Checking for the presence of at least two people on board a vehicle

Abstract

Control of the presence of at least two people on board a vehicle. The invention relates to a method for controlling the presence of at least two people on board a vehicle, said vehicle traveling between two geographical positions, said two people using a first and a second communication terminal respectively, characterized in that it comprises the following, during the journey: - collecting in a communication network time-stamped geolocation information generated by the first and second terminals between the two geographical positions, - collecting in said network time-stamped discovery information which relates to a discovery of the presence in the vehicle, -- by the first or second terminal, of the second or first terminal respectively, -- or by the first and second terminals, of at least one other terminal or piece of equipment, - according to the geolocation and discovery information collected.to determine whether or not the two people traveled together between the two geographical locations.

Description

Title of the invention: Monitoring the presence of at least two people on board a vehicle Field of invention

[0001] The invention relates to the field of telecommunications and the processing of communication data, in the case where at least two people travel together on board a vehicle, for example a car (carpooling), a motorcycle, a boat or any other type of vehicle. Prior art

[0002] Currently, the practice of carpooling is increasingly encouraged in order to combat single-occupancy driving. The aim of this encouragement is in particular to democratize environmentally virtuous practices and limit the impact of upheavals affecting the energy market. To this end, measures are currently being developed at different levels of public policy that strongly encourage carpooling, based on the remuneration of those who practice it. These policies are implemented at both the governmental and local levels, with implementation specificities depending on the transport supply situation in a given geographical area.In particular, in government terminology, the notion of a Proof of Carpooling Register is mentioned, which denotes the concern of the public authorities to be able to support an incentive policy with reliable mechanisms establishing that carpooling journeys giving rise to financial compensation do indeed take place.

[0003] Precisely, these public policies gaining media visibility and involving remuneration mechanisms are mechanically confronted with the risk of fraud, which can moreover be implemented relatively easily.

[0004] To carry out carpooling, there are currently numerous applications that allow a motorist using a vehicle to be connected, on the one hand, with one or more occasional passengers of this vehicle, on the other hand. The applications are generally nominative, the passengers and the motorist declaring their identity via the application. The connection also defines a meeting point to drive the vehicle there to pick up the passenger(s).

[0005] Such applications also have a certain number of mechanisms based on the geolocation of the driver's mobile terminal and the mobile terminal of each passenger. Thus, in the General Conditions of Use of these applications, the geolocation at the departure and arrival of the mobile terminals is mentioned, this basic data also appearing among the data of the Proof of Journey Register, for applications approved within the framework of public programs. In some of these applications, a "telephone verification" after departure is also mentioned, this verification not claiming to implement terminal capabilities other than geolocation.

[0006] Faced with the promise of remuneration, users may be tempted to simulate carpooling between people who have agreed to each other at the outset. These people choose each other, outside of any contact platform, because they have identical itineraries and they make the same journey, each in their own vehicle, following each other - the precision of the geolocation is not sufficient to establish that they are in fact two solo drivers fraudulently declared as carpooling. Subject matter and summary of the invention

[0007] One of the aims of the invention is to remedy the drawbacks of the aforementioned state of the art by proposing a method for checking the presence of at least two people on board a vehicle, which makes it possible to generate proof / a certificate that the journey was indeed made jointly by these two people, while guaranteeing compliance with the legislation in force and in particular the protection of the personal data of these two people.

[0008] To this end, an object of the present invention relates to a method for controlling the presence of at least two people on board a vehicle, the vehicle making a journey between two geographical positions, the two people using a first and a second respective communication terminal.

[0009] Such a method is characterized in that it comprises the following, during the journey:

[0010] - collecting in a communication network geolocation information ho- rodates generated by the first and second terminals between the two geographical positions,

[0011] - collect in the network time-stamped discovery information which is relating to the discovery of the presence in the vehicle,

[0012] — by the first or second terminal, of the second or first terminal res respectively,

[0013] — or by the first and second terminal, of at least one other terminal or equipment,

[0014] - based on the geolocation and discovery information collected, de whether or not the two people made the journey together between the two geographical positions.

[0015] The invention thus makes it possible to certify in a simple and reliable manner that at least two people have made a journey together. The fact of only retrieving geolocation and discovery information from the network, which is not in itself personal data, has the advantage of also ensuring the protection of the privacy of users.

[0016] According to a particular embodiment, the time-stamped discovery information comprises an identifier associated with the journey and data representative of the failure or success of the discovery.

[0017] According to a particular embodiment, the identifier associated with the journey comprises an identifier associated with the first terminal and an identifier associated with the second terminal.

[0018] Such an embodiment has the advantage of reusing identifiers of already existing and known terminals, for example the MAC (Media Access Control) addresses of these terminals, their MSISDN (Mobile Station International Subscriber Directory Number) numbers, etc. As a result, the control method according to this embodiment is simple to implement while making it possible to certify, according to a first level of confidence, whether or not the two people made the journey together.

[0019] According to another particular embodiment, the identifier associated with the path is an identifier received by the first and second terminals from a communication device, via the network, such an identifier being a function of:

[0020] - of a first identifier of a short-range communication protocol associated with the first terminal,

[0021] - of a second identifier of the short-range communication protocol associated with the second terminal.

[0022] Such an identifier advantageously makes it possible to be associated with the user of the first terminal, with the user of the second terminal, with the first and second terminals, with the journey made by said users. In this way, for all the discovery attempts, if applicable short-range communication, which take place between the first and second terminals during the journey, it is possible to trace and exploit, by the communication equipment, such as for example a server, a platform or other dedicated equipment, the number of discoveries or short-range communications which succeeded or failed throughout the journey. As a result, the control method according to this embodiment makes it possible to certify, according to a second level of confidence higher than the aforementioned first level of confidence, whether the two people made the journey together or not.

[0023] According to another particular embodiment, during the discovery implemented by one of the two terminals, the first terminal, respectively the second terminal, identifies the second terminal, respectively the first terminal, using the second identifier, respectively first identifier, of the short-range communication protocol, the first and second identifiers having been received respectively by the second and first terminals from the communication equipment, via the network.

[0024] In this embodiment, the first and second terminals can discover each other, or even pair up, easily, since they have a common short-range communication protocol determined beforehand by the communication equipment and associated with a first and a second corresponding short-range communication protocol identifier, the first and second short-range communication protocol identifiers having been advantageously communicated beforehand to the second and first terminals respectively by the communication equipment.

[0025] According to another particular embodiment, the discovery of the presence in the vehicle of the first or second terminal comprises the sharing of information between the first and second terminals, the shared information being transmitted in a time-stamped manner to the communication equipment, via the network, by the first and second terminals.

[0026] In this embodiment, such sharing of information between the first and second terminals and the sending of this time-stamped information to the communication equipment by each of the terminals advantageously constitutes a means of proving that an attempt at discovery or local short-range communication has been implemented between these terminals at two concordant times. This embodiment is particularly advantageous when at least one of these terminals is not equipped with a conventional short-range communication interface of the type, for example, Bluetooth, NFC, etc.

[0027] According to another particular embodiment, the discovery step is initiated by one of the first and second terminals in response to the reception by the terminal, from the communication equipment, of a data sequence, the sequence being sent by the terminal to the other terminal during the discovery step, the sequence received by the other terminal being sent by the other terminal to the communication equipment via the network, being associated with time-stamped discovery information.

[0028] Such an embodiment advantageously makes it possible to provide an additional level of security for the transmission, by at least one of the terminals, to said server, of the time-stamped discovery information, since the communication equipment:

[0029] - by sending the data sequence to one of the terminals, has the possibility of control the initialization of the discovery and therefore wait to receive time-stamped discovery information from another terminal;

[0030] - thanks to the reception from the other terminal of the data sequence associated with time-stamped discovery information, has the possibility of obtaining proof with an increased level of confidence, that the two terminals were present at approximately the same time in the vehicle, or even at the same time if each of the terminals sends synchronously to the communication equipment its information time-stamped discovery training, for example in the case where the terminals have access to universal time via the Internet network.

