Method, computer program, and device for processing data recorded by a motor vehicle, and for providing parameters for such processing

The disclosure relates to a method for processing data recorded by a motor vehicle. In a first step, at least one set of parameters for a temporal and spatial obfuscation of the recorded data is received. An item of data recorded by a motor vehicle is additionally received. A temporal and spatial obfuscation is then applied to the received item of data using the at least one received set of parameters. The obfuscated item of data is finally forwarded for further processing. The obfuscation may take place within the motor vehicle or in a back end connected to the motor vehicle.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to German Patent Application No. DE 10 2019 209 711.1, filed Jul. 2, 2019 with the German Patent and Trademark Office. The contents of the aforesaid Patent Application are incorporated herein for all purposes.

TECHNICAL FIELD

The present invention relates to a method, a computer program with instructions, and a device for processing data recorded by a motor vehicle. The invention additionally relates to a method, a computer program with instructions, and a device for providing parameters for the processing of data recorded by a motor vehicle. The invention further relates to a motor vehicle and a back end in which a method according to the invention or a device according to the invention is used.

BACKGROUND

In modern motor vehicles, a variety of data is collected. With increasing vehicle connectivity, there is an interest in using the data collected by a vehicle for further evaluation. For this purpose, data may be taken from the motor vehicle and fed to a back end. For example, data may be extracted from vehicle sensors in a location- or time-dependent manner for applications relating to weather forecasts, parking space occupancy, or traffic flow data. In the back end, the data are then combined with other data on a map and fed back to the functions using said data.

One important application scenario for data collection is the creation of a database for anonymized swarm data for researching, developing, and safeguarding automatic driving functions. Highly automated vehicles are expected to cope with a plethora of different and sometimes complex road traffic scenarios without there being an accident. However, since the majority of these scenarios occur only very rarely, testing in real road traffic is both time- and cost-intensive. A substantial database is therefore required for the development of automatic driving functions to series maturity in order to safeguard the algorithms, as this may no longer be achieved by means of classic endurance test runs. Therefore, a data pool is required which has data from as wide a variety of challenging traffic situations as possible, ideally supplied from real driving situations, by means of which data pool the algorithms may be trained and continuously improved such that the vehicles may make appropriate decisions and act safely in road traffic in all eventualities.

However, the data taken from a vehicle may sometimes provide an indication of the personal or material circumstances of an identified or at least identifiable natural person, for example the driver of the motor vehicle.

Such collection and use of the data is generally only possible with a declaration of consent of the driver, as per applicable data protection laws. Although consumers today, in particular in the software field, are quite familiar with accepting conditions of use and granting approval for the evaluation of data, this is not very common in the automotive sector. It is therefore not always easy to obtain a declaration of consent for the use of the data. In addition, software updates may potentially require a new declaration of consent to be obtained from the user, which could become a nuisance for the user over time.

In order to ensure the protection of data, the data may be subjected to different anonymization methods. The aim of these anonymization methods is to conceal the identity of the data originator in an anonymization group.

In one anonymization approach, the data are segmented. In this case, the data of a vehicle are split into different segments during travel. In this way, it is ensured that potential data users cannot obtain the full data set relating to the vehicle's journey. The entire distance is generally only traveled by very few vehicles, and potentially only one individual vehicle. However, the individual segments are traveled by many vehicles.

In another anonymization approach, the data are obfuscated in terms of location or time. In this case, the data are randomly additively shifted in space or time. In this way, identification of the original vehicle is only possible with respect to a group of vehicles.

Although methods for spatial and temporal obfuscation are well suited for concealing the identity of the data originator within an anonymization group, the data user must always compromise on the extent of the spatial and temporal obfuscation.

SUMMARY

A need exists to provide solutions for anonymizing data recorded by a motor vehicle that allow for a temporal and spatial obfuscation of the recorded data that is less subjected to compromise.

The need is addressed by a method, by a computer program, and by a device according to the independent claims. Embodiments of the invention are described in the dependent claims, the following description, and the drawings.

DESCRIPTION

In some embodiments, a method for processing data recorded by a motor vehicle comprises the steps of:receiving at least one set of parameters for a temporal and spatial obfuscation of the recorded data from a data user;receiving an item of data recorded by a motor vehicle;applying a temporal and spatial obfuscation to the received item of data using one of the received sets of parameters; andforwarding the obfuscated item of data for further processing.

