Patent ID: 12197622

DETAILED DESCRIPTION

Various examples will now be described more fully with reference to the accompanying drawings in which some examples are illustrated. In the figures, the thicknesses of lines, layers and/or regions may be exaggerated for clarity.

Accordingly, while further examples are capable of various modifications and alternative forms, some particular examples thereof are shown in the figures and will subsequently be described in detail. However, this detailed description does not limit further examples to the particular forms described. Further examples may cover all modifications, equivalents, and alternatives falling within the scope of the disclosure. Same or like numbers refer to like or similar elements throughout the description of the figures, which may be implemented identically or in modified form when compared to one another while providing for the same or a similar functionality.

It will be understood that when an element is referred to as being “connected” or “coupled” to another element, the elements may be directly connected or coupled via one or more intervening elements. If two elements A and B are combined using an “or”, this is to be understood to disclose all possible combinations, i.e. only A, only B as well as A and B, if not explicitly or implicitly defined otherwise. An alternative wording for the same combinations is “at least one of A and B” or “A and/or B”. The same applies, mutatis mutandis, for combinations of more than two Elements.

The terminology used herein for the purpose of describing particular examples is not intended to be limiting for further examples. Whenever a singular form such as “a,” “an” and “the” is used and using only a single element is neither explicitly or implicitly defined as being mandatory, further examples may also use plural elements to implement the same functionality. Likewise, when a functionality is subsequently described as being implemented using multiple elements, further examples may implement the same functionality using a single element or processing entity. It will be further understood that the terms “comprises,” “comprising,” “includes” and/or “including,” when used, specify the presence of the stated features, integers, steps, operations, processes, acts, elements and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, processes, acts, elements, components and/or any group thereof.

Unless otherwise defined, all terms (including technical and scientific terms) are used herein in their ordinary meaning of the art to which the examples belong.

Mobility-as-a-Service (MaaS) describes a shift away from personally-owned modes of transportation and towards mobility provided as a service. This can be enabled by combining transportation services from public and private mobility service providers through a unified gateway that creates and manages the trip, which users can pay for with a single account. A key concept behind MaaS is to offer travelers mobility solutions based on their travel needs.

In order, for example, to adapt a transportation schedule of different providers to each other, the different providers may gather information on trips of their users and determine, for example, where and/or when most of the users change between transportation vehicles of the different providers.

According to data protection regulations or due to concerns about a security of personal information it may be undesired and/or illegal to share personalized information on the trip of the users. This can limit an analysis of a travel behavior of the users since sets of information of a same users gathered by each of the providers cannot be associated with each other. Thus, for example, it is not be possible to determine where and/or when a particular user has changed between transportation vehicles.

Hence, there may be a demand for an improved data storing method and an improved privacy preserving data storing system, in particular for analyzing a travel behavior of one or more users of mobility-as-a-service (MaaS) transportation services.

FIG.1shows a flowchart schematically illustrating a privacy preserving data storing method100for analyzing a travel behavior of one or more users of mobility-as-a-service transportation services.

To put the method100in context of a technical implementation, the method100should be described in the following by reference toFIG.2, which illustrates an embodiment of a privacy preserving data storing system200.

According to a basic idea, the method100provides for storing110and120the personal information, namely a user identification280(user ID), and non-personal information, namely a trip information290, on a trip of one or more users, each together with a (predefined) trip identification270(trip ID) as a database entry in separate databases210-1and250of the system200.

For example, each of multiple mobility service providers of a “MaaS consortium/ecosystem” may run such a data storing system200. The users can provide the mobility service providers with their user ID280, e.g., via an interface to the mobility service providers. Such interfaces can be certain MaaS applications running on a smartphone or a computer of the users. In some cases such applications can also be used by the users for booking a travel or a trip which may involve travels with multiple of the mobility service providers.

In the course of booking or afterwards, the application may further predefine the trip ID270and the trip information290depending on a travelling plan requested by the users.

The user ID280(e.g. name, bank data, date of birth, address, nationality), for example, is stored on the first database210-1and the trip information290is stored on the second database250.

The first and the second database210-1and250may further be implemented on separate electronic data storages.

