EP2490183B1 - Vehicle device, ad-hoc network and method for a road toll system - Google Patents

Description

The present invention relates to a vehicle device for a road toll system, also called "onboard unit" or OBU, with a satellite navigation receiver for the continuous generation of location data for a processing and transceiver unit of the vehicle unit and a separate trusted element processor for logging a time portion of generated location data and the cryptographic signing of the same. The invention further relates to an ad-hoc network of at least two such vehicle devices and to a method for logging location data of a location-recording vehicle device of a road toll system with a plurality of vehicle devices that can wirelessly exchange location data.

From the EP 2 017 790 A2 It is known to use a trusted element to sign the location records posted by an OBU to a map matching proxy. The trusted element also serves to encrypt the interface between the OBU and the map matching proxy.

In order to monitor and control the functioning of interoperable road toll systems, such as the new European Electronic Toll Service (EETS), "secure monitoring" concepts are used, based on logging and real-time freezing of the location records of the vehicle's equipment Road toll system based. For signing, trusted element processors are used which contain a trusted element certificate of the inspector, eg a street owner, an authority, etc. ("certificate issuer") and therefore enjoy their trust. Details of the Secure Monitoring or Secure Freezing concept can be found in the publications "Security aspects of the 1.11 EETS", Expert Group 12, Final report V1.0, 5 April 2007; "Electronic fee collection - Application interface definition for autonomous systems - Part 1: Changing", ISO Technical Specification 17575-1, 15 June 2010; and "An Example of a View on EETS Trust and Privacy on GNSS based toll systems", Vis J, Report Ministry of Transport, Public Works and Water Management of The Netherlands, 15 December 2009.

In the known systems, all location data accumulating in the vehicle device are logged and continuously signed in sections ("freezed"); Subsequently, the signed periods are read out for control purposes with an external control device. This means a high volume of data and requires on the one hand a correspondingly large storage space for the storage of the signed data and on the other hand separate control devices for their reading.

The invention aims to overcome the disadvantages of the prior art and to provide an improved secure monitoring solution for interoperable road toll systems. This object is achieved in a first aspect of the invention with a vehicle device of the aforementioned type, which is characterized in that the trusted element processor is adapted to start said logging upon detection of a predetermined time or a predetermined location of the vehicle device and to perform for a given period of time.

In this way, the vehicle device itself is used for its own monitoring: The programmed in the above manner Trusted-element processor acts similar to a computer virus that collects at a given time or at a predetermined location for a limited time location data in the vehicle unit and for control purposes. The said functionality of the trusted element processor "sleeps" until its use and then performs a single section logging. There is no need to continuously log, sign and store ("freeze") all location data, and there is no need for a separate control device to initiate the monitoring process.

It will be understood that the predetermined location which is detected need not necessarily be punctiform, but may be extended, eg, a district, a particular street, etc. According to a first variant of the invention, the trusted element processor detects the predetermined location in his own location data of his vehicle unit, which keeps the effort low.

A particularly advantageous embodiment of the invention is characterized in that the trusted element processor detects the predetermined location in foreign location data, which it receives via a wireless network from adjacent vehicle devices. This represents a qualitative leap in the safety of monitoring: The location data of other vehicle devices are independent of any manipulation or malfunction of the controlled vehicle device; the use of foreign location data as a triggering criterion for the secure freezing of one's own location data thus enables a highly secure control of the functionality of a vehicle device for the inspector or certificate issuer. The aforementioned adjacent vehicle devices do not necessarily need to be carried by vehicles; they can also be stationary with infrastructure support.

The wireless network is preferably an ad hoc network, in particular a vehicular ad hoc network (VANET), particularly preferably according to the WAVE (wireless access in a vehicle environment) or WLAN (wireless local area network) standard. Such networks may be spontaneously formed between a group of adjacent vehicle devices located in mutual transmit range.

It is particularly favorable if the trusted element processor receives the foreign location data of several neighboring vehicle devices and compares them with one another in order to detect the predetermined location in the matched foreign location data.

