JP7617810B2 - Map output device and map output system - Google Patents

Description

The present invention relates to a map output device and a map output system that output map data.

Patent document 1 discloses a navigation system. When an SD card is inserted, the navigation unit that constitutes the navigation system reads map data from the SD card and displays an image of the map on the display screen of a monitor.

The navigation unit is configured to assign a map update deadline to the SD card when the SD card is first inserted. The map data stored on the SD card is updated based on the map update deadline.

JP 2011-169825 A

However, the navigation system disclosed in Patent Document 1 calculates the map update deadline in the navigation unit, so if the specifications related to the calculation of the map update deadline are changed, the change process must be made in each navigation unit installed in two or more automobiles, which is time-consuming.

The present invention aims to provide a map output device and a map output system that can reduce the effort required when changing specifications related to the calculation of update deadlines for map data.

The map output device according to the first aspect of the present disclosure is mounted on a mobile body. The map output device outputs map data. The map output device includes a connection unit and an in-vehicle control unit. A recording medium is connected to the connection unit. The recording medium stores map data. The in-vehicle control unit controls the connection unit. The in-vehicle control unit stores usage start information in the recording medium. The usage start information specifies the time when the recording medium is connected to the connection unit for the first time. Alternatively, the usage start information specifies the time when the mobile body has been used beyond a predetermined usage amount. The in-vehicle control unit updates the map data within a predetermined period from the time specified by the usage start information. The map data is map data stored in the recording medium.

The map output device of the first aspect can store in the recording medium the start-of-use information required when, for example, setting the update deadline for map data on the server. For example, if the server is configured to calculate the update deadline for map data, when the specifications related to the calculation of the update deadline are changed, the change process can be performed on the server, without performing the change process on each map output device. Therefore, the map output device can update the map data stored in the recording medium, and the effort required to change the specifications related to the calculation of the update deadline for map data can be reduced.

A map output system according to a second aspect of the present disclosure includes a map output device and a server. The map output device is mounted on a mobile body. The map output device outputs map data. The server communicates with the map output device. The map output device includes a connection unit and an in-vehicle control unit. A recording medium is connected to the connection unit. The recording medium stores map data. The in-vehicle control unit controls the connection unit. The in-vehicle control unit stores usage start information in the recording medium. The usage start information specifies when the recording medium is connected to the connection unit for the first time. Alternatively, the usage start information specifies when the mobile body has been used beyond a predetermined usage amount. The server sets an update deadline based on the usage start information. The update deadline is a deadline by which the map data stored in the recording medium can be updated.

The map output system of the second aspect can store in the recording medium the start-of-use information required when setting the update deadline for map data on the server. Therefore, when changing the specifications for calculating the update deadline, the map output system can reduce the effort required when changing the specifications for calculating the update deadline for map data by performing the change process on the server rather than performing the change process on each map output device.

In a map output system according to a third aspect of the present disclosure, the recording medium stores initial usage information in advance. The initial usage information indicates a predetermined character string. When the recording medium is connected to the connection unit for the first time, the in-vehicle control unit changes the initial usage information stored in the recording medium to start-of-use information. Alternatively, when the mobile body is used beyond a predetermined usage amount, the in-vehicle control unit changes the initial usage information stored in the recording medium to start-of-use information.

The map output system of the third aspect can store the start-of-use information in the recording medium in which the initial use information is stored. Therefore, the map output system can update the map data in the genuine recording medium in which the initial use information is stored.

In the map output system according to the fourth aspect of the present disclosure, the server sets an update deadline for a recording medium in which usage start information is not stored, based on the date on which the map output device accesses the server.

The map output system of the fourth aspect can set an update deadline even for a recording medium in which usage start information is not stored.

The present invention can reduce the effort required when changing the specifications for calculating the update deadline for map data.

1 is a configuration diagram of a map output system according to an embodiment of the present invention; 11 is a table showing information stored in a first recording medium. 4 is a flowchart showing a start-up process of the map output device. 5 is a flowchart showing a process of updating map data via a map output device. 5 is a flowchart showing a process of updating map data via a personal PC. Configuration diagram of the production system. A flow diagram of the processes carried out in the fabrication system. FIG. 13 is a diagram showing an image of a process executed in an update process. 1 is a flow chart of the process executed in the update process. FIG. 2 is a block diagram showing an example of a hardware configuration of the map output device according to the embodiment.

A map output system 1 according to one embodiment of the present invention includes a first recording medium 2, a map output device 3, a first server 4, a second server 5, and a personal computer 6. In this embodiment, the map output system 1 includes two or more first recording media 2 and two or more map output devices 3.

The first recording medium 2 includes a first medium management unit 21, a first storage unit 22, and a first control unit 23. In this embodiment, the first recording medium 2 is a secure digital (SD) card.

The map output device 3 includes an output unit 31, an on-board storage unit 32, an input/output unit 33, a connection unit 34, an on-board control unit 35, and an on-board communication unit 36. The on-board control unit 35 includes a mileage acquisition unit 37, a determination unit 38, and a data processing unit 39. In this embodiment, the map output device 3 is a navigation device. The map output device 3 is mounted on a moving body 30. In this embodiment, the moving body 30 is a vehicle. The vehicle is, for example, an automobile, a motorcycle, a bicycle, or a train.

The first server 4 includes a first server storage unit 41, a first server communication unit 42, and a first server control unit 43. The second server 5 includes a second server storage unit 51, a second server communication unit 52, and a second server control unit 53. In this embodiment, the first server 4 and the second server 5 are managed by different organizations. In this embodiment, the first server 4 is managed by an organization involved in the manufacture of the map output device 3, and the second server 5 is managed by a sales company of the map data 11.

The personal computer 6 includes a display unit 61, a PC storage unit 62, a PC communication unit 63, a PC interface 64, and a PC control unit 65. The personal computer 6 is a general computer that is personally owned by a user. Hereinafter, the personal computer 6 is also referred to as a "personal PC 6."

The map output device 3 is mounted on the mobile object 30. When the first recording medium 2 is inserted into the connection unit 34, the map output device 3 reads the map data 11 shown in FIG. 2 from the first storage unit 22, and displays on the output unit 31 a map showing the position of the mobile object 30 and the route to the destination.

The first recording medium 2 is a genuine product. The first recording medium 2 is, for example, a recording medium that is recognized as genuine by the manufacturer or distributor of the map output device 3. The first recording medium 2 is sold as a set with the map output device 3. Alternatively, the first recording medium 2 is sold separately. Below, a recording medium without a reference number indicates a recording medium that is not a genuine product.

For the user of the map output device 3, the newer the version of the map data 11, the more preferable it is. Older versions of map data 11 are more likely to cause inconvenience to the user of the map output device 3 than newer versions of map data 11. For example, older versions of map data 11 do not include road information corresponding to newly installed roads and facility information corresponding to newly constructed facilities. In this case, the map output device 3 cannot search for a route that passes through a new road or set a new facility as a destination. The first recording medium 2 is configured such that the information stored in the first storage unit 22 is read by the personal PC 6, just like commercially available recording media. Therefore, there is a risk that the latest map data 11 may be illegally copied to another first recording medium 2 or a commercially available recording medium.

As a security measure for the map data 11, in this embodiment, the map output device 3 is configured to read the map data 11 from the first recording medium 2, and not from a commercially available recording medium. The map output device 3 is configured to read the map data 11 from a first recording medium 2 in which the information has not been illegally rewritten. Therefore, illegally copied map data 11 cannot be used by the map output device 3.

The map output device 3 is also configured not to read map data 11 from a first recording medium 2 that has been used by another map output device 3. When the first recording medium 2 is connected to the connection unit 34, the data processing unit 39 writes vehicle identification information of the mobile body 30 on which the map output device 3 is mounted to the first storage unit 22. The vehicle identification information is different for each of the two or more mobile bodies 30. The first recording medium 2 is linked to a specific mobile body 30 by the vehicle identification information. Hereinafter, the process in which the data processing unit 39 writes the vehicle identification information to the first storage unit 22 is referred to as a "lock process." The map output system 1 can prevent the first recording medium 2 from being reused by two or more map output devices 3 by the lock process.

<Configuration of first recording medium 2>
The first medium management unit 21 stores medium identification information. The medium identification information is information capable of identifying each of the two or more first recording media 2. The medium identification information indicates an arbitrary character string. The character string includes, for example, at least one of numbers, letters, symbols, etc. The medium identification information stored in the first medium management unit 21 is set to a different character string for each of the two or more first recording media 2.

