Computer-implemented method for secure data processing within the framework of providing a vehicle function and information technology system

Abstract

The invention relates to a computer-implemented method for secure data processing in the context of providing a vehicle function, wherein a vehicle (1) generates data (2) to be processed for providing the vehicle function and transmits it cryptographically secured to a central computing unit (3), which processes the data (2) and transmits the resulting data (4) back to the vehicle (1) cryptographically secured for providing the vehicle function. The method according to the invention is characterized by the following process steps: A: Generating the data (2) in the vehicle (1); B: Enriching the data (2) with a unique request ID (5); C: cryptographic encryption of the data (2) in the vehicle (1); D: Transfer of the data (2) to the computing device (3); E: Reading a purpose information (7) by the computing device (3); F: Applying a purpose-specific homomorphic processing method (8) selected depending on the purpose information (7); G: Transferring result data (4) to the vehicle (1); H: Decoding the result data (4) in the vehicle (1); I: Matching the request IDs (5); and J1: Use of the decoded result data (4) by the vehicle (1); or J2: Discarding the decoded result data (4); wherein the vehicles (1) of a vehicle fleet (9) perform steps A to D additionally at random times under the generation of dummy data (10), the dummy data (10) representing artificially generated random data, wherein the vehicle (1) is part of the vehicle fleet (9).

Description

[0001] The invention relates to a computer-implemented method for secure data processing of the type defined in more detail in the preamble of claim 1, and to an information technology system for carrying out the method.

[0002] With increasing digitalization, the proportion of computing units in vehicles is also growing. Processing data within the vehicle enables a wide variety of vehicle functions. This includes, for example, route planning with a navigation system to optimize charging stops for electric vehicles, minimizing travel interruption time and the distance of any necessary detours; and processing sensor data generated by the vehicle to provide driver assistance systems, such as lane departure warning. Depending on the specific vehicle function, it may be necessary to process information externally by a central computing unit.

[0003] Data processing in the cloud takes place within the framework of "Software-as-a-Service" (SaaS). Software is centrally hosted in the cloud and accessible online via the internet. The advantage of using cloud services lies in the rapid data processing due to powerful hardware and access to extensive data repositories such as databases, which can be queried according to specific functions. This allows for the timely execution of computationally intensive algorithms, especially when using complex AI algorithms. The algorithms used for data processing can be implemented centrally, making them easier to use and maintain with less effort. Furthermore, the hardware and software components of the underlying IT system can be scaled quickly depending on the current load.When a few clients request access to a service, these requests can be processed using a relatively large number of cloud infrastructure resources, whereas when a relatively large number of clients request a service, the computing resources are redistributed accordingly. This allows, in particular, for the cost-efficient provisioning of functions and services.

[0004] However, centralized data processing has the disadvantage that critical information, such as personal data or information that allows inferences to be made about a user's characteristic behavior patterns, must be transmitted over the internet and processed by external partners. Generally, there is always the risk that a corresponding communication channel or the IT infrastructure used for data processing could be compromised by an attacker. In the past, for example, the IT systems of a vehicle manufacturer have been infiltrated, and sensitive data leaked. Therefore, there is a risk that unauthorized individuals could gain access to such data or information. This creates a need for tools that allow cloud-based data processing in the context of providing vehicle functions while maintaining cybersecurity.

[0005] Homomorphic encryption and computation methods are known from the general state of the art. Such methods allow arithmetic operations to be applied to encrypted data, ensuring that the entity performing the operation has no access to the data before or after the operation. Encrypted results are transmitted back to their source and decrypted there. This allows for secure data processing without disclosing sensitive information. Standardized libraries exist for computational, search, comparison, and lookup operations. Such libraries can be found, for example, at: - https: / / homomorphicencryption.org; - Microsoft SEAL: Fast and Easy-to-Use Homomorphic Encryption Library: https: / / www.microsoft.com / en-us / research / project / microsoft-seal / ; - OpenFHE.org - OpenFHE - Open Source Fully Homomorphic Encryption Library: https: / / openfhe.org / .

