EP2360647B1 - Method for recording vehicles passing through - Google Patents

Abstract

The method involves detecting an identifier (5) of a vehicle (1) at a gateway (3) as gateway identifier (6). The specified or vehicle identification data (7) is encoded with the help of the gateway identifier to encrypted data (8). The identifier of a vehicle is detected at an exit (4) as exit identifier (15).

Description

The present invention relates to a method for detecting transits of vehicles with unique identifiers from an entrance to an exit according to the preamble of claim 1.

Such a method is known from DE 10 2007 059 346 A1 known.

Certain traffic surveillance tasks require two-time detection of one and the same vehicle at two different points, generally referred to herein as "entry" and "exit" of the section of road traveled by the vehicle. Examples of this are the so-called "Section Control", in which the entry and exit times of the vehicle are measured and used to determine the speed; the so-called "video toll", in which the vehicle is identified at the entrance and exit in order to charge the route section as a function of the route; or the so-called "City toll", in which the entrance and exit at city limits is controlled, e.g. the length of stay in the city center to be time-dependent.

The traffic monitoring systems used for this purpose must meet strict data protection requirements in order to rule out as far as possible the impermissible creation of movement profiles of road users. For example, the statutory regulations in Austria and Germany for the implementation of Section Control require that a permanent identification of a vehicle and its passage data may only be made in the event of a speeding violation.

Previously known systems attempt to meet these data protection requirements by, after identification of the vehicle at the entrance and exit and speed measurement based thereon, if there is no speed penalty, all recorded data within a guaranteed time, eg 8 minutes, be deleted without a trace (see F. Albrecht, "Section Control in Germany", Road Traffic Law, Journal for the practice of traffic lawyer, 2009). This procedure is still associated with uncertainties because all transit data at a certain time in the entry and exit stations are available in unencrypted form, regardless of whether it is a Delikatfall or not. In the from the DE 10 2007 059 436 A1 known method, the detected at the entrance of the vehicle vehicle identification, usually the vehicle license plate, itself used as a key to encrypt the entry data. This key can be destroyed immediately after encryption in the entry station, because it is physically "transported" from the entrance to the exit, in the form of the vehicle itself, and thus available for decryption there or in downstream evaluation stations. The known systems, however, can not always eliminate the danger of data misuse and data protection concerns with certainty.

The invention has for its object to provide a method for detecting the passage of vehicles between an entrance and an exit, which offers the highest possible data protection for the sensitive passage data.

This object is achieved by a method of the type mentioned in the introduction, which is characterized in that the entry data are provided with the entry time of the vehicle and deleted from the amount of entry data provided as soon as the current time exceeds a time window beginning with the entry time. The invention has the decisive advantage that decryption of the entry data always takes place only in the event of an offense: the time window is selected such that it corresponds to the minimum permissible travel time for the route section, ie when a vehicle is traveling at the maximum permissible speed. Thus, if the "age" of an encrypted entry data object is greater than the time window, then it can not be an overspeed, and that entry data is deleted (discarded) and thus never decrypted. A compliant vehicle thus leaves no identifiable traces in the system, which ensures the highest data security.

In the invention, a detected exit identifier is also preferably rejected if no entry data that can be decrypted thereby can be determined in the amount of provided entry data, so that no "unapproachable" exit identifications accumulate at the exit.

The data encrypted to the entry data may be of the predetermined type in the simplest case, i. a requirement that is also known at the exit and thus allows the recognition of a successful decryption. The default may be any known value or preferably includes an identification of the entrance, so that it can be determined at the exit from which entrance the vehicle comes.

Alternatively or additionally, the data mentioned can be related to the vehicle identification, because it is also known - in the form of exit detection - at the exit. In a further embodiment of the invention, therefore, the data mentioned include the entry recognition itself and / or an entry image of the vehicle from which the entry identification can be derived.

Such an entry image can also be retrieved when decrypting the entry data and archived together with an exit image and the identification of the vehicle for evidence purposes.

