DE102014224202A1 - A method for providing vehicle data of a vehicle, method for evaluating vehicle data of at least one vehicle and method for monitoring a traffic event - Google Patents

Abstract

The invention relates to a method for providing vehicle data (262) of a vehicle (140). In this case, the method can be carried out by means of a supply device (130) arranged in-vehicle. The method has a step of reading in vehicle data (262) detected by means of at least one detection device (242) of the vehicle (140). Also, the method comprises a step of generating a data message comprising the read vehicle data (262). The method also includes a step of providing the generated data message with at least one digital signature to generate an authenticated data message (264). Furthermore, the method comprises a step of outputting the authenticated data message (264) to a transmission interface (244) in order to provide the vehicle data (262) to an external evaluation device.

Description

State of the art

The present invention relates to a method for providing vehicle data of a vehicle, to a method for evaluating vehicle data of at least one vehicle, to a method for monitoring a traffic event, to a corresponding device or to a corresponding system and to a corresponding computer program.

It is possible that the automated driving, and in particular the highly automated driving, is allowed by the legislature initially only on defined routes or sections of track. This may require a legal framework for the resolution of accidents involving highly automated vehicles. A legal requirement for the introduction of accident data recorders for automated driving is likely. The DE 100 59 679 A1 discloses an accident diagnostic system that wirelessly transmits the data of an accident data recorder to a portable base unit that can be used by a person to read the accident data.

Disclosure of the invention

Against this background, with the approach presented here, a method for providing vehicle data of a vehicle, a method for evaluating vehicle data of at least one vehicle, a method for monitoring a traffic event, furthermore a device or a system with devices that are designed to all Perform steps of such a method, and finally presented a corresponding computer program according to the main claims. Advantageous embodiments emerge from the respective subclaims and the following description.

According to embodiments of the present invention, in particular a vehicle data recorder or a vehicle data recorder functionality can be realized with a highly available cloud connection for storing sensor and status data as well as operator interventions. For example, an insert may be provided in combination with semi-automated, fully automated or highly automated driving. Such a vehicle data recorder or such vehicle data recorder functionality may, but not exclusively, be applied to such route sections, sections or road sections that are released in a regulatory manner for highly automated driving. According to embodiments of the present invention, in particular a continuous, for example wireless, automatic transmission, for example in real time or near real-time, of vehicle data, in particular safety-related or accident-related data, from vehicles to an, for example, scalable, high-availability, cost-effectively representable online storage can be realized ,

Advantageously, according to embodiments of the present invention, for example by means of security mechanisms and methods for ensuring data integrity, a conclusive reconstruction of accident occurrences can be achieved. A provision of relevant vehicle data is carried out automatically without the need for manual intervention or a required manual readout of an accident data recorder can be avoided. In this case, it is possible to use particularly extensive and therefore meaningful quantities of vehicle data, for example of different sensor technology origin. A more reliable detection and reconstruction of accident occurrences, for example with the involvement of several vehicles, can be realized. In the event of an accident or other safety-critical event, such vehicle data can thus be particularly well suited as evidence, since, for example, subsequent manipulation can be technically prevented or data integrity can be detected. Further, a risk of casualty data loss due to immediate accident consequences, such as destruction of data storage, power interruption, or the like, may be dispelled. Thus, a cost-inefficient storage of large amounts of data in the vehicle and additionally or alternatively a cost-inefficient transmission of large, especially unfiltered, amounts of data on the Internet or in the so-called cloud can be avoided. Using, for example, known security mechanisms, data integrity, data authenticity and privacy can be ensured.

A method is provided for providing vehicle data of a vehicle, the method being executable by means of an in-vehicle provisioning device, the method comprising the following steps:
Reading in vehicle data representing data acquired by means of at least one detection device of the vehicle;
Generating a data message comprising the read vehicle data;
Providing the generated data message with at least one digital signature to generate an authenticated data message; and
Outputting the authenticated data message to a transmit interface to provide the vehicle data to an on-vehicle evaluation device.

The vehicle may be a road vehicle, an aircraft or a watercraft, in particular a road-bound motor vehicle, for example a passenger car, truck or any commercial vehicle. The vehicle data may be suitable for enabling conclusions to be drawn about safety-critical events or situations to which the vehicle or a neighboring vehicle adjacent to the vehicle is exposed in a traffic event. The transmission interface can be designed to transmit the authenticated data message to the vehicle-external evaluation device, in particular wirelessly. The steps of the method may be performed in an automated, repeated and / or intermittent or continuous manner.

According to one embodiment, in the step of providing, the generated data message may be provided with a digital device signature of the at least one sensing device or controller of the vehicle and additionally or alternatively with a driver's digital personal signature of the vehicle. In this case, the at least one detection device or the control device of the vehicle can be designed to generate the device signature and additionally or alternatively to provide the data message with the device signature. The at least one detection device can also be designed to provide the vehicle data with the device signature. The personal signature may be generated using an identification device personally issued to a driver of the vehicle, such as a smart card, particularly an identity card, or the like. Such an embodiment offers the advantage that a legally binding and indisputable signing of the vehicle data is made possible, so that an assignment of a driver's identity to possible accident data can be done reliably, ie. H. it is possible to provide reliable proof of who was the driver of the vehicle at the time of the accident.