[0006] However, the application of homomorphic processing methods by a cloud infrastructure only allows for inadequate data protection, since metadata such as location information, timestamps or an IP address of a sender or recipient and the like are assigned to the data to be processed through data collection, data transmission and data processing, which allows conclusions to be drawn about the identity of a user or a vehicle.

[0007] See also: https: / / netzpolitik.org / 2020 / edri-bericht-die-eu-staaten-muessen-vorratsdatenspeicherung-endlich-aufgeben / ; and https: / / www.kuketz-blog.de / die-komplexe-welt-der-metadaten-ein-blick-auf-datenschutz- und-privatsphaere / .

[0008] An effective means of preventing the analysis of metadata is so-called deniability. See, for example: https: / / de.wikipedia.org / wiki / Glaubhafte_Abstreitbarkeit.

[0009] In information technology, mechanisms for the credible deniability of communication are used, for example in anonymous peer-to-peer networks such as the Tor network, or for general data encryption, to deny the origin or existence of information. These are methods to conceal confidential data or its origin, so that its existence and origin cannot be proven.

[0010] However, anonymizing peer-to-peer networks are characterized by significant disadvantages. Entry and exit nodes into the network are potential points of entry for deanonymization. Insufficient availability and bandwidth for data transmission within the network lead to a deterioration of the user experience. In particular, data transmission latency fluctuates considerably and is therefore unreliable.

[0011] Methods for anonymizing movement data are known from DE 10 2021 001 378 B3. In this process, a vehicle's movement data is processed by a backend server. Before the movement data is transmitted to the backend server, it is exchanged with another vehicle encountered along the same route, so that the backend server does not have access to information about which movement data was originally generated by which vehicle.

[0012] The obfuscation of signals by superimposing them with noise signals is also known from US 2009 / 285402 A1. While the method disclosed therein enables the obfuscation of user data, it does not in any way protect against the collection and analysis of metadata generated during communication between sender and receiver. Furthermore, knowledge of the noise signal used is required on the receiver side in order to reconstruct the user data. This undermines the principle of absolute privacy, since the user data is reconstructed on the receiver side and is therefore accessible to unauthorized third parties in the event of a compromise.

[0013] Another method for anonymizing vehicle data is also known from DE 10 2019 209 487 A1. Here too, there is insufficient protection against the identification of critical information from metadata.

[0014] Furthermore, US patent 2021 / 0192509 A1 discloses a system, method, and computer program product for ensuring data privacy in group transactions. This involves issuing a secret key for communication between multiple user devices. A first user device sends a message to a server to execute a split billing process, with the server not having access to the secret key. The message contains information encrypted with the secret key. The server generates an encrypted billing result for the users.

[0015] Furthermore, DE 10 2018 006 747 A1 discloses a method for evaluating data from a vehicle. The vehicle sends encrypted sensor data to an external data processing unit. The sensor data is homomorphically encrypted and processed in encrypted form on the data processing unit. Encrypted result data is received by the vehicle and only decrypted there.

[0016] Furthermore, DE 10 2019 102 487 A1 discloses a system and method for the secure transmission and processing of data, which also shows external processing of encrypted data and its decryption in the vehicle.

[0017] Furthermore, measures for defending low-latency mix networks against attacks are known from: SHMATIKOV, V. [et al.]: Timing analysis in low-latency mix networks: attacks and defenses. In: 11th European Symposium on Research in Computer Security (ESORICS 2006), Hamburg, Germany, September 18-20, 2006. URL: https: / / www.cs.cornell.edu / ~shmat_esorics06.pdf.

[0018] Furthermore, a dependent link padding scheme for protecting anonymization systems from traffic analysis is known from: WANG, W. [et al.]: Dependent link padding algorithms for low latency anonymity systems. In: 15th ACM conference on Computer and Communications Security (CCS' 08), Virginia, Alexandria, USA, October 27-31, 2008, pp. 323-332. DOI: 10.1145 / 1455770.1455812.

