UWB SURVEILLANCE SYSTEM

Description

[0001] The invention relates to a UWB monitoring system and a method for controlling a UWB monitoring system.

[0002] Modern sensor technology enables detailed, diverse, and comprehensive monitoring, for example, of spatial areas. However, with the increasing volume and quality of the sensor data collected, the demands on data processing and security also rise, especially when this data includes personal information. US 2008 / 165046 A1 describes a system and method for highly selective intrusion detection using a sparse array of ultra-wideband (UWB) radars. Two or more UWB radars are arranged in a sparse array around an area to be protected. Each UWB radar emits ultra-wideband pulses that illuminate the area to be protected. Signal feedback data is processed to determine, among other things, whether an alarm condition has been triggered. High-resolution radar images are generated, providing an accurate picture of the area to be protected.This image is used to selectively detect movement and track moving objects within the protected area. Movement can be differentiated based on criteria suitable for the environment in which the intruder detection system operates.

[0003] EP 3 471 068 A1 describes a system for managing personal data. The system comprises a first security device and a second security device. The security devices are spatially separated and each is configured to collect personal data and assign the collected personal data to identities. The system also includes a management system configured to manage access rights to these identities. Both the first and second security devices anonymize the collected personal data and allow access to the personal data only when there is an access authorization associated with the identity to which the personal data is assigned.

[0004] DE 10 2015 222794 A1 describes an IoT system with a multitude of IoT sensors for recording data that can be evaluated by a data evaluation unit of the IoT system, wherein the IoT system has detectors for detecting protective signals, each of which signals consent or refusal of a person to the recording and / or processing and / or storage and / or disclosure and / or evaluation of personal data of the person concerned.

[0005] The article "Privacy-Aware Object Representation for Surveillance Systems" by Hauke ​​Vagts et al., published in the 2010 Seventh IEEE International Conference on Advanced Video and Signal Based Surveillance (pages 601-608), describes how a centralized object representation, compliant with the Fair Information Practice Principles (FIP), can be implemented for a video surveillance system. To bridge the gap between video signal processing output and the spatiotemporal analysis of object behavior at the semantic level, a generic and sensor-independent object representation is provided, fulfilling the data protection requirements for public and corporate video surveillance.

[0006] DE 20 2012 000328 U1 describes a surveillance system with a plurality of cameras, wherein the surveillance system is designed to establish a communication channel for communication with the surveillance system in response to optical authentication of a user to the surveillance system via one of the plurality of cameras of the surveillance system.

[0007] DE 10 2015 122990 A1 describes a method for protecting electronic data generated in a home automation system. The method comprises: identifying electronic data that can be associated with a user of the home automation system; obfuscating the electronic data associated with the user of the home automation system using a first cryptographic key; transmitting the electronic data, obfuscated by the first cryptographic key, from the home automation system to a data management entity; and obfuscating the data obfuscated by the first cryptographic key using a second cryptographic key by the data management entity. The method allows for the re-identification of the data obfuscated by the first and second cryptographic keys.

[0008] WO 2018 / 136402 A2 describes a contactless intelligent monitoring system for elderly people, configured to automatically detect unusual movements and short- and long-term changes in the behavior of residents in a room and issue alerts when such an event is observed. The system uses a combination of a UWB radar sensor and a thermal sensor to monitor the person's movement patterns and vital signs. An AI module learns the behavioral patterns and classifies and generates data sets, after which the system generates alerts if abnormal deviations in behavioral patterns or vital signs are observed.

[0009] DE 10 2016 200003 A1 describes a computer-implemented method for controlling access by a terminal to an attribute stored in an ID token. The method includes authentication of the terminal by the ID token and authentication of the ID token by the terminal, wherein authentication of the terminal by the ID token is carried out via an authentication server which includes a static private key assigned to the terminal, and wherein the terminal's access to the attribute is only granted if the ID token has been successfully authenticated by the terminal.

[0010] The invention is based on the objective of creating a UWB surveillance system with improved data security.

[0011] The problem underlying the invention is solved by the features of the independent claims. Embodiments of the invention are specified in the dependent claims.

[0012] Embodiments include a UWB monitoring system for monitoring a spatial area according to claim 1.

[0013] Some embodiments offer the advantage of ensuring that personal sensor data, insofar as it is captured by the UWB sensors, is either not made available or only made available in such a way that no conclusions can be drawn about the identity of the persons to whom the personal data relates, as a result of anonymization. According to some embodiments, anonymization includes, in particular, modifying personal sensor data in such a way that individual details about personal or factual circumstances can no longer be attributed to a specific or identifiable natural person, or only with a disproportionate expenditure of time, costs, and labor. This modification includes, for example, altering the content of captured personal sensor data, up to and including its deletion.Deletion, in this context, refers to, for example, rendering personal sensor data unreadable, up to and including the complete removal of the corresponding personal sensor data from a storage device used to store collected sensor data. This storage device could be, for example, a local or a central storage device of the UWB surveillance system.

[0014] In some embodiments, the spatial area is, for example, an access-restricted area, such as a restricted-access security area. The restricted-access area is, for example, demarcated from its surroundings and, by design, can only be entered via one or more entrances or exits. For example, the restricted-access area is an indoor area.

[0015] UWB ("Ultra Wideband") refers to the wireless transmission of electromagnetic pulse signals over multiple parallel radio channels with low transmission power, e.g., up to a maximum of 1 mW. This involves, for example, using frequency ranges with a bandwidth of at least 500 MHz and / or at least 20% of the arithmetic mean of the lower and upper cutoff frequencies of the frequency band used.

[0016] UWB is based on generating pulses with the shortest possible pulse duration, which is why the spectrum radiated or received via a UWB antenna is larger or wider the shorter the pulse duration, according to the laws of the Fourier transform.

[0017] The product of the pulse's temporal and spectral width remains constant. The total transmission power of a few milliwatts or less is distributed over such a wide frequency range that no interference is expected for narrowband radio transmission methods. Consequently, it is difficult or impossible to detect that UWB transmission is even taking place. To a narrowband receiver, a UWB signal appears more like noise. This enables communication that is virtually undetectable and can be used in the same frequency range as conventional transmission methods.

[0018] UWB does not use a fixed carrier frequency that is modulated. Instead, data transmission occurs, for example, based on pulse phase modulation or pulse position modulation (PPM) using a multitude of individual pulses. Another option for data transmission using UWB is modulation of the polarity and / or amplitude of the pulses. If the timing of the individual pulses is sufficiently distinct, multiple UWB transmission channels can operate in the same spatial area without mutual interference.