In the step of reading, sensor raw data, information derived from raw sensor data, data on actions automated by the vehicle and additionally or alternatively data about driver interventions can be read in as the vehicle data. Thus, the vehicle data may include information representing raw sensor data, object lists, and additionally or alternatively automated actions performed by the vehicle. In this case, the vehicle data can originate from at least one detection device or at least one sensor, at least one driver assistance device, at least one user interface and additionally or alternatively at least one control device. Such an embodiment offers the advantage that a comprehensive, comprehensive and meaningful selection of vehicle data can be provided. Thus, for example, an accident situation can be more reliably constructed in an accident situation.

Also, in the step of generating the data message, at least a subset of the read-in vehicle data can be encrypted. Such an embodiment offers the advantage that privacy or privacy can be improved.

Furthermore, in the step of reading a user input signal can be read in, which represents a reference criterion for a safety-relevant traffic event. In this case, the user input signal can be output to the transmission interface in the step of outputting. The user input signal may represent information about manual actuation of a vehicle-based emergency button, emergency switch, or the like by a vehicle occupant. The information criterion of the user input signal can be used by a subsequently executable method for evaluating the vehicle data in order to permanently store safety-relevant and additionally or alternatively accident-relevant vehicle data. Such an embodiment offers the advantage that a recognizability of a safety relevance of provided vehicle data can be increased by the user input signal, since in this way a recognition rate achievable by only information processing means can be increased for every imaginable accident situation involving human sensory perception.

A method for evaluating vehicle data of at least one vehicle is also presented, it being possible to carry out the method by means of at least one evaluation device arranged on the outside of the vehicle, the method comprising the following steps:
Receiving at least one authenticated data message representing a data message provided according to an embodiment of the above method for receiving vehicle data from the at least one vehicle; and
Performing a comparison of the vehicle data with at least one notification criterion for a safety-relevant traffic event in order to evaluate the vehicle data.

The method for evaluating vehicle data may be advantageously carried out in connection with an embodiment of the aforementioned method for providing the vehicle data. The at least one evaluation device may be arranged as a device arranged adjacent to a traffic route or peripheral Device and additionally or alternatively be designed as a central system. The central system can be realized using so-called cloud computing. The at least one notification criterion can have a default parameter, a threshold value, a data pattern and additionally or alternatively a received user input signal that represents a notification criterion for a security-relevant traffic event.

Also, the method may include a step of adding a timestamp and additionally or alternatively a digital signature to the received at least one authenticated data message. In this case, the at least one evaluation device can be designed to generate the digital signature and additionally or alternatively to provide the authenticated data message with the digital signature. The time stamp can be related to a reliable time reference or generated after a comparison with a reliable time difference. Such an embodiment offers the advantage that manipulation by falsification of a local time in the vehicle prevented and thus a security regarding a genuineness of the vehicle data can be increased.

According to one embodiment, wherein the method is carried out by means of a plurality of evaluation devices arranged outside the vehicle, the method may comprise a step of synchronizing the evaluation devices with one another using a common time reference. In this case, each of the plurality of evaluation devices may be designed to carry out the method for evaluation. Such an embodiment offers the advantage that, by means of such a time synchronization, it is possible or at least made easier to clarify questions of fault, accident causes or the like in accidents involving several parties. Unequivocal accident detection and unambiguous accident reconstruction can be achieved due to such time synchronization through the introduction of a common time base and appropriate fusing of vehicle data from multiple vehicles in at least one evaluation device.

Furthermore, the method may include a step of forwarding at least a subset of the vehicle data to a memory interface to a memory device as a function of the comparison and additionally or alternatively of at least one hint criterion. If this indicates at least one reference criterion and additionally or alternatively the comparison reveals that vehicle data is related to a safety-relevant traffic event, this vehicle data can be forwarded to a memory device in the step of forwarding to the memory interface. If this indicates at least one indication criterion and additionally or alternatively the comparison reveals that vehicle data are irrelevant with regard to safety-relevant traffic event, then in a step of discarding at least a subset of the vehicle data can be discarded. Such an embodiment offers the advantage that the received vehicle data initially only need to be cached, for example in a ring buffer or the like, and only upon detection of an accident or a critical situation or a manual triggering by user input signal further evaluation and additionally or alternatively one be stored permanently, so that an amount of data to be archived can be reduced.

In this case, the method may comprise a step of storing forwarded vehicle data by means of a memory device in the at least one evaluation device. In this case, at least one first evaluation device, which may be embodied as a peripheral device arranged adjacent to a traffic route, and additionally or alternatively at least one second evaluation device, which may be embodied as a central system, may be provided. In this case, the at least one first evaluation device may have a first storage device for temporary storage of vehicle data, and the at least one second evaluation device may have a second storage device for permanent or long-term storage of vehicle data. Such an embodiment offers the advantage that as an alternative to a continuous data transmission from at least one vehicle directly into a memory device of a central evaluation device or a so-called cloud backend with the proposed method, an upstream intermediate storage of the vehicle data in a memory device of a peripheral evaluation device or a so-called Roadside Unit (RSU) can be performed. Storing data in an evaluation device remote from the vehicles minimizes a likelihood of data loss in the vehicle due to immediate accident consequences or the like. Corresponding data backup measures can be implemented more cost-effectively in an evaluation device than in the vehicle. Thus, the use of cost-effective storage devices instead of cost-intensive, for example, certified for the automotive sector, storage is possible. By shifting complex accident detection algorithms from the vehicle into a central device, on-board system complexity can be reduced. For example, cloud-based accident loggers are inexpensive to maintain and update.