[0019] The present invention is based on the objective of providing an improved method for secure data processing in the context of providing a vehicle function, which does not allow any conclusions to be drawn about the identity of a user and / or a vehicle used to make the service request to the hoster of a cloud service for the provision of the vehicle function.

[0020] According to the invention, this problem is solved by a computer-implemented method for secure data processing with the features of claim 1. Advantageous embodiments and further developments, as well as an information technology system for carrying out the method, are described in the dependent claims.

[0021] A generic computer-implemented method for secure data processing in the context of providing a vehicle function, wherein a vehicle generates data to be processed for the provision of the vehicle function and transmits it cryptographically secured to a central computing unit, which processes the data and transmits the resulting data back to the vehicle in cryptographically secured form for the provision of the vehicle function, is further developed according to the invention by the following method steps: A: Generating the data in the vehicle; B: Enriching the data with an individual request ID and additionally storing the request ID in the vehicle; C: Cryptographic encryption of the data in the vehicle with a vehicle-specific secret, whereby the encrypted data is assigned a purpose information readable by the computing device, describing the context of the processing of the data within the framework of the underlying vehicle function; D: Transfer of data to the computing facility; E: Reading the purpose information assigned to the received cryptographically encrypted data by the computing facility; F: Applying a purpose-specific homomorphic processing method selected based on the purpose information to the cryptographically encrypted data by the computing facility to generate cryptographically encrypted result data, whereby the request ID is carried unchanged from the encrypted data into the result data; G: Transferring the results data to the vehicle; H: Decrypting the result data in the vehicle using the secret; I: The vehicle compares the query ID contained in the decrypted result data with query IDs stored in the vehicle; and J1: if both request IDs match: the vehicle uses the decrypted result data to provide the vehicle function; or J2: if the request IDs differ: discard the decrypted result data; wherein the vehicles of a vehicle fleet perform steps A to D without additionally storing the request ID in the vehicle in step B additionally at random times under the generation of dummy data, the dummy data representing artificially generated random data, wherein the vehicle is part of the vehicle fleet.

[0022] The implementation of the method according to the invention allows the processing of data generated in the vehicle for the provision of vehicle functions in a cloud environment while maintaining data integrity. Neither the data itself nor the metadata associated with the data through data transmission and processing can reveal critical information such as personal data or information that would allow inferences about behavioral patterns and thus the identity of a user or vehicle. Therefore, even if an attacker infiltrates the central computing unit or the information technology systems involved in the data transmission, such as a mobile communication node, no inferences about such information can be drawn. Consequently, the potential attacker cannot carry out any attacks on the user of the vehicle or the vehicle function.This not only increases cybersecurity but also personal safety, as it prevents, for example, the identification of a vehicle used by a VIP who is to be kidnapped or involved in an accident, and its location at any given time.

[0023] Depending on the type of vehicle function, a wide variety of data can be collected in the vehicle, such as position data, especially in the form of GPS data, sensor data, for example in the form of camera images, radar or LiDAR distance data, speed data, acceleration data, temperature data and the like.

[0024] Each vehicle and the central computing unit are connected to each other in the usual way, for example via the internet. The central computing unit can thus be referred to as a cloud server or backend. The individual vehicles in the fleet can be equipped with a telecommunications unit that allows them to connect to the internet wirelessly, for example via mobile network, Wi-Fi, or similar technologies. Data transmission is cryptographically secured, for example using the HTTPS protocol.

