EP2469497A1 - Method for recording vehicles - Google Patents

Abstract

The image capturing method involves generating a random identifier of access for an aircraft, after which the captured image of the aircraft and the random identifier are stored in a first memory. An encrypted or hashed value is then formed for the aircraft identifier. The identifier value is recorded during the departure of the aircraft, after which the aircraft identifier during departure is converted into an encrypted or hashed value. If the departure time is greater than the data input time, the identifier stored in the first memory is used and linked with the stored aircraft image.

Description

The present invention relates to a method for image recording of vehicles passing through a distance between an entrance and an exit at too high a speed.

Certain traffic surveillance tasks require a picture of a vehicle to preserve evidence for the punishment of traffic offenses. Examples of this are the so-called "Section Control", in which the entry and exit times of a vehicle are measured at the section of road traveled by the vehicle and used for speed determination. The traffic monitoring systems used for this purpose must meet strict data protection requirements in order to rule out as far as possible the impermissible creation of movement profiles of road users. For example, the statutory regulations in Austria and Germany for the implementation of Section Control require that a permanent identification of a vehicle and its transit data may only be made in the event of a speeding violation.

Previously known systems attempt to meet these data protection requirements by, after identification of the vehicle at the entrance and exit and speed measurement based thereon, if there is no speed penalty, all recorded data within a guaranteed time, eg 8 minutes, be deleted without a trace (see F. Albrecht, "Section Control in Germany", Road Traffic Law, journal for the practice of the traffic lawyer, 2009 ). This procedure is still associated with uncertainties because all transit data at a certain time in the entry and exit stations are available in unencrypted form, regardless of whether it is a Delikatfall or not.

Other solutions are in the scriptures DE 10 2007 059 346 A1 . DE 10 2005 03 65 562 A1 . EP 0 978 811 A2 . US 6,081,206 and AT 8939 U1 described. All these known systems are either expensive or can not eliminate the risk of data misuse and privacy concerns with certainty.

The invention has for its object to provide a method for imaging vehicles passing through a route at too high a speed, which offers the highest possible data protection for the sensitive transit data.

• Erzeugen einer zufälligen Zugriffskennung für ein Fahrzeug an der Einfahrt,
• Aufnehmen eines Bildes des Fahrzeugs an der Einfahrt und Speichern des Einfahrtsbildes und der Zugriffskennung in einem ersten Speicher, der nur über diese Zugriffskennung abrufbar ist,
• Erfassen der Einfahrtszeit und zumindest einer Kennung des Fahrzeugs an der Einfahrt, Bilden eines verschlüsselten oder gehashten Werts dieser Einfahrtskennung und Speichern der Einfahrtszeit, des genannten Werts und der Zugriffskennung als Datensatz in einem zweiten Speicher,
• Erfassen der Ausfahrtszeit und zumindest einer Kennung eines Fahrzeugs an der Ausfahrt, Bilden eines verschlüsselten oder gehashten Werts dieser Ausfahrtskennung und Ermitteln des Datensatzes mit demselben verschlüsselten bzw. gehashten Wert aus dem zweiten Speicher und,
• wenn die Ausfahrtszeit innerhalb einer vorgegebenen Zeitspanne von der Einfahrtszeit dieses Datensatzes liegt, Verwenden der Zugriffskennung aus diesem Datensatz zum Zugriff auf den ersten Speicher, um das dazu gespeicherte Einfahrtsbild des Fahrzeugs abzurufen.

This object is achieved by a method of the type mentioned in the introduction, which comprises the following steps:

• Generating a random access identifier for a vehicle at the entrance,
• Recording an image of the vehicle at the entrance and storing the entry image and the access identifier in a first memory, which is only accessible via this access identifier,
• Detecting the entry time and at least one identifier of the vehicle at the entrance, forming an encrypted or hashed value of this entry identification and storing the entry time, said value and the access identifier as a data record in a second memory,
• Detecting the exit time and at least one identifier of a vehicle at the exit, forming an encrypted or hashed value of that exit identifier, and determining the record with the same encrypted or hashed value from the second memory and,
• if the exit time is within a predetermined time from the entry time of that record, using the access identifier from that record to access the first memory to retrieve the entry image of the vehicle stored therefor.

