EP3994676A1

EP3994676A1 - Method, computer program and device for processing data recorded by a motor vehicle, and for providing parameters for such processing

Info

Publication number: EP3994676A1
Application number: EP20734381.5A
Authority: EP
Inventors: Stephan Max; Martin Wegner; Sabine ALAZZAWI; Richard Niestroj
Original assignee: Volkswagen AG
Current assignee: Volkswagen AG
Priority date: 2019-07-02
Filing date: 2020-06-23
Publication date: 2022-05-11
Also published as: US20220358248A1; DE102019209711A1; CN114097011A; WO2021001207A1

Abstract

The present invention relates to a method, to a computer program containing instructions and to a device for processing data recorded by a motor vehicle. The invention additionally relates to a method, to a computer program containing instructions and to a device for providing parameters for processing data recorded by a motor vehicle. The invention furthermore relates to a motor vehicle and to a backend in which a method according to the invention or a device according to the invention is used. In a first step, at least one parameter set for temporally and spatially masking the recorded data is received (10). An item of data recorded by a motor vehicle is additionally received (11). Temporal and spatial masking is then applied to the received item of data using the at least one received parameter set (12). The masked item of data is finally forwarded for further processing (13). The masking may take place within the motor vehicle or in a backend connected to the motor vehicle.

Description

description

Method, computer program and device for processing data captured by a motor vehicle, and for providing parameters for such processing

The present invention relates to a method, a computer program with instructions and a device for processing data recorded by a motor vehicle. The invention also relates to a method, a computer program with instructions and a device for providing parameters for processing data recorded by a motor vehicle

Motor vehicle recorded data The invention further relates to a motor vehicle and a backend in which a method according to the invention or a

Device is used.

A wide variety of data is collected in modern motor vehicles. In the course of

With increasing vehicle networking, there is an interest in using the data collected by the vehicle for further analysis. For this purpose, data can be taken from the motor vehicle and sent to a backend. For example, data from vehicle sensors can be based on location and time

Applications relating to weather forecasts, parking space occupancy or even

Traffic flow data are extracted. In the backend, the data is then combined with other data on a card and fed back to the functions using it.

An important use case for data collection is the creation of a database for anonymized swarm data for research, development and safeguarding of automatic driving functions. Since most of these scenarios rarely occur, testing in real traffic is both time-consuming and costly. For the development of automatic driving functions through to series production, a significant database is required to secure the algorithms, which can no longer be achieved through classic test drives per endurance run. It is therefore necessary to have a data pool with data from as diverse as possible demanding traffic scenarios, ideally fed from real journeys, with which the algorithms are trained and continuously improved so that the Vehicles in road traffic can make appropriate decisions and act safely under all eventualities.

The data taken from a vehicle may, however, allow conclusions to be drawn about the personal or factual circumstances of a specific or at least identifiable natural person, for example about the driver of the

Motor vehicle

Such a collection and use of the data is in accordance with the applicable

Data protection laws are usually only possible with a declaration of consent from the driver. In today's world, consumers are quite familiar with accepting conditions of use and granting approvals for data analysis, particularly in the field of software, but this has not yet been common in the automotive sector. Obtaining a declaration of consent for the use of the data is therefore not always easy. In addition, as part of software updates, a new

Declaration of consent can be obtained from the user, which can be a nuisance for the user in the long run.

To ensure data protection, the data can be different

The aim of this anonymization process is to hide the identity of the data producer in an anonymization group.

Against this background, DE 10 2011 106 295 A1 describes a method for

bidirectional transmission of data between motor vehicles and a service provider. In the method, traffic data that describe a traffic condition and originate from the motor vehicles are provided to a service provider. This is done exclusively via a backend server device operated by a security operator. The traffic data is anonymized by means of the backend server device before it is transmitted to the service provider.

