EP2872373A2

EP2872373A2 - Implementing an operation in a signalling system

Info

Publication number: EP2872373A2
Application number: EP13762760.0A
Authority: EP
Inventors: Frank RENPENNING
Original assignee: Siemens AG
Current assignee: Siemens Mobility GmbH
Priority date: 2012-09-10
Filing date: 2013-09-04
Publication date: 2015-05-20
Also published as: CN104619572A; HK1207609A1; WO2014037364A2; DE102012215959A1; WO2014037364A3

Abstract

The invention relates to an (auxiliary) operation of an operating unit which is directed to a signalling system. Information is generated by the signalling system, the information comprising a CAPTCHA, which information is transmitted to the operating unit. There, an operator enters the character string, in particular a transaction authentication number, portrayed in the CAPTCHA, which is transmitted to the signalling system for confirmation. If the input is correct, the operation is implemented. The advantage here is that it is possible to ensure that such an input does not originate from a machine but only from the operator. Automated undesirable operations can thus be effectively and reliably prevented.

Description

description

Performing an operation in a signaling system The invention relates to a method for performing an operation in a signal system of a railway system, and corresponding devices (operating unit and Signalsys ^¬ TEM). A so-called CAPTCHA method is known (see eg http://de.wikipedia.org/wiki/Captcha). CAPTCHA is an Ak ^¬ ronym for "Completely Automated Public Turing test to participate Computers and Humans Apart", which means in German:

"Fully automatic public Turing test to differentiate between computers and people". CAPTCHAs are used to decide whether the counterpart is a human or a machine. Usually this is done to Che ^¬ fen whether entries have been made in Internet forms on humans or machines (robots, bots short) because robots can be misused here.

Also known is the use of transaction numbers (http://en.wikipedia.org/wiki/Transaction_Number). A transaction number (TAN) is a one-time password, e.g. consists of decimal digits and is used for example in online banking.

The coupling of a control unit to a safe signal system ^¬ (eg a signal box, a control center for Zug- influencing systems such as a radio block center, a

Vehicle equipment of train control systems, etc.) serves in certain cases to bypass the security function of the signaling system under the responsibility of the operator (eg Dispatcher). This method is referred to, inter alia, as an auxiliary operation or as a command-release method (KF method). Here are two Prob ^¬ lems to be solved: First, there is the problem that no auxiliary operation may be initiated that is not intended by the operator. This problem can be put zer ^¬ into two parts:

- This can lead to unintended auxiliary operations

caused by faults or failures of the operator station system or the transmission system. This includes all types of "unwanted auxiliary operation", e.g. unintentional triggering, falsification or loss or undesired repetition of operations.

- Inadvertent auxiliary operations may also occur due to automation of auxiliary operator actions; For example, macros or automated processes in the operator station system can trigger such unwanted auxiliary operations.

On the other hand, there is a problem in that the operator is to be supported while performing an auxiliary operation such that the likelihood of false operations ^¬ voltage is reduced.

In this context, it is also problematic if operator station system and signal system are provided by different providers and thus there is no mutual control over the other system.

The object of the invention is to provide the reasons stated above drawbacks to be avoided and in particular an effi cient and safe approach for an auxiliary operation from a non-secure workstation system or from a non-secure operating unit as a component of the operating ^¬ station system of. This object is achieved according to the features of the independent claims. Preferred embodiments are insbeson ^¬ particular the dependent claims. The object is achieved by a method for performing ^¬ guide an operator in a signal system of a rail system,

in which an operation is transmitted from an operating unit to the signal system,

- in which to operate a Informati ^¬ on is comprehensively generate a CAPTCHA based,

- in which the information will be wearing to the operating unit over ^¬,

in which an input is made based on the information on the operating unit and this input is transmitted to the signal system,

- wherein the signal system to perform the operation if the input bestä the contents of the CAPTCHA ^¬ Untitled.

In particular, the operation on the side of the signal ^¬ system is executed (eg caused), if the received input corresponds to the contents of the CAPTCHA correctly. In the CAPTCHA, it may in particular be any depicting ^¬ development that is visible and can be converted into a string for the people with this string per ^¬ but is poorly by a machine or not automatically recognized. There are different algorithms that can represent, for example, a character sequence (several characters, including spaces) in such a way that they can preferably only be recognized by one person (ie not by a machine). Accordingly, it is an advantage that can be ^{sicherge ¬} provides that the operation of a human, not from a machine or was authorized. The CAPTCHA represents for example alphanumeric characters, symbols and / or characters of different size and orientation in front of different backgrounds at different positions, for example, partially distorted represents wherein more characters that are not to be detected, also Darge ^¬ be established to impede the automatic detection or impossible to do. Known algorithms for generating such a CAPTCHA can be used for the present approach.