The invention enables a separate storage of the images of the vehicles in a secure memory and only for the time that is strictly necessary in order to be available in case of a speeding offense. During this time, the images are only under the random Access identifier can be found, which in turn can be determined only by an anonymous comparison of encrypted or hashed entry and exit data. For example, the first memory may be sealed as a "black box" and privacy-certified, and only in the event of an offense the key (the access identifier) is provided for the "sealed" image recordings.

In the present description, an "encrypted value" of the entry or exit identifier is understood as an encryption of this identifier by means of a cryptographic key, so that its knowledge of the decryption is required. A "hashed value" "hash value") of the entry or exit identifier is understood in the present description to mean the application of a virtually irreversible n: 1 mapping function to this identifier, i. a function that is only (extremely) ambiguous reversible, so that from the knowledge of the hash value practically no longer on the output value (the identifier) can be concluded. Examples of such hashing functions are the checksum function, the modulo function, etc.

In the aforementioned comparison, the entry and exit times of quasi "anonymous" encrypted or hashed values are compared; and only if they are within a predetermined period of time is the associated access identifier used to retrieve an image capture. In order for the invention ensures that a pictorial identification of a vehicle is always possible only in case of crime: The said period of time is chosen so that it corresponds to the minimum allowable travel time for the route, i. if a vehicle passes through it at the maximum permissible speed. This significantly increases data security.

In a further development of the invention, an exit image of the vehicle is preferably recorded at the exit, a class of the vehicle is determined therefrom and the time period is predefined as a function of the determined class. This can be different Speed limits for different classes (types) of vehicles are controlled, eg 130 km / h for cars, 100 km / h for trucks, 80 km / h for vehicles with trailers, etc.

In a further preferred embodiment of the invention, the entry images in the first memory are each provided with their recording time and each entry image, which is not retrieved within a predetermined period, is deleted in the first memory. The storage time of the image data in the first memory is thus limited to the minimum necessary period of time, which further reduces the risk of manipulation and unauthorized data access.

For the same purpose, in an alternative preferred embodiment of the invention, it may be provided that if the exit time is not within the aforementioned time from the entry time of said record, the access identifier from that record is used to clear the entry image stored thereto in the first memory ,

Preferably, the first memory is physically separated from the second memory to facilitate the establishment of the first memory as a "black box".

A further preferred embodiment of the invention is characterized in that an exit image of the vehicle is also recorded at the exit and each successfully retrieved entry image is archived together with the exit image and the identification of the vehicle for purposes of proof. As a result, a double proof of evidence for speeding offenses can be achieved.

As identifier of the vehicle, any suitable for an identification feature of the vehicle may be used, for example, a remote-readable VIN, a radio ID of an entrained RFID transponder chip, etc. Preferably, the identifier is simply the vehicle registration number on the license plate of the vehicle and is as a picture or especially preferably alphanumerically by optical character recognition (optical character recognition, OCR) in entry and exit images of the vehicle. Conveniently, the same entry and exit images can be used for this, which are also archived for evidence, so that at the entrance and exit only a single image acquisition is required.

Preferably, his speed can be determined from the entry and exit time of a vehicle and the length of the route between entry and exit.

Optionally, the proper access to the image recordings can additionally be checked by a further offense check within the first memory (the "black box"), in addition to the access identifier, the entry and exit times in a form electronically signed by the entry and exit stations be handed over to the black box. Accordingly, the respective images and entry and exit times are preferably provided at the entrance and exit with an electronic signature of an entry or exit station, and in particular with the access to the first memory, the entry and exit times to the first memory mitgeben, and from first memory is a retrieval of the entrance image only allowed if the entrained entry and exit times are within the specified time period, preferably from the first memory and the signatures of the entry and exit times are checked.

According to another option, the entry and exit images may be stored with a separate key from a third party, e.g. a competent traffic control authority, encrypted in the corresponding memories for control queries by this third party, in particular the authority.

• Fig. 1 ein nach dem Verfahren der Erfindung arbeitendes Section-Control-System schematisch im Überblick; und
• Fig. 2 das Verfahren der Erfindung in Form eines Sequenzdiagramms.

The invention will be explained in more detail with reference to embodiments illustrated in the accompanying drawings. In the drawings shows

• Fig. 1 a working according to the method of the invention section control system schematically at a glance; and
• Fig. 2 the method of the invention in the form of a sequence diagram.

