Privacy-optimized destination input for a motor vehicle

Abstract

Procedure (200) for steering a motor vehicle (105), wherein the procedure (200) comprises the following steps: - Determine that a predetermined first person (110) is the driver of the motor vehicle (105); - Recording a destination for the motor vehicle (105); - Determine that a change of driver has taken place, whereby a second person (120) different from the first person (110) has become the driver of the motor vehicle (105); - Determine whether the change of driver from the first (110) to the second person (120) occurred during an interruption of a joint journey of persons (110, 120); and - Providing the destination to the second person (120) if it has been determined that the change of driver from the first (110) to the second person (120) took place during an interruption of a joint journey of the persons (110, 120).

Description

[0001] The present invention relates to privacy-optimized destination input for a motor vehicle. In particular, the invention relates to the sharing of a travel destination between different users of the motor vehicle.

[0002] A motor vehicle includes a navigation system configured to detect an entered destination, determine a route from the vehicle's current position to the destination, and guide the vehicle along the route. The vehicle can support driver differentiation. Settings, inputs, or other information can be assigned to a driver and protected from access by another driver. In particular, a destination entered into the vehicle by one driver can be withheld from a second driver. This can help protect a driver's privacy.

[0003] However, this information protection can also be a hindrance under certain circumstances. One of the problems underlying the present invention is therefore to provide an improved technique for enhanced data protection of a motor vehicle's destination. The invention solves this problem by means of the subject matter of the independent claims. Dependent claims describe preferred embodiments.

[0004] According to DE 10 2006 060 519 A1, it is intended that, especially when a second driver begins a new journey, he should be informed of information that comes from a previous journey of an earlier, first driver.

[0005] In DE 10 2013 204 882 A1, the identification of persons in vehicles is addressed by means of seat occupancy and identification codes.

[0006] DE 10 2014 017 375 A1 concerns a method according to which, with the engine and infotainment system of a vehicle running, a change of driver is detected and the previous destination is displayed to the new driver, depending on whether or not they have a private user profile. A distinction between a mere interruption of a shared journey by both drivers and a complete stop before the start of another, new journey is neither intended nor possible.

[0007] According to a first aspect of the present invention, a method for controlling a motor vehicle comprises steps of determining that a first person is the driver of the motor vehicle; determining a destination for the motor vehicle; determining that a change of driver has occurred, whereby a second person, different from the first person, has become the driver of the motor vehicle; determining whether the change of driver from the first to the second person occurred as part of an interruption of a joint journey of the persons; and providing the destination to the second person if it has been determined that the change of driver from the first to the second person occurred as part of an interruption of a joint journey of the persons.

[0008] The proposed method allows for a better balance between data privacy and convenience. The destination is typically entered by the first driver and can be assigned to that person. However, if the first and second drivers are traveling together, the destination can be shared with the second driver. Conversely, if the first and second drivers are traveling independently, the second driver's access to the first driver's destination can be prevented.

[0009] When several people are traveling together, this method can be advantageous for facilitating one or more driver changes during the trip. Multiple entries of the destination or manually passing it from one driver to the next can become unnecessary. The method can also be used multiple times and / or with more than two people.

[0010] In a preferred embodiment, the destination is hidden from the second person if the driver change occurs outside of an interruption of the shared journey. Preferably, both the existence of a destination and the specific destination entered are hidden from the second driver. This can provide particularly good protection for the privacy of the first driver.

[0011] In one variant, it is stipulated that the first and second persons must be on board the vehicle before and after the driver change. This criterion can be sufficient to establish that a shared journey has been interrupted and the persons have exchanged driving positions. In this embodiment, it may be irrelevant whether another person was on board before and / or after the change. This allows different people to use the vehicle flexibly. For example, the vehicle can also be more easily used for the staged transport of persons, such as within the framework of a carpool.

[0012] To determine that the driver change occurred during an interruption of a shared journey, other or additional indicators can also be used. Generally, several indicators can be considered and logically linked together.

[0013] For example, it can be determined that the driver change occurred while the vehicle was stationary. It can also be determined that at least one vehicle door was opened. This vehicle door could be located in the driver's area. It can also be determined that at least two vehicle doors were opened while the vehicle was stationary. Furthermore, it can be determined that the duration of the stationary period does not exceed a predetermined threshold. In another embodiment, it can also be determined that the duration of the stationary period exceeds a further predetermined threshold. For example, a vehicle stationary for between approximately 10 seconds and approximately 1 hour could be interpreted as an indication of a driver change. If a predetermined indicator of a driver change is not detected, it can be concluded that no driver change, in the sense of a journey interruption, occurred.

[0014] In a refinement of the described procedure, it can be determined that a predetermined service measure was performed on the vehicle during the standstill. It is common for a driver change to be carried out as part of such a service measure. However, if no service measure was performed on the vehicle, this cannot be interpreted as an indication that a driver change did not occur.

