DE102019220244A1 - Method for storing operating data of a motor vehicle - Google Patents

Abstract

Method for storing operating data (2) that arise during operation of the motor vehicle (1) with a vehicle driver, the operating data (2) being encrypted during storage in such a way that the driver of the motor vehicle is involved in decrypting the operating data (2) (1) is required.

Description

State of the art

Operating data recorders for storing operating data relating to the operation of a motor vehicle are known per se. It is also known to store photos or camera recordings that were taken during or after an accident in a motor vehicle. Operating data and in particular such photos or camera recordings are extremely interesting for insurance companies in order to determine who is responsible for an accident. The course of an accident can possibly be reconstructed with such data.

The idea of encrypting operating data and in particular photos or camera recordings in order to protect them from unauthorized access is also known. A considerable problem in connection with the storage of such data are data protection provisions and data protection interests of the motor vehicle operator, the motor vehicle manufacturer and the vehicle driver of the motor vehicle. Data protection regulations are also different in different countries, so that very different regulations must be complied with in this context if a universally applicable storage system for operating data is to be provided.

It is particularly problematic if such data are stored in the sphere of a motor vehicle manufacturer and only the motor vehicle manufacturer can therefore decide whether to publish such data. Particularly in connection with autonomous vehicles, the responsibility for traffic accidents regularly lies either with the driver of the vehicle or with the manufacturer of the vehicle, depending on which error occurred when and how and was the cause of the traffic accident. In such situations it is extremely difficult for the driver of a motor vehicle to represent his interests because the manufacturer could withhold the necessary data for clarifying the responsibility of an accident.

In the case of accidents with autonomously operated motor vehicles, it is often necessary to clarify, for example, whether the vehicle driver has taken control of the motor vehicle in a timely manner in a dangerous situation or has relied on the autonomous operation of the vehicle in an inadmissible manner. In such a situation, extensive recorded operational data is helpful.

Disclosure of the invention

Based on this situation, a method for storing operating data of a motor vehicle is to be described here, which is suitable for enabling access to data if necessary, ensuring data manipulation security and at the same time being compatible with applicable confidentiality interests, confidentiality provisions and data protection provisions.

The invention relates to a method for storing operating data that arise during operation of the motor vehicle with a vehicle driver, the operating data being encrypted during storage in such a way that the driver of the motor vehicle must be involved in decrypting the operating data.

This means that the operating data are encrypted in such a way that the operating data cannot be decrypted without the involvement of the driver of the motor vehicle. A vehicle driver thus retains control over the utilization of the operating data despite the storage of the operating data.

The encryption takes place in particular with a so-called strong encryption method. Such encryption methods are particularly characterized in that even knowing a volume of data in encrypted form and in unencrypted form, it is not possible to infer the key or the encryption rule.

The method is particularly preferably carried out in an operating data recorder of a motor vehicle, the method being carried out in such a way that, within the scope of the method described, it is particularly advantageous if the data can also only be extracted from the operating data recorder in encrypted form, so that the vehicle driver can cooperate is still necessary after the data has been extracted from the operating data recorder in order to decrypt the operating data. Even with full access to the operational data recorder (i.e. full access to the data memory of the operational data recorder without restrictions through an access interface) there is no possibility of extracting the operational data unencrypted from the operational data recorder or of extracting the information necessary to decrypt the data from the operational data recorder.

The driver of the vehicle does not necessarily mean a person who controls the vehicle himself. In the case of a fully autonomous one Vehicle, it can also be “only” a person involved in the operation of the motor vehicle or a person (co-) responsible for the operation of the motor vehicle. A vehicle driver also means, in particular, a vehicle user.

The fact that the vehicle driver's participation is required can also include indirect participation by the vehicle driver. This means, for example, that the cooperation of a body authorized by the vehicle driver or a public body can be sufficient to enable the operating data to be decrypted. The vehicle driver may, for example, have made a key available to such a point. An authorized body can, for example, be an insurance company to which the vehicle driver has granted access to the operating data in return for receiving benefits from the insurance. An authorized body can also be an authority or a court. If necessary, it is possible for such an authorized body to have or receive a master key with which the operating data can be decrypted.