The first medium management unit 21 is a memory configured so that it cannot be read or written by the personal PC 6. The first medium management unit 21 is configured so that it can be written and read only when certain conditions are met. In this embodiment, the certain conditions are determined by the manufacturer of the first recording medium 2. The certain condition is, for example, the use of a certain management program corresponding to the first medium management unit 21. The medium-specific information stored in the first medium management unit 21 cannot be read or rewritten by the user of the map output device 3.

In this embodiment, a portion of the medium-specific information is common to two or more first recording media 2. The common information is set, for example, in association with the map output device 3. The common information indicates, for example, the name of the organization that manufactures the map output device 3, the product name of the map output device 3, or the product name of the mobile object 30 on which the map output device 3 is mounted. The first server 4 uses the common information in the update process of the map data 11.

The first storage unit 22 stores various types of information. In this embodiment, the first storage unit 22 stores map data 11, map difference data 15, a vehicle-specific file 12, a usage date file 13, and a license file 14.

Map data 11 includes road information, facility information, version information, etc. The version information indicates the version of map data 11. Road information is represented by a combination of nodes and links. Nodes are set at intersections, ends of roads, etc. Links are set at positions that connect adjacent nodes. Facility information indicates, for example, the location and type of buildings, and the location and type of POIs (points of interest), etc.

The map data 11 is composed of data corresponding to, for example, a number of parcels. Parcels are set by dividing the earth's surface into rectangles of a given size based on latitude and longitude. The map data 11 stored in the first storage unit 22 is updated to a new version of the map data 11 via the map output device 3 or the personal PC 6.

The map difference data 15 is map data that differs from the map data 11 stored in the first storage unit 22. The map difference data 15 is handled in parcel units. New versions of the map difference data 15 are created more frequently than the map data 11 by the sales company of the map data 11, etc.

In this embodiment, the first server 4 stores the map difference data 15 of the latest version. The second server 5 stores the map difference data 15 of the latest version and the map data 11 of the latest version. The map data 11 stored in the first storage unit 22 is updated by storing the map difference data 15 of the latest version transmitted from the first server 4 in the first storage unit 22. Alternatively, the map data 11 stored in the first storage unit 22 is updated by replacing it with the map data 11 of the latest version transmitted from the second server 5. Alternatively, the map data 11 stored in the first storage unit 22 is updated by replacing it with the map data 11 of the latest version transmitted from the second server 5 and storing the map difference data 15 of the latest version transmitted from the second server 5 in the first storage unit 22. The output unit 31 can output a map based on the map data 11 and the map difference data 15 stored in the first storage unit 22. Hereinafter, updating the map data 11 stored in the first storage unit 22 is also referred to as "map update." Note that the map output system 1 may be configured such that the second server 5 does not store the map difference data 15.

By using the map difference data 15, the map output system 1 can reduce the time required to update the map compared to downloading the entire map data 11.

The vehicle-specific file 12 is a file indicating that the first recording medium 2 is an original product. As shown in FIG. 2, the vehicle-specific file 12 before the locking process includes vehicle initial information, medium-specific information, and version information. The vehicle initial information indicates a predetermined character string. The vehicle initial information is the same for each of the two or more first recording media 2. Therefore, the vehicle initial information is sometimes called an initial value. In this embodiment, the vehicle initial information is set by an organization involved in the manufacture of the map output device 3. If the information has not been illegally rewritten, the medium-specific information included in the vehicle-specific file 12 and the medium-specific information stored in the first medium management unit 21 are the same. Hereinafter, the version of the map data 11 will also be referred to as the "map version."

In this embodiment, the vehicle identification file 12 after the locking process includes vehicle identification information, medium identification information, and version information. The vehicle identification information can identify the mobile body 30 in which the map output device 3 is mounted. The vehicle identification information indicates a predetermined character string. The vehicle identification information is different for each of the two or more mobile bodies 30. The vehicle identification information is created based on the device identification information. The device identification information is specific and unique information that each mobile body 30 has. In this embodiment, the device identification information is set by the organization that manufactures the mobile body 30.

The locking process described above is a process for storing vehicle specific information in the first storage unit 22. In this embodiment, the locking process changes the vehicle initial information in the vehicle specific file 12 to the vehicle specific information.

The usage date file 13 and the license file 14 are used for map updates. As shown in FIG. 2, the usage date file 13 before the locking process includes initial usage information, medium identification information, and version information. The initial usage information indicates a character string different from the vehicle initial information. The initial usage information is the same for each of the two or more first recording media 2. In this embodiment, the initial usage information is set by an organization involved in the manufacture of the map output device 3.

When the first recording medium 2 is subjected to a locking process or a map update, use start information is stored in the first storage unit 22. The use start information indicates when the locking process was performed on the first recording medium 2. Alternatively, the use start information indicates when the first map update was performed on the first recording medium 2 for the first time. In these cases, the use start information is specified by at least one of the year, month, day, and time. In this embodiment, the use start information indicates the date. Although omitted in FIG. 2, if a map update is performed before the locking process, the use start information is stored in the first storage unit 22 even before the locking process. In this embodiment, the use date file 13 after the locking process or the map update includes the use start information, the medium specification information, and the version information.

The license file 14 before the locking process includes vehicle-specific information, medium-specific information, and version information. The license file 14 after the locking process includes vehicle-specific information, medium-specific information, version information, and flag information. The flag information is information that indicates that the first recording medium 2 has been locked. The inclusion of flag information in the license file 14 is determined by obtaining a bit from an area of numerical data that represents a set of flags.

The first server control unit 43 uses the usage date file 13 and the license file 14 when updating the map. The first server control unit 43 manages the update deadline and map version of the map data 11 for each first recording medium 2 based on the usage date file 13 and the license file 14. The update deadline is the deadline during which the map output system 1 can update the map data 11 stored in the first storage unit 22.

The first recording medium 2 stores the vehicle-specific file 12 and the usage date file 13 even before it is connected to the connection unit 34 for the first time. The license file 14 is created by the data processing unit 39 when the first recording medium 2 is connected to the connection unit 34 and stored in the first storage unit 22. The vehicle-specific file 12, the usage date file 13, and the license file 14 are each encrypted and stored in the first storage unit 22 to prevent unauthorized rewriting.

The first control unit 23 controls the first medium management unit 21 and the first storage unit 22.

Configuration of map output device 3
The output unit 31 displays a map based on the map data 11 stored in the first storage unit 22. Alternatively, the output unit 31 displays a map based on the map data 11 stored in the first storage unit 22 and the map difference data 15. The output unit 31 is configured by, for example, a liquid crystal display or the like.

The on-board storage unit 32 stores various information related to the navigation function, map updates, etc. In this embodiment, the on-board storage unit 32 pre-stores vehicle initial information, an encryption key, and a navigation program. The specified encryption key is an encryption key for encrypting and decrypting the vehicle-specific file 12, the usage date file 13, and the license file 14, respectively. The programs are various programs executed by the map output device 3. These programs include a program for starting the map output device 3, a program for updating the map, and a management program for reading out medium-specific information from the first medium management unit 21.

The in-vehicle storage unit 32 is realized by a storage device. Examples of the storage device include semiconductor memory elements such as RAM (Random Access Memory) and flash memory, or hard disks and optical disks.

The input/output unit 33 inputs and outputs data between the mobile body 30 and the map output device 3 mounted on the mobile body 30. The input/output unit 33 is configured, for example, by an I/O (Input/Output) interface.

The map output device 3 is connected to various car navigation sensors and input/output devices provided on the mobile unit 30 via the input/output unit 33. The car navigation sensors include a GPS (Global Positioning System) receiver, a direction sensor, and a distance sensor. The GPS receiver receives GPS signals from GPS satellites. The direction sensor detects the traveling direction of the mobile unit 30 or changes in that traveling direction. The distance sensor detects the speed and travel distance of the mobile unit 30.

The connection unit 34 is a device for exchanging data between the map output device 3 and the first recording medium 2. The connection unit 34 is configured so that the first recording medium 2 can be inserted. In this embodiment, the connection unit 34 is configured by an SD host module.

The in-vehicle control unit 35 controls each device included in the map output device 3. The mileage acquisition unit 37 controls the input/output unit 33 to acquire mileage information from the distance sensor. The mileage information is information indicating the mileage of the mobile object 30. The mileage is the cumulative distance traveled since the mobile object 30 was not used.

The judgment unit 38 makes a judgment to prevent unauthorized map data 11 from being used in the map output device 3. In this embodiment, when the first recording medium 2 is connected to the connection unit 34, the judgment unit 38 judges whether or not the vehicle-specific file 12 is stored in the first storage unit 22. A recording medium in which the vehicle-specific file 12 is not stored is not a genuine product. When the vehicle-specific file 12 is stored in the first storage unit 22, the judgment unit 38 judges whether or not the vehicle-specific file 12 is proper. The judgment unit 38 is configured to start the map output device 3 when the vehicle-specific file 12 is proper. When reading each piece of information contained in the vehicle-specific file 12, the judgment unit 38 decrypts the vehicle-specific file 12 with an encryption key stored in the in-vehicle storage unit 32.