[0015] The service measure may include, in particular, replenishing the vehicle's energy reserves. If the vehicle is powered by an internal combustion engine, the fuel supply may be replenished. If it is an electrically powered vehicle, the vehicle's electrical energy storage system may be charged while stationary. Other service measures may also be specified, such as topping up other operating fluids like water or oil, checking tire pressure, or cleaning a vehicle window.

[0016] In yet another embodiment, it is determined that the stop occurred in the vicinity of a service station. For this purpose, the current position can be compared with map data showing service stations or other points of interest. In one variant, the service station is equipped to perform the predetermined service measure on the vehicle. For example, the service station could be a workshop, a gas station, or a charging station. In another variant, the service station could be for the rest or to meet a need, particularly a travel-related need, of one of the occupants of the vehicle. In this case, it could be, for example, a parking lot, a rest area, or a public restroom. This takes into account that a technically or humanly necessary or customary stop of the vehicle is often used for a driver change.

[0017] In a further development of this idea, it can be determined that the duration of a standstill essentially corresponds to the expected duration of a service measure. To this end, it can be determined which service measure is being performed. For example, a time of approximately 2 to 10 minutes is realistic for refueling, while charging a vehicle's electrical energy storage system takes approximately 15 to 90 minutes. For a person to eat a meal, for example at a rest stop, between approximately 15 and 60 minutes are typically assumed. Other threshold values ​​can be used alternatively.

[0018] Various techniques can be used to determine which person is driving the vehicle or even if they are on board at all. In one variant, the first and / or second person is identified based on a digital vehicle key assigned to that person. The digital vehicle key is usually stored on a device that can communicate wirelessly with the vehicle. The device can be permanently assigned to the person. In one embodiment, the device is standalone and can, for example, be integrated into a mechanical key or designed as a key fob. In another embodiment, the digital vehicle key can be stored on a device that is assigned to the person.Such a device can be referred to as a personal device and could include, for example, a smartphone, mobile phone, laptop computer, tablet computer, smartwatch, smart ring, or similar device. Using the digital vehicle key may require the person to authenticate themselves to the device. For example, in the case of a smartphone, this could be done by presenting a biometric feature or by entering a predetermined secret.

[0019] In one embodiment, the person who is the driver of the motor vehicle is determined based on the digital vehicle key used to unlock or start the vehicle. Additionally, one or more persons who are on board the vehicle and carry a digital vehicle key can be identified. These persons can potentially become the driver of the vehicle in the event of a change of driver.

[0020] In another variant, the first and / or second person is identified based on a biometric characteristic. For example, facial recognition can be performed using a camera image from an interior camera of the vehicle. Here, too, both the driver of the vehicle and any person generally present on board the vehicle who is not currently driving can be identified.

[0021] In yet another embodiment, it is determined that the same number of people are on board the vehicle before and after the driver change. For this purpose, signals from occupancy sensors of seats on board the vehicle can be evaluated. In particular, it can be determined that at least two people are on board before and after a possible driver change, so that a driver change is plausible.

[0022] It remains preferable that a profile be assigned to each identified person on board the vehicle. The destination can be stored in this profile. The identified person's profile can be protected from access by other individuals. For example, the first person can enter the destination, which is then saved in their profile. If the second person then drives temporarily, the originally saved destination can be accessed when the driver changes again, reverting to the first person. Multiple transfers of the destination between the profiles of the individuals may not be necessary. It should be noted that not every person acting as the driver of the vehicle is necessarily known or identifiable. A guest profile can be provided for a person who cannot be identified. This guest profile can be used by multiple individuals who could not be identified.If one of the persons is a guest in this sense, then the destination can only be withheld from the other person if they can be assigned a different role.

[0023] According to a further aspect of the present invention, a control device on board a motor vehicle comprises a device for determining a person who is the driver of the motor vehicle; an input device for recording a destination for the motor vehicle; and a processing device. The processing device is configured to determine a change of driver from a predetermined first person to a second person; and to provide the destination to the second person only if the change occurs during an interruption of a joint journey of the persons.

[0024] The processing device is preferably configured to partially or completely execute a method described herein. For this purpose, the processing device may be electronic and may, for example, comprise an integrated circuit, a programmable logic device, or a programmable microcomputer. The method may be implemented in the form of a configuration or as a computer program product with program code resources for the processing device.

[0025] The configuration or computer program product can be stored on a computer-readable data carrier. Features or advantages of the method can be transferred to the device or vice versa.