[0025] In step D, the respective vehicle transmits data to the computing unit, whereupon the computing unit transmits the resulting data back to the vehicle in step G. The computing unit therefore requires information describing which data must be transmitted to which vehicle in the fleet during data processing. For this purpose, the respective vehicle and the computing unit can establish a so-called "session." For example, the vehicle user can log in to the central computing unit with a personal user account using an individual username and password. Such an account can also be vehicle-specific, or a vehicle itself can have such an account. A unique assignment between vehicle and service request is possible, for example, using the IP address, MAC address, or similar identifier of a hardware component installed in the vehicle.The vehicle can also transmit identification information, such as a vehicle identification number (VIN) or at least parts thereof, to the central computer. If an attacker has infiltrated the central computer and is thus able to intercept incoming and outgoing data traffic, the attacker knows which information is being exchanged between which vehicle and the central computer, but cannot view this information due to cryptographic encryption and the homomorphic processing of the underlying data. Furthermore, individual vehicles can deny that sensitive data has been processed, since, in addition to real data required for vehicle functionality, they also transmit dummy data to the central computer.Thus, the metadata also prevents any inferences about sensitive information that could enable the determination of behavioral profiles, identities, and the like. The vehicle or user can therefore deny that the data assigned to it constitutes a data exchange and processing of real data—that is, data that actually needs to be processed to provide the vehicle's functionality. The principle of deniability of communication is thus maintained. Any communication or processing operation involving real data is therefore lost in the noise of randomly generated dummy data.

[0026] The individual request ID generated in step B allows the respective vehicle to track whether the result data received from the central computing unit is actually intended for use in providing a vehicle function. If dummy data is generated and transmitted to the central computing unit, no request ID is stored in the vehicle. It would also be conceivable to store the request ID and link it to additional information indicating that this request ID was generated during the creation and processing of dummy data, so that result data to which such a request ID is assigned is not considered in the vehicle. However, this unnecessarily consumes storage space on a computer-readable storage medium in the vehicle, so it is preferable not to store a request ID for dummy data.

[0027] Once the vehicle decrypts the encrypted result data received from the computing unit, corresponding request IDs can be read. These request IDs are compared with the stored request IDs so that the vehicle can determine whether this result data should be used to provide a vehicle function or not. Request IDs can be randomly generated by the vehicles during the generation or encryption of the real or dummy data. They can be any sequence of numbers or digits. For example, a true random number generator can be used to generate request IDs. It is also conceivable to generate ambiguous response IDs that include a characteristic identifier of the vehicle, such as the last two digits of its own vehicle identification number, the last two digits of a user account name, or a modulo base and the modulo result.Each request ID is unique to a respective service request, i.e., a specific provision of a particular vehicle function.

[0028] Standard cryptographic encryption mechanisms, particularly symmetric or asymmetric encryption mechanisms, can be used to encrypt and decrypt the data or results. The vehicle-specific secret can therefore be a symmetric key or a private and public cryptographic key, respectively.

[0029] Thanks to the use of homomorphic processing methods, the data does not need to be decrypted for processing by the central computing unit. Therefore, no secrets or cryptographic keys need to be transmitted to the central computing unit. Consequently, vehicle-specific secrets cannot be stolen by a potential attacker at the central computing unit. Nevertheless, processing the data to generate results is still possible.

[0030] Each vehicle's unique secrets are stored in a secure memory within the vehicle, such as a so-called crypto chip. Such a crypto chip can be part of a Trusted Platform Module (TPM).

[0031] In general, it is conceivable to encrypt all data at once or to encrypt parts of the data individually. For example, each piece of personal or personally identifiable information can be encrypted individually, preferably with a unique, i.e., different, secret. Accordingly, individually encrypted results data are also transmitted back to the vehicle, which must then be decrypted individually.

[0032] The method according to the invention can be used to provide all possible vehicle functions. The data to be processed in each context typically have a different structure. For example, the data of a given service request differs in file format, file size, and the like. Therefore, specific homomorphic processing methods must be applied in each case. The purpose information determines which homomorphic processing method the central computing unit must apply in each case. If the method is carried out in the context of only a single purpose or a single vehicle function, the purpose information can be omitted, since it is not necessary to distinguish between multiple purposes.

[0033] The implementation of the method according to the invention makes it possible, for example, to provide the following services in the vehicle, which do not allow any conclusions to be drawn about sensitive data.

[0034] Location-based services without revealing one's own position: - Searching for points of interest in the vehicle's surroundings without allowing third parties to become aware of the vehicle's surroundings; - Querying traffic data in the vehicle's surroundings; - Searching for speed cameras or traffic controls near the vehicle.