To determine whether the vehicle-specific file 12 is appropriate, the judgment unit 38 judges whether the medium-specific information included in the vehicle-specific file 12 matches the medium-specific information stored in the first medium management unit 21. To determine whether the vehicle-specific file 12 is appropriate, the judgment unit 38 judges whether the version information included in the vehicle-specific file 12 matches the version information included in the map data 11.

When a first recording medium 2 on which a locking process has not been executed is connected to the connection unit 34, the determination unit 38 determines whether the vehicle initial information included in the vehicle specific file 12 matches the vehicle initial information stored in the vehicle storage unit 32. When a first recording medium 2 on which a locking process has already been executed is connected to the connection unit 34, the determination unit 38 determines whether the vehicle initial information included in the vehicle specific file 12 matches the vehicle specific information created by the data processing unit 39 based on the device identification information. When the vehicle initial information does not match, or when the vehicle specific information does not match, the determination unit 38 is configured not to start the map output device 3. For example, a first recording medium 2 that has been locked by another map output device 3 is not authenticated by the determination unit 38 because the vehicle specific information included in the vehicle specific file 12 does not match the vehicle specific information created by the data processing unit 39.

At least one of the vehicle initial information, vehicle specific information, medium specific information, and version information of the vehicle specific file 12 that has been illegally copied or rewritten does not correspond to at least one of the vehicle initial information stored in the on-board storage unit 32, the vehicle specific information created by the data processing unit 39, the medium specific information stored in the first medium management unit 21, and the version information included in the map data 11. Therefore, the map output device 3 can prevent an illegal first recording medium 2 from being used. In this embodiment, the judgment unit 38 makes the above judgment each time the first recording medium 2 is inserted into the connection unit 34.

When the first recording medium 2 is connected to the connection unit 34, the judgment unit 38 judges whether the first storage unit 22 stores the license file 14. When the first storage unit 22 stores the license file 14, the judgment unit 38 judges whether the license file 14 is appropriate. Specifically, the judgment unit 38 judges whether the vehicle identification information included in the license file 14 matches the vehicle identification information created by the data processing unit 39. The judgment unit 38 judges whether the medium identification information included in the license file 14 matches the medium identification information stored in the first medium management unit 21. The judgment unit 38 judges whether the version information included in the license file 14 matches the version information of the map data 11 stored in the first storage unit 22. The match of all of this information means that the information included in the license file 14 matches the current situation. When reading the information included in the license file 14, the judgment unit 38 decrypts the license file 14 with the encryption key stored in the in-vehicle storage unit 32.

The determination unit 38 determines whether the mileage information acquired by the mileage acquisition unit 37 has exceeded a predetermined value for the locking process. The determination unit 38 determines whether the locking process has already been executed on the first recording medium 2 inserted into the connection unit 34 based on the vehicle initial information or vehicle specific information contained in the vehicle specific file 12.

The data processing unit 39 creates the license file 14 based on the judgment of the judgment unit 38. The data processing unit 39 creates the license file 14 when the license file 14 is not stored in the first storage unit 22 and when the license file 14 stored in the first storage unit 22 is not appropriate. The data processing unit 39 creates the license file 14, for example, based on the device identification information, the medium specification information stored in the first medium management unit 21, and the map data 11 and the vehicle specification file 12 stored in the first storage unit. The data processing unit 39 encrypts the newly created license file 14 with the encryption key stored in the in-vehicle storage unit 32. The data processing unit 39 stores the encrypted license file 14 in the first storage unit 22. When the license file 14 is already stored in the first storage unit 22, the data processing unit 39 overwrites the license file 14 stored in the first storage unit 22 with the newly created license file 14. The data processing unit 39 can update the license file 14 stored in the first storage unit 22 to contents that correspond to the current situation.

The data processing unit 39 executes a lock process when the mobile object 30 has traveled beyond a predetermined travel distance. Specifically, when the determination unit 38 determines that the travel distance information has exceeded a predetermined value, the data processing unit 39 creates a vehicle specific file 12. The vehicle specific file 12 created by the data processing unit 39 includes vehicle specific information, medium specific information, and version information. The data processing unit 39 creates the vehicle specific information based on the device identification information. The data processing unit 39 creates the vehicle specific information from the device identification information, for example, by hashing. The data processing unit 39 encrypts the vehicle specific file 12 with an encryption key stored in the in-vehicle storage unit 32. The data processing unit 39 overwrites the vehicle specific file 12 stored in the first storage unit 22 with the newly created vehicle specific file 12. This allows the data processing unit 39 to change the vehicle initial information included in the vehicle specific file 12 to the vehicle specific information.

The specified value is not particularly limited. For example, the specified value is set to a value between 10 km and 100 km. It is preferable that the specified value is set to a value between 10 km and 50 km. It is more preferable that the specified value is set to a value between 10 km and 30 km. It is even more preferable that the specified value is set to a value between 10 km and 20 km.

The data processing unit 39 may be configured to perform the locking process based on the output period during which the map data 11 was output to the output unit 31, instead of the mileage. In this configuration, the data processing unit 39 executes the locking process when the map data 11 stored in the first storage unit 22 has been used for a certain period. The certain period is, for example, from one hour to one year. The certain period is preferably from one hour to 24 hours. The certain period is more preferably from one hour to 10 hours. In this configuration, the on-board control unit 35 preferably has, for example, a timer function for measuring time.

The case where the vehicle has traveled more than a predetermined distance corresponds to the case where the vehicle has been used in excess of a predetermined amount. The amount of usage is a parameter that indicates the extent to which the vehicle has been used. In other words, the data processing unit 39 may be configured to perform the locking process based on a parameter that indicates that the mobile unit 30 has been used not only temporarily but fully. The distance traveled and the output period of the map data 11 are parameters that indicate that the mobile unit 30 has been used fully. The distance traveled and the output period of the map data 11 each correspond to the amount of usage. The data processing unit 39 may be configured to perform the locking process when the mobile unit 30 has been used in excess of a predetermined amount.

After the mobile unit 30 has traveled a predetermined distance, the data processing unit 39 performs a locking process each time another first recording medium 2 that has not been locked is inserted into the connection unit 34.

The data processing unit 39 is not limited to a configuration that performs locking processing based on the amount of usage of the mobile unit 30, and may be configured to perform locking processing, for example, when the first recording medium 2 is inserted into the connection unit 34 for the first time. Examples of when the first recording medium 2 is inserted into the connection unit 34 for the first time include when the map output device 3 detects that the first recording medium 2 has been connected to the connection unit 34, and when the map data 11 read from the first recording medium 2 is output to the output unit 31 for the first time.

When executing a lock process on a first recording medium 2 that does not store start-of-use information, the data processing unit 39 creates a use date file 13. The use date file 13 created by the data processing unit 39 includes start-of-use information, medium identification information, and version information. The data processing unit 39 creates the start-of-use information based on the GPS signal received by the GPS receiver. The data processing unit 39 encrypts the created use date file 13 with an encryption key stored in the in-vehicle storage unit 32. The data processing unit 39 controls the connection unit 34 so that the encrypted use date file 13 is overwritten and saved in the first storage unit 22. In this way, the data processing unit 39 stores the start-of-use information in the first storage unit when the travel distance of the mobile unit 30 reaches a predetermined value and the reception date and time is confirmed by the GPS receiver.

In this embodiment, the map output device 3 performs a map update using the map difference data 15. The in-vehicle control unit 35 automatically performs the map update process at a predetermined time interval, for example, once a month. When performing a map update, the in-vehicle control unit 35 requests the first server 4 for the latest version. The request for the latest version is a request to have the first server 4 transmit the map difference data 15 of the latest version to the map output device 3. In this embodiment, when requesting the latest version, the data processing unit 39 transmits the version information and medium specification information of the map data 11 stored in the first storage unit 22 to the first server 4. Specifically, the data processing unit 39 transmits the usage date file 13 and the license file 14 to the first server 4.

When the data processing unit 39 receives map difference data 15 from the first server 4, it controls the connection unit 34 so that the map difference data 15 is written to the first memory unit 22.

When performing a map update, the data processing unit 39 creates a vehicle-specific file 12 whose version information indicates the latest map version based on the map difference data 15 received from the first server 4. The data processing unit 39 encrypts the created vehicle-specific file 12 with an encryption key stored in the on-board storage unit 32. The data processing unit 39 controls the connection unit 34 so that the encrypted vehicle-specific file 12 is overwritten and saved in the first storage unit 22.

