Methods for the flexible provision of information security in connected vehicles

Abstract

Methods (300) for the flexible provision of information security in connected vehicles (110), comprising: Receiving (310), on a backend server (120), a request to perform an alibi mode in a vehicle (110); Capture (320), on the backend server (120), a route (220A) traveled by the vehicle (110) after receiving the request; Determine (330), on the backend server (120), an alibi route (220B), which corresponds to the route (220A) traveled by the vehicle (110) in - the distance travelled; and / or - the energy consumption; corresponds to; and Transmit (340) the alibi route (220B) to the vehicle (110), where the distance traveled by the vehicle (110) (220A) is overwritten with the alibi distance (220B).

Description

[0001] The present invention relates to a method for the flexible provision of information security in networked vehicles.

[0002] With the increasing networking of vehicles, there is an ever-increasing amount of data being collected, processed, communicated, and exchanged (vehicle communication). Vehicle communication can take place via servers providing telematics services (telematics servers) over the Internet. This networking of vehicles is increasing due to the increasing support provided to drivers in vehicles - via driver assistance systems such as lane departure warning systems, distance assistants, etc., but also due to the provision of at least partially autonomous driving modes that require little or no assistance from the driver. However, vehicle communication also presents challenges with regard to information security, particularly with regard to the data protection of personal and / or personally identifiable data, i.e. data that can be directly and / or indirectly linked to a person.Even if a personal reference is not always obvious in vehicle communication, specific information about the vehicle driver can be obtained for a variety of vehicle communication scenarios. For example, by collecting position data, insights into the location and whereabouts of the vehicle driver can be derived. This may be undesirable for the vehicle driver, at least in certain cases.

[0003] US 2011 / 0 061 106 A1 describes a method for protecting a user's privacy. For example, the user can select their location as a "deceptive variable." The "deceptive position" is generated by specifying a route and requiring the user to follow the route.

[0004] DE 10 2015 213 393 A1 relates to a method for the anonymous provision of vehicle data, comprising the following steps: providing original vehicle data that indicate one or more traveled route sections of a route traveled by a motor vehicle and the time period during which the one or more route sections were traveled; generating artificial vehicle data that indicate at least one further artificial route; and storing and / or transmitting the original vehicle data and the artificial vehicle data.

[0005] US 2014 / 0 068 010 A1 discloses network communication, the provision of web-based services, and customized services using the web-based services, which can be provided to drivers and users via the in-vehicle head unit and their mobile device. The communication link between the in-vehicle head unit and the mobile device is established via a short-range wireless connection. Furthermore, these devices can communicate via a network, such as a cellular network, with a service provider that provides entertainment and information services to the mobile device and the vehicle's head unit. The user's profile and preferences can follow the user to different locations and vehicles, as this information is stored on a server accessible by the user's mobile device and, in some embodiments, by the head unit.The mobile device can provide services to the main unit if it does not have wider network connectivity through the short-range wireless connection.

[0006] US 2009 / 0 005 070 A1 discloses receiving location information on a mobile device from the memory of a vehicle device. The mobile device is updated based on the location information. Sensor data is received from at least one sensor that measures the movement of the mobile device, and an estimated location of the mobile device is calculated based at least in part on the location information and the sensor data.

[0007] The object of the invention is to provide a solution that offers the driver of the vehicle a flexible and simple way to increase information security by flexibly preventing the collection of personal or personally identifiable data if necessary.

[0008] This object is achieved according to the invention by the features of the independent claim. Preferred embodiments are the subject of the dependent claims.

[0009] The above-mentioned object is achieved by a method for the flexible provision of information security in connected vehicles, comprising: Receiving, at a backend server, a request to perform an alibi mode in a vehicle; Recording, on the backend server, a route traveled by the vehicle after receiving the request; Determine, on the backend server, an alibi route that corresponds to the route travelled by the vehicle in - the distance travelled; and / or - the energy consumption; corresponds; and Transmitting the alibi route to the vehicle, whereby the route traveled by the vehicle is overwritten with the alibi route.

[0010] For the purposes of this description, the term vehicle includes in particular passenger cars (cars), lorries (lorries), buses, mobile homes, motorcycles, etc.

[0011] The backend server is a central data pool and can include a computing device as well as a storage device, e.g. a database, in which data can be stored, managed and processed centrally or centrally controlled.

[0012] It may be necessary for each vehicle to first undergo a one-time registration on the backend server (or another suitable computing device that provides a corresponding service). This one-time registration may include at least the deposit of a suitable vehicle identification (ID), but may also include other suitable data.