[0035] Private health monitoring and classification of health hazards: - Recording, transmission and processing of vital data generated in the vehicle that allows conclusions to be drawn about the health status of a vehicle occupant; - Detection of reduced attention or fatigue to issue a fatigue warning based on vital signs and / or monitoring of the driver's gaze direction and / or blink rate.

[0036] Automated driving: - Transfer of manual control of the vehicle to a human operator in an external control center.

[0037] An advantageous further development of the method according to the invention provides that the vehicles in the fleet, or rather the times at which steps A to D are carried out in the context of the dummy data, are defined with a frequency distribution such that no statistically identifiable pattern exists between carrying out steps A to D using real data and carrying out steps A to D using the dummy data. In other words, there are no fixed rules by which it can be determined when real data and when dummy data are generated, transmitted, and processed. This makes it difficult, or even completely impossible, for a potential attacker to determine which data transmission and processing take place in the context of real data and which in the context of dummy data. This further improves data integrity, privacy, and the identity of the user and the vehicle.

[0038] It is preferred that the frequency distribution be varied over time. This further complicates the differentiation between service requests using real data and dummy data.

[0039] A further advantageous embodiment of the method according to the invention provides that the purpose information is appended to the cryptographically encrypted data as a subordinate or superior data structure; or that the purpose information is assigned to the cryptographically encrypted data by means of a purpose-specific formatting of the data before or after encryption.

[0040] Thus, various mechanisms are possible for linking the purpose information with the cryptographically encrypted data. The purpose information can therefore represent dedicated additional information added to the encrypted data. This purpose information can be linked to the encrypted data as a subordinate or even a superior data structure. However, it is also conceivable to specify the purpose information through the formatting of the data itself. This can be done before or after the data is encrypted. Depending on the function to be provided by the vehicle, the data will also have a specific format. Vehicle functions within the context of navigation, such as searching for a point of interest, require, for example, the transmission of geolocation coordinates.The data structure can therefore be defined by the file format and / or the content, for example, the characteristic formatting of geocoordinates. This characteristic formatting is retained even after encryption, since the encrypted data also exhibits matching patterns for the same formatting.

[0041] Generally, a distinction can be made between an inner and an outer data structure. The outer data structure comprises various data fields. A data field can contain different types of data, such as geographic coordinates in the form of latitude and longitude, POI categories, and the like. The inner data structure can, for example, be defined by a 32-bit signed integer field in milliarcseconds for geographic coordinates. Suitable file formats such as JSON or XML can be used.

[0042] According to a further advantageous embodiment of the method according to the invention, it is further provided that the computing unit transmits the encrypted result data to several vehicles in the vehicle fleet in step G, with those vehicles that cannot decrypt the encrypted result data with their vehicle-specific secret in step H discarding the encrypted result data. This provides an even greater degree of obfuscation. Thus, a potential attacker can no longer deduce from a data set transmitted by the central computing unit to vehicles for which vehicle the transmitted cryptographically encrypted result data is actually relevant. The larger the number of vehicles to which the encrypted result data is sent, the more difficult it becomes to determine the actual vehicle for which the transmitted result data is relevant.The data sets transmitted to various vehicles are sent in the context of both real data and dummy data. The number of vehicles can be determined based on various criteria, such as the type of vehicle function or a manual user setting.

[0043] Preferably, the computing unit determines the selection of vehicles to which the encrypted result data is additionally sent, depending on a part of a characteristic identification piece of the vehicle that transmits the data or dummy data to the computing unit in step D. For example, result data can be transmitted to all vehicles in the fleet that share the last two digits of their own vehicle identification number. The vehicle, the user, or the central computing unit can freely choose which part of the characteristic identification piece is to be considered. The degree of ambiguity of sending and receiving can be flexibly adjusted by appropriately selecting the number of digits or the modulo.This allows the overhead in data communication to be limited while simultaneously ensuring a sufficiently high degree of ambiguity in data transmission.

[0044] The central computing unit can also make the selection of the respective vehicles entirely on its own.