The connection unit 34 exchanges data between the map output device 3 and the first recording medium 2. The connection unit 34 is configured so that the first recording medium 2 can be inserted. In this embodiment, the connection unit 34 is an SD host module. The connection unit 34 is not limited to an SD host module as long as it can read data from the first recording medium 2.

The in-vehicle control unit 35 is realized, for example, by a central processing unit (CPU) or a micro processing unit (MPU) executing a program stored in the in-vehicle storage unit 32.

The in-vehicle communication unit 36 communicates with the first server 4 and the second server 5 via the Internet 10. In this embodiment, the in-vehicle communication unit 36 is configured as a telecommunication control unit (TCU).

<Configuration of first server 4>
In the case of a map update via the map output device 3, the map output system 1 determines whether or not the map update is possible in the first server 4, and if the map update is possible, performs the map update using the map difference data 15 received from the first server 4. In the case of a map update via the personal PC 6, the map output system 1 determines whether or not the map update is possible in the first server 4, and if the map update is possible, performs the map update using the map data 11 and map difference data 15 received from the second server 5.

The first server storage unit 41 stores various types of information. The first server storage unit 41 prestores a specific encryption key, common information, a map database, map difference data 15, and a program. The specific encryption key is the same as the encryption key stored in the in-vehicle storage unit 32. The programs are various programs executed by the first server 4. The common information is the aforementioned information that is included in common in two or more first recording media 2 as part of the medium-specific information. The first server storage unit 41 stores two or more map difference data 15, each of which has a different version. The map difference data 15 stored in the first server storage unit 41 is updated to a new version of the map difference data 15 by the organization that manages the first server 4, for example, several times a year.

The map database is used to manage the update deadline for the map data 11. The map database stores medium-specific information, update deadline information, and version information in association with each other. The version information stored in the map database indicates the version of the map data 11 stored in the first storage unit 22.

The first server storage unit 41 is configured with a storage device. Examples of the storage device include semiconductor memory elements such as RAM and flash memory, or hard disks and optical disks.

The first server communication unit 42 communicates with the map output device 3 and the personal PC 6 via the Internet 10.

The first server control unit 43 controls the first server storage unit 41 and the first server communication unit 42. The first server control unit 43 makes decisions and performs processing for updating the map. When performing a map update, the map output device 3 or the personal PC 6 obtains the usage date file 13 and the license file 14 from the first storage unit 22 and transmits them to the first server 4. The usage date file 13 and the license file 14 are data files required for the map output system 1 to perform a map update. The first server control unit 43 verifies the license file 14 transmitted from the map output device 3 or the personal PC 6. If the first server control unit 43 determines that the license file 14 can be decrypted with the encryption key stored in the first server storage unit 41 and that the license file 14 contains the above-mentioned common information, it authenticates the license file 14.

After authenticating the license file 14, the first server control unit 43 determines whether the first recording medium 2 to be the target of the map update has been granted the update right based on the license file 14 and the map database. The update right is the right to update the map data 11 stored in the first storage unit 22. The update right is granted for each first recording medium 2. If the same medium identification information as that contained in the license file 14 is registered in the map database in association with update deadline information and version information, the first server control unit 43 determines that the first recording medium 2 to be the target of the map update has been granted the update right. Note that if the license file 14 is not authenticated, the first server control unit 43 stops the map update process.

If the update right is granted, the first server control unit 43 determines whether or not a map update can be performed on the first recording medium 2 that is the target of the map update. Specifically, the first server control unit 43 determines whether or not the update deadline has passed. In addition, in the case of a map update via the map output device 3, the first server control unit 43 determines whether or not a newer version of the map difference data 15 than the map data 11 stored in the first storage unit 22 is stored in the first server storage unit 41 based on the map database and the license file 14. Alternatively, in the case of a map update via the personal PC 6, the first server control unit 43 determines whether or not a newer version of the map data 11 and the map difference data 15 than the map data 11 stored in the first storage unit 22 are stored in the second server storage unit 51 based on the map database and the license file 14. If the update deadline has already passed, the first server control unit 43 stops the map update process. If the first storage unit 22 already stores the latest version of the map data 11 and the map difference data 15, the first server control unit 43 stops the map update process.

If the update right is not granted, the first server control unit 43 grants the update right to the first recording medium 2 that is the target of the map update. The first server control unit 43 grants the update right to the first recording medium 2 in which the use start information is already stored, based on the use start information. The first server control unit 43 sets the update deadline so that the map update is performed within a predetermined period from the time specified by the use start information. In this embodiment, the first server control unit 43 sets the update deadline to the date when a predetermined number of years have passed since the date indicated by the use start information. In this embodiment, the date indicated by the use start information is considered to be the use start date, which is the date on which the first recording medium 2 began to be used by the map output device 3. The map output system 1 calculates the update deadline by setting the date indicated by the use start information as the first day, so even if the use start dates are different for two or more first recording media 2, the length of the period from the use start date to the update deadline is equal for each first recording medium 2. For a first recording medium 2 that does not store start-of-use information but stores initial use information, the first server control unit 43 calculates the update deadline based on the time when the map output device 3 or personal PC 6 accessed the first server 4. That is, the first server control unit 43 regards the date when the map output device 3 or personal PC 6 accessed the first server 4 as the start-of-use date, and sets the date a specified number of years after this date as the update deadline. The first server control unit 43 reflects the determined update deadline in the map database together with the medium identification information and version information of the first recording medium 2 that is the target of the map update. In this way, the first server control unit 43 grants the right to update to the first recording medium 2 that is the target of the map update.

If the license file 14 is authenticated, the first server control unit 43 creates authentication information. The authentication information is information that proves that the first server 4 has been accessed normally from the map output device 3 or the personal PC 6. The authentication information is expressed as a character string that has no particular meaning. The first server control unit 43 sets the validity period of the authentication information so that the map output system 1 can use the authentication information until one map update is completed. The validity period is, for example, 12 hours or 24 hours. The authentication information is transmitted between the first server 4 and the map output device 3 or the personal PC 6 together with various information. By using the authentication information, the map output system 1 does not need to transmit and decrypt the license file 14 every time it is accessed, so that the processing load of the map output system 1 can be reduced while taking security measures.

When a request for issuing the vehicle specific file 12 and the usage date file 13 is made from the personal PC 6 in a map update via the personal PC 6, the first server control unit 43 creates the vehicle specific file 12 and the usage date file 13. The first server control unit 43 encrypts the created vehicle specific file 12 and usage date file 13 based on the encryption key stored in the first server storage unit 41. In the case of a map update via the personal PC 6, the personal PC 6 obtains the map data 11 from the second server 5.

The vehicle-specific file 12 created by the first server control unit 43 indicates the latest map version in version information. Therefore, when the first recording medium 2 with an updated map is connected to the connection unit 34, the vehicle-specific file 12 is determined to be appropriate by the judgment unit 38. If the version information included in the vehicle-specific file 12 is not updated after the map update, the next time the first recording medium 2 is connected to the connection unit 34, the version information included in the vehicle-specific file 12 and the version information of the map data 11 stored in the first storage unit 22 will not match, and the vehicle-specific file 12 will not be authenticated by the judgment unit 38. When creating the vehicle-specific file 12, the first server control unit 43 obtains the version information of the map data 11 downloaded from the second server 5 from the personal PC 6.

The version information of the usage date file 13 created by the first server control unit 43 is not updated. Therefore, the map output system 1 can leave the version information of the map data 11 originally stored in the first recording medium 2 in the usage date file 13 even after a map update. In this way, when performing a map update on the first recording medium 2 that pre-stores the map data 11 and the vehicle specific file 12 and usage date file 13 that respectively store the version information, the map output device 3 updates the vehicle specific information contained in the vehicle specific file 12 to vehicle specific information indicating the latest map version. The version information of the map data 11 originally stored in the first recording medium 2 is used, for example, for analysis when a bug occurs.

When a map update is performed, the first server control unit 43 updates the version information stored in the map database to match the version of the map data 11 or map difference data 15 newly stored in the first storage unit 22.

The first server control unit 43 is realized, for example, by a CPU, an MPU, or the like executing a program stored in the first server storage unit 41.

<Configuration of personal PC 6>
In this embodiment, the personal PC 6 performs map updates using the map data 11, without using the map difference data 15. The personal PC 6 corresponds to an update unit. The update unit is not limited to the personal PC 6, and may be a smartphone, a tablet terminal, or the like.

The display unit 61 is, for example, a liquid crystal display.

The PC storage unit 62 stores various programs and the like. These programs include an update tool program, a program necessary for processing performed by the PC 6, and a program for reading medium-specific information from the first medium management unit 21. The update tool is dedicated software for map updates. The update tool is programmed to download update map data 11 from the second server 5 to the personal PC 6 and overwrite the map data 11 stored in the first storage unit 22 with the downloaded update map data 11. Map updates via the personal PC 6 are performed by the user using the update tool installed on the personal PC 6.

