DE102012215959A1 - Carrying out an operation in a signal system - Google Patents

Abstract

It is proposed, based on (auxiliary) operation from an operating unit that is directed to a signal system, to generate information from the signal system that includes a CAPTCHA and to transmit this information to the operating unit. There, an operator enters the character sequence shown in the CAPTCHA, in particular a transaction number, which is transmitted to the signal system for confirmation. If the entry is correct, the operation is carried out. It is advantageous here that it can be ensured that such an input does not come from a machine but only from the operator. In this way, automated undesired operations can be prevented effectively and safely.

Description

The invention relates to a method for carrying out an operation in a signal system of a railway system, as well as corresponding devices (operating unit and signal system).

Known is a so-called CAPTCHA method (see, eg http://de.wikipedia.org/wiki/Captcha ). CAPTCHA is an acronym for "Completely Automated Public Turing Test to Tell Computers and Human Apart", which means:
"Fully Automated Public Turing Test to Distinguish Computers and People". CAPTCHAs are used to decide whether the counterpart is a human or a machine. In general, this is done to check whether entries have been made in Internet forms about people or machines (robots, bots), because robots can be misused here.

Also known is the use of transaction numbers ( http://de.wikipedia.org/wiki/Transaktionsnummer ). A transaction number (TAN) is a one-time password that consists of decimal digits, for example, used in online banking.

• – So kann es zu unbeabsichtigten Hilfsbedienungen kommen, verursacht durch Fehler oder Ausfälle des Bedienplatzsystems oder des Übertragungssystems. Hierunter fallen alle Arten der "unerwünschten Hilfsbedienung", z.B. ein unbeabsichtigte Auslösen, eine Verfälschung oder ein Verlieren oder ein unerwünschtes Wiederholen von Bedienungen.
• – Auch kann es zu unbeabsichtigten Hilfsbedienungen aufgrund einer Automatisierung von Hilfsbedienhandlungen kommen; beispielsweise können Makros oder automatisierte Abläufe im Bedienplatzsystem solche unerwünschten Hilfsbedienungen auslösen.

The coupling of a control unit to a safe signal system (eg a signal box, a line center for train control systems such as a radio block center, a vehicle facility of train control systems, etc.) is used in certain cases, the backup function of the signaling system under the responsibility of the operator (eg Dispatcher ) to get around. This method is referred to inter alia as an auxiliary operation or as a command release method (KF method). There are two problems to solve:
First, there is the problem that no auxiliary operation may be initiated that is not intended by the operator. This problem can be broken down into two parts:

• - This may result in unintentional auxiliary operations caused by faults or failures of the operator station system or the transmission system. This includes all types of "unwanted auxiliary operation", such as unintentional triggering, falsification or loss or unwanted repetition of operations.
• - There may also be inadvertent auxiliary operations due to automation of auxiliary operator actions; For example, macros or automated processes in the operator station system can trigger such unwanted auxiliary operations.

On the other hand, there is a problem in that the operator is to be assisted in performing auxiliary operation so as to reduce the likelihood of misoperation.

In this context, it is also problematic if operator station system and signal system are provided by different providers and thus there is no mutual control over the other system.

The object of the invention is to avoid the above-mentioned disadvantages and in particular to provide an efficient and secure approach for an auxiliary operation of a non-secure operator station system or of a non-secure operator unit as part of the operator station system.

This object is achieved according to the features of the independent claims. Preferred embodiments are in particular the dependent claims.

• – bei dem eine Bedienung von einer Bedieneinheit an das Signalsystem übertragen wird,
• – bei dem basierend auf der Bedienung eine Information umfassend ein CAPTCHA erzeugt wird,
• – bei dem die Information an die Bedieneinheit übertragen wird,
• – bei dem basierend auf der Information auf der Bedieneinheit eine Eingabe erfolgt und diese Eingabe an das Signalsystem übertragen wird,
• – bei dem das Signalsystem die Bedienung ausführt, falls die Eingabe den Inhalt des CAPTCHAs bestätigt.

