Monitor and correct obfuscation of vehicle-related data

Abstract

A method and apparatus for monitoring and correcting obfuscation of vehicle-related data of a vehicle, the vehicle-related data being transmitted to a back-end computer and obfuscated through an anonymization filter, comprising: deleting personal data from the transmitted vehicle-related data; merging the vehicle-related data after deleting personal references into a vehicle-related data group without personal references; performing temporal and spatial obfuscation on the vehicle-related data group without personal references based on an estimated group size of vehicles for data collection to generate an anonymous data group; and providing the anonymous data group including the degree of obfuscation to a data user; determining an actual group size for a spatial region based on the provided anonymous data group; comparing the determined actual group size with the estimated group size used to obfuscate the anonymous data group; and using the comparison result to correct the obfuscation of the spatial region.

Description

Technical Field

[0001] The invention relates to a method and a device for monitoring and correcting the obfuscation of vehicle-generated data, in particular surrounding data, which are transmitted to a back-end computer (hereinafter referred to as the back-end), so that no conclusions can be drawn about the vehicle and / or its passengers from the obfuscated data. Background Art

[0002] In current applications, data generated by the vehicle's sensor system for different systems is acquired from the vehicle and fed to the backend. For example, location-related and time-related data from vehicle sensors can be used in applications such as weather forecasts, parking space occupancy or also traffic flow data. In the backend, these data from the vehicle are then combined with data from other vehicles on the map and the results are fed back to the function that makes use of them.

[0003] For reasons of data protection, however, the collected data sets are always provided to the respective functional user in an anonymous form. The following process is used for this purpose:

[0004] -The vehicle sends personal data to the backend,

[0005] - The backend checks the data and performs anonymization, and

[0006] - The functions used obtain anonymous data for further processing.

[0007] The anonymization itself is based on various assumptions, in which traffic volumes and market penetration rates are estimated for the area in which the data is collected. However, there has been no way to check these estimates in large-scale use. However, due to the strict data protection requirements, these estimates must have a safety margin, which could reduce the quality of the data set and therefore the information value of the functions that use the anonymized data set.

[0008] Document US2018 / 0131740 A1 describes a system and method for anonymizing a transmitted data set, comprising:

[0009] - processing one or more data sets into one or more anonymous vector representations of the data sets,

[0010] - load the generalized vector containing the desired degree of anonymization,

[0011] - compare the anonymized vector representation of the data set with the generalized vector,

[0012] - based on the comparison, determining whether the anonymized vector representation of the data set is sufficiently anonymous,

[0013] - identify the time period during which sufficiently anonymized data sets were sent, and

[0014] - Increasing or decreasing the amount of computer resources that determine whether the vector representation of the data set is sufficiently anonymized based on the remainder of the time in the time period.

[0015] In other words, the document US2018 / 0131740 A1 mentioned describes an algorithm which checks in a database whether certain data categories can be anonymized. Here, for example, people living in a postal code area are determined. If the number of people in the postal code area is sufficient for the anonymization requirement, these data are marked as anonymizable and released for further processing steps. If the release is not made, further data are collected and the check is repeated until the release is achieved. Summary of the invention

[0016] The object of the present invention is therefore to provide a method and a device for monitoring an anonymization filter for vehicle-related data.

[0017] The technology solves the problem by a method having the features of the invention and by a corresponding device having the features of the invention. The preferred design of the invention is the content of the invention.

[0018] The invention relates to a method according to the invention for monitoring and correcting the obfuscation of vehicle-related data of a vehicle, which vehicle-related data are transmitted to a backend computer and obfuscated by an anonymization filter, comprising:

[0019] - delete personal data from the transmitted vehicle-related data,

[0020] - merge the vehicle-related data after the removal of personal references into a vehicle-related data group without personal references,

[0021] - performing temporal and spatial obfuscation of the vehicle-related data set without individual reference to generate an anonymous data set based on the estimated population size of vehicles subject to data collection, and

[0022] - provide anonymized data sets including the degree of obfuscation to data users, where

[0023] - determining the actual group size for a spatial region based on the provided anonymous data set,

[0024] - comparing the determined actual group size with the estimated group size used to obfuscate the anonymized data set, and

[0025] The comparison results are used to correct for aliasing in spatial regions.

