EP3026640A1 - Method for providing vehicle data of a vehicle, method for evaluating vehicle data of at least one vehicle and method for monitoring a traffic event - Google Patents

Abstract

The invention relates to a method for providing vehicle data (262) of a vehicle (140). In this case, the method can be carried out by means of a supply device (130) arranged in-vehicle. The method has a step of reading in vehicle data (262) detected by means of at least one detection device (242) of the vehicle (140). Also, the method comprises a step of generating a data message comprising the read vehicle data (262). The method also includes a step of providing the generated data message with at least one digital signature to generate an authenticated data message (264). Furthermore, the method comprises a step of outputting the authenticated data message (264) to a transmission interface (244) in order to provide the vehicle data (262) to an external evaluation device.

Description

State of the art

The present invention relates to a method for providing vehicle data of a vehicle, to a method for evaluating vehicle data of at least one vehicle, to a method for monitoring a traffic event, to a corresponding device or to a corresponding system and to a corresponding computer program.

It is possible that the automated driving, and in particular the highly automated driving, is allowed by the legislature initially only on defined routes or sections of track. This may require a legal framework for the resolution of accidents involving highly automated vehicles. A legal requirement for the introduction of accident data recorders for automated driving is likely. The DE 100 59 679 A1 discloses an accident diagnostic system that wirelessly transmits the data of an accident data recorder to a portable base unit that can be used by a person to read the accident data.

Disclosure of the invention

Against this background, with the approach presented here, a method for providing vehicle data of a vehicle, a method for evaluating vehicle data of at least one vehicle, a method for Monitoring a traffic event, further comprising a device or a system having means adapted to perform all the steps of such a method, and finally a corresponding computer program presented according to the main claims. Advantageous embodiments emerge from the respective subclaims and the following description.

According to embodiments of the present invention, in particular a vehicle data recorder or a vehicle data recorder functionality can be realized with a highly available cloud connection for storing sensor and status data as well as operator interventions. For example, an insert may be provided in combination with semi-automated, fully automated or highly automated driving. Such a vehicle data recorder or such vehicle data recorder functionality may, but not exclusively, be applied to such route sections, sections or road sections that are released in a regulatory manner for highly automated driving. According to embodiments of the present invention, in particular a continuous, for example wireless, automatic transmission, for example in real time or near real-time, of vehicle data, in particular safety-related or accident-related data, from vehicles to an, for example, scalable, high-availability, cost-effectively representable online storage can be realized ,

Advantageously, according to embodiments of the present invention, for example by means of security mechanisms and methods for ensuring data integrity, a conclusive reconstruction of accident occurrences can be achieved. A provision of relevant vehicle data is carried out automatically without the need for manual intervention or a required manual readout of an accident data recorder can be avoided. In this case, it is possible to use particularly extensive and therefore meaningful quantities of vehicle data, for example of different sensor technology origin. A more reliable detection and reconstruction of accident occurrences, for example with the involvement of several vehicles, can be realized. In an accident or other safety-critical Event such vehicle data can thus be particularly well suited as evidence, for example, a subsequent manipulation can be technically prevented or data integrity can be detected. Further, a risk of casualty data loss due to immediate accident consequences, such as destruction of data storage, power interruption, or the like, may be dispelled. Thus, a cost-inefficient storage of large amounts of data in the vehicle and additionally or alternatively a cost-inefficient transmission of large, especially unfiltered, amounts of data on the Internet or in the so-called cloud can be avoided. Using, for example, known security mechanisms, data integrity, data authenticity and privacy can be ensured.

• Einlesen von Fahrzeugdaten, die mittels zumindest einer Erfassungseinrichtung des Fahrzeugs erfasste Daten repräsentieren;
• Erzeugen einer Datennachricht, welche die eingelesenen Fahrzeugdaten umfasst;
• Versehen der erzeugten Datennachricht mit zumindest einer digitalen Signatur, um eine authentifizierte Datennachricht zu generieren; und
• Ausgeben der authentifizierten Datennachricht an eine Sendeschnittstelle, um die Fahrzeugdaten an eine fahrzeugexterne Auswertevorrichtung bereitzustellen.

A method is provided for providing vehicle data of a vehicle, the method being executable by means of an in-vehicle provisioning device, the method comprising the following steps:

• Reading in vehicle data representing data acquired by means of at least one detection device of the vehicle;
• Generating a data message comprising the read vehicle data;
• Providing the generated data message with at least one digital signature to generate an authenticated data message; and
• Outputting the authenticated data message to a transmit interface to provide the vehicle data to an on-vehicle evaluation device.

The vehicle may be a road vehicle, an aircraft or a watercraft, in particular a road-bound motor vehicle, for example a passenger car, truck or any commercial vehicle. The vehicle data may be suitable to draw conclusions about safety-critical events or situations allow the vehicle or an adjacent vehicle adjacent to the vehicle are exposed in a traffic event. The transmission interface can be designed to transmit the authenticated data message to the vehicle-external evaluation device, in particular wirelessly. The steps of the method may be performed in an automated, repeated and / or intermittent or continuous manner.

According to one embodiment, in the step of providing, the generated data message may be provided with a digital device signature of the at least one sensing device or controller of the vehicle and additionally or alternatively with a driver's digital personal signature of the vehicle. In this case, the at least one detection device or the control device of the vehicle can be designed to generate the device signature and additionally or alternatively to provide the data message with the device signature. The at least one detection device can also be designed to provide the vehicle data with the device signature. The personal signature may be generated using an identification device personally issued to a driver of the vehicle, such as a smart card, particularly an identity card, or the like. Such an embodiment offers the advantage that a legally binding and indisputable signing of the vehicle data is made possible, so that an assignment of a driver's identity to possible accident data can be done reliably, ie. H. it is possible to provide reliable proof of who was the driver of the vehicle at the time of the accident.