The PC communication unit 63 communicates with the first server 4 and the second server 5 via the Internet 10. The PC interface 64 is a device for exchanging data between the personal PC 6 and the first recording medium 2. The PC interface 64 is configured so that the first recording medium 2 can be inserted.

The PC control unit 65 controls the PC memory unit 62, the PC communication unit 63, and the PC interface 64.

When performing a map update, the PC control unit 65 sends the usage date file 13 and the license file 14 to the first server 4.

When the first server control unit 43 determines that a map update can be performed on the first recording medium 2, the PC control unit 65 determines the version of the map data 11 for update. The PC control unit 65 can determine the latest version of the map data 11 that can be downloaded from the second server 5, among the map data 11 for update stored in the second server storage unit 51. The PC control unit 65 communicates the determined version to the second server 5. The PC control unit 65 controls the PC interface 64 to store the map data 11 transmitted from the second server 5 in the first storage unit 22. The PC control unit 65 may be configured to be able to obtain information required to determine the latest map version from at least one of the first server 4 and the second server 5.

When the PC control unit 65 receives update map data 11 and map difference data 15 from the second server 5, it requests the first server 4 to issue the vehicle-specific file 12 and usage date file 13 described above. When making a request to issue the vehicle-specific file and usage date file 13, the PC control unit 65 communicates to the first server 4 the version of the update map data 11 sent from the second server 5. Hereinafter, the request to issue the vehicle-specific file 12 and usage date file 13 is also referred to as a "file issue request."

The PC control unit 65 controls the PC interface 64 so that the update map data 11 and map difference data 15 received from the second server 5, and the vehicle-specific file 12 and usage date file 13 received from the first server 4 are stored in the first storage unit 22, respectively.

The PC control unit 65 is realized, for example, by a CPU, an MPU, or the like executing a program stored in the PC memory unit 62.

<Configuration of second server 5>
The second server 5 has a configuration similar to that of the first server 4, and a description of the same configuration as that of the first server 4 will be omitted. The second server 5 differs from the first server 4 in that it stores update map data 11 in a second server storage unit 51. The second server 5 differs from the first server 4 in that it does not store a predetermined encryption key and a map database. The map data 11 and map difference data 15 stored in the second server storage unit 51 are updated to new versions of the map data 11 by an organization that manages the second server 5, for example, several times a year.

When the second server control unit 53 is notified of the map version determined by the personal PC 6 in a map update via the personal PC 6, it acquires the map data 11 for update and the map difference data 15 corresponding to that version from the second server storage unit 51. The second server control unit 53 transmits the map data 11 and the map difference data 15 acquired from the second server storage unit 51 to the personal PC 6.

<<Transition of information stored in first recording medium 2>>
Before being connected to the connection unit 34 for the first time, the first recording medium 2 stores the map data 11, the vehicle specific file 12, and the usage date file 13. The vehicle specific file 12 includes vehicle initial information. When the first recording medium 2 is connected to the connection unit 34, it further stores the license file 14.

The first recording medium 2 that has been locked stores vehicle identification information and start-of-use information. In this embodiment, the vehicle initial information in the vehicle identification file 12 is changed to vehicle identification information by the locking process. The initial use information in the use date file 13 is changed to start-of-use information by the locking process.

The first recording medium 2, whose map has been updated via the map output device 3, further stores map difference data 15. Furthermore, the version information of the vehicle-specific file 12 and license file 14 stored in the first storage unit 22 has been updated to the latest map version. The first recording medium 2, whose map has been updated via the personal PC 6, stores the vehicle-specific file 12 and license file 14, whose version information has been updated to the latest map version.

<<Start-up process of map output device 3>>
When the first recording medium 2 is inserted into the connection unit 34 and power is supplied to the map output device 3, the map output device 3 starts the start-up process shown in FIG.

In step S11, the judgment unit 38 judges whether or not a vehicle-specific file 12 is stored in the first storage unit 22. If the vehicle-specific file 12 is stored in the first storage unit 22, the judgment unit 38 advances the startup process of the map output device 3 to step S12. If the vehicle-specific file 12 is not stored in the first storage unit 22, the judgment unit 38 advances the startup process of the map output device 3 to step S13.

In step S12, the judgment unit 38 judges whether the vehicle-specific file 12 is appropriate. If the vehicle-specific file 12 is appropriate, the judgment unit 38 advances the startup process of the map output device 3 to step S14. If the vehicle-specific file 12 is not appropriate, the judgment unit 38 advances the startup process of the map output device 3 to step S13.

In step S13, the determination unit 38 does not authenticate the first recording medium 2 inserted into the connection unit 34. The determination unit 38 causes the output unit 31 to output an error screen, and ends the startup process of the map output device 3. When the error screen is output, the map output device 3 does not read the map data 11 from the first recording medium 2, and cannot perform navigation.

In step S14, the determination unit 38 starts the map output device 3.

In step S15, the determination unit 38 determines whether or not the license file 14 is stored in the first storage unit 22. If the license file 14 is stored in the first recording medium 2, the determination unit 38 advances the startup process of the map output device 3 to step S16. If the license file 14 is not stored in the first recording medium 2, the determination unit 38 advances the startup process of the map output device 3 to step S17.

In step S16, the judgment unit 38 judges whether the license file 14 is appropriate. If the license file 14 is appropriate, the judgment unit 38 advances the start-up process of the map output device 3 to step S19. If the license file 14 is not appropriate, the judgment unit 38 advances the start-up process of the map output device 3 to step S17.

In step S17, the data processing unit 39 creates the license file 14.

In step S18, the data processing unit 39 writes the license file 14 created in step S17 to the first storage unit 22. If the license file 14 is stored in the first storage unit 22, the data processing unit 39 overwrites the license file 14 stored in the first storage unit 22 with the license file 14 created in step S17.

In step S19, the determination unit 38 determines whether the travel distance of the mobile object 30 exceeds a predetermined value. If the mobile object 30 has traveled a distance exceeding the predetermined value, the determination unit 38 advances the startup process of the map output device 3 to step S20. If the mobile object 30 has not traveled a distance exceeding the predetermined value, the determination unit 38 ends the startup process of the map output device 3. In this case, the map output device 3 becomes ready to perform navigation.

In step S20, the judgment unit 38 judges whether the first recording medium 2 inserted into the connection unit 34 is a first recording medium 2 that has already been locked. If a first recording medium 2 that has already been locked is inserted into the connection unit 34, the judgment unit 38 ends the startup process of the map output device 3. This enables the navigation function of the map output device 3. If the lock process has not yet been executed on the first recording medium 2, the judgment unit 38 advances the startup process of the map output device 3 to step S21.

In step S21, the data processing unit 39 executes a locking process. After the locking process, the map output device 3 is in a state in which it can perform navigation.

<<Updating process of map data 11 via map output device 3>>
When performing a map update on the first recording medium 2 in which the license file 14 is stored in the first storage unit 22, the in-vehicle control unit 35 controls the in-vehicle communication unit 36 to transmit data files necessary for the map update to the first server 4 in step S21 shown in Fig. 4. In this embodiment, the data files necessary for the map update are the use date file 13 and the license file 14.

After the data files required for the map update are received in step S22, the first server control unit 43 verifies the license file 14 in step S23.

In step S24, the first server control unit 43 determines whether or not the update right has been granted to the first recording medium 2 that is the target of the map update. If the update right has been granted, the first server control unit 43 advances the update process of the map data 11 to step S26. If the update right has not been granted, the first server control unit 43 advances the update process of the map data 11 to step S25.

In step S25, the first server control unit 43 determines the update deadline for the map data 11 based on the usage date file 13 received in step S23.

In step S26, the first server control unit 43 creates authentication information.

In step S27, the first server control unit 43 controls the first server communication unit 42 to transmit the authentication information created in step S26 to the map output device 3.

After the authentication information is received in step S28, the in-vehicle control unit 35 requests the latest version in step S29. When requesting the latest version, the in-vehicle control unit 35 controls the in-vehicle communication unit 36 to transmit the version information and medium identification information of the map data 11 stored in the first storage unit 22 and the authentication information received in step S28 to the first server 4.

In step S30, the first server control unit 43 determines the latest map version based on the map difference data 15 stored in the first server storage unit 41.

In step S31, the first server control unit 43 controls the first server communication unit 42 to transmit the map difference data 15 for the map version determined in step S30 and the authentication information created in step S27 to the map output device 3.

In step S32, the data processing unit 39 controls the connection unit 34 so that the map difference data 15 transmitted from the first server 4 is written to the first storage unit 22.