The object is achieved by means of a method for carrying out an operation in a signaling system of a railway system,

• In which an operation is transmitted from an operating unit to the signal system,
• In which, based on the operation, information comprising a CAPTCHA is generated,
• In which the information is transmitted to the operating unit,
• In which an input is made based on the information on the operating unit and this input is transmitted to the signal system,
• - where the signaling system performs the operation if the input confirms the contents of the CAPTCHA.

In particular, if the received input correctly matches the content of the CAPTCHA, the operation is performed on the side of the signal system (e.g., caused).

In particular, the CAPTCHA can be any representation that can be recognized by humans and converted into a string, but this string is not or only poorly automatically recognizable by a machine. There are different algorithms, e.g. can display a string (multiple characters, including spaces) so that they can preferably only be recognized by one human (i.e., not a machine). Accordingly, it is an advantage that it can be ensured that the operation originated from a human, not from a machine or has been authorized.

The CAPTCHA presents eg alphanumeric characters, symbols and / or special characters of different size and orientation different background at different positions eg partially distorted, where other characters that are not to be recognized, are also displayed to make the automatic detection difficult or impossible. Known algorithms for generating such a CAPTCHA can be used for the present approach.

The present approach is based on such a CAPTCHA insofar as an automated input can thus be excluded with a predefinable security or an input made by an operator can also be recognized as such via a communication interface.

The signaling system is e.g. a unit of a railway system in which an action for setting the railway system or a component of the railway system can take place. The railway system can have several signal systems. It is also possible that the signal system is executed distributed over several units.

The operating unit can be part of an operator station system. This operator station system can be part of a control system that has a secure or unsecured connection to the signaling system. The connection can be designed to be structurally and / or technically secure. For example, in the latter case, a transmission can take place by means of a signature and / or an encryption. The connection may comprise a wireless and / or a wired communication interface. The control unit can be portable or it can be part of a fixed terminal.

• – eine Kommandoeingabe, deren Verfälschung die Sicherheit des Signalsystems umgehen kann,
• – ein Hilfsumstellen von Fahrwegelementen (z.B. Weichen),
• – ein Entsperren von Fahrwegelementen (Gleise, Weichen, Kreuzungen), die zum Befahren gesperrt sind,
• – ein Ersatzsignal in Fahrt stellen,
• – ein Hilfsauflösen von Fahrstraßen,
• – ein Grundstellen von Achszählern,
• – ein Einrichten von Beschränkungen für Streckenabschnitte (Befahrbarkeitssperre, Langsamfahrstelle),
• – ein Aufheben von Beschränkungen für Streckenabschnitte.

A further development is that the operation comprises at least one of the following actions:

• A command input whose corruption can bypass the security of the signaling system,
• An auxiliary change of infrastructure elements (eg points),
• - unlocking of track elements (tracks, switches, intersections) that are locked for driving,
• - activate a replacement signal,
• - auxiliary dissolution of driveways,
• - a basic location of axle counters,
• - setting up restrictions for sections of the route (drivability barrier, slow-driving),
• - removing restrictions on sections of the route.

Another development is that the CAPTCHA is created based on a string.

In particular, it is a development that the information includes a transaction number.

It is also a development that the CAPTCHA is created based on a transaction number.

In particular, a transaction number is used only once per period of time (e.g., for a given validity period) or generally only once. This ensures that no repeated entries can be made.

One option is that the CAPTCHA represents the transaction number that the operator must recognize and enter. It is also possible that the transaction number e.g. is represented as text (for example as ASCII text) and the CAPTCHA comprises the representation of alphanumeric characters. The operator should now enter the characters displayed in the CAPTCHA together with the transaction number, if appropriate in different fields of an input mask provided for this purpose. If the CAPTCHA is recognized as correct on the signal system side, it is possible to perform the operation.

Furthermore, it is a development that the information includes a text.

The text may include alphanumeric characters, symbols and / or special characters. It is also possible that the text comprises only a subset of the possible characters, e.g. no national special characters.

In the context of an additional development, the information comprises an image or a symbol which is associated in particular with the operation or represents it.