[0026] Therefore, the functionality of the anonymization filter is checked item by item for the obfuscated characteristic parameters. The comparison result is then fed back to the anonymization filter as a location-dependent correction value and any deviations of the estimated group size from the measured reality are corrected thereby, wherein the estimated group size can be estimated, for example, based on the traffic density in the surroundings of the vehicle collecting the data.

[0027] Preferably, the aliasing is corrected both temporally and spatially, so that the aliasing matches reality in both respects. In other words, the aliasing is achieved by adding noise to the measurement location and the measurement time point.

[0028] To determine the actual group size, it is also preferred to perform:

[0029] - randomly select an initial anonymous data set,

[0030] - for a predefined time interval, collecting a further anonymous data set subsequent to the initial data set, wherein the further data set relates to a region of the initial data set,

[0031] - determining the actual group size by determining the number of anonymous data sets within a predetermined time interval for a spatial region predetermined by the obfuscated positions of the initial data sets,

[0032] - comparing the actual group size to an estimated group size determined by the degree of confounding of the initial data set, and

[0033] - Correction of the obfuscation of the anonymization filter for the predefined spatial region as a function of the comparison result.

[0034] In this way, based on the anonymous data set following the initial data set, an actual group size is determined for the spatial region defined by the positions of the initial data set, so that the estimated group size for this region can be corrected using the actual group size. The temporally confounding time offset defined by the initial data set is preferably used as a predefined time interval for determining the actual group size.

[0035] Further preferably, correction parameters for different spatial regions are stored in correction maps for different spatial regions, and the correction of the estimated group size is performed according to the correction maps for the corresponding regions.

[0036] Further preferably, the correction of the aliasing of the spatial region is performed in a continuously differentiable manner. In this way, it is ensured that the correction is performed slowly depending on the determined actual group size, so that the correction map is changed only slowly in order to avoid oscillations in the aliasing behavior.

[0037] The degree of obfuscation of the anonymized data set can furthermore preferably be checked as follows: whether an attacker can again identify the vehicle from which the data was collected from the anonymized data set. For this purpose, a mean-time-to-confusion method can preferably be used.

[0038] The invention relates to a device according to the invention for monitoring and correcting the obfuscation of vehicle-related data of a vehicle, which vehicle-related data are transmitted to a backend computer, wherein the device is configured and designed to carry out the method set out above, the device comprising:

[0039] - an anonymization filter for anonymizing vehicle-related data, said anonymization filter having

[0040] - means for erasing personal data,

[0041] - means for calculating traffic density,

[0042] - means for temporally obfuscating the data,

[0043] - means for spatially obfuscating the data, and

[0044] - means for outputting the anonymized data with an indication of the degree of obfuscation,

[0045] as well as

[0046] - an observer having

[0047] - means for randomly selecting an anonymous data set,

[0048] - means for collecting additional anonymous data sets for the same location and determining the actual group size, and

[0049] - means for comparing the actual group size with the estimated group size to determine correction parameters for the anonymization filter.

[0050] As already explained, the obfuscation is achieved by adding noise to the measured positions and the measured time points. Data sets that are comparable for the observer are determined within the obfuscated time and space intervals, which then indicate the group size.

[0051] Preferably, the anonymization filter comprises a controller and a correction map, whereby temporal and spatial confounding related to the estimated group size is corrected directly for the current region.

[0052] It is further preferred that the anonymization filter has means for creating and limiting the input data set. In this way, data from which conclusions can be drawn about the vehicle can be deleted. Thus, for example, in order to ensure the anonymity of the vehicle, at least the area around the starting point and the end point of the trip of the vehicle for which the data was collected is deleted. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The preferred design of the present invention is described in more detail below with reference to the accompanying drawings.

[0054] In the figure:

[0055] Figure 1 An anonymization filter with connected observers is shown schematically. DETAILED DESCRIPTION

[0056] Figure 1 The anonymization filter A shown in FIG. 1 , which is arranged in the backend for data collection, is fed with vehicle-related data with a personal reference via an input unit IN, wherein these vehicle-related data include application-specific parameters. The personal reference of the data includes, for example, the vehicle identification number of the vehicle for data collection and data transmission, and optionally further identifiers that allow conclusions to be drawn about the vehicle or the person in the vehicle.