1. a) Ermitteln eines öffentlichen Schlüssels eines Schlüsselpaars, dessen geheimer Schlüssel in einer geschützten Sphäre eines Fahrzeugführers des Kraftfahrzeugs ist,
2. b) Akquirieren von Betriebsdaten des Kraftfahrzeuges während eines Betriebs des Kraftfahrzeuges,
3. c) Verschlüsseln der Betriebsdaten mit dem öffentlichen Schlüssel und einem asymmetrischen Verschlüsselungsverfahren oder verschlüsseln der Betriebsdaten mit einem temporären Schlüssel und einem symmetrischen Verschlüsselungsverfahren, wobei anschließend der temporäre Schlüssel mit dem öffentlichen Schlüssel und einem asymmetrischen Verschlüsselungsverfahren verschlüsselt und dann gelöscht wird,
4. d) Ablegen von verschlüsselten Betriebsdaten auf einem Datenspeicher.

The method described here for storing operating data of a motor vehicle has the following steps in a preferred embodiment variant:

1. a) determining a public key of a key pair whose secret key is in a protected sphere of a driver of the motor vehicle,
2. b) Acquiring operating data of the motor vehicle while the motor vehicle is in operation,
3. c) Encrypting the operating data with the public key and an asymmetric encryption method or encrypting the operating data with a temporary key and a symmetric encryption method, the temporary key being then encrypted with the public key and an asymmetric encryption method and then deleted,
4. d) Storage of encrypted operating data on a data memory.

The key pair with the public key and the secret key is usually a key pair for an asymmetrical encryption method. In such methods it is possible to encrypt data with the public key of the respective key pair. A decryption of the data is only possible if the secret key of the respective key pair (often also called private key) is available. The secret key of the respective key pair is kept in a protected area.

The theoretical basis for asymmetric encryption methods are trapdoor functions, i.e. functions that are easy to calculate, but are practically impossible to invert without a secret. The secret key is then a description of the function, the public key is the trapdoor. With the application of the public key to the data to be encrypted, a lot of encrypted data can arise from the data to be encrypted, which is worthless without the secret key. A prerequisite is, of course, that the private key cannot be calculated from the public.

• - elliptische Kurven,
• - RSA-Verfahren,
• - PGP-Verfahren

Asymmetrical encryption methods or trapdoor functions can, for example, be based on one of the following mathematical methods:

• - elliptic curves,
• - RSA method,
• - PGP procedure

As described above, the secret key is stored in a protected area of a driver of the motor vehicle. A protected sphere of the driver of the motor vehicle can be, for example, a mobile phone in the possession of the driver of the motor vehicle or possibly also an electronic signature card of the driver of the motor vehicle or a similar device. It is also possible that the protected sphere of the vehicle driver is a computer or a network memory or a similar component which is under the control of the vehicle driver. In order to carry out the method described, it is generally not necessary that the second key is available while the method is being carried out. The protected sphere can therefore also be completely detached from the motor vehicle. It is not necessary for the technical unit that forms the protected sphere to be located in the motor vehicle itself. In many cases, however, this is not harmful either. For example, this is possible with a mobile phone or a signature card (also called a smart card), which could provide the protected sphere and which a vehicle driver of the motor vehicle can take with him into the motor vehicle. It is technically possible to securely store a secret key for the described method, for example in a mobile phone or a signature card, if the mobile phone is set up accordingly in terms of hardware and / or software.

Determining the public key in step a) can include reading out the respective key from a memory. However, further substeps for determining the key from external sources can also be carried out. More detailed versions of this will be given later. Step a) can take place once when a vehicle driver uses a motor vehicle for the first time. Step a) can also be carried out repeatedly by the vehicle driver each time the vehicle is started up again.

Acquiring operating data of the motor vehicle in step b) includes in particular receiving or collecting various sensor data from various sensors in the motor vehicle via a data interface of an operating data recorder.

