Method for anonymising movement data of a vehicle, and vehicle

Abstract

The invention relates to a method for anonymising movement data of a vehicle (1), wherein the vehicle (1) transmits the movement data to a central computing unit (4) for analysis, and wherein, prior to the analysis of the movement data by the central computing unit (4), artificial blurring is applied to at least one location and / or time in the movement data. The method according to the invention is characterised by the following method steps: determining the starting location and the departure time; completing the journey; determining the destination and the arrival time; comparing the movement data (1) of the vehicle with fleet data; and applying a temporal and / or spatial blur interval to the movement data at the starting location and destination depending on the vehicle density determined from the fleet data at the starting location and destination within a departure time interval and an arrival time interval.

Description

[0001] Procedure for anonymizing movement data of a vehicle and vehicle

[0002] The invention relates to a method for anonymizing movement data of a vehicle according to the type defined in more detail in the preamble of claim 1 and to a vehicle for carrying out the method.

[0003] Big data is becoming increasingly important. Metadata can be processed in a variety of ways, and the resulting conclusions can be used to their advantage. Generating and analyzing metadata is relevant not only for internet companies, but also for vehicle manufacturers. This allows vehicle manufacturers to gain insights from their vehicles' usage behavior that can be used to further develop the vehicles. However, user privacy and data protection must be respected. Movement data collected from a vehicle—the locations visited by a vehicle and the routes taken during each journey—constitutes particularly sensitive personal data and therefore requires special protection.

[0004] When transmitting so-called origin-destination profiles, a vehicle typically transmits the starting location and destination of a journey, as well as the vehicle's vehicle identification number. To anonymize such profiles, simply deleting the vehicle identification number is not sufficient, as the origin-destination profiles still carry a high risk of re-identification.

[0005] A method for anonymizing movement data is also known from DE 10 2021 006 526 B4. This document describes how vehicles in a fleet collect movement data in the form of individual time- and position-related data sets while driving. The corresponding data sets are exchanged among several vehicles and thus merged. The data sets are then transmitted to a central computing device for analysis. Before transmission to the central computing device, the position data and time data are noise-generated. This means that a small amount is subtracted from or added to the respective actual value, for example, plus 5 minutes or 123 meters to the north. The type and intensity of the noise is determined in coordination between the vehicles involved in the data exchange.The exchange of movement data between vehicles and the imposition of noise on the respective data sets makes it difficult for the central computing device to determine which navigation routes were taken by which vehicle. However, the disadvantage is that anonymizing the movement data requires the exchange of data sets between vehicles. This requires that the respective vehicles be within communication range of each other. If no corresponding vehicle is found, movement data cannot be exchanged and thus anonymized.

[0006] DE 102015213 393 A1 describes a method for anonymizing vehicle movement data by adding additional, artificially generated route sections to the original route data in order to conceal the actual movement data. The additional route data can be generated and added in a central unit to which the original movement data was previously transmitted.

[0007] DE 102016225287 A1 discloses a method for temporally and spatially concealing data received from a vehicle in a central receiving system with the aim of achieving group anonymity for several vehicles before the data is passed on for further processing.

[0008] The present invention is based on the object of providing an improved method for anonymizing movement data of a vehicle, with the aid of which it is possible to anonymize movement data in a larger number of situations.

[0009] According to the invention, this object is achieved by a method for anonymizing

[0010] Movement data of a vehicle is solved with the features of claim 1. Advantageous embodiments and further developments as well as a vehicle for carrying out the method arise from the dependent claims.

[0011] A generic method for anonymizing movement data of a vehicle which completes a journey from a starting point to a destination, wherein the vehicle generates a movement data point at least at the starting point and at the destination and includes it in the movement data, wherein each movement data point describes the current location of the vehicle at the current time, wherein the vehicle transmits the movement data to a central computing device for analysis, and wherein an artificial blur is imposed on at least one location and / or time in the movement data prior to the analysis of the movement data by the central computing device, is further developed according to the invention by the following method steps:

[0012] A) Determining, by the vehicle, the location and the start time at the start location;

[0013] B) Completion of the journey by the vehicle;

[0014] C) Determining, by the vehicle, the location and the time of arrival at the destination;

[0015] D) Reading out fleet data managed by the central computing device, wherein the fleet data comprises, in anonymised form, the movement data of a plurality of fleet vehicles, and comparing the movement data of the vehicle with the fleet data, wherein:

