FR3146362A1 - Checking the presence of at least two people on board a vehicle - Google Patents

Abstract

Monitoring the presence of at least two persons on board a vehicle The invention relates to a method for monitoring the presence of at least two persons on board a vehicle, said vehicle making a journey between two geographical positions, said two persons using a first and a second respective communication terminal, characterized in that it comprises the following, during the journey: - collecting in a communication network time-stamped geolocation information generated by the first and second terminals between the two geographical positions, - collecting in said network time-stamped discovery information which relates to a discovery of the presence in the vehicle, -- by the first or second terminal, of the second or first terminal respectively, -- or by the first and second terminal, of at least one other terminal or equipment, - depending on the geolocation and discovery information collected, determining whether or not the two persons made the journey together between the two geographical positions.

Description

Checking the presence of at least two people on board a vehicle Field of invention

The invention relates to the field of telecommunications and the processing of communication data, in the case where at least two people travel together on board a vehicle, for example a car (carpooling), a motorcycle, a boat or any other type of vehicle.

Currently, the practice of carpooling is increasingly encouraged in order to combat single-occupancy driving. The aim of this encouragement is in particular to democratize environmentally virtuous practices and limit the impact of the upheavals affecting the energy market. To this end, measures are currently being developed at different levels of public policies that strongly encourage carpooling, based on the remuneration of those who practice it. These policies are implemented at both government and local levels, with implementation specificities depending on the situation of the transport offer in a given geographical area. In particular, in government terminology, the concept of Proof of Carpooling Register is mentioned, which denotes the concern of public authorities to be able to support an incentive policy with reliable mechanisms establishing that carpooling journeys giving rise to financial compensation do indeed take place.

Precisely, these public policies gaining media visibility and involving remuneration mechanisms are mechanically confronted with the risk of fraud, which can moreover be implemented relatively easily.

To carry out carpooling, there are currently many applications that allow connecting a motorist using a vehicle, on the one hand, and one or more occasional passengers of this vehicle, on the other hand. The applications are generally nominative, the passengers and the motorist declaring their identity via the application. The connection also defines a meeting point to drive the vehicle there to pick up the passenger(s).

Such applications also have a number of mechanisms based on the geolocation of the driver's mobile terminal and the mobile terminal of each passenger. Thus, in the General Conditions of Use of these applications, the geolocation at the departure and arrival of the mobile terminals is mentioned, this basic data also appearing among the data of the Proof of Journey Register, for applications approved within the framework of public programs. In some of these applications, a "telephone verification" is also mentioned after departure, this verification not declaring to implement terminal capabilities other than geolocation.

Faced with the promise of remuneration, users may be tempted to simulate a carpool between people who have agreed to each other at the start. These people choose each other, outside of any contact platform, because they have identical itineraries and they make the same journey, each in their own vehicle, following each other – the precision of the geolocation is not sufficient to establish that they are in fact two solo drivers fraudulently declared as carpooling.

Subject and summary of the invention

One of the aims of the invention is to remedy the drawbacks of the aforementioned state of the art by proposing a method for checking the presence of at least two people on board a vehicle, which makes it possible to generate proof/a certificate that the journey was indeed made jointly by these two people, while guaranteeing compliance with the legislation in force and in particular the protection of the personal data of these two people.

For this purpose, an object of the present invention relates to a method for controlling the presence of at least two persons on board a vehicle, the vehicle making a journey between two geographical positions, the two persons using a first and a second respective communication terminal.

Such a method is characterized in that it comprises the following, during the journey:

- collecting in a communication network time-stamped geolocation information generated by the first and second terminals between the two geographic positions,

- collect time-stamped discovery information from the network relating to a discovery of presence in the vehicle,

-- by the first or second terminal, from the second or first terminal respectively,

-- or by the first and second terminal, of at least one other terminal or equipment,

- based on the geolocation and discovery information collected, determine whether or not the two people traveled together between the two geographic positions.

The invention thus makes it possible to certify in a simple and reliable manner that at least two people have made a journey together. The fact of only retrieving geolocation and discovery information from the network, which is not in itself personal data, has the advantage of also ensuring the protection of users' privacy.

According to a particular embodiment, the time-stamped discovery information comprises an identifier associated with the journey and data representative of the failure or success of the discovery.

According to a particular embodiment, the identifier associated with the journey comprises an identifier associated with the first terminal and an identifier associated with the second terminal.

Such an embodiment has the advantage of reusing identifiers of already existing and known terminals, for example the MAC ( Media Access Control ) addresses of these terminals, their MSISDN ( Mobile Station International Subscriber Directory Number ) numbers, etc. As a result, the control method according to this embodiment is simple to implement while making it possible to certify, according to a first level of confidence, whether or not the two people made the journey together.

According to another particular embodiment, the identifier associated with the journey is an identifier received by the first and second terminals from communication equipment, via the network, such an identifier being a function of:

- a first identifier of a short-range communication protocol associated with the first terminal,

- a second identifier of the short-range communication protocol associated with the second terminal.

Such an identifier advantageously makes it possible to be associated with the user of the first terminal, with the user of the second terminal, with the first and second terminals, with the journey made by said users. In this way, for all the attempts at discovery, if applicable of short-range communication, which take place between the first and second terminals during the journey, it is possible to trace and exploit, by the communication equipment, such as for example a server, a platform or other dedicated equipment, the number of discoveries or short-range communications which succeeded or failed throughout the journey. As a result, the control method according to this embodiment makes it possible to certify, according to a second level of confidence higher than the first level of confidence mentioned above, whether or not the two people made the journey together.

According to another particular embodiment, during the discovery implemented by one of the two terminals, the first terminal, respectively the second terminal, identifies the second terminal, respectively the first terminal, using the second identifier, respectively first identifier, of the short-range communication protocol, the first and second identifiers having been received respectively by the second and first terminals from the communication equipment, via the network.

In this embodiment, the first and second terminals can discover each other, or even pair up, easily, since they have a common short-range communication protocol determined beforehand by the communication equipment and associated with a first and a second corresponding short-range communication protocol identifier, the first and second short-range communication protocol identifiers having advantageously been communicated beforehand to the second and first terminals respectively by the communication equipment.

According to another particular embodiment, the discovery of the presence in the vehicle of the first or second terminal comprises the sharing of information between the first and second terminals, the shared information being transmitted in a time-stamped manner to the communication equipment, via the network, by the first and second terminals.

In this embodiment, such sharing of information between the first and second terminals and the sending of this time-stamped information to the communication equipment by each of the terminals advantageously constitute a means of proving that an attempt at discovery or local short-range communication has been implemented between these terminals at two concordant times. This embodiment is particularly advantageous when at least one of these terminals is not equipped with a conventional short-range communication interface of the type for example Bluetooth, NFC, etc.

According to another particular embodiment, the discovery step is initiated by one of the first and second terminals in response to the reception by the terminal, from the communication equipment, of a data sequence, the sequence being sent by the terminal to the other terminal during the discovery step, the sequence received by the other terminal being sent by the other terminal to the communication equipment via the network, being associated with time-stamped discovery information.

Such an embodiment advantageously makes it possible to provide an additional level of security for the transmission, by at least one of the terminals, to said server, of time-stamped discovery information, since the communication equipment:

- by sending the data sequence to one of the terminals, has the possibility of controlling the initialization of the discovery and therefore of waiting to receive time-stamped discovery information from another terminal;

- by receiving from the other terminal the data sequence associated with time-stamped discovery information, has the possibility of obtaining proof with an increased level of confidence that the two terminals were present at approximately the same time in the vehicle, or even at the same time if each of the terminals sends its time-stamped discovery information synchronously to the communication equipment, for example in the case where the terminals have access to universal time via the Internet network.

