Method for providing functionality in a vehicle and information technology system

Abstract

The invention relates to a method for providing a functionality in a vehicle (1), wherein first information (2) is collected in the vehicle (1) and indirectly sent to a service provider (3) for processing while concealing the identity of the vehicle (1), wherein result data (4) generated during processing by the service provider (3) are indirectly sent back to the vehicle (1) and the result data (4) are processed in the vehicle (1) to provide the functionality.The method according to the invention is characterized in that a central computing unit (5) mediates between the vehicle (1) and the service provider (3), wherein the central computing unit (5) sends a request message (6) to the service provider (3) to initiate the generation of result data (4), wherein the central computing unit (5) applies a defined transformation rule (7) to the information received from the vehicle (1) and exchanges and / or artificially generates at least a portion of the first information (2) and applies a reverse transformation rule (8) to the result data (4T) received from the service provider (3) and transmits it to the vehicle (1), where it is processed to provide the functionality.

Description

[0001] The invention relates to a method for providing functionality in a vehicle according to the type defined in more detail in the preamble of claim 1, and to an information technology system for carrying out the method.

[0002] With increasing digitalization, more and more vehicle functions are being offered that involve data processing by external service providers. For this purpose, information is collected in the vehicle, wirelessly transmitted to the service provider, processed there, and the resulting data is then sent back to the vehicle to provide the function. Route calculation as part of a navigation system or a voice assistant are examples of such services. The service provider then receives information such as traffic data describing current traffic jams or road closures, enabling adjustments to the navigation route accordingly. A voice assistant allows the user to operate vehicle functions such as the infotainment system, climate control, and similar features, as well as to retrieve information from the internet.The processing of user input takes place in a cloud environment of the service provider using natural language processing methods.

[0003] The use of such functionalities in the vehicle requires data exchange between the vehicle and the service provider. This may include the transmission of sensitive information such as personal data. This information, along with associated metadata, can allow inferences to be drawn about the user's identity and / or behavior. Access to such sensitive information by unauthorized third parties must be prevented. It is conceivable that attackers could gain access to the service provider's IT systems to steal sensitive data and use it for further attacks on the user. For example, attackers could use this data to determine a user's movement patterns, use them for espionage, and / or plan an attack on the user.

[0004] Processing user requests using large language models (LLMs) is a well-established technique. See, for example, https: / / de.wikipedia.org / wiki / Large_Language_Model. User requests can be submitted in writing via a web interface.

[0005] Such large language models can also be integrated into the processing of user input in the context of voice assistants. See, for example: https: / / cariad.technology / de / en / news / stories / integrating-large-language-models-onwheels.html. The personalization of input prompts to a large language model by adding specific user attributes is also known from US 2024 / 0403564 A1.

[0006] Furthermore, US patent 2017 / 0230797 A1 discloses a gateway for vehicles designed to protect privacy. The gateway acts as an intermediary between a vehicle and a service provider. It functions as a VPN, preventing the service provider from accessing the IP address of the vehicle's communication modules. Instead, the gateway submits service requests, so the service provider only sees the gateway's IP address. However, a drawback is that simply masking the IP address does not provide sufficient data protection. The information contained in the service requests can still reveal individual patterns, potentially revealing the identity of individuals or vehicles and inferring behavioral patterns.

[0007] Furthermore, US 2017 / 0 103 587 A1 describes a method for controlling data collected from vehicles, whereby case data is anonymized and reduced. Additionally, DE 10 2011 106 295 A1 shows a method for the bidirectional transfer of data between motor vehicles and a service provider, involving the provision of information data receivable by the motor vehicles and originating from the service provider via a data infrastructure cloud, and the provision of traffic data describing traffic conditions and originating from the motor vehicles.

[0008] The present invention is based on the objective of providing a particularly safe method for providing a functionality in a vehicle.

[0009] According to the invention, this problem is solved by a method for providing a functionality in a vehicle with the features of claim 1. Advantageous embodiments and further developments as well as an information technology system for carrying out the method are set forth in the dependent claims.