Fig. 1 shows a vehicle 1, which passes a distance 2 of length L from an entrance 3 to an exit 4. The vehicle 1 has a unique identifier 5, for example in the form of its license plate number (LPN). The identifier 5 could alternatively also be formed by other features of the vehicle 1, eg a machine-readable chassis number, a remote-readable radio identifier, eg RFID identifier, etc.

At the entrances and exits 3, 4 are each - only schematically illustrated - entry and exit stations 6, 7 are arranged. The entry station 6 has at least one camera or video camera, with which it can record an entry image PIC _{1 of} the vehicle 1 when passing the driveway 3 and can also detect the entry time TS ₁ . In addition, the entry station 6 also detects the identifier 5 or LPN of the vehicle 1 as "entry detection" LPN ₁ .

The entry detection LPN ₁ can for example be done directly by optical character recognition (OCR) of the vehicle registration number of the vehicle 1 in the entrance image PIC ₁ , or by remote readout of a radio ID from an RFID transponder chip or radio on-board device (OBU) of the vehicle 1, or the like.

The entrance image PIC ₁ , the entry ID LPN ₁ and the entry time TS ₁ are stored by the entry station 6 in databases 8, 9, as later described in detail with reference to Fig. 2 is explained.

The exit station 7 in turn picks up an exit image PIC _{2 of} the vehicle 1 when passing the exit 4 and detects the exit time TS ₂ as well as the identification 5 or LPN of the vehicle 1 as "exit recognition" LPN ₂ . The exit picture PIC ₂ , the exit identifier LPN ₂ and the exit time TS ₂ are temporarily stored in an internal memory 10 of the exit station 7.

The entry and exit stations 6, 7 can communicate directly with one another via a data connection 11, and the method described below can be carried out, for example, directly in the exit station 7. Alternatively, the entry and exit stations 6, 7 can communicate with an evaluation computer 12 in which their data are evaluated in the manner described below.

Fig. 2 shows that with the components of Fig. 1 performed method of the invention in detail. In a first step 13, a separate, unique and random access identifier ("random ID") RID is generated in the entry station 6 for each vehicle 1 that passes the entrance 3. The access identifier RID may be randomly generated, or taken from a list of any prestored access identifiers known only at the entry station 6. In step 13, the entrance image PIC _{1 is also} recorded in the manner described and the entry time TS ₁ and the entrance recognition LPN ₁ detected, for example by OCR evaluation of the entrance image PIC ₁ with respect to the vehicle registration number of the vehicle 1. Subsequently, in step 13 the entry identifier LPN _{1 has formed} a hash h. The hash value h is generated in a virtually irreversible manner from the entry identifier LPN ₁ , as discussed at the beginning.

If an encrypted value of the entry identifier LPN _{1 is} formed instead of a hash value, a key is used for this purpose, which is known only in the entry and exit stations 6, 7. All statements given herein by reference to hash values also apply to such encrypted values.

In step 14, the entry image PIC _{1 is} stored under the random access identifier RID in the first memory 8 of the entry station 6. The memory 8 is a separate, preferably physically also in the form of a "black box" isolated and data protection technology sealed and certified memory, from which the once stored therein Einfahrtsbilder PIC. ₁ only accessible on the basis of their respective access identifier RID.

In step 15, the hash value h (LPN ₁ ) is stored together with the entry time TS ₁ and the access identifier RID as a data record 16 in the second memory 9 of the entry station 6.

At a later time, in step 17, a vehicle 1 passes the exit 4, it being still not clear at first whether it is the same vehicle 1 that has passed the entrance 3 in steps 13-15. In step 17, the exit station 7 detects the exit identifier LPN ₂ and the exit time TS ₂ as well as the exit identifier LPN ₂ , which can be obtained, for example, again from an exit picture PIC ₂ by OCR evaluation of a vehicle license plate recognizable therein. Alternatively or additionally, the exit identifier LPN _{2 could} also be determined from a radio identifier or other characteristic features of the vehicle 1, in which case the inclusion of an exit image PIC _{2 is} not absolutely necessary, but favorable for later proof purposes. From the exit identifier LPN ₂ , the exit station 7 again calculates a hash value h (LPN ₂ ) in the manner discussed above.

If an encrypted value of the entry identifier LPN _{1 was} used in the entry station instead of a hash value, an encrypted value of the same is also formed in the exit station instead of a hash value of the exit identifier LPN ₂ , u.zw. using the same key (or the other part of a corresponding public / private key pair for the entry and exit stations 6, 7).

