Methods for anonymizing sports data

Abstract

The invention relates to a method for anonymizing movement data of a traffic participant (1, 2) equipped with a positioning device, the traffic participant having a communication device for transmitting and receiving data to a backend server (3) and to other traffic participants (2, 1). The method according to the invention is characterized in that the movement data are collected in the form of separate time-dependent and position-dependent data sets and transmitted to the backend server (3), wherein at least some of the data sets are transmitted indirectly via at least one other vehicle (1, 2) and / or the position associations and / or time associations in at least some of the data sets are noised before transmission.

Description

Technical Field

[0001] The invention relates to a method of the type defined in detail in the preamble of claim 1 for anonymizing movement data of road users equipped with a positioning device. Background Art

[0002] Publication DE 10 2015 217 793 A1 describes a device, a method and a computer program for providing congestion information via a vehicle-to-vehicle interface. In this case, a vehicle detects congestion indicators, which include at least the vehicle speed and / or congestion warnings transmitted by vehicles in the vicinity of the vehicle. The vehicles can thus exchange and forward the corresponding data with each other.

[0003] It is also known from the general prior art that vehicles in a convoy regularly exchange data with a backend server, which is implemented as a cloud solution, for example via the Internet. There, the current traffic situation can also be reconstructed directly or in downstream systems from the movement data of the vehicles that regularly transmit their data sets. This in turn serves to control the traffic volume and can include congestion information and / or congestion warnings.

[0004] This is generally the case when the vehicle authenticates itself when the data set is transmitted to the backend server, for example using a TLS client certificate. The accuracy of the reconstruction of the traffic situation depends on the spatial and temporal resolution of the data set transmitted by the vehicle.

[0005] However, the movement data of traffic participants, such as vehicles in particular, should be regarded as personal data, which should be pseudonymized or anonymized, for example, on the backend server side. However, common anonymization practices, such as the introduction of artificial spatial and / or temporal blurring or random noise, can adversely affect the use of the data set provided on the backend side, in particular with regard to the quality of the reconstruction of the traffic situation. Here, too, abandoning anonymization in order to maintain a high reconstruction quality is a serious disadvantage. Summary of the invention

[0006] It is therefore an object of the present invention to specify a method for anonymizing movement data according to the preamble of claim 1 , in which not only anonymization is ensured but also a high quality is achieved in the data evaluation.

[0007] This object is achieved according to the invention by a method having the features of claim 1, here in particular the characterizing part of claim 1. Advantageous embodiments and improvements of the method according to the invention are revealed in the dependent claims.

[0008] The solution according to the method of the invention mainly includes two approaches, which can be used individually or in combination with each other to ensure the anonymization of movement data. According to the invention, the movement data here consists of at least a single time-related and position-related data set, so it consists of, for example, a position with a time stamp. In order to ensure that it is transmitted from the corresponding authorized vehicle of the fleet to the back-end server, the data is usually signed with a vehicle private key, and its matching with the vehicle is proved by a certificate corresponding to the private key, such as a TLS client certificate, which is sent together. But this will now ensure that the corresponding data set can be easily assigned to the corresponding vehicle in the back-end server. In order to prevent this in particular, it is now possible to use the data transmission between different vehicles that is known in principle from the prior art described in the introduction, so that the movement data collected in the form of data sets and transmitted to the back-end server are transmitted in such a way that, according to the invention, the transmission of at least several data sets is carried out indirectly through at least another vehicle. Therefore, the other vehicle is used as a kind of "proxy" in order to conceal the actual source of the data relative to the back-end, because this information does not reach the back-end server, but only reaches another vehicle locally, which then forwards the data, thus hiding the actual source of the data. Anonymization can thus be achieved.

[0009] Another problem with anonymization is that if the backend server has a substantially complete set of data sets for a vehicle, it can reconstruct the complete and orderly movement history of this vehicle from this set, even if the road segments are perhaps not sorted or mixed with road segments traveled by another vehicle. The reason for this is that if these individual road segments match in terms of their position and time stamp and can therefore be unambiguously assigned to a vehicle, they can be reconstructed accordingly from the data sets that follow each other seamlessly in time / space.