[0019] With increasing bandwidth, transmission capacity also increases, enabling UWB systems to provide usable bit rates up to the gigabit per second range. The range of UWB transmissions can vary from a few meters to hundreds of meters.

[0020] UWB technology also enables the implementation of a radar method using UWB radar sensors. As with UWB data transmission, a wide-bandwidth electromagnetic alternating field with low field strength is generated. Depending on the properties of objects within the propagation range of the electromagnetic alternating field, this will deform the field. The resulting field can be detected by a UWB sensor. Knowing both the initial field and the resulting field allows conclusions to be drawn about the cause of the detected deformation and thus about the type and geometry of the object(s) within the propagation range of the electromagnetic alternating field.

[0021] UWB radar sensors operate, for example, at frequencies between 30 MHz and 12.4 GHz. Depending on the application, resolutions from centimeters down to a few millimeters can be achieved with operating bandwidths of 5 GHz.

[0022] In radar technology, short pulses are emitted and compared with the pulse profiles reflected by the object(s). This allows geometric quantities such as distance, thickness, length, position, shape, movement, and / or speed to be determined. Objects can also be detected through clothing and walls. This method assumes that the properties of the propagation medium for the electromagnetic fields are known.

[0023] UWB can prevent the tracking of mobile devices because devices communicating via UWB, such as UWB tokens, cannot be located without knowledge of the UWB encoding used. Furthermore, the relatively short range of UWB ensures that remote tracking and / or eavesdropping can be effectively prevented. In addition, UWB encoding offers independent, instantaneous encryption of the transmitted data, thus protecting it against interception. Moreover, due to its wide frequency band, UWB exhibits high resistance to interference ("jamming"). Because of these specific technical characteristics, which are advantageous for security applications, a monitoring system can be implemented using UWB that can guarantee a high level of protection for processes as well as the sensor data contained or used within them, and especially for personal sensor data of those involved.In particular, a high level of data transmission security can be ensured using UWB.

[0024] Since UWB technology also allows for higher data rates, it can be particularly advantageous for the transmission of sensor data in the form of video data, audio data and / or other extensive sensor measurements.

[0025] A UWB sensor is understood to be a sensor or anchor configured to transmit acquired data, e.g., sensor data, using UWB. Furthermore, a UWB sensor, such as a UWB radar sensor or a UWB localization sensor, can be configured to acquire sensor data using UWB. Alternatively, a UWB sensor can be configured to acquire sensor data using a UWB-independent method, such as an optical, acoustic, chemical, thermal, electromagnetic, and / or vibration-based method. In some embodiments, the UWB sensors are configured for data transmission exclusively via UWB. In other embodiments, one or more of the UWB sensors can additionally be configured to transmit acquired data via a wired data connection.In some embodiments, some of the UWB sensors of the UWB monitoring system are configured to transmit acquired data via a wired data connection. In other embodiments, all of the UWB sensors of the UWB monitoring system are configured to transmit acquired data via a wired data connection.

[0026] Sensor data refers to data acquired by one of the UWB sensors, such as optical, acoustic, chemical, thermal, electromagnetic, and / or vibration-based data. The sensor data is transmitted by the acquiring UWB sensors within the UWB monitoring system using UWB. Depending on the configuration, one or more of the UWB sensors may also be configured to transmit acquired data via a wired data connection. Furthermore, the sensor data may be data acquired by the UWB sensors using UWB. For example, the sensor data could be from a UWB radar sensor or a UWB localization sensor.

[0027] Personal sensor data refers to sensor data that enables the identification of a person or can be attributed to a person to whom the personal sensor data relates. In particular, personal sensor data includes, for example, individual details about the personal or factual circumstances of a specific or identifiable natural person, captured by one of the UWB sensors. For example, personal sensor data includes visual sensor data, such as video and / or photo data, from which a person can be recognized. This is particularly the case if a person's face can be recognized from the video and / or photo data.

[0028] An anonymization filter is configured to selectively anonymize personal data. For example, the anonymization filter can be configured to anonymize sensor data collected by specific UWB sensors or a specific type of UWB sensor within the UWB surveillance system. This includes, for example, video and / or image data captured using a surveillance camera, in which individual persons are identifiable.

[0029] An exceptional event refers to an anomaly in the recorded sensor data, i.e., a data constellation that is not expected under predefined operating conditions. In particular, the anomaly could be an emergency situation, such as a fire or unauthorized entry into and / or movement within the spatial area.

[0030] A UWB token is a hardware token in the form of a mobile, portable electronic device configured for wireless communication via UWB. A UWB token can also be configured to determine position data by measuring the time of flight and triangulating UWB signals received from the localization sensors of the UWB monitoring system. For example, the UWB token can be designed as a document, particularly a document of value or security. The term "document" refers to paper-based and / or plastic-based documents, such as electronic identification documents, in particular passports, identity cards, visas, driver's licenses, vehicle registration documents, vehicle titles, company ID cards, health insurance cards, or other ID documents, as well as chip cards, means of payment, in particular banknotes, debit cards, and credit cards, bills of lading, or other authorization documents.For example, the memory of such a document contains one or more attributes of a user or object associated with the document.

[0031] In some embodiments, the suspension of anonymization is limited to personal sensor data acquired by UWB sensors that have a predefined relationship to the detected exception event. For example, a predefined relationship exists if the UWB sensors for whose personal sensor data anonymization is suspended are assigned to the same spatial segment as the UWB sensor(s) in whose acquired sensor data the exception event is detected. These embodiments can have the advantage that the suspension of anonymization is limited not only temporally but also spatially. Thus, unnecessary suspension of anonymization, e.g., for personal data unrelated to the exception event, can be avoided.In some embodiments, the predefined reference consists additionally or alternatively of assigning UWB sensors, for whose personal sensor data anonymization is suspended, to predefined spatial sections of the area. These spatial sections are, for example, entrances and exits of an access-restricted area. In the event of a possible unauthorized intrusion into the access-restricted area or in the event of an emergency, such as a fire alarm, it can be advantageous to record who enters and / or leaves the access-restricted area, or who attempts to enter and / or leave it.

[0032] In some embodiments, the anonymization of all personal sensor data captured by the UWB monitoring system is temporarily suspended. These embodiments can have the advantage of ensuring that no personal sensor data relevant and / or necessary for handling and / or resolving the exceptional event is missing due to anonymization.

[0033] According to some embodiments, anonymization by the anonymization filter includes deleting at least part of the personal sensor data. Temporarily suspending anonymization involves storing the personal sensor data that is collected within a limited time window.