[0013] Each vehicle can comprise a communication unit or a communication module. The communication unit can be a communication unit arranged in the vehicle that is capable of establishing a communication connection with other communication participants, for example with the backend server. The communication unit can comprise a subscriber identity module or a SIM card, which serves to establish a communication connection via a mobile radio system. The subscriber identity module uniquely identifies the communication unit in the mobile radio network. The communication connection can be a data connection (e.g. packet switching) and / or a wired communication connection (e.g. circuit switching). Any communication between the vehicle and other communication participants can take place via the communication unit.

[0014] The backend server is configured to receive a request or requirement – ​​e.g., in the client-server paradigm – to execute an alibi mode in a vehicle. Via an input / output unit – e.g., the infotainment system in the vehicle – a query can be sent to the driver each time a journey begins, asking whether they wish to execute an alibi mode. Furthermore, or alternatively, the vehicle user can initiate a request to execute alibi mode in the vehicle at any time – e.g., via the input / output unit in the vehicle. The request to execute alibi mode in the vehicle (hereinafter also referred to as a 'request') can be transmitted to the backend server via the vehicle's communications unit.

[0015] In addition or alternatively, the user (e.g., driver, owner, etc.) of the vehicle can initiate the request via a mobile device and transmit it to the backend server. The mobile device can be coupled to the vehicle via a suitable communication interface, e.g., a Bluetooth interface. In addition or alternatively, the mobile device can be linked to the vehicle using a predetermined, suitable authentication via a server—e.g., the backend server. All common and future authentication methods, such as knowledge (e.g., user name and password, PIN, security question, etc.), possession (e.g., SIM card, certificate, smart card), biometrics (e.g., fingerprint, facial recognition), and any combination of the individual authentication methods, can be considered for authentication.

[0016] A mobile device is a device that is able to communicate wirelessly in a mobile network via local areas networks (LANs), such as wireless fidelity (WiFi), or via wide areas networks (WANs) such as global system for mobile communication (GSM), general package radio service (GPRS), enhanced data rates for global evolution (EDGE), universal mobile telecommunications system (UMTS), high speed downlink / uplink packet access (HSDPA, HSUPA), long-term evolution (LTE), or world wide interoperability for microwave access (WIMAX). Communication via other current or future communication technologies is possible. The term mobile device includes in particular smartphones, but also other mobile telephones.Mobile phones, personal digital assistants (PDAs), tablet PCs and all current and future electronic devices equipped with technology for loading and running apps.

[0017] The backend server is configured to record a distance traveled by the vehicle after receiving the request.

[0018] In the next step, the backend server is configured to determine an alibi route that corresponds to the route traveled by the vehicle. The alibi route is characterized in particular by the fact that, while it corresponds to the route traveled by the vehicle in its starting and ending points, it is not identical to it.

[0019] The backend server is configured to send or transmit the alibi route to the vehicle in the next step.

[0020] By implementing alibi mode, an alternative alibi route is advantageously available in the vehicle, which corresponds to the route actually traveled by the vehicle in its start and end points, but is not identical to it. The actual route traveled can be overwritten with the alibi route. Advantageously, this means that no conclusions can be drawn about the actual route from actual position data, and thus also not about the identity of the user or driver of the vehicle. In other words, by providing the alibi route, no personal reference or linkability with regard to the actual route traveled is possible. This ensures information security, in particular data protection, flexibly as needed.

[0021] Preferably, the method also comprises transmitting the alibi route to a telematics server.

[0022] For example, a telematics server can be configured to provide one or more telematics services for correspondingly registered vehicles. Providing the telematics services can include transmitting distances traveled from the vehicle to the telematics server. If a request is received, the alibi distance can be transmitted from the vehicle and / or the backend server to the telematics server instead of the actual distance traveled by the vehicle.

[0023] Advantageously, the telematics server is therefore unable to identify individuals or to identify individuals.

[0024] Preferably, recording the route on the backend server includes: Receiving vehicle position data; and Determine the distance traveled based on the received position data.

[0025] The backend server can be configured to receive current position data from the (previously registered vehicle). The current position or current position data of each vehicle can be determined using a navigation satellite system. The navigation satellite system can be any current or future global navigation satellite system or Global Navigation Satellite System (GNSS) for positioning and navigation by receiving signals from navigation satellites and / or pseudo-navigation satellites. For example, this can be the Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), Galileo, positioning system, and / or BeiDou Navigation Satellite System. For example, each vehicle can include a module suitable for recording the vehicle's position in the respective system.In the GPS example, the vehicle may include a position determination unit comprising a GPS module configured to determine the current GPS position of the vehicle. The position data is then sent to the backend server.