[0031] According to another particular embodiment, the control method comprises, during the journey, the implementation of a verification of the identity of the at least two people on board the vehicle.

[0032] Such an embodiment advantageously makes it possible to reinforce the level of certification of the presence of at least two people on board a vehicle, thanks to the collection of additional information in the network (the result of the verification) which is of a different type than the aforementioned geolocation and discovery information, since it relates to the identity of the people on board the vehicle.

[0033] According to another particular embodiment, the identity verification comprises:

[0034] - identifying, by one of the first and second terminals associated with one of the persons who is not driving, said person, generating first identification data,

[0035] - identifying the other person, driver of the vehicle or not, using the terminal, generating second identification data,

[0036] - compare the first and second identification data to respectively first and second identification data previously stored in the communication equipment,

[0037] - save the result of the comparison in the equipment.

[0038] Such an embodiment is advantageous in that, particularly in the context of a journey involving two people, it is the person who is not driving who takes the initiative in verifying identity, so as not to disturb the other person who is driving. Road safety is thus preserved.

[0039] The various embodiments or features mentioned above may be added independently or in combination with each other to the method of controlling an avatar, as defined above.

[0040] The invention also relates to communication equipment suitable for monitoring the presence of at least two people on board a vehicle, the vehicle traveling between two geographical positions, the two people using a first and a second respective communication terminal.

[0041] Such equipment is characterized in that it is configured to, during the journey:

[0042] - collect geolocation information in a communication network ho rodates generated by the first and second terminals between the two geographical positions,

[0043] - collect in the network time-stamped discovery information which is relating to the discovery of the presence in the vehicle,

[0044] — by the first or second terminal, of the second or first terminal res respectively,

[0045] — or by the first and second terminal, of at least one other terminal or equipment,

[0046] - based on the geolocation and discovery information collected, whether or not the two people made the journey together between the two geographical positions.

[0047] Such equipment is particularly suitable for implementing the aforementioned control method.

[0048] The invention also relates to a communication terminal adapted to control the presence of at least two people on board a vehicle, the vehicle making a journey between two geographical positions, the terminal being used by one of the two people.

[0049] Such a terminal is characterized in that it is configured to, during the journey:

[0050] - sending geolocation information in a communication network ho- rotations generated by the terminal between the two geographical positions,

[0051] - send into the network time-stamped discovery information relating to a discovery by the terminal of the presence in the vehicle of another terminal or equipment, so as to determine in the network whether the person using the terminal and another person using the other terminal have or have not made the journey together between the two geographical positions, based on the geolocation and discovery information sent.

[0052] The invention also relates to a computer program comprising instructions for implementing the method for checking the presence of at least two people on board a vehicle, according to any one of the particular embodiments described above, when said program is executed by a processor.

[0053] Such instructions can be stored permanently in a non-transitory memory medium of the communication equipment implementing the control method according to the invention.

[0054] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0055] The invention also relates to a recording medium or information medium readable by a computer, and comprising instructions of a computer program as mentioned above.

[0056] The recording medium may be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a movable medium, a hard drive or SSD.

[0057] On the other hand, the recording medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means, so that the computer program it contains is remotely executable. The program according to the invention may in particular be downloaded over a network, for example an Internet-type network.

[0058] Alternatively, the recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the aforementioned control method.

[0059] According to an exemplary embodiment, the present technique is implemented by means of software and / or hardware components. In this regard, the term "device" or "module" may correspond in this document to a software component, a hardware component or a set of hardware and software components. Brief description of the drawings

[0060] Other characteristics and advantages will appear on reading particular embodiments of the invention, given as illustrative and non-limiting examples, and the appended drawings, among which:

[0061] [Fig.l] represents an architecture in which the method for controlling the presence of at least two people on board a vehicle is implemented, according to a particular embodiment of the invention,

[0062] [Fig.2] represents a communication equipment, according to a particular embodiment of the invention, as implemented in the architecture of [Fig.l],

[0063] [Fig. 3] represents the main actions implemented during a configuration phase of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of [Fig. 1],

[0064] [Fig.4A] represents actions implemented during an activation phase of a data exchange session of the method for controlling the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0065] [Fig.4B] represents actions implemented during an activation phase of a data exchange session of the method for controlling the presence of at least two people on board a vehicle, according to another particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0066] [Fig. 5] represents actions implemented during a phase of collecting time-stamped geolocation information of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment

[0067] [Fig.6A] represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0068] [Fig.6B] represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to another particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0069] [Fig.6C] represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to yet another particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0070] [Fig.6D] represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to yet another particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0071] [Fig.7A] represents actions implemented during a phase of collecting time-stamped identity information of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0072] [Fig.7B] represents actions implemented during a phase of collecting time-stamped identity information of the method for checking the presence of at least two people on board a vehicle, according to another particular embodiment of the invention, as implemented in the architecture of [Fig.1],

[0073] [Fig.8] represents actions implemented during a phase of processing the time-stamped geolocation information, the time-stamped discovery information, and possibly the time-stamped identity information, of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of [Fig.l].

[0074] Detailed description of several embodiments of the invention

[0075] [Fig.l] represents an architecture in which a method for controlling the presence of at least two persons A and B on board a vehicle is implemented, according to one embodiment of the invention. In the example shown, the vehicle is a car. This example is of course not exhaustive. The vehicle could be, for example, a motorcycle, a boat, a bicycle, etc. The car is used by one of the persons A and B, for example, person A. In other words, person A is driver of this car. Said car is designated by the reference V_A in [Fig.l].

[0076] The architecture comprises a communication device P, such as for example a service platform or a server. This device allows driver and / or passenger users to register, declare daily journeys, and consequently find compatible carpoolers. Each user registered with this device is associated with a user communication terminal. In the architecture of [Fig.l], the communication terminal of person A is designated T_A and the communication terminal of person B is designated T_B. In the example shown, the terminals T_A and T_B are both smartphone-type mobile phones (“smartphone”). Such an example is of course not exhaustive. Indeed, one or the other of these terminals could be for example a tablet, a laptop, etc.The equipment P comprises a database BD comprising for each person A, respectively B, an identifier ID_A, respectively ID_B, associated with the person A, respectively B. The identifiers ID_A, ID_B are for example identifiers of the persons A, B, for example a nickname, an email address or instant messaging, etc. or identifiers associated with the terminals T_A, T_B, such as for example their respective MAC addresses or their respective MSISDN numbers. In the terminal T_A, respectively T_B, a computer program designated by C_A, respectively C_B, as "client" is installed. This may be for example an application or application program that the person A, respectively B, has previously downloaded from an application provider or software downloaded from the equipment P. The activation of the programs C_A, C_B makes it possible to implement real-time data exchanges: .

[0077] - between on the one hand the terminals T_A, T_B and, on the other hand, the equipment P, via a RCP long-range network implemented using, for example, cellular radiotelephony technologies (e.g., 3G, 4G, 5G), IP ("Internet Protocol"), circuit, etc., or a combination of these technologies,

[0078] - between terminals T_A and T_B, where appropriate via a short-range RCP network, such as such as Bluetooth, NFC (“Near Field Communication” in English), etc.,

[0079] - between the terminals T_A, T_B, via the short-range network RCP, and a plurality of communication terminals or equipment Eb E2, ..., EM, with M>1, which are located in the vehicle V_A.

[0080] A communication terminal among Eb E2, ..., EM is for example a mobile phone for example of the smartphone type, a tablet, a laptop, etc. It can be for example a communication terminal belonging to a passenger of the vehicle V_A who is neither A nor B. A piece of equipment among Eb E2, ..., EM is for example a device installed or located in the vehicle V_A and operating according to a short-range communication protocol of the aforementioned type, for example a Bluetooth car radio, a Bluetooth headset, etc.

[0081] Such data exchanges can take place before, during and after the journey. The nature of these exchanges will be specified later in the description.

[0082] In the example of [Fig.l], one or more short-range local communication protocols may be supported by the two terminals T_A and T_B, such as for example Bluetooth, NFC, etc. By hypothesis, it is considered that such a protocol has a range not exceeding the passenger compartment of the vehicle.