[0016] E) within a temporal determination interval around the starting time and a spatial determination interval around the starting location, it is checked how many fleet vehicles have started a journey within the determination interval, whereby, if the number of fleet vehicles is greater than a critical number of vehicles, a temporal and / or spatial uncertainty interval is imposed on the movement data point at the starting location and otherwise the method is terminated; and

[0017] F) within a temporal determination interval around the end time and a spatial determination interval around the destination, it is checked how many fleet vehicles have completed a journey within the determination interval. If the number of fleet vehicles is smaller than a critical number of vehicles, a temporal and spatial uncertainty interval is imposed on the movement data point at the destination; otherwise, a temporal uncertainty interval is imposed on the movement data point at the destination. The method according to the invention allows for the reliable and efficient anonymization of movement data. It is not necessary for data records to be exchanged between two vehicles. Thus, it is a relatively random event when two vehicles pass each other to anonymize their movement data.By selecting a sufficiently large temporal determination interval around the starting time and a spatial determination interval around the starting location, situations can be encountered more frequently that generally allow the generation of anonymized movement data records.

[0018] There are two alternative embodiments of how process steps D) to F) can be carried out.

[0019] According to a first, preferred embodiment of the method according to the invention, the vehicle obtains the fleet data from the central computing device in step D), then carries out steps E) and F) itself, and in a step G) transmits anonymized movement data to the central computing device for analysis using artificial blurring. Although this requires a data exchange between the central computing device and the vehicle in order to transmit the fleet data to the vehicle, it is not necessary to transmit non-anonymized movement data to the central computing device. This allows data protection to be maintained even more effectively, since, for example, if the central computing device is compromised by an attacker, non-anonymized data records cannot be accessed.

[0020] An alternative embodiment of the method according to the invention, however, provides that the vehicle transmits non-anonymized movement data to the central computing device prior to step D), the central computing device carries out steps D) to F), deletes the non-anonymized movement data in a step G), and then analyzes the movement data anonymized by steps D) to F). The advantage here is that no data exchange between the vehicle and the central computing device is required to introduce the fleet data into the vehicle. Thus, less data exchange is required to carry out the method according to the invention. As already mentioned, however, temporarily anonymized movement data is made accessible to the central computing device, which generally increases the risk that data protection could be undermined.

[0021] The sequence of process steps indicated by the letters A) to G) does not necessarily have to be followed exactly. This means that subtasks can also be carried out earlier or later. For example, the vehicle can carry out process step D) and process step E) while still traveling from the starting point to the destination. To do this, the vehicle can, for example, access the central computing device, obtain current fleet data for the current time and check whether or not the critical number of vehicles is exceeded for the respective temporal and spatial determination interval at the starting point. Analogously, the vehicle could transmit corresponding non-anonymized movement data to the central computing device while still performing the journey, whereupon the central computing device reads out current fleet data and carries out process step E) before the vehicle has reached the destination.

[0022] The vehicle can have different positioning means to determine a current location. Particularly preferably, a respective vehicle uses an in-vehicle navigation system or a mobile navigation system coupled to the vehicle, for example, implemented on a mobile device such as a smartphone. The vehicle is thus capable of determining a geoposition taking into account a position signal provided by a global navigation satellite system. By comparing the geoposition with a digital road map, the relatively precise location of the vehicle can then be determined. The vehicle's location can also be determined by camera-based recognition of characteristic environmental features or by triangulation, for example, by analyzing the mobile phone signal strength of at least three mobile phone network base stations within range.

[0023] To communicate with the central computing device, the vehicle can have dedicated communication means such as a telecommunications unit, also known as a telematics unit. Such a telecommunications unit enables the exchange of data wirelessly, for example via mobile communications and / or Wi-Fi. The central computing device is a server or server network. The corresponding server or server network can be connected to the internet and thus also be referred to as a cloud environment. Accordingly, the vehicle can contact the central computing device via the internet.

[0024] The artificial blurring imposed on the corresponding times and locations involves a smearing of the respective exact values. If, for example, a time is "3:13 p.m.," a time that has been blurred accordingly can form a time interval, such as "3 p.m. to 4 p.m.." The same applies to a location. For example, an exact geoposition coordinate, defined by a latitude and a longitude, for example, can be falsified by adding or subtracting a few decimal places. There are certain limits within which falsification is permitted, so that the actual location lies, for example, in a circle with a radius of 200 meters around the transmitted location coordinate. To blur a location, the accuracy of transmitted geoposition coordinates, for example a latitude and a longitude, can also be reduced.For example, decimal places can be omitted. It would also be possible to transmit a location area instead of an exact location, for example, an area defined by a so-called geofence. Such an area can have any shape, for example, a circular, square, star-shaped, or any polygonal shape.