[0010] A generic method for providing functionality in a vehicle, wherein initial information is collected in the vehicle and indirectly sent to a service provider for processing while concealing the vehicle's identity, wherein result data generated during processing by the service provider is indirectly sent back to the vehicle and the result data is processed in the vehicle to provide the functionality, is further developed according to the invention in that a central computing unit mediates between the vehicle and the service provider, wherein the central computing unit sends a request message to the service provider to commission the generation of result data.wherein the central computing unit, applying a defined transformation rule to the information received from the vehicle, exchanges at least a portion of the initial information and / or artificially generates it, and, applying a reverse transformation rule suitable for reverse transformation to the result data received from the service provider, generates transformed result data and transmits it to the vehicle, where it is processed to provide the functionality.

[0011] Using the central computing unit, the transmission of sensitive information from the vehicle to the service provider can be prevented. This increases the security of the functionality. Sensitive information is either exchanged or supplemented by including artificially generated content, making it impossible to trace whether the data is sensitive or which part might be sensitive. The central computing unit acts as a kind of translator, applying transformation and reverse transformation rules. For the functionality to function, the processing of relevant information is necessary. Therefore, if parts of the initial information are exchanged, the central computing unit contains information about which information was exchanged and by what means.Accordingly, the central computing facility is able to transform the result data, which is retrieved from the service provider, back into its original form.

[0012] The initial information can include, for example, time or location data. This information can be blurred or "noiseed." Instead of a precise geolocation, for instance, an area or a geolocation within that area, which differs from the vehicle's actual geolocation, can be transmitted. If information is artificially added, it can subsequently be removed from the resulting data by the central processing unit.

[0013] The central computing unit has read access to a computer-readable storage medium containing machine-interpretable instructions. When executed by a processor of the central computing unit, these instructions cause the unit to implement the inventive method for mediating between the vehicle and the service provider. The vehicle and the central computing unit can exchange information in a proven manner, particularly using a wireless communication channel. For example, the vehicle can be connected to the internet via mobile network. Information can thus be transmitted using established application programming interfaces (APIs). The central computing unit can therefore also be referred to as a server, cloud server, or backend. Similarly, the service provider also has its own infrastructure for providing its service.The central computing facility and a server operated by the service provider can also communicate with each other via the internet. Established APIs are used for this purpose. Data transmission is secured, in particular cryptographically, for example using the HTTPS protocol and / or homomorphic encryption.

[0014] The central computing unit packages the initial information in a manipulated form into request messages for the service provider. These request messages have the format required for using the respective service. Therefore, no adjustments to the infrastructure used by the service provider are necessary to enable the inventive method to function.

[0015] The service provider transmits the respective result data back to the central computing unit. This unit translates the content into transformed result data, taking into account the reverse transformation rule. This data is then processed in the vehicle in the previously established manner. This allows the functionality to be provided in the vehicle while increasing user safety.

[0016] The way the central computing unit structures request messages, i.e., manipulates the actual information received from the vehicle, is particularly prone to being varied over time. This makes it difficult for the service provider to detect manipulations, or, in the case of a compromise by an attacker, for the attacker themselves.

[0017] An advantageous further development of the method according to the invention provides that the central computing unit exchanges vehicle identity information, in particular an IP address, which is associated with the first set of information in the form of metadata. In other words, the central computing unit thus operates like a VPN server. The request messages are not transmitted directly from the respective vehicles to the service provider, but rather by the central computing unit. Metadata that would allow a direct inference about the identity of the vehicle or user, such as an IP address, a MAC address, a Bluetooth identifier, or the like, cannot be read by the service provider, as this information is not transmitted. Therefore, the service provider cannot identify which vehicles are making the respective service requests.Instead, the service provider only sees the corresponding identifiers of the hardware implemented in the server. Furthermore, the central computing facility can act as a kind of filter to prevent the service provider from inferring the identity of the vehicles through various tracking methods, such as fingerprinting or the use of browser-based cookies.