In the step of reading, sensor raw data, information derived from raw sensor data, data on actions automated by the vehicle and additionally or alternatively data about driver interventions can be read in as the vehicle data. Thus, the vehicle data may include information representing raw sensor data, object lists, and additionally or alternatively automated actions performed by the vehicle. Here, the vehicle data of at least one detection device or at least one sensor, at least one driver assistance device, at least one user interface and additionally or alternatively at least come from a controller. Such an embodiment offers the advantage that a comprehensive, comprehensive and meaningful selection of vehicle data can be provided. Thus, for example, an accident situation can be more reliably constructed in an accident situation.

Also, in the step of generating the data message, at least a subset of the read-in vehicle data can be encrypted. Such an embodiment offers the advantage that privacy or privacy can be improved.

Furthermore, in the step of reading a user input signal can be read in, which represents a reference criterion for a safety-relevant traffic event. In this case, the user input signal can be output to the transmission interface in the step of outputting. The user input signal may represent information about manual actuation of a vehicle-based emergency button, emergency switch, or the like by a vehicle occupant. The information criterion of the user input signal can be used by a subsequently executable method for evaluating the vehicle data in order to permanently store safety-relevant and additionally or alternatively accident-relevant vehicle data. Such an embodiment offers the advantage that a recognizability of a safety relevance of provided vehicle data can be increased by the user input signal, since in this way a recognition rate achievable by only information processing means can be increased for every imaginable accident situation involving human sensory perception.

• Empfangen zumindest einer authentifizierten Datennachricht, die eine gemäß einer Ausführungsform des vorstehend genannten Verfahrens bereitgestellte Datennachricht repräsentiert, um Fahrzeugdaten von dem zumindest einem Fahrzeug zu empfangen; und
• Durchführen eines Vergleichs der Fahrzeugdaten mit zumindest einem Hinweiskriterium für ein sicherheitsrelevantes Verkehrsereignis, um die Fahrzeugdaten auszuwerten.

A method for evaluating vehicle data of at least one vehicle is also presented, it being possible to carry out the method by means of at least one evaluation device arranged on the outside of the vehicle, the method comprising the following steps:

• Receiving at least one authenticated data message that provides one according to one embodiment of the above-mentioned method Data message represents to receive vehicle data from the at least one vehicle; and
• Performing a comparison of the vehicle data with at least one notification criterion for a safety-relevant traffic event in order to evaluate the vehicle data.

The method for evaluating vehicle data may be advantageously carried out in connection with an embodiment of the aforementioned method for providing the vehicle data. The at least one evaluation device can be embodied as a device or peripheral device arranged adjacent to a traffic route and additionally or alternatively as a central system. The central system can be realized using so-called cloud computing. The at least one notification criterion can have a default parameter, a threshold value, a data pattern and additionally or alternatively a received user input signal that represents a notification criterion for a security-relevant traffic event.

Also, the method may include a step of adding a timestamp and additionally or alternatively a digital signature to the received at least one authenticated data message. In this case, the at least one evaluation device can be designed to generate the digital signature and additionally or alternatively to provide the authenticated data message with the digital signature. The time stamp can be related to a reliable time reference or generated after a comparison with a reliable time difference. Such an embodiment offers the advantage that manipulation by falsification of a local time in the vehicle prevented and thus a security regarding a genuineness of the vehicle data can be increased.

According to one embodiment, wherein the method is carried out by means of a plurality of evaluation devices arranged externally of the vehicle, the method can comprise a step of synchronizing the evaluation devices with one another using a common Have time reference. In this case, each of the plurality of evaluation devices may be designed to carry out the method for evaluation. Such an embodiment offers the advantage that, by means of such a time synchronization, it is possible or at least made easier to clarify questions of fault, accident causes or the like in accidents involving several parties. Unequivocal accident detection and unambiguous accident reconstruction can be achieved due to such time synchronization through the introduction of a common time base and appropriate fusing of vehicle data from multiple vehicles in at least one evaluation device.

Furthermore, the method may include a step of forwarding at least a subset of the vehicle data to a memory interface to a memory device as a function of the comparison and additionally or alternatively of at least one hint criterion. If this indicates at least one reference criterion and additionally or alternatively the comparison reveals that vehicle data is related to a safety-relevant traffic event, this vehicle data can be forwarded to a memory device in the step of forwarding to the memory interface. If this indicates at least one indication criterion and additionally or alternatively the comparison reveals that vehicle data are irrelevant with regard to safety-relevant traffic event, then in a step of discarding at least a subset of the vehicle data can be discarded. Such an embodiment offers the advantage that the received vehicle data initially only need to be cached, for example in a ring buffer or the like, and only upon detection of an accident or a critical situation or a manual triggering by user input signal further evaluation and additionally or alternatively one be stored permanently, so that an amount of data to be archived can be reduced.

In this case, the method may comprise a step of storing forwarded vehicle data by means of a memory device in the at least one evaluation device. In this case, at least one first evaluation device acting as one adjacent to a traffic route arranged peripheral device may be performed, and additionally or alternatively be provided at least a second evaluation device, which may be designed as a central system. In this case, the at least one first evaluation device may have a first storage device for temporary storage of vehicle data, and the at least one second evaluation device may have a second storage device for permanent or long-term storage of vehicle data. Such an embodiment offers the advantage that as an alternative to a continuous data transmission from at least one vehicle directly into a memory device of a central evaluation device or a so-called cloud backend with the proposed method, an upstream intermediate storage of the vehicle data in a memory device of a peripheral evaluation device or a so-called Roadside Unit (RSU) can be performed. Storing data in an evaluation device remote from the vehicles minimizes a likelihood of data loss in the vehicle due to immediate accident consequences or the like. Corresponding data backup measures can be implemented more cost-effectively in an evaluation device than in the vehicle. Thus, the use of cost-effective storage devices instead of cost-intensive, for example, certified for the automotive sector, storage is possible. By shifting complex accident detection algorithms from the vehicle into a central device, on-board system complexity can be reduced. For example, cloud-based accident loggers are inexpensive to maintain and update.