[0025] The central computing facility manages the fleet data. For this purpose, the vehicles in a fleet regularly send corresponding movement data to the central computing facility. This is the movement data that the respective vehicle transmits to the central computing facility for analysis. The fleet data is thus constantly kept up to date. The central computing facility can also retain outdated fleet data, which can also be referred to as historical fleet data. This makes it possible to trace the movement profiles of the vehicles in the fleet in the past. The temporal determination interval and the spatial determination interval can be the same or different at the starting location and the destination location. A respective temporal and / or spatial determination interval can be smaller, the same size, or larger than a respective temporal and / or spatial uncertainty interval.The size of each interval can depend, for example, on the type of location, for example whether it is a location in a city, in the countryside, or near a so-called point of interest (POI), such as a shopping center, a beach parking lot, a gas station, or the like. For example, the temporal determination interval is the last hour, starting at the start time, and the spatial determination interval is a circle with its center at the start location and a radius of, for example, 500 meters. The spatial determination interval can also have any shape, for example, instead of a circle it can have an elliptical shape, a polygonal shape, for example a triangular shape, a square shape, a pentagonal shape, or the like. A spatial determination interval does not necessarily have to be symmetrical, but can take on any polygonal shape.Particularly preferably, the boundaries of the local determination interval and / or a local uncertainty interval coincide with features of a digital road map, such as a road layout, the presence of certain map features such as parking lots, underground garages, doctor's offices, supermarkets, hospitals, and the like. Thus, a vehicle's location on a road or in a parking lot is a plausible location compared to, for example, a vehicle's location in a field or forest.

[0026] By continuously updating the fleet data, the fleet data contains information describing how many vehicles in the fleet were at the starting location within the time and location detection intervals, and in particular, how many vehicles started a trip there themselves. The same applies to the end of the trip at the respective destination at the respective detection intervals.

[0027] The process is terminated if the vehicle density at the starting location is too low, i.e., fewer than the critical number of vehicles have begun a journey there within the temporal determination interval around the starting time and the spatial determination interval around the starting location. Accordingly, no anonymized movement data is generated. If the number of other vehicles is too low, it is highly likely that the actual movement data can be assigned to the vehicle, which would endanger data protection. However, if the vehicle density is sufficiently high, i.e., a correspondingly large number of vehicles have begun a journey at the starting location and starting time within the respective determination interval, it is difficult or even impossible for the central computing device to assign the individual movement data points to the specific vehicle. This effectively protects data protection and privacy.

[0028] Since this already enables anonymization, the corresponding movement data points at the destination do not need to be discarded if the vehicle density is low. Thus, at the destination, if the vehicle density is low, it is sufficient to impose both a temporal and a spatial blur interval on the corresponding movement data point. However, if the destination has a high vehicle density at the destination time, i.e., if a correspondingly large number of additional vehicles complete a journey within the temporal determination interval around the end time and the spatial determination interval around the destination, it is sufficient to impose only a temporal blur interval on the corresponding movement data point of the vehicle to ensure sufficient anonymization.

[0029] An advantageous development of the method according to the invention further provides that the vehicle transmits a unique vehicle identifier to the central computing device together with anonymized or non-anonymized movement data. The unique vehicle identifier is, for example, a characteristic name or a characteristic number such as the vehicle identification number, also referred to as Vehicle Identification Number (VIN). This enables a clear assignment of the movement data to a respective vehicle. The unique vehicle identifier can be transmitted in plain text or encrypted, for example as a hashed value. Particularly preferably, the communication between the respective vehicles of the vehicle fleet and the central computing device is cryptographically secured. For this purpose, proven cryptography methods are used, such as asymmetric

[0030] Key exchange procedures and the signing of signatures. Generally, data protection is weakened by transmitting the vehicle identifier. However, since the provision of temporal and / or spatial uncertainty prevents the exact movement profile of the vehicle from being determined, data protection is still sufficiently protected. It may be necessary for the vehicle manufacturer to uniquely assign movement data to vehicles in order to gain certain insights. This is therefore also possible with the aid of the method according to the invention.