In step S33, the data processing unit 39 updates the vehicle specific file 12 stored in the first storage unit 22. The vehicle specific file 12 is updated by overwriting the vehicle specific file 12 stored in the first storage unit 22 with the vehicle specific file 12 created by the data processing unit 39.
<<Updating process of map data 11 via personal PC 6>>
When performing a map update on the first recording medium 2 in which the license file 14 is stored in the first storage unit 22, the PC control unit 65 controls the PC communication unit 63 to transmit data files necessary for the map update to the first server 4 in step S41 shown in Fig. 5. In this embodiment, the data files necessary for the map update are the use date file 13 and the license file 14.

The processing in steps S42 to S46 is similar to the processing in steps S22 to S26 shown in FIG. 4.

In step S47, the first server control unit 43 controls the first server communication unit 42 to transmit the authentication information created in step S46 to the personal PC 6.

After the authentication information is received in step S48, the PC control unit 65 determines the latest map version in step S49.

In step S50, the PC control unit 65 controls the PC communication unit 63 to send version information indicating the map version determined in step S49 to the second server 5.

After the version information is received in step S51, the second server control unit 53 controls the second server communication unit 52 to transmit the update map data 11 and the map difference data 15 to the personal PC 6 in step S52. The map data 11 and the map difference data 15 transmitted to the personal PC 6 correspond to the version information received by the second server 5 in step 51.

In step S53, the PC control unit 65 writes the update map data 11 and the map difference data 15 sent by the second server 5 in step S52 to the first storage unit 22. As a result, the map data 11 stored in the first storage unit 22 is overwritten with the latest version of the map data 11. In addition, the first storage unit 22 stores the latest version of the map difference data 15.

In step S54, the PC control unit 65 requests the issuance of the vehicle-specific file 12 and the usage date file 13. When making a file issuance request, the PC control unit 65 controls the PC communication unit 63 to transmit the version information of the map data 11 received in step S53 and the authentication information received in step S48 to the first server 4.

In step S55, the first server control unit 43 creates a vehicle-specific file 12 indicating the latest map version and a usage date file 13 in which the version information has not been updated.

In step S56, the first server control unit 43 controls the first server communication unit 42 to transmit the vehicle specific file 12 and the usage date file 13 created in step S55, and the authentication information created in step S47, to the personal PC 6.

In step S57, the PC control unit 65 controls the PC interface 64 to write the vehicle-specific file 12 and the usage date file 13 sent by the first server 4 in step S56 to the first memory unit 22.

As described above, the map output device 3 of this embodiment is mounted on the mobile body 30. The map output device 3 outputs the map data 11. The map output device 3 includes a connection unit 34 and an in-vehicle control unit 35. The first recording medium 2 is connected to the connection unit 34. The first recording medium 2 stores the map data 11. The in-vehicle control unit 35 controls the connection unit 34. The in-vehicle control unit 35 stores the use start information in the first recording medium 2. The use start information specifies the time when the first recording medium 2 is connected to the connection unit 34 for the first time. Alternatively, the use start information specifies the time when the mobile body 30 has been used beyond a predetermined usage amount. The in-vehicle control unit 35 updates the map data 11 within the update deadline set based on the use start information. The map data 11 is the map data 11 stored in the first recording medium 2.

The map output device 3 can store in the first recording medium 2 the start-of-use information required when, for example, setting an update deadline for map data in the first server 4. For example, if the first server 4 is configured to calculate the update deadline for the map data 11, when specifications related to the calculation of the update deadline are changed, the change process can be performed in the first server 4 without performing the change process in each map output device 3. Therefore, the map output device 3 can update the map data 11 stored in the first recording medium 2, and the effort required can be reduced if specifications related to the calculation of the update deadline for the map data 11 are changed.

In the map output system 1 of this embodiment, when the map output device 3 cannot access the first server 4 for a long period of time, the map output device 3 can record the start date of use on the first recording medium 2 according to a specific rule. In this embodiment, the specific rule is the timing of the lock process. Therefore, even if the map output device 3 accesses the first server 4 later, the map output system 1 prevents the first server 4 from being unable to know the true start date of use of the first recording medium 2, or from having a large error in the start date of use of the first recording medium 2, and allows the first server 4 to know the accurate start date of use.

<<Method of producing the first recording medium>>
The first recording medium 2, which stores the map data 11, the vehicle specific file 12, and the usage date file 13, is produced by a production system 100 shown in FIG. 6. The production system 100 includes the first recording medium 2, the second recording medium 120, the third recording medium 130, and a computer 140. The second recording medium 120 includes a second storage unit 121 and a second control unit 122. The third recording medium 130 includes a third medium management unit 131, a third storage unit 132, and a third control unit 133. The computer 140 includes a first interface 141, a second interface 142, a third interface 143, a storage device 144, and a control device 145. The storage device 144 includes a volatile memory 146 and a non-volatile memory 147. In this embodiment, the computer 140 is owned by the manufacturer of the first recording medium 2. Hereinafter, the computer 140 is also described as a "manufacturer's PC 140".

The production system 100 is a system for producing two or more first recording media 2. The production system 100 produces the first recording media 2 by executing the copy process S101 and update process S102 shown in FIG. 7. In this embodiment, the production system 100 is implemented by the manufacturer of the first recording media 2 at the request of an organization involved in the manufacture of the map output device 3. Note that in this embodiment, the medium identification information is written to the first medium management unit 21 by the manufacturer of the first recording media 2 before the copy process S101 shown in FIG. 7 is executed.

In this embodiment, the map data 11, the vehicle specific file 12, and the usage date file 13 are copied directly from the third recording medium 130 to two or more first recording media 2 in the copy step S101. The map data 11, the vehicle specific file 12, and the usage date file 13 are stored in advance in the third storage unit 132. As shown in FIG. 2, the vehicle specific file 12 stored in the third storage unit 132 includes vehicle initial information, medium initial information, and version information. The usage date file 13 stored in the third storage unit 132 includes usage initial information, medium initial information, and version information. The vehicle specific file 12 and the usage date file 13 are encrypted and stored in the third storage unit 132.

The production system 100 may be configured not to use the third recording medium 130 in the copy process S101. For example, the map data 11, the vehicle-specific file 12, and the usage date file 13 may be pre-stored in the non-volatile memory 147, and copied from the non-volatile memory 147 to the first recording medium 2 in the copy process S101.

In this embodiment, the third recording medium 130 is provided to the manufacturer of the first recording medium 2 by an organization involved in the manufacture of the map output device 3. In this embodiment, the map data 11 stored in the third storage unit 132 is the latest version of the map data 11 at the time the third recording medium 130 is provided to the manufacturer of the first recording medium 2.

The vehicle-specific file 12 copied from the third storage unit 132 to the first storage unit 22 in the copy process S101 includes vehicle initial information, medium initial information, and version information, as shown in FIG. 2. The vehicle-specific file 12 after the update process S102 includes vehicle initial information, medium initial information, and version information. The usage date file 13 copied from the third storage unit 132 to the first storage unit 22 in the copy process S101 includes usage initial information, medium initial information, and version information. The usage date file 13 after the update process S102 includes usage initial information, medium initial information, and version information.

In this embodiment, the third recording medium 130 is an SD card. The third recording medium 130 is electrically connected to the manufacturer PC 140 via the third interface 143. Note that the third recording medium 130 is not limited to an SD card as long as the manufacturer PC 140 can read data from it. In this embodiment, the first recording medium 2 and the third recording medium 130 are of the same type, but may be of different types.

The production system 100 uses the second recording medium 120 in the update step S102 for security measures of the encryption key. The second storage unit 121 stores an update program 123 and license information 124 in advance. In this embodiment, the second recording medium 120 is provided to the manufacturer of the first recording medium 2 by an organization involved in the manufacture of the map output device 3. The second storage unit 121 is configured, for example, by a semiconductor memory element such as a flash memory. Note that the second recording medium 120 only needs to store at least the update program 123 in advance, and does not need to store the license information 124.

The update program 123 is a program for updating the vehicle-specific file 12. As shown in FIG. 6, the update program 123 includes encrypted program data 123a. In this embodiment, the encrypted program data 123a is program data for decrypting or encrypting the vehicle-specific file 12 and the usage date file 13. The encrypted program data 123a includes an encryption key. The encryption key included in the encrypted program data 123a is the same as the encryption key pre-stored in the on-board storage unit 32. In this embodiment, the encryption key is a common key.

In this embodiment, the update program 123 cannot control the manufacturer PC 140 by itself. When the executable file 148 is executed, the update program 123 is read from the second storage unit 121 and stored in the volatile memory 146, and causes the control device 145 to execute processes such as decrypting and encrypting the vehicle-specific file 12. When the executable file 148 is executed, the update program 123 causes the control device 145 to execute processes such as decrypting and encrypting the usage date file 13.