[0034] Implementations can have the advantage that, in the event of deletion—i.e., the complete removal of personal sensor data from local and / or central storage of the UWB surveillance system—it can be ensured that no one can gain access to this data. However, if an exceptional event occurs, personal sensor data, such as video and / or image data, is stored only for that specific case and for a limited time. According to these implementations, the stored data is made available for the purpose of data analysis, in particular for the purpose of identifying the individuals to whom the stored personal sensor data relates.

[0035] In some embodiments, the storage is temporary. For example, the stored personal sensor data is deleted after evaluation and / or upon termination of the exceptional situation. In other embodiments, the storage is permanent.

[0036] In some embodiments, the limited time window begins with the detection of the exception event. In other embodiments, the limited time window ends after a predetermined time interval has elapsed or when the detection of the exception event has ceased.

[0037] Some embodiments offer the advantage of limiting the storage of personal sensor data to a time window related to the detected exceptional event. For example, it can be assumed that only personal sensor data captured within this time window is relevant in the context of the detected exceptional event. According to some embodiments, the limited time window ends, for instance, when the exceptional event is no longer detected or detectable. In the case of a potential fire as the exceptional event, the exceptional event could be detected, for example, by a UWB sensor in the monitoring system configured as a smoke detector. If the exceptional event is no longer detected, i.e., no more smoke is detected, the suspension of anonymization is, for example, terminated.In some implementations, at the end of the predetermined time period, a check is performed to determine whether the exceptional event is still detectable and / or whether further conditions are met. If the exceptional event is no longer detectable and, if applicable, the further conditions are met, the suspension of anonymization is terminated. Otherwise, the suspension is repeated or continued for another predetermined time period. Further conditions include, for example, logging confirmation in the UWB monitoring system that the exceptional event has been verified and no further action is necessary, or that all necessary measures have been taken. Alternatively or additionally, the further conditions may include, for example, logging confirmation in the UWB monitoring system that suspending anonymization is not and / or no longer necessary.The predetermined time period can, for example, be a length of seconds and / or minutes.

[0038] In some embodiments, the deletion of personal sensor data is performed by the UWB sensor that is acquiring the personal sensor data to be deleted. In other embodiments, the storage of personal sensor data includes the transmission of the personal sensor data, at least partially and / or completely, by the UWB sensor that is acquiring the personal sensor data to be stored to a storage module of the UWB monitoring system via UWB. In other embodiments, the storage of personal sensor data includes the transmission of the personal sensor data, at least partially and / or completely, by the UWB sensor that is acquiring the personal sensor data to be stored to a storage module of the UWB monitoring system via a wired data connection.

[0039] Some embodiments offer the advantage that direct deletion by the sensing UWB sensor ensures that the personal sensor data to be deleted does not leave the monitoring system beyond the sensing UWB sensor. This effectively prevents unauthorized access to the personal sensor data. Furthermore, some embodiments offer the advantage that the personal sensor data stored in the memory module can be used, if necessary, to handle and / or resolve the incident. For example, the stored personal sensor data can be analyzed to determine which individuals are, or could be, involved in the incident.The storage module can be a local storage module of a plurality of storage modules distributed decentrally via the UWB monitoring system, or a central storage module of the UWB monitoring system.

[0040] According to some embodiments, anonymization by the anonymization filter includes encrypting at least a portion of the personal sensor data. According to other embodiments, temporarily suspending anonymization includes temporarily providing the corresponding personal sensor data in unencrypted form.

[0041] Some implementations offer the advantage that encrypting personal sensor data effectively prevents unauthorized access. Conversely, in the event of an exceptional occurrence, access to previously collected personal sensor data can be enabled through decryption. For example, the personal sensor data could be made available in decrypted form only for a limited time.

[0042] According to some embodiments, the encryption of personal sensor data is carried out by the UWB sensor that captures the personal sensor data to be encrypted.

[0043] Implementations can offer the advantage that the personal sensor data is encrypted directly upon acquisition and processed further in the UWB monitoring system only in encrypted form. Encryption can be performed, for example, using a public cryptographic key from an asymmetric key pair, allowing decryption by the owner of the corresponding secret cryptographic key. This owner could be, for example, a central or decentralized control module of the UWB monitoring system. The secret cryptographic keys are stored, for example, in a protected memory area of ​​a storage module assigned to the corresponding control module.In some embodiments, the control module provides all UWB sensors, or at least all UWB sensors configured to collect personal data, with a single, unified public cryptographic key for encryption. In other embodiments, the control module provides each UWB sensor, or at least all UWB sensors configured to collect personal data, with an individual public cryptographic key assigned to the corresponding UWB sensor for encryption. In other embodiments, the control module provides each group of UWB sensors, or at least the UWB sensors configured to collect personal data, with an individual, unified public cryptographic key assigned to the corresponding group for encryption.The groups can be divided in such a way that they each include UWB sensors that are assigned to the same spatial section of the spatial area, that are the same type of UWB sensor, or that are configured to capture the same type of personal sensor data.

[0044] According to some embodiments, providing personal sensor data in unencrypted form includes suspending the encryption of personal sensor data acquired within a limited time window. These embodiments can have the advantage of avoiding the effort required to decrypt the corresponding personal sensor data, and this personal sensor data also remains unencrypted. Alternatively, providing personal sensor data in unencrypted form includes decrypting encrypted personal sensor data acquired within the limited time window. These embodiments can have the advantage that, even in the event of an exceptional occurrence, the personal sensor data is stored exclusively in encrypted form.Providing personal sensor data in unencrypted form can therefore be effectively limited in time.

[0045] In some embodiments, the limited time window begins a predetermined time interval before the detection of the exceptional event or at the time of detection. In other embodiments, the limited time window ends at the elapse of a predetermined time interval after the detection of the exceptional event or at the end of the detection of the exceptional event.