According to another particular embodiment, the control method comprises, during the journey, the implementation of a verification of the identity of at least two people on board the vehicle.

Such an embodiment advantageously makes it possible to strengthen the level of certification of the presence of at least two people on board a vehicle, thanks to the collection of additional information in the network (the result of the verification) which is of a different type than the aforementioned geolocation and discovery information, since it relates to the identity of the people on board the vehicle.

According to another particular embodiment, the identity verification comprises:

- identify, by one of the first and second terminals associated with one of the persons who is not driving, said person, generating first identification data,

- identify the other person, whether or not the driver of the vehicle, using the terminal, generating second identification data,

- comparing the first and second identification data with respectively first and second identification data previously stored in the communication equipment,

- save the comparison result in the equipment.

Such an embodiment is advantageous in that, particularly in the context of a journey involving two people, it is the person who is not driving who takes the initiative to check identity, so as not to disturb the other person who is driving. Road safety is thus preserved.

The various embodiments or features mentioned above may be added independently or in combination with each other to the method of controlling an avatar, as defined above.

The invention also relates to communication equipment suitable for monitoring the presence of at least two persons on board a vehicle, the vehicle traveling between two geographical positions, the two persons using a first and a second respective communication terminal.

Such equipment is characterized in that it is configured to, during the journey:

- collecting in a communication network time-stamped geolocation information generated by the first and second terminals between the two geographic positions,

- collect time-stamped discovery information from the network relating to a discovery of presence in the vehicle,

-- by the first or second terminal, from the second or first terminal respectively,

-- or by the first and second terminal, of at least one other terminal or equipment,

- based on the geolocation and discovery information collected, determine whether or not the two people traveled together between the two geographic positions.

Such equipment is particularly suitable for implementing the aforementioned control method.

The invention also relates to a communication terminal suitable for monitoring the presence of at least two persons on board a vehicle, the vehicle travelling between two geographical positions, the terminal being used by one of the two persons.

Such a terminal is characterized in that it is configured to, during the journey:

- send time-stamped geolocation information generated by the terminal between the two geographic positions in a communications network,

- send into the network time-stamped discovery information relating to a discovery by the terminal of the presence in the vehicle of another terminal or equipment, so as to determine in the network whether or not the person using the terminal and another person using the other terminal have made the journey together between the two geographical positions, based on the geolocation and discovery information sent.

The invention also relates to a computer program comprising instructions for implementing the method for checking the presence of at least two people on board a vehicle, according to any one of the particular embodiments described above, when said program is executed by a processor.

Such instructions can be stored permanently in a non-transitory memory medium of the communication equipment implementing the control method according to the invention.

This program may use any programming language, and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

The invention also relates to a recording medium or information medium readable by a computer, and comprising instructions of a computer program as mentioned above.

The recording medium may be any entity or device capable of storing the program. For example, the medium may include a storage medium, such as a ROM, such as a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, such as a mobile medium, a hard disk or an SSD.

On the other hand, the recording medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means, so that the computer program contained therein is remotely executable. The program according to the invention may in particular be downloaded over a network, for example an Internet-type network.

Alternatively, the recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the aforementioned control method.

According to an exemplary embodiment, the present technique is implemented by means of software and/or hardware components. In this regard, the term "device" or "module" may correspond in this document to a software component, a hardware component or a set of hardware and software components.

Other features and advantages will become apparent upon reading particular embodiments of the invention, given as illustrative and non-limiting examples, and the appended drawings, among which:

There represents an architecture in which the method for controlling the presence of at least two people on board a vehicle is implemented, according to a particular embodiment of the invention,

There represents a communication equipment, according to a particular embodiment of the invention, as implemented in the architecture of the ,

There represents the main actions implemented during a configuration phase of the method for controlling the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during an activation phase of a data exchange session of the method for controlling the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during an activation phase of a data exchange session of the method for controlling the presence of at least two people on board a vehicle, according to another particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of collecting time-stamped geolocation information of the method for controlling the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to another particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to yet another particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of collecting time-stamped discovery information of the method for checking the presence of at least two people on board a vehicle, according to yet another particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of collecting time-stamped identity information of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of collecting time-stamped identity information of the method for checking the presence of at least two people on board a vehicle, according to another particular embodiment of the invention, as implemented in the architecture of the ,

There represents actions implemented during a phase of processing the time-stamped geolocation information, the time-stamped discovery information, and possibly the time-stamped identity information, of the method for checking the presence of at least two people on board a vehicle, according to a particular embodiment of the invention, as implemented in the architecture of the .

Detailed description e d and several fashion s of carrying out the invention

There represents an architecture in which a method for controlling the presence of at least two persons A and B on board a vehicle is implemented, according to an embodiment of the invention. In the example shown, the vehicle is a car. This example is of course not exhaustive. The vehicle could be, for example, a motorcycle, a boat, a bicycle, etc. The car is used by one of the persons A and B, for example person A. In other words, person A is the driver of this car. Said car is designated by the reference V_A on the .

The architecture comprises a communication device P, such as for example a service platform or a server. This device allows driver and/or passenger users to register, declare daily journeys, and consequently find compatible carpoolers. Each user registered with this device is associated with a user communication terminal. In the architecture of the , the communication terminal of person A is designated T_A and the communication terminal of person B is designated T_B. In the example shown, the terminals T_A and T_B are both smartphone-type mobile telephones (" smartphone "). Such an example is of course not exhaustive. Indeed, one or the other of these terminals could be for example a tablet, a laptop, etc. The equipment P comprises a database BD comprising for each person A, respectively B, an identifier ID_A, respectively ID_B, associated with the person A, respectively B. The identifiers ID_A, ID_B are for example identifiers of the persons A, B, for example a pseudonym, an email or instant messaging address, etc. or identifiers associated with the terminals T_A, T_B, such as for example their respective MAC addresses or their respective MSISDN numbers. In the terminal T_A, respectively T_B, a computer program is installed designated by C_A, respectively C_B, as "client". This may be, for example, an application or application program that person A, respectively B, has previously downloaded from an application provider or software downloaded from equipment P. Activation of programs C_A, C_B makes it possible to implement real-time data exchanges:

- between on the one hand the terminals T_A, T_B and, on the other hand, the equipment P, via a long-range RCP network implemented according to, for example, cellular radiotelephony technologies (3G, 4G, 5G for example), IP (“ Internet Protocol ” in English), circuit, etc., or a combination of these technologies,

- between terminals T_A and T_B, where applicable via a short-range RCP network, such as for example Bluetooth, NFC (“ Near Field Communication ” in English), etc.,

- between the terminals T_A, T_B, via the short-range network RCP, and a plurality of communication terminals or equipment E ₁ , E ₂ , …, E _M , with M≥1, which are located in the vehicle V_A.

A communication terminal among E ₁ , E ₂ , …, E _M is for example a mobile phone for example of the smartphone type, a tablet, a laptop, etc. It may be for example a communication terminal belonging to a passenger of the vehicle V_A who is neither A nor B. A piece of equipment among E ₁ , E ₂ , …, E _M is for example a device installed or located in the vehicle V_A and operating according to a short-range communication protocol of the aforementioned type, for example a Bluetooth car radio, a Bluetooth headset, etc.

Such data exchanges may take place before, during and after the journey. The nature of these exchanges will be specified later in the description.