US 2017/0083708 A1 describes a mechanism for anonymizing sequential and location-based data records. In response to receiving the records from a company, the records are scanned to a number of

Uncover data protection vulnerabilities. A set of privacy restrictions is generated based on the privacy vulnerabilities discovered, and a set of usage restrictions is identified. The records are anonymized using the data protection restrictions and the usage restrictions, creating a anonymized data set is formed. The anonymized data set is then returned to the company.

Another approach to anonymization involves segmenting the data. Here, the data of a vehicle is divided into different segments while driving. In this way it is ensured that possible data users cannot determine the complete data record of the journey of the vehicle. As a rule, only a very small number of vehicles travel the entire route, and possibly only one vehicle. However, many vehicles pass through the individual segments.

Another approach to anonymization is to obscure the location or time of the data. The data is randomly shifted additively in space or in time. In this way, identification of the original vehicle can only be permitted in relation to a group of vehicles.

In this context, DE 10 2018 225 287 A1 describes a method for

Processing of data captured by a motor vehicle. In a first step, a date recorded by a motor vehicle is received. A local or temporal obfuscation is then applied to the received date. The obfuscated date is finally passed on for evaluation. The data received can be concealed within the motor vehicle or in a receiving system connected to the motor vehicle

DE 10 2018 008 281 A1 describes a method for operating an assistance system of a vehicle. In the method, objects are detected in the vicinity of the vehicle. With regard to a recorded object, a system action is triggered if an entry for the object is contained in a database which marks the system action as authorized. The data is anonymized to the effect that identification data is removed and spatial obfuscation is carried out

DE 10 2015 216 414 A1 describes a method for acquiring information about a movement of a first vehicle from a starting area to a destination area. The first vehicle in the starting area swaps with a second vehicle in the

Starting area is located, a first key and exchanges in the target area with a third vehicle that is located in the target area, a second key. Furthermore, the first vehicle encrypts first information about the starting area and the

Target area of movement using the first key and the second Key and stores it together with second information about the encryption, so that the encrypted first information can only be decrypted with the help of a specified number of additional information about the encryption.

Although methods for concealment of place and time are well suited to conceal the identity of the data producer within an anonymization group, the data user must always make a compromise with regard to the extent of concealment in place and time.

It is an object of the invention to provide solutions for anonymizing by a

Provide motor vehicle recorded data that allow a less compromised temporal and spatial concealment of the recorded data.

This object is achieved by a method with the features of claim 1 or 2, by a computer program with instructions according to claim 11 and by a device with the features of claim 12 or 13. Preferred embodiments of the invention are the subject matter of the dependent claims.

According to a first aspect of the invention, a method for processing data recorded by a motor vehicle comprises the steps:

- Receiving at least one set of parameters for concealing the recorded data in terms of time and location from a data user;

- Receiving a date recorded by a motor vehicle;

Applying a temporal and spatial obfuscation to the received date using one of the received parameter sets; and

- Forwarding of the obfuscated date for further processing

According to a further aspect of the invention, a computer program contains instructions which, when executed by a computer, cause the computer to carry out the following steps for processing data recorded by a motor vehicle:

- Receiving a date recorded by a motor vehicle;

- Forwarding of the obfuscated date for further processing The term computer should be understood broadly. In particular, it also includes control devices, workstations and other processor-based data processing devices

The computer program can, for example, be provided for electronic retrieval or be stored on a computer-readable storage medium.

According to a further aspect of the invention, a device for processing data recorded by a motor vehicle has:

an input for receiving at least one set of parameters for concealing the recorded data in terms of time and location and for receiving one of one

Motor vehicle date recorded by a data user;

an anonymization unit for applying a temporal and spatial obfuscation to the received date using one of the received parameter sets; and

- an output for forwarding the obfuscated date for further processing.

From the point of view of the data producer, it is provided that the anonymization procedure does not work with fixed settings for the temporal and spatial obfuscation, but allows a controllable mixed anonymization. For this purpose, previously received parameter sets are used, which allow a situation-dependent adaptation of the

Enable anonymization settings. In this way, both a quick detection of events in the recorded data and their subsequent local precise recording is possible.