In a simple embodiment of the invention, the detected exit identifiers may be "tried" on all existing encrypted entry data "until the key matches".

In a preferred embodiment of the invention, the encrypted entry data is provided under a hash value calculated from the entry identifier, and a hash value is calculated from the exit identifier in the same manner. by means of which the encrypted entry data provided under this hash value are determined. In this way, the encrypted entry data are respectively identified by said hash value, so that during decryption the exit identification no longer needs to be tried on all entry data, but the entry data identified by the hash value can be accessed immediately.

In the present description, a "hash value" is understood to mean a virtually irreversible n: 1 mapping function, ie a function that is only (extremely) ambiguously reversible, so that it is virtually impossible to deduce the initial value from the knowledge of the hash value. Examples of such hashing functions are the checksum function, the modulo function, etc.

The latter variant of the invention also allows an alternative embodiment of the section control: For each hash value, the entry and exit times of the vehicle are also recorded and the encrypted entry data are only decrypted if the exit time associated with the hash value is within a time beginning with the associated entry time Time window is located. This embodiment is also suitable for a time-delayed or offline evaluation of the entry data objects, because instead of the current time, the exit time that can be assigned by means of the hash value can be taken into account.

Preferably, its speed can also be determined from the entry and exit times of a vehicle and the route length between entry and exit.

As identifier of the vehicle, any feature of the vehicle suitable for identification may be used, e.g. a remote-readable chassis number, a radio identifier of a carried RFID transponder chip, etc. Preferably, the identifier is simply the vehicle identifier and is detected by optical character recognition (OCR) in entry and exit images of the vehicle. Appropriately, the same entry and exit images can be used for this purpose, which are also archived for evidence, so that at the entrance and exit only a single image acquisition is required.

According to a further preferred embodiment of the invention, the said encrypting and providing the entry data takes place in an access station, said detecting the exit detection in an exit station, and said decrypting the entry data and validating the decrypted data in a separate evaluation station. As a result, both the entry and the exit station can be sealed in the manner of black boxes, for example, and can be privacy-certified; because they process only partial information, they are inadmissible with regard to the risk Creation of movement profiles harmless. The evaluation station can also be constructed so that it is completely self-sufficient and can therefore be certified separately.

Alternatively, the functions of the evaluation station can also be completely or partially integrated into the exit station.

In any case, it is particularly advantageous if, when encrypting the entry data, the entry identifier used as the key is supplemented with further keys, which are provided separately for decryption. Such other keys may e.g. be a timestamp, a temporary key, an identification of the entry station or a public key of the exit station, whereby the data security on the transmission paths can be further increased.

• die Fig. 1a - 1d verschiedene Ausführungsformen der am Verfahren der Erfindung beteiligten Komponenten in Blockdiagrammform; und
• Fig. 2 eine Ausführungsform des Verfahrens der Erfindung in Flußdiagrammform.

The invention will be explained in more detail with reference to embodiments illustrated in the accompanying drawings. In the drawings show

• the Fig. 1a - 1d various embodiments of the components involved in the method of the invention in block diagram form; and
• Fig. 2 an embodiment of the method of the invention in flow chart form.

Fig. 1a shows a vehicle 1, which passes through a section 2 of length L from an entrance 3 to an exit 4. The vehicle 1 has a unique identifier 5, for example in the form of its license plate number (LPN), in the example shown "(A) W-123". The identifier 5 could alternatively also be formed by other features of the vehicle 1, eg a machine-readable chassis number, a remote-readable radio identifier, eg RFID identifier, etc.

At the entrance 3, the identifier 5 of the vehicle 1 is first detected as a so-called. Entrance identifier 6 ("License Plate Number Start", LPS). The detection can be done, for example, by remote reading or preferably by optical character recognition (OCR) of the identifier 5 take place in an image recording PIC of the vehicle 1 at the entrance 3 ("entrance picture").