In the example of the , one or more short-range local communication protocols may be supported by both terminals T_A and T_B, such as for example Bluetooth, NFC, etc. By hypothesis, it is considered that such a protocol has a range not exceeding the passenger compartment of the vehicle.

However, higher range protocols, such as WiFi ( Wireless Fidelity ), can be considered provided that suitable means are implemented in the terminals to reliably measure the power of the signal received by these terminals, and in doing so deduce the distance between said terminals.

In the context of a short-range communication protocol considered, for example Bluetooth, we will call ID_T_A the identifier of the terminal T_A and ID_T_B the identifier of the terminal T_B.

We will now describe, with reference to the , the simplified structure of the aforementioned communication equipment P.

Such equipment includes:

- an MCP communication interface configured to communicate, via the RCP communication network of the , including terminals T_A and/or T_B,

- an MTI data processing module, such as:

-- time-stamped geolocation information received from terminals T_A and T_B,

-- time-stamped information relating to a discovery, by the terminal T_A, of the presence of the terminal T_B in the vehicle V_A, or to a discovery, by the terminal T_B, of the presence of the terminal T_A in the vehicle V_A,

-- time-stamped information relating to a discovery, by the terminal T_A, of the presence of j pieces of equipment among M (1≤j≤M) in the vehicle V_A, or to a discovery, by the terminal T_B, of the presence of k pieces of equipment among M (1≤k≤M) in the vehicle V_A,

-- identification data of persons A and B.

- a GIS module for generating an identifier associated with the journey made in the vehicle V_A,

- the aforementioned BD database in which are stored:

-- the identifiers ID_T_A and ID_T_B,

-- an ID_S identifier associated with the journey, in association with the identifiers ID_T_A and ID_T_B or ID_A and ID_B,

-- information relating to the success or failure of discovery attempts between terminals T_A and T_B, in association with their respective identifiers ID_T_A and ID_T_B or ID_A and ID_B,

-- possibly identification data DI_A and DI_B relating to the person using at least one of the terminals T_A, T_B (e.g.: photo of the face, fingerprint, voice sample of this person, etc.),

- an RPC memory configured to store information (e.g. certificate) representing that a journey in vehicle V_A was indeed made jointly by persons A and B.

Information about the success or failure of discovery attempts can be boolean in nature, in the form of a percentage, etc.

In the example shown, BD and RPC are installed in the communication equipment P. Alternatively, BD and/or RPC can be made accessible by the communication equipment P depending on the implementation envisaged, for example if it does not have the hardware and software resources necessary to store this information.

According to a particular embodiment of the invention, the actions executed by the communication equipment P are implemented by instructions of a computer program PG₁. For this, the P equipment has the classic architecture of a computer and includes in particular a MEM memory₁, a UTR processing unit₁, equipped for example with a PROC processor₁, and driven by the PG computer program₁stored in MEM memory₁. The PG computer program₁ includes instructions for performing the following actions as part of the method for checking the presence of at least two persons A and B on board a vehicle which will be described below, when the program is executed by the processor PROC₁, according to any one of the particular embodiments of the invention:

- communication with terminals T_A, T_B, prior to the journey to be made and during the journey,

- generation of an identifier associated with the journey,

- data processing, such as:

-- time-stamped geolocation information received from terminals T_A and T_B,

-- time-stamped discovery information received from terminals T_A and T_B,

-- possibly identification data of persons A and B,

- storage :

-- identifiers ID_A and ID_B,

-- identifiers ID_T_A and ID_T_B,

-- an ID_S identifier associated with the journey, in association with the identifiers ID_T_A and ID_T_B or the identifiers ID_A and ID_B,

-- information relating to the success or failure of discovery attempts between terminals T_A and T_B, or between terminals T_A and T_B and equipment E ₁ , …, E _M .

At initialization, the code instructions of the computer program PG ₁ are for example loaded into a RAM memory ( Read Access Memory ) (not shown) before being executed by the processor PROC ₁ . The processor PROC ₁ of the processing unit UTR ₁ notably implements the aforementioned actions, according to the instructions of the computer program PG ₁ .

We will now describe, with reference to the , the simplified structure of a communication terminal of the T_A or T_B type.

Such a terminal has the classic architecture of a portable terminal such as a smartphone, a tablet, a computer, or other.

For this purpose, the T_A or T_B terminal includes:

- a user interface UI configured to enter information or return information (keyboard, mouse, screen, microphone, speaker, camera, etc.);

- an MCT communication interface configured to communicate, via the RLP communication network of the , with communication equipment P,

- possibly an MCC communication interface configured to communicate with another terminal of the same type, via the RCP short-range communication network of the ,

- a LOC geolocation module which operates, for example, using GPS (“ Global Positioning System ” in English), Galileo, WiFi, GSM (“ Global System for Mobile Communications ” in English), IP, etc.,

- an STT memory configured to store, where applicable, the identifiers ID_T_A and ID_T_B of the short-range communication protocol considered, to store the identifiers ID_A, respectively ID_B, and/or graphic and/or textual information to be shared locally with another terminal, possibly DI_AS, DI_BS data relating to the person using the terminal (e.g.: photo of the face, fingerprint, voice sample of this person, etc.), as well as the identifier ID_S associated with the journey.

Since terminals T_A or T_B are not necessarily equipped with the MCC short-range communication interface, this is shown in dotted lines on the .

At initialization, the code instructions of the computer program PG ₂ are for example loaded into a RAM memory (not shown) before being executed by the processor PROC ₂ . The processor PROC ₂ of the processing unit UTR ₂ implements in particular the following actions, within the framework of the method for checking the presence of at least two persons A and B on board a vehicle which will be described below, according to the instructions of the computer program PG ₂ :

- communication via the RLP long-range network with the P communication equipment, prior to the journey to be made and during the journey,

- discovery, via the short-range RCP network or not, of the other terminal T_A or T_B depending on the terminal initiating the discovery,

- geolocation of the T_A/T_B terminal,

- storage of the identifiers ID_A, respectively ID_B, possibly the identifiers ID_T_A and ID_T_B of the short-range communication protocol considered and/or graphic and/or textual information to be shared locally with another terminal, possibly data relating to the person using the terminal (e.g.: photo of the face, fingerprint, voice sample of this person, etc.), the identifier ID_S of the short-range communication session,

- identification of the person using the terminal, A if it is T_A, and B if it is T_B.

We will now describe, with reference to FIGS. 4A to 8, the progress of a method for checking the presence of at least two persons A and B on board a vehicle, according to different embodiments of the invention. In the figures, the actions shown in dotted lines designate optional actions that may or may not be implemented during the joint journey of persons A and B.

Activation phase of a data exchange session corresponding to a journey to be made

In reference to the , a first embodiment of an activation phase by the equipment P of the data exchange session between the terminals T_A and T_B on the one hand, and the equipment P on the other hand, in connection with the journey to be made is described. According to this first embodiment, the terminals T_A and T_B are both equipped with at least one MCC short-range communication interface of the Bluetooth, NFC or other type.

Prior to this process, person B boards vehicle V_A used by person A at a meeting point defined by geographic coordinates (x,y), where x and y represent, for example, longitude and latitude respectively.

In S40, A and B each declare, via their respective applications C_A and C_B, that their joint journey begins. To this end:

- A selects in S40_A the meeting point in the C_A application of the T_A terminal, using the IU user interface,

- B selects in S40_B the meeting point in the C_B application of the T_B terminal, using the IU user interface.

