Data anonymization in databases on servers

Abstract

To provide a method, device, and computer program for anonymizing data in a database on a server.SOLUTION: Data obtained from a vehicle are stored in a database of a server. A vehicle identification number is removed from the data in the database. At least one specific parameter included in the data in the database is changed to create anonymized data. Access to the anonymized data is provide to the user. One or more files for a simulation are created using the anonymized data.SELECTED DRAWING: Figure 4

Description

[Background technology]

[0001] Market demand for intelligent driving features is increasing, and safety is a critical influencing factor in gaining customer trust in intelligent driving. Safety testing includes field testing, public road performance verification, and virtual verification in the early stages of development. The degree of virtual scene simulation determines the comprehensiveness of safety performance verification for advanced driver-assistance systems (ADAS) and autonomous driving systems. The current development process for ADAS and autonomous driving systems requires going through MIL (Model-in-Loop), SIL (Software-in-Loop), HIL (Hardware-in-Loop), DIL (Driver-in-Loop), and VIL (Whole Vehicle-in-Loop). Driving scene libraries are a crucial part of the development process and are implemented throughout the process. Therefore, establishing comprehensive scenes that closely resemble real-world traffic environments is essential.

[0002] Autonomous Vehicle (AV) systems are complex and require robust testing and verification frameworks to support engineers. Well-defined processes and infrastructure are available for software development, especially for large developer bases, to avoid bugs in code and maintain quality over time. Automatic regression captured through continuous integration is a component that guarantees overall reliability by periodically testing relevant functions of software. Dynamic content of scenarios used in virtual test driving simulation can be described using OpenScenario files. OpenScenario provides a data model, specifications, and examples for describing dynamic content in driving simulation. OpenScenario is used in driving simulation, traffic simulation, virtual development, testing and verification of driving assistance functions, autonomous driving, and automated driving. OpenScenario files describe entities that are moving on or interacting with a road. Dynamic content of a scenario includes information such as maneuvers of traffic entities, for example, vehicles, pedestrians, infrastructure, edge devices, and bicycles.

[0003] Scenario files in OpenScenario format have various uses, including use in continuous integration (CI) testing and simulation in local / cloud environments. Continuous integration allows iterations to support system builds and the publication of deployment artifacts to an artifact repository. For example, a market data collection (MDC) server stores data acquired by vehicle sensors during operation. Access to this data is necessary to create OpenScenario files for simulation. However, the data in the database on the MDC server includes sensitive L4 (highly sensitive) data, i.e., PII (personally identifiable information), such as timestamp information. PII is any information about an individual that may be used to identify or track an individual's identifying information, and any other information that is linked to or can be linked to an individual. Therefore, L4 data in the MDC database is only accessible to users with special privileges, and OpenScenario files cannot be created based on data containing PII. [Overview of the project]

[0004] In at least one embodiment, a method for anonymizing data in a database on a server includes storing data obtained from a vehicle in the database, removing the vehicle identification number from the data in the database, and modifying at least one specific parameter contained in the data in the database in order to create anonymized data.

[0005] In at least one embodiment, the data anonymization device includes a memory for storing computer-readable instructions and a processor attached to the memory, the processor being configured to execute computer-readable instructions to modify at least one specific parameter contained in the data in the database in order to remove vehicle identification numbers from the data in the database stored on the server and create anonymized data.

[0006] In at least one embodiment, a computer program, when executed by a processor, causes the processor to perform actions to modify at least one specific parameter contained in the data in the database in order to store data obtained from a vehicle in a database, remove vehicle identification numbers from the data in the database, and create anonymized data. [Brief explanation of the drawing]

[0007] The aspects of this disclosure are best understood by reading the following detailed description with reference to the attached figures. Note that, in accordance with industry practice, various features are not depicted to scale. In fact, for clarity in the description, the dimensions of various features may be increased or decreased.

[0008] [Figure 1] Figure 1 is a flowchart of the process for generating and using a simulation file according to at least one embodiment. [Figure 2] Figure 2 is a schematic diagram of data anonymization according to at least one embodiment. [Figure 3] Figure 3 shows the operation of a vehicle data API according to at least one embodiment. [Figure 4] Figure 4 is a flowchart of a method for anonymizing data to create a simulation file according to at least one embodiment. [Figure 5] Figure 5 is a high-level functional block diagram of a processor-based system according to at least one embodiment. [Modes for carrying out the invention]

[0009] The embodiments described herein describe examples of implementing various features of the subject matter provided. For the sake of brevity of this disclosure, examples of components, values, operations, materials, arrangements, or similars are described below. Of course, these are examples and not intended to be limiting. Other components, values, operations, materials, arrangements, or similars are conceivable. For example, the formation of a first feature above or on a second feature in the following description includes embodiments in which the first and second features are formed in direct contact, and embodiments in which further features are formed between the first and second features so that the first and second features cannot make direct contact. In addition, this disclosure repeats reference numbers and / or reference letters in various examples. This repetition is for the sake of brevity and clarity and does not define relationships between the various embodiments and / or configurations described.