[0010] In order to resist this problem, it can now be provided as a supplement or alternative to the above solution that the position association and / or time association in at least several data groups are noised before transmission. Thus, inaccuracies are added here to prevent the data classification achieved in the above sense, which in turn allows the conclusion about the corresponding assignment of the entire motion curve to a certain vehicle. Among them, the noise intensity should be as small as possible, but the corresponding time stamps should have enough noise so that they are no longer exactly consistent. The same situation applies to position data, which can be noised, for example, so that although it can be identified that the vehicle is traveling on a certain road, it is impossible to identify the lane in the case of a multi-lane road. Therefore, it is no longer clear and unambiguous to ensure how the data is associated with each other, so that anonymization can be achieved. Nevertheless, the data quality is still maintained with high accuracy to ensure that the data is always evaluated by the back-end server in a high quality in an expected manner. That is, at this time, in many cases, it is not important for the reconstruction of the traffic situation which vehicle is at which exact time period and which exact location, but it is meaningless to know that the vehicle is traveling at a roughly time-space average speed on this road, and which lane is used.

[0011] It is particularly advantageous that the anonymization is achieved by a combination of two solution aspects. It is then difficult to trace the data back to a specific vehicle based on the data transmitted to the backend server. This ultimately improves the quality of the anonymization without adversely affecting the data quality associated with the data evaluation.

[0012] According to a very advantageous development of the method according to the invention, it can now be provided that all vehicles in the fleet connected to the backend server have a common shared vehicle certificate and an associated private key, wherein the signature created using this private key is transmitted together with the data set to the backend server directly or via at least one other vehicle. By exchanging the signature created with the help of the private key shared by all vehicles together with the movement data, it is ensured on the backend server side that the received data were actually recorded by a vehicle of the fleet and transmitted directly or indirectly to the backend server. Thus, the security requirements on the backend server side are met without the signature and the associated certificate used for its checking being able to directly assign the respective data set to a specific vehicle of the fleet.

[0013] According to an extremely advantageous design of the method of the present invention, it can also be provided that the noise of the data set is carried out with different intensities according to the distance from the starting point of the route and / or when starting the destination guidance of the navigation system to the end point of the planned route, for example. The intensity or size of the noise, that is, the degree of ambiguity about the position and / or time introduced artificially in the respective data set can therefore be adjusted in particular according to the starting point and potential end point of the route. Because the starting point and the end point need to be protected more than the vehicle's driving intermediate point in terms of data protection, it is applicable to a very high protection function. Therefore, it can be correspondingly provided that in the area of ​​the starting point and the end point, for example, in a corresponding radius of several kilometers or in a corresponding cycle time of several cycles, the noise is carried out more strongly than in other areas, so that although the quality may decrease in these areas, overall, due to the stronger noise in these special "private" site areas, an improved data protection function can be obtained.

[0014] An extremely advantageous development of this variant of the method according to the invention can even provide that data sets relating to locations such as the starting point and, in the case of activated destination guidance in the navigation system, the end point are not transmitted to the backend server, and in particular data sets acquired in the case of spatial proximity to the starting point and / or the end point are not transmitted. This further improves the protection of the starting point and the end point of a route which could allow conclusions to be drawn, in particular, about a specific vehicle and, in particular, about the person using the vehicle.

[0015] In the case of a combination of both variants, i.e., in the case of noise generation and the transmission of at least several data sets by at least one other vehicle, it can also be provided according to an extremely advantageous development of the concept that the type and intensity of the noise is coordinated between the participating vehicles. Such coordination of the type of noise is particularly useful when vehicles meet and the meeting is used to exchange data sets that are then forwarded to a backend server by another vehicle. In particular, better anonymization can then be achieved at these points by temporarily slightly stronger noise.