[0045] According to a further advantageous embodiment of the method according to the invention, it is further provided that the computing unit, in response to the data or dummy data received in step D, performs steps E, F, and G multiple times, in particular using a homomorphic processing method that transfers the request ID from the encrypted data or dummy data into the cryptographically encrypted result data in a modified form. Thus, one and the same service request from a vehicle is answered multiple times by the central computing unit. This can also be done for real data and dummy data alike. Consequently, a potential attacker has even more data to evaluate, which further complicates the identification of characteristic patterns, personal data, and the reconstruction of identities.The request ID is given particular priority for exchange, allowing the vehicle, which receives multiple responses to the same service request, to recognize immediately, or after decryption, that redundant data has been transmitted and can be safely deleted. This prevents the processing and / or storage of redundant information within the vehicle. The vehicle's computing resources can thus be used efficiently. Furthermore, for irrelevant responses, the central computing unit can use dummy result data, which is also meaningless.

[0046] Generally, it is also conceivable that if the central computing unit only transmits result data back to the vehicle that originally sent the data, the request ID is not encrypted, since it is already known for which vehicle the sent and processed information is relevant. This allows for faster retrieval of the request ID in the vehicle, which improves latency.

[0047] An information technology system of the generic type, comprising at least two vehicles training a fleet of vehicles and a central computing unit communicatively connected to the vehicles, is further developed according to the invention in that the vehicles are configured to execute steps A to D and H to J of a method described above, and the computing unit is configured to execute steps E, F, and G of a method described above. The respective computing units in the vehicles and the central computing unit thus have at least read access to a computer-readable storage medium and store machine-interpretable instructions which, when executed by a processor of the respective computing unit or computing unit, cause it to provide the corresponding steps of the method according to the invention.The respective steps are performed equally in the context of generating, transmitting and processing real data and dummy data.

[0048] The vehicles in question can be of the same or different types, such as cars, trucks, vans, buses, and the like. Generally speaking, it is also conceivable that they could be watercraft, rail vehicles, or aircraft.

[0049] Further advantageous embodiments of the inventive method for secure data processing in the context of providing a vehicle function and of the inventive information technology system also result from the exemplary embodiments, which are described in more detail below with reference to the figures.

[0050] This shows: Fig. 1 a schematic representation of a data exchange between a single vehicle and a central computing unit during the execution of the method according to the invention; Fig. 2. A schematic representation of the data exchange between several vehicles and the central computing unit; and Fig. 3. A schematic representation of the temporal behavior of a vehicle in the transmission of data and dummy data to the central computing unit:

[0051] Fig. Figure 1 illustrates the process of information transfer and processing between a vehicle 1 and a central computing unit 3 for providing a vehicle function in vehicle 1. In step 101, data 2 is generated in vehicle 1 and supplemented by a unique request ID 5. The unique request ID 5 is specific to each provision of the vehicle function and is additionally stored in a computer-readable storage medium in vehicle 1. Furthermore, the data 2 in vehicle 1, as well as the request ID 5, are cryptographically encrypted with a vehicle-specific secret 6. This can be the cryptographic key of a symmetric encryption method or the public key of an asymmetric encryption method. All conceivable cryptographic encryption mechanisms are possible.

[0052] In step 102, the vehicle 1 assigns a purpose information 7 to the encrypted data 2, which defines the type of vehicle function and thus the purpose of the data processing. The encrypted data 2, enriched by the request ID 5, are sent together with the purpose information 7 to the central computing unit 3 for processing.

[0053] The corresponding data 2, represented here as data packet 11 or data stream, can be assigned metadata 12 by the instances participating in the communication. The metadata 12 includes, for example, a timestamp, a sending and / or receiving address such as an IP address, a MAC address, or the like, a user account name, a vehicle identification number, and the like. Based on the information contained in the metadata 12, a so-called session can be established between the vehicle 1 and the central computing unit 3. The session allows the system to determine which information is to be exchanged between which vehicles 1 of a vehicle fleet 9 and the central computing unit 3.