[0057] In other words, the anonymization filter A anonymizes the data received from a moving vehicle, which in particular collects data about the vehicle's surroundings along its route during driving with the help of its surroundings sensor system and transmits it wirelessly to the back end. These vehicle-related data of the relevant vehicle include, for example, information about weather conditions, current traffic conditions (such as traffic flow, traffic obstacles such as traffic jams, construction sites, accidents, etc.) and other information determined by sensors of various assistance systems. In addition, the continuous position of the vehicle including time stamp, the speed of the vehicle collecting data if necessary, and an identifier for identifying the vehicle collecting data are transmitted. Now, the task of the anonymization filter A is to remove personal references from the data and to obfuscate the data so that no conclusions can be drawn about the vehicle collecting the data, so that the data can be transferred to third parties for further analysis.

[0058] In section A1 of the anonymization filter A, the above-mentioned personal data are deleted from the data flow of the vehicle from the input unit IN in addition to the vehicle-related data, namely the vehicle identification number of the vehicle in which the data collection and data transmission take place, as well as further identifiers that allow conclusions to be drawn about the vehicle or the persons in the vehicle.

[0059] In the subsequent section A2, the incoming data are combined into a data set, wherein the data set is cut by setting a start mark and an end mark. This means that, for example, data in a predetermined area around the start and end point of the vehicle's journey is deleted from the data stream, wherein the predetermined area is defined by a predetermined distance from the start and end point of the vehicle's journey for data collection.

[0060] The traffic density is then calculated in section A3. This should be understood as determining how many vehicles are present in the surroundings of the vehicle collecting data. This can be achieved, for example, by analyzing the distance between the vehicle collecting data and the vehicles traveling in front and behind, taking into account the vehicle speed, so that the traffic density in the surroundings of the vehicle collecting data can be determined. Based on the determined traffic density, as a function of the position of the vehicle collecting data, it is estimated how many vehicles communicating with the back end are located in the current area in which data collection is performed. For example, if section A3 determines that there are 20 vehicles in a predetermined surrounding environment based on distance measurement, it can be determined, for example, based on registration statistics for the current area, that among these 20 vehicles, there may be five vehicles of a certain brand that perform data collection in the predetermined surrounding environment. From these five vehicles, it can then be assumed based on the distribution of the communication devices on the vehicle side that on average three vehicles communicate with the back end.

[0061] In section A4, a first anonymization is performed by temporally obfuscating the data in the data set generated in section A2, wherein the time stamp of the data is deliberately falsified by obfuscation. This temporal obfuscation can be realized, for example, in a linearly distributed manner with a predetermined time offset (for example, 0 to 30 minutes), wherein the offset is optionally a function of the estimated traffic density. Other time distribution functions for temporal obfuscation can also be used.

[0062] In the subsequent section A5, the received data are spatially obfuscated by changing the actual spatial position of the data. This can be achieved, for example, by applying position noise of a predetermined distance (e.g. + / - 1 km). The purpose of the spatial obfuscation together with the described temporal obfuscation is to make the data of the vehicle collecting the data appear as if they were generated by a group of a predetermined number of vehicles. Thus, for example, it can be predetermined that the size of the group communicating with the backend in the considered area includes a number of 10 vehicles.

[0063] In section A6 of the anonymization filter A, the temporally and spatially obfuscated data of the data set of the vehicle that collected the data are combined with an indication of the degree of obfuscation according to the model settings, and the data set is provided to the user via the output terminal OUT, who analyzes the data set according to his specifications and requirements. In this case, the degree of obfuscation here means the group size that has been achieved for the obfuscation, i.e. the group size. By way of example, the data set has been changed, for example, so that the data set can be generated from a group of ten possible vehicles, i.e. the group size that defines the degree of obfuscation is ten in this example. In addition, the distribution function including the time offset used to obfuscate the data and the position noise used are output in the anonymized data set.

