EP2431947A1 - Method for securing electronic systems of tachographs - Google Patents

Abstract

The method involves recording a unique identifier (11) of a citizen device (7) e.g. electronic passport, in a non-volatile memory of a conducting device (2), and recording another unique identifier (5) of the conducting device in a non-volatile memory of the citizen device for commissioning the conducting device. The recorded identifiers are encoded using the ALGO cryptographic algorithms and a cryptographic key.

Description

The invention relates to a system for securing electronic tachograph systems.

In particular, the invention relates to a close numerical association between an electronic tachograph device and a state electronic document.

The tachograph, more generally called a tachograph, is an electronic recording device of speed, driving time and activities (work, expectations ...) installed in a road transport vehicle.

In its digital version using paper discs, the instantaneous speed of the vehicle is recorded next to the current time. Easy to read, it allows drivers and operators to know the speed, the downtime (regulatory breaks), driving times and all working time or availability, the total will give time to service. It makes it possible to ensure that the daily and weekly rest periods prescribed by law are respected and that maximum driving times are respected.

The first tachographs were used even before 1900. As for example the Flaman, they highlighted the regularity of the driving and the respect of the signaling more than the driving time.

The tachograph (commonly called "snitch") applied to trucks has existed since the early 1920s. The recording is done on paper disks (analog tachograph) or in the chip of the card driver (digital tachograph). The disc (or card) is attached to each driver and it is the personal duty time on the day that needs to be controlled. It is obligatory in France, on all the vehicles of transport of goods (of more than 3,5 t) and travelers since 1969.

Today the control is not only about the current week but about the 28 days before; driving, work, daily and weekly rest periods will be checked.

the installation of a digital tachograph is mandatory on new vehicles and as a replacement for an analogue tachograph broken down by a digital Vehicle Unit Unit (VUU) on vehicles carrying more than 8 seats and on freight vehicles of more than 3.5 tonnes.

By imposing this system and a European regulation, the European Union wants to improve and facilitate the control of driving and rest times, and thus combat one of the major causes of road accidents at the level of trucks. Thus, the regulation imposes a control of these devices every 2 years by companies having received a license of the state.

The system is based on a recording device sealed and installed by authorized and sworn personnel. It must include a permanent and tamper-proof storage system and a printer. Data transfers are by interoperable smart cards between system manufacturers and countries.

The electronic tachograph is a housing, the size of a car radio, including two readers of cards, a manual input selector, a display screen, and a printer.

• identification du véhicule ;
• données de calibration ;
• identité du conducteur;
• date et heure d'insertion et d'extraction de la carte conducteur ;
• rapport d'activité ;
• statut de conduite ;
• activité du conducteur;
• alarmes et alertes ;
• localisation de début et de fin de journée
• distance parcourue ;
• pannes et anomalies ;
• identité des agents/corps de contrôle, dates de contrôle(s) ;
• identité de l'atelier, date de calibration ;

Securely connected to the motion sensor, the electronic tachograph records the data relating to the use of the vehicle for one year. Especially:

• vehicle identification;
• calibration data;
• identity of the driver;
• date and time of insertion and extraction of the driver card;
• Activity Report ;
• driving status;
• driver activity;
• alarms and alerts;
• location of beginning and end of the day
• distance traveled ;
• failures and anomalies;
• identity of the agents / control body, dates of control (s);
• workshop identity, date of calibration;

The electronic tachograph also allows the printing of activity data in a synthetic way.

Several smart cards record the data, including the driver card. White, it records all the activities of the driver for at least 28 days. Personal, it is issued by the State where the driver has his normal residence. This card is used every day of activity on any vehicle equipped with an electronic tachograph. Its period of validity is set at 5 years. Thanks to the interoperability of the system, the driver card is readable by any approved electronic tachograph.

In a nominal operating mode, a driver card is associated with a single driver, and likewise, a driver has only one driver card.

However, unscrupulous users try to hijack the system, mainly in two ways:

In order to exceed the legal limitations of driving, especially in terms of duration, some users declare their stolen driver card, and request its renewal. They are thus in possession of at least two driver cards. It thus becomes possible, once the legal limits have been reached, to change the driver card, and thus to start a new registration. Similarly, following a series of infractions, for example speed, it is possible for such users to change the card, so that, in case of control, these data are not present on the card controlled.