The trip information290, for example, includes a start location, a destination, a start time and/or an end time of the trip, which may be recorded in the course of a check-in, a check-out and/or a booking of the user.

In general, the said users can be passengers of a same transportation vehicle or separate transportation vehicles. Consequently, the trip information290can include a set of multiple start locations and destinations which, for example, are listed in one or more vectors or matrices.

The trip ID270can be understood as a unique identifier of the trip. For example, the trip ID270is a hash value.

The method100further proposes associating the database entries of the first and second database210-1and250associated with the same trip ID270for an analysis of the travel behavior of the users based on the associated database entries of the first and the second database210-1and250.

This, for example, allows to link respective trip information290to each of the users, which consequently enables associating trip information290of same users, as stated in more detail below.

An association of the database entries can be carried out by a (intermediate) data processing circuitry220of the system200, such as a processor or a similar programmable hardware device, which is coupled to the first and the second database210-1and250.

In “MaaS applications”, the second database250can be shared between multiple mobility service providers e.g. using a blockchain, wherein the user IDs gathered by the mobility service providers can be stored on multiple separated databases each controlled by one of the mobility service providers in order to keep the user IDs private.

FIG.3illustrates a scenario in which one or more users of MaaS transportation services travel by bus of a first mobility service provider230-1and by train of another second mobility service provider230-2.

In this scenario, the analysis can aim to determine a time, a station (e.g. a bus stop or a train station) where and/or how many of the users changed from the bus to the train, for example, to adapt schedules of the mobility service providers230-1230-2to each other.

For this, each of the mobility service providers230-1and230-2can gather data/information on the trip of the users with the respective mobility service providers230-1and230-2, respectively and share the gathered data via the second database250. Since the mobility service providers230-1and230-2can share the second database250, it is also called a common “travel record ledger (TRL)”. As can be seen inFIG.3, a common choice for such a TRL is a blockchain, because of its immutability properties.

Thus, regarding the concerns about data protection security, it may be undesired and/or illegal to store and share the user ID280via the blockchain250. Rather, the user ID280needs to be stored separate from the trip information290shared between the mobility service providers230-1and230-2.

For example, the first mobility service provider230-1stores, for each of a plurality of first users travelling by bus, a first user ID280-1together with a first trip ID270-1in a database entry of the first database210-1controlled (only) by the first mobility service provider230-1. Further, respective first trip information290-1can be stored together with the first trip ID270-1in another database entry on the blockchain250.

Analogously, the second mobility service provider230-2stores, for each of a plurality of second users travelling by train, a second user ID280-2together with a second trip ID270-2in a database entry of a third database210-2controlled (only) by the second mobility service provider230-2and respective second trip information290-2together with the second trip ID270-2in another database entry on the blockchain250.

In this way, the mobility service providers230-1and230-2on the one hand can share the trip information290-1and290-2while keeping the user IDs280-1and280-2private in compliance with data protection regulations. On the other hand, using the trip IDs270-1and270-2, the user IDs280-1and280-2can be mapped onto the respective trip information290-1and290-2, for example, in order to determine whether, where, when and/or who of the second users changed from the bus to the train.

This can be described in more detail by reference toFIG.4.

FIG.4shows another embodiment of the system200comprising a first data processing circuitry220-1and a second data processing circuitry220-2which are configured to handle, edit and/or retrieve data from the blockchain250as well as the first and the second database210-1and210-2, respectively.

The first data processing circuitry220-1can be under control of the first mobility service provider230-1and the second data processing circuitry220-2can be under control of the second mobility service provider230-2.

For the analysis of the travel behavior, the first and the second data processing circuitry220-1and220-2can combine the database entries associated with the same trip ID270-1and270-2, respectively. The first and the second data processing circuitry220-1and220-2can execute a (secure) multi-party computation protocol for the analysis of the travel behavior of the users by taking the database entries associated with the same trip ID as input.

(Secure) multi-party computation (also known as privacy-preserving computation) is a sub-field of cryptography with the goal of creating methods for parties to jointly compute a function over their inputs while keeping those inputs private.

