Patent Description:
Car sharing has become more and more common. LYNK&CO have car sharing in the European market, m. co is another company focusing on car sharing between end users. Also VOI is dealing in the same business, except that they don't rent cars. On top of this, many companies offers services, such as car cleaning/washing, delivery services, etc..

When dealing with these kind of services, some information may be needed to be stored in the vehicle. Due to user integrity it is important that this information is visible only to the correct person. As an example: The owner of a car may have full access to see all user profiles in a vehicle. However, if a rider uses a service during their booking period, the owner may not be eligible for knowing all information about that service. A further example is that when using a cleaning service is that the user ordering the service may only have an interface to the cleaning service, but all employees at that cleaning service shall not have access to the car, only the one performing the work. The ordering user shall however not have access to see what employee that is performing the service. Document <CIT> discloses providing a monitoring system which may be included or associated with multiple devices such as a motorized vehicle, protecting devices and data by erasing data and/or making devices inoperable. Document <CIT> discloses securing data contained in computing devices by monitoring, tracking, providing a squib device for erasing stored data by permanently physically damaging a data storage device using heat. Document <CIT> discloses detecting vehicle accident and transmitting accident data to a storage device and turning off the backup circuit after transmission. Document <CIT> discloses securing user data stored in shared vehicles by deleting user data from the memory of a vehicle.

There is thus a need for improved data security in the vehicle industry.

It is an object of the present disclosure to mitigate, alleviate or eliminate one or more of the above-identified deficiencies and disadvantages in the prior art and solve at least the above mentioned problem. According to a first aspect there is provided a method for protecting data of a user in a vehicle, wherein the vehicle comprises a first memory, a distress sensor system, a processing circuitry operatively connected to memory and the distress sensor system, wherein the memory comprises personal data linked to the user, the method comprising, at the processing circuitry : detecting a signal of distress from the distress sensor system; in response to detecting the distress signal, automatically protecting the data linked to the user that is stored on the first memory.

An advantage is that the data is protected in case the car has to be abandoned by the user without any chance to secure or protect sensitive data linked to the user.

According to some embodiments the distress sensor system is a Safety Restraint System, wherein the distress signal is a signal indicative of a vehicle crash. The inventors have realized that while a very common approach is to save as much data as possible from a crash, some data is not relevant to determine a cause of the crash and the signal may be used to enable that sensitive data does not fall in the wrong hands. An advantage is that salvaged components containing sensitive data may be prevented from being re-used without authorization.

According to some embodiments, the distress signal is caused by a detected burglary, e.g. a signal from a burglary system of the vehicle. The data linked to the user is then protected if the burglar tries to steal the data linked to the user or if the user has to flee from the vehicle, e.g. if the vehicle is car jacked.

According to some embodiments, the distress signal is caused by a detected sudden health change of the driver, e.g. a detected heart attack, if the user falls asleep or lose consciousness. The data linked to the user is then protected in case the user has to leave the vehicle or if the condition causes an accident.

According to some embodiments, the distress signal is caused by the vehicle drive assisting systems determining that a severe crash is imminent and unavoidable. The information for the determination can come from cameras, radar, proximity sensors etc. available in the vehicle. An advantage is that time is saved so that the protection of the data linked to the user before a crash may interfere with the protection procedure.

According to some embodiments, the distress signal is received from a remote source. In that way the data linked to the user is protected if a distress is detected by a remote surveillance of the vehicle. It could be an anticipation of a severe accident, crime, a disaster of some sort that the vehicle is deemed to run into. It could also be based on a detected hacking of the vehicle software, theft, or a detected hijacking of the vehicle.

According to some embodiments, the data linked to the user is protected by logging out the user from the vehicle system. In that way the data linked to the user is protected from unauthorized persons.

According to some embodiments, the data linked to the user is protected by deleting the data from the memory. In that way the data linked to the user is securely removed from vehicle so that no one can read it ever again.