With the aid of this entry-detection code 6, data 7 for encrypted entry data 8 (also referred to below as the "entry data object" or "encrypted section control object") are now encrypted. The data 7 can be of various types: In the simplest case, a specification of any known value DAT is sufficient for this purpose, which can be retrieved during the subsequent decryption and thus indicates the success of the decryption ("the key fits"). However, the default can also be or include an identification GID of the entrance 3 ("gate ID"). Alternatively or additionally, the data 7 can be related to the identification 5 of the vehicle 1. In the latter case, the data 7 may be e.g. the entrance recognition 6 itself or the entrance image PIC, from which e.g. can be determined by means of OCR the entry identifier 6 from the vehicle registration number LPN.

The entry identifier 6, i. the identifier 5 of the vehicle 1 detected at the entrance 3 is thus used itself as the key 9 for the encryption. For encryption, any encryption method known in the art may be used.

After encrypting the entry data 8, the entry identifier 6 or the key 9 formed therefrom can be destroyed.

The Fig. 1b - 1d show variants for the generation of the key 9 from the entry identifier 6. In the case of Fig. 1b For example, the key 9 is formed from modifications, repetitions or functions of the entry detection 6 in order to increase the key length.

In the variants of Fig. 1c and 1d the key 9 is formed from the entry identifier 6 supplemented with further keys, in order to increase respectively the length of the key 9 and the data security. These other keys can be eg a timestamp TS ("Timestamp_StartGate"), an (arbitrary) temporary one Key 11 of the entry ("StartGate_tempID"), an entry ID 3 ("StartGate_ID"), or a public key 13 of exit 4 ("PublicKey_EndGate").

How out Fig. 1a As can be seen, the encrypted entry data 8 can optionally be provided with a hash value h1 or be provided below it for the further method steps. The hash value h1 is formed in a - as discussed in the beginning - practically irreversible way from the entrance ID 6 and facilitates the identification of the encrypted entry data 8 in the subsequent decryption and evaluation, as will be explained later.

After the vehicle 1 has passed through the section 2, at the exit 4 again the license plate 5 of the vehicle 1 is detected as so-called. Ausfahrtskennung 15. The detection can be done again in any manner, e.g. by remote reading or preferably by optical character recognition of the vehicle registration number 5 in an image recording of the vehicle 1 at the exit 4 ("exit image").

Since the vehicle 1 does not change its identifier 5 on its way from the entrance 3 to the exit 4, and thus the entry identifier 6 is equal to the exit identifier 15, the exit identifier 15 can be used to decrypt the encrypted entry data 8. Depending on the variant of Fig. 1a, 1b, 1c and 1d is to add the exit ID 15 in a corresponding manner to the key 9, either by appropriate function mapping ( Fig. 1b ), Supplementing with a time stamp TS obtained from the entry data 8, a temporary key 11 received from the entrance 3 on a separate transmission path 16, an identification of the entrance 3, a private key ("PrivateKey_EndGate") of the exit 4 , etc.

In practical operation, when a plurality of vehicles 1 travel from the entrance 3 to the exit 4, a plurality of encrypted entry data (objects) 8 also arrive. In the simplest case, the exit code can be decrypted 15 or the key 9 formed therefrom on each existing object will be "tried out" by encrypted entry data 8 "until the key fits".

Preferably, however, the mentioned hash values h1 are used, under which the encrypted entry data 8 are provided. For this purpose, a hash value h2 is formed from the exit identifier 15-in the same way as the hash value h1 from the entry identifiers 6. With the aid of the hash value h2, the encrypted entry data 8 provided under the same hash value h1 can be determined immediately without any attempt.

With the aid of the exit identifier 15 or the key 9 formed therefrom, the entry data 8 ascertained as appropriate or belonging (h1 = h2) are now decrypted and from this also the data 7 are retrieved. By validating the data 7 e.g. if they contain a specification DAT or GID compared to the known value DAT or a valid gate ID or if they contain the entry identifier 6 (directly derivable from the entry image PIC) vis-a-vis the exit identification 15, upon successful validation for a passage of a vehicle 1 closed with the identifier 5 from the entrance 3 to exit 4.