[0026] The vehicle can capture the position data at predefined events and transmit it to the backend server. This can occur at regular intervals, e.g., every 30 seconds, every minute, every 2, 5, 10, or 20 minutes. Additionally or alternatively, each vehicle can be configured to transmit the position data at predefined events, e.g., at every start of a journey, at every stop, at every parking, etc. For example, the vehicle can create the first position data at the start of the journey, then at regular intervals, and the final position data at the end of the journey.

[0027] The backend server can be configured to determine the actual distance traveled from the position data after receiving the request.

[0028] Preferably, recording the route on the backend server includes receiving the route from the vehicle.

[0029] The actual distance traveled can also be recorded on the vehicle side and transmitted to the backend server, for example, at the end of the journey (or in sections).

[0030] The end of the route can, for example, be determined by parking the vehicle, in which case the vehicle can transmit a corresponding message containing the actual route traveled to the backend server via the communication unit.

[0031] The alibi distance corresponds to the distance travelled by the vehicle in - the distance travelled; and / or - energy consumption.

[0032] The backend server is configured to determine an alibi route that exactly matches the actual distance traveled. This is particularly advantageous because it's impossible to determine from the vehicle's mileage, for example, that an alibi route has been traveled, as this exactly matches the vehicle's mileage.

[0033] In addition, or alternatively, the alibi route can correspond to the energy consumption traveled by the vehicle. This is particularly advantageous for at least partially electrically powered vehicles (electric cars), where energy consumption depends heavily on the nature of the route traveled. In particular, electric cars are capable of feeding at least part of the energy back into the electrical energy storage system during braking (regeneration). Advantageously, by selecting an alibi route of similar nature (e.g., both routes are steeply downhill), it cannot be determined that an alibi route exists that does not correspond to the vehicle's energy consumption.

[0034] These and other objects, features, and advantages of the present invention will become more apparent upon review of the following detailed description of preferred embodiments and the accompanying drawings. It will be appreciated that, although embodiments are described separately, individual features thereof may be combined to form additional embodiments. Fig. 1 shows a schematic system suitable for implementing a method for flexibly providing information security in connected vehicles; Fig. 2 shows an exemplary route travelled and an exemplary alibi route in an exemplary geographical area; Fig. Figure 3 shows a flowchart illustrating a method for flexible provision of information security in connected vehicles.

[0035] Fig. 1 shows a schematic system 100 which is suitable for carrying out a method 300 for the flexible provision of information security in networked vehicles 110. The method 300 is described further below with reference to Fig. 2 and Fig. 3 is explained in more detail.

[0036] The system 100 comprises at least one backend server 120. The backend server 120 may be a central data pool and may comprise a computing device (not shown) and a storage device 125, e.g., a database, in which data can be stored, managed, and processed centrally or under central control.

[0037] It may be necessary for each vehicle 110 to first undergo a one-time registration on the backend server 120 (or another suitable computing device that provides a corresponding service). The one-time registration may include at least the deposit of a suitable vehicle identification (ID), but may also include other suitable data.

[0038] The system comprises at least one vehicle 110. Each vehicle 110 can comprise a communication unit or a communication module 112. The communication unit 112 can be a communication unit arranged in the vehicle 110 that is capable of establishing a communication connection with other communication participants, for example with the backend server 120. The communication unit 112 can comprise a subscriber identity module or a SIM card (not shown), which serves to establish a communication connection via a mobile radio system. The subscriber identity module uniquely identifies the communication unit in the mobile radio network. The communication connection can be a data connection (e.g. packet switching) and / or a wired communication connection (e.g. circuit switching).Any communication between the vehicle 110 and other communication participants can take place via the communication unit 112. The respective units or modules 112, 114, 116 in the vehicle 110 can be implemented in a known manner and are communicatively and / or electrically connected to one another.

[0039] The backend server 120 is configured to receive a request or requirement—e.g., in the sense of the client-server paradigm—to execute an alibi mode in the vehicle 110 (step 310). Via an input and output unit 116 in the vehicle 110—e.g., the infotainment system 116—a query can be sent to the driver, for example, at each start of a journey, as to whether the driver wishes to execute an alibi mode. Furthermore, or alternatively, the driver or user of the vehicle 110 can initiate a request to execute the alibi mode in the vehicle 110 at any time—e.g., via the input and output unit 116 in the vehicle 110. The request to execute the alibi mode in the vehicle 110 (hereinafter also referred to as a "request") can be transmitted to the backend server 120 via the vehicle's communication unit 112.