[0031] According to a further advantageous embodiment of the method according to the invention, the vehicle waits to retrieve the fleet data from the central computing device or to transmit non-anonymized movement data to the central computing device until the end time of the temporal determination interval has been reached at the destination. This allows a particularly large temporal uncertainty interval to be utilized. If the vehicle were to retrieve the fleet data from the central computing device before the end time of the temporal determination interval at the destination or transmit the non-anonymized movement data to the central computing device beforehand, the central computing device would already know the exact time at the latest by which the vehicle arrived in the destination region described by the local uncertainty interval.If the temporal blur interval extends beyond this point in time, it would be implausible that the vehicle would have arrived at its destination at a later point in time within the temporal blur interval than the point in time at which the vehicle obtained the fleet data or transmitted the non-anonymized movement data. Therefore, if the vehicle is to use a correspondingly large temporal blur interval, the vehicle waits as described above.

[0032] A further advantageous embodiment of the method according to the invention further provides that the critical number of vehicles is 3. This is a compromise so that in a wide variety of situations, i.e., sufficiently frequently, movement data can be anonymized, but it is possible to impose sufficient blurring so that the central computing device cannot perform an exact assignment of movement data.

[0033] According to a further advantageous embodiment of the method according to the invention, the value of a temporal and / or spatial uncertainty interval is selected depending on the number of vehicles within the respective detection interval. The method according to the invention thus allows the respective uncertainty interval to be adaptively adjusted to the actual number of vehicles within the respective detection intervals. This makes it possible to improve the accuracy of the movement data depending on the situation while simultaneously maintaining sufficient anonymity.

[0034] Preferably, a smaller temporal and / or spatial uncertainty interval is selected as the number of vehicles within a respective detection interval increases. The more vehicles begin or end a corresponding journey within a respective temporal and spatial detection interval, the more possibilities are generally available as to which journey was completed by which vehicle. In other words, the uncertainty increases, making it more difficult for the central computing device to clearly assign corresponding movement data to vehicles. Accordingly, it is possible to select smaller temporal and / or spatial uncertainty intervals, since sufficient anonymization is already possible.If, on the other hand, fewer vehicles complete their respective journeys in a respective detection interval, a larger temporal and / or spatial blur interval is chosen accordingly in order to maintain anonymity at the expense of the accuracy of the movement data points.

[0035] According to a further advantageous embodiment of the method according to the invention, the vehicle stores historical fleet data and, before performing step B), checks the historical fleet data to determine whether a critical number of fleet vehicles have begun a historical journey within a temporal determination interval around the starting time and a spatial determination interval around the starting location. The vehicle does not transmit any movement data to the central computing device if the number of fleet vehicles is smaller than the critical number. In other words, at the start of the journey, the vehicle checks whether it is generally located in a region with a sufficiently high vehicle density. If this is the case, the further method steps are carried out accordingly to generate anonymized movement data if necessary.However, if the historical fleet data shows that there has historically been a low vehicle density in the corresponding region of the vehicle's location, i.e., generally too few vehicles begin a journey, the further method steps according to the invention are omitted. This improves the efficiency of the method according to the invention. Thus, it is not necessary for non-anonymized movement data to be transmitted to the central computing device, or for current fleet data to be transferred from the central computing device to the vehicle, and a corresponding comparison with the current fleet data to first determine that the further method steps should not be carried out anyway. Thus, the respective computing resources of the vehicle or the central computing device can be used for other tasks.

[0036] An analogous procedure is possible not only at the beginning of each vehicle journey, but also at the end of the journey at the destination. A further advantageous embodiment of the method according to the invention provides that the vehicle stores historical fleet data, after performing step C), checks the historical fleet data to determine whether a critical number of fleet vehicles have completed a historical journey within a temporal determination interval around the destination time and a spatial determination interval around the destination, and causes any movement data to be deleted prior to analysis by the central computing device if the number of fleet vehicles is smaller than the critical number.The critical number of vehicles used when checking the historical fleet data may be the same as or different from the critical number of vehicles used when comparing with the current fleet data.

[0037] For example, historical fleet data describes the movement data of fleet vehicles within the last year. However, a longer or shorter time interval can also be used, such as the last month, the month of June, the last week, or the year 2021.

[0038] The vehicle's movement data is then deleted before being transmitted anonymized to the central processing unit, or non-anonymized movement data is deleted from the central processing unit before the central processing unit can anonymize it. The process ends accordingly.

[0039] A further advantageous embodiment of the method according to the invention further provides that the vehicle collects at least one further movement data point between the starting location and the destination at a respective intermediate location at a respective intermediate point, checks within a temporal determination interval around the intermediate point and a spatial determination interval around the intermediate location how many fleet vehicles also want to generate or have generated a movement data point within the determination interval, wherein, if the number of fleet vehicles is smaller than a critical number of vehicles, the movement data point at the intermediate location is discarded or a temporal and spatial blur interval is imposed on the movement data point and otherwise no blur interval or only a temporal or spatial blur interval is imposed on the movement data point at the intermediate location.