[0046] Some embodiments offer the advantage that the provision of personal sensor data in unencrypted form is limited to a time window related to the detected exceptional event. For example, it can be assumed that only personal sensor data captured within this time window is relevant in the context of the detected exceptional event. According to some embodiments, the limited time window ends, for instance, when the exceptional event is no longer detected or is no longer detectable. In the case of a potential fire as the exceptional event, the exceptional event could, for example, be detected by a UWB sensor in the monitoring system configured as a smoke detector. If the exceptional event is no longer detected, i.e., no more smoke is detected, the suspension of encryption is, for example, terminated.In some embodiments, at the end of the predetermined time period, a check is performed to determine whether the exceptional event is still detectable and / or whether further conditions are met. If the exceptional event is no longer detectable and, if applicable, the further conditions are met, the encryption suspension is terminated. Otherwise, the suspension is repeated or continued for another predetermined time period. Further conditions include, for example, logging confirmation in the UWB monitoring system that the exceptional event has been verified and no further action is necessary, or that all necessary measures have been taken. Alternatively or additionally, the further conditions may include, for example, logging confirmation in the UWB monitoring system that the encryption suspension is not and / or no longer necessary.The predetermined time period can, for example, be a length of seconds and / or minutes. Starting the limited time window a predetermined time before the detection of the exceptional event can have the advantage that relevant personal sensor data, which was collected prior to the exceptional event, can also be made available in unencrypted form.

[0047] According to some embodiments, the UWB monitoring system is further configured to Receiving a request to release captured sensor data, checking for an authorization certificate included in the request to access the requested sensor data, verifying that the authorization certificate has been successfully checked, and releasing access to the requested sensor data.

[0048] Implementations can offer the advantage that captured sensor data, especially personal sensor data, is only made available to authorized individuals. Release of sensor data, such as location and / or other data, occurs, for example, according to the requester's authorization profile. This allows an effective data protection layer to be integrated into the UWB monitoring system. Proof of authorization can be provided, for example, in the form of an authorization certificate. In some implementations, the request is received and checked by a decentralized or centralized control module of the UWB monitoring system. If the check is successful, the corresponding control module also releases the data. For example, the requested sensor data is sent to the sender of the request or displayed on a display device of the UWB monitoring system.The requested sensor data is transmitted, for example, in encrypted form; in particular, it can be transmitted using end-to-end encryption.

[0049] According to some embodiments, the captured sensor data are divided into categories, and the verification of the authorization includes checking whether the authorization entitles the user to access sensor data of the category to which the requested sensor data is assigned.

[0050] Implementation methods can have the advantage that authorizations can be granted category by category, so that authorization certificates can be restricted to one or more of the categories.

[0051] According to some implementations, the recorded personal sensor data is divided into categories and the suspension of anonymization is carried out selectively, for example depending on the type of detected exceptional event, only for one or more selected categories.

[0052] In some embodiments, the access authorization of the credential is extended for a limited time upon detection of an exception event. Extending the credential means that, with a given credential, more categories may be viewed in the event of an exception event detection than if no exception event is detected. In some embodiments, the scope of the extension depends on the type of exception event detected. In other embodiments, in the event of an exception event detection, the access authorization for all valid credentials is extended for a limited time to all categories of sensor data, granting access to at least one category.

[0053] Some implementations offer the advantage that, for example, depending on the sensitivity of the sensor data, different authorization credentials are required for accessing the corresponding sensor data. This allows control over who is granted access rights to the collected sensor data of the UWB monitoring system and to what extent. Thus, data release can be adapted to the current threat situation, for example, by adjusting the requester's authorization profile.

[0054] In some implementations, each captured sensor data entry is assigned an origin ID. A prerequisite for successful authorization verification is valid confirmation of the authorization to access the requested sensor data by one or more instances assigned to the origin IDs of the requested sensor data.

[0055] Some embodiments offer the advantage that access to the acquired sensor data requires authorization from one or more instances associated with the origin IDs, i.e., the source of the requested sensor data. According to these embodiments, the origin IDs identify the UWB sensor that acquired the corresponding sensor data and / or the UWB token that was sensed by the corresponding sensor data. In these embodiments, the corresponding instances are the respective UWB sensors, UWB tokens, or users / administrators assigned to the respective UWB sensors or UWB tokens.

[0056] For example, each localized position, i.e., each sensor data point captured for locating a UWB token, is imprinted with secure information from the UWB token, ensuring that the origin and owner of the corresponding sensor data are always known. In this case, requests regarding the position or data of a UWB token must always be authorized first by the UWB token in question or by its holder and / or representative.

[0057] According to some embodiments, when the requested sensor data is released, the type, time, location, recipient and / or use of the released sensor data are logged.

[0058] Some implementations offer the advantage that the corresponding protocols allow for precise tracking of what happens to the recorded sensor data, particularly who has access to it. According to some implementations, this logging takes place in a blockchain. A blockchain can offer the advantage of providing a tamper-proof storage structure for the data to be logged.

[0059] In some embodiments, the UWB monitoring system comprises one or more pre-trained machine learning modules, each trained to detect exceptional events based on anomalies in the acquired sensor data. These embodiments can offer the advantage of enabling automated detection of exceptional events.

[0060] According to various embodiments, the majority of UWB sensors comprise a plurality of localization sensors configured to determine the position of UWB tokens within the spatial area. Position determination is performed using time-of-flight measurements of UWB signals between UWB tokens and / or localization sensors.

[0061] Implementations can offer the advantage that, using UWB tokens, it is possible to effectively monitor the location of authorized individuals within a defined area. For example, each person entering the area, such as a restricted-access zone, receives a corresponding UWB token. If data linking a token ID to a specific person is not stored or is stored cryptographically, e.g., in encrypted form, monitoring the UWB tokens enables anonymized monitoring of the token holders. For instance, a necessary prerequisite for decrypting the data used for identification is the detection of an exceptional event.

[0062] UWB tokens can be located, for example, using triangulation with at least two or three localization sensors in the form of UWB antennas. The triangulation signals can be transmitted by the UWB token and / or the UWB antennas. The triangulation signals can be evaluated by the UWB token and / or the UWB antennas and / or an evaluation module of the monitoring system.

[0063] In some embodiments, the UWB monitoring system transmits an activation code. The UWB tokens are activated upon entering the transmission range of the UWB monitoring system and upon receiving the activation code, and deactivated upon leaving the transmission range of the UWB monitoring system and upon not receiving the activation code.

[0064] Design features can have the advantage that the UWB token only actively transmits signals using UWB within the spatial area or transmission range of the UWB monitoring system and is therefore detectable at all.

[0065] In some embodiments, activating the UWB tokens comprises enabling the transmission of UWB signals by the respective UWB token, in particular enabling the transmission of UWB signals to the monitoring system. Activation makes the corresponding UWB token visible to the monitoring system. In other embodiments, deactivating the UWB tokens comprises disabling the transmission of UWB signals by the respective UWB token, in particular disabling the transmission of UWB signals to the monitoring system. Disabling makes the corresponding UWB token invisible to the monitoring system.

[0066] According to certain embodiments, access rights to and / or residence rights in a spatial area, which is an access-restricted spatial area, are verified using UWB tokens.