[0054] In step 103, the central computing unit 3 reads the purpose information 7 assigned to the received cryptographically encrypted data 2. Based on the purpose information 7, the central computing unit 3 determines a homomorphic processing method 8 to be used for processing the encrypted data 2. For this purpose, the central computing unit 3 maintains a relationship 13 defining which homomorphic processing method 8 should be used for which purpose information 7.

[0055] In step 104, the encrypted data 2 are processed using the selected homomorphic processing method 8 to generate encrypted result data 4. The encryption of the data 2 is thus not broken, as such a homomorphic processing method 8 is used, which ensures that the query ID 5 from the data 2 is transferred unchanged to the result data 4.

[0056] In step 105, the central computing unit 3 now transmits the encrypted result data 4 to the vehicle 1 identified based on the session. Other methods for identifying the relevant vehicle 1 are possible.

[0057] In step 106, the respective vehicle 1 decrypts the received encrypted result data 4 with the appropriate secret 6. This is accordingly the corresponding key of the symmetric encryption method or the private key of the asymmetric encryption method.

[0058] In step 107, vehicle 1 compares the request ID 5 stored in step 101 with the request ID 5 contained in the transmitted result data 4. If both request IDs 5 are the same in step 108, vehicle 1 uses the decrypted result data 4 to provide the vehicle function. However, if the two request IDs 5 differ in step 109, the received decrypted result data 4 is discarded.

[0059] The data 2, which are processed externally to the vehicle 1 to provide the vehicle function, remain encrypted at every point outside the vehicle 1. Thus, an attacker cannot access the data 2, which improves cybersecurity. Furthermore, the method according to the invention includes a mechanism that allows the vehicle 1 or a user to deny communication with the central computing unit 3. This further increases the integrity of the corresponding data or identities of the user and vehicle 1. This mechanism is described by means of Fig. 2 explained.

[0060] Furthermore, according to the invention, it is provided that the vehicles 1 of a vehicle fleet 9 randomly select the vehicle 1 to display the information in the invention at random times. Fig. The scheme shown in Figure 1 is implemented, using dummy data 10 in the form of randomly generated, but content-free data instead of data 2, also referred to as real data. While it is possible to determine which vehicle 1 receives which data and when, based on the metadata 12 and an analysis of the data streams incoming and outgoing to the central computing unit 3, the data 2 itself cannot be viewed, and the metadata 12 does not allow reconstruction of whether the data 2 is real data to be processed for providing a vehicle function or content-free dummy data 10. Only the respective vehicle 1 can determine whether data 2 or dummy data 10 was processed by comparing the two request IDs 5. Therefore, vehicle 1, or the user, can deny that relevant information was exchanged and processed.Thus, the transmission and processing of real data 2 is lost in the noise of the transmission and processing of dummy data 10.

[0061] Based on the session, an attacker can identify which vehicle 1 of the fleet 9 receives result data 4 and when. However, this is irrelevant, as this can be denied at any time for relevant data processing, as described above. The central computing unit 3 preferentially transmits the resulting data 4 to multiple vehicles 1 of the fleet 9 in response to a specific service request. Thus, even if an attacker monitors all incoming and outgoing data traffic, they can no longer determine which response from the central computing unit 3 applies to which service request. The central computing unit 3 can also respond to a single service request multiple times to generate even more irrelevant data and thus create more "noise."

[0062] It is particularly preferred that, as Fig. Figure 3 shows that the respective vehicles 1 of the vehicle fleet 9 transmit dummy data 10 to the central computing facility 3 at such times tD that it is not possible to trace, using statistical methods, that it is a transmission of dummy data 10 instead of the transmission of real data 2. Fig.Figure 3 illustrates such a frequency distribution on a timeline over time t. The respective time points tR at which the vehicle 1 transmits and receives data 2 for the provision of the vehicle function are also shown. The frequency and intervals of the time points tD and tR on the timeline are random, so that no relationship between the transmission of real data 2 and dummy data 10 can be reconstructed or established. If the provision of the vehicle function requires data processing at regular intervals, the time points tD can also be equidistantly distributed to prevent any difference in the data transmission and processing with respect to the data 2.