[0018] According to a further advantageous embodiment of the method according to the invention, it is further provided that the application of the transformation rule involves replacing an identity information of the vehicle and / or a user contained in the first information with a placeholder, and the reverse transformation rule involves replacing a placeholder contained in the result data with the identity information, in particular by using a one-way function with a trapdoor. The central computing unit has the information about which part of the first information is replaced by which placeholder. Thus, if the service provider processes a corresponding request message and returns result data, the central computing unit can replace the placeholders contained in the result data with the respective underlying original partial information of the first information.One-way functions with a trapdoor are particularly preferred for this purpose. These are also known as trapdoor functions. For example, the content of the initial information can be transformed into a hash value by applying a defined hash function, and this hash value can then be included in the request message instead of the actual content.

[0019] The vehicle manufacturer knows which functionalities are available in a vehicle. In particular, the central computing unit is operated by the vehicle manufacturer. Accordingly, the central computing unit has the information regarding the required format of the data transmitted to the service provider to ensure successful provision of the functionality despite data manipulation. Which portion of the initial information is replaced by placeholders can be defined specifically for each functionality, similar to a template or mask. For example, the initial information might include a unique identifier for the vehicle and / or the user, such as a vehicle identification number and / or a username for a user account.The central computing facility can store one or more pseudonyms for specific vehicles, vehicle components, and / or users, which can be used as placeholders in respective request messages. In particular, the use of multiple pseudonyms makes it more difficult for the service provider or a potential attacker to deduce the true identity of the vehicle, vehicle components, and / or user.

[0020] For some functionalities, it may be necessary to transmit information to the service provider that, due to its nature, could allow inferences to be made about personal information. For example, a service that searches for a restaurant near the vehicle relies on the vehicle's geolocation. As described previously, however, the vehicle's exact geolocation can be vaguely defined. For instance, instead of the precise geolocation, the vehicle's location can be transmitted in the form of What3Words. This allows the service provider to know approximately where the vehicle is located—namely, which tile on a map subdivided into segments—but not its precise location.

[0021] A further advantageous embodiment of the method according to the invention provides that the application of the transformation rule involves replacing a designation for a given situation contained in the initial information with a placeholder, and the reverse transformation rule involves replacing a placeholder contained in the result data with the designation. Thus, not only identity information that allows a direct inference about the identity of the vehicle and / or user, but also other critical information can be concealed. In addition to a vehicle identification number, a username, geocoordinates, and the like, the initial information can, for example, also include sensor data or the words of a voice command.This can be understood as the imposition of noise or "random noise" on a service request, so that relevant information is lost in or replaced by irrelevant information.

[0022] The functionality can, for example, involve processing such voice commands using a large language model, so that the query messages include corresponding input prompts for the large language model. Accordingly, words or numbers contained in these input prompts can be interpreted as descriptive information and replaced with placeholders. The partial content of the initial information is thus abstracted by the central processing unit. Synonyms or similar linguistic terms that exhibit a certain semantic similarity can be used for words. Methodologically, this can be implemented, for example, using knowledge graphs or ontologies.For example, if a vehicle sends a message asking for the nearest fast-food chain, the central computer system does not transmit the chain's actual name to the service provider. Instead, it uses a dummy name or placeholder located near the user's knowledge graph. A label with a broader category, such as "fast-food restaurant," is also conceivable. This prevents the service provider or attacker from knowing which specific fast-food restaurant the user prefers. A similarly semantically related term would be searching for an industrial park, as these areas often contain fast-food restaurants.Here, a distance measure can be inserted so that the semantic similarity concept lies within a target interval defined by a minimum distance and a maximum distance, using suitable similarity measures such as cosine similarity or a distance between nodes in a graph.

[0023] The selection of specific placeholders can be optimized based on user satisfaction with a given service provision.

[0024] According to a further advantageous embodiment of the method according to the invention, the application of the transformation rule provides for the artificial generation of complete initial information. The central computing unit can therefore not only exchange or artificially regenerate a portion of the initial information, but also generate complete request messages that have no real connection to a vehicle. Thus, artificial request messages are generated that simulate the fictitious use of functionalities in a vehicle for the service provider.