According to a further aspect of the invention, a method for providing parameters for processing data recorded by a motor vehicle comprises the steps:

- Determination of at least one parameter set for a temporal and spatial concealment of the recorded data; and

Transmission of the at least one parameter set to a device for processing data recorded by a motor vehicle.

According to a further aspect of the invention, a computer program contains instructions which, when executed by a computer, cause the computer to carry out the following steps for providing parameters for processing data recorded by a motor vehicle:

- Determination of at least one parameter set for a temporal and spatial concealment of the recorded data; and Transmission of the at least one parameter set to a device for processing data recorded by a motor vehicle

The term computer should be understood broadly. In particular, it also includes

Controllers, workstations and other processor-based data processing devices

According to a further aspect of the invention, a device for providing parameters for processing data acquired by a motor vehicle has:

Vehicle date recorded;

a parameter determination unit for determining at least one parameter set for concealing the acquired data in terms of time and location; and

a transmission unit for transmitting the at least one parameter set to a device for processing data recorded by a motor vehicle.

From the point of view of the data user, it is provided that this is not limited to data with compromised settings with regard to time and location

Obfuscation were anonymized Rather, the data user can, depending on the situation or occasion, cause the data generator to use an adapted parameter set for the anonymization. For this purpose, e.g. the desired parameter set can be transmitted to the data generator. Alternatively, it is also possible to use just one

Request to the data producer to use a parameter set already available at the data producer for the anonymization. In this way, the data user is always able to change the parameter sets of the obfuscation algorithm.

According to one aspect of the invention, the at least one parameter set includes information on the position or area for which the at least one parameter set can be used. It is preferably possible not only to carry out the adaptation of the parameter set globally for the obfuscation filter, but to carry it out precisely for certain positions or areas. This enables, for example, slow and precise concealment, ie a large temporal concealment in combination with a low one local concealment, to be used on a previously recognized accident site without causing a large temporal concealment in other areas.

According to one aspect of the invention, the at least one parameter set includes information on the type of recorded data for which the at least one parameter set can be used. This makes it possible to anonymize only certain or recognized data records

To adjust events. For example, a quick and imprecise concealment can be permitted for a recognized emergency vehicle, i.e. a short time

Concealment combined with a large local concealment.

According to one aspect of the invention, a selection is made from two or more

Parameter sets for the temporal and spatial obfuscation of the recorded data. Another possibility is obfuscation with several parameter sets, which can be selected at random. It can be advantageous if, for example, 50% of the data is anonymized with a large temporal obfuscation in combination with a low local obfuscation, while the remaining 50% of the data is anonymized with a low temporal obfuscation in combination with a large local obfuscation. In this way, it can be statistically ensured that, for example, new events or fundamental changes to the events are recognized quickly, while known data can be measured more precisely over time thanks to the slow recognition. This approach of using several parameter sets is particularly advantageous when precise adaptation of the parameter sets is not possible or not possible with sufficient certainty.Of course, a combination of the methods is also possible, i.e. the use of several parameter sets with adaptable, precisely executed parameters. The percentage distribution used can preferably be adapted depending on the application.

According to one aspect of the invention, a first set of parameters is first transmitted, which causes a concealment of the recorded data with a low temporal concealment in combination with a large local concealment. In response to the detection of one event in the obfuscated data, a second is then performed

A set of parameters transmitted which causes a concealment of the recorded data with a large temporal concealment in combination with a low local concealment. In this way it is possible, for example, to record a traffic jam or the end of a traffic jam within about 60 seconds to an accuracy of 5 km. As soon as this is known to the data user, he can change the parameters and thus precisely localize the end of the traffic jam, for example within 500 m. However, this is now done with a time offset. The data user is like this enabled to warn the traffic quickly or to divert large areas using navigation instructions. In the long term, it is also able to warn the driver exactly before the end of the traffic jam.

A method according to the invention or one according to the invention is preferably used

Device used in an autonomously or manually controlled vehicle, in particular a motor vehicle. Alternatively, the solution according to the invention can also be used in a backend to which the data is transmitted from the vehicle.