In order to meet confidentiality requirements, the trusted element processor according to a further preferred feature, the foreign location data of the adjacent vehicle devices query anonymously, for example, under a randomly selected (anonymous) network Senderend, a - without additional information not assignable - MAC address in ad hoc network, etc.

To increase the security of control, the trusted element processor can query the foreign location data by exchanging a key with temporally and / or locally limited validity and only take into account those foreign location data which are received under a valid key. As a result, the topicality of the location data used as the triggering criterion and / or its neighborhood area can be verified; in a highly mobile environment such as a VANET, the accuracy of the location of the recorded vehicle device can thus be increased.

In a further variant of the invention, the trusted element processor can send the signed time section by means of the transceiver unit of the vehicle device to a center of the road toll system. Alternatively, the trusted element processor can provide the signed period of time via an interface of the vehicle device for querying.

In a second aspect, the invention also provides an ad hoc network comprising at least two vehicle devices of the type in which data of adjacent vehicle devices are used as the triggering criterion for secure freezing, according to the features of claim 10.

• Empfangen von Ortsdaten eines zweiten Fahrzeuggeräts,
• Detektieren eines vorgegebenen Orts in den empfangenen Ortsdaten des zweiten Fahrzeuggeräts,
• Starten der Protokollierung eines Zeitabschnitts der Ortsdaten des ersten Fahrzeuggeräts, und
• Signieren des protokollierten Zeitabschnitts mit einer kryptographischen Signatur.

In a third aspect, the invention provides a method for logging location data of a location-recording vehicle device of a road toll system with a plurality of vehicle devices, which can wirelessly exchange location data, comprising, in a first vehicle device:

• Receiving location data of a second vehicle device,
• Detecting a predetermined location in the received location data of the second vehicle device,
• Starting the logging of a time section of the location data of the first vehicle device, and
• Sign the logged period with a cryptographic signature.

The detection, logging and signing preferably take place in a trusted element processor of the first vehicle device.

• Detektieren einer vorgegebenen Zeit,
• Starten der Protokollierung eines Zeitabschnitts der Ortsdaten des ersten Fahrzeuggeräts und Empfangen von Ortsdaten eines zweiten Fahrzeuggeräts, und
• Signieren des protokollierten Zeitabschnitts und der empfangenen Ortsdaten mit einer kryptographischen Signatur.

If the logging of the own location data is timed triggered, the location data of the other vehicle devices can be used as additional validation data by being "co-frozen" during secure freezing of the own location data. Accordingly, in an alternative embodiment, the invention also provides a method for logging location data of a location-recording vehicle device of a road toll system with a plurality of vehicle devices that can wirelessly exchange location data, comprising, in a first vehicle device:

• Detecting a given time,
• Starting the logging of a time section of the location data of the first vehicle device and receiving location data of a second vehicle device, and
• Signing the logged time period and the received location data with a cryptographic signature.

With regard to the advantages of the ad hoc network and the method of the invention, reference is made to the above explanations of the vehicle device according to the invention.

• Fig. 1 ein Straßenmautsystem mit Fahrzeuggeräten in einem erfindungsgemäßen ad-hoc-Netzwerk unter Verwendung des Verfahrens der Erfindung in Blockschaltbildform; und
• Fig. 2 eines der Fahrzeuggeräte von Fig. 1 in Blockschaltbildform im Detail.

The invention will be explained in more detail with reference to an embodiment shown in the accompanying drawings. In the drawings shows

• Fig. 1 a road toll system with vehicular devices in an ad hoc network according to the invention using the method of the invention in block diagram form; and
• Fig. 2 one of the vehicle devices of Fig. 1 in block diagram form in detail.