Thus, the operator may be given an indication of the operation and / or the CAPTCHA.

A next development is that the signal system performs the operation if the input confirms the contents of the CAPTCHA and if the input is received on the signal system before a period of time has elapsed.

One embodiment is that the information is transmitted to the operating unit and a timer is started, wherein the timer specifies the time period that may elapse until the input to the signal system is to be received.

An alternative embodiment is that if the input does not match the content of the CAPTCHA, the signal system uses the Operation does not execute, and in particular an error message and / or an alarm is / are triggered.

The statements concerning the method apply correspondingly to the other categories of claim.

• – eine Bedienung an das Signalsystem übertragbar ist,
• – basierend auf einer von dem Signalsystem empfangenen Information eine Eingabe erfassbar ist und diese Eingabe an das Signalsystem übertragbar ist, wobei die empfangene Information auf einer Anzeigeeinheit zumindest teilweise darstellbar ist, wobei die empfangene Information ein CAPTCHA umfasst, das basierend auf der Bedienung erzeugt und von dem Signalsystem übermittelt wurde.

The above object is also achieved by a device for inputting an operation for a signal system of a railway system, which is arranged such that

• An operation is transferable to the signaling system,
• - An input is detectable based on an information received from the signal system and this input is transferable to the signal system, wherein the received information is displayed on a display unit at least partially, the received information comprises a CAPTCHA generated based on the operation of and was transmitted to the signaling system.

The device is in particular a control unit.

• – eine Bedienung von einer Bedieneinheit empfangbar ist,
• – basierend auf der Bedienung eine Information umfassend ein CAPTCHA erzeugbar ist,
• – die Information an die Bedieneinheit übertragbar ist,
• – das Signalsystem die Bedienung ausführt, falls eine Eingabe den Inhalt des CAPTCHAs bestätigt, wobei die Eingabe von der Bedieneinheit übermittelbar ist.

Also, the above object is achieved by means of a signal system of a railway system, which is set up such that

• An operation can be received by an operating unit,
• Based on the operation, an information comprising a CAPTCHA can be generated,
• The information is transferable to the operating unit,
• - The signal system performs the operation, if an input confirms the contents of the CAPTCHA, wherein the input from the operating unit can be transmitted.

The solution presented here further comprises a computer program product which can be loaded directly into a memory of a digital computer, comprising program code parts which are suitable for performing steps of the method described here.

Furthermore, the above problem is solved by means of a computer-readable storage medium, e.g. any memory comprising computer-executable instructions (e.g., in the form of program code) adapted for the computer to perform steps of the method described herein.

The above-described characteristics, features, and advantages of this invention, as well as the manner in which they will be achieved, will become clearer and more clearly understood in connection with the following schematic description of exemplary embodiments which will be described in detail in conjunction with the drawings. In this case, the same or equivalent elements may be provided with the same reference numerals for clarity.

Show it:

1 a schematic flow diagram illustrating the implementation of an auxiliary operation;

2 a schematic representation of information comprising a CAPTCHA, a graphic and a text.

In the present case, it is proposed to use a CAPTCHA method and optionally to combine it with transaction numbers in order to ensure that the input of an operation (hereinafter referred to as auxiliary operation, for example) is performed exclusively and possibly only once by an operator. The CAPTCHA can be provided in such a way that it also supports the operator from an ergonomic point of view.

• – eine Kommandoeingabe, deren Verfälschung die Sicherheit des Signalsystems umgehen kann,
• – ein Hilfsumstellen von Fahrwegelementen (z.B. Weichen),
• – ein Entsperren von Fahrwegelementen (Gleise, Weichen, Kreuzungen), die zum Befahren gesperrt sind,
• – ein Ersatzsignal in Fahrt stellen,
• – ein Hilfsauflösen von Fahrstraßen,
• – ein Grundstellen von Achszählern,
• – ein Einrichten von Beschränkungen für Streckenabschnitte (Befahrbarkeitssperre, Langsamfahrstelle),
• – ein Aufheben von Beschränkungen für Streckenabschnitte.