According to some embodiments, the vehicle further comprises wireless communication means operatively connected to the processing circuitry, wherein in response to detecting the distress signal, before deleting the data linked to the user that is stored on the memory, uploading the data linked to the user to the OEM to be stored and collected after verification of the identity of the user (to be used for insurance reasons). In that way the data linked to the user is backed up so that it is can be recovered by the user later on.

According to some embodiments, the vehicle further comprises a small explosive device arranged adjacent the memory, the method further comprises: in response to detecting the distress signal, triggering the explosive device to explode, thereby destroying the memory and all data on it. In that way the data linked to the user is completely destroyed from all attempts of recovery.

According to some embodiments, the explosive device is a squib. A squib is normally used for airbags and is thereby tested and certified for vehicles already.

The Safety Restraint System of modern vehicles are equipped with circuits that can be used to trigger one or multiple explosive devices when triggered by the distress system. By using existing circuits in a novel and inventive way costs are reduced the environmental foot print is kept to a minimum.

According to some embodiments, the vehicle comprises a multiple memories storing data linked to the user, wherein the method further comprises: in response to detecting the distress signal, automatically delete or protect the data linked to the user that is stored on every memory. An advantage with this embodiment is that all data on every part of the vehicle system is protected or deleted.

According to some embodiments, the multiple memories storing data linked to the user are located in devices wirelessly connected to the vehicle via e.g. Bluetooth or wifi. The devices are disconnected in response to detecting a distress signal.

According to some embodiments, each of the multiple memories are part of a dedicated system in the vehicle, wherein the processing circuitry is configured to in response to detecting the distress signal, send a dedicated delete signal to all equipment in the vehicle the method comprises memories storing data linked to the user.

According to a second aspect there is provided a vehicle comprising a first memory, a distress sensor system, a processing circuitry operatively connected to memory and the distress sensor system, wherein the memory comprises personal data linked to the user, the method comprising, wherein the processing circuitry is configured to: detect a signal of distress from the distress sensor system; in response to detecting the distress signal, automatically delete the data linked to the user that is stored on the first memory.

According to some embodiments, the distress signal is caused by a detected burglary. The data linked to the user is then protected if the burglar tries to steal the data linked to the user or if the user has to flee from the vehicle, e.g. if the vehicle is car jacked.

According to some embodiments, the vehicle further comprises wireless communication means operatively connected to the processing circuitry, wherein the processing circuitry is configured to in response to detecting the distress signal, before deleting the data linked to the user that is stored on the memory, upload the data linked to the user to the OEM to be stored and collected after verification of the identity of the user (to be used for insurance reasons). In that way the data linked to the user is backed up so that it is can be recovered by the user later on.

According to some embodiments, the vehicle further comprises an small explosive device arranged adjacent the memory, the processing circuitry is configured to: in response to detecting the distress signal, triggering the explosive device to explode, thereby destroying the memory all data on it. In that way the data linked to the user is completely destroyed from all attempts of recovery.

According to some embodiments, the vehicle comprises a multiple memories storing data linked to the user, wherein the processing circuitry is configured to: in response to detecting the distress signal, automatically delete the data linked to the user that is stored on every memory. An advantage with this embodiment is that all data on every part of the vehicle system is protected or deleted.

According to some embodiments, the each of the multiple memories are part of a dedicated system in the vehicle, wherein the processing circuitry is further configured to in response to detecting the distress signal, send a dedicated delete signal to all equipment in the vehicle the vehicle comprises memories storing data linked to the user. An advantage with this embodiment is that all data on every part of the vehicle system is protected or deleted.

Effects and features of the second aspect are to a large extent analogous to those described above in connection with the first aspect.

The present disclosure will become apparent from the detailed description given below. The detailed description and specific examples disclose preferred embodiments of the disclosure by way of illustration only. Those skilled in the art understand from guidance in the detailed description that changes and modifications may be made within the scope of the disclosure.

<FIG> shows the second aspect of this disclosure shows a vehicle <NUM> comprising a first memory <NUM>, a distress sensor system <NUM>, a processing circuitry <NUM> operatively connected to memory and the distress sensor system, wherein the memory comprises personal data linked to the user, the method comprising, wherein the processing circuitry <NUM> is configured to: detect a signal of distress from the distress sensor system; in response to detecting the distress signal, automatically delete the data linked to the user that is stored on the first memory.