According to this definition, the MPC protocol provides a data protection-compliant option of an analysis of the database entries. In particular, he MPC protocol can enable an analysis of database entries with matching user IDs280-1and280-2without the first and the second user ID280-1and280-2being exchanged between the databases210-1,210-2,250and between the first and the second data processing circuitry220-1and220-2, respectively, e.g. to comply with data protection regulations. This, for example, allows an analysis of the trip information270-1and270-2related to same/identical user/s.

In order to prevent unauthorized entities from accessing the first and the second user ID280-1and280-2, as well as the first and the second trip information290-1and290-2, those can be encrypted, for example, in the course of storing the first user ID280-1, the second user ID280-1, the first trip information290-1and the second trip information. Consequently, the first and the second data processing circuitry220-1and220-2may be configured to decrypt the user IDs280-1and280-2, as well as the trip information290-1and290-2in connection with the analysis.

The above described concept, for example, can be used by a plurality of mobility service providers collaborating in terms of MaaS transportation services, in particular, if the mobility service providers want to share the blockchain250for the analysis of the trip information.

To be more specific, the (privacy preserving) association of the aforementioned database entries for purposes of the analysis is described by reference to a specific example as follows:The first users include 156 people who left the bus of the first mobility service provider230-1at 3:45 pm at station X, and 12 of the 156 people continue their journey from station X by a train with destination Y of the second mobility service provider230-2at 3:53 pm. Thus, the 12 people can be referred to as a portion of the second users who get on the train.The first and the second user IDs280-1and280-2thus may include names and bank account numbers of the 156 people travelling by bus and of the 12 people travelling by train.In this example, the first trip information290-1, for example, includes an end time at which the 156 people left the bus and the second trip information290-2may include a start time at which the 12 people entered the train.As mentioned above, each entry of the user IDs280-1and280-2, for example each of the names and bank account numbers, shares a respective trip ID270-1and270-2with one of multiple entries of the trip information290-1or290-2.As a result, the first and the second data processing circuitry220-1and220-2can associate the user IDs280-1and280-2with respective trip information290-1and290-2having the same trip ID270-1or270-2. For example, user A of the 156 people is associated with the trip information that user A left the bus at 3:45 pm at station X.In this way, the first and the second data processing circuitry220-1and220-2can generate a vector d1including the associated first user IDs280-1and first trip information290-1and a vector d2including the associated second user IDs280-2and second trip information290-2.Both the first and the second vector d1and d2can be used as input of a multi-party-computation (MPC) protocol260executed partly by each of the first and the second data processing circuitry220-1and220-2. The MPC protocol260can be configured to calculate a function F(d1, d2) without revealing d1to the second data processing220-2and d2to the first data processing circuitry220-1.The function F(d1, d2) can be adapted to a desired objective of the analysis. For example, the function F(d1, d2) identifies people who are included in both d1and d2to determine a number of the people who changed from the bus to the train at station X between 3:45 pm and 3:53 pm. To this end, the MPC protocol can apply private set intersection to d1and d2.Private set intersection is a cryptographic technique which allows two parties holding sets to compare encrypted versions of these sets in order to compute the intersection.In this scenario, neither the first230-1nor the second mobility service provider230-2reveals anything to the counterparty except for the trip information290-1and290-2, and the number of people who changed between the bus and the train. Thus, both of the mobility service providers230-1and230-2can analyze the travel behavior of the users without violating data protection regulations.

FIG.5schematically illustrates a way of storing the user identification using Shamir's secret sharing.

As shown inFIG.5, a consortium of N mobility service providers may collaborate in the sense of the above described concept of MaaS.

For this, each of N mobility service providers, runs one of N data processing circuitries220-1,220-2, . . . ,220-N connected to one of N databases210-1,210-2, . . . ,210-N and the blockchain250, wherein in this scenario, the N databases may be separately stored on N separate data storages.

In the course of booking a travel, the user ID280of one or more users can be divided into N shares280/1,280/2, . . . ,280/N according to Shamir's secret sharing such that only a combination of a predefined number of the shares280/1,280/2, . . . ,280/N enable a conclusion on the user ID280.