[0083] Higher range protocols, for example WiFi (“Wireless Fidelity” in English), can however be envisaged provided that suitable means are implemented in the terminals to reliably measure the power of the signal received by these terminals, and in doing so deduce the distance between said terminals.

[0084] In the context of a short-range communication protocol considered, for example Bluetooth, we will call ID_T_A the identifier of the terminal T_A and ID_T_B the identifier of the terminal T_B.

[0085] We will now describe, with reference to [Fig.2], the simplified structure of the aforementioned communication equipment P.

[0086] Such equipment comprises:

[0087] - an MCP communication interface configured to communicate, via the network RCP communication module of [Fig.l], with in particular the terminals T_A and / or T_B,

[0088] - an MTI data processing module, such as:

[0089] — time-stamped geolocation information received from the terminals T_A and T_B,

[0090] — time-stamped information relating to a discovery, by the terminal T_A, of the presence of terminal T_B in vehicle V_A, or to a discovery, by terminal T_B, of the presence of terminal T_A in vehicle V_A,

[0091] — time-stamped information relating to a discovery, by the terminal T_A, of the presence of j equipment among M (l <j<M) dans le véhicule V_A, ou à une découverte, par le terminal T_B, de la présence de k équipements parmi M (l<k<M) dans le véhicule V_A,

[0092] — identification data of persons A and B.

[0093] - a GIS module for generating an identifier associated with the journey made in the vehicle V_A,

[0094] - the aforementioned BD database in which are stored:

[0095] — the identifiers ID_T_A and ID_T_B,

[0096] — an identifier ID_S associated with the journey, in association with the identifiers ID_T_A and ID_T_B or ID_A and ID_B,

[0097] — information relating to the success or failure of discovery attempts between the terminals T_A and T_B, in association with their respective identifiers ID_T_A and ID_T_B or ID_A and ID_B,

[0098] — possibly identification data DI_A and DI_B relating to the person user of at least one of the terminals T_A, T_B (e.g.: photo of the face, fingerprint, voice sample of this person, etc.),

[0099] - an RPC memory configured to store information (e.g. certificate) represented indicating that a journey in vehicle V_A was indeed made jointly by persons A and B.

[0100] Information regarding the success or failure of discovery attempts may be Boolean in nature, in the form of a percentage, etc.

[0101] In the example shown, BD and RPC are installed in the communication equipment P. Alternatively, BD and / or RPC can be made accessible by the communication equipment P according to the implementation envisaged, for example if it does not have the hardware and software resources necessary to store this information.

[0102] According to a particular embodiment of the invention, the actions executed by the communication equipment P are implemented by instructions of a computer program PGp. For this, the equipment P has the conventional architecture of a computer and comprises in particular a memory MEMi, a processing unit UTRi, equipped for example with a processor PROCi, and controlled by the computer program PGi stored in memory MEMb. The computer program PGi comprises instructions for carrying out the following actions within the framework of the method for checking the presence of at least two people A and B on board a vehicle which will be described below, when the program is executed by the processor PROCi, according to any one of the particular embodiments of the invention:

[0103] - communication with terminals T_A, T_B, prior to the journey to be made and during the journey,

[0104] - generation of an identifier associated with the journey,

[0105] - data processing, such as:

[0106] — time-stamped geolocation information received from the terminals T_A and T_B,

[0107] — time-stamped discovery information received from terminals T_A and T_B,

[0108] — possibly identification data of persons A and B,

[0109] - storage:

[0110] — identifiers ID_A and ID_B,

[0111] — identifiers ID_T_A and ID_T_B,

[0112] — an identifier ID_S associated with the journey, in association with the identifiers ID_T_A and ID_T_B or the identifiers ID_A and ID_B,

[0113] — information relating to the success or failure of discovery attempts between terminals T_A and T_B, or between terminals T_A and T_B and equipment Eh ..., Em.

[0114] At initialization, the code instructions of the computer program PGi are for example loaded into a RAM memory (Read Access Memory in English) (not shown) before being executed by the processor PROCi. The processor PROCi of the processing unit UTRi notably implements the aforementioned actions, according to the instructions of the computer program PGp

[0115] We will now describe, with reference to [Fig.3], the simplified structure of a communication terminal of the T_A or T_B type.

[0116] Such a terminal has the classic architecture of a portable terminal such as a smartphone, a tablet, a computer, or other.

[0117] For this purpose, the terminal T_A or T_B comprises:

[0118] - a user interface UI configured to enter information or render information (keyboard, mouse, screen, microphone, speaker, camera, etc.);

[0119] - an MCT communication interface configured to communicate, via the network RLP communication of [Fig.l], with communication equipment P,

[0120] - possibly an MCC communication interface configured for com communicate with another terminal of the same type, via the short-range communication network RCP of [Fig.l],

[0121] - a geolocation LOC module which operates for example according to the technology GPS (Global Positioning System), Galileo, WiFi, GSM (Global System for Mobile Communications), IP, etc.,

[0122] - an STT memory configured to store, where appropriate, the identifiers ID_T_A and ID_T_B of the short-range communication protocol considered, to store the identifiers ID_A, respectively ID_B, and / or graphic and / or textual information to be shared locally with another terminal, possibly DI_AS, DI_BS data relating to the person using the terminal (e.g.: photo of the face, fingerprint, voice sample of this person, etc.), as well as the identifier ID_S associated with the journey.

[0123] Since the terminals T_A or T_B are not necessarily equipped with the MCC short-range communication interface, this is shown in dotted lines in [Fig.3].

[0124] At initialization, the code instructions of the computer program PG2 are for example loaded into a RAM memory (not shown) before being executed by the processor PROC2. The processor PROC2 of the processing unit UTR2 notably implements the following actions, within the framework of the method for controlling the presence of at least two persons A and B on board a vehicle which will be described below, according to the instructions of the PG2 computer program:

[0125] - communication via the RLP long-range network with the communication equipment nication P, prior to the journey to be made and during the journey,

[0126] - discovery, via the short-range RCP network or not, of the other terminal T_A or T_B depending on the terminal that initiated the discovery,

[0127] - geolocation of terminal T_A / T_B,

[0128] - storage of identifiers ID_A, respectively ID_B, possibly iden identifiers ID_T_A and ID_T_B of the short-range communication protocol considered and / or graphic and / or textual information to be shared locally with another terminal, possibly data relating to the person using the terminal (e.g.: photo of the face, fingerprint, voice sample of this person, etc.), the identifier ID_S of the short-range communication session,

[0129] - identification of the person using the terminal, A if it is T_A, and B if it is This is T_B.

[0130] We will now describe, with reference to Figures 4A to 8, the progress of a method for checking the presence of at least two people A and B on board a vehicle, according to different embodiments of the invention. In the figures, the actions shown in dotted lines designate optional actions which may or may not be implemented during the shared journey of people A and B.

[0131] Activation phase of a data exchange session corresponding to a journey to be made

[0132] With reference to [Fig.4A], a first embodiment of a phase of activation by the equipment P of the data exchange session between the terminals T_A and T_B on the one hand, and the equipment P on the other hand, in connection with the journey to be made, is described. According to this first embodiment, the terminals T_A and T_B are both equipped with at least one short-range communication MCC interface of the Bluetooth, NFC or other type.

[0133] Prior to this process, person B boards vehicle V_A used by person A at a meeting point defined by geographic coordinates (x,y), where x and y represent, for example, longitude and latitude respectively.

[0134] In S40, A and B each declare, via their respective applications C_A and C_B, that their joint journey begins. To this end:

[0135] - A selects in S40_A the meeting point in the C_A application of the terminal T_A, using the UI,

[0136] - B selects in S40_B the meeting point in the C_B application of the terminal T_B, using the UI.

[0137] In response to the selection action S40_A, respectively S40_B, the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG1_A, respectively MSG1_B, comprising:

[0138] - the identifier ID_A, respectively ID_B,

[0139] - the short-range communication protocol(s) supported by the terminal T_A, respectively T_B,

[0140] - the identifier(s) ID_T_A, respectively ID_T_B, associated with these protocols,

[0141] - the “enabled / disabled” status of the MCC short-range communication interfaces supporting these protocols.

