GB2310523A

GB2310523A - Data storage system for a vehicle

Info

Publication number: GB2310523A
Application number: GB9703080A
Authority: GB
Inventors: Jochen Hertle
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 1996-02-22
Filing date: 1997-02-14
Publication date: 1997-08-27
Anticipated expiration: 2017-02-14
Also published as: DE19606552B4; DE19606552A1; CH691715A5; GB9703080D0; GB2310523B; ITMI970191A1; IT1290231B1

Description

DATA STORAGE SYSTEM FOR A VEHICLE 2310523 The present invention relates to

a data storage system in a vehicle and to a method for the presentation of data of a vehicle device, especially in communication between stationary communications installations at highways and the vehicle device, into which changing data, such as fee credits, are entered by means of a portable data carrier, for example a chip card.

Vehicle devices which can receive chip cards are used in systems for the automatic levying of fees. The chip card can store sensitive data, such as fee credits, personal data and confidential data, for example codes for the enciphering of the exchange communications and for the mutual authentification with debiting stations. The chip card is therefore executed as a "trusted device", i.e. the data can be read out or amended only by authorised communications partners, in particular of booking and settling stations. Changes in the operating system and in the software of the chip card are not possible.

For the automatic levying of fees, presented data of the vehicle device can be transmitted to, for example, stationary communications installations at highways, but alternatively also processed in the vehicle device itself. For automatic fee assessment, data also play a part of kind which should not be stored on a chip card, since the data are tied to a certain vehicle. Examples of this are the motor vehicle class which may be relevant to fees and information about the keeper of the vehicle, which is of significance particularly in the case of a post- payment method, in which the user fee is debited from an account at a later date.

If these data is to be filed directly in the vehicle device, they must be protected against manipulation, since the data can have a direct influence on the fee level (for example, motor vehicle class) or open up other possibilities of misuse (for example, "free travel" coding in police and rescue vehicles). It would therefore be possible also to execute the vehicle device as "trusted device", i.e. so to design the mechanical envelope and the operating system that manipulation or reading- out of certain data is not possible. This method would be very expensive and inflexible, since a new certification of the device would have to take place after changes.

It would thus be desirable to be able to file the data, such as may be required for automatic levying of fees, in vehicle devices so as to be secure against manipulation without needing expensive and inflexible measures.

According to the present invention there is provided a method for the presentation of data of a vehicle device, especially between stationary communications installations at highways and the vehicle device, into which changing data, such as fee credits, are entered by means of a transportable data carrier, especially a chip card, characterised in that one part of the data, which is related to the vehicle, is entered into the vehicle device in coded form or in a form augmented by a code with the aid of a special vehicle device configuration station, that the other part of the data is stored on the data carrier and that the data carrier is provided with a deciphering code for the vehicle data in the vehicle device configuration station so that on co-operation of the data carrier with the vehicle vehicle the enciphered vehicle device data are transferred into the data carrier and presented in deciphered form.

A method exemplifying the invention thus envisages a separation of the data, wherein the filing of the vehicle-related data in the device by a vehicle device configuration station can take place in enciphered form with a secret code. This can be effected, for example, directly by the vehicle device configuration station or with the aid of special configuration chip cards. The vehicle device data can also be provided with an electronic signature by this station with the use of a secredt code. For example, a check sum about these data can be formed and the data plus check sum enciphered subsequently. Confidential data can, if so desired, be enciphered by a second code.

The portable data carriers, which later co-operate with the vehicle devices, receive the code matching the secret code of the vehicle device configuration station on their initialisation. The filing of these codes takes place in the protected storage region of the data carriers, in particular chip cards, and thus cannot be manipulated.

When the data carrier co-operates with the vehicle' device, for example the chip card is plugged into the device, the secured vehicle device data are transferred into the transportable data carrier.

Expediently, an integrity and authenticity check is undertaken. If the data do not have integrity or are not authentic according to this check, thus do not originate from the vehicle device configuration station, the vehicle device with the transportable data carrier is made incapable of function or incapable of comDlete function. Any application requiring an unrestricted participation of the data carrier, thus in particular the automatic levying of fees, can no longer take place. The checking procedure cannot be circumvented by manipulation when, as is usual, the data carrier is a "trusted device".

The vehicle device data are protected against manipulation by this method. However, it would be feasible to copy the vehicle device data, in particular vehicle device data which provide special privileges such as exist for, for example, police vehicles.