The method may also include a step of anonymizing and additionally or alternatively a step of encrypting at least a subset of the vehicle data. Such an embodiment offers the advantage that a role-based process for ensuring data protection and for controlling access permissions, such as by authorities, insurance companies, vehicle owners and / or the like, can be provided.

Furthermore, a method for monitoring a traffic event is presented, wherein the method comprises the following steps:
Providing vehicle data of a vehicle according to an embodiment of the above method of providing; and
Evaluating vehicle data of at least one vehicle according to an embodiment of the aforementioned method for evaluation.

The method of monitoring may be advantageously carried out in connection with an embodiment of the aforementioned method for providing the vehicle data as well as in connection with an embodiment of the above-mentioned method for evaluating the vehicle data.

The approach presented herein further provides an apparatus or system having means adapted to perform, control, or implement the steps of one embodiment of a method presented herein. Also by this embodiment of the invention in the form of a device or a system, the object underlying the invention can be solved quickly and efficiently.

In the present case, a device or a system can be understood to mean an electrical device or a composite of electrical devices which process sensor signals and output control and / or data signals in dependence thereon. The device or the system may have an interface, which may be designed in hardware and / or software. In the case of a hardware-based embodiment, the interfaces can be part of a so-called system ASIC, for example, which contains a wide variety of functions of the device. However, it is also possible that the interfaces are their own integrated circuits or at least partially consist of discrete components. In a software training, the interfaces may be software modules that are present, for example, on a microcontroller in addition to other software modules.

Also of advantage is a computer program product or computer program with program code which can be stored on a machine-readable carrier or storage medium such as a semiconductor memory, a hard disk memory or an optical memory and for carrying out, implementing and / or controlling the steps of the method according to one of the embodiments described above is used, especially when the program product or program is executed on a computer or a device.

The approach presented here will be explained in more detail below with reference to the accompanying drawings. Show it:

1 a schematic representation of a traffic monitoring system according to an embodiment of the present invention in a traffic environment;

2 a schematic representation of a provisioning device of a traffic monitoring system according to an embodiment of the present invention;

3 a schematic representation of evaluation devices of a traffic monitoring system according to an embodiment of the present invention;

4 a schematic representation of an on-vehicle part of a traffic monitoring system according to an embodiment of the present invention;

5 a schematic representation of a trackside portion of a traffic monitoring system according to an embodiment of the present invention;

6 a schematic representation of a vehicle data packet according to an embodiment of the present invention;

7 a flowchart of a method for monitoring according to an embodiment of the present invention;

8th a flowchart of a method for providing according to an embodiment of the present invention; and

9 a flowchart of a method of evaluation according to an embodiment of the present invention.

In the following description of favorable embodiments of the present invention are for the illustrated and similar elements shown in the various figures the same or Similar reference numerals are used, with a repeated description of these elements is omitted.

1 shows a schematic representation of a traffic environment with a traffic monitoring system 100 , also called a traffic monitoring system, according to an embodiment of the present invention. According to the in 1 illustrated embodiment of the present invention, the traffic monitoring system 100 a central evaluation device 110 , a plurality of peripheral evaluation devices 120 and a plurality of delivery devices 130 on.

Each of the plurality of delivery devices 130 is here in a vehicle 140 arranged. Each delivery device 130 is designed to vehicle data of the vehicle 140 in which it is arranged. The provision of the vehicle data is explained in more detail below with reference to the following figures.

The vehicles 140 are according to the in 1 illustrated embodiment of the present invention road-bound motor vehicles. Two of the vehicles 140 are at an accident event 145 involved, for example, a collision of the two vehicles 140 , The majority of vehicles 140 are part of a traffic happening on a street 150 , In 1 are exemplary four vehicles 140 in the street 150 or a road section or section shown.

The peripheral evaluation devices 120 are stationary and along the street 150 arranged. The central evaluation device 110 is stationary and off the street 150 spaced apart. The peripheral evaluation devices 120 and the central evaluation device 110 are trained to the vehicle data of the vehicles 140 evaluate. The evaluation of the vehicle data is explained in more detail below with reference to the following figures.

As it is in 1 is illustrated by antenna symbols, are the provisioning devices 130 and the peripheral evaluation devices 120 wirelessly communicating with each other. The peripheral evaluation devices 120 and the central evaluation device 110 are fixed installations. The connection between the plants 110 . 120 Therefore, according to the current state of the art, it is advantageous for wired use, since, among other things, this enables, for example, higher capacity, less latency, higher reliability, less interference and better time synchronization. It is possible that suitable wireless technologies will be available in the future. Even today, data transmission between the systems 110 . 120 be implemented wirelessly, but from a technical point of view, this only makes sense if no wired data lines are available.

According to one embodiment, instead of the peripheral evaluation devices 120 and the central evaluation device 110 also be provided only an evaluation device.

2 shows a schematic representation of a delivery device 130 a traffic monitoring system according to an embodiment of the present invention in a vehicle 140 , In the 2 illustrated provisioning device 130 or device for providing vehicle data of a vehicle corresponds to one of the in 1 shown delivery devices or similar provisioning device.

The delivery device 130 has a read-in device 232 , a generating device 234 , a signing device 236 and an output device 238 on. From the vehicle 140 are in the representation of 2 in addition to the provisioning device 130 by way of example only a detection device 242 and a transmission interface 244 shown.