In some embodiments, a computer program contains instructions which, when executed by a computer, prompt the computer to carry out the following steps for processing data recorded by a motor vehicle:receiving at least one set of parameters for a temporal and spatial obfuscation of the recorded data from a data user;receiving an item of data recorded by a motor vehicle;applying a temporal and spatial obfuscation to the received item of data using one of the received sets of parameters; andforwarding the obfuscated item of data for further processing.

The term “computer” is to be understood broadly. In particular, it may also include control units, workstations, and other processor-based data processing devices.

The computer program may for example be provided for electronic retrieval or be stored on a computer-readable storage medium.

In some embodiments, a device for processing data recorded by a motor vehicle comprises:an input for receiving at least one set of parameters for a temporal and spatial obfuscation of the recorded data and for receiving an item of data recorded by a motor vehicle from a data user;an anonymization unit for applying a temporal and spatial obfuscation to the received item of data using one of the received sets of parameters; andan output for forwarding the obfuscated item of data for further processing.

From the point of view of the data originator, the anonymization method does not function with fixed settings for the temporal and spatial obfuscation, but rather allows for adjustable mixed anonymization. For this purpose, previously received sets of parameters that allow for situation-dependent adaptation of the anonymization settings are used. In this way, quick recognition of events in the recorded data as well as subsequent precise spatial detection of said events are possible.

In some embodiments, the method for providing parameters for the processing of data recorded by a motor vehicle comprises the steps of:providing at least one set of parameters for a temporal and spatial obfuscation of the recorded data; andtransmitting the at least one set of parameters to a device for processing data recorded by a motor vehicle.

In some embodiments, a computer program contains instructions which, when executed by a computer, prompt the computer to carry out the following steps for providing parameters for the processing of data recorded by a motor vehicle:providing at least one set of parameters for a temporal and spatial obfuscation of the recorded data; andtransmitting the at least one set of parameters to a device for processing data recorded by a motor vehicle.

The term “computer” is to be understood broadly. In particular, it may also include control units, workstations, and other processor-based data processing devices.

The computer program may for example be provided for electronic retrieval or be stored on a computer-readable storage medium.

In some embodiments, a device for providing parameters for the processing of data recorded by a motor vehicle comprises:an input for receiving at least one set of parameters for a temporal and spatial obfuscation of the recorded data and for receiving an item of data recorded by a motor vehicle;a parameter determination unit for determining at least one set of parameters for a temporal and spatial obfuscation of the recorded data; anda transmission unit for transmitting the at least one set of parameters to a device for processing data recorded by a motor vehicle.

From the point of view of the data user, this is not restricted to data that were anonymized with temporal and spatial obfuscation settings subjected to compromise. Rather, the data user may prompt the data originator to use an adapted set of parameters for the anonymization depending on the situation or event. For this purpose, the desired set of parameters may for example be transmitted to the data originator. Alternatively, it is also possible to merely transmit a request to the data originator to use a set of parameters already available to the data originator for the anonymization. In this way, the data user is always able to change the sets of parameters for the obfuscation algorithm.

In some embodiments, the at least one set of parameters comprises specifications as to which position or which area the at least one set of parameters may be applied for. For example, it is possible to adapt the set of parameters not only for the obfuscation filter as a whole but rather precisely for specific positions or areas. This makes it possible, for example, to apply a slow and precise obfuscation, i.e., a large-scale temporal obfuscation in combination with a small-scale spatial obfuscation, to a previously identified site of an accident, without thereby causing a large-scale temporal obfuscation in other regions.

In some embodiments, the at least one set of parameters comprises specifications as to which type of recorded data the at least one set of parameters may be applied for. This makes it possible to only adapt the anonymization for specific data sets or identified events. For example, a fast and imprecise obfuscation may be permitted for an identified emergency vehicle, i.e., a small-scale temporal obfuscation in combination with a large-scale spatial obfuscation.

In some embodiments, a selection is made between two or more sets of parameters for the temporal and spatial obfuscation of the recorded data. Another possibility is an obfuscation with multiple sets of parameters that may be selected at random. It may be beneficial if, for example, 50% of the data are anonymized with a large-scale temporal obfuscation in combination with a small-scale spatial obfuscation, whereas the remaining 50% of the data are anonymized with a small-scale temporal obfuscation in combination with a large-scale spatial obfuscation. This makes it statistically certain that new events or fundamental changes to events, for example, are identified quickly, while known data may be measured more accurately over time on account of the slow detection. This approach of using multiple sets of parameters is helpful, in particular, if a precise adaptation of the sets of parameters is not possible or not possible with sufficient certainty. Of course, a combination of the methods is also possible, i.e., the use of multiple sets of parameters with adaptable, precisely executed parameters. The percentage distribution used is for example adaptable depending on the application.