[0010] Furthermore, spatially relative terms such as “downward,” “below,” “below,” “upward,” “above,” and similar terms are used herein to facilitate explanation, describing the relationship of one element or feature to another element or feature as shown in the figures. Spatially relative terms are intended to encompass various orientations of the device during use or operation, in addition to the orientation depicted in the figures. The device may have different orientations (90-degree rotation or other orientations), and the spatially relative descriptions used herein are interpreted accordingly.

[0011] Terms such as “User Equipment,” “Mobile Station,” “Mobile,” “Mobile Device,” “Subscriber Station,” “Subscriber Equipment,” “Access Terminal,” “Terminal,” and “Headset,” and similar terms, refer to wireless devices used by subscribers or users of wireless communication services to receive or transmit data, control, voice, video, audio, games, data streaming, or signaling streaming. These terms are interchangeable in the subject matter specification and related drawings. Terms such as “Access Point,” “Base Station,” “Node B,” “Evolved Node B (eNode B),” “Next Generation Node B (gNB),” “Enhanced gNB (en-gNB),” “Home Node B (HNB),” and “Home Access Point (HAP),” or similar terms, refer to wireless network components or devices that supply and receive data, control, voice, video, audio, games, data streaming, or signaling streaming from the UE.

[0012] In at least one embodiment, a method for anonymizing data in a database on a server includes storing data obtained from a vehicle in a database on the server, removing the vehicle identification number from the data in the database, and modifying at least one specific parameter contained in the data in the database in order to create anonymized data.

[0013] Embodiments described herein provide methods that offer one or more advantages. For example, a vehicle data application programming interface (API) anonymizes data stored in a database on a server by transforming highly sensitive data into anonymized and protected data by modifying at least one specific parameter contained in the data in the database.

[0014] Figure 1 is a flowchart of the process for generating and using a simulation file 100 according to at least one embodiment.

[0015] In Figure 1, reports / data are acquired from the test vehicle (110). Files such as simulation files are generated based on the reports acquired from the test vehicle (120). Based on these files, test engineers and application developers can use the simulation platform 130 to test applications in closed software-in-the-loop (SIL) testing without accessing a real vehicle. The simulation platform 130 is used to simulate sensor and ground truth data for the test vehicle and its surrounding virtual environment.

[0016] Reports / data from test vehicles are stored as data in a database on a server, such as a Market Data Collection (MDC) server. The data can be raw or pre-processed. The data is acquired by the vehicle's sensors during operation. However, the data in the database on the server includes sensitive (highly sensitive) data, such as timestamp information, i.e., PII (Personally Identifiable Information). PII is any information about an individual, including any information that can be used to identify or track an individual's identifying information, and any other information that is linked to or can be linked to an individual. Therefore, sensitive data in the database is accessible only to users with special privileges, and simulation files, such as OpenScenario files, cannot be created based on data containing PII. To create a simulation file, at least one embodiment modifies at least one specific parameter contained in the data in the database to remove the vehicle identification number from the data in the database and create anonymized data. Requests for data acquisition are received through a Vehicle Data Application Programming Interface (API).

[0017] Figure 2 is a schematic diagram of data anonymization 200 according to at least one embodiment.

[0018] In Figure 2, sensitive data 210 containing personally identifiable information is acquired from the vehicle and stored in the server 214 as data 212, for example, hash data. Data 212 can be raw data or pre-processed data. The data 212 in the server 214 is data acquired by the vehicle's sensors during driving and has not passed through the data lens 216 for processing before being provided to the server 214. The data lens 216 allows a user 218 with access rights to search, explore, and interact with the data 212 in the server 214. The vehicle API has access rights to the data 212. In the context of autonomous driving technology, “vehicle” is a term used to describe an autonomous vehicle equipped with sensors, cameras, and other technologies that enable the autonomous vehicle to perceive its environment and make decisions. Thus, the term “auto” in this context refers to the vehicle being egocentric or self-referential, meaning that the vehicle perceives the world primarily from its own perspective. The vehicle's sensors and cameras are focused on detecting objects and obstacles in its immediate vicinity, which is used to provide safe navigation. Users 218 with access rights have an authorization threshold determined by the confidentiality of the data. For example, some users have access rights to the data in the server 214 via the vehicle API. Before anonymization, the data 212 on the server 214 includes a combination of GPS location or coordinate data, a timestamp, and vehicle identification information (ID) that allows a specific user to be identified. To make the anonymized data 232 available, data without personally identifiable information (PII) is provided to users 240 who do not have access authorization. Thus, users 240 who do not have access authorization can request a subset of the data 212 in the database on the server 214. The vehicle data API 218 processes the event data 216 to anonymize the data in the server 214 in order to create the anonymized data 232. The data 212 can be raw data or data that has been processed before anonymization.The anonymized data is anonymized and protected data that does not include the Vehicle Identification Number (VIN), absolute time, or video / images.242