In response to the selection action S40_A, respectively S40_B, the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG1_A, respectively MSG1_B, comprising:

- the identifier ID_A, respectively ID_B,

- the short-range communication protocol(s) supported by the terminal T_A, respectively T_B,

- the identifier(s) ID_T_A, respectively ID_T_B, associated with these protocols,

- the “enabled/disabled” status of the MCC short-range communication interfaces supporting these protocols.

The transmission of these different pieces of information to the equipment P can be carried out without loss of generality in one or more requests. During the transmission, related mechanisms for encrypting the messages MSG1_A, MSG1_B, for authenticating the persons A and B and/or the terminals T_A and T_B, which are known to those skilled in the art, can be implemented.

In S41, the P device receives the MSG1_A and MSG1_B messages via its MCP communication interface ( ).

In S42, the device P generates an identifier ID_S associated with a data exchange session that will take place during the journey between the terminals T_A and T_B on the one hand, and the device P on the other hand. The identifier ID_S is generated according to the identifiers ID_T_A and ID_T_B received, being associated with a status whose value is “initialized”.

In S43, the equipment P determines, based on the short-range protocols supported by the terminals T_A and T_B and based on the “activated/deactivated” status of the short-range communication interfaces supporting these protocols, whether or not a short-range discovery or communication can be established between T_A and T_B.

In the case where the P device determines a short-range communication protocol common to T_A and T_B, for example Bluetooth, for which the MCC short-range communication interfaces of T_A and T_B supporting this protocol are in the “activated” status, the P device sends in S44, via the RLP communication network:

- the session identifier ID_S at terminal T_A and T_B,

- the identifier ID_T_A at terminal T_B and the identifier ID_T_B at terminal T_A.

In the case where the equipment P determines a short-range communication protocol common to T_A and T_B, for example Bluetooth, for which the short-range communication interfaces of T_A and T_B supporting this protocol are respectively in the status “activated” and “deactivated” or “deactivated” and “activated” or “deactivated” and “deactivated”, the equipment P establishes that communication will be possible as soon as the Bluetooth protocol is activated on T_B and/or T_A as the case may be. For this purpose, in addition to the aforementioned information sent in S44, the equipment P sends to the terminal T_A and/or T_B whose short-range communication interface is deactivated, a message MSG2_A and/or MSG2_B respectively, this message requesting an activation of the short-range communication interface currently deactivated on the terminal T_A and/or T_B as the case may be.

In the event that the equipment P fails to determine a short-range communication protocol common to T_A and T_B, the equipment P sends in S44 to the terminal T_A and/or T_B a message MSG3_A and/or MSG3_B respectively, instead of the message MSG2_A and/or MSG2B, the message MSG3_A and/or MSG3_B informing the persons A and B that their carpooling cannot benefit from certification.

In S45, the terminal T_A, respectively T_B, receives the message MSG3_A, respectively MSG3_B, via its communication interface MCT ( ).

In S46, A and/or B then perform(s), on their respective terminal T_A, T_B, the activation required in S6 of their currently deactivated short-range communication MCC interface. Such activation is performed via the user interface IU of the terminals T_A, T_B in the parameters/settings of these terminals.

In S47, in response to said activation, the terminal T_A, respectively T_B, as the case may be, sends to the communication equipment P, via the RLP network, a notification MSG4_A, respectively MSG4_B, informing the equipment P that the activation of their corresponding short-range communication interface has been successfully implemented.

In S48, the P device receives the MSG4_A and/or MSG4_B messages via its MCP communication interface.

In S49, the P device changes the “initialized” status of the session corresponding to the ID_S identifier to the status with the value “activated”.

In reference to the , a second embodiment of a phase of activation by the equipment P of the data exchange session between the terminals T_A and T_B on the one hand, and the equipment P on the other hand, in connection with the journey to be made is described. According to this second embodiment, at least one of the terminals T_A and T_B is not equipped with at least one short-range communication MCC interface of the Bluetooth, NFC or other type. In the example described below, none of the terminals T_A and T_B is equipped with such an MCC interface.

Prior to this process, person B boards vehicle V_A used by person A at a meeting point defined by geographic coordinates (x,y), where x and y represent, for example, longitude and latitude respectively.

In S40’, A and B each declare, via their respective applications C_A and C_B, that their joint journey is beginning. To this end:

- A selects in S40’_A the meeting point in the C_A application of the T_A terminal, using the IU user interface,

- B selects in S40’_B the meeting point in the C_B application of the T_B terminal, using the IU user interface.

In response to the selection action S40’_A, respectively S40’_B, the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG1’_A, respectively MSG1’_B, comprising the identifier ID_A, respectively ID_B.

During transmission, related mechanisms for encrypting messages MSG1_A, MSG1_B, for authenticating persons A and B and/or terminals T_A and T_B, which are known to those skilled in the art, may be implemented.

In S41', the P device receives the MSG1_A and MSG1_B messages via its MCP communication interface ( ).

In S42’, the P device generates an ID_S identifier associated with a data exchange session that will take place during the journey between the T_A and T_B terminals on the one hand, and the P device on the other hand. The ID_S identifier is generated independently or according to the ID_A and ID_B identifiers received, being associated with a status whose value is “initialized”.

In S43’, the P device sends to the terminals T_A and T_B, via the RLP communication network, the identifier ID_S generated in S42’.

In S44', the terminal T_A, respectively T_B, receives the identifier ID_S generated in S42', via its MCT communication interface ( ).

In S45’, the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG2’_A, respectively MSG2’_B, informing the equipment P of the correct reception of the identifier ID_S.

In S46’, the P device receives the MSG2’_A and MSG2’_B messages via its MCP communication interface.

In S47’, the P device then changes the “initialized” status of the session corresponding to the identifier ID_S to the status with the value “activated”.

Phase collection of time-stamped geolocation information

In reference to the , an embodiment of a collection phase is described, during the journey having the identifier ID_S, of time-stamped geolocation information from the terminals T_A and T_B. Such a phase is implemented whether or not the terminal T_A and/or T_B is equipped with a short-range communication interface MCC.

For this purpose, at a location on the route:

- the C_A application triggers in S500 the sending by the terminal T_A to the equipment P, via the RLP network, of first time-stamped geolocation information IGH1_A generated by the geolocation module LOC of the terminal T_A,

- the P equipment then receives this information in S501,

- the C_B application triggers in S502 the sending by the terminal T_B to the equipment P, via the RLP network, of first time-stamped geolocation information IGH1_B generated by the geolocation module LOC of the terminal T_B,

- the P equipment then receives this information in S503.

The sending actions S500 and S502 can be implemented in a different order, simultaneously or independently.

In the example shown in the , at least one of the following locations on the route:

- the C_B application triggers in S504 the sending by the terminal T_B to the equipment P, via the RLP network, of second time-stamped geolocation information IGH2_B generated by the LOC geolocation module of the terminal T_B,

- the P equipment then receives this information in S505,

- the C_A application triggers in S506 the sending by the terminal T_A to the equipment P, via the RLP network, of second time-stamped geolocation information IGH2_A generated by the LOC geolocation module of the terminal T_A,

- the P equipment then receives this information in S507,

- and so on throughout the journey.

Send actions S504 and S506 can be implemented in a different order, simultaneously or independently.

In one embodiment, the time-stamped geolocation information IGH1_A, IGH2_A, etc. is in the form of triplets (X1_T_A, Y1_T_A, φ1_T_A), (X2_T_A, Y2_T_A, φ2_T_A), …, where:

- X1_T_A, X2_T_A, etc. denote longitude,

- Y1_T_A, Y2_T_A, etc. denote the latitude,

- φ1_T_A, φ2_T_A, etc. denote the timestamp.