[0067] Implementations can offer the advantage that UWB tokens can not only track the movements of users within a restricted area, but also verify whether access authorization and / or authorization to be present in the restricted area and / or specific sections thereof exists. Based on this, it can be determined whether a user with a UWB token is legitimately present in the restricted area and / or a section thereof. For example, access barriers, such as doors to the restricted area and / or a section thereof, can open automatically when a user with a valid UWB token approaches the barrier.Depending on the design, different access authorizations may be necessary for different spatial sections of the restricted area.

[0068] In some implementations, access and / or residence rights are proven by possession of the UWB token. In others, access and / or residence rights are proven by authorization certificates. An authorization certificate is a digital certificate that assigns access and / or residence rights to a UWB token and / or a user of the corresponding UWB token. For example, an authorization certificate defines access and / or residence rights, includes a public cryptographic key of an asymmetric cryptographic key pair associated with the UWB token, a token ID, information about the issuer of the authorization certificate, and / or a digital signature of the issuer.The issuer can be, for example, an external entity, a decentralized or centralized control module of the UWB monitoring system, or another UWB token that itself possesses the granted access and / or residence rights. Access and / or residence rights can be verified, for example, using the authorization certificate in conjunction with a signature of the UWB token, using a private cryptographic key from the asymmetric cryptographic key pair associated with the UWB token. The signature can be verified using the public cryptographic key provided by the authorization certificate, thus confirming the UWB token's possession of the private cryptographic key.The authorization certificate defines, for example, the access rights and / or permissions granted by the issuer of the authorization certificate to the owner of the private cryptographic key. Depending on the specific implementation, these access rights and / or permissions may be time-limited. For example, a time limit may be defined by an expiration date and / or time period specified in the authorization certificate.

[0069] According to embodiments, detecting the exceptional event includes identifying a number of persons in the spatial area, such as an access-restricted spatial area, using the UWB sensors, which differs at least locally from the number of authorized persons identified in the spatial area using the UWB tokens.

[0070] Embodiments can have the advantage that attempts to gain access to the restricted area or sections thereof without authorization and / or attempts to evade motion monitoring by the UWB monitoring system within the restricted area can be effectively detected.

[0071] In some embodiments, each UWB token is assigned to a specific user. Each UWB token stores, for example, one or more reference values ​​for personal sensor data used to authenticate the assigned user—that is, authentication data. Proving access and / or entry authorization using one of the UWB tokens includes, for example, the UWB token confirming the authentication of the user assigned to that token. Authentication by the UWB token includes, for example, the local validation of authentication data by the UWB token using the one or more reference values ​​stored within it.

[0072] In some embodiments, the UWB tokens include, for example, a sensor for capturing authentication data. In other embodiments, the user's authentication data is captured by a sensor on each UWB token. In other embodiments, the authentication data is captured by a local sensor of the UWB monitoring system and sent to the UWB token for validation. In other embodiments, the captured authentication data is transmitted in encrypted form. In other embodiments, the reference values ​​are stored in encrypted form, and the local validation of the captured authentication data is performed in encrypted form.

[0073] According to some embodiments, the authentication data includes the user's biometric data, which is captured using a biometric sensor. Biometric data can include, for example: DNA data, fingerprint data, body geometry / anthropometry data such as facial, hand, and ear geometry data, palmar ridge structure data, vein structure data such as hand vein structure data, iris data, retinal data, voice recognition data, nail bed patterns, and dental pattern data.

[0074] In some implementations, the authentication data includes user behavioral data. Behavioral data is data based on the user's intrinsic behavior and can include, for example, movement patterns, gait patterns, arm, hand, and finger movement patterns, and lip movement patterns. Using behavioral data to authenticate the user can have the advantage that the user can continue their usual, characteristic behavior for authentication purposes without requiring any atypical additional actions. In particular, the user does not have to interrupt their usual behavior.

[0075] To capture behavioral data, a sensor is used to capture behavioral data. This behavioral data includes, for example, motion data, which is captured using an authentication sensor configured as a motion sensor. The motion sensor may, for example, include an accelerometer. Motion can be calculated, for example, by integrating acceleration measurements captured by the accelerometer. The motion sensor can also detect its position in space and / or changes in position. For example, the motion sensor may include a gyroscope. The motion data captured by the motion sensor includes, for example, acceleration, tilt, and / or position data.

[0076] Captured motion data includes, for example, data on the movements of the UWB token caused by the user carrying the token, such as wearing it on their body. The user's characteristic movements cause the UWB token to move in a manner characteristic of that user. This occurs even if the user does not actively interact with the UWB token, for example, by not using any of its user interfaces, such as a button, keyboard, touchscreen, or microphone.

[0077] According to embodiments, the UWB token comprises a classification module configured to recognize one or more generic movement patterns using motion data. These movement patterns can be, for example, gross and / or fine motor movements of the UWB token, as characteristic of an individual user's use of the UWB token, such as carrying and / or wearing it on their body. For example, the classification module is pre-trained to recognize the generic movement patterns using training datasets containing motion data from a user cohort.

[0078] According to some embodiments, the user is registered as a user of the UWB token during a learning phase. According to these embodiments, the learning phase includes capturing the user's movement data using an authentication sensor in the form of a motion sensor on the UWB token and extracting one or more reference values ​​characteristic of the user to be registered.

[0079] According to some implementations, behavior-based authentication of a user using the UWB token comprises the following steps: Capture of movement data by an authentication sensor in the form of a motion sensor of the UWB token, input of the captured movement data into the classification module, generation of a classification result by the classification module as to whether the current user is a user registered in the UWB token, generation of an authentication signal if the classification result meets a test criterion, whereby the authentication signal signals a successful authentication of the current user.

[0080] The verification criterion may, for example, include a sufficiently high degree of correlation between the recorded movement data and one or more reference values ​​stored for the registered user. Furthermore, the verification criterion may include ensuring that the recorded movement data and / or the one or more reference values ​​used do not exceed a maximum age.

[0081] According to embodiments, the aforementioned steps of capturing the motion data, entering the motion data, and generating the classification result are repeatedly performed sequentially. Furthermore, in addition to the step of generating the classification result, the following step is also performed each time: Storing the classification result in the memory of the UWB token.

[0082] Generating an authentication signal includes, for example: In response to an authentication request, accessing the UWB token's memory to read the stored classification result, for example, the last stored classification result, and reading and evaluating the classification result according to the test criterion.

[0083] According to some implementations, captured movement data can be used to adjust and / or improve the reference values ​​stored for the respective user in the event of successful user authentication.