Fig. 1 shows an interoperable road toll system 1, which consists of a plurality of onboard units (OBUs, O ₁ - O ₆ ) 2, a plurality of different toll operator centers (Toll Charger, TC ₁ , TC ₂ ) 3 and a plurality of different clearing centers (Certificate Issuer , CI ₁ - CI ₃ ) 4. The vehicle devices 2 determine by means of satellite navigation receivers 5 (FIG. Fig. 2 ) continuously their location p in a global navigation satellite system (global navigation satellite system, GNSS) 6 and generate from this a continuous stream (track) of location data (position fixes) p _i .

With the aid of a processing and transceiver unit 7, 8 (FIG. Fig. 2 Each vehicle device 2 sends its location data p _i either in "raw form" or - preferably - processed to toll data m via an operator center 3 to a billing center 4. The processing section 7 of the unit 7, 8, for example, a microprocessor, and the transceiver unit 8 of Unit 7, 8 is a DSRC (dedicated short range communication), WAVE, WLAN or preferably PLMN (public land mobile network) transceiver.

The toll data m are preferably accumulated and location-anonymized toll transaction records, which indicate, for example, a number of kilometers driven, a traveled route segment of a road network, the residence time in a toll area (eg city toll), etc. To generate the toll data m from the location data p _i , the latter can for example be compared with pre-stored toll cards ("map matching"). For this purpose, the vehicle devices 2, for example, an external map matching server (map matching proxy) use 9, are outsourced to the map matching tasks under anonymized task identifiers to the confidentiality of the location data p _i to the operator and billing centers 3, 4 as known to those skilled in the art. The toll data m can also be sent by the proxy 9 directly to the operator or clearing centers 3, 4.

For monitoring and control of the functions of the vehicle devices 2 and also operator centers 3 is in accordance with Fig. 2 Each vehicle device 2 is equipped with a trusted element processor 10, which contains a cryptographic signature (tk). The signature tk is issued, for example, by a contract issuer CI, owner of one of the billing centers 4, and is trustworthy for it. In the present description, a "trusted element processor" 10 is a cryptographic device equipped with a cryptographic signature - Preferably at hardware level - access secured processor element understood. Processor elements of this type meet high security requirements, such as those on the SIM cards, credit cards, bank cards, etc. integrated single-chip processors are provided.

The trusted element processor 10 receives the stream of location data p _i from the satellite navigation receiver 5 of the vehicle device 2 directly or via the processing part 7 and is designed or programmed for specific requirements or triggering over a given time period s , eg one, five or ten minutes, to record the location data p _i . The recorded time period s (p _i ) is then signed by the trusted element processor 10 with its cryptographic signature tk and thus "frozen".

When signing or immediately before, a data reduction at the time period s can be made, for example by forming a hash value of the same. A hash value is understood in the following description to mean the application of a virtually irreversible n: 1 mapping function to an input data set, i. a function that is only (extremely) ambiguous reversible, so that from the knowledge of the hash value practically no longer can be concluded on the input data set. Examples of such hashing functions are the checksum function, the modulo function, etc.

The signed, logged period of time, here denoted by s * (p _i , tk), is then sent via the transceiver unit 8 of the vehicle unit 2 to an operator center 3 and from this to a clearing center 4. The clearing center 4 can use the signature tk of the signed time period s * to deduce its authentic origin from a trusted element processor 10 of its confidence. Alternatively or additionally, the signed logged time period s * can be provided on an interface 11 of the vehicle device 2 for polling.

The starting of the time segment s of the logging of the location data p _i in the trusted element processor 10 can be triggered in various ways. A first embodiment consists in that the vehicle device 2 contains a timer 12, in the manner of a "watchdog", which triggers said logging at a predefined time T, ie "wakes" the trusted element processor 10 to said functionality, if the current time is t = T.

A second start criterion is that the trusted element processor 10 detects the occurrence of a predetermined location P in the location data p _i . The predetermined location P may be a punctual location, eg a "virtual toll station", or an extended location such as a parking lot, a city center, a freeway section, etc. Once the trusted element processor 10 locates the location P in FIG the location data p _i detected, ie determines that a position p in the location data p _i in the limits or in the vicinity of the predetermined location P arrives, the logging starts over the specified time period, for example over ten minutes. After completion of the logging, the signed logged time period s * of the location data p _{i is present} for transmission and interrogation.

