Method and device for limiting personal information in camera image

Abstract

The invention relates to a method for reducing personal information in a camera image of a camera unit (1), the processed camera image being used to perform a vehicle function, in which: prior to processing, raw image data of the camera unit (1) is degraded by stages, each of which performs its specific degradation manner, the calculation unit (5) determines parameter values for each of the phases by means of an optimization algorithm using i) at least the information to be provided for the vehicle function and i) a desired limit level of the personal information to determine a distribution of the degradation over the respective phases, i) and i) being used as target variables.

Description

Technical Field

[0001] The invention relates to a method for reducing personal information in a camera image of a camera unit by downgrading the camera image, a system for reducing personal information in a camera image of a camera unit by downgrading the camera image, and a vehicle having such a system. Background Art

[0002] Image analysis methods in the field of so-called "computer vision" allow the automatic processing of image data from camera units. In this case, for example, it can be determined whether and how many people are currently in the detection area of ​​the camera unit, whether and how many objects are recognized in the detection area, etc.; in particular in the application of automated vehicle driving or driver assistance systems, such automatic image analysis methods can also increase safety in road traffic and are in some cases mandatory for vehicle certification. For example, for some regions of the globe, in certain application cases that are sometimes relevant for safety and certification, for the implementation of vehicle functions such as driver monitoring or occupant monitoring, or for the operation of assistance systems, it is necessary to provide interior vehicle cameras that must be in operation during the vehicle's travel. This essentially leads to the following dilemma: in addition to the safety-technical advantages provided by such interior cameras, there are also significant restrictions on the privacy of the occupants, especially when the faces of the occupants can in principle be recognized in the raw camera images of the camera unit. Although there is a risk of illegal access to the camera images through hacking, it is not possible to completely deactivate such camera units for the operation of vehicle functions or assistance systems. It is therefore desirable to protect the privacy of persons and other sensitive situations and objects present in the detection area of ​​the camera unit, while also maintaining the functionality of automation applications, vehicle functions or assistance systems that rely on the presence of the camera image of the camera unit.

[0003] US 8,666,110 B2 relates to the unrecognizable processing of image areas containing private information. To this end, the corresponding image part containing private information is determined and then processed to make it unrecognizable. This particularly relates to the face of a person, a vehicle license plate, the window area of ​​a house, etc. In order to make the image unrecognizable, the corresponding image area can be decomposed and segmented in a coded manner. In addition, it is disclosed that the corresponding unrecognizable processing process can be reversed to restore the original information in the detected image. Summary of the invention

[0004] The object of the present invention is to ensure effective protection of sensitive data while still being able to use the information from the camera image of the camera unit to operate vehicle functions, such as assistance systems.

[0005] The invention is derived from the features of the independent claim. Advantageous developments and embodiments are the subject matter of the dependent claims.

[0006] A first aspect of the invention relates to a method for reducing personal information in a camera image of a camera unit by downgrading the camera image, wherein the camera image processed by image analysis is used to perform a vehicle function, such as an assistance system, wherein in order to reduce personal information in the camera image before processing, raw image data of the camera unit is downgraded in stages of image processing, wherein each of the stages performs a stage-specific degradation method, each of the stages has at least one variable parameter for determining the intensity of the degradation in the respective stage, wherein a calculation unit determines the parameter value for each stage by using an optimization algorithm based on i) at least information to be provided for the vehicle function and ii) a desired restriction level of personal information to determine the distribution of the degradation over the stages, wherein i) and ii) are used as target variables or target values ​​and the parameters are determined for achieving the target variables. The at least information to be provided for the vehicle function represents a minimum requirement at which the vehicle function can be used to the desired extent, i.e., can be used, for example, without restriction, with a slight restriction or with a large restriction.

[0007] The camera unit is preferably arranged on or in the vehicle and provides camera images for vehicle functions, such as automated applications of the vehicle. Such vehicle functions are, for example, viewing the vehicle interior for determining the number of occupants in the vehicle, personalizing vehicle functions by means of facial recognition, fatigue warning systems, etc. However, it is also possible to arrange a camera on the outside of the vehicle for providing visual data for vehicle functions of the vehicle, such as recognizing traffic signs or classifying road users around the vehicle into predetermined categories, such as cyclists, pedestrians, other vehicles, etc.