Further features of the present invention will become apparent from the following description and the appended claims in conjunction with the figures

1 shows schematically a method for processing data recorded by a motor vehicle;

2 shows a first embodiment of a device for processing data recorded by a motor vehicle;

3 shows a second embodiment of a device for processing data acquired by a motor vehicle;

Fig. 4 shows schematically a motor vehicle in which a solution according to the invention is implemented;

Fig. 5 shows schematically a method for providing parameters for the

Processing of data captured by a motor vehicle;

Fig. 6 shows a first embodiment of a device for providing

Parameters for processing data captured by a motor vehicle;

Fig. 7 shows a second embodiment of a device for providing

Parameters for processing data captured by a motor vehicle;

8 illustrates variants of the obfuscation with constant boundary conditions; and

9 schematically shows a system concept of the solution according to the invention. For a better understanding of the principles of the present invention, embodiments of the invention are explained in more detail below with reference to the figures. It goes without saying that the invention is not restricted to these embodiments and that the features described can also be combined or modified without departing from the scope of protection of the invention as defined in the appended claims.

1 schematically shows a method for processing data captured by a motor vehicle. In a first step, at least one parameter set for concealing the captured data in terms of time and location is received 10. In addition, a data captured by a motor vehicle is received 11 a temporal and spatial obfuscation is applied to the received data using one of the received parameter sets 12 The obfuscated data is finally passed on for further processing 13 The parameter set can include information for which position or for which area it is applicable. The parameter set can also include information on the type of recorded data for which it can be used. This information is preferably taken into account by the data generator if a parameter set is to be used for the obfuscation. Alternatively there is one

Selection of two or more parameter sets for the temporal and spatial concealment of the recorded data. From these, for example, a parameter set for concealment can be selected at random

2 shows a simplified schematic illustration of a first embodiment of a device 20 for processing data D recorded by a motor vehicle

Device 20 has an input 21 for receiving at least one parameter set P for concealing the recorded data from a data user in terms of time and location and for receiving data D Ein recorded by a motor vehicle

On the basis of one of the parameter sets P, the data processing unit 22 determines the parameters necessary for a temporal and spatial concealment. An anonymization unit 23 then applies a temporal and spatial concealment to the date D received. The concealed datum VD is finally transferred to another via an output 25

Processing passed on. The parameter set P can include information on the position or area for which it is applicable. The parameter set P can also include information about the type of recorded data for which it can be used. This information is preferably taken into account by the data processing unit 22 if a parameter set P is to be used for the concealment. Alternatively, there is a choice between two or more parameter sets P for the temporal and spatial Obfuscation of the recorded data. From these, for example, a parameter set P can be selected randomly for the concealment.

The data processing unit 22 and the anonymization unit 23 can be controlled by a control unit 24. Via a user interface 27,

If necessary, settings of the data processing unit 22, the anonymization unit 23 or the control unit 24 can be changed. The data accumulating in the device 20 can, if required, be stored in a memory 26 of the device 20, for example for a later evaluation or for use by the components of the device 20. The data processing unit 22, the anonymization unit 23 and the

Control unit 24 can be implemented as dedicated hardware, for example as integrated circuits. Of course, they can also be partially or completely combined or implemented as software that runs on a suitable processor, for example on a GPU. The input 21 and the output 25 can be implemented as separate interfaces or as a combined bidirectional interface

3 shows a simplified schematic illustration of a second embodiment of a device 30 for processing data recorded by a motor vehicle. The

Device 30 has a processor 32 and a memory 31. For example, the device 30 is a computer, a workstation or a control device.

Instructions are stored in memory 31 which, when executed by processor 32, cause device 30 to carry out the steps according to one of the described methods. The instructions stored in the memory 31 thus embody a program which can be executed by the processor 32 and which implements the method according to the invention. The device has an input 33 for receiving information. Data generated by the processor 32 are provided via an output 34. In addition, they can be stored in memory 31. The input 33 and the output 34 can be combined to form a bidirectional interface.