If in the entrance and exit 3, 4 respectively the entry time TS and the exit time TE is included, the dwell time of the vehicle 1 on the section 2 and - knowing the length L of the section 2 - also the speed of the vehicle 1 in Section 2 are determined ("Section Control").

Preferably, the entry and exit times TS, TE are also used for the control of the procedure, in the following manner.

The entry data 8, ie each entry data object 8, is / are respectively provided with the entry time TS of the vehicle 1. Once an entry data object 8 exceeds a predetermined age, ie the current time greater is as a beginning with the entry time TS time window .DELTA.T, the relevant entry data object 8 is deleted from the set of all provided entry data objects 8. The time window ΔT is defined by the permissible maximum speed V _max on the section 2, ie ΔT = L / V _max . An entry data object 8 which is too old, that is to say the time window ΔT, is therefore entry data of a vehicle 1 which complies with the regulations and does not exceed the permissible maximum speed, so that decryption is not required no identifiable traces in the system.

Exit identifiers 15, to which no entry data 8 that can be decrypted thereby can be found in the set of all provided entry data (objects) 8, can also be discarded.

According to an alternative (or additional) variant of the method, the hash values can also be utilized for this time comparison. In the assignment and determination of the entry data 8 on the basis of the comparison of the hash values h1 and h2, only those entry data 8 are considered and subsequently decoded whose entry and exit times TS, TE lie within the time window ΔT. As a result, the age of the entry data objects 8 can also be changed at a later time, e.g. offline or in a separate evaluation station.

In a practical embodiment, an allowable minimum arrival time TEC (Time-stamp_End_Calculated) is calculated in the entry station from the entry time TS and the time window ΔT and provided (equal to the entry time TS) with the hash value h1 and the encrypted entry data 8. If the exit time TE associated with a hash value h2 (= h1) is now before the minimum arrival time TEC, then there is obviously a speed overrun and the entry data 8 is decrypted. In this case, also the exit detection 15 = entrance identification 6 = identification 5 of the vehicle 1 together with the entrance image PIC and the exit image are archived for evidential purposes, eg in order to be able to impose a penalty for exceeding the speed limit. On the other hand, if the actual exit time TE is after the allowable minimum arrival time TEC, ie outside the time window ΔT, then it is a compliant vehicle not exceeding the maximum permissible speed TEC and the encrypted entry data 8 and exit detection 15 are immediately cleared.

The said steps of the method are preferably carried out in different entities. Detecting the entry identifier 6, encrypting the data 7 to the encrypted entry data 8 and forming the hash value h1 is preferably performed in a station at the entrance 3 ("entry station"). Detecting the exit identifier 15 and forming the hash value h2 is preferably performed in a station at exit 4 ("exit station"). Determining the encrypted entry data 8 suitable for an exit identifier 15 by means of a trial or by using the hash values h1 = h2, decrypting the entry data 8 and evaluating the data 7, eg validating against the specification DAT / GID or the exit identifier 15, becomes preferably in a separate from both the entry station 3 and the exit station 4 evaluation station 20 ( Fig. 2 ) carried out.

TS

Timestamp_Start

TEC

Timestamp_End_Calculated

LPS

Einfahrtskennung 6

LPE

Ausfahrtskennung 15

m1

Daten 7 (unverschlüsselt)

m2

Ausfahrtsdaten 15 (unverschlüsselt)

c1

Einfahrtsdaten 8 (verschlüsselt)

E

Verschlüsselungsfunktion

D

Entschlüsselungsfunktion

H

Hashfunktion

h1

Hashwert von 6

h2

Hashwert von 15

21

Temporärer Prozeßspeicher

22

Archivspeicher für Beweisdaten

Fig. 2 shows a practical embodiment of the method with reference to a flow chart using the following abbreviations:

TS

Timestamp_Start

TEC

Timestamp_End_Calculated

LPS

Entry detection 6

LPE

Exit detection 15

m1

Data 7 (unencrypted)

m2

Exit data 15 (unencrypted)

c1

Entry data 8 (encrypted)

e

encryption function

D

decryption function

H

hash function

h1

Hash value of 6

h2

Hash value of 15

21

Temporary process memory

22

Archive storage for evidence data

The invention is not limited to the illustrated embodiments, but includes all variants and modifications that fall within the scope of the appended claims.