[0084] In some implementations, authentication is knowledge-based. For example, the authentication data includes the user's personal password. This password could, for instance, be an alphanumeric string.

[0085] In some embodiments, authentication is possession-based. In these embodiments, the authentication data includes signed data from one or more other electronic devices associated with the user, particularly mobile portable electronic devices. These electronic devices include, for example, smart devices carried by the user, such as smartphones, smartwatches, smartglasses, phablets, tablets, smartbands, smart keychains, smartcards, etc. These electronic devices transmit a range-limited signal indicating their presence. For example, the signal includes an ID of the corresponding electronic device. For example, the signal is signed with a cryptographic signature key of the corresponding electronic device. The signal could be, for example, a Bluetooth or UWB signal.When using a UWB signal, the majority of electronic devices are represented by multiple UWB tokens. Successful user authentication may require the user to carry a certain number of their assigned electronic devices. While an electronic device might be stolen, the higher the number of devices required for successful authentication, the lower the probability that they will be carried by someone other than the registered user, for example, as a result of theft.

[0086] If one or more UWB sensors, such as impact sound sensors, motion detectors, light barriers, or gas detectors, detect the presence of a person in a section of the spatial area where no UWB token is detected, this indicates an attempted unauthorized entry. Similarly, differences in the movement patterns of UWB tokens and detected persons can point to unauthorized activity, for example, if a UWB token remains stationary while the sensor data detects human movement.

[0087] According to some embodiments, an exceptional event includes, for example, the detection of a number of persons that exceeds the number of detected authorized persons or the number of detected ID tokens, at least locally.

[0088] According to embodiments, detecting the exceptional event includes capturing a UWB token in a spatial section of the spatial area, such as an access-restricted spatial area, for which the corresponding UWB token does not have access authorization.

[0089] According to some embodiments, detecting the exceptional event includes capturing non-personal sensor data that exceeds a predefined threshold.

[0090] These designs can offer the advantage of effectively detecting emergency situations, such as a fire using a UWB sensor configured as a smoke detector or a break-in using a UWB sensor configured as a glass breakage sensor. For example, increased movement and a simultaneous temperature rise can initially be interpreted as an unclear exceptional event, potentially leading to a dangerous situation.

[0091] According to embodiments, the majority of UWB sensors include sensors for capturing optical, acoustic, chemical, thermal, electromagnetic and / or vibration-based sensor data.

[0092] These designs offer the advantage that, using appropriate sensors, a wide variety of sensor data can be acquired, thus enabling the detection of numerous different situations and conditions within the spatial area. Examples of UWB sensors include one or more UWB radar sensors, glass break sensors, impact sound sensors, gas sensors, motion detectors, video sensors, infrared sensors, temperature sensors, and / or smoke detectors.

[0093] Position data from UWB tokens are acquired, for example, using localization sensors. Sensor data indicative of a person's presence can be acquired using methods such as UWB radar, radio frequency radiation, microwave radiation, Doppler radar, lasers, ultrasound, infrasound, infrared radiation, vibration measurements, or gas concentration measurements. If a person is within a sensor's detection range, they may reflect, scatter, or disrupt radiation or waves emitted by the sensor, such as UWB radar, radio frequency radiation, microwave radiation, Doppler radar, laser beams, or ultrasound, or generate measurable radiation, waves, or other influences, such as infrared radiation, vibrations (e.g., impact noise), infrasound, or gas concentration changes (e.g., an increase in carbon dioxide concentration).

[0094] According to embodiments, the UWB monitoring system comprises a digital radio network with a mesh topology, which is configured to transmit the acquired sensor data using UWB.

[0095] Implementation methods can offer the advantage of efficiently transmitting acquired sensor data via the UWB monitoring system. Furthermore, a mesh topology provides high reliability, as data transmission via alternative routes remains possible even if individual components of the mesh topology fail. Additionally, if a portion of the mesh topology fails, operation can be maintained using the remaining portion.

[0096] According to certain embodiments, the advantage can be that in a UWB-based wireless network with a mesh topology, position data for multiple and / or all network nodes, i.e., UWB sensors and / or UWB tokens, can be disseminated or determined. Position data can be determined, for example, using a triangulation method based on time-of-flight measurements of UWB signals. The position data can be relative and / or absolute. To determine absolute position data, at least one or more stationary reference points must be known.Implementations can have the advantage that a position-based routing method can be used for targeted forwarding of data in the UWB-based wireless network with mesh topology, in order to determine a shortest or otherwise best path between a source node and a destination node within the wireless network using the position data determined by UWB.

[0097] In some embodiments, one or more of the UWB sensors are configured as UWB transceivers for forwarding UWB transmission signals. In other embodiments, the UWB monitoring system includes, in addition to the UWB sensors, one or more UWB transceivers configured for forwarding the UWB transmission signals.

[0098] Implementation designs can have the advantage that forwarding data via UWB can be effectively implemented using the UWB sensors and / or additional UWB transceivers.

[0099] Embodiments further include a method for controlling a UWB monitoring system for monitoring a spatial area according to claim 12.

[0100] According to embodiments, the method for controlling the UWB monitoring system is configured to control each of the previously described embodiments of the UWB monitoring system.

[0101] Embodiments of the invention will now be explained in more detail with reference to the drawings. These show: Figure 1 is a schematic diagram of an exemplary UWB monitoring system, Figure 2 is a schematic diagram of an exemplary UWB sensor, Figure 3 is a schematic diagram of an exemplary UWB token, Figure 4 is a flowchart of an exemplary procedure for controlling a UWB monitoring system, and Figure 5 is a flowchart of an exemplary procedure for controlling a UWB monitoring system.

[0102] Elements of the following embodiments that correspond to each other are marked with the same reference numerals.

[0103] Figure 1Figure 100 shows an exemplary UWB monitoring system for monitoring a spatial area 102, such as an access-restricted area. If the spatial area 102 is an access-restricted area, it is, for example, demarcated from its surroundings and, by design, can only be accessed via one or more entrances or exits 104. For example, the spatial area could be an indoor area within a building. Alternatively or additionally, the spatial area could also include an outdoor area outside a building. For example, this outdoor area could be an access-restricted area that is enclosed. An enclosure could, for example, include a fence, a wall, and / or a hedge.An access-restricted spatial area 102 can, for example, be subdivided into a plurality of spatial sections 106, each of which can only be accessed via one or more entrances or exits 108.