The distress signal may be caused by a crash of the vehicle, detected by a sensor in the vehicle. The distress signal may also be caused by a detected burglary, e.g. on a signal from a burglary system in the vehicle. The distress signal may be caused by the vehicle drive assisting systems with cameras <NUM>, <NUM>, radar <NUM>, proximity sensors <NUM> etc. determining that a severe crash is imminent and unavoidable.

The distress signal may also be received from a remote source via the wireless communication means <NUM>. It may be the vehicle OEM deleting the vehicle in case of hack, theft, hijacking, etc..

The vehicle further comprises wireless communication means <NUM> operatively connected to the processing circuitry <NUM>, wherein the processing circuitry <NUM> is configured to in response to detecting the distress signal, before deleting the data linked to the user that is stored on the memory, upload the data linked to the user via a network <NUM> to an OEM server <NUM> to be stored and collected after verification of the identity of the user to be used for insurance reasons.

The vehicle further comprises a small explosive device <NUM> arranged adjacent the memory <NUM>, the processing circuitry <NUM> is configured to: in response to detecting the distress signal, triggering the explosive device to explode (after OEM upload if set), thereby destroying the memory all data on it. The explosive device is in <FIG> a squib normally used for airbags.

The vehicle of <FIG> comprises multiple memories (not shown) storing data linked to the user, wherein the processing circuitry <NUM> is configured to: in response to detecting the distress signal, automatically delete the data linked to the user that is stored on every memory. Each of the multiple memories are part of a dedicated system in the vehicle, wherein the processing circuitry <NUM> is further configured to in response to detecting the distress signal, send a dedicated delete signal to all equipment in the vehicle the vehicle comprises memories storing data linked to the user.

The first aspect of this disclosure is disclosed in <FIG>, showing a method for protecting data of a user in a vehicle <NUM>, wherein the vehicle comprises a first memory <NUM>, a distress sensor system <NUM>, a processing circuitry <NUM> operatively connected to memory and the distress sensor system, wherein the memory comprises personal data linked to the user, the method comprising, at the processing circuitry <NUM>: detecting S1 a signal of distress from the distress sensor system; in response to detecting the distress signal, automatically protecting S2 the data linked to the user that is stored on the first memory.

The data is protected by logging S2-<NUM> out the user from the vehicle system or by deleting S2-<NUM> the data.

The vehicle further comprises wireless communication means operatively connected to the processing circuitry <NUM>, wherein in response to detecting the distress signal, before deleting the data linked to the user that is stored on the memory, uploading S3 the data linked to the user to the OEM to be stored and collected after verification of the identity of the user to be used for insurance reasons.

The vehicle further comprises a small explosive device <NUM> arranged adjacent the memory <NUM>, the method further comprises: in response to detecting the distress signal, triggering S4 the explosive device to explode (after OEM upload if set), thereby destroying the memory and all data on it.

The vehicle may comprise multiple memories storing data linked to the user, wherein the method further comprises: in response to detecting the distress signal, automatically delete the data linked to the user that is stored on every memory. Each of the multiple memories are part of a dedicated system in the vehicle, wherein the processing circuitry <NUM> is configured to in response to detecting the distress signal, send a dedicated delete signal to all equipment in the vehicle the method comprises memories storing data linked to the user.

Claim 1:
A vehicle comprising
a first memory (<NUM>), a distress sensor system (<NUM>), a processing circuitry (<NUM>) operatively connected to memory and the distress sensor system, wherein the memory comprises personal data linked to the user, wherein the processing circuitry (<NUM>) is configured to protect data of a user (<NUM>) in a vehicle (<NUM>) in the event of distress by:
detecting (S1) a signal of distress from the distress sensor system;
in response to detecting the distress signal, automatically deleting (S2) the data linked to the user that is stored on the first memory;
wherein the distress signal is received from a sensor in the vehicle in response to a detected crash of the vehicle.