EP2148305A1 - Method for calculating charges for using a mobile station - Google Patents

Abstract

The method involves processing a place utilization data (5), and transmitting a position anonymised allocation data (9) to a control center (11) e.g. central server, for the purpose of billing. The place utilization data in a mobile station (1) is encrypted with a user specific key (14). The encrypted place utilization data is transmitted to the control center. The encrypted place utilization data in the center is provided for retrieving by a user provided with the proper key. The utilization data is decrypted in a retrieve terminal of the user.

Description

• Verarbeiten der Ortsnutzungsdaten anhand ortsabhängiger Nutzungsgebühren zu ortsanonymisierten Verrechnungsdaten in der Station, und
• Senden der ortsanonymisierten Verrechnungsdaten an eine Zentrale zwecks Vergebührung.

The present invention relates to a method for charging location uses of a mobile station, which continuously determines its position and uses it to create location usage data, comprising:

• Processing the location usage data on the basis of location-dependent usage fees to location-anonymised billing data in the station, and
• Sending the location anonymized billing data to a central office for billing.

Such methods are used, for example, in electronic driving performance measurement, road toll or parking management systems to account for local uses such as the kilometer-dependent use of a particular route in a road network or the time-dependent use of a particular parking space in a parking lot. For reasons of data protection and confidentiality, mobile stations with their own intelligence ("thick" onboard units, OBU) are currently being used, which generate generalized billing data from the determined position or location data that no longer permit detailed conclusions about the movements of the station so that the confidentiality of the movement profile of the user with respect to the headquarters and any other entrusted with the billing agencies is guaranteed. However, this location anonymization in the billing process brings to the user also has the disadvantage that the correctness of the billing is no longer conclusive verifiable.

It has therefore already been proposed to make the location usage data accumulating in the mobile station accessible to the user via a local interface at the mobile station, e.g. via a serial, USB, Bluetooth or WLAN interface. However, this requires physical proximity to the mobile station, which is not so easy with OBUs of fleet vehicles, which typically can only be read in the fleet base at weekends. Also, in such a rare reading due to the limited storage space, older location usage data may be lost and, moreover, a local interface at the mobile station carries the risk of hacker attacks and tampering since it is billing-sensitive data.

The aim of the invention is to provide a method of the kind set forth which overcomes the stated disadvantages of the prior art and combines high transparency of the billing process with high confidentiality of the user movement data.

• Verschlüsseln der Ortsnutzungsdaten in der Station mit zumindest einem benutzerspezifischen Schlüssel,
• Senden der verschlüsselten Ortsnutzungsdaten an die Zentrale, und
• Zurverfügungstellen der verschlüsselten Ortsnutzungsdaten in der Zentrale zur Abfrage durch einen mit dem richtigen Schlüssel ausgestatteten Benutzer.

This object is achieved by a method of the initially mentioned kind, which according to the invention is characterized by the following steps:

• Encrypting the location usage data in the station with at least one user-specific key,
• Sending the encrypted location data to the central office, and
• Providing the encrypted location usage data in the center for polling by a user equipped with the correct key.

The inventive method is based on the new approach, the location usage data, which reflect the movement profile of a station and thus allow verification of Vergebührungsgrundlagen sent in encrypted form to the headquarters and there in encrypted form available for user queries. The method of the invention allows the user to view the detailed location usage underlying his billing without requiring a locally accessible and tamper-resistant interface at the mobile station; the query can be performed by the user at any time and in a single central location. Only the user himself knows the key to decrypting his place of use data in the center. This preserves the full confidentiality of this sensitive user data vis-à-vis the system operator or billing authority.

It is particularly advantageous if the encrypted location usage data is provided by the central office via a web interface for querying via the Internet, so that the user can also carry out the verification of his settlement basis from anywhere in the world.

For the query, the user can enter the key either directly into the central office or via their web interface in this, and the decryption takes place directly in the Headquarters. An even higher level of confidentiality is achieved when the user receives the encrypted location usage data from the central office and decrypts it in his interrogation terminal into which he enters the key and which only holds the key locally, ie does not forward it to the central office.