The detection device 242 , according to which in 2 Illustrated embodiment of the present invention is exemplified by a vehicle camera, is designed to vehicle data 262 capture. Also, the detection device 242 trained to the vehicle data 262 for the delivery device 130 provide.

The reading device 232 the delivery device 130 is adapted to the means of detection 242 recorded vehicle data 262 read. Also is the reading device 232 trained to read the vehicle data 262 to the generating device 234 pass. For example, the read-in device 232 designed to sensor raw data, information derived from sensor raw data, data from the vehicle 140 automated actions and additionally or alternatively data about driver interventions as the vehicle data 262 read.

The generating device 234 is designed to be using the read vehicle data 262 generate a data message containing the read vehicle data 262 includes. Also, the generating device 232 trained to the generated data message for the signing device 236 provide. According to one embodiment, the generating means 234 further configured to generate at least a subset of the vehicle data when generating the data message 262 to encrypt.

The signing device 236 In turn, it is designed to provide the generated data message with at least one digital signature, an authenticated data message 264 to generate. Also is the signing device 236 trained to receive the authenticated data message 264 to the output device 238 forward. Optional is the signing device 236 thereby formed to the generated data message with a digital device signature of the detection device 242 or a control device of the vehicle 140 and additionally or alternatively with a digital person signature of a driver of the vehicle 140 to provide.

The output device 238 is designed to receive the authenticated data message 264 to the transmission interface 244 issue. At the transmission interface 244 it is an interface to a vehicle-external evaluation device. Here is the authenticated data message 264 by means of the transmission interface 244 wirelessly transferable to the vehicle-external evaluation device. This is indicated by an antenna symbol in 2 illustrated.

According to one embodiment, the read-in device 232 be configured to read in a user input signal representing a criterion for a safety-related traffic event. In this case, the output device 238 be configured to the user input signal to the transmission interface 244 to output to the vehicle external evaluation device.

3 shows a schematic representation of evaluation devices 110 and 120 a traffic monitoring system or devices for evaluating vehicle data of at least one vehicle according to an embodiment of the present invention. In the 3 illustrated evaluation devices 110 and 120 correspond to in 1 shown evaluation or similar evaluation devices. In 3 Here are the central evaluation device 110 and one of the peripheral evaluation devices 120 out 1 shown in more detail. In this case, each of the peripheral evaluation devices 1 essentially the in 3 illustrated peripheral evaluation device 120 correspond or be similar.

The central evaluation device 110 and the peripheral evaluation device 120 have collectively considered a receiving device 321 , a comparison device 322 , an adding device 323 , a synchronization device 324 , a forwarding device 325 , a storage device 326 , an anonymizer 327 and an encryption device 328 on. Here are the central evaluation device 110 and the peripheral evaluation device 120 wirelessly communicating with each other. This is due to antenna symbols in 3 illustrated.

According to the in 3 illustrated embodiment of the present invention has the peripheral evaluation device 120 for example, the receiving device 321 , the comparison device 322 , the adding device 323 , the synchronization device 324 and the forwarding device 325 on. The central evaluation device 110 has the storage device 326 , the anonymizer 327 and the encryption device 328 on. According to another embodiment, the peripheral evaluation device 120 the receiving device 321 and optionally the adding device 323 and optionally the synchronization device 324 and can be the central evaluation device 110 the comparison device 322 , the forwarding device 325 , the storage device 326 and optionally the anonymizer 327 and optionally the encryption device 328 exhibit.

The receiving device 321 is formed to at least one of a provision device of at least one vehicle by means of a transmission interface emitted, authenticated data message 264 receive via a receive interface. In other words, the receiving device 321 trained to at least one authenticated data message 264 to receive by means of one of the provisioning devices 1 is provided. According to one embodiment, the receiving device 321 trained to receive the received authenticated data message 264 to the comparator 322 pass.

The comparison device 322 is configured to compare the data received by the received authenticated data message 264 Carried to perform vehicle data represented with at least one criterion for a safety-related traffic event. According to the in 3 illustrated embodiment of the present invention is the comparison device 322 in the peripheral evaluation device 120 arranged. The comparison device 322 is designed to be the authenticated data message 264 to the forwarding device 325 issue. Alternatively or additionally, the central evaluation device 110 the comparison device 322 exhibit.

According to the in 3 illustrated embodiment of the present invention, the peripheral evaluation device 120 also the adding device 323 and the synchronization device 324 on. In this case, the receiving device 321 trained to receive the received authenticated data message 264 to the adding device 323 pass. The adding device 323 is configured to provide a time stamp and additionally or alternatively a digital signature to the at least one received, authenticated data message 264 add. Also, the addition device 323 trained to the added to the time stamp and / or the digital signature, authenticated data message 264 to the comparator 322 issue. The synchronization device 324 is designed to use a common time reference or with reference to a common time reference, a temporal synchronization with other peripheral evaluation devices and additionally or alternatively with the central evaluation device 110 perform. Here is the synchronization device 324 data transferable with the adding device 323 and connected to other peripheral evaluation devices.