The operating data acquired in step b) are then encrypted with at least the second public key in step c).

The operating data can also be encrypted with the public key in step c) indirectly. In the case of indirect encryption with the public key, an individual / temporary key is first generated for symmetrical encryption. Such an individual key is preferably a random value with a sufficient bit length. This ensures that the individual key cannot be determined with an attack. The data is then encrypted with the individual key. The individual key is then encrypted with the public key and then deleted. The encrypted individual key is stored together with the encrypted operating data or made available as part of the encrypted operating data. If the encrypted operating data is to be decrypted, the individual key is first decrypted with the private key. The operating data can then be decrypted with the individual key and the symmetrical procedure.

The storage of the encrypted operating data on a data memory in step d) is preferably carried out in such a way that access to this operating data is possible if this access is advantageous and / or necessary. This can be the case, for example, that an accident has occurred in the motor vehicle and the operating data are to be used to investigate this accident. If necessary, the operating data can also be stored in several places. It is conceivable that both storage in a memory of the vehicle driver and storage in a memory of a person responsible for the technical operation of the motor vehicle take place. This can be, for example, the motor vehicle manufacturer (OEM) or a vehicle provider (rental car operator, operator of a car sharing fleet or the like).

1. A) Akquirieren von Betriebsdaten des Kraftfahrzeuges während eines Betriebs des Kraftfahrzeuges,
2. B) Transportieren der Betriebsdaten in eine geschützte Sphäre eines Fahrzeugführers des Kraftfahrzeugs,
3. C) Verschlüsseln der Betriebsdaten mit einem Schlüssel innerhalb der geschützten Sphäre eines Fahrzeugführers des Kraftfahrzeugs,
4. D) Ablegen von verschlüsselten Betriebsdaten auf einem Datenspeicher außerhalb der geschützten Sphäre.

In a further variant, the method has the following steps:

1. A) Acquiring operating data of the motor vehicle while the motor vehicle is in operation,
2. B) Transporting the operating data into a protected sphere of a vehicle driver of the motor vehicle,
3. C) Encryption of the operating data with a key within the protected sphere of a vehicle driver of the motor vehicle,
4. D) Storage of encrypted operating data on a data storage device outside of the protected sphere.

Process steps a) to d) can be an alternative to process steps A) to D). Variants of the method are conceivable in which it is determined depending on the situation (preferably depending on an external decision criterion which is taken into account by the method) whether method steps a) to d) or method steps A) to D) are carried out.

Process steps a) to d) and process steps A) to D) of the two process variants detailed here correspond in part. Process step b) corresponds to process step A). Process step d) corresponds to process step D).

The process variants differ in particular with regard to process steps a) and c) as well as B) and C).

According to method step B), the operating data are transported to a protected area of the vehicle driver of the motor vehicle. The definition of a protected sphere corresponds to the above definition of a protected sphere in connection with process step a).

According to method step C), the operating data are encrypted with a key within this protected area.

The encrypted operating data is then stored in method step D). The storage can take place in the protected area of the vehicle driver. The filing can also take place outside the protected sphere, for example in a control unit or a data memory in the motor vehicle.

A major advantage of this method implementation is that symmetrical encryption methods can also be used to encrypt the operating data, in which the same key is used for decryption and encryption without the risk of the key being stolen or duplicated. With such symmetrical methods, the key, which can later also be used for decryption, must be known or available during encryption. This means in particular that an encryption algorithm must be able to access the key for encryption in order to be able to process the operating data together with the key. If the key is not to be known outside the protected area, it is advantageous to transport the operating data to be encrypted into the protected area, to carry out the encryption there and then to transport the encrypted operating data out of the protected area again. Then the key does not have to leave the protected sphere.

The necessity of transporting the operating data into the protected sphere and also out of the protected sphere again may be challenging in such a process management. This can be a large amount of data. The transfer of large amounts of data via common interfaces (WIFI, Bluetooth etc.) is possible without any problems. Another possibility is to reduce the amount of data in the operating data, for example by only encrypting particularly critical / sensitive operating data with the method.