The processor 32 may include one or more processing units, such as microprocessors, digital signal processors, or combinations thereof.

The memories 26, 31 of the described embodiments can have volatile and / or non-volatile storage areas and a wide variety of storage devices and

Storage media include, for example, hard drives, optical storage media or semiconductor memories. The two embodiments of the device can be integrated into the motor vehicle or be part of a backend connected to the motor vehicle

FIG. 4 schematically shows a motor vehicle 40 in which a solution according to the invention is implemented. The motor vehicle 40 has a sensor system 41 with which data D can be recorded, for example a traffic situation

Motor vehicle 40 are a navigation system 42, a data transmission unit 43 and a number of assistance systems 44, one of which is shown as an example. A connection to a backend 80 can be set up by means of the data transmission unit 43, in particular for transmitting captured data and for receiving at least one parameter set P. In this exemplary embodiment, a device 20 for processing the captured data D ensures that the data is concealed in terms of time and location Use of the at least one received parameter set so that disguised data VD are transmitted to backend 80. Alternatively, the data D can only be concealed in the backend 80 before it is made available to a data user by the latter. In this case, the backend 80 receives the at least one parameter set P. A memory 45 is provided for storing data. The

Data exchange between the various components of motor vehicle 40 takes place via a network 46.

Fig. 5 shows schematically a method for providing parameters for the

Processing of data captured by a motor vehicle. In a first step, at least one parameter set is determined 50 for a temporal and spatial concealment of the recorded data. This is then transmitted 51 to a device for processing data recorded by a motor vehicle. The parameter set can include information for which position or for which Area he is applicable. The parameter set can also include information on the type of recorded data for which it can be used.

In addition, two or more parameter sets can be transmitted for concealing the recorded data in terms of time and location. From these, the data generator can then randomly select a parameter set for the concealment

FIG. 6 shows a first embodiment of a device 60 for providing

Parameters for processing data captured by a motor vehicle

Device 60 has an input 61, for example for receiving requests from a data user with regard to the obfuscation of captured data Ein

Parameter determination unit 62 determines at least one parameter set P for concealing the acquired data in terms of time and location. This at least one Parameter set P is then transmitted from a transmission unit 63 to a device 20 for processing data recorded by a motor vehicle. The parameter set P can include information for which position or for which area it is applicable. The parameter set P can also include information about the type of recorded data for which it can be used. In addition, two or more sets of parameters P can be transmitted for concealing the recorded data in terms of time and location. From these, the device 20 can then randomly select a parameter set P for the concealment.

The parameter determination unit 62 and the transmission unit 63 can be controlled by a control unit 64. Via a user interface 67 can

possibly settings of the parameter determination unit 62, the

Transmission unit 63 or the control unit 64 can be changed. The data obtained in the device 60 can, if necessary, be stored in a memory 66 of the device 60, for example for later evaluation or for use by the components of the device 60. The parameter determination unit 62, the

Transmission unit 63 and control unit 64 can be implemented as dedicated hardware, for example as integrated circuits. Of course, they can also be partially or completely combined or implemented as software that runs on a suitable processor, for example on a GPU. The input 61 and the output 65 can be implemented as separate interfaces or as a combined bidirectional interface.

FIG. 7 shows a second embodiment of a device 70 for providing parameters for processing data captured by a motor vehicle. The

Device 70 has a processor 72 and a memory 71. For example, the device 70 is a computer or a workstation. Instructions are stored in the memory 71 which, when executed by the processor 72, cause the device 70 to execute the steps according to one of the described methods. The instructions stored in the memory 71 thus embody a program which can be executed by the processor 72 and which implements the method according to the invention. The

The device has an input 73 for receiving information. Data generated by the processor 72 are provided via an output 74. In addition, they can be stored in the memory 71. The input 73 and the output 74 can be combined to form a bidirectional interface. Processor 72 may include one or more processing units, such as microprocessors, digital signal processors, or combinations thereof.