The location usage data can be stored in plaintext in the station and only encrypted immediately for sending to the control center. However, it is particularly advantageous if the location usage data are already stored in the station only in encrypted form, so that even an inspection of the mobile station would give no information about the movement history of the station.

The granularity of the location usage data can be arbitrarily selected according to the desired requirements, from "very fine" at the level of individual positions ("position fixes") to "very coarse" at the level of traveled sections, kilometers per time, length of stay in a parking area, crossing Accordingly, the location usage data both directly to the determined positions ("raw position data") correspond to the station and - preferably - be created from a geographical assignment of positions to places, routes or areas in a geodatabase.

According to a further advantageous embodiment of the invention, the encrypted location usage data can be stored in a separate area of the center, which is preferably physically separated from the remaining components of the center is particularly preferably outsourced as a web server. In this way, the encrypted location usage data can be placed in the central office, for example, under the separate power of disposition of a third party, which on the one hand increase security and trust for the user and on the other hand can allow a division of responsibilities on the operator side.

The transmission of the location-anonymised billing data can be carried out via any radio network known in the art, for example via mobile telephone, WLAN or WAVE networks. Particularly preferably, the transmission of the location-anonymous billing data takes place via a DSRC network in order to allow the high reliability and closed user group property of such networks to be given priority to the billing data.

The transmission of the encrypted location usage data can in itself also take place via any radio network known in the art, for example via DSRC, WLAN or WAVE networks. It is particularly advantageous if, according to a further feature of the invention, the transmission of the encrypted location usage data takes place via data packet transmission in a mobile telephone network. The transmission of the location data for testing and control purposes is generally lower than the billing data transfer, so that on the one hand no resources of the billing data communication are consumed and on the other hand with data packets conventional mobile phone networks Auslangen can be found, for example with SMS or GPRS data messages in GMS - or UMTS networks.

The mobile station may determine its position by any positioning method known in the art, for example by location in a mobile telephone, WLAN or DSRC network. Preferably, the position of the station is determined by satellite, e.g. according to the GPS, GLONASS, EGNOS, WAAS or GALILEO standard, which combines high accuracy with self-sufficiency. These methods may also use land-based radio systems, for example to increase the accuracy or improve the coverage; The term "satellite-based" also encompasses such combined methods.

According to a first preferred variant of the method of the invention, the key is entered by the user himself into the station. This process is very transparent to the user, but requires a separate input device, e.g. a keyboard at the station.

Alternatively, the key is preferably pre-stored in the station and handed to the user with the station, for example in a sealed envelope or as a "scratch code".

According to a further preferred variant, the key can be entered by the user in a programming device, which stores the key in the station, which eliminates a separate input device for each station.

A further advantageous embodiment of the invention is characterized in that the location usage data in the station is encrypted with different user-specific keys for different encrypted location usage data which are sent to the polling center by users equipped with the correct key. As a result, for example, different keys can be distributed to different types of users, for example, single user keys to the driver and a group key to the operator of a vehicle fleet, etc.

The method according to the invention is suitable for all types of mobile stations, which are used for billing local uses in the context of a central system. Particularly preferably, the station is an onboard unit of a vehicle in a mileage measurement, road toll or parking space management system.

The invention will be explained below with reference to a preferred embodiment with reference to the accompanying drawings, in which Fig. 1 a block diagram of the components of a satellite-based road toll or parking management system, which operates according to the method of the invention.

In Fig. 1 a mobile station 1 ("onboard unit", OBU) is shown, which with the aid of a GPS receiver 2 continuously, for example continuously, periodically or only during movements, determines the position of the station 1 in a coordinate system (not shown) and as Positions raw data 3 passes to a mapping application 4. The item raw data 3 consist for example of a sequence of geographical longitude and latitude coordinates at predetermined time intervals or each provided with a time stamp.

The mapping application 4 described below is optional; in the simplest case, it can be dispensed with and the item raw data 3 are processed further directly as location utilization data 5.