[0142] The transmission of this different information to the equipment P can be carried out without loss of generality in one or more requests. During the transmission, related mechanisms for encrypting the messages MSG1_A, MSG1_B, for authenticating the persons A and B and / or the terminals T_A and T_B, which are known to those skilled in the art, can be implemented.

[0143] In S41, the equipment P receives the messages MSG1_A and MSG1_B via its MCP communication interface ([Fig.2]).

[0144] In S42, the equipment P generates an identifier ID_S associated with a data exchange session which will take place during the journey between the terminals T_A and T_B on the one hand, and the equipment P on the other hand. The identifier ID_S is generated as a function of the identifiers ID_T_A and ID_T_B received, being associated with a status whose value is “initialized”.

[0145] In S43, the equipment P determines, as a function of the short-range protocols supported by the terminals T_A and T_B and as a function of the “activated / deactivated” status of the short-range communication interfaces supporting these protocols, whether or not a short-range discovery or communication can be established between T_A and T_B.

[0146] In the case where the equipment P determines a short-range communication protocol common to T_A and T_B, for example Bluetooth, for which the short-range communication interfaces MCC of T_A and T_B supporting this protocol are in the “activated” status, the equipment P sends in S44, via the RLP communication network:

[0147] - the session identifier ID_S at terminal T_A and T_B,

[0148] - the identifier ID_T_A at terminal T_B and the identifier ID_T_B at terminal T_A.

[0149] In the case where the equipment P determines a short-range communication protocol common to T_A and T_B, for example Bluetooth, for which the short-range communication interfaces of T_A and T_B supporting this protocol are respectively in the status “activated” and “deactivated” or “deactivated” and “activated” or “deactivated” and “deactivated”, the equipment P establishes that communication will be possible as soon as the Bluetooth protocol is activated on T_B and / or T_A as the case may be. For this purpose, in addition to the aforementioned information sent in S44, the equipment P sends to the terminal T_A and / or T_B whose short-range communication interface is deactivated, a message MSG2_A and / or MSG2_B respectively, this message requesting activation of the short-range communication interface currently deactivated on the terminal T_A and / or T_B as the case may be.

[0150] In the case where the equipment P is unable to determine a short-range communication protocol common to T_A and T_B, the equipment P sends in S44 to the terminal T_A and / or T_B a message MSG3_A and / or MSG3_B respectively, instead of the message MSG2_A and / or MSG2B, the message MSG3_A and / or MSG3_B informing the persons A and B that their carpooling cannot benefit from certification.

[0151] In S45, the terminal T_A, respectively T_B, receives the message MSG3_A, respectively MSG3_B, via its communication interface MCT ([Fig.3]).

[0152] In S46, A and / or B then proceed(s), on their respective terminal T_A, T_B, to the activation required in S6 of their currently deactivated short-range communication MCC interface. Such activation is carried out via the user interface UI of the terminals T_A, T_B in the parameters / settings of these terminals.

[0153] In S47, in response to said activation, the terminal T_A, respectively T_B, as the case may be, sends to the communication equipment P, via the RLP network, a notification MSG4_A, respectively MSG4_B, informing the equipment P that the activation of their corresponding short-range communication interface has been implemented.

[0154] In S48, the equipment P receives the messages MSG4_A and / or MSG4_B via its MCP communication interface.

[0155] In S49, the equipment P changes the “initialized” status of the session corresponding to the identifier ID_S to the status having the value “activated”.

[0156] With reference to [Fig.4B], a second embodiment of a phase of activation by the equipment P of the data exchange session between the terminals T_A and T_B on the one hand, and the equipment P on the other hand, in connection with the journey to be made, is described. According to this second embodiment, at least one of the terminals T_A and T_B is not equipped with at least one short-range communication MCC interface of the Bluetooth, NFC or other type. In the example described below, none of the terminals T_A and T_B is equipped with such an MCC interface.

[0157] Prior to this process, person B boards vehicle V_A used by person A at a meeting point defined by geographic coordinates (x,y), where x and y represent, for example, longitude and latitude respectively.

[0158] In S40', A and B each declare, via their respective applications C_A and C_B, that their joint journey begins. To this end:

[0159] - A selects in S40'_A the meeting point in the C_A application of the terminal T_A, using the UI,

[0160] - B selects in S40'_B the meeting point in the C_B application of the terminal T_B, using the UI.

[0161] In response to the selection action S40'_A, respectively S40'_B, the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG1'_A, respectively MSG1'_B, comprising the identifier ID_A, respectively ID_B.

[0162] During transmission, related mechanisms for encrypting the messages MSG1_A, MSG1_B, for authenticating the persons A and B and / or the terminals T_A and T_B, which are known to those skilled in the art, may be implemented.

[0163] In S41', the equipment P receives the messages MSG1_A and MSG1_B via its MCP communication interface ([Fig.2]).

[0164] In S42', the equipment P generates an identifier ID_S associated with a data exchange session which will take place during the journey between the terminals T_A and T_B on the one hand, and the equipment P on the other hand. The identifier ID_S is generated independently or as a function of the identifiers ID_A and ID_B received, being associated with a status whose value is "initialized".

[0165] In S43', the equipment P sends to the terminals T_A and T_B, via the RLP communication network, the identifier ID_S generated in S42'.

[0166] In S44', the terminal T_A, respectively T_B, receives the identifier ID_S generated in S42', via its communication interface MCT ([Fig.3]).

[0167] In S45', the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG2'_A, respectively MSG2'_B, informing the equipment P of the correct reception of the identifier ID_S.

[0168] In S46', the equipment P receives the messages MSG2'_A and MSG2'_B via its MCP communication interface.

[0169] In S47', the equipment P then changes the “initialized” status of the session corresponding to the identifier ID_S to the status having the value “activated”.

[0170] Time-stamped geolocation information collection phase

[0171] With reference to [Fig.5], an embodiment of a phase of collecting, during the journey having the identifier ID_S, time-stamped geolocation information from the terminals T_A and T_B is described. Such a phase is implemented whether or not the terminal T_A and / or T_B is equipped with a short-range communication interface MCC.

[0172] For this purpose, at a location on the route:

[0173] - the application C_A triggers in S500 the sending by the terminal T_A to the equipment P, via the RLP network, initial time-stamped geolocation information IGH1_A generated by the LOC geolocation module of the terminal T_A,

[0174] - the equipment P then receives this information in S501,

[0175] - the application C_B triggers in S502 the sending by the terminal T_B to the equipment P, via the RLP network, initial time-stamped geolocation information IGH1_B generated by the LOC geolocation module of the terminal T_B,

[0176] - the equipment P then receives this information in S503.

[0177] The sending actions S500 and S502 may be implemented in a different order, simultaneously or independently.

[0178] In the example shown in [Fig.5], at least one of the following locations on the route:

[0179] - the application C_B triggers in S504 the sending by the terminal T_B to the equipment P, via the RLP network, second time-stamped geolocation information IGH2_B generated by the LOC geolocation module of the terminal T_B,

[0180] - the equipment P then receives this information in S505,

[0181] - the application C_A triggers in S506 the sending by the terminal T_A to the equipment P, via the RLP network, second time-stamped geolocation information IGH2_A generated by the LOC geolocation module of the terminal T_A,

[0182] - the equipment P then receives this information in S507,

[0183] - and so on throughout the journey.

[0184] The sending actions S504 and S506 may be implemented in a different order, simultaneously or independently.

[0185] In one embodiment, the time-stamped geolocation information IGH1_A, IGH2_A, etc. is in the form of triplets (X1_T_A, Y1_T_A, (pl_T_A), (X2_T_A, Y2_T_A, cp2_T_A), ..., where:

[0186] - X1_T_A, X2_T_A, etc. denote the longitude,

[0187] - Y 1_T_A, Y2_T_A, etc. denote the latitude,

[0188] -<pl_T_A, q> 2_T_A, etc. denote the timestamp.