[0025] In particular, the central computing facility transmits artificially generated request messages to the service provider at irregular intervals. This makes it difficult to recognize patterns, which in turn makes it even harder to conclude that the corresponding request messages were artificially generated.

[0026] A further advantageous embodiment of the method according to the invention provides that the central computing unit uses information contained in initial information received from a second vehicle as a placeholder for a request message sent to a first vehicle. Thus, the context of several vehicles connected to the service provider via the central computing unit is mixed together. Since real data is used instead of artificially generated data, identifying manipulations is made even more difficult for the service provider or attacker. This also applies to the behavioral patterns of the various users that can potentially be reconstructed from the data. However, the central computing unit has the information about which original information originated from which vehicle or user, so that a corresponding reverse transformation is possible.Various methods of so-called differential privacy can be used.

[0027] Preferably, the central computing unit selects the second vehicle, from which initial information is to be used to create placeholders, based on a time difference between the receipt of the initial information from the first and second vehicles. For example, the central computing unit combines at least part of the initial information from a first and second vehicle that submit corresponding service requests to the service provider at essentially the same time, i.e., within a certain defined time window such as 500 milliseconds, 5 seconds, 1 minute, 5 minutes, or the like. In this way, the first and second vehicles exhibit a similar behavior pattern, making it even more difficult to differentiate between them. However, it is also conceivable to select as the second vehicle a vehicle that submitted a service request within a different time window.It is also conceivable that this service request was made by the first vehicle itself, but in the past, so that the first figure represents the second vehicle. In other words, information from historical service requests can be reused. This means that real data is included in the request messages, which makes it even more difficult for the service provider or an attacker to identify artificially generated content.

[0028] A further advantageous embodiment of the method according to the invention provides that the central computing unit artificially generates at least a portion of the first information in such a way that the artificially generated information is distributed across the request messages sent for different vehicles according to a heuristic uniform distribution. This makes it even more difficult for the service provider or corresponding attackers to identify artificially generated request messages or an artificially generated portion of a request message, since the patterns used for this purpose are harder to identify.

[0029] According to a further advantageous embodiment of the method according to the invention, it is further provided that the central computing unit processes the first information to determine a content to be exchanged and / or artificially generated using methods of natural language processing.

[0030] Natural Language Processing (NLP) methods such as tokenization, regular expressions, blacklisted items, named entity recognition, and similar techniques can be used. Unlike the previously described templates for identifying the content to be replaced or artificially generated, this approach allows for flexible adaptation to the actual content of the initial information. This further complicates the identification of modified content in the initial information.

[0031] A further advantageous embodiment of the method according to the invention provides that the central computing unit selects the strength of the transformation rule depending on a user setting. The strength of the transformation rule can thus be freely selected by the user. If the user selects a low strength, at least the partial content of the initial information is modified as little as possible. This increases the risk that characteristic behavioral patterns or identities could be identified and traced, but also leads to better quality of the resulting data. Thus, the probability increases that the functionality used in the vehicle will be provided satisfactorily. However, the user can also select a higher strength for the transformation rule, so that corresponding partial content of the initial information, and in particular a larger proportion of the initial information, is modified.This is artificially generated. This makes it more difficult to identify characteristic behavioral patterns and identities, but can lead to a decline in the quality of the resulting data. Consequently, the central computing unit can only provide the transformed data with insufficient quality. This can negatively impact the user experience when using the functionality in the vehicle. It is conceivable to adjust the strength of the transformation rule specifically for each functionality.

[0032] According to a further advantageous embodiment of the method according to the invention, the central computing unit includes initial information from several vehicles in the same request message. This allows service requests from multiple vehicles to be answered by sending a single request message to the service provider. This further complicates the recognition of characteristic behavioral patterns and identities and can lead to cost reductions for the vehicle manufacturer or fleet operator, since the underlying service provided by the service provider is requested less frequently.