[0064] As already explained, the anonymization filter A comprising sections A1 to A6 is dependent on the calculation of the traffic density in section A3 , which includes an estimate of how many vehicles are present in the area in which the data are collected and which communicate with a suitable backend.

[0065] In order to verify and continuously improve the anonymization filter A and its estimation of the traffic density, an observer B is assigned to the anonymization filter A, wherein the observer B performs a point-by-point check on the functionality of the anonymization filter A. In this case, the following is performed:

[0066] In section B1 , a random initial anonymous data set with an indication of the degree of obfuscation is extracted by observer B. This extraction can be performed for each data set or, for reasons of computational performance, only for every tenth, hundredth or thousandth of the anonymous data set.

[0067] Subsequently, in this respect, the data sets that have passed through the anonymization filter A after the extracted initial data set are checked in section B2 to see whether these data sets fall into the anonymization group together with the initial data set. In other words, further data sets that fall into the position noise of the initial data set are collected and merged with the initial data in section B2, wherein this achieves a temporal obfuscation within a predetermined time interval from zero to the above-mentioned predetermined maximum time offset.

[0068] After the time interval has elapsed, the data found are counted in section B3 and the anonymized group of positions for the initial data group after the noise is actually determined. The measured actual size, i.e. the number of data groups found in the position interval within the time interval, is compared with the nominal size, i.e. the group size specified in the initial data group. The difference between the nominal size estimated in section A3 of the anonymization filter A and the real actual size is fed to the controller A7 of the anonymization filter A together with the position reference and time reference of the data.

[0069] Controller A7 feeds the result, i.e. the difference between the setpoint value and the actual value, to a correction map in section A8, wherein only limited adjustments are made by controller A7 and the correction map of section A8. In this case, the correction map itself consists of map tile elements, which, due to observer B, have corresponding correction values ​​which adjust the confusion directly in the tile. As a result, the model of the vehicle that is transmitting the confusion is adjusted to match reality as well as possible. The tile elements of the map here include a predefined surrounding environment of a set of locations. In other words, for example, a map of a federal state includes a predetermined set of tile elements that cover the map of the federal state.

[0070] The purpose of adjusting the correction map is only to slowly change the correction map itself. Therefore, both positive and negative outliers can be identified by the controller A7 and correspondingly intercepted, so that the correction map is always correct on average. Due to the local accumulation of vehicles or vehicle categories at a certain location at a specific time, there will always be short-term outliers in the vehicle group, but the outliers are not allowed to affect the correction map of section A8. In addition to the location, that is, the location, the model is also corrected in the time point of the data in another dimension. Here, the time deviation of the model is identified and can be corrected accordingly with respect to the location. In other words, the adjustment of the correction map should not be carried out suddenly, because this may cause oscillation of the controller. Therefore, if the measurement of observer B shows that there is an actual group size of ten vehicles, although a group size of 20 vehicles has been assumed for confusion due to the estimation of traffic density, the confusion in time and space will not be suddenly changed as follows: the group size used for confusion is increased to 20 vehicles, but in the correction map, for example, an average value of 15 vehicles can be used, which can then be slowly further increased as a function of observer B.

[0071] Although the solution of observer B is intended to randomly check the obfuscation method and its parameters, an additional mechanism can be implemented in the backend, which continuously measures and quantifies the degree of obfuscation, i.e. the effectiveness of the selected method. This also involves checking whether an attacker can use the method of picking out links (so-called singling out) from existing data sets to identify people or vehicles again from the data storage, for example by correlation analysis or inference (i.e., deriving the value of a feature from the significant probability of the values ​​of a series of other features), or to recover personal references again in anonymized data sets.

[0072] Since this is currently geospatial data and data with associated timestamps, the "Mean Time To Confusion (MTTC)" method is provided for this purpose, for example. Here, a continuous measurement is made of how long an attacker can successfully track an anonymous user in a defined trust environment. The better the method selected for anonymizing the data set, the shorter the MTTC. The algorithm is therefore a measure of the effectiveness of the selected anonymization method.