In some embodiments, firstly, a first set of parameters that causes an obfuscation of the recorded data involving a small-scale temporal obfuscation in combination with a large-scale spatial obfuscation is transmitted. Then, in response to an event being identified in the obfuscated data, a second set of parameters that causes an obfuscation of the recorded data involving a large-scale temporal obfuscation in combination with a small-scale spatial obfuscation is transmitted. In this way, it is possible, for example, to detect a traffic jam or the end of a traffic jam within approximately 60 seconds to the nearest 5 km. As soon as this is known to the data user, said data user may change the parameters and thus locate the end of the traffic jam to the nearest 500 m, for example. However, this is done with a time offset. The data user is thus able to quickly warn traffic or to divert traffic over a large area by means of navigation instructions. In the long term, the data user will also be able to warn drivers of the exact point at which the traffic jam ends.

For example, a method or a device according to the teachings herein may be used in an autonomously or manually controlled vehicle, in particular a motor vehicle. Alternatively, the solution may also be used in a back end to which the data are transmitted from the vehicle.

Additional features of the present invention will become apparent from the following description and the appended claims in conjunction with the FIGS.

In order to improve understanding of the principles of the present invention, further embodiments will be explained in detail in the following based on the FIGS. It should be understood that the invention is not limited to these embodiments and that the features described may also be combined or modified without departing from the scope of protection of the invention as defined in the appended claims.

FIG.1schematically shows a method for processing data recorded by a motor vehicle. In a first step, at least one set of parameters for a temporal and spatial obfuscation of the recorded data is received10from a data user. Additionally, an item of data recorded by a motor vehicle is received11. Subsequently, a temporal and spatial obfuscation is applied12to the received item of data using one of the received sets of parameters. Finally, the obfuscated item of data is forwarded13for further processing. The set of parameters may comprise specifications as to which position or which area it may be applied for. The set of parameters may also comprise specifications as to which type of recorded data it may be applied for. These specifications are for example taken into account by the data originator if a set of parameters is to be used for the obfuscation. Alternatively, a selection between two or more sets of parameters is provided for the temporal and spatial obfuscation of the recorded data. A set of parameters may then be selected therefrom, for example at random, for the obfuscation.

FIG.2is a simplified schematic representation of a first embodiment of a device20for processing data D recorded by a motor vehicle. The device20comprises an input21for receiving at least one set of parameters P for a temporal and spatial obfuscation of the recorded data from a data user and for receiving an item of data D recorded by a motor vehicle. A data processing unit22determines the parameters required for a temporal and spatial obfuscation based on one of the sets of parameters P. An anonymization unit23then applies a temporal and spatial obfuscation to the received item of data D. Finally, the obfuscated item of data VD is forwarded for further processing via an output25. The set of parameters P may comprise specifications as to which position or which area it may be applied for. The set of parameters P may additionally comprise specifications as to which type of recorded data it may be applied for. These specifications are for example taken into account by the data processing unit22if a set of parameters P is to be used for the obfuscation. Alternatively, a selection between two or more sets of parameters P is provided for the temporal and spatial obfuscation of the recorded data. A set of parameters P may then be selected therefrom, for example at random, for the obfuscation.

The data processing unit22and the anonymization unit23may be controlled by a control unit24. Settings of the data processing unit22, anonymization unit23, or control unit24may be changed, if required, via a user interface27. The data accumulating in the device20may be deposited in a memory26of the device20if required, for example for later evaluation or to be used by the components of the device20. The data processing unit22, anonymization unit23, and control unit24may be designed as dedicated hardware, for example as integrated circuits. Of course, they may also be partially or fully combined or be implemented as software running on a suitable processor, for example a GPU. The input21and the output25may be implemented as separate interfaces or as a combined bidirectional interface.

FIG.3is a simplified schematic representation of a second embodiment of a device30for processing data recorded by a motor vehicle. The device30comprises a processor32and a memory31. By way of example, the device30is a computer, a workstation, or a control unit. Instructions which, when executed by the processor32, prompt the device30to carry out the steps according to any one of the methods described are stored in the memory31. The instructions stored in the memory thus constitute a program that may be executed by the processor32and that implements the method according to the teachings herein. The device has an input33for receiving information. Data generated by the processor32are provided via an output34. Said data may also be stored in the memory31. The input33and the output34may be merged into a bidirectional interface.