[0104] The UWB monitoring system 100 comprises a plurality of UWB sensors 110 distributed over a spatial area 102. The UWB sensors 110 are configured to acquire sensor data such as position data, motion data, image data, sound data, vibration data, temperature data, structural data, gas concentration data, particle concentration data, etc. Furthermore, the UWB sensors 110 are configured to transmit the acquired sensor data via UWB, i.e., via a UWB network provided by the UWB monitoring system 100. The UWB sensors 110 can be configured as UWB transceivers for forwarding UWB transmission signals within the monitoring system 100. In addition to the UWB sensors 110, the UWB monitoring system 100 can also include one or more UWB transceivers 111, which are configured to forward the UWB transmission signals.The UWB network implemented by the monitoring system 100 is, for example, a digital wireless network with a mesh topology, configured to transmit the acquired sensor data using UWB. For example, sensor data is transmitted within the UWB-based wireless network with a mesh topology using a position-based routing method. According to embodiments, data transmission from the UWB sensors 110 occurs exclusively via UWB. According to embodiments, one or more of the UWB sensors 110 are additionally configured for at least partial and / or fully wired transmission of the acquired sensor data. According to embodiments, all UWB sensors 110 are additionally configured for at least partial and / or fully wired transmission of the acquired sensor data.For example, UWB radar functionality can also be integrated and / or implemented for the detection of persons who do not carry a UWB token.

[0105] The UWB sensors 110 include, for example, anonymization filters configured to filter the collected sensor data. During this filtering process, personally identifiable sensor data is anonymized. Personally identifiable sensor data includes, for example, image data that can identify individuals. The filtered sensor data is transmitted, for example, via the UWB network to a control module 116. The control module 116 can be a central or a decentralized control module. The control module 116 is configured, for example, to evaluate the sensor data collected by the UWB sensors 110 to detect exceptional events, such as a hazardous situation or unauthorized access to the spatial area 102. Upon detection of an exceptional event, the anonymization of the personally identifiable sensor data is temporarily suspended.

[0106] The control module 116 is also configured to receive requests for acquired sensor data, to verify authorization credentials for accessing the corresponding sensor data, and, if the verification is successful, to grant access to the requested sensor data. In the event of a detected exception, access is also granted to personal sensor data whose anonymization is temporarily suspended. The authorization credentials can be based, for example, on authorization certificates and / or authorization profiles of the requesters, which define the requesters' access permissions. For example, all access permissions associated with a user and / or UWB token are stored in an authorization profile. Depending on the implementation, the scope of the granted access permission can depend, for example, on whether an exception situation is detected.

[0107] The monitoring system 100 can also be configured to locate UWB tokens 112 within the spatial area 102 using UWB sensors. For this purpose, UBW localization signals 107 are used, which are sent from the UWB antennas 110 to the corresponding UWB tokens 112 and vice versa. Based on the time-of-flight differences of the transmitted signals, the relative positions of the UBW tokens 112 to the fixed UWB antennas 110, and thus the positions of the UBW tokens 112 within the spatial area 102, can be precisely determined, for example, by triangulation. Since the transmitted UBW localization signals 107 are hardly distinguishable from background noise without knowledge of the UWB encoding used and are therefore effectively obfuscated, attempts to locate the UWB tokens 112 during unauthorized spying attempts can be effectively prevented.This is further supported by the relatively short range of UWB signals, which effectively counter remote eavesdropping attempts. For example, UWB token 112 identifies users or carriers with access authorization to spatial area 102, if this is a restricted area. Furthermore, UWB token 112 can define carrier-specific access authorizations if different authorizations are required for individual sections of spatial area 102. Thus, UWB token 112 can be used to determine the location of authorized individuals. If individuals are detected to whom no UWB token 112 can be assigned, this indicates an attempted unauthorized intrusion, which is then detected as an exceptional event.

[0108] Figure 2Figure 1 shows an exemplary UBW sensor 110. This UBW sensor 110 comprises a processor 120, which executes program instructions stored, for example, in a memory 124 of the UBW sensor 110, and controls the UBW sensor 110 according to these instructions. The UBW sensor 110 also includes a sensor element 122, which is configured, for example, to acquire optical, acoustic, chemical, thermal, electromagnetic, and / or vibration-based sensor data. Depending on the sensor element 122 used, the acquired sensor data may include, for example, personal data. If the UBW sensor 110 is configured to acquire personal data, it also includes an anonymization filter for anonymizing the personal data; otherwise, it does not. Anonymization may, for example, involve deleting the acquired personal data from memory 124.Furthermore, anonymization can, for example, include encrypting the collected personal sensor data. Finally, the UWB sensor 110 includes a UWB antenna 126 for sending and receiving data via UWB. According to embodiments, the UWB sensor 110 can, for example, additionally include a communication interface for wired data transmission.

[0109] Figure 3Figure 1 shows an exemplary UBW token 112, which comprises a processor 130, a memory 132, and a UWB antenna 134. The processor 130 is configured to control the UBW token 112 by executing program instructions stored, for example, in the memory 132. A token ID can also be stored in the memory 132. The UBW token 112 is configured to send and receive UWB signals via the UWB antenna 134. For example, the UBW token 112 sends UWB signals that include a timestamp and / or the token ID. Using these UWB signals of the UBW token 112 or UWB signals from UWB antennas or UWB sensors 110 of the UWB monitoring system 100, the UBW token 112 can be located and / or identified by the UWB monitoring system 100.

[0110] Figure 4This section illustrates an exemplary procedure for controlling a UWB surveillance system. In Block 200, sensor data is collected within a defined area by UWB sensors of the surveillance system. The collected sensor data may include personal data. In Block 202, the collected sensor data is filtered using anonymization filters of the UWB sensors. This anonymizes personal data. Such anonymization includes, for example, deleting or encrypting the sensor data to be anonymized. In Block 204, the collected and filtered sensor data is evaluated to detect an exceptional event. This is done, for example, by a central or decentralized control module of the UWB surveillance system. In Block 206, upon detection of an exceptional event, the control module initiates a temporary suspension of the anonymization of personal data.

