TECHNICAL FIELD

The subject matter described herein relates, in general, to security mechanisms for protecting telematics data, and, more particularly, to securing personally identifiable information within telematics data.

BACKGROUND

Traditionally, vehicle security has involved a vehicle owner using a physical key to lock a door and/or start a vehicle manually. As technology advances, this traditional vehicle security has morphed into more complex systems that involve additional features but also encounter additional/different risks. For example, many vehicles now include the ability to collect data about the operation of the vehicle, and communicate the collected data (also referred to as telematics data) to various remote entities. The ability to collect the telematics data and provide the telematics data to a manufacturer or other entity enables additional features for the vehicle owner and for the original manufacturer. For example, communicating the data may provide for tracking vehicle maintenance, automating reminders, improving security, and so on. In the context of the manufacturer, the telematics data provides insights about vehicle usage, potential maintenance problems, marketing data, and so on.

However, the telematics data also includes personally identifiable information (PII), which is data that links the vehicle with the identity of a particular person. The PII data can include information such as GPS location data from start/end points of a route, driving habits, and so on. Thus, with the advent of personal data privacy laws such as the California Online Privacy Protection Act (CalOPPA), the European Union General Data Protection Regulation (GDPR), and others, telematics data that is unsecured can be problematic. That is, the communication of the telematics data to third-parties, such as manufacturers, represents a significant difficulty since telematics data generally includes PII data that may be subject to various statutes and that should be secured. However, mechanisms for providing control of the data to users and for properly securing the data are generally unavailable or ill-suited for integration with existing vehicles.

SUMMARY

Example systems and methods disclosed herein relate to securing personally identifiable information in telematics data. As noted, vehicles may collect telematics data about various operating aspects and communicate the telematics data for use by various entities. However, because the telematics data can include PII data, which may be subject to various privacy laws, the plain communication and storage of this information is problematic. Therefore, the present disclosure describes various approaches to securing the telematics data in order to further protect the PII data. That is, in one approach, a vehicle and a mobile device initially register with a cloud-based computing system in order to, for example, establish cryptographic keys. The cloud-based system may store the keys for subsequent access to the data and filtering of PII data so that the telematics data can be otherwise accessed without revealing the PII.

In either case, the mobile device and the vehicle operate in concert to ensure that the telematics data is secure. For example, as the vehicle generates the telematics data, the vehicle can communicate the telematics data to the mobile device associated with a person that is presently riding in the vehicle. The device may then use the cryptographic key to encrypt the telematics data, thereby securing the telematics data against intrusion. The vehicle may also contribute a cryptographic signature of the data to identify the vehicle in relation to the data. The mobile device can then communicate the secured telematics to the cloud-based computing system for secure storage. In a further aspect, the cloud-based system may process the secured data to remove any identifying aspects (e.g., digital signatures) and simply associate the data with the vehicle and/or the mobile device using a numeric identifier such as the hash. In this way, the vehicle, the mobile device, and the cloud-based system function together to protect the PII data within the telematics data from improper use.

Subsequently, the mobile device can retrieve the telematics data from the cloud-based computing system using the hash of the data. In general, the mobile device can retrieve the telematics without being in the presence of the vehicle. That is, in the circumstance where the vehicle is a commercial vehicle providing an e-haling ride, a rideshare, etc., the mobile device can still retrieve the telematics for the prior trip. Thus, the telematics data, and, in particular, the PII data are associated with the particular mobile device/user combination so that the privacy of the user is protected even when riding in a vehicle that the user does not own.

In one embodiment, a privacy system for securing personally identifiable information associated with riding in a vehicle is disclosed. The system includes one or more processors and a memory communicably coupled to the one or more processors. The memory stores a crypto module including instructions that when executed by the one or more processors cause the one or more processors to, in response to receiving telematics data about a current trip of the vehicle, secure the telematics data according to at least a mobile cryptographic key associated with the mobile device to provide the telematics data as secured data that is obfuscated. The crypto module includes instructions to generate, by the mobile device, a secure packet including at least the secured data and a signature from the vehicle associated with the secured data. The memory stores a communication module including instructions that when executed by the one or more processors cause the one or more processors to communicate the secure packet to a remote computing device from the mobile device to cause the remote computing device to securely store the secured data without identifying a user associated with the mobile device.

In one embodiment, a non-transitory computer-readable medium for securing personally identifiable information associated with riding in a vehicle and including instructions that when executed by one or more processors cause the one or more processors to perform one or more functions is disclosed. The instructions include instructions to, in response to receiving telematics data about a current trip of the vehicle, secure the telematics data according to at least a mobile cryptographic key associated with the mobile device to provide the telematics data as secured data that is obfuscated. The instructions include instructions to generate, by the mobile device, a secure packet including at least the secured data and a signature from the vehicle associated with the secured data. The instructions include instructions to communicate the secure packet to a remote computing device from the mobile device to cause the remote computing device to securely store the secured data without identifying a user associated with the mobile device.

In one embodiment, a method for securing personally identifiable information associated with riding in a vehicle is disclosed. In one embodiment, the method includes, in response to receiving, in a mobile device from the vehicle, telematics data about a current trip of the vehicle, securing the telematics data according to at least a mobile cryptographic key associated with the mobile device to provide the telematics data as secured data that is obfuscated. The method includes generating, by the mobile device, a secure packet including at least the secured data and a signature from the vehicle associated with the secured data. The method includes communicating, by the mobile device, the secure packet to a remote computing device to cause the remote computing device to securely store the secured data without identifying a user associated with the mobile device.