[0040] In the previous embodiments, movement data points were generated only at the starting location and the destination. To reconstruct the route traveled by the vehicle, the central computing device must then recalculate the corresponding route between the starting location and the destination. The same route determination algorithm that is also implemented in the vehicle can be used for this purpose.

[0041] However, it is also possible according to the invention for the vehicle to generate additional movement data points along the corresponding navigation route from the starting point to the destination. This enables the central computing device to more reliably retrace the navigation route. To ensure sufficient anonymization here as well, the additional movement data points can also be provided with a corresponding temporal and / or spatial blur. The procedure is analogous to imposing the corresponding blur at the starting point and destination. In this way, the vehicle checks the fleet data to determine how many other vehicles are also on a journey within the temporal determination interval around the intermediate point and the spatial determination interval around the intermediate point and generate corresponding movement data points.If sufficient vehicles are available, it is not necessary to impose a temporal and / or spatial blur interval on the movement data point. However, it would also be possible in this case to impose only a temporal or a spatial blur interval. If, however, the vehicle density is too low, both a temporal and a spatial blur interval must be imposed to maintain anonymity. Alternatively, the corresponding movement data point can be discarded. The determination of appropriately blurred movement data points can take place during the journey or at the end of the journey, particularly after the end time of the temporal determination interval has elapsed to the target time.The vehicle preferably communicates with fleet vehicles, determines the existence of a respective intermediate location at a respective intermediate point when at least as many fleet vehicles as the critical number of vehicles are within communication range, whereupon the fleet vehicles coordinate and each generate a movement data point and either impose no uncertainty interval on this, or merely impose a temporal or spatial uncertainty interval. The vehicle can communicate with other fleet vehicles via proven interfaces. Such an interface is also referred to as a vehicle-to-vehicle communication interface, or vehicle-to-vehicle (V2V) interface. The general question therefore arises as to when the vehicles in the fleet should generate further movement data points during the journey. This is advantageous when several vehicles in the fleet are within communication range of one another.Thus, the fleet vehicles, or rather the vehicle itself, can directly detect when a sufficiently high vehicle density is present on the route, allowing anonymizable movement data points to be generated. Depending on the vehicle density in such a situation, it may not even be necessary to impose a blur interval, or it may only be necessary to impose a temporal or spatial blur interval. Furthermore, analogous to the advantageous embodiments of the method according to the invention described above, the height of each temporal or spatial blur interval to be imposed can be selected depending on the vehicle density.

[0042] Particularly preferably, at least two fleet vehicles within communication range exchange their previously generated movement data points and use the previous movement data points received from the other fleet vehicle to generate their own movement data. This further increases the degree of anonymization and further improves data protection. The central computing device assumes that the route described by the movement data of a vehicle from the starting point to the destination is also traveled by the respective vehicle. However, the inventive exchange of the movement data points, which were generated by the respective fleet vehicles before the vehicles meet, makes it possible to exchange the respective route sections.The first partial route of a first vehicle thus originates from a second vehicle, and only the subsequent partial route section originates from the vehicle itself. This exchange of previous movement data points can be performed as often as desired during a trip, enabling a particularly high degree of mixing. Only the previously generated or exchanged movement data points can be (re)exchanged, as this is the only way to reconstruct plausible routes.

[0043] In a vehicle according to the invention, comprising an internal computing unit, position-determining means, and communication means, the computing unit, the position-determining means, and the communication means are configured to carry out a method described above. The vehicle can be any vehicle, such as a car, truck, van, bus, or the like. The computing unit can be a central on-board computer, a control unit of a vehicle subsystem, or the like. The vehicle can have a dedicated telecommunications unit as the communication means. A mobile device, such as a smartphone, which is linked to the computing unit via tethering, can also be used as the communication means. The vehicle can preferably have an in-vehicle navigation unit, such as a GPS-based navigation system, as the position-determining means.

[0044] Further advantageous embodiments of the method according to the invention for anonymizing movement data also emerge from the exemplary embodiments which are described in more detail below with reference to the figures.

[0045] Showing:

[0046] Fig. 1 is a schematic plan view of a vehicle according to the invention which carries out a journey from a starting point to a destination and carries out a method according to the invention for anonymising movement data arising therein;

[0047] Fig. 2 is a flow chart of the method according to the invention; and

[0048] Fig. 3 is a schematic plan view of two vehicles according to the invention whose travel routes intersect, whereby the two vehicles exchange the part of the movement data generated before the point of intersection.