[0026] The control device can include a navigation system configured to guide the motor vehicle along a route to a destination. The control device can also be separate from the navigation system. In one embodiment, the control device is configured to manage a profile of a predetermined person, who may be, in particular, the driver of the motor vehicle. The profile may, in particular, store preferences, presets, or information related to that person. Examples of preferences include a mirror or seat position or the selection of a favorite radio station. A profile can be selected after a person acting as the driver of the motor vehicle has been detected. As mentioned, a person acting as the driver but who could not be detected can be assigned to a general profile, in particular a guest profile.

[0027] According to yet another aspect of the present invention, a motor vehicle comprises a control device as described herein. The motor vehicle can, in particular, comprise a motorcycle, a passenger car, a truck, or a bus.

[0028] The invention will now be described in more detail with reference to the attached drawings, in which: Fig. 1 a control device on board a motor vehicle; and Fig. 2. A flowchart of a process is illustrated.

[0029] Fig. Figure 1 shows a control device 100 on board an exemplary motor vehicle 105. On board the motor vehicle 105 are a first person 110, to whom a first mobile device 115 is assigned, and a second person 120, to whom a second mobile device 125 is assigned. The mobile device 115, 125 is shown as a smartphone for illustrative purposes, but could also be configured differently, for example, as a standalone device. A digital vehicle key, which authorizes the use of the motor vehicle 105, can be stored on the mobile device 115, 125. This authorization can, in particular, include driving the motor vehicle 105. In other words, a person 110, 120 who possesses a matching digital vehicle key can be authorized to act as the driver of the motor vehicle 105.

[0030] To use the digital vehicle key, it may be necessary for the person (110, 120) to authenticate themselves to the mobile device (115, 125). The digital vehicle key is typically read wirelessly using a predefined, encrypted communication method. Furthermore, the digital vehicle key is preferably designed according to the specifications of the Car Connectivity Consortium. Details regarding the digital vehicle key can be found in the technical specification "Digital Key Release 3".

[0031] The control device 100 comprises a processing unit 130, an input device 135, and a wireless communication device 140. For illustrative purposes, it is assumed that the control device 100 is integrated with a navigation system for the motor vehicle 105 and is configured to determine the current geographic position of the motor vehicle 105 and to provide guidance for driving the motor vehicle 105 along a route to a predetermined destination. For this purpose, the input device 135 can also be configured as a bidirectional interaction device. The wireless communication device 140 is configured for communication with a mobile device 115, 125.

[0032] In the given example, the identity of a person 110, 120 on board the motor vehicle 105 can be established in this way. In another embodiment, an interior camera 145 is provided that can provide an image of a person 110, 120 on board the motor vehicle 105. Based on the image, the person 110, 120 can be identified. In particular, a known facial recognition technology can be used for this purpose. Other devices for identifying a person 110, 120 on board the motor vehicle 105 are also possible. In yet another embodiment, a person 110, 120 can be identified in a different way, for example, via a physical vehicle key assigned to them.

[0033] The identification of a person 110, 120 based on a digital vehicle key can be carried out by a security system of the motor vehicle 105. The security system is configured to control a predetermined security function of the motor vehicle 105 only after successful authentication of the person 110, 120 or their assigned digital vehicle key to the motor vehicle 105. The security function can, in particular, include unlocking a vehicle door or hatch, releasing an immobilizer, or starting a drive motor. In the illustration of Fig. It is assumed that this functionality is also provided by the control device 100. An interface 150 is provided for controlling the safety function, which can be connected, for example, to a corresponding actuator. In another embodiment, the safety system can be set up independently of the control device 100. In this case, the control device 100 can communicate with the safety system via the interface 150.

[0034] If persons 110 and 120 undertake a joint journey to a predetermined destination, person 110, who is initially the driver of the vehicle 105, can enter the destination into the control device 100 using the input device 135. If a stop is later made during the joint journey and persons 110 and 120 switch places, so that the second person 120 continues as the driver and the first person 110 as a passenger, the destination entered by the first person 110 can be automatically transferred to the second person 120 for use. It is proposed that this transfer be enabled only if it is indeed a stopover with a driver change during the joint journey of persons 110 and 120.Should persons 110 and 120 change their positions as driver and passenger for another reason or in another context, the destination assigned to the first person 110 cannot be transferred to the second person 120.

[0035] Fig. Figure 2 shows a flowchart of an exemplary method 200 for data protection-optimized target input for a motor vehicle 105. It should be noted that not all embodiments of the present invention need to include all steps of method 200 described below. A step may be omitted, and an additional step may be inserted, as a person skilled in the art can easily see.

[0036] In step 205, the activation of an initial profile can be determined. The profile can comprise a collection of information assigned to a person 110 or 120. The initial profile is assigned to the first person 110. In order for the first person 110 to act as the driver of the vehicle 105, they identify themselves to the vehicle 105. This can be done, for example, by entering a predetermined secret or by presenting a digital vehicle key.