The encryption key applied to the vehicle specific file 12, the encryption key applied to the usage date file 13, and the encryption key applied to the license file 14 may be different from each other. In this case, the on-board storage unit 32 needs to store in advance the encryption key applied to the vehicle specific file 12, the encryption key applied to the usage date file 13, and the encryption key applied to the license file 14. The encryption program data 123a may be program data for performing at least one of encryption and decryption on the vehicle specific file 12 and the usage date file 13. The update program 123 is configured like a library that is called by other programs to provide some function.

The encrypted program data 123a is designed to perform an update process in the update step S102 on files that are identical to the vehicle-specific file 12 and the usage date file 13 stored in the third storage unit 132. As described above, the vehicle-specific file 12 and the usage date file 13 are copied directly from the third recording medium 130 to the first recording medium 2 in the copy step S101. Therefore, if the vehicle-specific file 12 or the usage date file 13 copied to the first storage unit 22 in the copy step S101 is rewritten for some reason before the update step S102, the control device 145 may not be able to recognize the vehicle-specific file 12 and the usage date file 13, and may not be able to perform processing based on the encrypted program data 123a.

The second control unit 122 controls the second storage unit 121. The second control unit 122 writes information to the second storage unit 121 and reads information from the second storage unit 121. The second control unit 122 is composed of, for example, a controller.

In this embodiment, the second recording medium 120 is a USB memory. The second recording medium 120 is electrically connected to the manufacturer's PC 140 via the second interface 142. Note that the second recording medium 120 is not limited to a USB memory as long as the computer can read data from it. The second recording medium 120 may be an SD card, a microSD card, a nanoSD card, a CD-R, or the like. In this embodiment, the second recording medium 120 is a different type from the first recording medium 2 and the third recording medium 130, but may be the same type as the first recording medium 2 or the third recording medium 130.

The manufacturer PC 140 is configured so that the first recording medium 2, the second recording medium 120, and the third recording medium 130 can be attached and detached. In this embodiment, the first interface 141 and the third interface 143 are each an SD card interface. The first interface 141 may be an interface other than an SD card interface as long as it can read data from the first recording medium 2. Alternatively, the manufacturer PC 140 may be configured to read and write data from the first recording medium 2, the second recording medium 120, or the third recording medium 130 via another device. In this embodiment, the first interface 141 is configured so that two or more first recording media 2 can be connected simultaneously. The third interface 143 may be an interface other than an SD card interface as long as it can read data from the third recording medium 130. In this embodiment, the second interface 142 is a USB memory interface. The second interface 142 may be an interface other than a USB memory interface as long as it can read data from the second recording medium 120.

Volatile memory 146 temporarily stores the program code being executed by control device 145 and data necessary for this processing. Volatile memory 146 is a main storage device. Volatile memory 146 requires power to retain data. Therefore, all data stored in volatile memory 146 is erased when the power to manufacturer PC 140 is turned off. Volatile memory 146 is composed of, for example, RAM.

The non-volatile memory 147 stores data necessary for the control device 145 to execute various processes. The non-volatile memory 147 is an auxiliary storage device. The non-volatile memory 147 does not require power to retain data. The non-volatile memory 147 retains data even when the power to the manufacturer PC 140 is turned off. The non-volatile memory 147 is composed of, for example, a semiconductor memory element such as a flash memory, a hard disk, etc.

An executable file 148 is pre-stored in the non-volatile memory 147. The executable file 148 is a program for causing the manufacturer PC 140 to execute processes that do not require an encryption key among the processes executed in the update process S102. Processes that do not require an encryption key in the update process S102 include, for example, a process of reading medium-specific information from the first medium management unit 21, a process of reading the vehicle-specific file 12 and the usage date file 13 from the first storage unit 22, a process of reading the update program 123 from the second storage unit 121, and a process of writing the updated vehicle-specific file 12 and the usage date file 13 back to the first storage unit 22.

The executable file 148 corresponds to a predetermined condition for reading the medium-specific information from the first medium management unit 21. For example, a predetermined management program corresponding to the first medium management unit 21 is incorporated into the executable file 148 so that the medium-specific information can be read from the first medium management unit 21. The executable file 148 is designed to correspond to the first recording medium 2, the vehicle-specific file 12, and the usage date file 13 so that the control device 145 can read the vehicle-specific file 12 and the usage date file 13 from the first storage unit 22. In this embodiment, the executable file 148 is created by the manufacturer of the first recording medium 2.

The control device 145 controls the first interface 141, the second interface 142, the third interface 143, and the storage device 144. The control device 145 is, for example, a CPU or an MPU.

In the copy step S101, the control device 145 controls the third interface 143 to read the map data 11, the vehicle specific file 12, and the usage date file 13 from the third storage unit 132. The control device 145 controls the first interface 141 to store the read map data 11, the vehicle specific file 12, and the usage date file 13 on two or more first recording media 2, respectively. As a result, the map data 11, the encrypted vehicle specific file 12, and the usage date file 13 are stored on two or more first recording media 2, respectively.

In the update step S102, the control device 145 executes the update process based on the executable file 148 and the update program 123 shown in Figures 6 and 8. Specifically, in step S105 of Figures 8 and 9, the control device 145 controls the first interface 141 to read the vehicle-specific file 12 and the usage date file 13 from the first storage unit 22 based on the executable file 148. The control device 145 also controls the first interface 141 to read the medium-specific information from the first medium management unit 21. Note that in Figures 8 and 9, the vehicle-specific file 12 and the usage date file 13 are simply referred to as "files 12, 13."

In step S106, the control device 145 controls the second interface 142 to read the license information 124 from the second storage unit 121 based on the executable file 148. If the control device 145 approves the license information 124, it controls the second interface 142 and the volatile memory 146 to read the update program 123 from the second storage unit 121 based on the executable file 148 and store the read update program 123 in the volatile memory 146. If the license information 124 is not stored in the second recording medium 120, the control device 145 reads the update program 123 from the second storage unit 121 in step S106 without approval based on the license information 124.

In step S107 of FIG. 9, the control device 145 decrypts the vehicle-specific file 12 and the usage date file 13 read in step S105 based on the encrypted program data 123a.

In step S108, the control device 145 controls the volatile memory 146 to change the media initial information contained in the vehicle-specific file 12 and the usage date file 13 to the media-specific information based on the media-specific information read in step S105 and the update program 123 read in step S106.

In step S9, the control device 145 encrypts the vehicle specific file 12 and the use date file 13 based on the encryption program data 123a. Note that the encryption key used to encrypt the vehicle specific file 12 and the use date file 13 in step S9 may be different from the encryption key used to decrypt the vehicle specific file 12 and the use date file 13 in step S107, as long as it is the same as the encryption key stored in the vehicle storage unit 32. If the encryption keys are different for encryption and decryption, the encryption program data 123a must include two different encryption keys. In this case, the vehicle specific file 12 and the use date file 13 in the third recording medium 130 must be encrypted with the same encryption key as the encryption key used to decrypt the vehicle specific file 12 and the use date file 13 in step S107. Note that the encryption key is not limited to a common key, and may be, for example, a public key or a private key.

In step S110 of FIG. 8 and FIG. 9, the control device 145 controls the first interface 141 to write the vehicle-specific file 12 and the usage date file 13 encrypted in step S109 to the first recording medium 2 based on the executable file 148.

In this way, the control device 145 updates the vehicle-specific file 12 and the usage date file 13 stored in the first storage unit 22 in the update step S102. This allows the production system 100 to produce a first recording medium 2 that contains the same medium-specific information in the first medium management unit 21, the vehicle-specific file 12, and the usage date file 13.

As described above, the production system 100 of this embodiment includes the first recording medium 2, the second recording medium 120, and the manufacturer PC 140. The first recording medium 2 stores the vehicle-specific file 12 and the usage date file 13. The second recording medium 120 stores the encrypted program data 123a. The encrypted program data 123a includes an encryption key. The encrypted program data 123a encrypts and decrypts the vehicle-specific file 12. The manufacturer PC 140 reads data from the first recording medium 2 and the second recording medium 120. The manufacturer PC 140 stores the encrypted program data 123a read from the second recording medium 120 in the volatile memory 146. The volatile memory 146 can hold data when power is supplied. The manufacturer PC 140 stores the vehicle-specific file 12 encrypted with the encrypted program data 123a stored in the volatile memory 146 in the first recording medium 2.