[0189] Similarly, the time-stamped geolocation information IGH1_B, IGH2_B, etc. is presented in the form of triplets (X1_T_B, Y1_T_B, <pl_T_B), (X2_T_B, Y2_T_B, cp2_T_B), ..., où :

[0190] - X1_T_B, X2_T_B, etc. denote the longitude,

[0191] - Y 1_T_B, Y2_T_B, etc. denote the latitude,

[0192] -<pl_T_B, q> 2_T_B, etc. denote the timestamp.

[0193] The timestamps may have a character determined by a fixed frequency or have a random character. The sending actions S500, S506, respectively S502, S506 are triggered autonomously by the computer program C_A, respectively C_B, or are triggered in the form of “challenges” notified by the equipment P to the terminal T_A and / or T_B. The triggering mode may be hybrid, that is to say that one of the terminals, T_A for example, implements the sending actions S500, S506 autonomously, while the terminal T_B implements the sending actions S502, S504 following receipt of a challenge from equipment P.

[0194] Such a challenge includes, for example, the protocol elements necessary for the terminal T_A and / or T_B to understand the need to send the geolocation information concerning it. Optional elements may also be considered, such as:

[0195] - a quantity and / or frequency of measurements to be carried out (to determine the speed of the vehicle for example),

[0196] - a request to use a particular positioning network (GPS, Galileo, etc.).

[0197] In the case where the sending actions S500, S506, respectively S502, S504, fail due for example to insufficient coverage or saturation of the RLP network, the information IGH1_A, IGH2_A, respectively IGH1_B, IGH2_B, the application C_A, respectively C_B, triggers in S508, S511, respectively S509, S510, the temporary storage of this information in the memory STT of the terminals T_A and / or T_B, before triggering said sending actions again, when the coverage of the RLP network is reestablished or the latter is no longer saturated.

[0198] Time-stamped discovery information collection phase

[0199] With reference to [Fig.6A], an embodiment of a collection phase is described, during the journey having the identifier ID_S, of time-stamped discovery information from the terminals T_A and T_B. In this embodiment, the terminals T_A and T_B are provided with a short-range communication interface MCC.

[0200] For this purpose, at a location on the route, the following is implemented.

[0201] In S600a, one of the terminals T_A or T_B, for example T_A, detects the presence of the terminal T_B in vehicle V_A, using the identifier ID_T_B received at S45 in [Fig.4A].

[0202] Optionally, the method continues as follows:

[0203] — in S601a, person A acknowledges this detection, via the user interface UI of the terminal T_A,

[0204] — in S602a, the application C_A triggers the sending, by the communication module short range MCC from terminal T_A, of an acknowledgment message MSG5_A to terminal T_B,

[0205] — in S603a, the terminal T_B receives the acknowledgment message MSG5_A,

[0206] — in S604a, person B acknowledges receipt of the message MSG5_A, via the interface T_B terminal UI user,

[0207] — in S605a, the application C_B triggers the sending, by the communication module short range MCC from terminal T_B, of an acknowledgment message MSG5_B to terminal T_A,

[0208] — in S606a, the terminal T_A receives the acknowledgment message MSG5_B.

[0209] In S607a, the application C_A, respectively C_B, verifies that the execution context of the mutual discovery between the two terminals shares the session identifier ID_S.

[0210] Optionally in S608a, the application C_A, respectively C_B, executes an encryption / decryption challenge of a randomly generated character string, reciprocally proving to the application C_A, respectively C_B, that the other application C_B, respectively C_A, is an electronically “signed” and valid component.

[0211] At the end of the action S607a or S608a, in S609a, the application C_A, respectively C_B, generates information IRD_A, respectively IRD_B, representative of the success or failure of the discovery between the terminals T_A and T_B.

[0212] In S610a, one of the applications C_A or C_B, the application C_B in the example shown, triggers the sending by the terminal T_B to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_B.

[0213] The equipment P receives the IDH1_B information in S611a and stores it in its STP memory in S612a.

[0214] In S613a, the application C_A triggers the sending by the terminal T_A to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_A.

[0215] The equipment P receives in S614a the information IDH1_A and stores it in its STP memory in S615a.

[0216] The sending actions S610a and S613a may be implemented in a different order, simultaneously or independently.

[0217] The discovery phase which has just been described above is iterated at least once during the journey so that:

[0218] - in S616a, one of the applications C_A or C_B, the application C_A in the example represented, triggers the sending by the terminal T_A to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_A,

[0219] - the equipment P receives in S617a the information IDH2_A and stores it in its STP memory in S618a,

[0220] - in S619a, the application C_B triggers the sending by the terminal T_B to the equipment P, via the RLP network, second time-stamped discovery information IDH2_B,

[0221] - the equipment P receives in S620a the information IDH2_B and stores it in its STP memory in S621a.

[0222] Thus, during the journey, the equipment P is able to collect time-stamped discovery information IDH1_A, IDH2_A, IDH3_A, etc. from the terminal T_A and time-stamped discovery information IDH1_B, IDH2_B, IDH3_B, etc. from the terminal T_B.

[0223] In one embodiment, the time-stamped discovery information IDH1_A, IDH2_A, IDH3_A, etc., respectively IDH1_B, IDH2_B, IDH3_B, etc., comprises the information IRD_A, respectively IRD_B, representative of the success or failure of the discovery, the nature of the discovery (presence of an encryption challenge, etc.) and its time-stamp. The time-stamps may have a character determined by a fixed or variable frequency or may have a random character.

[0224] In the case where the sending actions S613a, S616a, respectively S610a, S619a, fail due for example to insufficient coverage or saturation of the RLP network, the application C_A, respectively C_B, triggers in S623a, S624a, respectively S622a, S625a, the temporary storage of the information IDH1_A, IDH2_A, respectively IDH1_B, IDH2_B in the memory STT of the terminals T_A and / or T_B, before triggering said sending actions again, once the coverage of the RLP network is re-established or the latter is no longer saturated.

[0225] With reference to [Fig.6B], an alternative embodiment of the course of the discovery phase illustrated in [Fig.6A] is described. Such an alternative embodiment differs from the embodiment of [Fig.6A], in that the equipment P commands the terminal T_A or T_B to send a discovery request for the terminal T_B, respectively T_A, whereas in the example of [Fig.6A], such an action, S600a in [Fig.6A], is implemented at the initiative of the terminal T_A. As a result, the information IDH1_A, IDH2_A,..., respectively IDH1_B, IDH2_B,... can be certified with a higher level of confidence.

[0226] For this purpose, in SOOb, the equipment P sends to one of the terminals T_A or T_B, T_A in the example of [Fig.6B], via the RLP network, a random sequence (e.g.: character strings) of value S.

[0227] Terminal T_A receives this sequence in SOlb.

[0228] In S600b, T_A requests the discovery of the terminal T_B in the vehicle V_A, using the identifier ID_T_B received in S45 in [Fig.4A].

[0229] The discovery phase continues as follows:

[0230] — in S601b, person A acknowledges this discovery, via the user interface UI of the terminal T_A,

[0231] — in S602b, the application C_A triggers the sending, by the communication module short range MCC from terminal T_A, of an acknowledgment message MSG5_A to terminal T_B, said message containing the value S of the random sequence,

[0232] — in S603b, the terminal T_B receives the acknowledgment message MSG5_A,

[0233] — in S604b, person B acknowledges receipt of the message MSG5_A, via the interface T_B terminal UI user,

[0234] — in S605b, the application C_B triggers the sending, by the communication module short range MCC from terminal T_B, from an acknowledgment message MSG5_B to terminal T_A, said message containing the value S of the random sequence,

[0235] — in S606b, the terminal T_A receives the acknowledgment message MSG5_B.

[0236] In S607b, the application C_A, respectively C_B, verifies that the execution context of the mutual discovery between the two terminals shares the session identifier ID_S and the value S of the random sequence.

[0237] The following actions S608b to S625b are similar to the aforementioned actions S608a to S625a in connection with [Fig.6A], except that the first time-stamped discovery information IDH1_B sent in S610b to the equipment P, as well as the first time-stamped discovery information IDH1_A sent in S613b, contain the value S of the random sequence.