The forwarding device 325 is configured to at least a subset of the vehicle data from the at least one authenticated data message 264 to a memory interface to the memory device 326 forward. Here is the forwarding device 325 designed to be dependent on the means of the comparator 322 Carried out comparison and additionally or alternatively depending on at least one hint criterion vehicle data from the at least one authenticated data message 264 forward or discard. The memory interface is according to the in 3 illustrated embodiment of the present invention as a wireless data connection between the peripheral evaluation device 120 and the central evaluation device 110 executed. According to the in 3 illustrated embodiment of the present invention is the forwarding device 325 in the peripheral evaluation device 120 arranged. Alternatively or additionally, the central evaluation device 110 the forwarding device 325 exhibit.

The storage device 326 is adapted to the forwarded vehicle data from the at least one authenticated data message 264 save. The storage device 326 is in the central evaluation device 110 arranged.

According to the in 3 illustrated embodiment of the present invention has the central evaluation device 110 the anonymizer 327 and the encryption device 328 on. Here are the anonymizer 327 and the encryption device 328 exemplary data transferable with each other and with the storage device 326 connected. The anonymizer 327 is designed to anonymize at least a subset of the vehicle data. The encryption device 328 is configured to encrypt at least a subset of the vehicle data. Optionally, the central evaluation device 110 only the anonymizer 327 or the encryption device 328 exhibit. According to one embodiment, the peripheral evaluation device 120 the anonymizer 327 and additionally or alternatively, the encryption device 328 exhibit.

4 shows a schematic representation of an on-vehicle part of a traffic monitoring system according to an embodiment of the present invention. In this case, the vehicle-side part of the traffic monitoring system has a provisioning device 130 on that in a vehicle 140 is arranged. In the 4 illustrated provisioning device 130 corresponds to one of the in 1 Deployment devices shown in 2 illustrated provisioning device or similar provisioning device.

From the vehicle 140 are in 4 in addition to the provisioning device 130 a plurality of detection devices 442A . 442B . 442C . 442D and 442E , a driver authentication device 446 and a manual triggering device 448 shown. Here are the majority of detection devices 442A . 442B . 442C . 442D and 442E and the driver authentication device 446 and the manual release device 448 data transferable with the delivery device 130 connected.

The majority of detection devices 442A . 442B . 442C . 442D and 442E are configured to provide vehicle data to the delivery device 130 transferred to. According to the in 4 illustrated embodiment of the present invention is a first detection device 442A designed as a sensor for ultrasound, acceleration, wheel speed and / or the like, is a second detection device 442B designed as a sensor for operator intervention such as for steering angle, brake application and / or the like, is a third detection device 442C as a position detecting means such as a GPS (Global Positioning System) receiver or the like, is a fourth detecting means 442D as an interface to a control unit, for example for detecting data about an airbag deployment and / or the like carried out and is a fifth detection device 442E implemented as sensor for vehicle data from other data sources.

The driver authentication device 446 is configured to authenticate or verify an identity of a driver of the vehicle 140 perform. For example, the driver authentication device 446 designed to read data from a smart card, in particular from an identity card or the like, or another identification means. Further, the driver authentication device is 446 configured to provide authentication data for creating the digital person signature to the delivery device 130 issue.

The manual release device 448 is configured to generate a user input signal indicative of a safety-critical or safety-related traffic event in response to a user input. In this case, the manual triggering device 448 For example, have an emergency button or the like.

5 shows a schematic representation of a trackside portion of a traffic monitoring system according to an embodiment of the present invention. In this case, the trackside part of the traffic monitoring system has a central evaluation device 110 , By way of example, only three explicitly shown, peripheral evaluation devices 120 and a network 515 on. In the 5 illustrated evaluation devices 110 and 120 correspond to the in 1 shown evaluation, the in 3 illustrated evaluation or similar evaluation devices.

The peripheral evaluation devices 120 are by means of the network 515 Datenübertragungsmäßig with the central processing device 110 connected. In this case, the peripheral evaluation devices 120 For example, as a so-called Road Side Units (RSU) running. The peripheral evaluation devices 120 are configured to add an additional signature to at least one received authenticated data message from a provisioning device of at least one vehicle. The central evaluation device 110 is designed to realize a cloud service, accident detection, data storage, archiving and / or the like.

6 shows a schematic representation of a vehicle data packet according to an embodiment of the present invention. The illustrated vehicle data packet has vehicle data 262 on, for example, the vehicle data 2 , The vehicle data packet also includes an authenticated data message 264 , for example, the authenticated data message 2 respectively. 3 ,

In this case, the authenticated data message points 264 in addition to the vehicle data 262 a digital device signature 602 and a digital person signature 604 on. The vehicle data 262 are by means of a signing device of a delivery device, such as by means of the signing device of the delivery device from one of 1 . 2 and 4 , with the digital device signature 602 and the digital person signature 604 Mistake.

In addition to the authenticated data message 264 the vehicle data packet includes a timestamp 610 and a digital signature 612 an evaluation device, such as one of the evaluation of one of 1 . 3 and 5 , The authenticated data message 264 are by means of an adding device of an evaluation device, such as by means of the adding device of an evaluation of one of 1 . 3 and 5 , the time stamp 610 and the digital signature 612 added.

Thus, the vehicle data packet has the vehicle data 262 , the digital device signature 602 , the digital person signature 604 , the time stamp 610 and the digital signature 612 on. The vehicle data packet is by means of a memory device of an evaluation device, such as the memory device of an evaluation of one of 1 . 3 and 5 storable.

7 shows a flowchart of a method 700 according to an embodiment of the present invention for monitoring a traffic event. The procedure 700 is in conjunction with or using a traffic monitoring system such as the traffic monitoring system 1 executable.