In the subsequent step 18, the hash value h of the exit identifier LPN _{2 is} used to determine from the second memory 9 of the entry station 6 that data record 16 which contains the same hash value h as obtained from the entry identifier LPN ₁ . This can be one owned by a single vehicle 1 entry time TS ₁ and its stored access identifier RID be determined without the vehicle identification 5 or LPN directly between the entry and exit stations 6, 7 must be replaced.

If the entry and exit identifications LPN ₁ , LPN _{2 are determined} by means of OCR from the entry and exit pictures PIC ₁ , PIC ₂ , due to the error rate of conventional OCR methods, the case may occur that instead of a single correct OCR reading result several different " Candidate IDs LPN ₁ and LPN _2, respectively, as possible OCR read results. From such multiple candidate identifiers LPN ₁ , LPN ₂ , accordingly, a plurality of encrypted or hashed candidate hash values h can also be formed on each side, ie in the entry station and in the exit station; Accordingly, in the retrieval of the record 16 from the second memory 9, the various candidate hash values h of both pages are compared with each other to find out the "matching" record 16 at which these hash values h coincide. Since it is extremely unlikely that the OCRs in the ingress and egress stations will result in exactly the same read errors, and hence the same sets of candidate identifiers and hence candidate hashes h, with very high reliability, there will be exactly one match between the ( Candidate) hash values h of the two sides, so that the method leads to the correct data record 16 even in such cases.

In step 19 it is then compared whether the exit time TS _{2 of} this vehicle 1 is within a predetermined time period t _max of the entry time TS _{1 of the} same vehicle 1. If this is the case (branch "y" of the comparison 19), then it is obviously a speeding error: The vehicle 1 then has the distance L in a shorter than the allowable time t _max and thus with a higher than the maximum speed passed through. In this case, in step 20, the black box memory 8 is accessed using the access identifier RID specified in the data record 16, to derive therefrom the information stored under the access identifier RID Access image PIC ₁ . The entrance image PIC ₁ can be used directly for punishment ("enforcement") of the traffic offense or in an optional step 21 together with the entry and exit times TS ₁ , TS ₂ and the optional exit image PIC ₂ in a memory, eg also in the memory 10. the exit station 7 are archived.

The time span t _max can also be predetermined depending on the type (class) of the vehicle 1. For this purpose, the exit image PIC ₂ can be automatically analyzed to classify the vehicle 1 depicted therein; Depending on the classification result, different time intervals t _max can then be determined and predefined from a stored table in order to define specific speed limits for certain vehicle types, taking into account the length L of the route 2, eg 130 km / h for cars, 100 km / h for trucks. 80 km / h for vehicles with trailers, etc.

A computer (not shown) may retrieve the data generated in step 21 for further sanction, and upon retrieval, preferably, all data in the exit station 7 and memory 10 is deleted.

The black box memory 8 (optionally also the second memory 9) can be designed so that it continuously deletes all those entry pictures PIC ₁ (or optionally also those data TS ₁ , h (LPN ₁ )) after a predetermined period of time from the time TS _{1 of} their detection, preferably after the said time period t _max , not be retrieved. These "unrequested" entry pictures PIC ₁ obviously are pictures of vehicles 1 that have not committed a speeding offense so that they are deleted after expiration of the time period t _max for privacy reasons (step 22). To this end, the image recording or access times TS ₁ can be stored in the first storage ₁ directly to the entrance 8 pictures PIC.

Alternatively, the deletion of the "no-entry" entry pictures PIC ₁ in the first memory 8 (and optionally the data in the second memory 9) are also triggered by the entry station 6 using the entry times TS ₁ from the second memory 9 if the current time is greater than the entry time TS ₁ plus the time period t _max .

Yet another alternative is shown in the optional step 23, which is traversed at the "no" branch of the comparison 19. The clearing of the entry-free entry pictures PIC ₁ is initiated in step 23 by the exit station 7, which sends a request to the black box memory 8 (and optionally the second memory 9) or the entry station 6 for deleting the entry picture (and optionally the data of the memory 9) sends. A compliant vehicle thus leaves no identifiable traces in the system, which ensures the highest data security.

The steps 17 - 21 or 23 of the method can - except in the detection of the exit time TS ₂ and the exit image PIC ₂ - instead of in the exit station 7 in the (optional) evaluation computer 12 are performed, if desired.