The method may also include a step of anonymizing and additionally or alternatively a step of encrypting at least a subset of the vehicle data. Such an embodiment offers the advantage that a role-based process for ensuring data protection and for controlling access permissions, such as by authorities, insurance companies, vehicle owners and / or the like, can be provided.

• Bereitstellen von Fahrzeugdaten eines Fahrzeugs gemäß einer Ausführungsform des vorstehend genannten Verfahrens zum Bereitstellen; und
• Auswerten von Fahrzeugdaten zumindest eines Fahrzeugs gemäß einer Ausführungsform des vorstehend genannten Verfahrens zum Auswerten.

Furthermore, a method for monitoring a traffic event is presented, wherein the method comprises the following steps:

• Providing vehicle data of a vehicle according to an embodiment of the above method of providing; and
• Evaluating vehicle data of at least one vehicle according to an embodiment of the aforementioned method for evaluation.

The method of monitoring may be advantageously carried out in connection with an embodiment of the aforementioned method for providing the vehicle data as well as in connection with an embodiment of the above-mentioned method for evaluating the vehicle data.

The approach presented herein further provides an apparatus or system having means adapted to perform, control, or implement the steps of one embodiment of a method presented herein. Also by this embodiment of the invention in the form of a device or a system, the object underlying the invention can be solved quickly and efficiently.

In the present case, a device or a system can be understood to mean an electrical device or a composite of electrical devices which process sensor signals and output control and / or data signals in dependence thereon. The device or the system may have an interface, which may be designed in hardware and / or software. In the case of a hardware-based embodiment, the interfaces can be part of a so-called system ASIC, for example, which contains a wide variety of functions of the device. However, it is also possible that the interfaces are their own integrated circuits or at least partially consist of discrete components. In a software training, the interfaces may be software modules that are present, for example, on a microcontroller in addition to other software modules.

Also of advantage is a computer program product or computer program with program code which can be stored on a machine-readable carrier or storage medium such as a semiconductor memory, a hard disk memory or an optical memory and for carrying out, implementing and / or controlling the steps of the method according to one of the embodiments described above is used, especially when the program product or program is executed on a computer or a device.

• Fig. 1 eine schematische Darstellung eines Verkehrsüberwachungssystems gemäß einem Ausführungsbeispiel der vorliegenden Erfindung in einer Verkehrsumgebung;
• Fig. 2 eine schematische Darstellung einer Bereitstellungsvorrichtung eines Verkehrsüberwachungssystems gemäß einem Ausführungsbeispiel der vorliegenden Erfindung;
• Fig. 3 eine schematische Darstellung von Auswertevorrichtungen eines Verkehrsüberwachungssystems gemäß einem Ausführungsbeispiel der vorliegenden Erfindung;
• Fig. 4 eine schematische Darstellung eines fahrzeugseitigen Teils eines Verkehrsüberwachungssystems gemäß einem Ausführungsbeispiel der vorliegenden Erfindung;
• Fig. 5 eine schematische Darstellung eines streckenseitigen Teils eines Verkehrsüberwachungssystems gemäß einem Ausführungsbeispiel der vorliegenden Erfindung;
• Fig. 6 eine schematische Darstellung eines Fahrzeugdatenpakets gemäß einem Ausführungsbeispiel der vorliegenden Erfindung;
• Fig. 7 ein Ablaufdiagramm eines Verfahrens zum Überwachen gemäß einem Ausführungsbeispiel der vorliegenden Erfindung;
• Fig. 8 ein Ablaufdiagramm eines Verfahrens zum Bereitstellen gemäß einem Ausführungsbeispiel der vorliegenden Erfindung; und
• Fig. 9 ein Ablaufdiagramm eines Verfahrens zum Auswerten gemäß einem Ausführungsbeispiel der vorliegenden Erfindung.

The approach presented here will be explained in more detail below with reference to the accompanying drawings. Show it:

• Fig. 1 a schematic representation of a traffic monitoring system according to an embodiment of the present invention in a traffic environment;
• Fig. 2 a schematic representation of a provisioning device of a traffic monitoring system according to an embodiment of the present invention;
• Fig. 3 a schematic representation of evaluation devices of a traffic monitoring system according to an embodiment of the present invention;
• Fig. 4 a schematic representation of an on-vehicle part of a traffic monitoring system according to an embodiment of the present invention;
• Fig. 5 a schematic representation of a trackside portion of a traffic monitoring system according to an embodiment of the present invention;
• Fig. 6 a schematic representation of a vehicle data packet according to an embodiment of the present invention;
• Fig. 7 a flowchart of a method for monitoring according to an embodiment of the present invention;
• Fig. 8 a flowchart of a method for providing according to an embodiment of the present invention; and
• Fig. 9 a flowchart of a method of evaluation according to an embodiment of the present invention.

In the following description of favorable embodiments of the present invention, the same or similar reference numerals are used for the elements shown in the various figures and similar acting, with a repeated description of these elements is omitted.

Fig. 1 1 shows a schematic representation of a traffic environment with a traffic monitoring system 100, also called a system for monitoring a traffic event, according to an exemplary embodiment of the present invention. According to the in Fig. 1 In accordance with an exemplary embodiment of the present invention, the traffic monitoring system 100 has a central evaluation device 110, a plurality of peripheral evaluation devices 120 and a plurality of delivery devices 130.