The procedure 700 has a step 710 the provision of vehicle data of a vehicle. This is the step 710 providing in conjunction with or using a provisioning device such as the delivery device of any one of 1 . 2 and 4 feasible. The step 710 Provisioning has sub-steps that include a 8th illustrated method for providing comprises.

Further, the method has 700 one step 720 evaluating vehicle data of at least one vehicle. This is the step 720 the evaluation in conjunction with or using at least one evaluation device such as at least one of the evaluation of one of 1 . 3 and 5 feasible. The step 720 of the evaluation has sub-steps, the in 9 illustrated method for evaluating includes.

8th shows a flowchart of a method 810 for providing vehicle data of a vehicle, according to an embodiment of the present invention. Here is the procedure 810 by means of an in-vehicle supply device executable, such as the provision device of one of 1 . 2 and 4 ,

The procedure 810 has a step 812 reading in vehicle data acquired by means of at least one detection device of the vehicle. In one on the step 812 reading in the next step 814 When generating, a data message is generated which includes or represents the read-in vehicle data. Further, the method has 810 one step 816 providing the generated data message with at least one digital signature to generate an authenticated data message. In one step 816 subsequently executable step 818 outputting the authenticated data message is output to a transmission interface for transmitting the authenticated data message to a vehicle-external evaluation device. As a result, the vehicle data is provided to the vehicle-external evaluation device.

9 shows a flowchart of a method 920 for evaluating vehicle data of at least one vehicle, according to an embodiment of the present invention. Here is the procedure 920 by means of at least one vehicle external evaluation device executable, such as at least one of the evaluation of one of 1 . 3 and 5 , Also, that's the procedure 920 using the method of providing 8th provided vehicle data feasible.

The procedure 920 has a step 921 the receiving of vehicle data, which were sent out in the form of at least one authenticated data message via the transmission interface of the at least one vehicle, as it is based on 8th is described. After the step 921 becomes a step 922 executed, in which the vehicle data are compared with at least one criterion for a safety-related traffic event. As a result, the vehicle data can be evaluated.

According to one embodiment, in one respect to the step 921 of receiving subsequently performed step 923 adding a timestamp and additionally or alternatively adding a digital signature to the received at least one authenticated data message.

In an optional step 924 of the time synchronization, the evaluation devices are synchronized with one another using a common time reference. It should be noted that the step 924 the temporal synchronization in conjunction with a plurality of peripheral evaluation devices is executable, such as the peripheral evaluation from 1 . 3 respectively. 5 ,

Further, the method has 920 according to one embodiment, a step 925 forwarding at least a subset of the vehicle data to a memory interface to a memory device. The step 925 of forwarding becomes dependent on the comparison of step 922 comparing and additionally or alternatively executed as a function of at least one hint criterion. In one step 925 forwarding step that can be subsequently performed 926 the stored vehicle data are stored by means of a memory device in the at least one evaluation device.

According to one embodiment, the method 920 a further step 927 anonymising and additionally or alternatively a step 928 encrypting at least a subset of the vehicle data. This will be the step 927 of anonymizing or the step 928 Encrypting the step 921 of receiving subsequently performed.

With reference to the 1 to 9 In the following, exemplary embodiments of the present invention are explained in summary and in other words.

According to embodiments, in particular a real-time transmission, signing and storage, for example with time stamp, of relevant vehicle data 242 in vehicles external devices feasible. Such vehicle data 242 For example, sensor raw data, e.g. B. with respect to a vehicle environment and / or vehicle condition, or attention or driving readiness of the driver, for. As well as fatigue detection or touch sensor on the steering wheel, derived from the raw data or derived information, such as an object list, from the vehicle 140 automatically performed actions, possibly with triggering event, manual driver intervention and / or the like.

In particular, a signature of accident data with a driver's crypto-key, e.g. B. by a smart card or a new identity card (nPA), in the vehicle 140 and by downstream system elements, eg. RSU, enables data integrity and authenticity as well as an indisputability of the vehicle data 262 technically demonstrated. A signature and time stamp by the peripheral evaluation devices 120 allows manipulation by falsifying a local time in the vehicle 140 excluded. The RSUs peripheral evaluation devices 120 or and all downstream system components are synchronized, for example, continuously.

Upon detection of an accident or a critical situation or a manual triggering vehicle data from the peripheral evaluation devices 120 to the central evaluation device 110 or transferred to a so-called back-end or cloud backend. As a result, a lot of data to be transferred to the cloud can be reduced, while also ensuring that the data is safe from manipulation and loss outside the vehicle 140 be filed.

The cloud connection can be implemented in particular, but not exclusively, via automotive WLAN (IEEE802.11p) by means of the so-called Road Side Units (RSUs) or by means of mobile radio.

The "cloud connection" in the sense of a data connection can be divided into two segments. A first segment comprises the connection from the vehicle 140 to the RSU. This connection is expediently wireless (eg with IEEE802.11p). A second segment comprises the connection from the network 515 between RSUs and central evaluation device 110 , This connection is pronounced according to the current state of the art as a wired network. This connection can also be implemented wirelessly, possibly using future technologies.