The encryption method which is used in step C) is preferably an encryption method in which it is not possible or only with a very high, practically impossible effort to calculate the key if the same data is in unencrypted form as well as in encrypted form are present. Such encryption methods that can be used here are based, for example, on the AES standard (AES = Advanced Encryption Standard), for example AES-256 with a key length of 256 bits.

The method is particularly preferred if step c) takes place in a separate electronic device of the vehicle driver.

Such a separate electronic device is particularly well suited to provide a protected area for the vehicle driver of the vehicle, which is protected from the vehicle or the vehicle manufacturer or the person responsible for the operation of the vehicle (rental car rental company, car sharing operator, etc.). Usually and preferably, such a separate electronic device is manufactured by a different manufacturer / provider / person responsible and / or made available to the vehicle driver than the motor vehicle. The manufacturer / supplier / person responsible for the operation of the motor vehicle particularly preferably has no way of accessing data within the electronic device.

The separate electronic device can be, for example, a mobile terminal (mobile phone, tablet or the like) of the vehicle driver.

• - Sensordaten von Sensoren zur Überwachung des Umfeldes des Kraftfahrzeugs,
• - Sensordaten von Sensoren zur Überwachung des Innenraums des Kraftfahrzeugs,
• - Meßdaten zur Überwachung von Insassen des Kraftfahrzeugs, und
• - Kameraaufnahmen des Innenraumes,
• - Kameraaufnahmen der Fahrzeugumgebung,
• - Position des Fahrzeugs,
• - Sensordaten zur Überwachung der Fahrzeugfunktion (Motordrehzahl, Akkustand, Bremswirkung),
• - Steuerkommandos des Fahrers (Pedalwinkel, Lenkwinkel),
• - Steuerkommandos (Teil-) Autonomer Fahrsysteme.

The method is particularly advantageous if the operating data include at least one of the following types of data:

• - Sensor data from sensors for monitoring the surroundings of the motor vehicle,
• - Sensor data from sensors for monitoring the interior of the motor vehicle,
• - Measurement data for monitoring occupants of the motor vehicle, and
• - camera recordings of the interior,
• - camera recordings of the vehicle environment,
• - position of the vehicle,
• - Sensor data for monitoring the vehicle function (engine speed, battery level, braking effect),
• - Control commands from the driver (pedal angle, steering angle),
• - Control commands of (partially) autonomous driving systems.

The types of operating data described are not exhaustive here. It is possible that other types of operational data may be recorded. In particular, it is preferred that at least two or even at least three different types of operating data are recorded. Particularly in connection with camera recordings and measurement data for monitoring vehicle occupants, it is necessary that data protection regulations are observed. The method described and the encryption ensure that access to the data is only possible if the vehicle driver of the motor vehicle agrees.

The method is particularly advantageous if the method is carried out in an operating data recorder of the motor vehicle.

Such an operating data recorder is usually constructed in the manner of a control device. Such an operating data recorder can also be implemented as a more virtual component in a hardware control device in which further components are implemented. The hardware control device then provides a virtualization environment in which hardware control devices are stored and can be operated.

• a') Bereitstellen einer Kopie eines (geheimen) Schlüssels, der sowohl zum Verschlüsseln als auch zum Entschlüsseln von Daten verwendet werden kann aus einer geschützten Sphäre eines Fahrzeugführers (in eine temporär geschützte Sphäre, beispielsweise in einem Betriebsdatenrekorder des Kraftfahrzeuges),
• b') Akquirieren von Betriebsdaten des Kraftfahrzeuges während eines Betriebs des Kraftfahrzeuges,
• c') Verschlüsseln der Betriebsdaten mit dem Schlüssel (in der temporär geschützten Sphäre),
• c'') Löschen des Schlüssels (aus der temporär geschützten Sphäre),
• d') Ablegen von verschlüsselten Betriebsdaten auf einem Datenspeicher.