[0019] Without the vehicle data API 218 for anonymizing data 212, i.e., highly sensitive data 220, the data 212 on the server 214 will still have a timestamp in absolute time, and therefore, a user cannot create a file using the data unless they have a high level of access authorization.

[0020] Removing the user vehicle ID from data 212 makes user identification difficult, but user identification is still possible based on location and timestamp in data 212. For example, GPS location, along with timestamp, can be used to identify users who have passed through a specific area, potentially compromising user information.

[0021] Therefore, in order to create a file, at least one embodiment provides a vehicle data API 218, which retrieves data 212 and converts the data 212 in the server 214 into anonymized data 232 by modifying at least one specific parameter included in a subset of the data 212 in the server 214. Requests for data retrieval for the data in the server 214 are received from the vehicle data API 218. The vehicle data API 218 retrieves data 212 taken in from a test vehicle through its own vehicle API. Thus, the vehicle data API 218 enables the user to find and use the desired anonymized data 232.

[0022] Vehicle identification numbers are removed from data 212. Data 212 is anonymized by modifying at least one specific parameter in data 212 within server 214 in order to create anonymized data 232. Highly sensitive data 220 is modified into anonymized data 232 to reduce access restrictions for users. Modifying at least one specific parameter included in a subset of data 212 involves changing the timestamp value of the first frame from the frame in the data to set the timestamp value of the first frame (e.g., the first event) in a subset of data 212 to time 0, such that subsequent frames in at least one subset of data have an offset relative to the first frame. Thus, when a user does not have access to sensitive data, privileges for the user can be reduced.

[0023] Anonymized data 232 is created using remaining GPS coordinates that provide information about a vehicle passing through a specific time and place. Anonymized data 232 is created using vehicle motion and location data. Anonymized data 232 is created using vehicle motion and location data including speed data, acceleration data, latitude data, longitude data, orientation data, and relative time offset. The vehicle data API 218 provides access to vehicle motion and location data. The created anonymized data 232 may include one or more of the following: weather data or terrain data.

[0024] Anonymized data 232 is used to generate scenario data that is used to create simulation data 234 relating to a file 236. The file 236 is stored in a database (DB) 238. Accordingly, a user who does not have access authorization can access the data in DB 238, while only a user having access authorization can access data 212 in a server 214. As shown in FIG. 2, the process associated with highly confidential data 220 for acquiring data relating to a new dataset or API is generally 1 to 3 months 250. The process for creating anonymized data 230 that does not contain PII is generally 1 to 2 weeks 260. However, those skilled in the art will recognize that these timeframes are provided by way of example, and the embodiments described herein are not limited to the timeframes of the present disclosure.

[0025] FIG. 3 is a diagram illustrating the operation of a vehicle data API 300 according to at least one embodiment.

[0026] In FIG. 3, a host vehicle API 310 provides (312) access to vehicle motion and position data. FIG. 3 shows a vehicle 330 relative to other vehicles 332, 334, and 336. The vehicle motion and position data include vehicle speed 320, vehicle acceleration 322, vehicle location 324 (e.g., latitude and longitude coordinates of the vehicle), vehicle orientation 326 (e.g., yaw, yaw rate, pitch, and roll data relating to the vehicle), and a relative time offset 328.

[0027] The Actor Data API 340 provides data about objects around the vehicle (e.g., other passenger cars, pedestrians, infrastructure, edge devices, etc.) (342). Figure 3 shows vehicle 360, and the data for other vehicles 362, 364, 366 (actors 370) obtained by the Actor Data API 340 is obtained by the Actor Data API 340. The data obtained by the Actor Data API 340 about objects around the vehicle includes the relative position of the surrounding vehicles 350, the orientation of the surrounding vehicles (e.g., yaw) 352, the relative velocity of the surrounding vehicles 354, the relative acceleration of the surrounding vehicles 356, and similar.