[0008] For the above exemplary application, a plurality of technically different types of camera systems may be used for the camera unit. In particular, any of the following may be used: RGB camera, IR camera, FIR / NIR / thermal imaging camera, time-of-flight camera, stereo camera, structured light camera.

[0009] For example, the Multi-Purpose In-Car Camera (MPIC) is an interior camera placed on the center console of the vehicle. This camera can provide signals to various systems: Attention Assist (observing the driver to identify fatigue and distraction, authentication), Driver Assistance Systems with “hands-free driving” functions, personalization of driver and passenger recognition, Interior Assist (people and gesture recognition), and other systems.

[0010] The camera images of a camera unit usually contain not only information for vehicle functions, but also sensitive data from the perspective of personal privacy. In particular, personal information includes information suitable for identifying an individual, such as information sufficient for facial recognition. But in addition to personal aspects, object-related information may also contain sensitive data, such as vehicle license plates, house numbers and other sensitive, privacy-related data.

[0011] However, depending on the vehicle function, a certain degree of this personal information is not necessary for the execution of the vehicle function. Therefore, it is proposed according to the invention that, if possible, a certain degree of personal information is degraded at different stages in the data path from the sensor of the camera unit to the processing computer unit for executing the vehicle function, in particular the computer unit of the vehicle. In this case, the information provided after the degrading must at least reach the target variable defined as the information to be provided in order to be able to provide sufficient quality for the execution of the vehicle function.

[0012] The degradation of the camera images is performed by algorithms or mechanisms specific to this stage, so that the corresponding camera images are degraded by editing steps such as image editing, i.e. the information interpretable in all pixels of the corresponding camera images is artificially converted into less interpretable, i.e. less recognizable personal data and personal information. The degradation is achieved in particular by editing steps that, for example, achieve a reduction in the resolution of the corresponding camera images, by applying an overexposure, by a changed tone value curve, by a bilateral filter / guided filter / cartoonization filter, etc. Furthermore, known computational imaging methods and known image processing filter methods can also be used for the degradation.

[0013] As a result, in one embodiment, a degraded camera image may be obtained which is completely color shifted, noisy and low in resolution compared to the original image data. In another embodiment, the original color of the original image data is considered important for the perfect performance of the vehicle function, and the parameters of the stage are preferably changed in such a way that the original color of the original image data is maintained.

[0014] In this case, for each individual corresponding camera image, a necessary trade-off is produced, namely finding a compromise between one goal of obtaining as much information as possible from the raw image data to ensure perfect functionality of the vehicle function execution and another goal of removing as much personal related information as possible from the raw image data. These are essentially competing goals, and in a first variant of the first aspect of the invention, a choice is made between these goals so that both serve as target variables in the optimization algorithm.

[0015] For this purpose, for example, a multi-objective optimization is carried out using the objectives i) and ii) as respective objective variables, which are optimized in a weighted manner, in particular in a common cost function.

[0016] In a second alternative or additional variant of the first aspect of the invention, in the case where both target variables cannot be achieved simultaneously by changing the parameters, the optimization algorithm optimizes the parameters so that, depending on the application: target variable i) is achieved in terms of the information provided for the vehicle function, while the level of restriction achieved for personal information is as close as possible to target variable ii), or target variable ii) is achieved in terms of the level of restriction for personal information, while the information provided for the vehicle function is as close as possible to target variable i). This variant is used as soon as a parameter value that allows the two target variables i) and ii) to be achieved simultaneously cannot be found or at least cannot be found within a predetermined time.

[0017] Therefore, according to the invention, the following alternatives are possible:

[0018] - Prioritize privacy by limiting and deleting personal information according to target variable ii), while making the information provided for vehicle functions as close as possible to target variable i); or

[0019] - Prioritize the information provided for vehicle functions according to the target variable i) while keeping personal information as close as possible to the desired limit level ii).

[0020] Regardless of whether the optimization algorithm solves a linear optimization problem analytically, solves a nonlinear optimization problem iteratively, or performs a database-based solution (table, lookup table), the result is a degradation distribution of the original image data over different stages with a respective stage-specific degradation method. By determining parameter values ​​for the respective stages, the intensity of the degradation in the respective stage and therefore in a respective specific manner is determined. However, the problem space here (determined by the number of parameters in the stage) is usually high-dimensional and cannot usually be solved by simple compromises (e.g., 1D parameter restrictions). In a processing stage that is usually in the single digit, there can be more than a thousand parameters in total, but there can also be orders of magnitude more parameters.