If the method is carried out in an operating data recorder of the motor vehicle, it is usually not possible at the same time to ensure that the encryption is carried out in a protected area of the vehicle driver. In most cases, process steps a) to d) and not A) to D) will then be used. It is then usually not possible or not desirable for symmetrical encryption methods to be used in step C). However, it is conceivable that, in a modified variant of the procedure according to steps a) to d), symmetrical encryption methods are used in step c) in an operating data recorder of the motor vehicle, namely when the vehicle driver has sufficient confidence that the Operating data recorder the key is securely deleted as soon as the implementation of the encryption (step c)) has been completed. If a symmetrical encryption method is carried out in the operating data recorder of the motor vehicle to encrypt the operating data, then the method described preferably has the following sequence:

• a ') Providing a copy of a (secret) key that can be used both for encrypting and for decrypting data from a protected area of a vehicle driver (in a temporarily protected area, for example in an operating data recorder of the motor vehicle),
• b ') Acquiring operating data of the motor vehicle while the motor vehicle is in operation,
• c ') Encryption of the operating data with the key (in the temporarily protected sphere),
• c '') deletion of the key (from the temporarily protected sphere),
• d ') Storage of encrypted operating data on a data memory.

If the data is then to be decrypted, the secret key or a new copy of the secret key can be accessed again.

The method is particularly advantageous if the data memory is arranged in the operating data recorder of the motor vehicle.

The data memory can be arranged in the operating data recorder of the motor vehicle both when performing method steps a) to d) and when performing method steps A) to D). If method steps A) to D) are carried out, in step D) it may be necessary to transport the encrypted operating data back from the protected sphere of the vehicle driver to the motor vehicle or to the operating data recorder.

The data memory is implemented in particular in a non-volatile memory in the operating data recorder. The data are preferably stored in the operating data recorder in such a way that destruction of the data by an accident is completely or at least largely prevented. In this context, the construction of the operating data recorder is preferably designed similar to a black box.

The method is particularly advantageous if the data memory is arranged in an electronic device that is separate from the motor vehicle.

A storage of encrypted operating data in a data memory in a separate electronic device can particularly preferably be used in connection with one of the method steps A) to D).

It is also preferred if the data are stored both in a data memory in a separate electronic device and in a (further) data memory (for example in an operating data recorder).

The method is particularly advantageous if the electronic device is a mobile terminal of the vehicle driver of the motor vehicle.

The data memory can in particular be arranged in a portable electronic device, for example in a chip of a mobile terminal of the vehicle driver of the motor vehicle or also in a cloud. In this way, the driver of the motor vehicle can secure the encrypted operating data without any problems.

Mobile devices are, for example, cell phones, tablets or similar components. The functionalities required for the described method in a sphere of the vehicle driver of the motor vehicle can be easily implemented with such mobile terminals.

It is preferred if a vehicle driver is recognized before the encryption and storage of operating data and the encryption method is set up with the aid of driver-specific encryption information.

A vehicle driver can be identified in a number of different ways. It is possible, for example, to recognize a driver with a camera and / or on the basis of biometric features. If necessary, it is also possible to recognize the driver on the basis of a separate electronic device, for example by using a mobile phone as a separate electronic device to establish a connection to the motor vehicle. In variant embodiments, it is possible, within the framework of setting up the encryption method, to provide a driver-specific key as driver-specific encryption information. In particular, such a driver-specific key is transmitted to the motor vehicle or to an operating data recorder in the motor vehicle. It is also possible to use other methods for vehicle driver authentication which are known, for example, from the field of tachographs.

It is further preferred if, before the encryption (steps c) and / or C)), a public key from the vehicle driver is received by the vehicle and set up in an operating data recorder of the motor vehicle for encryption.

The public key is preferably part of a pair of public key and private key for an asymmetrical encryption method. The establishment of the key in the operating data recorder describes in particular the provision of the key for the implementation of the encryption method in a memory in the control device.

It is also preferred if, before the encryption (steps c) and / or C)), a data connection is set up to a protected area of the vehicle driver, in which the encryption is carried out.