[0238] The value S' of a new random sequence can then be sent by the equipment P to the terminal T_A or T_B with a view to transmitting to the equipment P the second discovery information IDH2_A and IDH2_B.

[0239] According to the embodiment variant of [Fig.6B], the choice, by the equipment P, of sending the value S, S' of the random sequence to T_A or T_B can have an immutable character. For example, it can be decided that it will always be the terminal T_A (driver) or always the terminal T_B (passenger) which will receive the value S, S'. Such a choice can also be reversed or random.

[0240] In this embodiment variant, the timestamps may have a character determined by a fixed or variable frequency or may have a random character.

[0241] To guard against RLP network coverage problems, which are likely to affect this end-to-end embodiment variant, a fallback mechanism to the embodiment of [Fig.6A] may be agreed between the equipment P and each application C_A and C_B. According to a non-exhaustive exemplary embodiment, the equipment P may indicate to each terminal T_A, T_B that in the event of the latter not receiving, after a certain duration, a new random sequence value from the equipment P, it is up to the terminal T_A or T_B to take the initiative of discovery, according to the embodiment of [Fig.6A],

[0242] With reference to [Fig.6C], another embodiment of a collection phase is described, during the journey having the identifier ID_S, of time-stamped discovery information from the terminals T_A and T_B. In this embodiment, the terminals T_A and T_B are provided with a short-range communication interface MCC and are thus able to detect the presence, in the vehicle V_A, of different equipment also provided with a short-range communication interface, such as the terminals or equipment Eb ..., EM illustrated in [Fig.l]. Such an embodiment can be implemented in addition to the embodiments described with reference to FIGS. 6A and 6B or alternatively.

[0243] For this purpose, at one location on the route, the following is implemented.

[0244] In S600c, one of the terminals T_A or T_B, for example T_B, detects the presence in the vehicle V_A of K equipment or terminals among Eb ..., EM.

[0245] In S601c, the application C_B then triggers the sending by the terminal T_B to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_B which includes the number K of equipment / terminals detected and their respective identifiers.

[0246] The equipment P receives the IDH1_B information in S602c and stores it in its STP memory in S603c.

[0247] In S604c, the terminal T_A in turn detects the presence in the vehicle V_A of L equipment or terminals among EH ..., EM.

[0248] In S605c, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_A which includes the number L of equipment / terminals detected and their respective identifiers.

[0249] The equipment P receives the IDH1_A information in S606c and stores it in its STP memory in S607c.

[0250] In the example shown:

[0251] - K can be equal to L and the equipment / terminals discovered by T_A, respec tively T_B, may be the same or not,

[0252] - K can be less than or greater than L.

[0253] The aforementioned actions are iterated at least once during the journey.

[0254] Thus:

[0255] In S608c, one of the terminals T_A or T_B, for example T_A, detects the presence in the vehicle V_A of Q equipment or terminals among EH ..., EM.

[0256] In S609c, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_A which includes the number Q of equipment / terminals detected and their respective identifiers.

[0257] The equipment P receives in S610c the information IDH2_A and stores it in its memory STP in S61 le.

[0258] In S612c, the terminal T_B in turn detects the presence in the vehicle V_A of R equipment or terminals among EH ..., EM.

[0259] In S613c, the application C_B then triggers the sending by the terminal T_B to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_B which includes the number R of equipment / terminals detected and their respective identifiers.

[0260] The equipment P receives in S614c the information IDH2_B and stores it in its STP memory in S615c.

[0261] In the example shown:

[0262] - Q can be equal to R and the equipment / terminals discovered by T_A, respec tively T_B, may be the same or not,

[0263] - Q can be less than or greater than R.

[0264] The sending actions S601c, S605c, respectively S609c, S613c, can be implemented in a different order, simultaneously or independently.

[0265] In the case where the sending actions S601c, S613c, respectively S605c, S609c, fail due for example to insufficient coverage or saturation of the RLP network, the application C_A, respectively C_B, triggers in S616c, S617c, respectively S618c, S619c, the temporary storage of the information IDH1_A, IDH2_A, respectively IDH1_B, IDH2_B in the memory STT of the terminals T_A and / or T_B, before triggering said sending actions again, once the coverage of the RLP network is re-established or the latter is no longer saturated.

[0266] With reference to [Fig.6D], an embodiment of a collection phase is described, during the journey having the identifier ID_S, of time-stamped discovery information from the terminals T_A and T_B. In this embodiment, the terminals T_A and T_B are not provided with a short-range communication interface MCC.

[0267] For this purpose, at one location on the route, the following is implemented.

[0268] In S600d, one of the persons A and B, preferably the person who is not driving, B in the example shown, restores information INF on his terminal T_B using the user interface IU. Such information INF may be previously stored in the memory STT of the terminal T_B or be generated on the fly by the terminal T_B. The information INF may be a graphic element such as for example an image, a textual element coded in an image, a QR code (“Quick Response Code” in English), or a sound element, such as for example a particular sound: music, the ambient sound in the vehicle V_A, etc.

[0269] In S601d, B requests A to capture the information INF from its terminal T_A.

[0270] In S602d, A captures the INF information via the user interface UI of its terminal T_A, a camera or a microphone depending on the type of INF information returned.

[0271] The sharing of the information INF between the two terminals T_A and T_B then corresponds to a phase of mutual discovery inside the vehicle V_A.

[0272] In S603d, the application C_B then triggers the sending by the terminal T_B to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_B which includes the information INF.

[0273] The equipment P receives the IDH1_B information in S604d and stores it in its STP memory in S605d.

[0274] In S606d, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_A which includes the information INF.

[0275] The equipment P receives in S607d the information IDH1_A and stores it in its STP memory in S608d.

[0276] The aforementioned actions are iterated at least once during the journey.

[0277] Thus:

[0278] In S609b, B renders information INF' on its terminal T_B using the user interface IU. Such information INF' may be the same as the information INF or different.

[0279] In S610d, B asks A to capture the information INF' from its terminal T_A.

[0280] In S61 Id, A captures the information INF' via the user interface IU of its terminal T_A, a camera or a microphone depending on the type of information INF' returned.

[0281] In S612d, the application C_B then triggers the sending by the terminal T_B to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_B which includes the information INF'.

[0282] The equipment P receives the IDH2_B information in S613d and stores it in its STP memory in S614d.

[0283] In S615d, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_A which includes the information INF'.

[0284] The equipment P receives the IDH1_A information in S616d and stores it in its STP memory in S617d.

[0285] The sending actions S606d, S615d, respectively S603d, S612d, can be implemented in a different order, simultaneously or independently.

[0286] In the case where the sending actions S606d, S615d, respectively S603d, S612d, fail due for example to insufficient coverage or saturation of the RLP network, the application C_A, respectively C_B, triggers in S618d, S619d, respectively S620d, S621d, the temporary storage of the information IDH1_A, IDH2_A, respectively IDH1_B, IDH2_B in the memory STT of the terminals T_A and / or T_B, before triggering said sending actions again, once the coverage of the RLP network is re-established or the latter is no longer saturated.

[0287] Time-stamped identity information collection phase

[0288] We will now describe with reference to [Fig.7A] an embodiment of a phase of collecting, during the journey having the identifier ID_S, time-stamped identity information from at least one of the terminals T_A and T_B, preferably the terminal of the person who is not driving, T_B in the example shown.

[0289] Such an embodiment is optional or not.

[0290] The implementation of such a phase is inspired by the following practical considerations and constraints:

[0291] - this involves certifying the promiscuity in the same passenger compartment of driver A and passenger B, which further strengthens the guarantee with regard to equipment P that persons A and B have indeed made the journey together;

[0292] - a terminal, typically that of person A, can, during the journey, be allocated to other uses, such as navigation assistance (computer program using GPS, etc.);

[0293] - it is not desirable that person A, who is driving, uses a locking mechanism tification of his presence which would affect his concentration while driving, such as for example taking a photo of himself with his terminal T_A, while the vehicle V_A is moving.