[0021] Each phase therefore has in particular at least one parameter, by means of which the level and / or manner of degradation of the camera image in a manner specific to the phase can be determined. After the parameter values ​​have been determined, the degradation distribution by the phase-specific degradation method is therefore determined from all parameters as a whole, i.e. the degree / share of degradation that each phase has in the present case, in particular depending on the vehicle function.

[0022] The purpose of the optimization algorithm is to determine parameter values ​​for these consecutive processing stages and thus determine the degradation distribution over the stages as well as the overall degradation intensity and, according to some embodiments (see below), also the local intensity distribution of image data degradation within the camera image.

[0023] The invention thus has the advantageous effect that the camera image used to perform the vehicle function is effectively reduced to a determined degree of personal information. In particular, the efficiency of the reduction is achieved by distributing the reduction over different stages, each individual stage providing a specific mechanism for reducing personal information. In this regard, the physical and logical characteristics of the respective stages can be optimally utilized depending on which boundary conditions exist in terms of image properties and what and how much personal information is to be deleted from the camera image. In addition, a compromise between competing requirements, namely, on the one hand, the maximum possible privacy protection of private information contained in the camera image and, on the other hand, the retention of as much information content as possible in the camera image for the operation of the vehicle function, can be defined and implemented. Thus, the requirements for privacy and the requirements for the vehicle function can be advantageously taken into account, in particular in such a way that the vehicle function does not suffer losses or only suffers very little losses within its functional scope, while significantly increasing respect for privacy. Thus, there is a systematic and feasible solution to optimize the trade-off between data protection and application functionality. Thus, an attacker can in principle only determine a degraded camera image in which sensitive data has been completely or largely deleted.

[0024] According to an advantageous specific embodiment, a measure of preference between a desired level of restriction of at least the information to be provided or personal information for a vehicle function and / or a priority of one of the target variables is predetermined by the user.

[0025] In other words, the user can preset and influence a target variable or target value in terms of the level of application functions or a target variable or target value for the level of personal information by the quality of the information to be provided. For example, the user can decide that he wants a high level of restriction on personal data, i.e. the image data contain little personal data, or that he wants a large amount of information to be conveyed by the image data for the realization of unrestricted vehicle functions. This preset by the user is preferably performed on a graphical operating interface of the operating computer of the vehicle. In this case, a graphical element such as a sliding regulator / slider may be advantageous, but depending on the situation and application, discrete inputs via check boxes on the graphical interface may also be used.

[0026] In the case of safety-critical vehicle functions or vehicle functions that are legally required due to certification regulations, the target variable can only be reduced to a minimum value at best, or the number of users can also be limited to developers or workshop personnel. Therefore, various user authorizations are advantageously provided in order to be able to carry out the above-mentioned presettings.

[0027] According to another advantageous embodiment, a measure of the preference between the desired level of limitation of at least the information to be provided for the vehicle function and the personal information and / or the priority of one of the target variables is predetermined by the calculation unit, for example depending on the corresponding vehicle function, speed, driving situation, environmental conditions, etc.

[0028] In contrast to the previously described embodiments, the trade-off between i) and ii) is made by the computing unit itself depending on the respective vehicle function. Thus, for example, the computing unit can define a target variable for a safety-critical vehicle function as the minimum information to be provided by the vehicle function, while limiting the personal information to the maximum extent possible in the remaining margin / decision space. This can also be applied to individual aspects and taken into account when distributing the degradation to the individual stages. For example, if eye color is important for the vehicle function, the computing unit will automatically recognize that no color shift (which helps to limit the personal information) is allowed in this cluster.

[0029] According to another advantageous embodiment, the stages of image processing include: an image sensor of the camera unit, in particular registers of the image sensor, hardware settings in a control unit of the camera unit, in particular calibration data, and software processing in the control unit of the camera unit for algorithmically performing image editing.