[0016] According to an extremely advantageous development, it can also be provided in a corresponding variant of the method according to the invention that the data sets associated with the position at which the vehicles met and at which the data sets were transferred from one vehicle to the other have correspondingly greater noise than the other data sets. That is, the data sets immediately before and after the exchange have greater noise, so that the position and time of the exchange can be better disguised.

[0017] For the case where several data sets are transmitted via at least one other vehicle (in which case the vehicles exchange data sets), provision can be made accordingly that the vehicles exchange data sets and simultaneously delete the data sets sent to the other vehicle and update their own routes based on the exchanged other vehicle data sets. It is thus possible for a vehicle that originally travels from starting point A to end point D and meets another vehicle at point C to pretend that it travels from point B (actually the starting point of the other vehicle) to C and then from C to end point D for the back-end server. However, its travel route from point B to point C and then to point E is falsified, so that for the back-end server it is a false journey from point A (i.e. the starting point of the first vehicle) via point C to point E. This also serves to improve data anonymization and simultaneously reduce the amount of data to be transmitted, since each vehicle no longer has to transmit a plurality of its own and other vehicle data sets, but only has to transmit the other vehicle data sets that have not yet been transmitted before the moment of meeting the other vehicle, and from then on transmits its own data sets again, perhaps until the third vehicle is met, and so on.

[0018] According to this particularly advantageous embodiment of the method according to the invention, it can then be provided that data is exchanged or transmitted between the vehicles when the vehicles are close to one another in terms of time and / or space. This can be ensured by vehicle-to-vehicle communication transmission technology and by corresponding position data. If, for example, the vehicles are driving next to one another on a multi-lane road, corresponding exchanges can take place so that on the one hand simple communication is possible and on the other hand a correspondingly high data quality is maintained at the backend server despite the data exchange and the anonymization obtained thereby.

[0019] A very advantageous embodiment of the method according to the invention can now also provide that the data sets are transmitted based on a predetermined parameterizable time and / or number of data sets. For example, a cycle time can be set so that data are transmitted every 60 seconds, or the transmission can take place, for example, after every 10 to 20 data sets have been collected.

[0020] According to a particularly advantageous embodiment of the method according to the invention, it can also be provided that the anonymized movement data are marked accordingly. The backend server can then use the corresponding markings to identify that it performs its evaluation and reconstruction based on the anonymized data, which may or may necessarily lead to a different interpretation of the data situation, because it may be important to know that individual sections of road, rather than the entire route, were traveled by the same vehicle, for example when specific data, speed profiles, etc. should be taken into account for the respective vehicle type.

[0021] Further advantageous embodiments of the method according to the invention also emerge in conjunction with the exemplary embodiments described in detail below with reference to the figures. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The single FIGURE shows a route diagram of two simple routes, each of which is traveled by two different vehicles and consists of three route points. DETAILED DESCRIPTION

[0023] For example, it is now possible that one of the two vehicles 1, 2 shown in the figure transmits its movement data as a sequence of position data sets consisting of positions and timestamps. For example, such a sequence can specify the form ((position 1, timestamp 1), (position 2, timestamp 2), (position 3, timestamp 3) ...). These data sets are transmitted accordingly to the back-end server 3, which is purely exemplary and is shown as a cloud. Then, the back-end server 3 obtains valuable information for it, such as the time-space average speed of the vehicles 1, 2 in each road section described by two subsequent position data sets. It should be noted here that an isolated data set in the above form is basically worthless for traffic analysis, because it only indicates that a vehicle 1, 2 is already at the position at the time of the timestamp. What is most valuable to the back-end server 3 is a sequence of data sets that is as complete as possible, which has been pre-classified accordingly in the ideal case compared to an unclassified road section set, so that it can be processed quickly and less laboriously by the back-end server 3. In principle, regardless of the classification, the information content is the same here, because the same information can be reconstructed, but the calculation cost for the unclassified data set is correspondingly higher.