[0040] Additionally or alternatively, the user (e.g., driver, owner, passenger in autonomous driving modes, etc.) of the vehicle 110 can initiate the request via a mobile device (not shown) and transmit it to the backend server 120. The mobile device can be coupled to the vehicle 110 via a suitable communication interface, e.g., a Bluetooth interface. Additionally or alternatively, the mobile device can be linked to the vehicle 110 by means of a predetermined, suitable authentication via a server—e.g., the backend server 120.

[0041] The backend server 120 is configured to record a distance traveled by the vehicle 110 after receiving the request (step 320).

[0042] The recording 320 of the route on the backend server 120 may include receiving 322 position data of the vehicle 110 and determining 324 the route traveled based on the received position data.

[0043] The backend server 120 can be configured to receive current position data from the (previously registered vehicle). The current position or current position data of each vehicle can be determined using a navigation satellite system. The navigation satellite system can be any current or future global navigation satellite system or Global Navigation Satellite System (GNSS) for determining positions and navigating by receiving signals from navigation satellites and / or pseudo-navigation satellites. For example, this can be the Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), Galileo positioning system, and / or BeiDou Navigation Satellite System. For example, each vehicle can include a module suitable for detecting a position of the vehicle in the respective system.In the GPS example, the vehicle 110 may include a position determination unit 114 comprising a GPS module configured to determine the current GPS position of the vehicle 110. The position data thus determined may ultimately be transmitted to the backend server 120 (via the communication unit 112).

[0044] The vehicle 110 can record the position data for predefined events and transmit it to the backend server 120. This can occur at regular intervals, e.g., every 30 seconds, every minute, every 2, 5, 10, or 20 minutes. In addition, or alternatively, each vehicle 110 can be configured to transmit the position data for predefined events, e.g., at each start of a journey, at each stop, at each parking, etc. For example, the vehicle 110 can create the first position data (for the starting point 210 of the route) at the start of the journey, then at regular intervals, and the last position data at the end of the journey (end point 230 of the route). The position data can be transmitted to the backend server 120 immediately or in bulk.

[0045] The backend server 120 can be configured to determine the actual route traveled from the position data after receiving the request in a manner known from the prior art - in particular with the aid of highly accurate digital maps.

[0046] Additionally or alternatively, capturing 320 the route at the backend server 120 may include receiving 326 the route from the vehicle 110.

[0047] The actual route 220A traveled can also be recorded on the vehicle side as explained above and transmitted to the backend server 120, for example, at the end of the journey (or in sections).

[0048] The end of the route 230 can, for example, result from parking the vehicle 110, in which case the vehicle can transmit a corresponding message comprising the actual route traveled to the backend server 120 via the communication unit.

[0049] In a next step, the backend server 120 is configured to determine an alibi route 220B that corresponds to the route 220A actually traveled by the vehicle 110. The alibi route 220B is characterized in particular by the fact that it corresponds to the route 220A traveled by the vehicle in its starting point 210 and end point 230 (cf. Fig. 2) but is not identical to it.

[0050] The alibi route 220B can be the route 220A travelled by the vehicle 110 in - the distance travelled; and / or - correspond to energy consumption.

[0051] The backend server 120 can be configured to determine an alibi route 220B based on the prior art, which exactly corresponds to the actual route 220B traveled in terms of distance. This is particularly advantageous because it is not possible to determine, for example, from the mileage of the vehicle 110 that an alibi route 220B exists. For example, a telematics service provided by a telematics server 130 may require that the routes traveled by the vehicle be stored in order to, for example, determine a motor vehicle insurance rate based on the mileage of the vehicle 110. In this case, the telematics server 130 could not recognize that an alibi route 220B exists, since this corresponds to the actual mileage of the vehicle 110.

[0052] In addition or alternatively, the alibi route 220B can correspond to the energy consumption actually traveled by the vehicle 110. This is particularly relevant for electrically powered vehicles (electric cars), where energy consumption depends heavily on the nature of the route traveled. In particular, electric cars are capable of feeding at least part of the energy back into the electrical energy storage device (recuperation) when braking (e.g., on downhill roads). Advantageously, when selecting a similarly natured alibi route 220B, it cannot be determined that an alibi route 220B exists, since this corresponds to the energy consumption of the vehicle 110 when traveling the actual route 220A.

[0053] The backend server 120 is configured to send or transmit the alibi route 220B to the vehicle 110 in a next step 340. For example, the alibi route 220B can now be stored in the vehicle 110 instead of the actually driven route 220A. This terminates the alibi driving mode.

[0054] The backend server 120 can be configured to irrevocably delete all data relating to the actual route 220A after sending or transmitting the alibi route 220B to the vehicle 110.