[0028] Data acquired from the test vehicle by the Vehicle API 310 and the Actor Data API 340 is stored in a database on the server. The data stored on the server can be raw data or pre-processed data. However, the data in the database on the server includes sensitive data such as timestamp information, i.e., PII (Personally Identifiable Information). PII is any information about an individual, including any information that can be used to identify or track an individual's identifying information, and any other information that is linked to or can be linked to an individual. Therefore, sensitive data in the server's database is accessible only to users with special privileges, and files cannot be created based on data containing PII. To create a file for simulation, the event data in at least one embodiment of the database on the server is anonymized data obtained by modifying at least one specific parameter included in a subset of the data in the database on the server. Requests for data acquisition for a subset of the data in the database on the server are received from the Vehicle Data API 380.

[0029] Connected cars or autonomous vehicles (AVs) use wireless communication technology to exchange information with other vehicles, edge devices, and infrastructure. Other vehicles, edge devices, and infrastructure deliver various road and surrounding information related to autonomous driving, along with vehicle sensor data. For example, AVs can receive data wirelessly from other vehicles, edge devices, and infrastructure. As described above, the vehicle API 310 provides access to data on the vehicle's motion and location (312), and the actor data API 340 provides data on objects around the vehicle (e.g., other passenger cars, pedestrians, infrastructure, edge devices, etc.) (342).

[0030] Sensor data acquired by AVs and data acquired from other vehicles and infrastructure can be used by AVs for autonomous driving. Other vehicles and infrastructure that transmit data to AVs are sometimes collectively referred to as edge devices. Sensors in AVs include devices such as radar, LiDAR, GPS, cameras, and similar devices. In addition, sensor data acquired by AVs and data acquired from edge devices can be transmitted to servers such as MDC servers. Data is transmitted from edge devices to AVs, and data transmitted by AVs can be transmitted wirelessly using radio protocols such as 5G New Radio (NR), 4G Long-Term Evolution (LTE), LTE-A, Global Interoperability Microwave Access (WiMAX), IEEE 802.11, Wi-Fi Wireless Local Area Network (WLAN), Unlicensed LTE (LTE-U), Licensed Auxiliary Access (LAA), Cellular Device-to-Device (D2D), Vehicle-to-Everything (V2X), Bluetooth, General Purpose Packet Radio Service (GPRS), Wideband Code Division Multiple Access (WCDMA) (registered trademark), or other wireless communication technologies.

[0031] The Vehicle Data API 380 anonymizes data from the Vehicle API 310 and the Actor Data API 340 (382). The Vehicle Data API 380 provides a standardized and documented data model (384) and abstracts complex diffuse data schemas (386). The Vehicle Data API 380 improves data quality by selecting the best available sensor data (e.g., yaw, yaw rate, SPI, and CAN) (388).

[0032] Referring again to Figure 2, the vehicle data API 218 anonymizes the data 212 from the server 214 to generate anonymized data 232. As a result, the absolute time of the event cannot be derived, and therefore, other time-related information cannot be used to infer specific user data because the anonymized data is not sufficient to identify the user or the exact time the event occurred.

[0033] Removing timestamps and vehicle IDs anonymizes the user, allowing the simulation to use frames with a time offset, i.e., delta time. GPS location data can be used to recreate the vehicle's trajectory. Therefore, based on the anonymized data, the simulation team works using file 236 to create a specification that describes what happened with the vehicle, for example, to accurately reproduce what the vehicle did in real life. The anonymized data 232 is anonymized from data 212 from server 214, so it cannot be traced back to the user.

[0034] Since geographical location is important for simulations that use geographical data to determine the overall orbital shape, removing or altering location data is undesirable. The anonymized data 232 created will include geographical context information. Other factors relevant to the simulation include weather. Another factor is specific terrain that can influence the overall shape of the orbit. Therefore, instead of removing timestamps, GPS locations may be altered. However, this is more complex than providing anonymization by removing timestamp information.

[0035] The purpose of the simulation is to analyze how a vehicle responds to a specific situation. Absolute GPS is used to link geographical contextual information, such as weather. When dealing with absolute GPS coordinates, it is possible to include external data about what the vehicle itself detects, such as rain data. When the data is anonymized by the vehicle data API 218 to generate anonymized data 232, the weather data is accessible because it resides in a database maintained by the server 214.

[0036] The anonymized data 232 is used to generate simulation data 234, which is used to create a file 236, for example, a simulation file. File 236 is stored in a database (DB) 238. Therefore, users without access authorization can access the data in DB 238, while only users with access authorization can access the data 212 (L4 data) on server 214. The anonymized data 232 is anonymized and protected data 242.

[0037] Figure 4 is a flowchart 400 of a method for anonymizing data to create a simulation file according to at least one embodiment.