Preferably, therefore, the enciphered vehicle device data are filed with an unambiguous identification code, for example in the form of an identification number or a check number derived from the vehicle identification. The identification codes picked up at the highways from the stationary communications installations can then be checked at any time to establish whether like identification codes occur parallelly or whether the check number fits with the preferably optielectronically detected vehicle identification, whereby copied vehicle device data may be able to be discovered. The corresponding identification codes can be blocked or manipulated by the stationary communications installations so that either the vehicle concerned or the corresponding chip cards can be traced.

An embodiment of the present invention will now be more particularly described with reference to the accompanying drawing, the single figure of which is a block diagram of a data storage system embodying the invention.

Referring now to the drawing there is shown a vehicle device 1 in which a first part of application data 2 is entered in secured or enciphered form in a storage region thereof, which can if desired be executed to be protected. The entry can be effected directly in a special vehicle device configuration station or by a special portable data carrier, such as a special configuration chip card. The vehicle device also includes an application program 3, by which a communication can be made to an external application 4 via a shortrange communication link or network. The communication is possible with, in particular, stationary communications installations at highways. It is, however, also feasible to undertake levying of fees "autonomously" in the vehicle device 1 in that the position of the device is ascertained by means of satellite navigation and a payment is effected, optionally with the use of a chip card. The acknowledgements are passed on to an appropriate infrastructure at a later point in time. The application program 3 in this case looks after performance and evaluation of the satellite location and the issue of the acknowledgements, whilst the external application 4 in this case stands for the communication with the navigation satellites and for the mentioned infrastructure.

The application data 2 of the vehicle device are not, however, usable in the enciphered form. A functionally capable vehicle device arises only through use of a portable data carrier 5, which is constructed as, for example, a chip card and in which is stored a second part of application data 6 comprising a code 7 for the deciphering of the application data contained in the protected region 2 of the device 1. The application data 6 of the data carrier 5 can contain, for example, fee credits when the desired system is to be used in conjunction with the levying of fees.

Claims

1. A data storage system for a vehicle, comorising a data storage device intended to be located in the vehicle and storing data related to the vehicle in a coded form or a form augmented by a code and a portable data carrier storing further data and provided with a deciphering code for the vehicle-related data, the data carrier being co-operable with the device to take over and decipher the vehicle related data.

2. A system as claimed in claim 1, comprising means to carry out an integrityand authenticity check prior to take-over of the vehicle- related data by the data carrier and to cause functional inhibition of the device in response to a negative result of the check.

3. A system as claimed in claim 1 or claim 2, wherein the vehicle related data is stored i.n the system in conjunction with an identification code and the system comprises means to carry out a check for parallelly occurring like identification codes.

4. A system as claimed in any one of the preceding claims, wherein the vehicle-related data is stored in the device in conjunction with an identification code formed by a check number derived from an identification of the vehicle and the system comprises means for comparing the check number and the vehicle identification.

5. A system as claimed in any one of the preceding claims, wherein the device is operable to effect at least one of transmission of data to and reception of data from stationary communications points.

6. A system as claimed in any one of the preceding claims, wherein the further data comprises variable data and the device and data carrier are co-operable to effect entry of the variable data into the device.

7. A system as claimed in any one of the preceding claims, wherein the data carrier is a chip card.

8. A data storage system for use in a vehicle, the system being substantially as hereinbefore described with reference to the accompanying drawing.

9. A method for the presentation of data of a vehicle device, especially between stationary communications installations at highways and the vehicle device, into which changing data, such as fee credits, are entered by means of a transportable data carrier, especially a chip card, characterised in that one part of the data, which is related to the vehicle, is entered into the vehicle device in coded form or in a form augmented by a code with the aid of a special vehicle device configuration station, that the other part of the data is stored on the data carrier and that the data carrier is provided with a deciphering code for the vehicle data in the vehicle device configuration station so that on co-operation of the data carrier with the vehicle device the enciphered vehicle device data are transferred into the data carrier' and presented in deciphered f orm.

10. A method as claimed in claim 9, wherein before take-over of the enciphered data from the vehicle device by the data carrier an integrity and authenticity check is made and a negative result of the check leads to functional inhibition of the vehicle device.

11. A method as claimed in claim 9 or claim 10, wherein the enciphered vehicle device data are stored with an unambiguous identification code and a check is made for parallelly occurring like identification codes.

12. A method as claimed in any one of claims 9 to 11, wherein the enciphered vehicle device data are stored with an identification code which is formed by a check number derived from the vehicle identification and that a comparison of the check number and the vehicle identification is made before or during the communication.