Each of those shares280/1,280/2, . . . ,280/N can be distributed to one of the N databases210-1,210-2, . . . ,210-N of the N mobility service providers.

Hereby, none of the mobility service providers but only the MPC protocol260can retrieve a required number of the shares280/1,280/2, . . . ,280/N in order to recover the user ID280for the analysis of the travel behavior as described in connection with the above examples.

The following examples pertain to further embodiments:(1) A privacy preserving data storing method, in particular for analyzing a travel behavior of one or more users of mobility-as-a-service, MaaS, transportation services, the method comprising:storing at least one user identification, user ID, identifying the one or more users on a trip together with a trip identification, trip ID, identifying the trip in a database entry of a first database;storing trip information on the trip with the trip ID in a database entry of a separate second database;associating the database entries of the first and second databases associated with the same trip ID for an analysis of the travel behavior of the users based on the associated database entries of the first and the second database.(2) Privacy preserving data storing method of any of (1), wherein the method further comprises:storing the user ID together with the trip ID in a database entry of a third database; andassociating the database entries of the first, the second and the third databases associated with the same trip ID for an analysis of the travel behavior of the users based on the associated database entries of the first, the second and the third database.(3) Privacy preserving data storing method of any one of (1) or (2),wherein the trip information comprises at least one of a start location, a destination, a start time and an end time of the trip.(4) Privacy preserving data storing method of any one of (1) to (3),wherein the user ID comprises at least one of a name and bank data of at least one of the users.(5) Privacy preserving data storing method of any one of (1) to (4),wherein the user ID and the trip information are encrypted.(6) Privacy preserving data storing method of any one of (1) to (5),wherein storing the user ID comprises physically storing a first share of the user ID on a first data storage and physically storing and one or more further shares of the user ID on one or more further data storages; andwherein the method further comprises recovering the user ID based on the first and the one or more further shares in accordance with Shamir's secret sharing scheme for associating the database entries of the first and second databases associated with the same trip ID.(7) Privacy preserving data storing method of (2), further comprising:storing at least one first user identification, first user ID, identifying one or more first users on a first trip in a database entry of the first database, the first user ID being associated with a first trip identification, first trip ID, identifying the first trip;storing at least one second user identification, second user ID, identifying one or more second users on a second trip in a database entry of the third database, the second user ID being associated with a second trip identification, second trip ID, identifying the second trip;storing first trip information on the first trip in a database entry of the second database, the first trip information being associated with the first trip ID;storing second trip information on the second trip in a database entry of the second database, the second trip information being associated with the second trip ID; andassociating the first and the second users with the respective first and second trip based on a comparison of the data base entries of the first, second, and third databases associated with the same trip ID for the analysis of the travel behavior of the users based on the associated database entries of the first, the second and the third database.(8) Privacy preserving data storing method of (7), the method comprising executing a secure multi-party computation protocol for the analysis of the travel behavior based on the associated database entries of the first, the second and the third database without exchanging the first and/or the second user ID between any of the databases.(9) Privacy preserving data storing method of (7), wherein the analysis of the travel behavior comprises identifying identical users among the first and second users by comparing the first and the second user ID.(10) Privacy preserving data storing method of (8) and (9), wherein executing the secure multi-party computation protocol comprises applying private set intersection to the first user ID associated with the first trip information and the second user ID associated with the second trip information for identifying identical users among the first and second users.(11) Privacy preserving data storing method of any one of (1) to (10), wherein the second database is stored on a blockchain.(12) A computer program comprising instructions which, when executed by at least one processor, causes the processor to perform the method of any one of (1) to (11).(13) A privacy preserving data storing system, in particular for analyzing a travel behavior of one or more users of mobility-as-a-service (MaaS) transportation services, the system comprising:a first database for storing at least one user identification, user ID, identifying the one or more users on a trip together with a trip identification, trip ID, identifying the trip in a database entry of the first database;a separate second database for storing trip information on the trip with the trip ID in a database entry of the second database; anda data processing circuitry for associating the one or more users with the trip based on a combination of the database entries of the first and second databases associated with the same trip ID for an analysis of the travel behavior of the users based on the associated database entries of the first and the second database.(14) A data processing circuitry for:receiving at least one user identification, user ID, identifying one or more users on a trip together with a trip identification, trip ID, identifying the trip stored in a database entry of a first database;receiving trip information on the trip together with the trip ID stored in a database entry of a separate second database; andassociating the database entries of the first and second databases associated with the same trip ID for an analysis of the travel behavior of the users based on the associated database entries of the first and the second database.