Claims

[1] Computer-implemented method for secure data processing in the context of providing a vehicle function, wherein a vehicle (1) generates data (2) to be processed for the provision of the vehicle function and transmits it cryptographically secured to a central computing unit (3), which processes the data (2) and transmits the resulting data (4) back to the vehicle (1) cryptographically secured for the provision of the vehicle function, characterized by the following procedural steps: A: Generating the data (2) in the vehicle (1); B: Enriching the data (2) by adding an individual request ID (5) and additionally storing the request ID (5) in the vehicle (1); C: cryptographic encryption of the data (2) in the vehicle (1) with a vehicle-specific secret (6), wherein the encrypted data (2) is assigned a purpose information (7) readable by the computing device (3), describing the context of the processing of the data (2) within the framework of the underlying vehicle function; D: Transfer of the data (2) to the computing device (3); E: Reading the purpose information (7) assigned to the received cryptographically encrypted data (2) by the computing device (3); F: Applying a purpose-specific homomorphic processing procedure (8) selected depending on the purpose information (7) to the cryptographically encrypted data (2) by the computing facility (3) to generate cryptographically encrypted result data (4), whereby the request ID (5) is transferred unchanged from the encrypted data (2) to the result data (4); G: Transferring the result data (4) to the vehicle (1); H: Decrypting the result data (4) in the vehicle (1) using the secret (6); I: Matching the query ID (7) contained in the decrypted result data (4) with query IDs (7) stored in the vehicle (1) by the vehicle (1); and J1: if both request IDs (7) match: use of the decrypted result data (4) by the vehicle (1) to provide the vehicle function; or J2: if the request IDs (7) differ: discard the decrypted result data (4); wherein the vehicles (1) of a vehicle fleet (9) perform steps A to D without additionally storing the request ID (7) in the vehicle (1) in step B additionally at random times under the generation of dummy data (10), the dummy data (10) representing artificially generated random data, wherein the vehicle (1) is part of the vehicle fleet (9). [2] Method according to claim 1, characterized by , that the vehicles (1) of the vehicle fleet (9) and the times (tD) at which steps A to D are carried out in the context of the dummy data (10) are determined with such a frequency distribution that there is no statistically identifiable pattern between carrying out steps A to D using real data (2) and carrying out steps A to D using the dummy data (10). [3] Method according to claim 2, characterized by , that the frequency distribution varies over time (t). [4] Method according to any one of claims 1 to 3, characterized by , that the purpose information (7) is appended to the cryptographically encrypted data (2) as a subordinate or superior data structure; or that the purpose information (7) is assigned to the cryptographically encrypted data (2) by a purpose-specific formatting of the data (2) before or after encryption. [5] Method according to any one of claims 1 to 4, characterized by , that the computing device (3) in step G transmits the encrypted result data (4) to several vehicles (1) of the vehicle fleet (9), whereby those vehicles (1) which in step H cannot decrypt the encrypted result data (4) with their vehicle-specific secret (6) discard the encrypted result data (4). [6] Method according to claim 5, characterized by , that the computing device (3) determines the selection of vehicles (1) to which the encrypted result data (4) are additionally sent, depending on a part of a characteristic identification information of the vehicle (1) which transmits the data (2) or dummy data (10) to the computing device (3) in step D. [7] Method according to any one of claims 1 to 6, characterized by, that the computing device (3) in response to the data (2) or dummy data (10) received in step D performs steps E, F and G multiple times, in particular using such a homomorphic processing procedure (8) which causes the request ID (7) to be transferred from the encrypted data (2) or dummy data (10) into the cryptographically encrypted result data (4) in a modified form. [8] Information technology system comprising at least two vehicles (1) training a fleet of vehicles (9) and a central computing facility (3) communicatively connected to the vehicles (1), characterized by , that the vehicles (1) are configured to perform steps A to D and H to J of a method according to any one of claims 1 to 7 and the computing device (3) is configured to perform steps E, F and G of a method according to any one of claims 1 to 7.

Images