Each of the plurality of provisioning devices 130 is arranged in a vehicle 140. Each provisioning device 130 is configured to provide vehicle data of the vehicle 140 in which it is disposed. The provision of the vehicle data is explained in more detail below with reference to the following figures.

The vehicles 140 are in accordance with the in Fig. 1 illustrated embodiment of the present invention road-bound motor vehicles. Two of the vehicles 140 are involved in an accident event 145, such as a collision of the two vehicles 140. The plurality of vehicles 140 are part of a traffic event on a road 150. In Fig. 1 are For example, four vehicles 140 on the road 150 or a road section or section shown.

The peripheral evaluation devices 120 are stationary and arranged along the road 150. The central evaluation device 110 is stationary and arranged at a distance from the road 150. The peripheral evaluation devices 120 and the central evaluation device 110 are designed to evaluate the vehicle data of the vehicles 140. The evaluation of the vehicle data is explained in more detail below with reference to the following figures.

As it is in Fig. 1 is illustrated by antenna symbols, the provisioning devices 130 and the peripheral evaluation devices 120 are wirelessly communicatively coupled to each other. The peripheral evaluation devices 120 and the central evaluation device 110 are fixed installations. The connection between the systems 110, 120 is therefore advantageously wired in the current state of the art, since it enables, for example, higher capacity, less latency, higher reliability, less interference and better time synchronization. It is possible that suitable wireless technologies will be available in the future. Even today, the data transmission between the systems 110, 120 can be implemented wirelessly, but from a technical point of view, this only makes sense if no wired data lines are available.

According to one exemplary embodiment, instead of the peripheral evaluation devices 120 and the central evaluation device 110, only one evaluation device may be provided.

Fig. 2 1 shows a schematic illustration of a provisioning device 130 of a traffic monitoring system according to an embodiment of the present invention in a vehicle 140 Fig. 2 Provisioning device 130 shown or device for providing vehicle data of a vehicle in this case corresponds to one of the in Fig. 1 shown delivery devices or similar provisioning device.

The provisioning device 130 has a read-in device 232, a generation device 234, a signing device 236 and an output device 238. From the vehicle 140 are in the illustration of Fig. 2 In addition to the provisioning device 130, by way of example only a detection device 242 and a transmission interface 244 are shown.

The detection device 242, in which, according to the in Fig. 2 Illustrated embodiment of the present invention by way of example by a vehicle camera, is designed to detect vehicle data 262. Also, the detector 242 is configured to provide the vehicle data 262 to the provider 130.

The read-in device 232 of the provision device 130 is designed to read in the vehicle data 262 detected by the detection device 242. The read-in device 232 is also designed to forward the read-in vehicle data 262 to the generation device 234. For example, the read-in device 232 is designed to read sensor raw data, information derived from sensor raw data, data on actions performed automatically by the vehicle 140, and additionally or alternatively data on driver interventions as the vehicle data 262.

The generation device 234 is designed to generate a data message comprising the read-in vehicle data 262 using the read-in vehicle data 262. Also, the generator 232 is configured to provide the generated data message to the signer 236. In one embodiment, the generator 234 is further configured to encrypt at least a subset of the vehicle data 262 when generating the data message.

The signing device 236 in turn is designed to provide the generated data message with at least one digital signature in order to generate an authenticated data message 264. Also, the signer 236 is configured to forward the authenticated data message 264 to the output device 238. Optionally, the signer 236 It is designed to provide the generated data message with a digital device signature of the detection device 242 or a control device of the vehicle 140 and additionally or alternatively with a digital person signature of a driver of the vehicle 140.

The output device 238 is designed to output the authenticated data message 264 to the transmission interface 244. The transmission interface 244 is an interface to a vehicle-external evaluation device. In this case, the authenticated data message 264 can be transmitted by means of the transmission interface 244 wirelessly to the vehicle-external evaluation device. This is indicated by an antenna symbol in Fig. 2 illustrated.

In one embodiment, the read-in device 232 may be configured to read in a user input signal representing a safety-related traffic event alert criterion. Here, the output device 238 may be configured to output the user input signal to the transmission interface 244 to the vehicle-external evaluation device.

Fig. 3 shows a schematic representation of evaluation devices 110 and 120 of a traffic monitoring system or devices for evaluating vehicle data of at least one vehicle according to an embodiment of the present invention. In the Fig. 3 shown evaluation devices 110 and 120 correspond to in Fig. 1 shown evaluation or similar evaluation devices. In Fig. 3 In this case, the central evaluation device 110 and one of the peripheral evaluation devices 120 are made Fig. 1 shown in more detail. In this case, each of the peripheral evaluation devices Fig. 1 essentially the in Fig. 3 represented peripheral evaluation device 120 correspond or be similar.

The central evaluation device 110 and the peripheral evaluation device 120 jointly have a receiving device 321, a comparison device 322, an adding device 323, a synchronization device 324, a forwarding device 325, a Memory device 326, an anonymizer 327 and an encryption device 328 on. In this case, the central evaluation device 110 and the peripheral evaluation device 120 are connected to one another in a data-transfer-capable manner in a wireless manner. This is due to antenna symbols in Fig. 3 illustrated.

According to the in Fig. 3 In accordance with an exemplary embodiment of the present invention, the peripheral evaluation device 120 has, for example, the receiving device 321, the comparison device 322, the adding device 323, the synchronization device 324 and the forwarding device 325. The central evaluation device 110 has the memory device 326, the anonymizer 327 and the encryption device 328. According to another exemplary embodiment, the peripheral evaluation device 120 may have the receiving device 321 and optionally the adding device 323 and possibly the synchronization device 324, and the central evaluation device 110 may be the comparison device 322, the forwarding device 325, the storage device 326 and optionally the anonymizing device 327 and optionally the encryption device 328 exhibit.