Similarly, the timestamped geolocation information IGH1_B, IGH2_B, etc. is presented in the form of triplets (X1_T_B, Y1_T_B, φ1_T_B), (X2_T_B, Y2_T_B, φ2_T_B), …, where:

- X1_T_B, X2_T_B, etc. denote longitude,

- Y1_T_B, Y2_T_B, etc. denote the latitude,

- φ1_T_B, φ2_T_B, etc. denote the timestamp.

The timestamps may have a character determined by a fixed frequency or may have a random character. The sending actions S500, S506, respectively S502, S506 are triggered autonomously by the computer program C_A, respectively C_B, or are triggered in the form of “challenges” notified by the equipment P to the terminal T_A and/or T_B. The triggering mode may be hybrid, i.e. one of the terminals, T_A for example, implements the sending actions S500, S506 autonomously, while the terminal T_B implements the sending actions S502, S504 following the reception of a challenge from the equipment P.

Such a challenge includes, for example, the protocol elements necessary for the terminal T_A and/or T_B to understand the need to send geolocation information concerning it. Optional elements can also be considered, such as:

- a quantity and/or frequency of measurements to be carried out (to determine the speed of the vehicle for example),

- a request to use a particular positioning network (GPS, Galileo, etc.).

In the event that the sending actions S500, S506, respectively S502, S504, fail due to, for example, insufficient coverage or saturation of the RLP network, the information IGH1_A, IGH2_A, respectively IGH1_B, IGH2_B, the application C_A, respectively C_B, triggers in S508, S511, respectively S509, S510, the temporary storage of this information in the memory STT of the terminals T_A and/or T_B, before triggering said sending actions again, when the coverage of the RLP network is re-established or the latter is no longer saturated.

Time-stamped discovery information collection phase

In reference to the , an embodiment of a collection phase is described, during the journey having the identifier ID_S, of time-stamped discovery information from the terminals T_A and T_B. In this embodiment, the terminals T_A and T_B are provided with a short-range communication interface MCC.

For this purpose, at one location on the route, the following is implemented.

In S600a, one of the terminals T_A or T_B, for example T_A, detects the presence of the terminal T_B in the vehicle V_A, using the identifier ID_T_B received in S45 on the .

Optionally, the process continues as follows:

-- in S601a, person A acknowledges this detection, via the user interface IU of the terminal T_A,

-- in S602a, the C_A application triggers the sending, by the short-range communication module MCC of the terminal T_A, of an acknowledgment message MSG5_A to the terminal T_B,

-- in S603a, the terminal T_B receives the acknowledgment message MSG5_A,

-- in S604a, person B acknowledges receipt of the message MSG5_A, via the user interface IU of the terminal T_B,

-- in S605a, the C_B application triggers the sending, by the short-range communication module MCC of the terminal T_B, of an acknowledgment message MSG5_B to the terminal T_A,

-- in S606a, the terminal T_A receives the acknowledgment message MSG5_B.

In S607a, the application C_A, respectively C_B, checks that the execution context of the mutual discovery between the two terminals shares the session identifier ID_S.

Optionally in S608a, the application C_A, respectively C_B, executes an encryption/decryption challenge of a randomly generated character string, reciprocally proving to the application C_A, respectively C_B, that the other application C_B, respectively C_A, is an electronically “signed” and valid component.

At the end of action S607a or S608a, in S609a, the application C_A, respectively C_B, generates information IRD_A, respectively IRD_B, representing the success or failure of the discovery between the terminals T_A and T_B.

In S610a, one of the applications C_A or C_B, the application C_B in the example shown, triggers the sending by the terminal T_B to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_B.

The P device receives the IDH1_B information in S611a and stores it in its STP memory in S612a.

In S613a, the C_A application triggers the sending by the terminal T_A to the P equipment, via the RLP network, of first time-stamped discovery information IDH1_A.

The P device receives the IDH1_A information in S614a and stores it in its STP memory in S615a.

Send actions S610a and S613a can be implemented in a different order, simultaneously or independently.

The discovery phase just described above is iterated at least once during the journey so that:

- in S616a, one of the applications C_A or C_B, the application C_A in the example shown, triggers the sending by the terminal T_A to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_A,

- the P equipment receives the IDH2_A information in S617a and stores it in its STP memory in S618a,

- in S619a, the C_B application triggers the sending by the terminal T_B to the P equipment, via the RLP network, of second time-stamped discovery information IDH2_B,

- the P equipment receives the IDH2_B information in S620a and stores it in its STP memory in S621a.

Thus, during the journey, the P equipment is able to collect time-stamped discovery information IDH1_A, IDH2_A, IDH3_A, etc. from the T_A terminal and time-stamped discovery information IDH1_B, IDH2_B, IDH3_B, etc. from the T_B terminal.

In one embodiment, the time-stamped discovery information IDH1_A, IDH2_A, IDH3_A, etc., respectively IDH1_B, IDH2_B, IDH3_B, etc., comprises the information IRD_A, respectively IRD_B, representative of the success or failure of the discovery, the nature of the discovery (presence of an encryption challenge, etc.) and its time stamp. The time stamps may have a character determined by a fixed or variable frequency or may have a random character.

In the event that the sending actions S613a, S616a, respectively S610a, S619a, fail due to, for example, insufficient coverage or saturation of the RLP network, the application C_A, respectively C_B, triggers in S623a, S624a, respectively S622a, S625a, the temporary storage of the information IDH1_A, IDH2_A, respectively IDH1_B, IDH2_B in the memory STT of the terminals T_A and/or T_B, before triggering said sending actions again, once the coverage of the RLP network is re-established or the latter is no longer saturated.

In reference to the , we describe a variant of the implementation of the discovery phase illustrated in . Such a variant is distinguished from the embodiment of the , in that the equipment P orders the terminal T_A or T_B to send a request to discover the terminal T_B, respectively T_A, whereas in the example of the , such action, S600a on the , is implemented at the initiative of the terminal T_A. As a result, the information IDH1_A, IDH2_A, ..., respectively IDH1_B, IDH2_B, … can be certified with a higher level of confidence.

For this purpose, in S00b, the equipment P sends to one of the terminals T_A or T_B, T_A in the example of the , via the RLP network, a random sequence (e.g. character strings) of value S.

Terminal T_A receives this sequence in S01b.

In S600b, T_A requests the discovery of the terminal T_B in the vehicle V_A, using the identifier ID_T_B received in S45 on the .

The discovery phase continues as follows:

-- in S601b, person A acknowledges this discovery, via the user interface IU of the terminal T_A,

-- in S602b, the application C_A triggers the sending, by the short-range communication module MCC of the terminal T_A, of an acknowledgment message MSG5_A to the terminal T_B, said message containing the value S of the random sequence,

-- in S603b, the terminal T_B receives the acknowledgment message MSG5_A,

-- in S604b, person B acknowledges receipt of the message MSG5_A, via the user interface IU of the terminal T_B,

-- in S605b, the application C_B triggers the sending, by the short-range communication module MCC of the terminal T_B, of an acknowledgment message MSG5_B to the terminal T_A, said message containing the value S of the random sequence,

-- in S606b, the terminal T_A receives the acknowledgment message MSG5_B.

In S607b, the application C_A, respectively C_B, checks that the execution context of the mutual discovery between the two terminals shares the session identifier ID_S and the value S of the random sequence.

The following actions S608b to S625b are similar to the above actions S608a to S625a in connection with the , except that the first time-stamped discovery information IDH1_B sent in S610b to the equipment P, as well as the first time-stamped discovery information IDH1_A sent in S613b, contain the value S of the random sequence.