[0049] Figure 1 shows an idealized top view of a road map of a vehicle 1 according to the invention, which completes a journey from a starting point 2 to a destination 3. The vehicle 1 generates at least one movement data point at each of the starting point 2 and the destination 3 and includes this in the movement data to be generated. The respective movement data point describes the current location of the vehicle 1 at the current time. The vehicle 1 transmits the movement data to a central computing device 4 for analysis. Before the movement data is analyzed by the central computing device 4, an artificial blur is imposed on at least one location and / or time in the movement data. This makes it possible to anonymize the movement data.

[0050] First, vehicle 1 determines the respective location and start time at the beginning of the journey. Vehicle 1 then completes its journey. When vehicle 1 arrives at destination 3, it also determines the location and destination time again.

[0051] A plurality of fleet vehicles 5 transmit corresponding anonymized movement data to the central computing device 4. This data is aggregated and kept up-to-date by the central computing device 4. Corresponding current fleet data can then be evaluated for further processing either by the central computing device 4 itself or transmitted to the vehicle 1 for evaluation. The vehicle 1 or the central computing device 4 then compares the movement data of the vehicle 1 in non-anonymized form with the fleet data.

[0052] It is checked how many fleet vehicles 5 have begun a journey within a temporal determination interval around the starting time and a spatial determination interval 6 around the starting location 2. If the number of fleet vehicles 5 is greater than a critical number of vehicles, for example, 3, the vehicle 2 imposes a temporal and / or spatial 7 uncertainty interval on the movement data point at the starting location 2. The respective uncertainty interval can also be imposed accordingly by the central computing device 4.

[0053] For example, vehicle 1 starts its journey at starting location 2 at 8 a.m. The local determination interval 6 corresponds, for example, to a circle with radius r, for example, 500 meters. The fleet data is then used to determine which fleet vehicles 5 also began a journey within the time determination interval, for example, ±30 minutes, i.e., from 7:30 a.m. to 8:30 a.m., within the local determination interval 6. This step is particularly preferably performed after 8:30 a.m., since a previous execution could be an indication to the central computing device 4 that the journey actually began before 8:30 a.m.

[0054] Since the movement data of the fleet vehicles 5 are also anonymized, the actual starting point of each fleet vehicle 5 lies within an area described by the respective circles 13. In other words, the central computing device 4 assumes the center of each circle 13 as the starting point 14 of each fleet vehicle 5 in the fleet data, even if the actual starting point lies at any location within each circle 13.

[0055] If the vehicle density is high enough, i.e. if a sufficient number of fleet vehicles 5, for example three fleet vehicles 5, are present within the temporal determination interval within the local determination interval 6 and start their respective journey, then vehicle 1 is also able to generate anonymized movement data. The presence of the additional fleet vehicles 5 makes it more difficult for the central computing device 4 to track exactly which vehicle 1, 5 has made which journey. To further increase the degree of anonymization, vehicle 1 or the central computing device 4 imposes a temporal blur or the local blur interval 7 on the exact starting time and / or the exact starting location 2 of vehicle 1. The local blur interval 7 can take on any shape and any size.Particularly preferably, the respective sizes of the temporal and / or spatial 7 blur interval are designed as a function of the vehicle density.

[0056] The procedure for anonymizing the movement data upon arrival of vehicle 1 at destination 3 is analogous. Thus, the current fleet data is also checked to determine how many fleet vehicles 5 have completed a journey within a local determination interval 8 at a time determination interval. If the vehicle density is high enough, it is sufficient to simply impose a temporal blur interval on the corresponding movement data point at destination 3. If, however, the vehicle density is lower than a critical limit, for example, also three fleet vehicles 5, both a temporal and a spatial blur interval 9 are imprinted on the movement data point at destination 3. The spatial blur interval 9 can also have any extent and shape.With the aid of the method according to the invention, it is reliably possible to generate anonymized movement data for a particularly large number of situations and to make them available to the central computing device 4 for analysis.

[0057] Figure 2 illustrates the process flow once again. In step 201, vehicle 1 begins its journey and determines its current location and starting time at starting location 2.

[0058] This is followed by an optional method step 202, in which vehicle 1 checks whether a sufficiently high vehicle density generally exists in its current location, particularly within the local detection interval 6. If this is not the case, the method is terminated and the data generated in step 201 is discarded. This occurs in step 203.