[0030] The restriction of personal information is implemented in multiple stages. As mentioned above, these stages preferably include the stage of the sensor itself, because here personal information can be removed from the data directly at the source. Preferred algorithms for the sensor stage include the following applications: 2×2 binning, 8x subsampling, high value saturation, 16x gain, image cropping, automatic exposure control and tone mapping to achieve optimal privacy. Another preferred stage is implemented by hardware settings in the control unit of the camera unit downstream of the sensor. This stage is implemented in hardware in the ECU (e.g., central infotainment computer). In this case, more complex algorithms than in the sensor can be used to increase data protection without compromising vehicle functionality. By implementing in hardware, this stage is advantageously well protected from external attackers. Preferred algorithms for the hardware stage include the following applications: tone mapping for optimal privacy, minimum color saturation, edge-preserving sharpness reduction. Another preferred stage downstream of the hardware settings in the control unit of the camera unit is software preprocessing in the control unit of the camera unit, which is ideally suitable for flexible algorithmically performed image editing to delete personal data without compromising vehicle functionality. Complex algorithms (e.g., neural networks) can be applied here to remove personal information from the data. However, implementing this third stage in software makes this stage more vulnerable to attack. The preferred algorithm for the software stage includes applying Complex Wavelet SSIM (CW_SSIM), where the abbreviation SSIM stands for "Structural Similarity Index Measure". CW_SSIM can be used as a measure of information content. For this preferred algorithm, the filters and parameters described below are used to reduce personal information as much as possible, while ensuring vehicle functionality by monitoring CW_SSIM.

[0031] In another embodiment, in a software processing phase in the control unit of the camera unit, for algorithmic image editing, filters (in particular at least one of the following: noise filter, sharpening filter, scaling filter, tone value curve filter, brightness filter, color change filter) are used, which are implemented by an artificial neural network with parameters for parameterizing it. For this purpose, preferably universal steps are specified, in particular in the form of a CNN (convolutional neural network). By known training methods (sometimes millions of parameters), the seamless chain of CNNs can be globally optimized. The basic assumption here is that for the optimal execution of the vehicle function, the camera image obtained at this stage does not necessarily have to look particularly bright and neutral; on the contrary, a specific emphasis (for example, edges) can greatly improve the use of the information of the vehicle function due to its nonlinear properties. This extended version therefore advantageously enables implementation solutions that are simply not available through prefabricated "building blocks" (as is still the case in current series projects).

[0032] The respective algorithms of each stage are preferably adapted to the maximum available computing power of the computing unit, the used data formats, security requirements, etc. Since usually only little computing power is available in the above-mentioned preferred first stage (sensor), simple algorithms are preferably implemented here (e.g. saturating pixels in certain areas to remove personal information). Therefore, the complexity of the applications in the above-mentioned further preferred stages tends to be chosen higher by the computing unit. Between the stages, the data are transmitted in particular via a physical channel (e.g. from the "Sensor" stage to the "Hardware Setup" stage via a cable from the camera unit to the ECU).

[0033] In another advantageous embodiment, for example, a stage located upstream of the sensor is used, in which external signals are purposefully directed towards the sensor in order to disrupt / interfere with the sensor detection itself. In a preferred embodiment, the artificial deterioration of the camera image is achieved by an active light source (changing the intensity and / or pattern of existing or additional lighting and / or projectors, preferably in the infrared range).

[0034] According to another advantageous embodiment, the desired level of restriction of personal information is defined by a structural similarity index with respect to the camera images. According to this embodiment, the target variable for the desired level of restriction of personal information is defined by the so-called "structural similarity index measure" (SSIM). As a preferred measure for quantifying the desired level of restriction, the following is used: (1-CW_SSIM), in the words "one minus CW_SSIM", where "CW" stands for "complex wavelet" and "SSIM" stands for "structural similarity index measure"; more information can be found in the publication "Z. Wang and A.C. Bovik", "Mean squared error: Love it or leave it? A new look at Signal Fidel i ty Measures", IEEE Signal Processing Magazine, Vol. 26, No. 1, pp. 98-117, January 2009, doi: 10.1109 / MSP.2008.930649".

[0035] According to a further advantageous specific embodiment, at least the information to be provided for the vehicle function comprises an average standard deviation or a signal-to-noise ratio with respect to the camera images.

[0036] Further information about the mean standard deviation (abbreviated as "MSE") can be found in the publication "Z. Wang and A.C. Bovik," "Mean squared error: Love it or leave it? A new look at Signal Fidel i ty Measures," IEEE Signal Processing Magazine, Vol. 26, No. 1, pp. 98-117, January 2009, doi: 10.1109 / MSP.2008.930649."

[0037] According to a further advantageous embodiment, a computing unit arranged in the vehicle is used, wherein continuously updated values ​​of the parameters for each of the phases are determined by the computing unit for the continuously updated determination of the degradation distribution over the phases.