The receiving device 321 is designed to receive at least one authenticated data message 264 transmitted by a provisioning device of at least one vehicle by means of a transmission interface via a receiving interface. In other words, the receiving device 321 is designed to receive at least one authenticated data message 264 that is output by means of one of the provisioning devices Fig. 1 is provided. In one embodiment, the receiving device 321 is configured to pass the received authenticated data message 264 to the comparing device 322.

The comparison device 322 is designed to compare the vehicle data represented by the received authenticated data message 264 with at least one security-relevant reference criterion Traffic event. According to the in Fig. 3 illustrated embodiment of the present invention, the comparison device 322 is arranged in the peripheral evaluation device 120. The comparison device 322 is designed to output the authenticated data message 264 to the forwarding device 325. Alternatively or additionally, the central evaluation device 110 may have the comparison device 322.

According to the in Fig. 3 In accordance with an exemplary embodiment of the present invention, the peripheral evaluation device 120 also has the addition device 323 and the synchronization device 324. In this case, the receiving device 321 is designed to pass on the received authenticated data message 264 to the adding device 323. The adding device 323 is configured to add a time stamp and additionally or alternatively a digital signature to the at least one received, authenticated data message 264. The addition device 323 is also designed to output the authenticated data message 264 supplemented by the time stamp and / or the digital signature to the comparison device 322. The synchronization device 324 is designed to perform a time synchronization with other peripheral evaluation devices and additionally or alternatively with the central evaluation device 110 using a common time reference or with reference to a common time reference. In this case, the synchronization device 324 is capable of transmitting data to the adding device 323 as well as to other peripheral evaluation devices.

The forwarding device 325 is configured to forward at least a subset of the vehicle data from the at least one authenticated data message 264 to a memory interface to the memory device 326. In this case, the forwarding device 325 is designed to forward or discard vehicle data from the at least one authenticated data message 264 as a function of the comparison carried out by the comparison device 322 and additionally or alternatively as a function of at least one reference criterion. The memory interface is according to the in FIG. 3 illustrated embodiment of the present invention as a wireless data connection between the peripheral evaluation device 120 and the central processing device 110 executed. According to the in Fig. 3 illustrated embodiment of the present invention, the relay 325 is disposed in the peripheral evaluation device 120. Alternatively or additionally, the central evaluation device 110 may have the forwarding device 325.

The memory device 326 is configured to store the forwarded vehicle data from the at least one authenticated data message 264. The memory device 326 is arranged in the central evaluation device 110.

According to the in Fig. 3 illustrated embodiment of the present invention, the central evaluation device 110, the anonymizer 327 and the encryption device 328 on. In this case, the anonymizing device 327 and the encryption device 328 are, for example, capable of transmitting data with one another and are connected to the memory device 326. The anonymizer 327 is configured to anonymize at least a subset of the vehicle data. The encryption device 328 is designed to encrypt at least a subset of the vehicle data. Optionally, the central evaluation device 110 may have only the anonymizer 327 or the encryption device 328. According to one embodiment, the peripheral evaluation device 120 may comprise the anonymizer 327 and additionally or alternatively the encryption device 328.

Fig. 4 shows a schematic representation of an on-vehicle part of a traffic monitoring system according to an embodiment of the present invention. In this case, the vehicle-side part of the traffic monitoring system has a provisioning device 130, which is arranged in a vehicle 140. In the Fig. 4 Provisioning device 130 shown corresponds to one of the in Fig. 1 Deployment devices shown in Fig. 2 illustrated provisioning device or similar provisioning device.

From the vehicle 140 are in Fig. 4 In addition to the provisioning device 130, a plurality of detectors 442A, 442B, 442C, 442D and 442E, a driver authentication device 446 and a manual trigger 448 are further shown. In this case, the plurality of detectors 442A, 442B, 442C, 442D and 442E as well as the driver authentication device 446 and the manual trigger 448 are communicatively connected to the provisioning device 130.

The plurality of detectors 442A, 442B, 442C, 442D and 442E are configured to transmit vehicle data to the providing device 130. According to the in Fig. 4 A second detection device 442B is designed as sensor system for operating interventions such as for steering angle, brake actuation and / or the like, is a third detection device 442C as a position detecting means such as a GPS (Global Positioning System) receiver or the like, a fourth detecting means 442D is implemented as an interface to a controller for detecting data about airbag deployment and / or the like, for example, and is a fifth Detection device 442E designed as a sensor for vehicle data from other data sources.

The driver authentication device 446 is configured to perform an authentication of a driver's identity of the vehicle 140. For example, the driver authentication device 446 is designed to read in data from a smartcard, in particular from an identity card or the like, or from another identification means. Further, the driver authentication device 446 is configured to output authentication data for creating the digital person signature to the provisioning device 130.

The manual trigger 448 is configured to be indicative of a safety-critical or safety-related traffic event Generate user input signal in response to a user input. In this case, the manual release device 448, for example, have an emergency button or the like.

Fig. 5 shows a schematic representation of a trackside portion of a traffic monitoring system according to an embodiment of the present invention. In this case, the trackside part of the traffic monitoring system has a central evaluation device 110, by way of example only three explicitly illustrated, peripheral evaluation devices 120 and a network 515. In the Fig. 5 shown evaluation devices 110 and 120 correspond to the in Fig. 1 shown evaluation, the in Fig. 3 illustrated evaluation or similar evaluation devices.

The peripheral evaluation devices 120 are data transmission-wise connected to the central evaluation device 110 by means of the network 515. In this case, the peripheral evaluation devices 120 are designed, for example, as so-called road side units (RSU). The peripheral evaluation devices 120 are designed to add an additional signature to at least one received authenticated data message from a provisioning device of at least one vehicle. The central evaluation device 110 is designed to realize cloud service, accident detection, data storage, archiving and / or the like.