[0111] Figure 5 This section illustrates an exemplary procedure for controlling a UWB monitoring system. In block 300, the UWB monitoring system, for example, a control module of the UWB monitoring system, receives a request to release acquired sensor data. In block 302, the control module, for example, checks for an authorization credential included in the request to access the requested sensor data. The authorization credential could be, for example, an authorization certificate or an identifier from a stored authorization profile of the requesting party. In block 304, if the authorization credential is successfully checked, access to the requested sensor data is granted. For example, the requested sensor data is sent to the requesting party or displayed on a local display device of the monitoring system. Reference symbol list

[0112] 100 UWB monitoring system 102 Spatial area 104 Access / Exit 106 Spatial section 108 Access / Exit 107 UWB localization signal 110 UWB sensor 111 UWB transceiver 112 UWB token 114 UWB transmission channel 116 Control module 120 Processor 122 Sensor element 123 Filter 124 Memory 126 UWB antenna 130 Processor 132 Memory 134 UWB antenna

Claims

1. A UWB surveillance system for monitoring a spatial area (102), wherein the UWB surveillance system (100) comprises a plurality of UWB sensors (110) arranged distributed throughout the spatial area, wherein the UWB sensors are configured to detect sensor data and to transmit the detected sensor data using UWB, wherein the UWB surveillance system is configured to • detect sensor data in the spatial area using the UWB sensors, wherein the detected sensor data comprise personal sensor data that enable a person to be identified or that can be assigned to a person to whom said personal sensor data relate, • filter the detected sensor data using an anonymisation filter (123), wherein the anonymisation filter is configured to anonymise the personal sensor data, • evaluate the detected sensor data to detect an exceptional event, wherein the exceptional event denotes an anomaly in the detected sensor data, • upon detection of the exceptional event, temporarily suspending the anonymisation of the personal sensor data, wherein the anonymisation by the anonymisation filter comprises an encryption of at least some of the personal sensor data, wherein the temporary suspension of the anonymisation comprises temporarily providing the corresponding personal sensor data in unencrypted form, wherein the non-anonymised personal sensor data are provided for the purpose of data analysis.

2. The UWB surveillance system according to claim 1, wherein the encryption of the personal sensor data is performed by the UWB sensor detecting the personal sensor data to be encrypted.

3. The UWB surveillance system according to any one of claims 1 to 2, wherein the provision of the personal sensor data in unencrypted form comprises suspending the encryption of the personal sensor data which are detected within a limited time window, or wherein the provision of the personal sensor data in unencrypted form comprises decrypting encrypted personal sensor data which are detected within the limited time window, wherein the limited time window for example begins a predetermined period of time before the detection of the exceptional event or upon the detection of the exceptional event and ends upon the expiration of a predetermined period of time after the detection of the exceptional event or upon the termination of the detection of the exceptional event.

4. The UWB surveillance system according to any one of the preceding claims, wherein the UWB surveillance system is further configured to • receive a request to release detected sensor data, • verify a credential included in the request for access to the requested sensor data, • upon successful verification of the credential, release access to the requested sensor data.

5. The UWB surveillance system according to claim 4, wherein the detected sensor data are divided into categories and the verification of the credential includes verifying whether the credential authorises access to sensor data of the category to which the requested sensor data are assigned, and / or wherein the access authorisation of the credential is extended for a limited time upon detection of the exceptional event, and / or wherein the detected sensor data are each assigned origin IDs, wherein a prerequisite for the successful verification of the credential comprises a valid confirmation of the credential for access to the requested sensor data by one or more instances assigned to the origin IDs of the requested sensor data, and / or wherein, in the event of the requested sensor data being released, the type, time, location, recipient and / or use of the released sensor data are logged.

6. The UWB surveillance system according to any one of the preceding claims, wherein the UWB surveillance system comprises one or more pre-trained machine learning modules, each of which is trained to detect exceptional events based on anomalies in the detected sensor data.

7. The UWB surveillance system according to any one of the preceding claims, wherein the plurality of UWB sensors comprises a plurality of localisation sensors which are configured to determine the position of UWB tokens (112) within the spatial area, wherein the position determination is performed using runtime measurements of UWB signals between UWB tokens and localisation sensors.

8. The UWB surveillance system according to claim 7, wherein the UWB surveillance system transmits an activation code, wherein the UWB tokens are each activated upon entry into a transmission range of the UWB surveillance system upon receipt of the activation code and are deactivated upon leaving the transmission range of the UWB surveillance system upon failure to receive the activation code.

9. The UWB surveillance system according to any one of claims 7 to 8, wherein access authorisations to and / or residence authorisations in the spatial area are verified using the UWB tokens.

10. The UWB surveillance system according to claim 9, wherein detecting the exceptional event comprises detecting a number of persons in the spatial area using the UWB sensors, which at least locally deviates from the number of persons with access authorisation detected in the spatial area using the UWB tokens, and / or wherein each of the UWB tokens is assigned to a respective user, wherein one or more reference values for personal sensor data for authenticating the assigned user are stored in each of the UWB tokens, wherein the verification of access authorisation and / or residence authorisation using one of the UWB tokens comprises confirming authentication of the user assigned to the corresponding UWB token by the UWB token, wherein authentication by the UWB token comprises local validation of personal sensor data by the UWB token using the one or more reference values stored in the UWB token.

11. The UWB surveillance system according to any one of the preceding claims, wherein detecting the exceptional event comprises detecting non-personal sensor data that exceed a predefined threshold value, and / or wherein the plurality of UWB sensors comprises sensors for detecting optical, acoustic, chemical, thermal, electromagnetic and / or vibration-based sensor data, and / or wherein the UWB surveillance system comprises a digital radio network with a mesh topology, which is configured to transmit the detected sensor data using UWB, wherein one or more of the UWB sensors are configured as UWB transceivers for forwarding UWB transmission signals, and / or wherein the UWB surveillance system comprises, in addition to the UWB sensors, one or more UWB transceivers (111), which are configured to forward the UWB transmission signals.

12. A method for controlling a UWB surveillance system (100) for monitoring a spatial area (102), wherein the UWB surveillance system comprises a plurality of UWB sensors (110) arranged distributed throughout the spatial area, wherein the UWB sensors are configured to detect sensor data and to transmit the detected sensor data using UWB, wherein the method comprises: • detecting sensor data in the spatial area using the UWB sensors, wherein the detected sensor data comprise personal sensor data that enable a person to be identified or that can be assigned to a person to whom said personal sensor data relate, • filtering the detected sensor data using an anonymisation filter (123), wherein the anonymisation filter is configured to anonymise the personal sensor data, • evaluating the detected sensor data to detect an exceptional event, wherein the exceptional event denotes an anomaly in the detected sensor data, • upon detection of the exceptional event, temporarily suspending the anonymisation of the personal sensor data, wherein the anonymisation by the anonymisation filter comprises an encryption of at least some of the personal sensor data, wherein the temporary suspension of the anonymisation comprises temporarily providing the corresponding personal sensor data in unencrypted form, wherein the non-anonymised personal sensor data are provided for the purpose of data analysis.