Similarly, some users are tempted to share a driver card, and thus drive an unauthorized person.

One solution is a centralized database of driver cards, as well as identities of the people to whom they were issued.

However, the implementation of this solution is very difficult in a multi-state territory such as Europe, where each country can issue official documents in different formats, and whose laws and techniques in terms of databases data, are very disparate.

The present invention proposes a solution linking a standardized electronic official document, for example the driving license, and the driver card, by a strong cryptographic mechanism.

• enregistrement, dans une mémoire non volatile du dispositif conducteur, de l'identifiant unique du dispositif citoyen
• enregistrement, dans une mémoire non volatile du dispositif citoyen, de l'identifiant unique du dispositif conducteur

To do this, the invention describes a method for securing the tachograph system, comprising at least a first electronic mobile device said conductive device, and a second electronic mobile device said citizen device, each comprising, in a non-volatile memory, an identifier single, and an electronic terminal said tachograph, said conductive device being configured to receive and store information from said tachograph. The putting into service of this conductive device also comprises the steps of:

• recording, in a nonvolatile memory of the conductive device, the unique identifier of the citizen device
• recording, in a nonvolatile memory of the citizen device, the unique identifier of the conductive device

The registered identifiers can be encrypted using an ALGO cryptographic algorithm, and a cryptographic key K to give encrypted identifiers. Thus, there can be at least a third electronic device, called a control device, able to communicate with the first and second devices, and having the cryptographic means to verify that the encrypted identifier registered in the first electronic device is identical to the identifier of the second electronic device, and that the encrypted identifier recorded in the second electronic device is identical to the identifier of the first electronic device.

According to one embodiment, the first electronic device can be a smart card.

According to one embodiment, the second electronic device may be for example an electronic driver's license, an electronic identity card or an electronic passport.

• La figure 1 représente un tachygraphe, avec dispositif conducteur selon l'invention, ainsi qu'un dispositif citoyen associé.

Other characteristics and advantages of the invention will emerge clearly from the description which is given hereinafter, by way of indication and in no way limitative, with reference to the appended drawing in which:

• The figure 1 represents a tachograph, with a conductive device according to the invention, as well as an associated citizen device.

According to the invention, the conductive device is an electronic device having at least one non-volatile internal memory capable of receiving and recording information from the electronic tachograph, as well as recording at least one secure information. This technical constraint, associated with the general context of use of such a device imposes high general security conditions. Thus, such a device according to the invention may advantageously be a smart card, or a secure USB key.

The safety constraints associated with this driver device must make it possible to record the information from the tachograph under conditions ensuring that no unauthorized users can edit them. Consultation is generally allowed.

In the implementation mode shown in the figure 1 , a tachograph 1 receives a conductive device 2, here illustrated by a smart card.

• une zone 3 de mémoire non volatile, contenant au moins un identifiant unique 5, lié audit dispositif conducteur 2
• une zone mémoire 4 contenant une donnée sécurisée 6, dont l'accès est strictement protégé. Cette protection se fait avantageusement par un chiffrement. Ce chiffrement sera développé plus loin dans la présente description.

According to the invention, this conductive device has at least two memory zones:

• a zone 3 of non-volatile memory, containing at least one unique identifier 5, linked to said conductive device 2
• a memory zone 4 containing secure data 6, whose access is strictly protected. This protection is advantageously by encryption. This encryption will be developed later in the present description.

• une zone 9 de mémoire non volatile, contenant au moins un identifiant unique 11, lié audit dispositif citoyen 7
• une zone mémoire 10 contenant une donnée sécurisée 12, dont l'accès est strictement protégé.

To this conductive device is associated a citizen device 7, here illustrated by an electronic passport. Advantageously, this device is a driving license equipped with an electronic component 8. This device has at least two memory zones:

• a zone 9 of non-volatile memory, containing at least one unique identifier 11, linked to said citizen device 7
• a memory zone 10 containing secure data 12, whose access is strictly protected.

The creation of the conducting device 2 must be done with a state administration having specific authorizations. In France, such places can be for example gendarmeries, prefectures, ...

These administrations have in their possession the computer means for reading the data of said conductive device, as well as said citizen device, but above all they have the possibility of recording information in these same devices.