[0038] In Figure 4, the process begins (S402), and the data acquired from the vehicle is stored in the server's database (S410). Referring to Figure 2, confidential data 210 containing personally identifiable information is acquired from the vehicle and stored in the server 214 as data 212, for example, hash data. Data 212 can be raw data or pre-processed data. The data 212 in the server 214 is data acquired by the vehicle's sensors during driving and has not passed through the processing data lens 216 before being provided to the server 214.

[0039] Requests for data retrieval are received from the user (S420). Referring to Figure 2, requests for data retrieval for data in server 214 are received from vehicle data API 218. Vehicle data API 218 retrieves data 212 taken in from the test vehicle through its own vehicle API. Thus, vehicle data API 218 enables the user to find and use the desired anonymized data 232.

[0040] The vehicle identification number is removed from the data (S430). Refer to Figure 2, where the vehicle identification number is removed from the data.

[0041] Referring to Figure 3, data acquired from the test vehicle by the vehicle API 310 and actor data API 340 is stored in a database on the server. The data stored on the server can be raw data or pre-processed data. However, the data in the database on the server includes sensitive data such as timestamp information, i.e., PII (Personally Identifiable Information). PII is any information about an individual that can be used to identify or track an individual's identifying information, and any other information that is linked to or can be linked to an individual. Therefore, sensitive data in the database on the server is accessible only to users with special privileges, and files cannot be created based on data that includes PII.

[0042] At least one specific parameter in at least one subset of the data is modified to create anonymized data (S440). Referring to Figure 2, the vehicle data API 218 takes in data 212 taken from a test vehicle through its own vehicle API. Thus, the vehicle data API 218 enables the user to find and use the desired anonymized data 232. The vehicle identification number is removed from the data. Data 212 is anonymized by modifying at least one specific parameter in data 212 within the server 214 to create anonymized data 232. Highly sensitive data 220 is modified into anonymized data 232 to reduce access restrictions for the user. The modification of at least one specific parameter in a subset of data 212 includes changing the timestamp value of the first frame from the frame in the data to set the timestamp value of the first frame (e.g., the first event) in the subset of data 212 to time 0, so that subsequent frames in at least one subset of the data have a relative offset from the first frame. Thus, when the user does not have access to sensitive data, the privileges for the user can be reduced. Anonymized data 232 is created using remaining GPS coordinates that provide information about a vehicle passing through a specific time and place. Anonymized data 232 is created using vehicle motion and position data. Anonymized data 232 is created using vehicle motion and position data, including velocity data, acceleration data, latitude data, longitude data, orientation data, and relative time offset. The vehicle data API 218 provides access to vehicle motion and position data. The created anonymized data 232 may include one or more of weather data or terrain data. The created anonymized data 232 includes geographic context information. Other factors relevant to the simulation include weather. Another factor is specific terrain that can affect the overall shape of the trajectory. Therefore, instead of removing the timestamp, the GPS position may be altered. However, this is more complex than providing anonymization by removing timestamp information.The purpose of the simulation is to analyze how a vehicle responds to a specific situation. Absolute GPS is used to link geographical contextual information, such as weather. When dealing with absolute GPS coordinates, it is possible to include external data about what the vehicle itself detects, such as rain data. When the data is anonymized by the vehicle data API 218 to generate anonymized data 232, the weather data is accessible because it resides in a database maintained by the server 214.

[0043] User access to at least one anonymized subset of the data is provided (S450). Referring to Figure 2, in order to make the anonymized data 232 available, data without personally identifiable information (PII) is provided to user 240 who does not have access authorization. Thus, user 240 who does not have access authorization can make a request to retrieve data 212 in the database at server 214.

[0044] A simulation file is created using at least one anonymized subset of the data (S460). Referring to Figure 2, the anonymized data 232 is used to generate simulation data, which is used to create simulation data 234 for the simulation file, for example, file 236. File 236 is stored in database (DB) 238. Based on the anonymized data, the simulation teamwork uses file 236 to create a specification that describes what happened with the vehicle, for example, to accurately reproduce what the vehicle did in real life.

[0045] Next, the process terminates (S470).

[0046] At least one embodiment of a method for anonymizing data in a database on a server includes storing data obtained from a vehicle in a database on the server, removing vehicle identification numbers from the data in the database, and modifying at least one specific parameter contained in the data in the database in order to create anonymized data.

[0047] Figure 5 is a high-level functional block diagram of a processor-based system 500 according to at least one embodiment.