[0073] Thus, for example, a trip in a data set of random trips of different vehicles originally traveling can be associated with a certain probability based on time, location, driving direction and speed. In the case of repeated execution and large data sets, it can be calculated how long a trajectory in the anonymized data set can be followed with a defined probability. The averaged MTTC can be determined from this distribution of the "obfuscation time" over the trajectory length.

[0074] With the proposed observer concept, the anonymization component can be checked for validity both randomly by observer B and continuously, for example, by the MTTC method, in the backend. This significantly improves the use of anonymized personal data in compliance with data protection law.

[0075] Reference numerals list

[0076] A Anonymization filter

[0077] B. Observer

[0078] IN raw data group input

[0079] OUT anonymous data output

[0080] A1 Remove personal data from the original data set

[0081] A2 Cut Data Group

[0082] A3 Calculate traffic density

[0083] A4 Time Confusion

[0084] A5 Confusion in space

[0085] A6 Data set without personal reference including statement of degree of obfuscation

[0086] A7 Controller for correcting confusion

[0087] A8 Correction map for confusion intensity

[0088] B1 randomly selects data groups

[0089] B2 collects another data set with the same location

[0090] B3 Determine the correction parameters based on the collected data set

Claims

1. A method for monitoring and correcting the obfuscation of vehicle-related data of a vehicle, the vehicle-related data being transmitted to a backend computer and obfuscated by an anonymization filter (A), the method comprising: delete personal data from the transmitted vehicle-related data, Merge the vehicle-related data after the deletion of personal data into a vehicle-related data set without personal data, Based on the estimated group size of vehicles subject to data collection, performing temporal and spatial obfuscation of the vehicle-related data set without personal data to generate an anonymous data set, and Provide anonymized data sets including the degree of obfuscation to data users, where Determine the actual group size for the spatial region based on the provided anonymous data set, comparing the determined actual group size to the estimated group size used to obfuscate the anonymized data set, and The comparison results are used to correct the confusion of spatial regions. In order to determine the actual group size, the method includes: Randomly select an initial anonymous data set, For a predetermined time interval, a further anonymous data set is collected after the initial data set, wherein the further data set relates to a region of the initial data set, For a spatial region predetermined by the obfuscated positions of the initial data set, the actual group size is determined by determining the number of anonymous data sets within a predetermined time interval, comparing the actual group size to the estimated group size determined by the degree of confounding of the initial data set, and Depending on the comparison result, the anonymization filter (A) is corrected for the aliasing of the predefined spatial region.

2. The method according to claim 1, characterized in that Confusion is corrected both temporally and spatially.

3. The method according to claim 1 or 2, characterized in that: Correction parameters for different spatial regions are stored in correction maps for different spatial regions, and the estimated group size is corrected according to the correction maps for the corresponding regions.

4. The method according to claim 1 or 2, characterized in that: The correction of the aliasing of the spatial region is performed in a continuously differentiable manner.

5. The method according to claim 1 or 2, characterized in that: The degree of obfuscation of the anonymized data set is further checked as to whether an attacker can again identify the vehicle from which the data was collected from the anonymized data set.

6. The method according to claim 5, characterized in that The average confusion time method was used.

7. A device for monitoring and correcting the obfuscation of vehicle-related data of a vehicle, which vehicle-related data is transmitted to a backend computer, wherein the device is configured and designed to perform the method according to any one of the preceding claims, The device has an anonymization filter (A) for anonymizing vehicle-related data, the anonymization filter comprising Means for erasing personal data (A1); Device for calculating traffic density (A3); means (A4) for temporally obfuscating the data; Means for spatially obfuscating data (A5); as well as means for outputting the anonymized data with an indication of the degree of obfuscation, and The device has an observer (B) having means (B1) for randomly selecting an anonymous data set; means (B2) for collecting additional anonymous data sets for the same location and determining the actual group size; as well as Means for comparing the actual group size with the estimated group size to determine correction parameters for an anonymization filter (A).

8. The device according to claim 7, characterized in that The anonymization filter (A) comprises a controller (A7) and a correction map (A8).

9. The device according to claim 7 or 8, characterized in that The anonymization filter (A) has means (A2) for creating and limiting input data sets.

Images