[0059] This “preliminary check” can reduce the effort required to carry out the method according to the invention, since current fleet data do not have to be transmitted to the vehicle 1 or non-anonymized movement data do not have to be transmitted from the vehicle 1 to the central computing device 4.

[0060] If, however, vehicle 1 is located in an area with sufficient vehicle density, step 204 is performed. Since method steps 202 and 203 are optional, method step 204 could also follow seamlessly on from method step 201. In step 204, a check is performed to determine, by analyzing the fleet data, whether sufficient fleet vehicles 5 have begun a respective journey within the temporal determination interval around the starting time and the spatial determination interval 6 around starting location 2. If this is the case, a temporal and / or spatial uncertainty interval 7 is imposed on the movement data point at starting location 2. If this is not the case, the method ends in method step 205.

[0061] Method step 204 can be performed at any time after the start of the journey. In method step 206, vehicle 1 reaches destination 3 and determines the current location and the destination time at destination 3. Method steps 206 and 204 could also be interchanged.

[0062] An optional step 207 now follows. Vehicle 1 checks historical fleet data to determine whether there is sufficient historical vehicle density at destination 3 in a local historical determination interval, for example, overlapping with local determination interval 8. If this is not the case, the method ends in step 208, and the movement data generated so far is deleted.

[0063] If, however, a sufficient historical vehicle density exists, method step 209 is carried out. Method step 209 can also follow seamlessly on from method step 206. In method step 209, taking into account the current fleet data, a check is carried out to determine whether a sufficient number of fleet vehicles 5 have completed a respective trip within a temporal determination interval around the end time and a spatial determination interval 8 around the destination 3. If this is the case, then only a temporal blur interval is imposed on the movement data point at destination 3 in step 210. If this is not the case, then both a temporal and a spatial blur interval 9 are imposed on the movement data point at destination 3 in step 211.

[0064] Figure 3 shows a further alternative embodiment of the method according to the invention, in which several vehicles 1 or fleet vehicles 5 exchange movement data points with one another. Figure 3 is divided into four quadrants I, II, III, and IV. Quadrant I shows the journey of a first vehicle 1.1 from its respective starting point 2 to its respective destination 3. Quadrant II shows the journey of a second vehicle 1.2 from its respective starting point 2 to the destination 3. The distance traveled in each case is highlighted by a bold line. The vehicles 1.1 and 1.2 meet at an intermediate location 10. Via a vehicle-to-vehicle communication interface, the vehicles 1.1 and 1.2 establish a communication connection and exchange movement data points generated until they reach the intermediate location 10. The vehicles 1.1 and 1.2 do not have to meet exactly at the intermediate location 10, but rather within a local detection interval 11. Through the data exchange, the route previously traveled by the respective vehicle 1.1, 1.2 is exchanged with the route of the other vehicle 1.2, 1.1. This simulates the route shown in quadrants III and IV to the central computing device 4.

[0065] To further increase anonymity, the intermediate location 10 is not described exactly, but rather by a temporal and / or spatial 12 blur interval. The procedure for determining the temporal and / or spatial 12 blur interval is analogous to the method described previously. In particular, the size of the respective temporal and / or spatial 12 blur interval is designed as a function of the vehicle density of the vehicles present in the respective temporal determination interval in the local determination interval 11. Therefore, if more fleet vehicles 5 are on a journey within the temporal determination interval, for example, 30 minutes, a smaller temporal blur interval and / or a smaller spatial blur interval 12 can be selected.

[0066] The method according to the invention makes it possible to reliably anonymize movement data. In particular, it is possible to anonymize movement data with a high frequency compared to proven anonymization methods.