[0048] A processing circuit 500 anonymizes data to create a simulation file for creating a vehicle test simulation, in at least one embodiment. The processing circuit 500 implements data anonymization for creating a simulation file using a processor 502. The processing circuit 500 also includes a non-temporary computer-readable storage medium 504 used to anonymize data for creating a simulation file. In particular, the non-temporary computer-readable storage medium 504 stores an instruction 506, i.e., encoded in computer program code, which is executed by the processor 502 to cause the processor 502 to perform an operation to anonymize data for creating a simulation file. The execution of the instruction 506 by the processor 502 (at least in part) represents an application that implements at least a portion of the methods described herein (hereinafter, the described processes and / or methods) according to one or more embodiments.

[0049] The processor 502 is electrically connected to a non-temporary computer-readable storage medium 504 via a bus 508. The processor 502 is electrically connected to an input / output (I / O) interface 510 via the bus 508. The network interface 512 is also electrically connected to the processor 502 via the bus 508. The network interface 512 is connected to a network 514, and as a result, the processor 502 and the non-temporary computer-readable storage medium 504 are connected to external elements via the network 514. The processor 502 is configured to execute instructions 506 encoded in the non-temporary computer-readable storage medium 504 in order to make the processing circuit 500 available to perform at least a part of a process and / or method. In one or more embodiments, the processor 502 is a central processing unit (CPU), a multiprocessor, a distributed processing system, an application-specific integrated circuit (ASIC), and / or a preferred processing unit.

[0050] The processing circuit 500 includes an I / O interface 510. The I / O interface 510 is connected to an external circuit. In one or more embodiments, the I / O interface 510 includes a keyboard, keypad, mouse, trackball, trackpad, touchscreen, and / or cursor directional keys for communicating information and commands to the processor 502.

[0051] The processing circuit 500 also includes a network interface 512 connected to the processor 502. The network interface 512 allows the processing circuit 500 to communicate with a network 514 to which one or more other computer systems are connected. The network interface 512 includes a wireless network interface, such as Bluetooth, Wi-Fi, Worldwide Interoperability Microwave Access (WiMAX), General Purpose Packet Radio Service (GPRS), or Broadband Code Division Multiple Access (WCDMA), or a wired network interface, such as Ethernet, Universal Serial Bus (USB), or IEEE 864.

[0052] The processing circuit 500 is configured to receive information through the I / O interface 510. The information received through the I / O interface 510 includes one or more of the following: instructions, data, design rules, cell libraries, and / or other parameters processed by the processor 502. The information is transmitted to the processor 502 via the bus 508. The processing circuit 500 is also configured to receive information related to the user interface (UI) through the I / O interface 510. The information (e.g., sensitive data / anonymized data) 522 is stored in a non-temporary computer-readable storage medium 504 as the UI 520.

[0053] In one or more embodiments, one or more non-temporary computer-readable storage media 504 store (in compressed or uncompressed form) instructions 506 that can be used to program a computer, processor, or other electronic device to perform a process or method described herein. One or more non-temporary computer-readable storage media 504 include one or more electronic storage media, magnetic storage media, optical storage media, quantum storage media, or the same.

[0054] For example, non-temporary computer-readable storage media 504 may include, but are not limited to, hard drives, floppy disks, optical disks, read-only memory (ROM), random access memory (RAM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, magnetic or optical cards, solid-state memory devices, or other types of physical media suitable for storing electronic instructions. In one or more embodiments using optical disks, one or more non-temporary computer-readable storage media 504 include compact disk read-only memory (CD-ROM), compact disk read / write (CD-R / W), and / or digital video discs (DVD).

[0055] In one or more embodiments, the non-temporary computer-readable storage medium 504 stores instructions 506 configured to cause the processor 502 to perform at least part of a process and / or method for anonymizing data in order to create a simulation file. In one or more embodiments, the non-temporary computer-readable storage medium 504 also stores information such as algorithms that facilitate performing at least part of a process and / or method for anonymizing data in order to create a simulation file.

[0056] Therefore, in at least one embodiment, the processor 502 executes instructions 506 stored in one or more non-temporary computer-readable storage media 504 to anonymize data in order to create a simulation file. The processor 502 retrieves sensitive data 532 from the vehicle. The processor 502 stores the sensitive data 532 on the server 530 in a database. The sensitive data 532 is raw data or pre-processed data. The processor 502 presents a vehicle data API 586, which is used to access the sensitive data 532 in the database on the server 530. The processor 502 executes a data retrieval request 540 for the data. Based on the data retrieval request 540, the processor 502 creates anonymized data 580 by removing the vehicle identification number from the data 532 and modifying at least one specific parameter in the data 522. An anonymized subset of data 580 includes at least one of the following: GPS coordinate data 581 providing the vehicle's time and location; vehicle motion and position data 582 (e.g., velocity data, acceleration data, latitude data, longitude data, orientation data, and relative time offset); vehicle trajectory 583; weather or terrain data 584; or geographic context information 585. Processor 502 uses the anonymized data 580 to create a file 570 for simulation based on the anonymized data. Processor 502 obtains a timestamp value 550 for the first frame, then sets the first frame to time 0, and the next frame has a relative offset from the first frame (560).