[0037] In step 210, a destination is entered. The destination can be entered, in particular, by the first person 110. For this purpose, the first person 110 can use the interaction device 135.

[0038] An entry is usually made by specifying a city, a street and a house number; other concepts are also possible.

[0039] The control device 100 can determine a route based on a current geographical position of the motor vehicle 105 and the specified destination with respect to predetermined map data, along which the motor vehicle 105 can subsequently be guided to the destination.

[0040] In step 215, it can be determined that the motor vehicle 105 is stationary. Further circumstances of the standstill can also be determined, for example, whether a door of the motor vehicle 105 is opened, whether a person 110, 120 leaves or enters the motor vehicle 105, how long the standstill lasts, whether the standstill occurs in the vicinity of a service station, whether the standstill is made relatively close to the specified route to the destination, or how long the stop lasts.

[0041] In step 220, the activation of a second profile can be determined. The second profile is assigned to the second person, 120. If the second person, 120, does not have their own profile assigned, a predefined guest profile can be used. In all cases, access to information in the first profile by the second person, 120, is initially blocked.

[0042] Based on the collected information, step 225 can determine whether a driver change occurred between persons 110 and 120 during a joint trip. This trip may, in particular, lead to the previously entered destination. For this purpose, one or more indicators, as described herein, can be evaluated. In one embodiment, a weighted sum of the detected indicators can be determined, and the result can be compared with a predetermined threshold. If the result exceeds the threshold, it can be assumed that a driver change took place. In this case, step 230 can provide the destination previously entered by the first person, 110, to the second person, 120.

[0043] Otherwise, if step 225 determines that the journey did not involve a driver change on a shared trip, the destination entered by the first person 110 can be hidden from the second person 120. Optionally, the first person 110 can still transmit the destination by authenticating themselves to the vehicle 105 or the control device 100 and giving their consent to the disclosure of the destination. Reference sign 100 Control device 105 motor vehicle 110 first person 115 first mobile device 120 second person 125 second mobile device 130 processing facilities 135 Input device, interaction device 140 wireless communication equipment 145 Interior camera 150 interface 200 procedures 205 Determine activation of first profile 210 Enter destination 215 Vehicle at a standstill 220 Activation of second profile 225 driver changes? 230 Provide destination 235 Hide destination

Claims

[1] Method (200) for steering a motor vehicle (105), wherein the method (200) comprises the following steps: - Determine that a predetermined first person (110) is the driver of the motor vehicle (105); - Recording a destination for the motor vehicle (105); - Determine that a change of driver has taken place, whereby a second person (120) different from the first person (110) has become the driver of the motor vehicle (105); - Determine whether the change of driver from the first (110) to the second person (120) occurred during an interruption of a joint journey of persons (110, 120); and - Providing the destination to the second person (120) if it has been determined that the change of driver from the first (110) to the second person (120) took place during an interruption of a joint journey of the persons (110, 120). [2] Method (200) according to claim 1, wherein the destination is concealed from the second person (120) if it has been determined that the change of driver took place outside of the interruption of the joint journey. [3] Method (200) according to any of the preceding claims, where it is determined that the change of driver took place while the motor vehicle was stationary (105); wherein it can be determined that a predetermined service action was carried out on the motor vehicle (105) during the standstill; wherein the service action may include replenishing a supply of driving energy of the motor vehicle (105). [4] Method (200) according to claim 3, wherein it is determined whether the standstill occurred in the area of ​​a service station. [5] Method (200) according to claim 4, wherein it is determined whether a duration of downtime is substantially equivalent to an expected duration of a service measure. [6] Method (200) according to any of the preceding claims, where the first and / or second person (110, 120) is identified on the basis of a digital vehicle key assigned to the person (110, 120); and / or where the first and / or second person (110, 120) is identified on the basis of a biometric characteristic. [7] Method (200) according to one of the preceding claims, wherein a profile is assigned to a recognized person (110, 120) on board the motor vehicle (105); wherein the destination is stored in the profile. [8] Control device (100) on board a motor vehicle (105), wherein the control device (100) comprises the following elements: - a device (140, 145) for determining a person (110, 120) who is the driver of the motor vehicle (105); - an input device (135) for recording a destination for the motor vehicle (105); and - a processing facility (130) which is equipped to, - to determine a change of driver from a predetermined first person (110) to a second person (120); and - to provide the destination to the second person (120) only if the change has taken place during an interruption of a joint journey of the persons (110, 120). [9] Control device (100) according to claim 8, further comprising a navigation system configured to guide the motor vehicle (105) along a route to a destination. [10] Motor vehicle (105), comprising - a device for carrying out a method according to one of claims 1 to 7 and / or - a control device (100) according to one of claims 8 or 9.

Images