The entry and exit pictures PIC ₁ , PIC ₂ can optionally be encrypted with a key of an authority and provided in the corresponding memories 8, 9, 10 for control inquiries by the authority.

The invention is not limited to the illustrated embodiments, but includes all variants and modifications that fall within the scope of the appended claims.

Claims (12)

A method of image acquisition (PIC ₁ ) of vehicles (1) passing through a route (2) between an entrance (3) and an exit (4) at high speed, comprising: Generating a random access identifier (RID) for a vehicle (1) at the entrance (3), Taking a picture (PIC ₁₎ of the vehicle (1) at the entrance (3) and storing the entry image (PIC ₁₎ and the access identifier (RID) in a first memory (8) only via this access identifier (RID) is available . Detecting the entry time (TS ₁ ) and at least one identifier (LPN ₁ ) of the vehicle at the entrance (3), forming an encrypted or hashed value (h) of this entry identifier (LPN ₁ ) and storing the entry time (TS ₁ ), of said Value (h (LPN ₁ )) and the access identifier (RID) as a record (16) in a second memory (9), Detecting the exit time (TS ₂ ) and at least one identifier (LPN ₂ ) of a vehicle (1) at the exit (4), forming an encrypted or hashed value (h) of this exit identifier (LPN ₂ ) and determining the record (16) with the same encrypted or hashed value (h) from the second memory (9) and, if the exit time (TS ₂ ) lies within a predetermined period of time (t _max ) of the entry time (TS ₁ ) of this data record (16), using the access identifier (RID) from this data record (16) to access the first memory (8) to retrieve the stored entrance image (PIC ₁ ) of the vehicle (1). A method according to claim 1, characterized in that at the exit (4) and an exit image (PIC ₂ ) of the vehicle (1) recorded and from a class of the vehicle (1) is determined, and that the time period (t _max ) depending on the determined class is specified. Method according to Claim 1 or 2, characterized in that the entry images (PIC ₁ ) in the first memory (8) are each provided with their recording time (TS ₁ ) and each entry image (PIC ₁ ) which is not within a predetermined period of time (t _max ) is cleared in the first memory (8). A method according to claim 1 or 2, characterized in that , if the exit time (TS ₂ ) is not within the said time period (t _max ) of the entry time (TS ₁ ) of said record (16), the access identifier (RID) therefrom Record (16) is used to delete the entry in the first memory (8) stored entrance image (PIC ₁ ). Method according to one of Claims 1 to 4, characterized in that the first memory (8) is physically separated from the second memory (9). Method according to one of Claims 1 to 5, characterized in that an exit image (PIC ₂ ) of the vehicle (1) is recorded at the exit (4) and each entry image (PIC ₁ ) retrieved successfully together with the exit image (PIC ₂ ) and the identification (LPN) of the vehicle is archived for evidential purposes. Method according to one of Claims 1 to 6, characterized in that the vehicle identifier is used as identifier (LPN) and detected by optical character recognition in entry and exit images (PIC ₁ , PIC ₂ ) of the vehicle (1). Method according to one of claims 1 to 7, characterized in that from the entry and exit time (TS ₁ , TS ₂ ) of a vehicle (1) and the length (L) of the traversed route (2) between entry and exit (3 , 4) its speed is determined. A method according to any one of claims 1 to 8, characterized in characterized in that at the entrance (3) and the exit (4) the respective images (PIC _1, PIC ₂₎ and the entry and exit times (TS _1, TS ₂₎ with an electronic Signature of an entry or exit station (6, 7) are provided. Method according to one of Claims 1 to 9, characterized in that when the first memory (8) is accessed, the entry and exit times (TS ₁ , TS ₂ ) are also transmitted to the first memory (8) and transmitted from the first memory (8). a retrieval of the entry image (PIC ₁ ) is only allowed if the entrained entry and exit times (TS ₁ , TS ₂ ) are within the specified time period (t _max ). Method according to claims 9 and 10, characterized in that the signatures of the entry and exit times (TS ₁ , TS ₂ ) are also checked by the first memory (8). Method according to one of Claims 1 to 11, characterized in that the entry and exit images (PIC ₁ , PIC ₂ ) are provided encrypted with a separate key in the corresponding memories (8, 9, 10) for control queries.

Images