Another, particularly security bidding start criterion is that the trusted element processor 10 detects the occurrence of the predetermined location P not in the own location data p _{i of} the own vehicle unit 2, but in "foreign" location data p _i ', which it from other ("foreign") adjacent vehicle devices 2 are communicated. This will now be explained in detail.

As in the Fig. 1 and 2 As shown, a group of vehicular devices 2 of the road toll system 1 may form a wireless network 13 by communicating with each other via wireless links 14. For example, the wireless connections 14 may be based on the WAVE or WLAN standard, and the wireless network 13 is preferably an ad hoc network or VANET. For this purpose, each vehicle device 2 has a suitable wireless transceiver 15. Optionally, the wireless transceiver 15 and the transceiver unit 8 of the vehicle device 2 may be identical.

Within the wireless network 13, vehicle devices 2 can inform each other about their respective current location p or z. B. continuously exchange their location data p _i . An example of this is the exchange of VTS messages (Vehicle Service Table Messages) in the context of a VANET, in which the individual network nodes (vehicle devices 2) mutually inform each other about their communication capabilities and the services offered by them and set up their own Tell places p or their location data p _i recent.

Alternatively, a trusted element processor 10 of a vehicle device 2 can also interrogate at any time positions p or location data p _i 'of adjacent vehicle devices 2. The location data p _i 'of a plurality of adjacent vehicle devices 2 received in a vehicle device 2 can also be matched with one another, eg, for consistency, in order to hide outlier measurement values or to average the received location data p _i '.

When querying or receiving the foreign location data p _i 'of the adjacent vehicle devices 2, interrogation or transmission keys with temporally and / or locally limited validity can be used so that only those foreign location data p _i ', which are received within a predetermined time range or come from a given location area around the vehicle unit 2, take into account.

The trusted element processor 10 is now configured or programmed to detect the occurrence of the predetermined location P in the foreign location data p _i 'of the adjacent vehicle devices 2 and this as a triggering criterion for starting the logging of the location records p _{i of} its own Vehicle unit 2 used. As a result, any manipulations, corruption options or disturbances of the own location data p _i remain triggering the recording of the location data portion s and s * disregarded, which facilitates the uncovering a failure: If the in frozen time segment s * location records contained p _i does not (approximately) to that predetermined location P match, the p in the other location data _i ' has been detected, there is a manipulation or malfunction of the vehicle device 2.

It is also possible to combine the aforementioned embodiments, Thus, the timer may cause 12 the Trusted Element processor 10 to a given time t the location data p _i 'of adjacent board units 2 interrogate and they, together with the period s of the own location data p _i to record and sign, ie s * (p _i , tk, p _i '), so that a consideration of the neighboring locations p _i ' in the review of their own location records p _i can take place.

The neighboring vehicle devices 2, whose location data p _i 'are used, may under certain circumstances also be stationary, eg not carried by a vehicle, but stationed in a stationary infrastructure. In this case, they do not need to continually redefine their location data p _i ', but may determine it once or contain it stored in a predetermined manner. Such "infrastructure-bound" vehicle devices 2 also fall under the term of the adjacent vehicle devices 2 used here.

The predetermined time T, the predetermined location P and / or the length of the time segment can be stored in the manufacture of the vehicle device 2 or the trusted element processor 10 in this or this later or via the interface 11, the transceiver unit 8 or the transceiver 15 are entered.

The invention is therefore not limited to the illustrated embodiments, but includes all variants and modifications that fall within the scope of the appended claims.