Fig. 6 shows a schematic representation of a vehicle data packet according to an embodiment of the present invention. The illustrated vehicle data packet includes vehicle data 262, such as the vehicle data Fig. 2 , The vehicle data packet also comprises an authenticated data message 264, for example the authenticated data message Fig. 2 respectively. Fig. 3 ,

In this case, the authenticated data message 264 has, in addition to the vehicle data 262, a digital device signature 602 and a digital person signature 604. The vehicle data 262 are by means of a Signing device of a provisioning device, such as by means of the signing device of the provisioning device from one of FIGS. 1 . 2 and 4 , provided with the digital device signature 602 and the digital person signature 604.

In addition to the authenticated data message 264, the vehicle data packet comprises a time stamp 610 and a digital signature 612 of an evaluation device, such as one of the evaluation devices from one of the FIGS. 1 . 3 and 5 , The authenticated data message 264 are by means of an adding device of an evaluation device, such as by means of the adding device of an evaluation of one of FIGS. 1 . 3 and 5 , the timestamp 610 and the digital signature 612 added.

Thus, the vehicle data packet includes the vehicle data 262, the digital device signature 602, the digital personal signature 604, the timestamp 610, and the digital signature 612. The vehicle data packet is by means of a memory device of an evaluation device, such as the memory device of an evaluation of one of FIGS. 1 . 3 and 5 storable.

Fig. 7 FIG. 12 shows a flowchart of a method 700 for monitoring traffic in accordance with an embodiment of the present invention. The method 700 is in conjunction with or using a traffic monitoring system such as the traffic monitoring system Fig. 1 executable.

The method 700 includes a step 710 of providing vehicle data of a vehicle. In this case, the step 710 of providing in connection with or using a provisioning device such as the provisioning device of one of FIGS. 1 . 2 and 4 feasible. The step 710 of providing has substeps that include an in Fig. 8 illustrated method for providing comprises.

Furthermore, the method 700 has a step 720 of evaluating vehicle data of at least one vehicle. The step 720 is the Evaluating in conjunction with or using at least one evaluation device such as at least one of the evaluation of one of FIGS. 1 . 3 and 5 feasible. The step 720 of the evaluation has sub-steps which include an in Fig. 9 illustrated method for evaluating includes.

Fig. 8 FIG. 12 shows a flowchart of a method 810 for providing vehicle data of a vehicle, according to an exemplary embodiment of the present invention. In this case, the method 810 can be executed by means of a provisioning device arranged in-vehicle, such as, for example, the provisioning device from one of the FIGS. 1 . 2 and 4 ,

The method 810 includes a step 812 of reading in vehicle data acquired by means of at least one detection device of the vehicle. In a step 814 of generating subsequent to the step 812 of reading, a data message is generated which includes or represents the read-in vehicle data. Further, the method 810 includes a step 816 of providing the generated data message with at least one digital signature to generate an authenticated data message. In a subsequent step 818 of the output, which can be carried out with respect to step 816, the authenticated data message is output to a transmission interface for sending the authenticated data message to a vehicle-external evaluation device. As a result, the vehicle data is provided to the vehicle-external evaluation device.

Fig. 9 shows a flowchart of a method 920 for evaluating vehicle data of at least one vehicle, according to an embodiment of the present invention. In this case, the method 920 can be executed by means of at least one evaluation device arranged outside the vehicle, such as, for example, at least one of the evaluation devices from one of the FIGS. 1 . 3 and 5 , Also, method 920 is using the method of providing Fig. 8 provided vehicle data feasible.

The method 920 includes a step 921 of receiving vehicle data that is in the form of at least one authenticated data message about the Send interface of the at least one vehicle were sent, as it is based on Fig. 8 is described. After step 921, a step 922 is performed, in which the vehicle data is compared with at least one criterion for a safety-relevant traffic event. As a result, the vehicle data can be evaluated.

According to one embodiment, in a step 923 of addition subsequently performed with respect to step 921 of receiving, a time stamp and, additionally or alternatively, a digital signature are added to the received at least one authenticated data message.

In an optional time synchronization step 924, the evaluation devices are synchronized using a common time reference. It should be noted that the time synchronization step 924 is executable in conjunction with a plurality of peripheral evaluation devices, such as the peripheral evaluation devices Fig. 1 . Fig. 3 respectively. Fig. 5 ,

Further, in one embodiment, the method 920 includes a step 925 of forwarding at least a subset of the vehicle data to a memory interface to a memory device. The forwarding step 925 is performed in response to the comparison of step 922 of the comparing and additionally or alternatively depending on at least one indication criterion. In a step 926 of the storage which can subsequently be carried out with respect to the step 925 of the forwarding, forwarded vehicle data are stored by means of a storage device in the at least one evaluation device.

According to one embodiment, the method 920 further comprises an anonymization step 927 and additionally or alternatively a step 928 of encrypting at least a subset of the vehicle data. In this case, the step 927 of the anonymization or the step 928 of the encryption with respect to the step 921 of the receiving are subsequently carried out.

With reference to the FIGS. 1 to 9 In the following, exemplary embodiments of the present invention are explained in summary and in other words.

According to exemplary embodiments, in particular a real-time transmission, signing and storage, for example with a time stamp, of relevant vehicle data 242 can be implemented in vehicles external to the vehicle. Such vehicle data 242 include, for example, sensor raw data, e.g. B. with respect to a vehicle environment and / or vehicle condition, or attention or driving readiness of the driver, for. As well as fatigue detection or touch sensor on the steering wheel, derived from the raw data or derived information, such as an object list, automatically performed by the vehicle 140 actions, possibly with triggering event, manual driver intervention and / or the like.