[0038] The current parameters determined by the calculation unit are therefore determined in each case on-board, i.e. locally in the vehicle itself. The continuously updated determination of the degradation distribution leads to a real-time adjustment of the degradation distribution over the phases as well as of the overall intensity of the degradation. Thus, an adjustment can advantageously be made to the current conditions in order to be able to carry out a continuously optimal distribution of information between the vehicle functions and the goal of reducing personal information.

[0039] According to another advantageous embodiment, the computing unit determines the parameters of each stage based on the determined situation parameters, wherein the situation parameters particularly include one of the following: the distance of the person's face from the camera unit, the person's facial movement relative to the camera unit, environmental conditions such as current brightness, driving conditions.

[0040] Thus, the limits of personal information can vary, in particular, because, for example, a face close to the camera is more privacy-critical than a face further away (e.g., in the back seat of a vehicle in the dark). For this purpose, predictions are preferably made by artificial intelligence or regression methods, even if previously used reference images are no longer available in operation.

[0041] The determination of the parameter values ​​for each stage by the optimization algorithm for determining the degradation distribution over the stages is also advantageously carried out adaptively, in particular with respect to the geometric ROI (region of interest) of the vehicle function, in particular in order to obtain as much information as possible about the ROI, i.e. this specific region. This can be changed depending on the scene. The face ROI can be determined using known algorithms for face detection. There are also face detectors (for face recognition) in the prior art that are very robust to a reduction in spatial resolution. Furthermore, the properties of the respective vehicle function can be taken into account with respect to the sensitivity of the parameter values ​​to certain image properties (e.g. noise, missing structure, missing contrast). In this case, the expected or actual current scene (e.g. with respect to the dynamic range, brightness distribution, such as can be represented by a histogram) can also be used in each case for a specific region to determine the parameter values ​​for it in the optimization algorithm. Furthermore, different combinations of parameter values ​​can be applied locally, temporally and content-dependently in each region of the camera image using the degradation of the respective stage.

[0042] According to a further advantageous embodiment, the parameter values ​​of the phases are specified by a calculation unit for predefined camera images or camera images from predefined scenes and stored in a control unit of the vehicle.

[0043] Advantageously, according to this embodiment, when a predefined camera image reappears or a camera image from a predefined scene appears, the parameter values ​​do not need to be re-determined, but a predefined set of predefined parameter values ​​that has been determined in the past off-board / outside the vehicle can be used. Thus, unnecessary computing effort can be advantageously saved. The predefined camera image can be used when it is determined that an almost exact repetition is detected by the camera unit. On the other hand, the use of camera images from predefined scenes is more flexible and only requires matching / consistency of scene features. Once these sets of parameter values ​​have been determined, they are stored in the control unit corresponding to the predefined camera image or the predefined scene and are accessible to the computing unit in order to provide an alternative source for the optimization algorithm.

[0044] According to a further advantageous embodiment, the downgrading is performed using parameter values ​​stored in the control unit of the vehicle instead of parameter values ​​continuously updated by the calculation unit only when a predefined camera image or a camera image from a predefined scene is present / available in operation.

[0045] According to a further advantageous embodiment, the calculation unit determines the parameter value by means of a numerical method, in particular an iterative method.

[0046] Iterative numerical methods are particularly advantageous for iteratively approaching a predetermined target variable with respect to i) or ii), i.e., changing the parameter value until the required threshold value of the target variable is met, or at least one threshold value i) or ii) of the target variable is reached, while the corresponding other threshold value is reached as best as possible. In multi-objective optimization, for nonlinear optimization problems, iterative search algorithms can be used.

[0047] According to a further advantageous embodiment, the computing unit determines the parameter value with the aid of a pretrained artificial neural network.

[0048] In this case, the optimization algorithm uses a pre-trained artificial neural network to determine the parameters. Possible input variables of the pre-trained artificial neural network are in particular the corresponding camera image and the target variables i) and ii); the output values ​​are the parameters of the stage.

[0049] According to a further advantageous embodiment, the pre-trained artificial neural network is continuously further trained on the server based on data from the camera units of the vehicles, wherein updates of the artificial neural network are transmitted back to the vehicles in the fleet.