[0024] The preferred transmission form for the backend 3 is therefore a sequence of (continuous) position data sets, which all belong to the same vehicle 1, 2. However, this is also the least anonymous form of the collected vehicle movement data, since the overall movement history of the vehicle 1, 2 can be directly derived from the sequence.

[0025] Generally, anonymity is violated in two ways when transmitting position data records.

[0026] 1. On the one hand, the position data sets are transmitted from the vehicles 1, 2 themselves to the backend 3. In order to ensure that only data from a reliable source is transmitted to the backend 3, the vehicles 1, 2 should authenticate themselves to the backend 3 before transmission, for example using a proprietary certificate and TLS. In this way, the backend 3 always knows which vehicle 1, 2 it is communicating with and thus also from which vehicle it has received the respective position data set.

[0027] 2. If the backend 3 has a (substantially) complete (possibly unclassified) set of sections travelled by vehicles 1, 2, the backend 3 can reconstruct the (substantially) entire ordered movement history of the vehicle from the set, even if these sections are unclassified and may be confused or mixed with sections travelled by other vehicles. The reason for this is that the sections of the complete movement history of vehicles 1, 2 are connected one after the other or "match" each other in the sense that the end position or end time stamp of the preceding section is equal to the start position or start time stamp of the succeeding section. Since the position (e.g. GPS coordinates) and the time stamp (at least accurate to the second) identify the space-time very accurately, the probability that another section belonging to another vehicle has a "matching", i.e. a start or end point that is exactly the same in terms of position and time stamp is extremely low, to be exact, almost zero. Therefore, it is always possible to identify "merged", i.e. sections belonging to vehicles 1, 2 or movement histories, even sections from a possibly large "unclassified" set consisting of multiple vehicles 1, 2, and put them into the correct order and thus compile them into a (complete) movement history.

[0028] The remedy for the first weakness is to use a "proxy" to transmit the position data set in the following way, i.e., the vehicles 1, 2 do not transmit their position data sets themselves, but use an "intermediate station" that is also trusted by the back end 3 for transmission, which receives the data of the vehicles 1, 2 but does not forward their identity to the back end 3. In particular, another vehicle 1, 2 in the vicinity can take on this task and send the "other's" position data set to the back end 3 together with its own position data set, but without indicating its source here. Alternatively, it is also possible to exchange sections between the vehicles 1, 2 in the following way, i.e., each vehicle 1, 2 partially transmits its own and partially transmits the other's section or part of the movement history.

[0029] If sections are only transmitted from vehicles 1, 2 to the backend 3, each section that should be provided to the backend 3 can ultimately be transmitted by any vehicle 1, 2. The aim should be to transmit to the backend 3 those sections of other vehicles 1, 2 whose "non-matching properties" with the vehicles 1, 2 that travel over them make the greatest contribution to anonymization. For example, it may make sense not to transmit a certain number of the first or last sections of a route, i.e. the sections that are traveled immediately after the starting point or shortly before the destination, because on the one hand the information about the starting point or the destination of the route may be particularly sensitive, and on the other hand the partial movement history can no longer be associated with the vehicle 1, 2 that traveled over it, since it is only unilaterally associated with the entire movement history. In this way, a particularly high technical and semantic anonymization effect can be achieved by transmitting a certain number of the first or last sections of a route by other vehicles 1, 2.

[0030] In the example of the figure, it is now the case that vehicle 1 starts at starting point A and travels along route ACD. Vehicle 2 starts at starting point B and travels in parallel along route BCE. Vehicles 1, 2 thus meet at a junction C, where they are very close in time and space, for example driving side by side on a multi-lane road. At the moment when the two vehicles 1, 2 are very close in space and time, they now exchange their data. The data sets that have not yet been transmitted between points A and C of vehicle 1 and between points B and C of vehicle 2 are exchanged accordingly, wherein each vehicle 1, 2 correspondingly eliminates the transmitted data after transmission to the other vehicle 2, 1 and then continues its previously planned route. At the end of the route, the movement data related to route BCD are now provided by vehicle 1 in the area of ​​the backend server 3, and the movement data of route ACE are provided by vehicle 2 accordingly. The movement data history therefore no longer corresponds to reality and is correspondingly anonymized with respect to the backend server 3.