The memories 66, 71 of the embodiments described can have volatile and / or non-volatile memory areas and a wide variety of storage devices and

Storage media include, for example, hard drives, optical storage media or semiconductor memories

8 illustrates variants of the concealment with constant boundary conditions. The possible combinations of temporal concealment and local concealment for a given degree of anonymization are plotted. As can be seen in the figure, the amount Äs of local concealment is greater, the lower the amount Ät of temporal concealment, and vice versa. A minimum temporal obfuscation requires a maximum local obscuration, whereas a minimum local obfuscation requires a maximum temporal obscuration. This means that the data user always has to make a compromise with regard to the obfuscation.

9 schematically shows a system concept of the solution according to the invention. The basic idea of the solution is that the data user 91 is able at any time by means of a parameter provision 93 to change the parameter sets P of the obfuscation algorithm 92 which is applied to the data recorded by a data generator 90. In this way, the data user 91 can, for example, quickly read out effects from the data, but then specify them more precisely afterwards.

For example, it is possible, for example, to record a traffic jam or the end of a traffic jam with an accuracy of 5 km within about 60 seconds. As soon as this is known to the data user 91, he can change the parameters and thus precisely localize the end of the traffic jam e.g. within 500 m. However, this is now done with a time offset of 600 seconds. The data user 91 is thus enabled to warn the traffic quickly or to divert it over a large area by means of navigation instructions. In the long term, it is also able to warn the driver exactly before the end of the traffic jam.

The adjustment of the parameter set P can not only be global for the

Obfuscation algorithm 92 can be carried out, but also precisely for certain positions or areas or for certain data sets or recognized events. In this way there is the possibility of slow and precise obfuscation, ie a large temporal obfuscation in combination with a low local obfuscation, on one to use previously recognized end of traffic jam. At the same time, rapid and imprecise concealment can be permitted for a recognized rescue vehicle, ie a low temporal concealment in combination with a large local concealment.

Another possibility is a concealment with several parameter sets P, which are selected at random. It can be advantageous if, for example, 50% of the data is anonymized with a large temporal obfuscation in combination with a low local obfuscation, while the remaining 50% of the data is anonymized with a low temporal obfuscation in combination with a large local obfuscation. In this way, it can be statistically ensured that, for example, new events or fundamental changes to the events are recognized quickly, while known data can be measured more precisely over time thanks to the slow recognition. This approach of using a plurality of parameter sets P is particularly advantageous when a precise adaptation of the parameter sets P is not possible or not possible with sufficient certainty.

A possible application for concealment with several parameter sets P is the identification of an icy road. For this application, for example, 30% of the measurements can be obscured with a spatial uncertainty of 5 km and a temporal uncertainty of 1 min. This allows new icing to be recognized quickly. The warnings are therefore available quickly, but are spatially very roughly 70% of the measurements, on the other hand, are obscured with a spatial uncertainty of 250 m and a temporal uncertainty of 20 minutes. This allows the limits of the icing on the road to be precisely recognized. The warnings are therefore precise, but very sluggish.

The associated parameter set P or the parameter matrix is:

[30%, 5 km, 1 min; 70%, 250 m, 20 min].

A combination of the methods is of course also possible, ie the use of several parameter sets P with adaptable, precisely executed parameters. List of reference symbols

Receiving a parameter set for a temporal and spatial obfuscation. Receiving a recorded date

Apply a temporal and local obfuscation to the date based on the parameter set

Passing on the obfuscated date for further processing

contraption

entrance

Data processing unit

Anonymization unit

Control unit

exit

Storage

User interface

contraption

Storage

processor

entrance

exit

Motor vehicle

Sensor system

navigation system

Data transmission unit

Assistance system

Storage

network

Determining at least one set of parameters for a temporal and spatial

Obfuscation

Transmission of the at least one parameter set

contraption

entrance

Parameter determination unit

Transmission unit 64 control unit

65 exit

66 memory

67 User Interface

70 device

71 memory

72 processor

73 entrance

74 exit

80 backend

90 data generator

91 Data users

92 Obfuscation Algorithm

93 Provision of parameters

D date

As the amount of local concealment Maximum local concealment

At the amount of temporal obfuscation

Ätn Maximum temporal obfuscation p parameter set

Veiled date

Claims

1. A method for processing data recorded by a motor vehicle (40), comprising the steps:

- Receiving (10) at least one set of parameters (P) for concealing the recorded data in terms of time and location from a data user (91);