Claims

Patent claims 1. A method for anonymizing movement data of a vehicle (1) which completes a journey from a starting point (2) to a destination (3), wherein the vehicle (1) generates a movement data point at least at the starting point (2) and at the destination (3) and includes it in the movement data, wherein each movement data point describes the current location of the vehicle (1) at the current time, wherein the vehicle (1) transmits the movement data to a central computing device (4) for analysis, and wherein, prior to the analysis of the movement data by the central computing device (4), an artificial blur is imposed on at least one location and / or time in the movement data, characterized by the following method steps: A) Determining, by the vehicle (1), the location and the starting time at the starting location (2); B) Completion of the journey by the vehicle (1); C) Determining, by the vehicle (1), the location and the destination time at the destination (3); D) Reading out fleet data managed by the central computing device (4), wherein the fleet data comprises, in anonymized form, the movement data of a plurality of fleet vehicles (5), and comparing the movement data of the vehicle (1) with the fleet data, wherein: E) Within a temporal determination interval around the starting time and a spatial determination interval (6) around the starting location (2), it is checked how many fleet vehicles (5) have started a journey within the determination interval, wherein, if the number of fleet vehicles (5) is greater than a critical number of vehicles, a temporal and / or spatial (7) blur interval is imposed on the movement data point at the starting location (2) and otherwise the method is terminated; and F) Within a temporal determination interval around the end time and a local determination interval (8) around the destination (3), it is checked how many Fleet vehicles (5) have completed a journey within the determination interval, wherein, if the number of fleet vehicles (5) is smaller than a critical number of vehicles, a temporal and spatial (9) blur interval is imposed on the movement data point at the destination (3) and otherwise a temporal blur interval is imposed on the movement data point at the destination (3).

2. Method according to claim 1, characterized in that the vehicle (1) obtains the fleet data from the central computing device (4) in step D), then carries out steps E) and F) itself and in a step G) transmits anonymized movement data to the central computing device (4) for analysis by means of the artificial blurring.

3. Method according to claim 1, characterized in that the vehicle (1) transmits non-anonymized movement data to the central computing device (4) before step D), the central computing device (4) carries out steps D) to F) and deletes the non-anonymized movement data in a step G) and then analyses the movement data anonymized by steps D) to F).

4. Method according to one of claims 1 to 3, characterized in that the vehicle (1) transmits a unique vehicle identifier to the central computing device (4) together with anonymized or non-anonymized movement data.

5. Method according to one of claims 1 to 4, characterized in that the vehicle (1) waits to obtain the fleet data from the central computing device (4) or to transmit non-anonymized movement data to the central computing device (4) until the end time of the time determination interval has been reached at the destination (3).

6. Method according to one of claims 1 to 5, characterized in that the critical number of vehicles is 3.

7. Method according to one of claims 1 to 6, characterized in that the height of a temporal and / or spatial (7, 9) blur interval is selected as a function of the number of vehicles within the respective determination interval.

8. Method according to claim 7, characterized in that with increasing number of vehicles within a respective determination interval, a smaller temporal and / or spatial (7, 9) uncertainty interval is selected.

9. Method according to one of claims 1 to 8, characterized in that the vehicle (1) stores historical fleet data, checks in the historical fleet data before carrying out step B) whether a critical number of fleet vehicles have started a historical journey within a time determination interval around the starting time and a local determination interval around the starting location (2) within the determination interval, and does not transmit any movement data to the central computing device (4) if the number of fleet vehicles is smaller than the critical number.

10. Method according to one of claims 1 to 9, characterized in that the vehicle (1) stores historical fleet data, after carrying out step C) checks in the historical fleet data whether within a time determination interval around the target time and a local determination interval around the target location (3) a critical number of fleet vehicles have completed a historical journey within the determination interval, and causes any movement data to be deleted before analysis by the central computing device (4) be deleted if the number of fleet vehicles is less than the critical number.

11. Method according to one of claims 1 to 10, characterized in that the vehicle (1) collects at least one further movement data point between the starting location (2) and the destination location (3) at a respective intermediate location (10) at a respective intermediate point, checks within a temporal determination interval around the intermediate point and a spatial determination interval (11) around the intermediate location (10) how many fleet vehicles also want to generate or have generated a movement data point within the determination interval, wherein, if the number of fleet vehicles is smaller than a critical number of vehicles, the movement data point at the intermediate location (10) is discarded or a temporal and spatial (12) blur interval is imposed on the movement data point and otherwise no blur interval or only a temporal or spatial (12) blur interval is imposed on the movement data point at the intermediate location (10).

12. The method according to claim 11, characterized in that the vehicle (1) communicates with fleet vehicles, determines the presence of a respective intermediate location (10) at a respective intermediate point when at least as many fleet vehicles as the critical number of vehicles are within communication range, whereupon the fleet vehicles coordinate and each generate a movement data point and each impose no blur interval on this or only impose a temporal or spatial (12) blur interval.

13. Method according to claim 12, characterized in that at least two fleet vehicles located within communication range exchange their previously generated movement data points and use the previous movement data points received from the other fleet vehicle to generate their own movement data.

14. Vehicle (1) comprising an internal computing unit, position determining means and communication means, characterized in that the computing unit, the position determining means and the communication means are configured to carry out a method according to one of claims 1 to 13.

Images