[0050] In another preferred embodiment, the elements of the phases and their parameters are not just a combination of a certain number of prefabricated filters, but are generated completely by deep learning methods, similar to generative adversarial networks (GAN). In an extended embodiment, the hardware components are also taken into account by another term in the objective function. In this case, in particular, the resource consumption is also mapped so that this can be taken into account in the optimization algorithm - for example, in the case of a constant restriction level of personal information, in the case of a similar quality and quantity of information to be provided for the vehicle functions (in particular to a substantially constant extent), a parameter variant (in particular for the selection of the filter module) is selected, which can be performed particularly efficiently on the computing unit or in the corresponding phase.

[0051] Another aspect of the present invention relates to a system for reducing personal information in a camera image of a camera unit by degrading the camera image, wherein the camera image processed by image analysis is used to perform a vehicle function, in particular to perform a vehicle function in a vehicle, and a computing unit for reducing personal information in the camera image is designed to degrade the raw image data of the camera unit in stages before processing, wherein each of the stages performs a degradation method specific to that stage, and each of the stages has at least one variable parameter for determining the intensity of the degradation in the corresponding stage, wherein the computing unit is designed to determine the parameter value of each stage by using an optimization algorithm based on i) at least information to be provided for the vehicle function and ii) the desired restriction level of personal information to determine the distribution of the degradation over the various stages, wherein i) and ii) are used as target variables and the parameters for achieving the target variables are determined.

[0052] Another aspect of the invention relates to a vehicle having a system as described above and below.

[0053] The advantages and preferred developments of the proposed system result from an analogous and appropriate application of the above-described embodiments in connection with the proposed method. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Further advantages, features and details emerge from the following description, in which (if applicable with reference to the drawings) at least one embodiment is described in detail. Identical, similar and / or functionally identical components are provided with the same reference numerals.

[0055] In the attached picture:

[0056] Figure 1 A method for reducing personal information in a camera image of a camera unit according to an embodiment of the present invention, implemented by a system, is shown;

[0057] Figure 2 The details are shown according to Figure 1 an embodiment of the present invention, a degradation stage used in the system;

[0058] Figure 3 Shown according to Figure 1 Another implementation of the degradation phase used in the system of the embodiment of the present invention, and

[0059] Figure 4 A flow chart of a method according to the invention is shown. DETAILED DESCRIPTION

[0060] Figure 1The interior of a vehicle 3 with a camera unit 1 and a computing unit 5 is shown. A method for reducing personal information in the corresponding camera images of the camera unit 1 by degrading the camera images is performed by means of the computing unit 5. For the purpose of vehicle functions, the camera images are generated by the camera unit 1 repeatedly and at a high frequency. The vehicle functions, such as the automatic fatigue warning, are performed using a multi-purpose interior camera. However, a secondary effect is that personal data are also detected, i.e., data that are sufficient in principle for recognizing a face in the camera image, whether automatically or by a person, thus constitute a security risk, so that, for example, an attacker could access these data from the outside. It is therefore sought to delete as much data in the corresponding camera image that can be used to identify the person being photographed as possible without impairing the vehicle functions. In order to reduce personal information in the camera images before they are processed by the vehicle functions, the raw image data are degraded in the editing stage of the camera unit 1, i.e., they are artificially degraded. Each stage carries out a degradation method specific to the stage. In order to set which stage should bear which degradation share in the corresponding scenario and in terms of the corresponding vehicle function and to what extent the degradation may be overall, each stage has a set of parameters with variable values. The distribution is determined by the calculation unit 5 in the following manner: by determining the parameter values ​​for each stage using an optimization algorithm for i) the information to be provided for the vehicle function application and ii) the desired restriction level of the personal information, so as to determine the distribution of the degradation over the stages. The competing objectives i) and ii) are designated as target variables of an iterative nonlinear optimization algorithm for performing multi-objective optimization to achieve a target value i) for the information provided for the vehicle function and a target value ii) for the restriction level of the personal information). Alternatively, the parameter optimization is performed so that either the information provided for the vehicle function reaches the target value i) while the restriction level of the personal information is as close as possible to the target variable ii), or the restriction level for the personal information reaches the target value ii), that is, the desired restriction level is reached, while the information provided for the vehicle function is as close as possible to the target variable i).