[0294] For this purpose, at a location on the route, the following is implemented, at a random or judiciously chosen time during the route when traffic conditions are favorable.

[0295] In S700a, the application C_B of the terminal T_B used by the person B, who is not driving, collects proof of the presence of B. Such proof consists of the generation of data DI_B identifying B.

[0296] The performance of step S700a is ensured by means known to those skilled in the art, previously agreed to by B and assuming:

[0297] - approval by B that the application C_B has access to the related capabilities of the terminal T_B within which this application is executed;

[0298] - the prior storage of identification data DI_BS of person B in the STT memory of the terminal T_B. Among these means, we can cite, but are not limited to:

[0299] - facial recognition;

[0300] - fingerprint recognition;

[0301] - recognition of a voice sample,

[0302] -etc.

[0303] In an exemplary embodiment, the application C_B of the terminal T_B invites B to pronounce the word “tartiflette”.

[0304] In S701a, the application C_B of the terminal T_B used by the person B who is not driving collects proof of the presence of A. Such proof consists of the generation of data DI_A identifying A.

[0305] In this embodiment, it is assumed that identification data DI_BS of person A have been previously stored in the memory STT of the terminal T_B.

[0306] The means used to identify A are the same as in step S700. Preferably, recognition of a voice sample will be implemented because it is the method that least affects A's concentration and / or motor skills.

[0307] In an exemplary embodiment, the application C_B of the terminal T_B invites A to pronounce the word “mountain”.

[0308] In S702a, the identification data DI_A and DI_B are stored in the memory STT of the terminal T_B.

[0309] In S703a, the identification data DI_B is compared with the identification data DI_BS of B which has been previously stored in the memory STT of the terminal T_B.

[0310] In the example shown, the word “tartiflette” DI_B is compared to previously recorded voice samples DI_BS.

[0311] At the end of the comparison, in S704a, the application C_B of the terminal T_B sends a notification NOTIF_B to the equipment P, via the RLP network, indicating to it whether DI_B=DI_BS or DI_B^DI_BS.

[0312] In S705a, the equipment P receives the notification NOTIF_B and stores in S706a the success (DI_B=DI_BS) or failure (DI B^DI BS) of this identification in its STP memory.

[0313] In S707a, the identification data DI_A is compared with the identification data DI_AS of A which has been previously stored in the memory STT of the terminal T_B.

[0314] In the example shown, the word “mountain” DI_A is compared to previously recorded voice samples DI_AS.

[0315] At the end of the comparison, in S708a, the application C_B of the terminal T_B sends a notification NOTIF_A to the equipment P, via the RLP network, indicating to it whether DI_A=DI_AS or DI_A^DI_AS.

[0316] In S709a, the equipment P receives the notification NOTIF_A and stores in S710a the success (DI_A=DI_AS) or failure (DI A^DI AS) of this identification in its STP memory.

[0317] An alternative embodiment of the embodiment of [Fig.7A] will now be described with reference to [Fig.7B].

[0318] The method according to this variant comprises steps S700b and S701b identical to steps S700a and S701a of [Fig.7A].

[0319] In S702b, the application C_B of the terminal T_B sends the identification data DI_A and DI_B to the equipment P, via the RLP network.

[0320] In S703b, the equipment P receives the identification data DI_A and DI_B and stores them in S704b in its STP memory.

[0321] In S705b, the identification data DI_B is compared with the identification data DI_BS of B which has been previously stored in the STP memory.

[0322] In the example shown, the word “tartiflette” DI_B is compared to samples previously recorded DI_BS voices.

[0323] In S706b, the equipment P stores, in its STP memory, the success (DI_B=DI_BS) or failure (DI_B^DI_BS) of the identification obtained at the end of this comparison.

[0324] In S707b, the identification data DI_A is compared with the identification data DI_AS of A which has been previously stored in the STP memory.

[0325] In the example shown, the word “mountain” DI_A is compared to previously recorded voice samples DI_AS.

[0326] In S708b, the equipment P stores, in its STP memory, the success (DI_A=DI_AS) or failure (DI_A^DI_AS) of the identification obtained at the end of this comparison.

[0327] The generation of such identification data DI_A and DI_B can be implemented once or several times. The potentially intrusive nature of the user experience, however, favors the generation of this data only once during the journey.

[0328] Phase of generating a level of confidence in the completion of a joint journey made by persons A and B

[0329] We now describe with reference to [Fig.8] an embodiment of a phase of generating a confidence level NC in the completion of the journey having the identifier ID_S.

[0330] For this purpose, when persons A and B arrive at their destination, at least one of persons A and B, or both, can declare in S80 the end of the journey to the equipment P.

[0331] To this end:

[0332] - A selects in S80_A the arrival point of the journey in the application C_A of the terminal T_A, using the UI, and / or

[0333] - B selects in S80_B the arrival point of the journey in the application C_B of the terminal T_B, using the UI.

[0334] In response to the selection action S80_A, respectively S80_B, the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG6_A, respectively MSG6_B, comprising:

[0335] - the coordinates (x',y') of the arrival point defined by geo coordinates (x',y') graphs, where x' and y' represent for example longitude and latitude respectively,

[0336] - the identifier(s) ID_T_A, respectively ID_T_B, associated with these protocols.

[0337] The transmission of this different information to the equipment P can be carried out without loss of generality in one or more requests. During this sending, related mechanisms for encrypting the messages MSG6_A, MSG6_B, for authenticating the persons A and B and / or the terminals T_A and T_B, which are known to those skilled in the art, can be implemented.

[0338] In S81, the equipment P receives the messages MSG6_A and MSG6_B via its MCP communication interface ([Fig.2]).

[0339] Steps S80 and S81 are optional, the equipment P being able to deduce from the information IGH1_A, IGH2_A, IGH1_B, IGH2_B, IDH1_A, IDH2_A, IDH1_B, IDH2_B, DI_A, DI_B, that the persons A and / or B are no longer making the journey having the identifier ID_S.

[0340] In S82, the equipment P then calculates a confidence level based on all of the following collected information:

[0341] - IGH1_A, IGH2_A,

[0342] - IGH1_B, IGH2_B, ..

[0343] - IDH1_A, IDH2_A, ..

[0344] - IDH1_B, IDH2_B,

[0345] - possibly DI_A, DI_B.

[0346] For this purpose, the equipment P determines whether all of this information is consistent with respect to a certain threshold criterion.

[0347] In one embodiment, the consistency between these different pieces of information is based on a weighting:

[0348] - applied to IGH1_A, IGH2_A,..., and IGH1_B, IGH2_B,...;

[0349] - [3 applied to IDH1_A, IDH2_A, ..., and IDH1_B, IDH2_B,...;

[0350] - y applied to DI_A, DI_B.

[0351] The weighting [3 may in particular be based on the percentage values ​​of the information relating to the success or failure of the discovery between the terminals T_A and T_B.

[0352] The generation of the confidence level NC takes into account the individual consistency of the information IGH1_A, IGH2_A,..., on the one hand, and of the information IGH1_B, IGH2_B,..., on the other hand.

[0353] For this purpose, the processing module MTI of the equipment P is configured to calculate, from the information IGH1_A, IGH2_A,..., respectively IGH1_B, IGH2_B,..., certain values, such as for example the distance traveled on the journey, the average speed of the vehicle V_A, the topology of the journey as a function of the calculated speeds, etc. and to deduce therefrom whether a level of consistency greater than a predefined threshold SP, for example 80%, is reached. If this is the case, the confidence level NC obtained makes it possible to generate in S83 a certificate CERT attesting that the journey having the identifier ID_S was indeed carried out jointly by the persons A and B. Otherwise, the certificate CERT is not generated.

[0354] The generation of the confidence level NC further takes into account the mutual consistency between the information IGH1_A and IGH1_B, IGH2_A and IGH2_B, etc. with respect to a predefined maximum distance threshold SP, for example 2.50m.