[0033] The initial information from such vehicles is preferably grouped, particularly using known clustering methods, based on common characteristics. Specifically, shared service requests from vehicles located in close proximity are bundled into a single request message. For example, the central computing unit can query traffic information for a specific geographic region and simultaneously send the response to multiple vehicles.

[0034] A further advantageous embodiment of the method according to the invention provides for the integration of a voice assistant as a functional element, particularly one implemented by the service provider using a large language model. The voice assistant can preferably be used to control the functionality of a navigation system. This allows users to search for points of interest (POIs) near their current location or a desired destination, or to define a navigation route. Navigation route planning is a particularly sensitive service with regard to data protection, as it involves processing the user's location and typical movement patterns. In this context, the method according to the invention can thus significantly enhance the user's protection against attacks.

[0035] According to the invention, a generic information technology system is characterized by a central computing unit set up for mediation between at least one vehicle and a service provider according to a method described above.

[0036] Further advantageous embodiments of the inventive method for providing functionality in a vehicle and of the inventive information technology system also result from the exemplary embodiments, which are described in more detail below with reference to the figures.

[0037] This shows: Fig. 1. A schematic representation of the system architecture of a central computing unit mediating between a vehicle in a fleet and a service provider for the provision of functionality in the vehicle; and Fig. 2 a schematic flowchart of the manipulation of the information exchanged between the vehicle and the service provider.

[0038] Fig. Figure 1 shows a highly schematic representation of the structure of an information technology system according to the invention for mediating information between a vehicle 1 and a service provider 3 for the provision of a function in the vehicle 1 by a central computing unit 5. How Fig. Figure 1 shows that vehicle 1 and the central computing unit 5 are connected to each other using wireless communication technology. For example, the central computing unit 5 could be a cloud server. Vehicle 1 may be equipped with a telecommunications unit that allows it to connect to the internet, for example via mobile network, Wi-Fi, or similar technology.

[0039] Vehicle 1 is part of a vehicle fleet 9, managed, for example, by a vehicle manufacturer. In particular, the central computing facility 5 is operated or at least managed by the vehicle manufacturer. The individual vehicles in the vehicle fleet 9 can also use corresponding services to provide functionalities.

[0040] How Fig. Figure 1 shows that the central computing facility 5 allows the use of the services offered by different service providers 3 equally for all vehicles in the vehicle fleet 9.

[0041] To provide the functionality in vehicle 1, as follows: Fig.Figure 2 shows that initial information 2 is collected in vehicle 1 and indirectly transmitted to service provider 3 via the central computing unit 5. The central computing unit 5 packages the initial information 2 into a request message 6, adhering to the function-specific, required format. Applying a defined transformation rule 7, the central computing unit 5 replaces at least part of the initial information 2 with the information received from vehicle 1 and / or artificially generates it. The manipulated information is such that it allows service provider 3, or an attacker with access to service provider 3's IT systems, to access typical behavioral patterns of a user of vehicle 1 and / or personal, and therefore sensitive, data. This information is exchanged accordingly, so that the true identity of vehicle 1 or the user of vehicle 1 cannot be determined.The user's identity is obscured, and typical behavioral patterns can no longer be reconstructed.

[0042] Service provider 3 processes the request message 6 without recognizing that its content differs from the initial information 2, as it has no knowledge of the initial information 2. As a result, service provider 3 delivers result data 4, which is then transmitted back to the central computing unit 5. Applying a suitable inverse transformation rule 8 to the result data 4, the central computing unit 5 generates transformed result data 4T and transmits it back to vehicle 1. Vehicle 1 uses the transformed result data 4T as result data 4 and is thus able to provide the functionality.

[0043] In particular, the central computing unit 5 exchanges information in metadata that allows conclusions to be drawn about the identity of the vehicle 1 or a component in the vehicle 1, such as a modem, the telecommunications unit or the like, such as an IP address, a MAC address, a Bluetooth address or the like.

[0044] Additionally or alternatively, such information is exchanged or artificially generated in the first information 2, specifying the identity of the vehicle 1, a vehicle component, and / or the user, such as a vehicle identification number, a user account name, a name, an address, or the like. Other information can be exchanged or artificially generated, such as geocoordinates, an identifier of a point of interest, and the like. Preferably, the central computing unit 5 generates complete new request messages 6 that are unrelated to any actual use of a functionality in the vehicle 1.