Such a data connection is preferably set up between the protected sphere of the vehicle driver and an operating data recorder of the motor vehicle. This is done either in order to transport operating data for the encryption into the protected sphere of the vehicle driver or out again (procedural control according to steps A) to D) or to transfer a key from the protected sphere of the vehicle driver to the place where the encryption is carried out (for example in a Operational data recorder of the motor vehicle) to transport (process control according to steps a) to d)).

In special design variants of the method described, operating data are protected with different keys or key pairs consisting of a public key and a private key, depending on the trigger of the recording. It is possible, for example, that operating data that are acquired in the context of an accident situation are recognized before decryption and, in addition or as an alternative to the encrypted storage described here, are also stored in another data memory. In particular, it can be implemented in such a way that such data can be decrypted with little or only indirect involvement of the driver, for example in order to be able to clarify the accident situation, if necessary also independently of the driver's consent. In further design variants, it is possible for different operating data to be encrypted with different keys. In particular, it is not necessary that the way described here for storing operating data is the only storage of operating data in a motor vehicle. For example, operational data that are essential for field observation by the OEM and / or operational data for which no or reduced data protection requirements exist can be stored separately. become. It is also possible for a vehicle driver to give general or partial consent to evaluate operating data. Depending on how this consent is given, only parts of the operating data can be excluded from encrypted storage and stored unencrypted.

An operating data recorder for a motor vehicle which is set up to carry out the method described is also intended to be described here.

A computer program product set up to carry out the described method is also to be described.

A machine-readable storage medium on which such a computer program product is stored is also to be described.

The method described here is explained in more detail below with reference to the figures.

• 1: ein Ablaufdiagramm einer ersten Variante des beschriebenen Verfahrens, und
• 2: ein Ablaufdiagramm einer zweiten Variante des beschriebenen Verfahrens.

Show it:

• 1 : a flow chart of a first variant of the method described, and
• 2 : a flow chart of a second variant of the method described.

1 shows the implementation of the method described according to steps a) to d), wherein in the 1 also representational components are shown in which the individual steps a) to d) take place and / or with which the individual steps a) to d) interact.

• b) erfolgt die Akquirierung bzw. das Sammeln und/oder Empfangen von Betriebsdaten 2 von verschiedenen Sensoren 7 in dem Kraftfahrzeug. In Schritt
• c) erfolgt die Verschlüsselung der Betriebsdaten und in Schritt d) werden die verschlüsselten Betriebsdaten 5 in einem Datenspeicher 4 abgelegt. Dieser Datenspeicher 4 kann wahlweise in einem Betriebsdatenrekorder 6 oder in der geschützten Sphäre 3c in dem separaten elektronischen Gerät 8 oder aber auch in einem separaten Datenspeichergerät 10 angeordnet sein.

A motor vehicle can be seen 1 with a production data recorder 6th in which the described steps a) to d) take place. In step a) a secure connection is established 9 to a separate electronic device 8th built in which a protected sphere 3c is arranged. The separate electronic device 8th can for example be a mobile terminal of a vehicle driver of the motor vehicle 1 be. In the protected sphere 3c there is a secret key 3b and also a public key 3a of the driver. The public key 3a is in step a) over the secure connection 9 the operating data recorder 6th in the motor vehicle 1 made available. In step

• b) the acquisition or the gathering and / or receiving of operating data takes place 2 from different sensors 7th in the motor vehicle. In step
• c) the encryption of the operating data takes place and in step d) the encrypted operating data is carried out 5 in a data store 4th filed. This data store 4th can optionally in a production data recorder 6th or in the protected sphere 3c in the separate electronic device 8th or in a separate data storage device 10 be arranged.