Examples of possible auxiliary operations are:

• A command input whose corruption can bypass the security of the signaling system,
• An auxiliary change of infrastructure elements (eg points),
• - unlocking of track elements (tracks, switches, intersections) that are locked for driving,
• - activate a replacement signal,
• - auxiliary dissolution of driveways,
• - a basic location of axle counters,
• - setting up restrictions for sections of the route (drivability barrier, slow-driving),
• - removing restrictions on sections of the route.

• (1) Der Bediener wählt eine entsprechende Hilfsbedienung an einer Bedieneinheit 101 aus oder gibt diese in Form von Textbefehlen ein. Diese Hilfsbedienung wird in einem Schritt 103 zu einem Signalsystem 102 übertragen. Die Übertragung ist hierbei beispielsweise nicht gesichert. Insbesondere könnte die Übertragung durch Ausfälle oder nicht definierte Zustände verfälscht (z.B. gar nicht, teilweise oder mehrfach übertragen) werden. Optional kann die Übertragung auch signiert und/oder verschlüsselt übertragen werden.
• (2) In dem Signalsystem 102 wird die empfangene Hilfsbedienung zu einem CAPTCHA verarbeitet, z.B. basierend auf einer einmaligen Transaktionsnummer (vgl. Schritt 104). Das CAPTCHA wird in einem Schritt 105 zu der Bedieneinheit 101 übertragen und dem Bediener angezeigt. Zusätzlich kann ein Zeitfenster bestimmt werden, innerhalb dessen auf eine (gültige) Rückmeldung gewartet wird. Ist die mit dem Zeitfenster verbundene Zeitdauer abgelaufen, so wird beispielsweise keine Eingabe von dem Bediener mehr akzeptiert und/oder angenommen – siehe hierzu auch (4).
• (3) Der Bediener prüft, ob das CAPTCHA die von ihm gewünschte Hilfsbedienung beschreibt oder – ggf. textuell oder grafisch – mit der gewünschten Hilfsbedienung assoziiert ist. Beispielsweise kann zusätzlich ein Text und/oder ein Bild angezeigt werden (vgl. Schritt 106), der bzw. das die Hilfsbedienung beschreibt oder identifiziert. Liegt keine Assoziation mit der gewünschten Hilfsbedienung vor, handelt es sich um einen Fehler, der Bediener bricht die Hilfsbedienung ab und/oder weist auf den Fehler hin. Liegt eine Assoziation mit der gewünschten Hilfsbedienung vor, so gibt der Bediener die Transaktionsnummer im Klartext ein (vgl. noch Schritt 106) und bestätigt damit, dass die Hilfsbedienung durchgeführt werden kann. Die eingegebene Transaktionsnummer wird in einem Schritt 107 (ggf. signiert und/oder verschlüsselt) an das Signalsystem 102 übertragen.
• (4) In dem Signalsystem 102 wird die Transaktionsnummer (bzw. die empfangene Bestätigung des Bedieners) empfangen. Es wird in einem Schritt 108 geprüft, ob die Bestätigung in dem vorgegebenen Zeitfenster eingegangen und korrekt ist. Sind diese Bedingungen erfüllt, so wird die Hilfsbedienung in einem Schritt 109 ausgeführt.

1 shows a schematic flow diagram illustrating the implementation of an auxiliary operation:

• (1) The operator selects an appropriate auxiliary operation on an operation unit 101 or enter these in the form of text commands. This auxiliary operation is in one step 103 to a signal system 102 transfer. The transmission is not secured, for example. In particular, the transmission could be corrupted by failures or undefined states (eg not transmitted at all, partially or repeatedly). Optionally, the transmission can also be signed and / or encrypted transmitted.
• (2) In the signaling system 102 the received auxiliary service is processed into a CAPTCHA, eg based on a unique transaction number (see step 104 ). The CAPTCHA will be in one step 105 to the control unit 101 transmitted and displayed to the operator. In addition, a time window can be determined within which to wait for a (valid) response. If the time period associated with the time window has expired, for example, no input is accepted and / or accepted by the operator - see also (4).
• (3) The operator checks whether the CAPTCHA describes the auxiliary operation desired by him or - possibly textually or graphically - associated with the desired auxiliary operation. For example, a text and / or an image may additionally be displayed (see step 106 ) describing or identifying the auxiliary operation. If there is no association with the desired auxiliary operation, it is an error, the operator aborts the auxiliary operation and / or indicates the error. If there is an association with the desired auxiliary operation, the operator enters the transaction number in plain text (see still step 106 ) and confirms that the auxiliary operation can be performed. The entered transaction number will be in one step 107 (possibly signed and / or encrypted) to the signaling system 102 transfer.
• (4) In the signal system 102 the transaction number (or the operator's acknowledgment received) is received. It gets in one step 108 Checks whether the confirmation in the given time window received and correct. If these conditions are met, the auxiliary operation becomes one step 109 executed.

Thus, the CAPTCHA achieves that the desired auxiliary operation is visualized in such a way that it can only be translated by a human into a form that can be understood by the machine. This prevents the operator actions from being automated.

The CAPTCHA can have different configurations. In particular, the CAPTCHA itself may be combined with text and graphics, e.g. specify the content of the auxiliary operation. The CAPTCHA can display a transaction number in a manner that can only be recognized by the operator (and not by a machine). When the operator enters the transaction number shown in the CAPTCHA, he indicates to the signal system that the auxiliary service is from him.

For example, the CAPTCHA may also have pictograms that visualize the auxiliary operation and help the operator identify the auxiliary operation. This allows the operator to easily identify if there is an error. In this way it is possible to reduce the likelihood of erroneous input while satisfying advantageous ergonomic requirements for the operator.

2 shows schematically an information 201 comprising a CAPTCHA 202 , In addition, the information 201 a graphic (eg picture, symbol, pictogram, bitmap, etc.) 203 and / or a text 204 exhibit.

By using a unique transaction number, it can be ensured that no old auxiliary operation is re-recorded. Furthermore, the required entry of the transaction number prevents a habitual, "knee-jerk" acknowledgment (i.e., always making the same entry) by the operator.

• (a) Es werden einmalige Transaktionsnummern generiert.
• (b) Es wird ein CAPTCHAs erzeugt zur Darstellung der Hilfsbedienung mit einer Transaktionsnummer als Bitmap auf der Basis der definierten Hilfsbedienungen.
• (c) Die Bitmap umfassend CAPTCHA mit Transaktionsnummer wird als komprimierte Grafik gespeichert.
• (d) Die Rückmeldung des Bedieners wird ausgewertet anhand von erwartungsgemäßen (projektierten) Wartezeiten.

For example, in a signal system, the following functions may be provided (regardless of the order below):

• (a) One-time transaction numbers are generated.
• (b) A CAPTCHA is generated to represent the auxiliary operation with a transaction number as a bitmap based on the defined auxiliary operations.
• (c) The bitmap comprising CAPTCHA with transaction number is stored as a compressed graphic.
• (d) The feedback from the operator is evaluated on the basis of expected (projected) waiting times.

• (a) Ein Dialogsystem zur Visualisierung der CAPTCHAs, die im komprimierten Grafikformat empfangen werden.
• (b) Ein Dialog zur Eingabe und Erfassung des CAPTCHA- Inhalts durch den Bediener.

The operating unit can be part of a control system; It is also possible that the operating unit is an independent component or is integrated in another component of the railway system than the control system. Preferably, for example, the following functions can be provided for inputting the auxiliary operation (regardless of the sequence selected below):

• (a) A dialog system for visualizing CAPTCHAs received in compressed graphics format.
• (b) A dialog for entering and capturing CAPTCHA content by the operator.

For example, the interface between the signal system and the operating unit may comprise a data transmission by means of a secure protocol, which is supported by both the signal system and the operating unit. Preferably, the secure protocol is independent of the physical transmission channel. The transmission of the CAPTCHA as a compressed graphic can be done in a PNG or JPG format. Accordingly, uncompressed can also Graphics are used. The transmission of the feedback from the operator can (possibly encrypted) in text form (eg as ASCII text).