Claims (13)

1. Method for detecting passages of vehicles (1) with unique identifiers (5) from an entry (3) to an exit (4), with the steps:

   detecting the identifier (5) of a vehicle (1) at the entry (3) as an entry identifier (6),

   encrypting predefined and/or vehicle identifier-related data (7) to encrypted entry data (8) by means of the entry identifier (6), providing the encrypted entry data (8) and destroying the entry identifier (6);

   detecting the identifier (5) of a vehicle (1) at the exit (4) as an exit identifier (15),

   determining the provided encrypted entry data (8) and decrypting the encrypted entry data (8) by means of the exit identifier (15) in order to obtain the said data (7); and

   validating the said data (7) in relation to their given setting (DAT, GID) and/or the exit identifier (15), wherein a successful validation indicates the passage of the vehicle (1)

   characterised in that the entry data (8) are provided with the entry time (TS) of the vehicle (1) and are deleted from the volume of provided entry data (8) as soon as the current time exceeds a time window (ΔT), which starts with the entry time (TS) and which is equal to the quotient of the length (L) of the section covered (2) between the entry and the exit (3, 4) and the permissible maximum speed (v_max) on this section (2).
2. Method according to claim 1, characterised in that a detected exit identifier (15) is discarded when no entry data (8) that can be decrypted with this can be determined for this in the volume of provided entry data (8).
3. Method according to claim 1 or 2 using predefined data, characterised in that these data (7) comprise an identifier (GID) of the entry (3).
4. Method according to one of claims 1 to 3 using vehicle identifier-related data, characterised in that these data (7) comprise the entry identifier (6).
5. Method according to one of claims 1 to 4 using vehicle identifier-related data, characterised in that these data (7) comprise an entry image (PIC) of the vehicle (1), from which the entry identifier (6) can be derived.
6. Method according to claim 5, characterised in that the entry image (PIC) obtained during decryption from entry data (8) is archived together with an exit image and the identifier (5) of the vehicle (1) for evidence purposes (22).
7. Method according to one of claims 1 to 6, characterised in that the encrypted entry data (8) are provided under a hash value (h1) calculated from the entry identifier (6) and a hash value (h2), on the basis of which the encrypted entry data (8) provided under this hash value (h2, h1) are determined, is calculated from the exit identifier (15) in the same way.
8. Method according to claim 7, characterised in that the respective entry and/or exit time (TS, TE) of the vehicle (1) is also recorded to each hash value (h1, h2) and the encrypted entry data (8) are only decrypted when the exit time (TE) belonging to the hash value (h1, h2) lies within a time window (ΔT) starting with the associated entry time (TS).
9. Method according to claim 8, characterised in that the speed of a vehicle (1) is determined from the entry and exit time (TS, TE) thereof and the distance covered between the entry and exit (3, 4).
10. Method according to one of claims 1 to 9, characterised in that the identifier (5) is the vehicle registration number (LPN) and is detected by optical character recognition in entry (PIC) and exit images of the vehicle (1).
11. Method according to one of claims 1 to 10, characterised in that the said encryption and provision of the entry data (8) occurs in an entry station (3), the said detection of the exit identifier (15) occurs in an exit station (4) and the said decryption of the entry data (8) and validation of the decrypted data (7) occurs in a separate evaluation station (20).
12. Method according to one of claims 1 to 11, characterised in that during encryption of the entry data (8) the entry identifier (6) used as key (9) is supplemented by further keys (TS, 11, 13), which are provided separately for the decryption.
13. Method according to claim 12, characterised in that the further keys comprise a time stamp (TS), a temporary key (11), an identifier of the entry station (3) or a public key (13) of the exit station (4).

Images