The processor32may comprise one or more processor units, for example microprocessors, digital signal processors, or combinations thereof.

The memories26,31of the embodiments described may have volatile and/or non-volatile memory regions and comprise a wide variety of storage units and storage media, for example hard drives, optical storage media, or semiconductor memories.

The two embodiments of the device may be integrated in the motor vehicle or be part of a back end that is connected to the motor vehicle.

FIG.4is a schematic representation of a motor vehicle40in which a solution according to the teachings herein is implemented. The motor vehicle40comprises a sensor system41by means of which data D may be recorded, for example a traffic situation. Other components of the motor vehicle40are a navigation system42, a data transmission unit43, and a series of assistance systems44, of which one is shown by way of example. By means of the data transmission unit43, a connection to a back end80may be established, in particular for transmitting recorded data and for receiving at least one set of parameters P. In this exemplary embodiment, a device20for processing the recorded data D provides for temporal and spatial obfuscation of the data using the at least one received set of parameters, such that obfuscated data VD are transmitted to the back end80. Alternatively, the obfuscation of the data D may not take place until said data are in the back end80, before they are provided thereby to a data user. In this case, the back end80receives the at least one set of parameters P. A memory is present for storing data. The data exchange between the various components of the motor vehicle40takes place via a network46.

FIG.5schematically shows a method for providing parameters for the processing of data recorded by a motor vehicle. In a first step, at least one set of parameters is determined50for a temporal and spatial obfuscation of the recorded data. Said set of parameters is then transmitted51to a device for processing data recorded by a motor vehicle. The set of parameters may comprise specifications as to which position or which area it may be applied for. The set of parameters may additionally comprise specifications as to which type of recorded data it may be applied for. In addition, two or more sets of parameters may be transmitted for the temporal and spatial obfuscation of the recorded data. The data originator may then randomly select a set of parameters therefrom for the obfuscation.

FIG.6shows a first embodiment of a device60for providing parameters for the processing of data recorded by a motor vehicle. The device60comprises an input61, for example for receiving requirements of a data user with regard to the obfuscation of recorded data. A parameter determination unit62determines at least one set of parameters P for a temporal and spatial obfuscation of the recorded data. Said at least one set of parameters P is then transmitted by a transmission unit63to a device20for processing data recorded by a motor vehicle. The set of parameters P may comprise specifications as to which position or which area it may be applied for. The set of parameters P may additionally comprise specifications as to which type of recorded data it may be applied for. In addition, two or more sets of parameters P may be transmitted for the temporal and spatial obfuscation of the recorded data. The device20may then randomly select a set of parameters P therefrom for the obfuscation.

The parameter determination unit62and the transmission unit63may be controlled by a control unit64. Settings of the parameter determination unit62, transmission unit63, or control unit64may be changed, if required, via a user interface67. The data accumulating in the device60may be deposited in a memory66of the device60if required, for example for later evaluation or to be used by the components of the device60. The parameter determination unit62, transmission unit63, and control unit64may be designed as dedicated hardware, for example as integrated circuits. Of course, they may also be partially or fully combined or be implemented as software running on a suitable processor, for example a GPU. The input61and the output65may be implemented as separate interfaces or as a combined bidirectional interface.

FIG.7shows a second embodiment of a device70for providing parameters for the processing of data recorded by a motor vehicle. The device70comprises a processor72and a memory71. By way of example, the device70is a computer or a workstation. Instructions which, when executed by the processor72, prompt the device70to carry out the steps according to any one of the methods described are stored in the memory71. The instructions stored in the memory71thus constitute a program that may be executed by the processor72and that implements the method according to the teachings herein. The device has an input73for receiving information. Data generated by the processor72are provided via an output74. Said data may also be stored in the memory71. The input73and the output74may be merged into a bidirectional interface.

The processor72may comprise one or more processor units, for example microprocessors, digital signal processors, or combinations thereof.

The memories66,71of the embodiments described may have volatile and/or non-volatile memory regions and comprise a wide variety of storage units and storage media, for example hard drives, optical storage media, or semiconductor memories.