The value S’ of a new random sequence can then be sent by the equipment P to the terminal T_A or T_B for the purpose of transmitting to the equipment P the second discovery information IDH2_A and IDH2_B.

In accordance with the embodiment variant of the , the choice, by the equipment P, of sending the value S, S' of the random sequence to T_A or T_B can have an immutable character. For example, it can be decided that it will always be the terminal T_A (driver) or always the terminal T_B (passenger) which will receive the value S, S'. Such a choice can also be reversed or random.

In this embodiment, the timestamps may have a character determined by a fixed or variable frequency or may have a random character.

To guard against RLP network coverage issues, which are likely to affect this end-to-end embodiment variant, a fallback mechanism to the embodiment of the is likely to be agreed between the equipment P and each application C_A and C_B. According to a non-exhaustive example of embodiment, the equipment P can indicate to each terminal T_A, T_B that in the event of the latter not receiving, after a certain duration, a new random sequence value from the equipment P, it is up to the terminal T_A or T_B to take the initiative of the discovery, according to the embodiment of the .

In reference to the , another embodiment of a collection phase is described, during the journey having the identifier ID_S, of time-stamped discovery information from the terminals T_A and T_B. In this embodiment, the terminals T_A and T_B are provided with a short-range communication interface MCC and are thus able to detect the presence, in the vehicle V_A, of different equipment also provided with a short-range communication interface, such as the terminals or equipment E ₁ , …, E _M illustrated in the . Such an embodiment may be implemented in addition to the embodiments described with reference to FIGS. 6A and 6B or alternatively.

For this purpose, at one location on the route, the following is implemented.

In S600c, one of the terminals T_A or T_B, for example T_B, detects the presence in the vehicle V_A of K devices or terminals among E ₁ , …, E _M .

In S601c, the C_B application then triggers the sending by the terminal T_B to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_B which includes the number K of equipment/terminals detected and their respective identifiers.

The P device receives the IDH1_B information in S602c and stores it in its STP memory in S603c.

In S604c, the terminal T_A in turn detects the presence in the vehicle V_A of L equipment or terminals among E ₁ , …, E _M .

In S605c, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_A which includes the number L of equipment/terminals detected and their respective identifiers.

The P device receives the IDH1_A information in S606c and stores it in its STP memory in S607c.

In the example shown:

- K can be equal to L and the equipments/terminals discovered by T_A, respectively T_B, can be the same or not,

- K can be less than or greater than L.

The above actions are iterated at least once during the journey.

So :

In S608c, one of the terminals T_A or T_B, for example T_A, detects the presence in the vehicle V_A of Q equipment or terminals among E ₁ , …, E _M .

In S609c, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_A which includes the number Q of equipment/terminals detected and their respective identifiers.

The P device receives the IDH2_A information in S610c and stores it in its STP memory in S611c.

In S612c, the terminal T_B in turn detects the presence in the vehicle V_A of R devices or terminals among E ₁ , …, E _M .

In S613c, the C_B application then triggers the sending by the terminal T_B to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_B which includes the number R of equipment/terminals detected and their respective identifiers.

The P device receives the IDH2_B information in S614c and stores it in its STP memory in S615c.

In the example shown:

- Q can be equal to R and the equipments/terminals discovered by T_A, respectively T_B, can be the same or not,

- Q can be less than or greater than R.

The sending actions S601c, S605c, respectively S609c, S613c, can be implemented in a different order, simultaneously or independently.

In the event that the sending actions S601c, S613c, respectively S605c, S609c, fail due to, for example, insufficient coverage or saturation of the RLP network, the application C_A, respectively C_B, triggers in S616c, S617c, respectively S618c, S619c, the temporary storage of the information IDH1_A, IDH2_A, respectively IDH1_B, IDH2_B in the memory STT of the terminals T_A and/or T_B, before triggering said sending actions again, once the coverage of the RLP network is re-established or the latter is no longer saturated.

In reference to the , an embodiment of a collection phase is described, during the journey having the identifier ID_S, of time-stamped discovery information from the terminals T_A and T_B. In this embodiment, the terminals T_A and T_B are not provided with a short-range communication interface MCC.

For this purpose, at one location on the route, the following is implemented.

In S600d, one of the persons A and B, preferably the person who is not driving, B in the example shown, returns an information INF on his terminal T_B using the user interface IU. Such an information INF can be previously stored in the memory STT of the terminal T_B or be generated on the fly by the terminal T_B. The information INF can be a graphic element such as for example an image, a text element coded in an image, a QR code (" Quick Response Code " in English), or a sound element, such as for example a particular sound: music, the ambient sound in the vehicle V_A, etc.

In S601d, B asks A to capture the information INF from its terminal T_A.

In S602d, A captures the INF information via the user interface IU of its terminal T_A, a camera or a microphone depending on the type of INF information returned.

The sharing of INF information between the two terminals T_A and T_B then corresponds to a phase of mutual discovery inside the vehicle V_A.

In S603d, the C_B application then triggers the sending by the terminal T_B to the P equipment, via the RLP network, of first time-stamped discovery information IDH1_B which includes the INF information.

The P device receives the IDH1_B information in S604d and stores it in its STP memory in S605d.

In S606d, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of first time-stamped discovery information IDH1_A which includes the information INF.

The P device receives the IDH1_A information in S607d and stores it in its STP memory in S608d.

The above actions are iterated at least once during the journey.

So :

In S609b, B returns an information INF’ on its terminal T_B using the user interface IU. Such information INF’ may be the same as the information INF or different.

In S610d, B asks A to capture the information INF’ from its terminal T_A.

In S611d, A captures the information INF’ via the user interface IU of its terminal T_A, a camera or a microphone depending on the type of information INF’ returned.

In S612d, the C_B application then triggers the sending by the terminal T_B to the P equipment, via the RLP network, of second time-stamped discovery information IDH2_B which includes the INF’ information.

The P device receives the IDH2_B information in S613d and stores it in its STP memory in S614d.

In S615d, the application C_A then triggers the sending by the terminal T_A to the equipment P, via the RLP network, of second time-stamped discovery information IDH2_A which includes the information INF’.

The P device receives the IDH1_A information in S616d and stores it in its STP memory in S617d.

The sending actions S606d, S615d, respectively S603d, S612d, can be implemented in a different order, simultaneously or independently.

In the event that the sending actions S606d, S615d, respectively S603d, S612d, fail due to, for example, insufficient coverage or saturation of the RLP network, the application C_A, respectively C_B, triggers in S618d, S619d, respectively S620d, S621d, the temporary storage of the information IDH1_A, IDH2_A, respectively IDH1_B, IDH2_B in the memory STT of the terminals T_A and/or T_B, before triggering said sending actions again, once the coverage of the RLP network is re-established or the latter is no longer saturated.

Information collection phase identity timestamped

We now describe with reference to the an embodiment of a collection phase, during the journey having the identifier ID_S, of time-stamped identity information from at least one of the terminals T_A and T_B, preferably the terminal of the person who is not driving, T_B in the example shown.

Such an embodiment is optional or not.

The implementation of such a phase is inspired by the following practical considerations and constraints:

- this involves certifying the promiscuity in the same passenger compartment of driver A and passenger B, which further strengthens the guarantee with regard to equipment P that persons A and B have indeed made the journey together;

- a terminal, typically that of person A, can, during the journey, be used for other purposes, such as navigation assistance (computer program using GPS, etc.);

- it is not desirable for person A, who is driving, to use a mechanism to certify his presence which would affect his concentration at the wheel, such as for example taking a photo of himself with his terminal T_A, while the vehicle V_A is moving.