[0057] The processor 502 presents a user interface (UI) 592 using a display 590, and the UI 592 displays sensitive data / anonymized data 594. The UI 592 allows the user to create anonymized data 580 by modifying at least one parameter contained in the sensitive data 532.

[0058] Embodiments described herein provide methods that offer one or more advantages. For example, a vehicle data API anonymizes data stored in a database on a server to create simulation files by transforming highly sensitive data into anonymized and protected data by modifying at least one specific parameter contained in the data.

[0059] Aspects of this specification relate, for example, to a method for anonymizing data in a database on a server using a processor [1], which includes storing data obtained from a vehicle in a database on a server, removing vehicle identification numbers from the data in the database, and modifying at least one specific parameter contained in the data in the database in order to create anonymized data.

[0060] [2]: The methods described in [1] further include creating one or more files for simulation using anonymized data.

[0061] [3]: The methods described in either [1] or [2] further include receiving a request for data retrieval and providing access to anonymized data.

[0062] [4]: Receiving requests for data retrieval is the method described in [3], which includes receiving requests from an application programming interface (API) that has access rights to the server.

[0063] [5]: At least one specific parameter is a timestamp value, in a manner described in any one of [1] through [4].

[0064] [6]: A method of modifying a timestamp value, as described in [5], which includes modifying the timestamp value of the first frame from a frame in a subset of data so that the timestamp value of the first frame is time 0, with the next frame in the subset of data having a relative offset from the first frame.

[0065] [7]: The creation of anonymized data includes creating anonymized data using motion and position data of a vehicle, wherein the motion and position data includes at least one of velocity data, acceleration data, latitude data, longitude data, orientation data, or relative time offset, in any of the manner described in any one of [1] to [6].

[0066] Aspects of this specification relate to a device for anonymizing data in a database on a server [8], which includes a memory for storing computer-readable instructions and a processor connected to the memory, wherein the processor is configured to perform operations by executing computer-readable instructions to modify at least one specific parameter contained in the data in the database in order to remove vehicle identification numbers from the data in the database stored on the server and create anonymized data.

[0067] [9]: The processor is further configured to create one or more files for simulation using anonymized data, as described in [8].

[0068]

[10] : The processor is further configured to receive requests for data acquisition and to provide access to anonymized data, as described in [8] or [9].

[0069]

[11] : The processor is further configured to receive requests for data retrieval from an application programming interface (API) that has access rights to a database on the server, as described in

[10] .

[0070]

[12] : At least one specific parameter is a device listed in any of [8] through

[11] , including a timestamp value.

[0071]

[13] : The data stored in the database includes a subset of the data, and the processor is configured to modify the timestamp values ​​by changing the timestamp value of the first frame from the frames in the subset of the data, so that the next frame in the subset of the data has a relative offset from the first frame, by setting the timestamp value of the first frame to time 0, as described in any of [8] to

[12] .

[0072]

[14] : The processor is further configured to create anonymized data by creating anonymized data using the motion and position data of the vehicle, wherein the motion and position data includes at least one of velocity data, acceleration data, latitude data, longitude data, orientation data, or relative time offset, as described in any one of [8] to

[13] .

[0073] Aspects of this specification relate to computer programs

[15] that, when executed by a processor, cause the processor to perform an action, the action including storing data obtained from a vehicle in a database on a server, removing vehicle identification numbers from the data in the database, and modifying at least one specific parameter contained in the data in the database in order to create anonymized data.

[0074]

[16] : A computer program described in

[15] , which further includes creating a file for simulation using anonymized data.

[0075]

[17] : A computer program as described in either

[15] or

[16] , further comprising receiving requests for data retrieval and providing access to anonymized data.

[0076]

[18] : A computer program described in any one of

[15] through

[17] , which includes at least one specific parameter, including a timestamp value.

[0077]

[19] : A computer program described in

[18] that modifies a timestamp value, which in a subset of data modifies the timestamp value of the first frame from a frame in the subset of data so that the next frame in the subset of data has a relative offset from the first frame, and sets the timestamp value of the first frame to time 0.

[0078]

[20] : The creation of anonymized data comprises creating anonymized data using motion and position data of a vehicle, wherein the motion and position data includes at least one of velocity data, acceleration data, latitude data, longitude data, orientation data, or relative time offset, as described in any one of

[15] to

[19] .