FIG.8illustrates variants of the obfuscation with constant boundary conditions. The possible combinations of temporal obfuscation and spatial obfuscation for a given level of anonymization are plotted here. As shown in the FIG., the magnitude Δs of the spatial obfuscation is greater the lower the magnitude Δt of the temporal obfuscation, and vice versa. A minimal temporal obfuscation requires a maximal spatial obfuscation, whereas a minimal spatial obfuscation requires a maximal temporal obfuscation. This results in the data user always having to compromise with regard to the obfuscation.

FIG.9schematically shows a system concept of the solution according to the teachings herein. A basic idea of the solution is that the data user91is always able, by means of a provision of parameters93, to change the sets of parameters P of the obfuscation algorithm92that is applied to the data recorded by a data originator90. In this way, the data user91may quickly read effects from the data, for example, but then specify them more precisely afterward.

By way of example, it is therefore possible to detect a traffic jam or the end of a traffic jam within approximately 60 seconds to the nearest 5 km. As soon as this is known to the data user91, said data user may change the parameters and thus locate the end of the traffic jam to the nearest 500 m, for example. However, this is done with a time offset of 600 seconds. The data user91is thus able to quickly warn traffic or to divert traffic over a large area by means of navigation instructions. In the long term, the data user will also be able to warn drivers of the exact point at which the traffic jam ends.

It is possible to adapt the set of parameters P not only for the obfuscation algorithm92as a whole but also precisely for specific positions or areas or for specific data sets or identified events. This makes it possible to apply a slow and precise obfuscation, i.e. a large-scale temporal obfuscation in combination with a small-scale spatial obfuscation, to a previously identified end point of a traffic jam. Equally, a fast and imprecise obfuscation may be permitted for an identified emergency vehicle, i.e. a small-scale temporal obfuscation in combination with a large-scale spatial obfuscation.

Another possibility is an obfuscation with multiple sets of parameters P that are selected at random. It may be beneficial if, for example, 50% of the data are anonymized with a large-scale temporal obfuscation in combination with a small-scale spatial obfuscation, whereas the remaining 50% of the data are anonymized with a small-scale temporal obfuscation in combination with a large-scale spatial obfuscation. This makes it statistically certain that new events or fundamental changes to events, for example, are identified quickly, while known data may be measured more accurately over time on account of the slow detection. This approach of using multiple sets of parameters P is beneficial in particular, if a precise adaptation of the sets of parameters P is not possible or not possible with sufficient certainty.

One possible application scenario for obfuscation with multiple sets of parameters P is the identification of an icy road. For this application scenario, 30% of the measurements, for example, may be obfuscated by means of spatial blurring of 5 km and temporal blurring of 1 min. As such, icy regions may be detected quickly. The warnings are therefore provided quickly, but are very imprecise from a spatial point of view. In contrast, 70% of the measurements are obfuscated with spatial blurring of 250 m and temporal blurring of 20 min. As such, the boundaries of the icy regions on the road may be accurately identified. The warnings are therefore accurate, but very sluggish.

The associated set of parameters P or parameter matrix is as follows:

Of course, a combination of the methods is also possible, i.e. the use of multiple sets of parameters P with adaptable, precisely executed parameters.

LIST OF REFERENCE NUMERALS

10Receiving a set of parameters for a temporal and spatial obfuscation11Receiving a recorded item of data12applying a temporal and spatial obfuscation to the item of data on the basis of the set of parameters13Forwarding the obfuscated item of data for further processing20Device21Input22Data processing unit23Anonymization unit24Control unit25Output26Memory27User interface30Device31Memory32Processor33Input34Output40Motor vehicle41Sensor system42Navigation system43Data transmission unit44Assistance system45Memory46Network50Determining at least one set of parameters for a temporal and spatial obfuscation51Transmitting the at least one set of parameters60Device61Input62Parameter determination unit63Transmission unit64Control unit65Output66Memory67User interface70Device71Memory72Processor73Input74Output80Back end90Data originator91Data user92Obfuscation algorithm93Provision of parametersD Item of dataΔs Magnitude of the spatial obfuscationΔsmaxMaximal spatial obfuscationΔt Magnitude of the temporal obfuscationΔtmaxMaximal temporal obfuscationp Set of parametersVD Obfuscated item of data

The term “exemplary” used throughout the specification means “serving as an example, instance, or exemplification” and does not mean “preferred” or “having advantages” over other embodiments. The term “in particular” used throughout the specification means “serving as an example, instance, or exemplification”.