In particular, a signature of accident data with a driver's crypto-key, e.g. B. by a smart card or a new identity card (nPA), in the vehicle 140 and by downstream system elements, eg. B. RSU, so that a data integrity or authenticity and an indisputability of facts represented by the vehicle data 262 can be technically proven. A signature and time stamping by the peripheral evaluation devices 120 makes it possible to preclude manipulation by falsifying a local time in the vehicle 140. The RSUs peripheral evaluation devices 120 and / or all downstream system components are, for example, continuously synchronized.

Upon detection of an accident or a critical situation or a manual triggering vehicle data are transmitted from the peripheral evaluation devices 120 to the central processing device 110 and in a so-called back-end or cloud back-end. As a result, a large amount of data to be transferred into the cloud can be reduced, whereby it is also ensured that the data is stored outside the vehicle 140 in a way that prevents manipulation and loss. The cloud connection can be implemented in particular, but not exclusively, via automotive WLAN (IEEE802.11p) by means of the so-called Road Side Units (RSUs) or by means of mobile radio.

The "cloud connection" in the sense of a data connection can be divided into two segments. A first segment includes the connection from the vehicle 140 to the RSU. This connection is conveniently wireless (e.g., IEEE802.11p). A second segment comprises the connection from the network 515 between RSUs and central evaluation device 110. This connection is pronounced as a wired network in the current state of the art. This connection can also be implemented wirelessly, possibly using future technologies.

In particular, a data transmission takes place fully automatically, for example in a predetermined temporal grid or the like. A manual intervention is not necessary in such a case. A cloud-side fusion of data, especially with a global time base, from multiple vehicles with a specific geographic proximity creates locally-defined, consistent overall views. These can be refined by enrichment with other data, such as environmental sensors such as surveillance cameras or satellites. Such an overall view is suitable for the automated evaluation by cloud-side algorithms for unambiguous recognition of an accident and supports a clear explanation of an accident. For this purpose, relevant data can be transmitted to a central accident data register for further analysis in the event of a recognized accident. If no accident is detected, the data can be deleted or overwritten, for example, so that the storage resources are used efficiently and the data protection of the vehicle owner or driver is ensured.

In addition to the cloud-side accident detection, an accident can also be detected by participating vehicles and uninvolved vehicles, for example, by local evaluation of a front camera in a following vehicle. Such detections can be reported accordingly automated become. In addition, the accident detection can also be done manually, such as by triggering an emergency button in the vehicle 140 or by a call of an eyewitness.

For the necessary temporal synchronization of the relevant communication partners are standardized protocols, such as IEEE1588. For this purpose, in particular, the peripheral evaluation devices 120 or road side units are continuously synchronized with one another according to step 924 of the method 920 and the data messages 264 arriving from vehicles 140 are enriched with time stamps. Thus, deviating or manipulated local clocks may be excluded as a source of error in the reconstruction of accidents involving multiple vehicles 140.

Data integrity is ensured by a continuous digital signature 602, 604 and 612, which takes place both on the vehicle side as well as outside the vehicle or RSU side or on the cloud side. In this case, for example, different keys are used, which are known only one page. Thus, data integrity and authenticity can be demonstrated later, as undetectable manipulation would only be possible with both keys. Since the keys are physically separate - in the vehicle, in the peripheral evaluation devices and the central evaluation device - and can be additionally secured by mechanical access protection, unnoticed manipulation is unlikely. Even if a public key used for signature 602 and / or 604 located in the vehicle 140 is destroyed, the integrity of the vehicle data 262 with the secret keys of the evaluation devices 110 and / or 120 and the vehicle 140 is for verification only but are not needed for signing, so are not in the vehicle 140 or in the evaluation 110 and / or 120, anytime verifiable. Thus, suitability of the thus-signed vehicle data 262 as evidence is possible.

A distinction is made between signature and verification (ie integrity) and encrypting / decrypting cases.

With regard to the case of signature and verification, the signature is carried out in the vehicle with a secret key "Fg". This could be destroyed in an accident. For verification, only the public (non-secret) key "Fö" appropriate to "Fg" is needed, which is well-known and distributed outside the vehicle.

With regard to the Encrypt / Decrypt cases, the encryption is done on the vehicle side with different public keys - depending on the addressee of the data. To decrypt the secret key of the addressee is needed. This case is not critical, since only the vehicle-side secret key of danger of destruction by accidents are exposed.

Data sovereignty and data protection are improved in particular by the following three alternative or combinable mechanisms.

First, if no accident occurs, the vehicle data 262 and the data messages 264 are automatically cleared after a short time. A duration of a temporary storage as well as a degree of detail can also be determined by a predictive algorithm, for example, a more extensive storage may be provided in situations suspected of causing an accident, eg. B. with sharp braking, hazard lights, etc.

Secondly, an encryption of all data not necessary for accident detection - for example, acceleration values above certain thresholds are required, but for example not a fill level of the windshield wiper water - is provided before transmission from the vehicle 140 to an evaluation device 110 and / or 120. The data can only be decrypted and evaluated with the key of the vehicle owner or vehicle owner and thus only with his consent. In addition, by using different keys, a role concept can be realized in which the vehicle owner and / or legislator decides to which third party which data is made available.

Third, anonymization of data is provided. In the encrypted state, data of a trusted party, such as a Data Protection Agency, where the data can be anonymized and / or aggregated, for example by removing unique identifiers. The anonymized data can then be provided anonymously to third parties, eg. It would also be possible to proceed similarly to permanently record data from certain sources, ie to exclude it from the deletion and to transmit it in encrypted form from an evaluation device 110 and / or 120 to such a data protection agency.