The (optional) mapping application 4 arranges the position raw data 3 to predefined locations, e.g. Parking lots, routes, e.g. Motorway sections, areas, e.g. Parking spaces or toll areas, borders, e.g. Access barriers, or the like. from a geodatabase 6 in order to create local and / or temporally generalized location usage data 5. The location information data 5 concern only more relevant for a billing local uses, such as driving on a particular route, the departure of a certain distance, exceeding a certain speed, staying at a certain place, staying for a certain time, exceeding a certain Area boundary or barrier, etc. The location usage data 5 may, for example, take the form of a list of traveled sections or used parking spaces with corresponding time stamps.

A billing application 7 then processes the location usage data 5 using location-dependent usage fees from a fee database 8 to location-anonymized billing data 9. The location-dependent usage fees of the fee database 8 define, for example, a certain fee for a certain mileage ("pay as you drive") or driven distance ("mileage "), for a particular route used (" toll route charge ") or a particular one used area ("area toll"), for a certain period of use of a place ("parking fee"), for a certain limit ("city toll", "entry fee", etc.), or the like, or any combination thereof.

The clearing application 7 thus replaces the concrete location information in the location usage data 5 by charging information, so that the billing data 9 no longer allow conclusions to be drawn about specific individual location uses, ie. are "anonymous". Optionally, multiple location usage data 5 accumulated in a single billing record 9, which further anonymizes the movement history of the mobile station 1.

The location-anonymous billing data 9 are sent via a first radio interface 10 of the mobile station 1 to a central office 11 ("central server", CS) of the system, from where they can be forwarded to a billing server 12 for billing. The functions of central 11 and clearing server 12 can also be combined in one unit, or alternatively be divided into several networked components. The radio interface 10 may be of any type known in the art, as previously discussed; Preferably, it is composed of a short range radio interface ("digital short range communication", DSRC) from the station 1 to a DSRC transponder on the roadside and a subsequent wired data line to the control center 11 together.

In order to allow the user to check the billing process shown, without compromising the confidentiality of the movement profile of the station 1 with respect to the operator of the center 11 and / or the clearing server 12, the following sequence is used.

The location utilization data 5 arising in the station 1 are stored in a separate memory area 13 of the station 1, encrypted with a key 14, sent as encrypted location usage data 15 via a second radio interface 16 to the center 11 and stored there in a separate area 17. The key 14 is selected by the user himself and entered via an interface 18 in the station 1. The interface 18 is, for example, a keyboard and display device on the mobile station 1.

Alternatively, the interface 18 may include a programming device (not shown) separate from the station 1, which is equipped with an input device into which the user inputs the key 14 and which stores the key 14 into the mobile station 1 via a local interface.

Yet another variant is that the key 14 is randomly generated in the manufacture of the mobile station 1, stored in the station 1 and handed to the user together with the mobile station 1, for example in a sealed envelope or as a "scratch code"; This also ensures that the operator of the system does not know the key 14 itself.

In the center 11, the encrypted location usage data 15 in the area 17 are made available to the user for decryption with his key 14, for example via a query terminal (not shown) or via an interface 19. The interface 19 is preferably a web interface for polling via the Internet 20. The user accesses the area 17 of the center 11 with a query terminal 21, receives the encrypted location usage data 15 via the Internet 20 and decrypts it with his key 14 back to the location usage data 5. Decrypting the encrypted location usage data 15 using the Key 14 thus takes place directly in the interrogation terminal 21, so that the key 14 does not reach the center 11; Alternatively, the decryption could also be done in an application of the center 11.

In the station 1, the location usage data 5 can be stored in the memory area 13 in still unencrypted form or preferably in already encrypted form. The memory area 13 is designed as "first-in / first-out" memory, wherein the oldest entries are overwritten in each case. In order to prevent memory overflows, the content of the memory area 13 is in each case sent in a timely manner to the center 11 via the second radio interface 16, e.g. whenever location usage data 5 is incurred, accumulated at intervals, or in each case at the request of the center 11.