Since the encrypted program data 123a is stored in the volatile memory 146 and not in the non-volatile memory 147, it is automatically deleted from the storage device 144 when the power of the manufacturer PC 140 is turned off. Therefore, the production system 100 can prevent, for example, a malicious third party from taking out the encrypted program data 123a from the manufacturer PC 140 that is turned off. In addition, since the second recording medium 120 is configured in a relatively small size such as a USB memory, it can be easily stored in a highly secure location while the update process S102 is not being performed. Therefore, the production system 100 can prevent the encryption key used by the manufacturer PC 140 to encrypt and decrypt the vehicle-specific file 12 from being leaked to the outside.

In the production system 100 of this embodiment, the non-volatile memory 147 stores an executable file 148. The executable file 148 corresponds to the encrypted program data 123a. When the executable file 148 is executed, the manufacturer PC 140 reads the encrypted program data 123a from the second recording medium 120 and stores it in the volatile memory 146.

In the production system 100 of this embodiment, the manufacturer PC 140 acquires the medium identification information from the first recording medium 2 based on the executable file 148. The medium identification information is information for identifying each of the two or more first recording media 2. The manufacturer PC 140 encrypts the vehicle-specific file 12 and the usage date file 13 in which the medium identification information is written, with the encryption program data 123a.

The executable file 148 corresponds to a predetermined condition for reading the medium-specific information from the first medium management unit 21, and does not include an encryption key. Therefore, an encryption key is not necessary for creating the executable file 148. The encrypted program data 123a includes an encryption key, and does not correspond to a predetermined condition for reading the medium-specific information from the first medium management unit 21. Therefore, a predetermined condition for reading the medium-specific information from the first medium management unit 21 is not necessary for creating the encrypted program data 123a. In this embodiment, the executable file 148 is created by the manufacturer of the first recording medium 2, and the encrypted program data 123a is created by an organization involved in the manufacture of the map output device 3 and provided to the manufacturer of the first recording medium 2, so that the predetermined condition and the encryption key do not need to be shared between different organizations. For this reason, the production system 100 of this embodiment can prevent the encryption key from leaking to the outside.

In this embodiment, the production system 100 executes the copy process S101 and the update process S102 using one manufacturer PC 140, but the copy process S101 and the update process S102 may be executed using two different manufacturer PCs 140.

<Hardware implementation example>
As shown in Fig. 10, the map output device 3 of this embodiment includes an MPU 35a, a ROM (Read Only Memory) 32a, a RAM 32b, an I/O interface 33a, a display 31a, a TCU 36a, a storage device 32c, and an SD host module 34a. The MPU 35a functions as an arithmetic processing device and a control device. The MPU 35a controls the overall operation of the map output device 3 according to various programs. The MPU 35a uses the RAM 32b as a working area and executes various programs stored in the ROM 32a.

The ROM 32a stores programs and calculation parameters used by the MPU 35a. The RAM 32b temporarily stores programs used by the MPU 35a when it executes control. The RAM 32b also temporarily stores parameters that change as appropriate when the MPU 35a executes control.

The I/O interface 33a reads data such as mileage information and vehicle identification information from various car navigation sensors and input/output devices installed in the vehicle, and provides this data to the MPU 35a via the RAM 32b.

TCU36a communicates with the first server 4.

The storage device 32c is realized by, for example, a magnetic storage device, a semiconductor storage device, an optical storage device, or a magneto-optical storage device. The magnetic storage device is, for example, a HDD (Hard Disk Drive). The storage device 32c stores the programs and various data executed by the MPU 35a, as well as various data acquired from the outside.

The SD host module 34a reads and writes information from the inserted first recording medium 2. The SD host module 34a outputs the information read from the first recording medium 2 to the RAM 32b.

The MPU 35a, ROM 32a, RAM 32b, I/O interface 33a, display 31a, TCU 36a, storage device 32c, and SD host module 34a are interconnected by a bus 73.

The MPU 35a acquires mileage information, for example, via the I/O interface 33a, and outputs the acquired mileage information to the RAM 32b. When the mileage of the mobile unit 30 exceeds a predetermined value, the MPU 35a creates a vehicle-specific file 12 based on the vehicle-specific information. The MPU 35a creates a usage date file 13 during locking processing or map updating. When the usage date file 13 is created during locking processing, the MPU 35a generates usage start information based on the GPS signal acquired via the I/O interface 33a. The MPU 35a stores the vehicle-specific file 12 and the usage date file 13 in the first storage unit 22 via the SD host module 34a.

The hardware configurations of the first server 4, the second server 5, and the personal PC 6 are also almost the same as the hardware configuration of the map output device 3, except for the I/O interface 33a, etc.

<<Variations>>
In this embodiment, the moving body 30 is not limited to a vehicle, and may be a ship, an aircraft, or the like. For example, when the moving body 30 is a ship, the map output device 3 executes a locking process when the ship sails beyond a predetermined length. That is, the map output device 3 executes a locking process when the moving body moves beyond a predetermined length. This movement means that the moving body 30 moves by the power possessed by the moving body 30. This movement does not mean that the moving body 30 moves by the power possessed by another moving body 30.

In this embodiment, the first recording medium 2 and the third recording medium 130 are not limited to SD cards and may be microSD cards or nanoSD cards, etc. The first recording medium 2 and the third recording medium 130 may be USB (Universal Serial Bus) memory or CD-R (Compact Disc Recordable), etc.

In this embodiment, the map output system 1 is not limited to a configuration in which the personal PC 6 downloads the update map data 11 from the second server 5, but may be configured to download the update map data 11 from the first server 4. In other words, the map output system 1 may not be configured to include the second server 5.

In this embodiment, the map data 11 stored in the first recording medium 2 may be at least partially encrypted.

In this embodiment, the map output system 1 may be configured such that the first server 4 and the second server 5 are each managed by the same organization.

In this embodiment, the map output device 3 may be configured to be able to use the first recording medium 2 in which the use date file 13 is not stored. That is, the map output system 1 may be configured such that, among two or more map output devices 3, some of the map output devices 3 use the first recording medium 2 in which the use date file 13 is stored, and the remaining map output devices 3 use the first recording medium 2 in which the use date file 13 is not stored. When the target of the map update is the first recording medium 2 in which the use date file 13 is not stored, the first server 4 receives only the license file 14 as a data file required for the map update from the map output device 3 or the personal PC 6. When the first server control unit 43 grants the update right to the first recording medium 2 in which the use date file 13 is not stored, the update deadline is set based on the version of the map data 11 stored in the first storage unit 22. The update deadline is set to a date further forward as the map version is newer. When granting update rights to a first recording medium 2 that does not store a usage date file 13, the first server control unit 43 may set the update deadline to a date that is a specified number of years after a specified date in the year that the map output device 3 or personal PC 6 accessed the first server 4. The specified date is, for example, the last day of December. The first server control unit 43 can set an update deadline for a first recording medium 2 that does not store a usage date file 13, regardless of the date on which the first recording medium 2 actually began to be used by the map output device 3. In this modified example, the production system 100 produces a first recording medium 2 that does not store a usage date file 13, for example, by using a third recording medium 130 that does not store a usage date file 13.

In this way, the map output system 1 of this modified example can set the update deadline in the following three ways.

(1) When the use date file 13 exists and use start information is stored in the use date file 13, the first server control unit 43 sets the renewal deadline based on the use start information.
(2) If a usage date file 13 exists and initial usage information is stored in the usage date file 13, the first server control unit 43 sets the update deadline based on the access time from the map output device 3 or the personal PC 6 to the first server 4.
(3) If the usage date file 13 does not exist, the first server control unit 43 sets the update deadline based on the map version stored in the first recording medium 2 .

The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims. The technical scope of the present invention also includes embodiments obtained by appropriately combining the technical means disclosed in each of the modified examples.

1. Map output system
Reference Signs List 2 First recording medium 3 Map output device 4 First server 11 Map data 30 Mobile body 34 Connection unit 35 Vehicle control unit

Claims (3)

A map output system including a map output device mounted on a mobile body and configured to output map data, and a server configured to communicate with the map output device,
The map output device is
a connection section to which a recording medium storing the map data is connected;
an in-vehicle control unit that controls the connection unit to store in the recording medium usage start information that identifies when the recording medium is connected to the connection unit for the first time or when the moving body has been used beyond a predetermined usage amount;
The server,
a map output system that sets an update deadline during which the map data stored in the recording medium can be updated based on the use start information; the recording medium stores in advance initial usage information indicating a predetermined character string;
The vehicle control unit includes:
The map output system according to claim 1, characterized in that when the recording medium is connected to the connection unit for the first time, or when the moving body is used beyond a predetermined usage amount, the initial usage information stored in the recording medium is changed to the start-of-use information . The server,
3. The map output system according to claim 2 , wherein for the recording medium on which the start-of-use information is not stored, the update deadline is set based on the date on which the map output device accesses the server .

Images