For encryption or key management z. B. built in the vehicle 140 driver authentication devices 446, for example smart card reader, and for example a smart card (eg nPA = new identity card) of the driver are used. For a high-performance implementation of security mechanisms are in the vehicle 140 permanently installed, non-compromisable hardware security modules. A role-based process to ensure authenticity, integrity and confidentiality, thus privacy, to various third parties, e.g. As car insurance, vehicle manufacturer, workshop, as well as a driver identification with the purpose of non-repudiation of the identity of the driver can be implemented by means of signing and encryption.

Signatures 602, 604, 612 enable a proof that the vehicle data 262 were subsequently not manipulated. In this case, the vehicle data 262 are for example signed in the vehicle 140 with the digital personal signature 604 or a personal secret key or private key of the driver, for example using a smart card, such. B. the new identity card (nPA). What is important is that such a smart card is integer and not compromisable. In addition, control devices, detection devices in and similar components of the vehicle 140 can sign relevant vehicle data 262 with a digital device signature 602, so that, for example, a manufacturer of a control device can additionally hedge against manipulation, for example through a so-called man-in-the-middle attack , Proof of authenticity and integrity then takes place with a respective public key or public key.

Upon receipt of the transmitted data messages 264, for example at the peripheral evaluation devices 120 or Road Side Units (RSUs), these data messages 264 together with an additional time stamp, which is based on a synchronized evaluation device time, with a digital signature 612 or an individual secret key of the RSU signed. Thus, a manipulation of the time base in the vehicle 140 can be excluded as an attack vector and detected with the public key.

In order to spare an available bandwidth of communication systems used, for example, the used keys are combined in such a way that a nested encryption of data packets arises, as in Fig. 6 is recognizable. Thus, a message or a data packet can be sent as a multicast or broadcast and also be taken to ensure that the respective information components can only be read in plain text by the designated communication partners.

The embodiments described and shown in the figures are chosen only by way of example. Different embodiments may be combined together or in relation to individual features. Also, an embodiment can be supplemented by features of another embodiment.

Furthermore, the method steps presented here can be repeated as well as executed in a sequence other than that described.

If an exemplary embodiment comprises a "and / or" link between a first feature and a second feature, then this is to be read so that the embodiment according to one embodiment, both the first feature and the second feature and according to another embodiment either only first feature or only the second feature.

Claims (15)

A method (810) for providing vehicle data (262) of a vehicle (140), the method (810) comprising the steps of: Reading in (812) vehicle data (262) representing data acquired by at least one detector (242; 442A, 442B, 442C, 442D, 442E) of the vehicle (140); Generating (814) a data message comprising the read vehicle data (262); Providing (816) the generated data message with at least one digital signature (602, 604) to generate an authenticated data message (264); and Outputting (818) the authenticated data message (264) to a transmit interface (244) to provide the vehicle data (262) to an on-vehicle evaluation device (110, 120). The method (810) according to claim 1, wherein in the step (816) of providing, the generated data message is provided with a digital device signature (602) of the at least one detection device (242; 442A, 442B, 442C, 442D, 442E) or a control device of the vehicle (820). 140) and / or provided with a digital personal signature (604) of a driver of the vehicle (140). Method (810) according to one of the preceding claims, wherein in the step (812) of read-in (812) sensor raw data, information derived from sensor raw data, data about from the vehicle (140) automatically performed actions and / or data on driver interventions as the vehicle data (262) are read. Method (810) according to one of the preceding claims, wherein in the step (814) of generating the data message at least a subset of the read-in vehicle data (262) is encrypted. A method (810) according to any one of the preceding claims, wherein in the read in step (812) a user input signal representing a security incident traffic event indicator is read, wherein in step (818) of the output, the user input signal is output to the transmit interface (244) becomes. Method (920) for evaluating vehicle data (262) of at least one vehicle (140), wherein the method (920) can be executed by means of at least one vehicle-external evaluation device (110, 120), the method (920) comprising the following steps: Receiving (921) at least one authenticated data message (264) representing a data message (264) provided according to a method (810) of any one of the preceding claims for receiving vehicle data (262) from the at least one vehicle (140); and Performing (922) a comparison of the vehicle data (262) with at least one alert criterion for a safety-related traffic event to evaluate the vehicle data (262). The method (920) of claim 6, further comprising the step (923) of adding a time stamp (610) and / or a digital signature (612) to the received at least one authenticated data message (264). Method (920) according to one of claims 6 to 7, wherein the method (920) is carried out by means of a plurality of evaluation devices (110, 120) arranged outside the vehicle, the method (920) comprising a step (924) of the timing synchronization of the evaluation devices (920). 110, 120) with each other using a common time reference. Method (920) according to one of claims 6 to 8, comprising a step (925) of forwarding at least a subset of the vehicle data (262) to a memory interface to a memory device (326) as a function of the comparison and / or of at least one notification criterion. Method (920) according to claim 9, comprising a step (926) of storing forwarded vehicle data (262) by means of a memory device (326) in the at least one evaluation device (110, 120). A method (920) according to any one of claims 6 to 10, comprising an act (927) of anonymizing and / or a step (928) of encrypting at least a subset of the vehicle data (262). A method (700) for monitoring a traffic event, the method (700) comprising the steps of: Providing (710) vehicle data (262) of a vehicle (140) according to a method (810) for providing according to any one of claims 1 to 5; and Evaluating (720) vehicle data (262) of at least one vehicle (140) according to the method (920) for evaluation according to one of claims 6 to 11. Apparatus (110, 120) or system (100) having means adapted to perform all the steps of a method (700; 810; 920) according to any one of the preceding claims. A computer program adapted to perform all the steps of a method (700; 810; 920) according to any one of the preceding claims. A machine-readable storage medium having a computer program stored thereon according to claim 14.

Images