[0055] In another example, the backend server 120 may be configured to store encrypted data regarding the actual route 220A traveled for possible later investigations by the legislature (e.g., criminal investigations).

[0056] Advantageously, the use of the alibi route 220B allows no conclusions to be drawn about the actual route 220A traveled, and thus also about the identity of the user or driver of the vehicle 110. In other words, the provision of the alibi route 220B does not provide any personal reference or linkability to the actual route 220A traveled. This ensures information security, in particular the driver's data protection (if necessary).

[0057] The method 300 can also include transmitting 350 the alibi route 220B to a telematics server 130. For example, a telematics server 130 can be configured to provide one or more telematics services for correspondingly registered vehicles 110. The provision of the telematics services can include transmitting traveled routes 220A from the respective vehicle 110 to the telematics server 130, for example, via the communication unit 112 of the vehicle 110. If a request is received, the alibi route 220B can be transmitted to the telematics server 130 instead of the route 220A actually traveled by the vehicle 110. Advantageously, the personal reference or the ability to be linked to a person is thus not present here either, so that the use of the service(s) of the telematics server 150 does not allow any conclusions to be drawn about the actual route 220A traveled.Such telematics services may include the provision of up-to-date weather maps, up-to-date air pollution maps (e.g., particulate matter, nitrogen oxide, and / or CO2 levels), etc.

[0058] Fig. 2 shows an exemplary geographical area 200, which may be a section of a digital map. This map schematically illustrates a starting point 210 and an end point 230 of an exemplary route 220A, which was actually traveled by the vehicle 110 after receiving the request. Furthermore, an exemplary alibi route 220B, which is described with reference to Fig. 1 and Fig. 3, the alibi route 220B is schematically shown. The starting point 210 and the end point 230 of the alibi route 220B correspond to the starting point 210 and the end point 230 of the actually traveled route 220A. Otherwise, the alibi route 220B corresponds to the actually traveled route 220A in terms of the distance traveled and / or the energy consumption required by the vehicle to cover it, but the routes 220A and 220B are not identical.

[0059] Fig. 3 shows a flowchart illustrating a method 300 for flexibly providing information security in connected vehicles 110 as described with reference to Fig. 1 and Fig. 2. The process steps can thus be described as above with reference to Fig. 1 and Fig. 2 explained in more detail.

[0060] The method 300 includes receiving 310, at the backend server 120, a request to perform an alibi mode in or with respect to a vehicle 110. The method 300 also includes detecting 320, at the backend server 120, a route 220A that is returned by the vehicle 110 after receiving 310 the request.

[0061] Capturing 320 the route 220A at the backend server 120 may include receiving 322 position data of the vehicle 110 and determining 324 the actual route 220A traveled based on the received position data. Furthermore or alternatively, capturing 320 the route 220A at the backend server 120 may include receiving 326 the route 220A from the vehicle 110.

[0062] The method 300 also includes determining 330, on or by the backend server 120, an alibi route 220B that corresponds to the route 220A traveled by the vehicle 110. The alibi route 220B corresponds to the route 220A actually traveled, at least in its starting point 210 and end point 230. The alibi route 220B can correspond to the route 220A traveled by the vehicle 110 in terms of the distance traveled and / or the required energy consumption.

[0063] The method 300 also includes sending or transmitting 340 the alibi route 220B to the vehicle 110.

[0064] Furthermore, the method 300 may include transmitting 350 the alibi route 220B from the vehicle 110 and / or the backend server 120 to a telematics server 130.

Claims

[1] Method (300) for the flexible provision of information security in connected vehicles (110), comprising: Receiving (310), at a backend server (120), a request to perform an alibi mode in a vehicle (110); Recording (320), on the backend server (120), a route (220A) traveled by the vehicle (110) after receiving the request; Determining (330), at the backend server (120), an alibi route (220B) corresponding to the route (220A) travelled by the vehicle (110) in - the distance travelled; and / or - the energy consumption; corresponds; and Transmitting (340) the alibi route (220B) to the vehicle (110), wherein the distance (220A) traveled by the vehicle (110) is overwritten with the alibi distance (220B). [2] Method (300) according to claim 1, further comprising: Transmitting (350) the alibi route (220B) to a telematics server (130). [3] Method (300) according to claim 1 or 2, wherein the detection (320) of the route (220A) at the backend server (120) comprises: Receiving (322) position data of the vehicle (110); and Determining (324) the distance traveled (220A) based on the received position data. [4] Method (300) according to one of the preceding claims, wherein the detection (320) of the route on the backend server (120) comprises: Receiving (326) the route (220A) from the vehicle (110).

Images