In particular, a data transmission takes place fully automatically, for example in a predetermined temporal grid or the like. A manual intervention is not necessary in such a case. A cloud-side fusion of data, especially with a global time base, from multiple vehicles with a specific geographic proximity creates locally-defined, consistent overall views. These can be refined by enrichment with other data, such as environmental sensors such as surveillance cameras or satellites. Such an overall view is suitable for the automated evaluation by cloud-side algorithms for unambiguous recognition of an accident and supports a clear explanation of an accident. For this purpose, relevant data can be transmitted to a central accident data register for further analysis in the event of a recognized accident. If no accident is detected, the data can be deleted or overwritten, for example, so that the storage resources are used efficiently and the data protection of the vehicle owner or driver is ensured.

In addition to the cloud-side accident detection, an accident can also be detected by participating vehicles and uninvolved vehicles, for example, by local evaluation of a front camera in a following vehicle. Such detections can be reported accordingly automated. In addition, the accident detection can also be done manually, such as by triggering an emergency button in the vehicle 140 or by a call of an eyewitness.

For the necessary temporal synchronization of the relevant communication partners are standardized protocols, such as IEEE1588. For this purpose, in particular the peripheral evaluation devices 120 or Road Side Units continuously according to the step 924 of the procedure 920 synchronized with each other and those of vehicles 140 incoming data messages 264 Enriched with timestamps. Thus, possibly deviant or manipulated, local clocks can be used as a source of error in the reconstruction of accidents involving several vehicles involved 140 exclude.

Data integrity is ensured by a continuous digital signature 602 . 604 and 612 , which takes place both on the vehicle side and outside the vehicle or RSU side or on the cloud side. In this case, for example, different keys are used, which are known only one page. Thus, data integrity and authenticity can be demonstrated later, as undetectable manipulation would only be possible with both keys. Since the keys are physically separate - in the vehicle, in the peripheral evaluation devices and the central evaluation device - and can be additionally secured by mechanical access protection, unnoticed manipulation is unlikely. Even if one for the signature 602 and or 604 used public key located in the vehicle 140 is destroyed, is the integrity of the vehicle data 262 with the secret keys of the evaluation devices 110 and or 120 and the vehicle 140 , which are needed only for verification, but not for signing, so not in the vehicle 140 or in the evaluation devices 110 and or 120 can be checked at any time. Thus, suitability of the vehicle data signed in this way is 262 as evidence possible.

A distinction is made between signature and verification (ie integrity) and encrypting / decrypting cases.

With regard to the case of signature and verification, the signature is carried out in the vehicle with a secret key "Fg". This could be destroyed in an accident. For verification, only the public (non-secret) key "Fö" appropriate to "Fg" is needed, which is well-known and distributed outside the vehicle.

With regard to the Encrypt / Decrypt cases, the encryption is done on the vehicle side with different public keys - depending on the addressee of the data. To decrypt the secret key of the addressee is needed. This case is not critical, since only the vehicle-side secret key of danger of destruction by accidents are exposed.

Data sovereignty and data protection are improved in particular by the following three alternative or combinable mechanisms.

First, if no accident occurs, the vehicle data 262 or the data messages 264 automatically deleted after a short time. A duration of a temporary storage as well as a degree of detail can also be determined by a predictive algorithm, for example, a more extensive storage may be provided in situations suspected of causing an accident, eg. B. with sharp braking, hazard lights, etc.

Secondly, encryption of all data not required for accident detection - for example acceleration values above certain thresholds, but not, for example, a level of windscreen wiper water - is required before transmission from the vehicle 140 to an evaluation device 110 and or 120 intended. The data can only be decrypted and evaluated with the key of the vehicle owner or vehicle owner and thus only with his consent. In addition, by using different keys, a role concept can be realized in which the vehicle owner and / or legislator decides to which third party which data is made available.

Third, anonymization of data is provided. In the encrypted state, data may be provided to a trusted party, such as a privacy agency, where the data may be anonymized and / or aggregated, for example, by removing unique identifiers. The anonymized data can then be provided anonymously to third parties, eg. It would also be possible to proceed similarly to permanently record data from certain sources, ie to exclude it from the deletion and in encrypted form from an evaluation device 110 and or 120 to be transferred to such a data protection agency.

For encryption or key management z. B. in the vehicle 140 built-in driver authentication devices 446 , For example, smart card reader, and for example a smart card (eg nPA = new identity card) of the driver are used. For a high-performance implementation of security mechanisms are suitable in the vehicle 140 Fixed, non-compromisable hardware security modules. A role-based process to ensure authenticity, integrity and confidentiality, thus privacy, to various third parties, e.g. As car insurance, vehicle manufacturer, workshop, as well as a driver identification with the purpose of non-repudiation of the identity of the driver can be implemented by means of signing and encryption.

By signatures 602 . 604 . 612 a proof is possible that the vehicle data 262 were not subsequently manipulated. This will be the vehicle data 262 for example, in the vehicle 140 with the digital person signature 604 or a personal secret key or private key signed by the driver, for example using a smart card, such. B. the new identity card (nPA). What is important is that such a smart card is integer and not compromisable. In addition, control devices, detection device in and similar components of the vehicle 140 relevant vehicle data 262 with a digital device signature 602 Sign, so that, for example, a manufacturer of a control device can additionally hedge against manipulation, for example, by a so-called man-in-the-middle attack. Proof of authenticity and integrity then takes place with a respective public key or public key.