[0061] These stages include: 1a the image sensor of the camera unit 1, in particular the registers of the image sensor; 1b the hardware settings in the control unit of the camera unit 1, in particular the calibration data, and 1c the software processing in the control unit of the camera unit 1 for algorithmically performing the image editing. Furthermore, an optional stage 1d is shown which is not explained in more detail and which includes further parameterizable settings that influence objectives i) and ii), such as object lighting, a post-editing stage, etc. These are Figure 2. Starting from the camera unit 1, a number of methods are already applied in the first stage 1a in the sensor to modify the raw camera image of the camera unit 1. The corresponding parameters in this stage are related to the above-mentioned image sensor of the camera unit 1. Methods such as 2×2 binning, 8-fold downsampling, high-value saturation, 16-fold gain, exposure control and tone mapping for optimal privacy can already be performed here. The hardware settings in the control unit of the camera unit 1 constitute the second stage 1b and have further parameters in the following methods: tone mapping for optimal privacy, minimum color saturation, edge-preserving sharpness reduction. In the third stage 1c, which is still upstream before the degraded image is processed by the vehicle function, the complex wavelet SSIM (CW_SSIM) is used, where the abbreviation SSIM stands for "Structural Similarity Index Measure". The parameter set with the parameter values ​​of all stages is iteratively determined as a parameter set by the calculation unit 5 of the vehicle 3 on board / on the vehicle specifically for each camera image.

[0062] For this purpose, the image recorded by the camera 1 and edited in the phase is analyzed by comparing the information i) to be provided at least for the vehicle function as a target variable 7 for meeting the predetermined functional scope with the actual value 7a of the information contained in the image, and by comparing the desired level of limitation of personal information as a target variable 9 with the actual value 9a of the image with respect to the level of personal-related data. If the actual value 7a, 9a is below the target variable, the calculation unit 5 optimizes the parameters of all phases 1a to 1d, for example in an iterative optimization process, until the actual value of the information provided by the image edited in phases S1 to S4 for the vehicle function and the level of personal-related data ideally reach at least the target variables 7, 9, and then outputs the image 11.

[0063] If the target variables 7, 9 cannot be achieved simultaneously with respect to the actual value of the information provided for the vehicle function and with respect to the level of the personal-related data, the parameters of steps 1a to 1d are determined in such a way that the target variable i) is achieved with respect to at least the information provided for the vehicle function, or the target variable ii) is achieved with respect to the level of limitation of the personal information, while the respective other value in each case is optimized as much as possible. In the case of safety-related functions such as monitoring the driver, the information provided for the vehicle function has priority, so that this information achieves the target variable required for this function.

[0064] Figure 3An embodiment is shown in which the optimization algorithm of the computing unit is designed as a pre-trained neural network. The neural network is set up to determine the parameters of the phases 1a to 1d based on the images recorded by the camera 1 and the predetermined target variable i) of at least the information 7 to be provided for the vehicle function and the desired restriction level of the personal information 9, so that the image 11 edited in each phase 1a to 1d and then output provides the information 7a required for the vehicle function and complies with the desired restriction level of the personal information 9a.

[0065] Figure 4 As an example, a flow chart of the method according to the invention is shown, wherein an image is received in step S1 and edited in step S2 in steps 1a to 1d using predetermined image editing parameters. In step S3, it is checked whether the information provided by the image for the vehicle function reaches the target variable i), i.e. whether the information (7) to be provided at least for the vehicle function is reached, and whether the personal information restriction level of the image reaches the desired restriction level of personal information. If the check yields a positive result, the image is output in step S4. If the check in S3 yields a negative result, in step S5, the image editing parameters are changed by the optimization algorithm of the calculation unit 5 and transmitted to steps 1a to 1d. In step S2, the image is edited with the changed parameters and then compared again with the target variables i) and i) in step 3. The optimization is carried out in step S5 until the target variables i) and ii) are reached, and the image can then be output in step 4.

[0066] Although the present invention has been described and explained in more detail by preferred embodiments, the present invention is not limited by the disclosed examples, and those skilled in the art can derive other variants therefrom without leaving the scope of protection of the present invention. It is therefore obvious that there are multiple possibilities for variation. It is also clear that the above-mentioned embodiments are actually only illustrative examples, and these examples cannot be understood in any way as limitations on, for example, the scope of protection of the present invention, the possibility of application, or the configuration. On the contrary, the foregoing description and the description of the figures enable those skilled in the art to specifically implement the exemplary embodiments, in which case those skilled in the art know that the disclosed ideas of the present invention can make various changes without leaving the scope of protection defined by the claims and their legal equivalents (such as further explanations in the specification), such as making various changes to the functions or arrangements of the individual elements described in the exemplary embodiments.