Indeed during the creation of the device 2, the driver has device that is intended to provide a citizen device 7.

The agent in charge of the operation connects these two devices on a terminal, and through it, he thus accesses the unique identifiers 5 and 11, respectively stored in the memory areas 3 and 9.

In possession of this information, the agent will be able to pair these two devices.

The pairing can take several forms according to the invention.

In a first embodiment, this pairing can be done by the registration of the identifier 5 of the conductive device in the secure data 12 of the citizen device 7, and conversely, the registration of the identifier 11 of the citizen device. 7 in the secure data 6 of the driver device 2.

Another pairing mode consists of the registration of the two identifiers 5 and 11 in each of the secure data 6 and 12.

In order to optimize the security of the system, the method according to the invention advantageously comprises an encryption of the secure data, for example through a cryptographic algorithm and a key.

This encryption can be done with the help of any means of encryption known to those skilled in the art, in particular by the use of a symmetrical or asymmetric algorithm.

Symmetric cryptography, or secret key cryptography, is based on shared knowledge of a secret between two actors.

The algorithms used, such as for example the DES, 3DES, AES, ... are based on the fact that it is almost impossible, knowing the cipher of a message, to find the clear message without knowing the key used to encryption.

Asymmetric cryptography, or public-key cryptography, is based on the existence of one-way functions.

Thus, public key cryptography is an asymmetric method using a pair of keys. These keys, generally called "public key" and "private key", are constructed in such a way that what is encrypted with the help of one of these keys can only be deciphered by the second.

It can be noted that it is impossible to guess the private key from the public key.

The generation of public key / private key pairs is not the subject of the present invention. All the methods described by the state of the art, or in the future, which make it possible to obtain such a key pair apply to the present invention.

"Group Encryption" keys, which allow to associate to a public key, several keys private, each for decrypting all or part of what has been encrypted with the public key, apply perfectly to the present invention.

In a secure mode of implementation of the invention, the reading of secure data requires the application of cryptographic keys that can be embedded in a device called control device. Such a device is, for example, in the possession of the police, authorized to control the validity of the conductive devices.

Thus, during a control, the conductive device is connected to a terminal, the control device also. The control device comprises means for storing at least one cryptographic key securely.

The terminal reads the secure data in the conductive device, and decrypts it. This decryption can be done in the terminal, by means of the key contained in the control device, or in the control device itself.

This step makes it possible to obtain at least one piece of information on the citizen device to which the conducting device is associated.

The agent must then read the identifier of the citizen device, and check the concordance with the information from the driver device.

In the case where the secure data also contains the identifier of the conductive device, the verification will extend to this datum.

Preferably, the verification further comprises reading the secure data present in the citizen device, its decryption, and a verification of the data obtained, in a manner comparable to that described above.

Claims (7)

A method of securing the tachograph system, comprising at least a first electronic mobile device said conductive device, and a second electronic mobile device said citizen device, each comprising, in a non-volatile memory, a unique identifier, and an electronic terminal said tachograph, said conductive device being configured to receive and store information from said tachograph,
characterized in that
the putting into service of said conductive device further comprises the steps of: recording, in a non-volatile memory of said conductive device, the unique identifier of said citizen device recording, in a non-volatile memory of said citizen device, the unique identifier of said conductive device. A method of securing the tachograph system according to claim 1, characterized in that said registered identifiers are encrypted using an ALGO cryptographic algorithm, and a cryptographic key K to give encrypted identifiers. method of securing the tachograph system according to claim 2, characterized in that there is at least a third electronic device, said control device, able to communicate with the first and second devices, and having the means cryptographic means for verifying that said encrypted identifier stored in said first electronic device is identical to said identifier of said second electronic device, and that said encrypted identifier registered in said second electronic device is identical to said identifier of said first electronic device. A method of securing the tachograph system according to any one of the preceding claims, characterized in that said first electronic device is a smart card. A method of securing the tachograph system according to any one of the preceding claims, characterized in that said second electronic device is an electronic driving license. A method of securing the tachograph system according to any one of the preceding claims, characterized in that said second electronic device is an electronic identity card. A method of securing the tachograph system according to any one of the preceding claims, characterized in that said second electronic device is an electronic passport.

Images