[0031] The measure for the second weakness mentioned above will be to noise the data contained in the section by slightly but sufficiently changing the position and / or time stamp before transmission so that it becomes significantly difficult or even impossible to reconstruct the movement history and / or to assign these sections to vehicles 1 and 2. The problem at this time is that the more accurate the data is, the better the results provided by the subsequent traffic analysis based on the vehicle movement data. This means that excessive noise will adversely affect the subsequent traffic analysis results. However, although too little purely symbolic noise makes it impossible to achieve a pure syntactic comparison of the end point without hardly affecting its semantics, that is, its value, it is not enough to prevent the reconstruction of the movement history and / or to prevent a section from being assigned to a certain vehicle 1 or 2, because in this case, there is no need to check for strict equality, but the use of a simple position data set spatiotemporal distance value is sufficient to identify the corresponding section end points that are not sufficiently noised when the formula is not equal, and thus the respective corresponding assignment of the section end points can be completed.

[0032] Therefore, the aim should be to use “noise” sparingly and only noise the segment endpoints before transmission, whose noise will contribute significantly to anonymization, and transmit the other segment endpoints unchanged to the backend 3 .

[0033] As indicated above, it is proposed that, when two vehicles 1, 2 are sufficiently close in time and space, that is, when the two vehicles 1, 2 are spatially adjacent at a certain moment, a position data set of one of the vehicles 1 that has previously appeared but has not yet been transmitted to the back end 3 is transmitted to the other vehicle 2 (neighboring vehicle), and then transmitted from the other vehicle 2 to the back end 3 at a subsequent or later moment, for example in the form of an (unclassified) collection of road section data or in the form of a (classified) position data sequence, that is, a partial movement history.

[0034] In particular, it is proposed that, in the case of more than two vehicles 1 , 2 that are adjacent in space and time, one vehicle collects position data sets from more than one other adjacent vehicle and then transmits them together to the backend 3 .

[0035] In particular, it is proposed that, in the case of two or more vehicles 1, 2 that are adjacent in space and time, the adjacent vehicles 1, 2 can exchange their data that have appeared so far with each other and then transmit the other party's data together with their own position data group to the back end 3 at a subsequent time or a later time, for example in the form of an (unclassified) collection of road section data or in the form of a (classified) position data sequence.

[0036] It is further proposed that when deciding which vehicle 1, 2 transmits data of which other vehicle 1, 2 to the back end 3, the strength of the anonymization effect that can be obtained by each is taken into consideration, for example by transmitting the section or part of the movement history that was traveled immediately after the starting point and immediately before the destination according to the possibility of the other vehicle 1, 2.

[0037] It is also proposed that vehicles 1, 2 that are adjacent in time and space jointly and coordinately noisy position-time stamp data that are very similar at that location and time, that is, the back end 3 can no longer directly recognize which future partial motion histories match which past partial motion histories (transmitted from one vehicle to another vehicle 1, 2 at that time and space point or exchanged between the vehicles at that time and space point).

[0038] It is also proposed that all vehicles 1, 2 that are adjacent to one another at this location and time participate in the noise reduction of the position data set by all importing a mutually coordinated position data set (synchronization data set) that defines the end point of the respective route section traveled before the synchronization point and the start point of the respective route section to be traveled after the synchronization point. In this way, it is significantly more difficult for the rear end 3 to recognize mutually corresponding partial movement histories that are located before the synchronization point and partial movement histories that are located after the synchronization point in terms of time and space, i.e., belong to the same vehicle 1, 2.