It is thus proposed, based on an (auxiliary) operation of an operating unit, which is directed to a signal system, to generate from the signal system information comprising a CAPTCHA and to transmit this information to the operating unit. There, an operator inputs the character string represented in the CAPTCHA, in particular a transaction number, which is transmitted to the signal system for confirmation. If the entry is correct, the operation is carried out. It is advantageous that it can be ensured that such input is not from a machine, but only from the operator. This can effectively and safely prevent automated unwanted operations.

While the invention has been further illustrated and described in detail by the at least one embodiment shown, the invention is not so limited and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

LIST OF REFERENCE NUMBERS

101

Operating unit, e.g. workstation

102

signal system

103

Transmission of the auxiliary operation

104

Creation of CAPTCHA, possibly together with other components such as graphics, text

105

Transmission of information with CAPTCHA to the operating unit 101

106

Display information, capture input

107

Transmission input to the signaling system 102

108

Check whether input within time window and whether input correct

109

Carrying out the auxiliary operation

201

information

202

CAPTCHA

203

Graphic (e.g., picture or icon)

204

text

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• http://en.wikipedia.org/wiki/Captcha [0002]
• http://en.wikipedia.org/wiki/Transaction_Number [0003]

Claims (12)

Method for carrying out an operation in a signaling system ( 102 ) of a railway system, - in which an operation of a control unit ( 101 ) to the signaling system ( 102 ) is transmitted ( 103 ), In which, based on the operation, information comprising a CAPTCHA is generated ( 104 ), - in which the information to the operating unit ( 101 ) is transmitted ( 105 ), - in which, based on the information on the operating unit ( 101 ) an input is made and this input to the signal system ( 102 ) is transmitted ( 106 . 107 ), In which the signal system carries out the operation if the input confirms the content of the CAPTCHA ( 109 ). The method of claim 1, wherein the operation comprises at least one of the following actions: A command input whose corruption can bypass the security of the signaling system, An auxiliary transfer of infrastructure elements (e.g., switches), - unlocking of track elements (tracks, switches, intersections) that are locked for driving, - activate a replacement signal, - auxiliary dissolution of driveways, - a basic location of axle counters, - setting up restrictions for sections of the route (drivability barrier, slow-driving), - removing restrictions on sections of the route.  Method according to one of the preceding claims, wherein the CAPTCHA is created based on a string. A method according to any one of the preceding claims, wherein the information comprises a transaction number. Method according to one of claims 1 to 3, wherein the CAPTCHA is created based on a transaction number. Method according to one of the preceding claims, in which the information ( 201 ) a text ( 204 ). Method according to one of the preceding claims, in which the information ( 201 ) a picture ( 203 ) or a symbol which is associated in particular with the operation or represents it. Method according to one of the preceding claims, in which the signal system ( 102 ) performs the operation ( 109 ), if the input confirms the contents of the CAPTCHA and if the input before the expiration of a period of time on the signaling system ( 102 ) Will be received ( 108 ). The method of claim 8, wherein the information is transmitted to the operating unit and a timer is started, the timer specifying the amount of time that may elapse until the input to the signal system is to be received. Method according to one of the preceding claims, in which, if the input does not correspond to the content of the CAPTCHA, the signal system does not perform the operation, and in particular an error message or an alarm is triggered. Contraption ( 101 ) for inputting an operation for a signaling system of a railway system, which is set up in such a way that - an operation is transferable to the signal system ( 103 ), - based on an information received from the signal system, an input is detectable and this input is transferable to the signal system ( 106 . 107 ), wherein the received information is at least partially representable on a display unit, the received information comprising a CAPTCHA generated based on the operation and transmitted by the signal system. Signaling system ( 102 ) of a railway system which is set up in such a way that - an operation can be received by an operating unit ( 103 ), Based on the operation of an information comprising a CAPTCHA is generated ( 104 ), - the information is transferable to the operating unit ( 105 ), - the signal system performs the operation ( 109 ) if an input confirms the contents of the CAPTCHA, the input being transferable from the keypad ( 107 ).

Images