For this purpose, at a location on the route, the following is implemented, at a random or judiciously chosen time during the route when traffic conditions are favorable.

In S700a, the application C_B of the terminal T_B used by the person B, who is not driving, collects proof of the presence of B. Such proof consists of the generation of data DI_B identifying B.

The performance of step S700a is ensured by means known to those skilled in the art, previously agreed to by B and assuming:

- approval by B that the application C_B has access to the relevant capabilities of the terminal T_B within which this application is executed;

- the prior storage of identification data DI_BS of person B in the STT memory of the terminal T_B. These means include, but are not limited to:

- facial recognition;

- fingerprint recognition;

- recognition of a voice sample,

-etc.

In an exemplary implementation, the C_B application of the T_B terminal invites B to pronounce the word “tartiflette”.

In S701a, the application C_B of the terminal T_B used by the person B who is not driving collects proof of the presence of A. Such proof consists of the generation of data DI_A identifying A.

In this embodiment, it is assumed that identification data DI_BS of person A has been previously stored in the STT memory of the terminal T_B.

The means used to identify A are the same as in step S700. Preferably, recognition of a voice sample will be implemented because this is the method that least affects A's concentration and/or motor skills.

In an exemplary implementation, the application C_B of the terminal T_B invites A to pronounce the word “mountain”.

In S702a, the identification data DI_A and DI_B are stored in the STT memory of the terminal T_B.

In S703a, the identification data DI_B are compared with the identification data DI_BS of B which have been previously stored in the STT memory of the terminal T_B.

In the example shown, the word “tartiflette” DI_B is compared to previously recorded voice samples DI_BS.

At the end of the comparison, in S704a, the C_B application of the T_B terminal sends a NOTIF_B notification to the P device, via the RLP network, indicating whether DI_B=DI_BS or DI_B≠DI_BS.

In S705a, the P device receives the NOTIF_B notification and stores in S706a the success (DI_B=DI_BS) or failure (DI_B≠DI_BS) of this identification in its STP memory.

In S707a, the identification data DI_A are compared with the identification data DI_AS of A which have been previously stored in the STT memory of the terminal T_B.

In the example shown, the word "mountain" DI_A is compared to previously recorded voice samples DI_AS.

At the end of the comparison, in S708a, the C_B application of the T_B terminal sends a NOTIF_A notification to the P device, via the RLP network, indicating whether DI_A=DI_AS or DI_A≠DI_AS.

In S709a, the P device receives the NOTIF_A notification and stores in S710a the success (DI_A=DI_AS) or failure (DI_A≠DI_AS) of this identification in its STP memory.

We now describe with reference to the an alternative embodiment of the embodiment of the .

The method according to this variant comprises steps S700b and S701b identical to steps S700a and S701a of the .

In S702b, the C_B application of the T_B terminal sends the identification data DI_A and DI_B to the P device, via the RLP network.

In S703b, the P device receives the identification data DI_A and DI_B and stores them in S704b in its STP memory.

In S705b, the identification data DI_B is compared with the identification data DI_BS of B which was previously stored in the STP memory.

In the example shown, the word “tartiflette” DI_B is compared to previously recorded voice samples DI_BS.

In S706b, the P device stores, in its STP memory, the success (DI_B=DI_BS) or failure (DI_B≠DI_BS) of the identification obtained at the end of this comparison.

In S707b, the identification data DI_A is compared with the identification data DI_AS of A which was previously stored in the STP memory.

In the example shown, the word "mountain" DI_A is compared to previously recorded voice samples DI_AS.

In S708b, the P device stores, in its STP memory, the success (DI_A=DI_AS) or failure (DI_A≠DI_AS) of the identification obtained at the end of this comparison.

The generation of such identification data DI_A and DI_B can be implemented once or several times. However, the potentially intrusive nature of the user experience favors the generation of this data only once during the journey.

Phase of generating a level of confidence in the completion of a joint journey made by persons A and B

We now describe with reference to the an embodiment of a phase of generating a confidence level NC in the completion of the journey having the identifier ID_S.

For this purpose, when persons A and B reach their destination, at least one of persons A and B, or both, can declare in S80 the end of the journey to equipment P.

For this purpose:

- A selects in S80_A the arrival point of the journey in the C_A application of the T_A terminal, using the IU user interface, and/or

- B selects in S80_B the arrival point of the journey in the C_B application of the T_B terminal, using the IU user interface.

In response to the selection action S80_A, respectively S80_B, the terminal T_A, respectively T_B, sends to the communication equipment P, via the RLP network, a notification MSG6_A, respectively MSG6_B, comprising:

- the coordinates (x’,y’) of the arrival point defined by geographic coordinates (x’,y’), where x’ and y’ represent for example the longitude and latitude respectively,

- the identifier(s) ID_T_A, respectively ID_T_B, associated with these protocols.

The transmission of these different pieces of information to the equipment P can be carried out without loss of generality in one or more requests. During this sending, related mechanisms for encrypting the messages MSG6_A, MSG6_B, for authenticating the persons A and B and/or the terminals T_A and T_B, which are known to those skilled in the art, can be implemented.

In S81, the P device receives the MSG6_A and MSG6_B messages via its MCP communication interface ( ).

Steps S80 and S81 are optional, the equipment P being able to deduce from the information IGH1_A, IGH2_A, ..., IGH1_B, IGH2_B, …, IDH1_A, IDH2_A, …, IDH1_B, IDH2_B, ..., DI_A, DI_B, that persons A and/or B are no longer making the journey with the identifier ID_S.

In S82, the P device then calculates a confidence level based on all of the following collected information:

- IGH1_A, IGH2_A, ...,

- IGH1_B, IGH2_B, …,

- IDH1_A, IDH2_A, …,

- IDH1_B, IDH2_B, ...,

- possibly DI_A, DI_B.

For this purpose, the P equipment determines whether all of this information is consistent with respect to a certain threshold criterion.

In one embodiment, the consistency between these different pieces of information is based on a weighting:

- α applied to IGH1_A, IGH2_A, ..., and IGH1_B, IGH2_B, …;

- β applied to IDH1_A, IDH2_A, …, and IDH1_B, IDH2_B, ...;

- γ applied to DI_A, DI_B.

The weighting β can in particular be based on the percentage values of the information relating to the success or failure of the discovery between the terminals T_A and T_B.

The generation of the NC confidence level takes into account the individual consistency of the information IGH1_A, IGH2_A, ..., on the one hand, and the information IGH1_B, IGH2_B, ..., on the other hand.

For this purpose, the MTI processing module of the equipment P is configured to calculate, from the information IGH1_A, IGH2_A, ..., respectively IGH1_B, IGH2_B, ..., certain values, such as for example the distance traveled on the journey, the average speed of the vehicle V_A, the topology of the journey according to the calculated speeds, etc. and to deduce whether a level of consistency greater than a predefined threshold SP, for example 80%, is reached. If this is the case, the confidence level NC obtained makes it possible to generate in S83 a CERT certificate attesting that the journey with the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

The generation of the confidence level NC further takes into account the mutual consistency between the information IGH1_A and IGH1_B, IGH2_A and IGH2_B, etc. with respect to a predefined maximum distance threshold SP, for example 2.50m.