[0039] It is also proposed to use the same synchronization data set in all adjacent vehicles 1, 2, more precisely one of the synchronization points, i.e. one of the spatiotemporal points at which all relevant vehicles 1, 2 are adjacent to one another. In this case, the rear end 3 can quickly recognize that it is a synchronization point (because there are no longer multiple vehicles 1, 2 at the same spatiotemporal point), but it is no longer possible to simply and directly assign the partial movement history located before the synchronization point to the partial movement history located after the synchronization point.

[0040] Alternatively, it is proposed that a synchronization data set that is slightly noisy (close to each other) but not identical at a synchronization point can be selected among adjacent vehicles 1, 2, wherein the end point of the final section of the partial motion history that potentially originates from another vehicle 1, 2 before the synchronization data set is adapted to the artificially generated synchronization data set to disguise the continuous and consistent motion history from the vehicle 1, 2 to the back end 3. In this way, it is difficult for the back end 3 to identify the potential synchronization point. It is also proposed that the vehicles 1, 2 belonging to a group of adjacent vehicles 1, 2 first exchange the partial motion history that has been traveled not far before the synchronization point according to the above-mentioned maximum anonymization principle or according to the random principle, and then match the partial motion history of the other party to their own synchronization data set. If one vehicle 1, 2 transmits the partial motion history of multiple vehicles 1, 2 before the synchronization point, one or more of the partial motion histories can be coordinated with the synchronization data set.

[0041] It is also proposed that the decisions as to which vehicle 1 , 2 transmits which position data set or which partial movement history to the rear end 3 and which partial movement histories are combined with one another to form a plausible overall movement history for disguise purposes are made independent of one another.

[0042] It is also proposed that, for example, if for any two vehicles 1, 2 in a relevant set of vehicles 1, 2 with a pre-specified positive spacing value, the spacing time > 0 and the spacing space > 0, there is a moment t from the time interval [timestamp-spacing time, timestamp+spacing time] at which the spatial distance between the two vehicles is less than or equal to the spacing space, then multiple vehicles 1, 2 are considered to be spatiotemporally adjacent at the synchronization point (position, timestamp).

Claims

1. A method for anonymizing movement data of road users equipped with a positioning device, said road users having a communication device for transmitting and receiving data with a back-end server (3) and for other road users, in, The motion data are collected in the form of individual time-dependent and position-dependent data sets and transmitted to the backend server (3), wherein the transmission of at least some of the data sets is carried out indirectly via at least one other vehicle and / or the position associations and / or time associations in at least some of the data sets are noised before transmission, It is characterized in that all vehicles of the fleet connected to the back-end server (3) have a common shared vehicle certificate and an associated private key, wherein a signature created using the private key is transmitted to the back-end server (3) together with the data set directly or indirectly via at least one other vehicle.

2. The method according to claim 1, characterized in that: The data set is noisyed with different intensities depending on the proximity to the route start point and / or when destination guidance is activated for the planned end point of the route.

3. The method according to claim 2, characterized in that: The starting point and / or the end point and the data set collected in the spatial vicinity of the starting point and / or the end point are not transmitted to the back-end server (3).

4. The method according to claim 1 or 2, characterized in that: When at least part of the data set is noised and transmitted indirectly via at least one other vehicle, the type and intensity of the noise is achieved in a manner coordinated with one another between the participating vehicles.

5. The method according to claim 4, characterized in that: The data set associated with the position where the vehicles meet and the data set is transmitted from one of the vehicles to the other vehicle has greater noise than the data sets at other positions.

6. The method according to claim 1 or 2, characterized in that: In the event of a transmission of at least a portion of the data set by at least one other vehicle, the vehicles exchange the data sets, delete the data sets sent for this purpose and update their own routes based on the exchanged other data sets.

7. The method according to claim 1 or 2, characterized in that: The data set transmission takes place between vehicles that are close to each other in time and space.

8. The method according to claim 1 or 2, characterized in that: The data group transmission to the back-end server (3) is performed according to a predetermined time period and / or a number of data groups with configurable parameters.

9. The method according to claim 1 or 2, characterized in that: Anonymized motion data is labeled accordingly.

Images