[0079] Separate instances of these programs may run on any number of separate computer systems or be distributed among them. Therefore, while certain steps are described as being performed by a specific device, software program, process, or entity, this is not necessarily required. Various alternative implementations will be understood by those skilled in the art.

[0080] Furthermore, it will be readily apparent to those skilled in the art that the above-described technologies can be used in a variety of devices, environments, and situations. While the embodiments are described in terms specific to structural features or actions of methods, the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described. Rather, specific features and actions are disclosed as exemplary forms that implement the claims.

Claims

1. A method for anonymizing data in a database on a server using a processor, The data acquired from the vehicle is stored in a database on the server, Removing the vehicle identification number from the data in the aforementioned database, To create anonymized data, at least one specific parameter included in the data in the database is modified, Includes, The modification of the at least one specific parameter includes changing the timestamp value. A method for modifying the timestamp value, comprising modifying the timestamp value of the first frame from a frame in the subset of data, such that the next frame in the subset of data has a relative offset from the first frame.

2. The further includes creating one or more files for simulation using the anonymized data, The method according to claim 1.

3. Receiving requests for data acquisition, To provide access to the anonymized data, This also includes, The method according to claim 1 or claim 2.

4. The reception of the request for data acquisition includes receiving the request from an application programming interface (API) that has access rights to the database on the server. The method according to claim 3.

5. The modification of the timestamp value includes modifying the timestamp value of the first frame from the frames in the subset of the data so that the timestamp value of the first frame is set to time 0, such that the next frame in the subset of the data has a relative offset from the first frame. The method according to claim 1 or claim 2.

6. The creation of the anonymized data includes creating the anonymized data using the motion and position data of the vehicle, wherein the motion and position data includes at least one of velocity data, acceleration data, latitude data, longitude data, orientation data, or relative time offset. The method according to claim 1 or claim 2.

7. A device that anonymizes data in a database on a server, Memory for storing computer-readable instructions, A processor connected to the aforementioned memory, The processor is equipped with the above, and performs operations by executing the computer-readable instructions. Remove the vehicle identification number from the data in the database stored on the aforementioned server. It is configured to modify at least one specific parameter included in the data in the database in order to create anonymized data. The aforementioned at least one specific parameter includes a timestamp value, The device wherein the data stored in the database includes a subset of the data, and the processor is further configured to modify the at least one specific parameter by changing the timestamp value of the first frame from a frame in the subset of the data, such that the next frame in the subset of the data has a relative offset from the first frame.

8. The processor is further configured to create one or more files for simulation using the anonymized data. The device according to claim 7.

9. The aforementioned processor further, Received a request to retrieve data. It is configured to provide access to the anonymized data. The device according to claim 7 or claim 8.

10. The processor is further configured to receive the requests for data retrieval from an application programming interface (API) that has access rights to the database on the server. The device according to claim 9.

11. The processor is further configured to modify the at least one specific parameter by changing the timestamp value of the first frame from the frames in the subset of data so that the next frame in the subset of data has a relative offset from the first frame, and setting the timestamp value of the first frame to time 0. The device according to claim 7 or claim 8.

12. The processor is further configured to create the anonymized data by using vehicle motion and position data, wherein the motion and position data includes at least one of velocity data, acceleration data, latitude data, longitude data, orientation data, or relative time offset. The device according to claim 7 or claim 8.

13. A computer program that, when executed by a processor, causes the processor to perform an action, wherein the action is: The data acquired from the vehicle is stored in a database on the server, Removing the vehicle identification number from the data in the aforementioned database, To create anonymized data, at least one specific parameter included in the data in the database is modified, Includes, The aforementioned at least one specific parameter includes a timestamp value, A computer program that modifies the timestamp value, such that the next frame in the subset of data has a relative offset from the first frame, wherein the modification of the timestamp value involves modifying the timestamp value of the first frame from a frame in the subset of data.

14. The further step includes creating a file for simulation using the anonymized data, The computer program according to claim 13.

15. Receiving requests for data acquisition, To provide access to the anonymized data, This also includes, The computer program according to claim 13 or claim 14.

16. The modification of the timestamp value includes modifying the timestamp value of the first frame from the frames in the subset of the data so that the timestamp value of the first frame is set to time 0, such that the next frame in the subset of the data has a relative offset from the first frame. The computer program according to claim 13 or claim 14.

17. The creation of the anonymized data includes creating the anonymized data using the motion and position data of the vehicle, wherein the motion and position data includes at least one of velocity data, acceleration data, latitude data, longitude data, orientation data, or relative time offset. The computer program according to claim 13 or claim 14.

Images