[0045] In a particularly preferred embodiment, the initial information 2 transmitted by several vehicles 1 of the vehicle fleet 9, or at least subsets thereof, are packaged into a single request message 6. This ensures particularly reliable identity concealment and reduces costs for the operator of the central computing facility 5, since fewer request messages 6 have to be processed by the service provider 3 overall.

[0046] Using the inventive method or information technology system, the creation of individual user profiles of vehicles 1 by unauthorized third parties can be reliably prevented. Privacy protection is improved. The risk of an attack on a user of the vehicle 1 decreases, thereby increasing customer satisfaction.

Claims

[1] Method for providing functionality in a vehicle (1), wherein initial information (2) is collected in the vehicle (1) and indirectly sent to a service provider (3) for processing while concealing the identity of the vehicle (1), wherein result data (4) generated during processing by the service provider (3) are indirectly sent back to the vehicle (1) and the result data (4) are processed in the vehicle (1) to provide the functionality, characterized by, that a central computing unit (5) mediates between the vehicle (1) and the service provider (3), wherein the central computing unit (5) sends a request message (6) to the service provider (3) to request the generation of result data (4), wherein the central computing unit (5) applies a defined transformation rule (7) to the information received from the vehicle (1) and exchanges and / or artificially generates at least part of the content of the first information (2) and applies a reverse transformation rule (8) to the result data (4T) received from the service provider (3) and transmits it to the vehicle (1), where it is processed to provide the functionality. [2] Method according to claim 1 characterized by, that the central computing facility (5) exchanges identity information of the vehicle (1) associated with the first information (2) in the form of metadata, in particular in the form of an IP address. [3] Method according to claim 1 or 2, characterized by , that the application of the transformation rule (7) provides for the replacement of an identity information of the vehicle (1) and / or a user contained in the first information (2) by a placeholder and the reverse transformation rule (8) provides for the replacement of a placeholder contained in the result data (4) by the identity information, in particular by applying a one-way trapdoor function. [4] Method according to any one of claims 1 to 3, characterized by, that the application of the transformation rule (7) provides for the replacement of a designation information for a matter contained in the first information (2) by a placeholder and the reverse transformation rule (8) provides for the replacement of a placeholder contained in the result data (4) by the designation information. [5] Method according to any one of claims 1 to 4, characterized by , that the application of the transformation rule (7) provides for the artificial generation of complete first information (2). [6] Method according to any one of claims 3 to 5, characterized by , that the central computing unit (5) uses as a placeholder for a query message (6) sent to a first vehicle (1) information contained in first information (2) received from a second vehicle. [7] Method according to claim 6, characterized by, that the central computing unit (5) selects the second vehicle from which first information (2) is to be used to create placeholders, depending on a time difference between receiving the first information (2) from the first (1) and from the second vehicle. [8] Method according to any one of claims 1 to 7, characterized by , that the central computing unit (5) artificially generates at least part of the content of the first information (2) in such a way that artificially generated information is distributed across the query messages (6) submitted for different vehicles (1) following a heuristic uniform distribution. [9] Method according to any one of claims 1 to 8, characterized by , that the central computing unit (5) processes the initial information (2) to determine content to be exchanged and / or artificially generated using natural language processing methods. [10] Method according to any one of claims 1 to 9, characterized by , that the central computing facility (5) selects a strength of the transformation rule (7) depending on a user specification. [11] Method according to any one of claims 1 to 10, characterized by , that the central computing unit (5) includes initial information (2) from several vehicles (1) in the same request message (6). [12] Method according to any one of claims 1 to 11, characterized by , that a voice assistant is provided as a functionality, in particular by the service provider executing a large language model (3). [13] Information technology system, characterized by a central computing device (5) set up for mediation between at least one vehicle (1) and a service provider (3) according to a method according to one of claims 1 to 12.

Images