At the receipt of the transmitted data messages 264 for example, on the peripheral evaluation devices 120 or Road Side Units (RSUs) become these data messages 264 along with an additional timestamp based on a synchronized evaluator time, with a digital signature 612 or an individual secret key of the RSU signed. Thus, a manipulation of the time base in the vehicle 140 excluded as an attack vector and detected with the public key.

For example, to conserve an available bandwidth of used communication systems, the keys used become such combined that creates a nested encryption of data packets, as in 6 is recognizable. Thus, a message or a data packet can be sent as a multicast or broadcast and also be taken to ensure that the respective information components can only be read in plain text by the designated communication partners.

The embodiments described and shown in the figures are chosen only by way of example. Different embodiments may be combined together or in relation to individual features. Also, an embodiment can be supplemented by features of another embodiment.

Furthermore, the method steps presented here can be repeated as well as executed in a sequence other than that described.

If an exemplary embodiment comprises a "and / or" link between a first feature and a second feature, then this is to be read so that the embodiment according to one embodiment, both the first feature and the second feature and according to another embodiment either only first feature or only the second feature.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 10059679 A1 [0002]

Claims (15)

Procedure ( 810 ) for providing vehicle data ( 262 ) of a vehicle ( 140 ), the process ( 810 ) has the following steps: reading in ( 812 ) of vehicle data ( 262 ), which by means of at least one detection device ( 242 ; 442A . 442B . 442C . 442D . 442E ) of the vehicle ( 140 represent collected data; Produce ( 814 ) of a data message which the read vehicle data ( 262 ); Mistake ( 816 ) of the generated data message with at least one digital signature ( 602 . 604 ) to an authenticated data message ( 264 ) to generate; and spend ( 818 ) of the authenticated data message ( 264 ) to a transmission interface ( 244 ) to the vehicle data ( 262 ) to a vehicle-external evaluation device ( 110 . 120 ). Procedure ( 810 ) according to claim 1, wherein in step ( 816 ) providing the generated data message with a digital device signature ( 602 ) of the at least one detection device ( 242 ; 442A . 442B . 442C . 442D . 442E ) or a control device of the vehicle ( 140 ) and / or with a digital person signature ( 604 ) of a driver of the vehicle ( 140 ). Procedure ( 810 ) according to one of the preceding claims, wherein in step ( 812 ) of read-in ( 812 ) Raw sensor data, information derived from sensor raw data, data from the vehicle ( 140 ) Automated actions and / or data on driver interventions as the vehicle data ( 262 ) are read. Procedure ( 810 ) according to one of the preceding claims, wherein in step ( 814 ) of generating the data message at least a subset of the read vehicle data ( 262 ) is encrypted. Procedure ( 810 ) according to one of the preceding claims, wherein in the reading-in step ( 812 ) a user input signal is read in which represents a reference criterion for a safety-relevant traffic event, wherein in step ( 818 ) outputting the user input signal to the transmit interface ( 244 ) is output. Procedure ( 920 ) for evaluating vehicle data ( 262 ) at least one vehicle ( 140 ), the process ( 920 ) by means of at least one vehicle external evaluation device ( 110 . 120 ) is executable, the method ( 920 ) comprises the following steps: receiving ( 921 ) at least one authenticated data message ( 264 ), one in accordance with a procedure ( 810 ) according to one of the preceding claims provided data message ( 264 ) to vehicle data ( 262 ) of the at least one vehicle ( 140 ) to recieve; and performing ( 922 ) a comparison of the vehicle data ( 262 ) with at least one reference criterion for a safety-relevant traffic event in order to 262 ). Procedure ( 920 ) according to claim 6, with a step ( 923 ) adding a timestamp ( 610 ) and / or a digital signature ( 612 ) to the received at least one authenticated data message ( 264 ). Procedure ( 920 ) according to any one of claims 6 to 7, wherein the process ( 920 ) by means of a plurality of vehicle-external evaluation devices ( 110 . 120 ), the method ( 920 ) one step ( 924 ) of the temporal synchronization of the evaluation devices ( 110 . 120 ) with each other using a common time reference. Procedure ( 920 ) according to one of claims 6 to 8, with a step ( 925 ) forwarding at least a subset of the vehicle data ( 262 ) to a memory interface to a memory device ( 326 ) as a function of the comparison and / or of at least one reference criterion. Procedure ( 920 ) according to claim 9, with a step ( 926 ) of storing relayed vehicle data ( 262 ) by means of a memory device ( 326 ) in the at least one evaluation device ( 110 . 120 ). Procedure ( 920 ) according to one of claims 6 to 10, with a step ( 927 ) of anonymisation and / or a step ( 928 ) encrypting at least a subset of the vehicle data ( 262 ). Procedure ( 700 ) for monitoring a traffic event, the method ( 700 ) comprises the following steps: providing ( 710 ) of vehicle data ( 262 ) of a vehicle ( 140 ) according to a method ( 810 ) for providing according to any one of claims 1 to 5; and evaluation ( 720 ) of vehicle data ( 262 ) at least one vehicle ( 140 ) according to the method ( 920 ) for evaluating according to one of claims 6 to 11. Contraption ( 110 . 120 ) or system ( 100 ) with facilities that are designed to handle all the steps of a procedure ( 700 ; 810 ; 920 ) according to to carry out any of the preceding claims. Computer program adapted to perform all steps of a procedure ( 700 ; 810 ; 920 ) according to one of the preceding claims. A machine-readable storage medium having a computer program stored thereon according to claim 14.

Images