The aspects and features mentioned and described together with one or more of the previously detailed examples and figures, may as well be combined with one or more of the other examples in order to replace a like feature of the other example or in order to additionally introduce the feature to the other example.

Examples may further be or relate to a computer program having a program code for performing one or more of the above methods, when the computer program is executed on a computer or processor. Steps, operations or processes of various above-described methods may be performed by programmed computers or processors. Examples may also cover program storage devices such as digital data storage media, which are machine, processor or computer readable and encode machine-executable, processor-executable or computer-executable programs of instructions. The instructions perform or cause performing some or all of the acts of the above-described methods. The program storage devices may comprise or be, for instance, digital memories, magnetic storage media such as magnetic disks and magnetic tapes, hard drives, or optically readable digital data storage media. Further examples may also cover computers, processors or control units programmed to perform the acts of the above-described methods or (field) programmable logic arrays ((F)PLAs) or (field) programmable gate arrays ((F)PGAs), programmed to perform the acts of the above-described methods.

The description and drawings merely illustrate the principles of the disclosure. Furthermore, all examples recited herein are principally intended expressly to be only for illustrative purposes to aid the reader in understanding the principles of the disclosure and the concepts contributed by the inventor(s) to furthering the art. All statements herein reciting principles, aspects, and examples of the disclosure, as well as specific examples thereof, are intended to encompass equivalents thereof.

A functional block denoted as “means for . . . ” performing a certain function may refer to a circuit that is configured to perform a certain function. Hence, a “means for s.th.” may be implemented as a “means configured to or suited for s.th.”, such as a device or a circuit configured to or suited for the respective task.

Functions of various elements shown in the figures, including any functional blocks labeled as “means”, “means for providing a signal”, “means for generating a signal.”, etc., may be implemented in the form of dedicated hardware, such as “a signal provider”, “a signal processing unit”, “a processor”, “a controller”, etc. as well as hardware capable of executing software in association with appropriate software. When provided by a processor, the functions may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which or all of which may be shared. However, the term “processor” or “controller” is by far not limited to hardware exclusively capable of executing software, but may include digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), read only memory (ROM) for storing software, random access memory (RAM), and non-volatile storage. Other hardware, conventional and/or custom, may also be included.

A block diagram may, for instance, illustrate a high-level circuit diagram implementing the principles of the disclosure. Similarly, a flow chart, a flow diagram, a state transition diagram, a pseudo code, and the like may represent various processes, operations or steps, which may, for instance, be substantially represented in computer readable medium and so executed by a computer or processor, whether or not such computer or processor is explicitly shown. Methods disclosed in the specification or in the claims may be implemented by a device having means for performing each of the respective acts of these methods.

It is to be understood that the disclosure of multiple acts, processes, operations, steps or functions disclosed in the specification or claims may not be construed as to be within the specific order, unless explicitly or implicitly stated otherwise, for instance for technical reasons. Therefore, the disclosure of multiple acts or functions will not limit these to a particular order unless such acts or functions are not interchangeable for technical reasons. Furthermore, in some examples a single act, function, process, operation or step may include or may be broken into multiple sub-acts, -functions, -processes, -operations or -steps, respectively. Such sub acts may be included and part of the disclosure of this single act unless explicitly excluded.

Furthermore, the following claims are hereby incorporated into the detailed description, where each claim may stand on its own as a separate example. While each claim may stand on its own as a separate example, it is to be noted that—although a dependent claim may refer in the claims to a specific combination with one or more other claims—other examples may also include a combination of the dependent claim with the subject matter of each other dependent or independent claim. Such combinations are explicitly proposed herein unless it is stated that a specific combination is not intended. Furthermore, it is intended to include also features of a claim to any other independent claim even if this claim is not directly made dependent to the independent claim.