[0355] If it turns out, for example, that for all the pairs of information IGH1_A and IGH1_B, IGH2_A and IGH2_B, etc., 80% of the pairs respect a distance less than (or less than or equal to) 2.50m, the confidence level NC obtained makes it possible to generate in S83 a CERT certificate attesting that the journey having the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

[0356] The generation of the confidence level NC also takes into account, for each of the pieces of information IDH1_A, IDH2_A,..., and IDH1_B, IDH2_B,... received, the success or failure of the discovery between the terminals T_A and T_B. If it turns out, for example, that over all of this information received the number of successes exceeds a predefined threshold SP of, for example, 80%, the confidence level NC obtained makes it possible to generate in S83 a certificate CERT attesting that the journey having the identifier ID_S was indeed carried out jointly by the persons A and B. Otherwise, the certificate CERT is not generated.

[0357] In the embodiment of [Fig.6B], consistency may consist of verifying that the information IDH1_A and IDH1_B, as well as IDH2_A and IDH2_B are a function or not of the same value S of the challenge. If it turns out, for example, that all this information does indeed carry this value S, the confidence level NC obtained makes it possible to generate in S83 a CERT certificate attesting that the journey having the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

[0358] In the embodiment of [Fig.6D], consistency may consist of verifying that:

[0359] - the information IDH1_A and IDH1_B both carry the information INF,

[0360] - and that the information IDH2_A and IDH2_B both carry INF' information.

[0361] If this is the case, the confidence level NC obtained makes it possible to generate in S83 a CERT certificate attesting that the journey with the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

[0362] In the embodiment of [Fig.6C], the coherence may consist of:

[0363] - for the information IDH1_A and IDH1_B, to compare the numbers L and K of discovered Ei to EM equipment / terminals and their types,

[0364] - for the information IDH2_A and IDH2_B, to compare the numbers Q and R of discovered Ei to EM equipment / terminals and their types.

[0365] If for example L=0 and K=2, Q=3 and R= 1, with the same type of equipment / terminals discovered among Q and among R, the confidence level NC obtained in S82 is low and the CERT certificate will not be generated in S83, the predefined threshold SP being for example “no more than 1 equipment / terminal of difference discovered between the two terminals T_A and T_B.

[0366] By applying this same threshold SP, if for example L=2 and K=3, Q=4 and R=4, with the same type of equipment / terminals discovered among L and K and among Q and R, the confidence level NC obtained in S 82 is high and the CERT certificate will be generated in S83.

[0367] The generation of the confidence level NC can also take into account the result of the comparison made between the identification data DI_A and DI_AS, respectively DI_B and DI_BS, in connection with FIGS. 7A and 7B, to deduce therefrom a confidence level NC. If it turns out for example that DI_A=DI_AS and DI_B=DI_BS, the confidence level NC obtained makes it possible to generate in S83 a CERT certificate attesting that the journey having the identifier ID_S was indeed carried out jointly by the persons A and B. Otherwise, the CERT certificate is not generated.

[0368] The CERT certificate that was generated in S83 is then stored in S84 in the RPC register illustrated in [Fig.2].

[0369] Such a certificate may thus be transmitted to any authority or organization that wishes to have it. The transmission of the certificate to the authority / organization may be implemented in a conventional manner, for example by sending an electronic message containing the certificate as an attachment, by making the certificate available on a dedicated server, for example FTP ("File Transport Protocol" in English), by sending by mail a recording medium storing the certificate, for example a USB key ("Universal Serial Bus" in English), etc.

Claims

Claims

1. Method for controlling the presence of at least two people on board a vehicle, said vehicle traveling between two geographical positions, said two people using a first and a second respective communication terminal, characterized in that it comprises the following, during the journey: - collecting (S501, S505, S503, S507) in a communication network time-stamped non-personal geolocation information (IGH1_A, IGH1_B, IGH2_A, IGH2_B) generated by the first and second terminals between the two geographical positions, - collecting (S612a, S615a, S618a, S621a;S603c, S607c, S611c, S615c) in said network of time-stamped non-personal discovery information (IDH1_A, IDH1_B, IDH2_A, IDH2_B) which relates to a discovery of the presence in the vehicle, — by the first or second terminal, of the second or first terminal respectively, — or by the first and second terminal, of at least one other terminal or equipment, - depending on the geolocation and discovery information collected, calculating a confidence level (NC) making it possible to determine (S82, S83) whether or not the two persons have made the journey together between the two geographical positions.;

2. Control method according to claim 1, in which the time-stamped discovery information comprises an identifier (ID_S) associated with the journey and data representative of the failure or success of the discovery.

3. Control method according to claim 2, in which the identifier (ID_S) associated with the route comprises an identifier (ID_T_A; ID_A) associated with the first terminal and an identifier (ID_T_B; ID_B) associated with the second terminal.

4. Control method according to claim 2, in which the identifier (ID_S) associated with the path is an identifier received by said first and second terminals from a communication device, via said network, said identifier being a function of: - a first identifier (ID_T_A) of a short-range communication protocol associated with the first terminal (T_A), - a second identifier (ID_T_B) of said communication protocol short-range communication associated with the second terminal (T_B).

5. Control method according to claim 4, wherein during the discovery implemented by one of the two terminals, the first terminal, respectively the second terminal, identifies the second terminal, respectively the first terminal, using the second identifier (ID_T_B), respectively first identifier (ID_T_A), of the short-range communication protocol, the first and second identifiers having been received respectively by the second and first terminals from the communication equipment, via said network.

6. A control method according to claim 1 or claim 2, wherein the discovery of the presence in the vehicle of the first or second terminal comprises the sharing of information (INF, INF') between the first and second terminals, said shared information being transmitted in a time-stamped manner to the communication equipment, via said network, by the first and second terminals.

7. A control method according to any one of claims 1 to 6, wherein the discovery step is initiated by one of the first and second terminals in response to the reception (SOlb) by said terminal, from said communication equipment, of a data sequence, said sequence being sent (S602b) by said terminal to the other terminal during the discovery step, said sequence received by the other terminal being sent (S610b) by the other terminal to said communication equipment via said network, being associated with time-stamped discovery information.

8. Control method according to any one of claims 1 to 7, further comprising, during the journey, the implementation of a verification (S703a, S707a; S705b, S707b) of the identity of said at least two persons on board the vehicle.

9. A control method according to claim 8, wherein said identity verification comprises: - identifying (S700a), by one of said first and second terminals associated with one of the persons who is not driving, said person, generating first identification data, - identifying (S701a) the other person, whether or not driving the vehicle, using said terminal, generating second identification data, - comparing (S703a, S707a) the first and second identification data with respectively first and second data identification data previously stored in said communication equipment, - record (S706a, S710a) the result of the comparison in said equipment.

10. Communication equipment suitable for monitoring the presence of at least two people on board a vehicle, said vehicle traveling between two geographical positions, said two people using a first and a second respective communication terminal, characterized in that said equipment is configured to, during the journey: - collect in a communications network non-personal time-stamped geolocation information generated by the first and second terminals between the two geographical positions, - collect in said network non-personal discovery information time-stamped which relates to a discovery of the presence in the vehicle, — by the first or second terminal, from the second or first terminal respectively, — or by the first and second terminal, of at least one other terminal or equipment, - based on the geolocation and discovery information collected, calculate a confidence level (CN) to determine whether or not the two people traveled together between the two geographical positions.

11. Communication terminal adapted to control the presence of at least two people on board a vehicle, said vehicle making a journey between two geographical positions, said terminal being used by one of the two people, characterized in that said terminal is configured to, during the journey: - send non-personal time-stamped geolocation information generated by said terminal between the two geographical positions over a communications network, - send in said network non-personal discovery information time-stamped relating to a discovery by said terminal of the presence in the vehicle of another terminal or equipment, so as to calculate a confidence level (NC) making it possible to determine in said network whether the person using said terminal and another person using the other terminal have or have not made the journey in common between the two geographic positions, based on the geolocation and discovery information sent.

12. A computer program comprising program code instructions for implementing the control method according to any one of claims 1 to 9, when executed on a computer.

13. A computer-readable information medium comprising instructions of a computer program according to claim 12.

Images