- Receiving (11) a date (D) recorded by a motor vehicle (40);

- applying (12) a temporal and spatial obfuscation to the received date (D) using one of the received parameter sets (P); and

- Forwarding (13) of the obfuscated date (VD) for further processing.

2. A method for providing parameters (P) for processing data captured by a motor vehicle (40), comprising the steps:

- Determination (50) of at least one parameter set (P) for concealing the acquired data in terms of time and location; and

- Transmission (51) of the at least one parameter set (P) to a device (20) for processing data recorded by a motor vehicle (40).

3. The method according to claim 1 or 2, wherein the at least one parameter set (P) includes information on the position or for which area the at least one parameter set (P) can be used.

4. The method according to any one of the preceding claims, wherein the at least one

Parameter set (P) includes information on the type of recorded data for which the at least one parameter set (P) can be used.

5. The method according to any one of the preceding claims, wherein a selection is made from two or more parameter sets (P) for the temporal and spatial concealment of the recorded data.

6. The method of claim 5, wherein selecting from among the two or more

Parameter sets (P) for the temporal and spatial obfuscation of the recorded data takes place at random.

7. The method according to claim 5 or 6, wherein the selection from the two or more parameter sets (P) for the temporal and spatial concealment of the recorded data is made such that a predetermined proportion of the data with a large temporal concealment in combination with a low local Obfuscation is obfuscated while the rest of the data is obfuscated with a low temporal obfuscation combined with a large local obfuscation

8. The method according to claim 7, wherein the predetermined proportion can be adapted as a function of the application.

9. The method according to claim 1, wherein as an alternative to receiving (10) the at least one parameter set (P) for a temporal and spatial concealment of the recorded data, a request is received to use an already existing parameter set for the temporal and spatial concealment of the recorded data

10. The method according to claim 2, wherein first a first parameter set (P) is transmitted (51), which causes a concealment of the recorded data with a low temporal concealment in combination with a large local concealment, and in response to the detection of an event in a second set of parameters (P) is transmitted (51) to the concealed data, which causes concealment of the recorded data with a large temporal concealment in combination with a low local concealment

11. Computer program with instructions which, when executed by a computer, allow the computer to carry out the steps of a method according to one of claims 1 to 10 for processing data recorded by a motor vehicle (40)

cause.

12. Device (20) for processing data acquired by a motor vehicle (40), with;

- An input (21) for receiving (10) at least one parameter set (P) for concealing the recorded data in terms of time and location and for receiving (11) a date (D) recorded by a motor vehicle (40) from a data user (91) ;

- An anonymization unit (23) for applying (12) a temporal and spatial concealment to the received data (D) using one of the received parameter sets (P); and - An output (25) for forwarding (13) the concealed date (VD) for further processing.

13. Device (60) for providing parameters (P) for processing data acquired by a motor vehicle (40), with:

- A parameter determination unit (62) for determining (50) at least one parameter set (P) for a temporal and spatial concealment of the recorded data; and

- A transmission unit (63) for transmitting (51) the at least one

Parameter set (P) to a device (20) for processing by a

Motor vehicle (40) recorded data.

14. Motor vehicle (40), characterized in that it has a device (20) according to claim 12 or is set up to carry out a method according to claim 1 for processing data recorded by the motor vehicle (40).

15. Backend (80) for processing data captured by a motor vehicle (40), characterized in that it has a device (20) according to claim 12 or is set up, a method according to claim 1 for processing data by the motor vehicle (40) execute recorded data.