Claims

1. A method for reducing personal information in a camera image of a camera unit (1) by downgrading the camera image, wherein: The camera image processed by image analysis is used to perform a vehicle function, in particular in a vehicle (3), and wherein, in order to reduce personal information in the camera image before processing, the raw image data of the camera unit (1) is degraded in stages, wherein each of the stages performs a degradation method specific to the stage, and each of the stages has at least one variable parameter for determining the intensity of the degradation in the corresponding stage, wherein a calculation unit (5) uses i) at least information (7) to be provided for the vehicle function and ii) a desired restriction level of personal information (9) to determine the parameter value of each stage by an optimization algorithm to determine the distribution of the degradation over the various stages, wherein i) and ii) are used as target variables and the parameters for achieving the target variables are determined.

2. The method according to claim 1, in, In the case that both target variables cannot be achieved simultaneously by changing the parameters, the optimization algorithm optimizes the parameters so that, depending on the application: Target variable i) is achieved in terms of the information provided for vehicle functions, while the level of restriction of personal information is as close as possible to target variable ii), or Target variable ii) is achieved with regard to the restriction level of personal information, while the information provided for the vehicle functions is as close as possible to target variable i).

3. The method according to claim 1 or 2, in, A measure of preference between priorities for at least one of the target variables and / or a desired level of restriction of information or personal information to be provided for a vehicle function predetermined by the user.

4. The method according to claim 1 or 2, in, The calculation unit (5) predetermines a measure of preference between a desired level of limitation of at least the information to be provided and the personal information for at least a vehicle function and / or a priority of one of the target variables.

5. The method according to any one of the preceding claims, The stages include: The image sensor of the camera unit (1), in particular the registers of the image sensor, the hardware settings in the control unit of the camera unit (1), in particular the calibration data, and the software processing in the control unit of the camera unit (1) for algorithmically performing image editing.

6. The method according to any one of the preceding claims, in, The desired level of limiting personal information is defined by a structural similarity index with respect to the camera images.

7. The method according to any one of the preceding claims, in, The information for the vehicle function includes at least an average standard deviation or a signal-to-noise ratio about the camera image.

8. The method according to any one of the preceding claims, in, A calculation unit (5) arranged in the vehicle (3) is used, wherein continuously updated values ​​of the parameter for each of the phases are determined by the calculation unit (5) for continuously updated determination of the degradation distribution over the phases.

9. The method according to claim 8, in, The calculation unit (5) determines the parameters of each stage according to the determined situation parameters, wherein the situation parameters particularly include one of the following: the distance from the person's face to the camera unit (1), the facial movement of the person relative to the camera unit (1), environmental conditions such as current brightness, driving conditions.

10. The method according to any one of the preceding claims, in, Phase parameter values ​​are defined by the calculation unit for predefined camera images or camera images from predefined scenes and are stored in a control unit of the vehicle (3).

11. The method according to claim 10, in, When a predefined camera image or a camera image from a predefined scene is present in operation, the degradation is performed using parameter values ​​stored in a control unit of the vehicle instead of parameter values ​​continuously updated by the calculation unit (5).

12. The method according to any one of the preceding claims, in, The calculation unit (5) determines the parameter values ​​by numerical methods.

13. The method according to any one of the preceding claims, in, The calculation unit (5) determines parameter values ​​with the aid of a pre-trained artificial neural network.

14. The method according to claim 13, in, The pre-trained artificial neural network is continuously further trained on a server based on data from camera units of vehicles, wherein updates of the artificial neural network are transmitted back to vehicles in the fleet.

15. A system for reducing personal information in a camera image of a camera unit (1) by downgrading the camera image, wherein: The camera image processed by image analysis is used to perform a vehicle function, in particular to perform a vehicle function in a vehicle (3), and a computing unit (5) for reducing personal information in the camera image is designed to degrade the original image data of the camera unit (1) in stages before processing, wherein each of the stages performs a degradation method specific to the stage, and each of the stages has at least one variable parameter for determining the intensity of the degradation in the corresponding stage, wherein the computing unit (5) is designed to determine the parameter value of each stage by using an optimization algorithm based on i) at least the information to be provided for the vehicle function and ii) the desired restriction level of the personal information to determine the distribution of the degradation over the various stages, wherein i) and ii) are used as target variables in the optimization algorithm or one target variable and one restriction are used from the set of i) and ii).

16. A vehicle (3) comprising a system according to claim 15.

Images