Claims (12)

1. A vehicle device for a road toll system (1), with a satellite navigation receiver (5) for continuously generating location data (p_i) for a processing and transmitting/receiving unit (7, 8) of the vehicle device (2) and a separate trusted-element processor (10) for logging (s) a time segment of the continuously generated location data (p_i) and for cryptographically signing (s*) said time segment, characterized by the fact that the trusted-element processor (10) is configured to start said logging (s) upon detection of a predefined time (T) or a predefined location (P) of the vehicle device (2) by recording the location data (p_i) continuously generated for the processing and transmitting/receiving unit (7, 8) of the vehicle device (2), to carry out this logging for a predefined time segment and, subsequently, to cryptographically sign the recorded time segment of the continuously generated location data (p_i).
2. The vehicle device according to Claim 1, characterized by the fact that the trusted-element processor (10) detects the predefined location (P) in its own generated location data (p_i).
3. The vehicle device according to Claim 1, characterized by the fact that the trusted-element processor (10) detects the predefined location (P) in external location data (p_i') that it receives from proximate vehicle devices (2) via a wireless network (13).
4. The vehicle device according to Claim 3, characterized by the fact that the wireless network (13) consists of an ad hoc network that preferably operates in accordance with the WAVE or WLAN standard.
5. The vehicle device according to Claim 3 or 4, characterized by the fact that the trusted-element processor (10) receives and matches the external location data (p_i) of several proximate vehicle devices (2) in order to detect the predefined location (P) in the matched external location data (p_i').
6. The vehicle device according to one of Claims 3 to 5, characterized by the fact that the trusted-element processor (10) anonymously retrieves the external location data (p_i').
7. The vehicle device according to one of Claims 3 to 6, characterized by the fact that the trusted-element processor (10) retrieves the external location data (p_i') by exchanging a key having temporally and/or locally limited validity and takes into consideration only external location data (p_i') that is received under a valid key.
8. The vehicle device according to one of Claims 1 to 7, characterized by the fact that the trusted-element processor (10) sends the signed time segment (s*) to a control center of the road toll system (1) by means of the transmitting/receiving unit (8) of the vehicle device (2).
9. The vehicle device according to one of Claims 1 to 7, characterized by the fact that the trusted-element processor (10) makes the signed time segment (s*) available for retrieval via an interface (11) of the vehicle device (2).
10. An ad hoc network of at least two vehicle devices according to one of Claims 3 to 9 that are connected to one another via their transmitting/receiving units (8), wherein at least one vehicle device (2) makes available location data (p_i) to another vehicle device (2) that detects a predefined location (P) therein in order to start the logging (s) of its own location data (p_i).
11. A method for logging location data (p_i) of a location-recording vehicle device (2) of a road toll system (1) with several vehicle devices (2) that can exchange location data (p_i) in a wireless fashion, wherein said method comprises the following steps in a first vehicle device (2):

    receiving location data (p_i') of a second vehicle device (2),

    detecting a predefined location (P) in the received location data (p_i') of the second vehicle device (2),

    starting the logging (s) of a time segment of the location data (p_i) of the first vehicle device (2) by recording the location data (p_i) continuously generated for a processing and transmitting/receiving unit (7, 8) of the first vehicle device (2) with a satellite navigation receiver (5) of the first vehicle device (2), and

    signing (s*) the logged time segment of the continuously generated location data (p_i) with a cryptographic signature.
12. A method for logging location data (p_i) of a location-recording vehicle device (2) of a road toll system (1) with several vehicle devices (2) that can exchange location data (p_i) in a wireless fashion, wherein said method comprises the following steps in a first vehicle device (2):

    detecting a predefined time (T),

    starting the logging (s) of a time segment of the location data (p_i) of the first vehicle device (2) by recording the location data (p_i) continuously generated for a processing and transmitting/receiving unit (7, 8) of the first vehicle device (2) with a satellite navigation receiver (5) of the first vehicle device (2) and receiving location data (p_i') of a second vehicle device (2), and

    signing (s*) the logged time segment of the continuously generated location data (p_i) and the received location data (p_i') with a cryptographic signature.

Images