The second radio interface 16 may be of any type known in the art, as previously discussed, and also be physically and / or logically separated from the first radio interface 10 or formed by the same physical and / or logical interface. The second radio interface 16 is preferably physically and logically separated from the first radio interface 10 and formed by a mobile telephone network connection to the central unit 11, in particular a packet-switched data connection, eg an SMS or GPRS connection in a GSM network.

If the radio interfaces 10, 16 are formed by one and the same physical interface, the encrypted location usage data 15 can even be sent to the center 11 together with the clearing data 9. In this case, however, the transmission of the billing data 9 preferably enjoys a logical priority over the transmission of the encrypted location utilization data 15 in order not to delay the (time-critical) transmission of the billing data 9.

In an alternative variant, the temporary storage of the location-use data 6 or encrypted location-use data 15 in the area 13 can be dispensed with, and the location-use data 6 are immediately encrypted for immediate transmission via the second radio interface 16.

In a further alternative variant, the area 17 of the center 11 may also be physically separated from its remaining components, for example outsourced in a separately connected web server, which may thus also be in a separate power of disposition of a third party. Also, any such physical breakdown of the center 11 in local Distributed, interconnected components fall under the term "control center" as used herein.

In still another variant of the method, the location usage data 5 in the station 1 could also be encrypted with various user-specific keys 14 to different encrypted location usage data 15, which are sent to the center 11 for queries by users equipped with the correct key 14, respectively. As a result, a multiplication or parallelization of the encryption path for the location usage data can be established, which, for example, allows the allocation of different keys to different user groups, as explained above.

The invention is not limited to the illustrated embodiments, but includes all variants and modifications that fall within the scope of the following claims.

Claims (15)

Method for charging location uses of a mobile station (1), which continuously determines its position (3) and uses it to generate location usage data (5), comprising: Processing of the location-use data (5) on the basis of location-dependent user charges (8) to location-anonymised billing data (9) in the station (1), and Sending the location-anonymised billing data (9) to a central office (11) for billing,
characterized by the steps: Encrypting the location usage data (5) in the station (1) with at least one user-specific key (14), - sending the encrypted location data (15) to the center (11), and - Providing the encrypted location usage data (15) in the center (11) for polling by a user equipped with the correct key (14). Method according to Claim 1, characterized in that the encrypted location utilization data (15) are made available to the central office (11) via a web interface (19) for querying via the Internet (20). Method according to one of Claims 1 to 2, characterized by the further step of decrypting the location usage data (15) in a polling terminal (21) of the user into which the key (14) is input. Method according to one of Claims 1 to 3, characterized in that the location utilization data (5) are stored in the station (1) in encrypted form (15). Method according to one of Claims 1 to 4, characterized in that the location-use data (5) are created in the station (1) by geographical assignment of the positions (3) to locations, routes or areas in a geodatabase (6). Method according to one of Claims 1 to 5, characterized in that the encrypted location utilization data (15) are stored in a separate area (17) of the center (11). A method according to claim 6, characterized in that the area (17) is physically separated from the remaining components of the center (11), preferably outsourced as a web server. Method according to one of Claims 1 to 7, characterized in that the transmission of the location-anonymised billing data (9) takes place via a DSRC network (10). Method according to one of Claims 1 to 8, characterized in that the transmission of the encrypted location usage data (15) takes place via data packet transmission in a mobile telephone network (16). Method according to one of claims 1 to 9, characterized in that the position (3) of the station (1) satellite-based (2) is determined. Method according to one of Claims 1 to 10, characterized in that the key (14) is entered by the user into the station (1). Method according to one of claims 1 to 10, characterized in that the key (14) in the station (1) pre-stored and the user with the station (1) is handed out. Method according to one of claims 1 to 10, characterized in that the key (14) is entered by the user in a programming device, which stores the key (14) in the station (1). Method according to one of Claims 1 to 13, characterized in that the location-use data (5) in the station (1) are encrypted with different user-specific keys (14) to different encrypted location-use data (15) which is sent to the center (11) for queries be sent by each equipped with the correct key (14) users. Method according to one of Claims 1 to 14, characterized in that the station (1) is an on-board unit (OBU) of a vehicle in a vehicle performance measurement, road toll or parking space management system.

Images