2 shows the implementation of the method described in accordance with steps A) to D). 2 is according to 1 built up. The motor vehicle can be seen 1 with the production data recorder 6th . In step A) the operating data recorder collects 6th Operating data 2 from various sensors 7th . The operating data are then transmitted in a step B) via a secure data connection 9 in a protected sphere 3c into a separate electronic device 8th transported. The encryption then takes place there in step C). To do this, there is a key 3a , 3b is used, which is preferably a secret key, but which is preferably not part of a pair of secret key and public key for asymmetric encryption. After encryption, the encrypted operating data is stored 5 in a data store 4th . If necessary, the encrypted operating data is transported back beforehand 5 through the secure data connection 9 back to the operating data recorder 6th . The data store 4th can optionally in a production data recorder 6th or in the protected sphere 3c in the separate electronic device 8th or in a separate data storage device 10 be arranged. When the data store 4th in the separate electronic device 8th is arranged, then step D) is also preferred completely in the separate electronic device 8th executed. This enables the encrypted operating data to be transported back 5 through the secure data connection 9 may be omitted.

Claims (15)

Method for storing operating data (2) that arise during operation of the motor vehicle (1) with a vehicle driver, the operating data (2) being encrypted during storage in such a way that the driver of the motor vehicle is involved in decrypting the operating data (2) (1) is required. Procedure according to Claim 1 , comprising the following steps: a) determining a public key (3a) of a key pair whose secret key (3b) is in a protected sphere (3c) of a driver of the motor vehicle (1), b) acquiring operating data (2) of the motor vehicle (1) during operation of the motor vehicle (1), c) encrypting the operating data with the public key (3a) and an asymmetric encryption method or encrypting the operating data with a temporary key and a symmetric encryption method, with the temporary key then using the public key (3a) and an asymmetric encryption method is encrypted and then deleted, and d) storage of encrypted operating data (5) on a data memory (4). Procedure according to Claim 1 , comprising the following steps: A) Acquiring operating data (2) of the motor vehicle (1) during operation of the motor vehicle (1), B) Transporting the operating data to a protected sphere (3c) of a driver of the motor vehicle (1), C) Encrypting the operating data with a key (3a, 3b) within the protected sphere (3c), D) storing encrypted operating data (5) on a data memory (4) outside the protected sphere. Procedure according to Claim 3 , wherein step C) takes place in a separate electronic device of the vehicle driver. Method according to one of the preceding claims, wherein operating data comprise at least one of the following types of data: Sensor data from sensors (7) for monitoring the surroundings of the motor vehicle (1), - sensor data from sensors (7) for monitoring the interior of the motor vehicle (1), - measurement data for monitoring occupants of the motor vehicle (1), and - camera recordings of the Interior, - Camera recordings of the vehicle environment, - Position of the vehicle, - Sensor data for monitoring the vehicle function (engine speed, battery level, braking effect), - Control commands from the driver (pedal angle, steering angle), - Control commands (partial) autonomous driving systems. Method according to one of the Claims 1 to 5 , the method being carried out in an operating data recorder (6) of the motor vehicle (1). Procedure according to Claim 6 , wherein the data memory (4) is arranged in the operating data recorder (6) of the motor vehicle (1). Procedure according to Claim 6 wherein the data memory (4) is arranged in an electronic device (8) which is separate from the motor vehicle (1). Procedure according to Claim 8 , wherein the electronic device (8) is a mobile terminal of the driver of the motor vehicle (1). Method according to one of the preceding claims, wherein a vehicle driver is recognized before the encryption and storage of operating data (2) and the encryption method is set up with the aid of driver-specific encryption information. Method according to one of the preceding claims, wherein, prior to the encryption, a public key (3a) of the vehicle driver is received by the vehicle driver and set up for encryption in an operating data recorder (6) of the motor vehicle (1). Method according to one of the preceding claims, wherein a secure data connection (9) to a protected sphere (3c) of the vehicle driver, in which the encryption is carried out, is set up before the encryption. Operating data recorder (6) for a motor vehicle (1) which is used to carry out the method according to one of the Claims 1 to 12th is set up. Computer program product set up to carry out the method according to one of the Claims 1 to 12th . Machine-readable storage medium on which a computer program product is based Claim 14 is stored.

Images