If it turns out, for example, that for all the pairs of information IGH1_A and IGH1_B, IGH2_A and IGH2_B, etc., 80% of the pairs respect a distance less than (or less than or equal to) 2.50m, the confidence level NC obtained makes it possible to generate in S83 a CERT certificate attesting that the journey with the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

The generation of the NC confidence level also takes into account for each of the IDH1_A, IDH2_A, ..., and IDH1_B, IDH2_B, ... received information, the success or failure of the discovery between the terminals T_A and T_B. If it turns out for example that on all of this received information the number of successes exceeds a predefined threshold SP of for example 80%, the NC confidence level obtained makes it possible to generate in S83 a CERT certificate attesting that the journey with the ID_S identifier was indeed carried out jointly by the persons A and B. Otherwise, the CERT certificate is not generated.

In the embodiment of the , consistency may consist of verifying that the information IDH1_A and IDH1_B, as well as IDH2_A and IDH2_B are functions of the same value S of the challenge or not. If it turns out, for example, that all of this information does indeed carry this value S, the confidence level NC obtained makes it possible to generate in S83 a CERT certificate attesting that the journey with the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

In the embodiment of the , consistency can consist of verifying that:

- the IDH1_A and IDH1_B information both carry the INF information,

- and that the IDH2_A and IDH2_B information both carry the INF’ information.

If this is the case, the NC confidence level obtained makes it possible to generate in S83 a CERT certificate attesting that the journey with the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

In the embodiment of the , coherence can consist of:

- for the IDH1_A and IDH1_B information, to compare with each other the numbers L and K of equipment/terminals E ₁ to E _M discovered and their types,

- for the IDH2_A and IDH2_B information, to compare with each other the numbers Q and R of equipment/terminals E ₁ to E _M discovered and their types.

If for example L=0 and K=2, Q=3 and R=1, with the same type of equipment/terminals discovered among Q and among R, the confidence level NC obtained in S82 is low and the CERT certificate will not be generated in S83, the predefined threshold SP being for example “no more than 1 equipment/terminal difference discovered between the two terminals T_A and T_B.

Applying this same SP threshold, if for example L=2 and K=3, Q=4 and R=4, with the same type of equipment/terminals discovered among L and K and among Q and R, the NC confidence level obtained in S82 is high and the CERT certificate will be generated in S83.

The generation of the NC trust level can also take into account the result of the comparison made between the identification data DI_A and DI_AS, respectively DI_B and DI_BS, in connection with figures 7A and 7B, to deduce a NC trust level. If it turns out for example that DI_A=DI_AS and DI_B=DI_BS, the NC trust level obtained makes it possible to generate in S83 a CERT certificate attesting that the journey having the identifier ID_S was indeed carried out jointly by persons A and B. Otherwise, the CERT certificate is not generated.

The CERT certificate that was generated in S83 is then stored in S84 in the RPC register illustrated in .

Such a certificate may thus be transmitted to any authority or body that wishes to have it. The transmission of the certificate to the authority/body may be implemented in a conventional manner, for example by sending an electronic message containing the certificate as an attachment, by making the certificate available on a dedicated server, for example FTP (" File Transport Protocol " in English), by sending by post a recording medium storing the certificate, for example a USB key (" Universal Serial Bus " in English), etc.

Claims (13)

Method for checking the presence of at least two persons on board a vehicle, said vehicle traveling between two geographical positions, said two persons using a first and a second respective communication terminal, characterized in that it comprises the following, during the journey:
- collecting (S501, S505, S503, S507) in a communication network time-stamped geolocation information (IGH1_A, IGH1_B, IGH2_A, IGH2_B) generated by the first and second terminals between the two geographic positions,
- collecting (S612a, S615a, S618a, S621a; S603c, S607c, S611c, S615c) in said network time-stamped discovery information (IDH1_A, IDH1_B, IDH2_A, IDH2_B) which relates to a discovery of the presence in the vehicle,
-- by the first or second terminal, from the second or first terminal respectively,
-- or by the first and second terminal, of at least one other terminal or equipment,
- based on the geolocation and discovery information collected, determine (S82, S83) whether or not the two people made the journey together between the two geographic positions. Control method according to claim 1, in which the time-stamped discovery information comprises an identifier (ID_S) associated with the journey and data representative of the failure or success of the discovery. Control method according to claim 2, in which the identifier (ID_S) associated with the journey comprises an identifier (ID_T_A; ID_A) associated with the first terminal and an identifier (ID_T_B; ID_B) associated with the second terminal. Control method according to claim 2, in which the identifier (ID_S) associated with the path is an identifier received by said first and second terminals from a communication device, via said network, said identifier being a function of:
- a first identifier (ID_T_A) of a short-range communication protocol associated with the first terminal (T_A),
- a second identifier (ID_T_B) of said short-range communication protocol associated with the second terminal (T_B). Control method according to claim 4, in which during the discovery implemented by one of the two terminals, the first terminal, respectively the second terminal, identifies the second terminal, respectively the first terminal, using the second identifier (ID_T_B), respectively first identifier (ID_T_A), of the short-range communication protocol, the first and second identifiers having been received respectively by the second and first terminals from the communication equipment, via said network. A control method according to claim 1 or claim 2, wherein the discovery of the presence in the vehicle of the first or second terminal comprises the sharing of information (INF, INF') between the first and second terminals, said shared information being transmitted in a time-stamped manner to the communication equipment, via said network, by the first and second terminals. Control method according to any one of claims 1 to 6, wherein the discovery step is initiated by one of the first and second terminals in response to the reception (S01b) by said terminal, from said communication equipment, of a data sequence, said sequence being sent (S602b) by said terminal to the other terminal during the discovery step, said sequence received by the other terminal being sent (S610b) by the other terminal to said communication equipment via said network, being associated with time-stamped discovery information. Control method according to any one of claims 1 to 7, further comprising, during the journey, the implementation of a verification (S703a, S707a; S705b, S707b) of the identity of said at least two persons on board the vehicle. A control method according to claim 8, wherein said identity verification comprises:
- identifying (S700a), by one of said first and second terminals associated with one of the persons who is not driving, said person, generating first identification data,
- identify (S701a) the other person, whether or not the driver of the vehicle, using said terminal, generating second identification data,
- comparing (S703a, S707a) the first and second identification data with respectively first and second identification data previously stored in said communication equipment,
- record (S706a, S710a) the result of the comparison in said equipment. Communication equipment suitable for monitoring the presence of at least two persons on board a vehicle, said vehicle traveling between two geographical positions, said two persons using a first and a second respective communication terminal, characterized in that said equipment is configured to, during the journey:
- collecting in a communication network time-stamped geolocation information generated by the first and second terminals between the two geographic positions,
- collect in said network time-stamped discovery information which relates to a discovery of the presence in the vehicle,
-- by the first or second terminal, from the second or first terminal respectively,
-- or by the first and second terminal, of at least one other terminal or equipment,
- based on the geolocation and discovery information collected, determine whether or not the two people traveled together between the two geographic positions. Communication terminal suitable for monitoring the presence of at least two persons on board a vehicle, said vehicle making a journey between two geographical positions, said terminal being used by one of the two persons, characterized in that said terminal is configured to, during the journey:
- send in a communication network time-stamped geolocation information generated by said terminal between the two geographic positions,
- sending in said network time-stamped discovery information relating to a discovery by said terminal of the presence in the vehicle of another terminal or equipment, so as to determine in said network whether the person using said terminal and another person using the other terminal have or have not made the journey together between the two geographical positions, depending on the geolocation and discovery information sent. Computer program comprising program code instructions for implementing the control method according to any one of claims 1 to 9, when executed on a computer. A computer-readable information medium comprising instructions of a computer program according to claim 12.