The present approach is based on such a CAPTCHA insofar as an automated input can thus be excluded with a predefinable security, or an input made by an operator can also be recognized as such via a communication interface.

The signaling system is e.g. a unit of a railway system in which an action for setting the railway system or a component of the railway system can take place. The railway system can have several signal systems. It is also possible that the signal system is executed distributed over several units.

The operating unit can be part of an operator station system. This operator station system can be part of a control system that has a secure or unsecured connection to the signaling system. The connection can be designed to be structurally and / or technically secure. For example, in the latter case, a transmission can take place by means of a signature and / or an encryption. The connection may comprise a wireless and / or a wired communication interface. The control unit can be portable or it can be part of a fixed terminal.

A further development is that the operation comprises at least one of the following actions: - a command input, the corruption may bypass the Si ^¬ reliability of the signal system,

an auxiliary diverting of track elements (e.g., switches),

- unlocking of track elements (tracks, switches, intersections) that are locked for driving,

- activate a replacement signal,

- auxiliary dissolution of driveways,

- a basic location of axle counters,

- setting up restrictions for sections of the route (drivability barrier, slow-driving),

- removing restrictions on sections of the route. Another development is that the CAPTCHA is basie ^¬ rend created on a string.

In particular, it is a further development that the Informati on ^¬ includes a transaction number.

It is also a development that the CAPTCHA is created based on a transaction number.

In particular, a transaction number is used only once per period of time (e.g., for a given validity period) or generally only once. This ensures that no repeated entries can be made.

One option is that the CAPTCHA represents the transaction number that the operator must recognize and enter. It is also possible for the transaction number to be represented, for example, as text (for example as ASCII text) and the CAPTCHA comprises the representation of alphanumeric characters. The operator should now enter the characters displayed in the CAPTCHA together with the transaction number, if appropriate in different fields of an input mask provided for this purpose. If the CAPTCHA is on the side of the sig- nalsystems recognized as correct, it is possible to carry out the operatio ^¬ tion.

Furthermore, it is a further development that the information comprises a text.

The text may include alphanumeric characters, symbols and / or special characters. It is also possible that the text comprises only a subset of the possible characters, e.g. no national special characters.

In the context of an additional development, the information comprises an image or a symbol which is associated in particular with the operation or represents it.

Thus, the operator may be given an indication of the operation and / or the CAPTCHA.

A next development is that the signal system performs the operation if the input confirms the contents of the CAPTCHA and if the input is received before expiration ei ^¬ ner time on the signal system.

One embodiment is that the information is transmitted to the operating unit and a timer is started, the timer specifying the time duration which may elapse until the input to the signal system is to be received. An alternative embodiment is that if the input does not correspond to the content of the CAPTCHA, the signal system does not perform the operation, and in particular triggers an error message and / or an alarm

will be .

The statements concerning the method apply correspondingly to the other categories of claim. The above object is also achieved by a device for inputting an operation for a signaling system of a railway system, which is set up in such a way that: - an operation is transferable to the signal system,

- An input is detectable based on an information received from the signal system and this input is transferable to the signal system, wherein the received information on a display unit is at least partially representable, wherein the received information comprises a CAPTCHA generated based on the operation and transmitted from the signaling system. The device is in particular a control unit.

Also, the above object is achieved by means of a signal system of a railway system, which is set up such that

an operation can be received by an operating unit,

- on the control information, a CAPTCHA is generated based umfas ^¬ sent,

the information is transferable to the operating unit,

- The signal system performs the operation, if an input confirms the contents of the CAPTCHA, wherein the input from the operating unit can be transmitted.

The presented solution further comprises a computer program product directly loadable into a memory of a digita ^¬ len computer, comprising program code portions which are suitable to carry out the steps of the described herein procedural ^¬ proceedings. Furthermore, the above problem is solved by ei ^¬ nes computer-readable storage medium, for example an arbitrary memory comprising executable by a computer instruc ^¬ solutions (for example in the form of program code) that are adapted so that the computer to perform steps of the method described herein.

The above-described characteristics, features and advantages of this invention and the way how they are he ^¬ sufficient become clearer and more fully understood in conjunction with the following schematic description of exemplary embodiments, which are explained in connection with the drawings. In this case, the same or equivalent elements may be provided with the same reference numerals for clarity.

Show it:

Fig.l is a schematic flow diagram illustrating the implementation of an auxiliary operation;

A schematic representation of information comprising a CAPTCHA, a graphic and a text.

In the present case it is proposed to use a CAPTCHA method and to combine optionally with transaction numbers, to ensure that the input of an operator (hereinafter referred to by way of example as auxiliary service) from finally and if necessary only once is performed diener by a loading ^¬. The CAPTCHA can be such bereitge ^¬ is that it supports the operator also from an ergonomic standpoint.

Examples of possible auxiliary operations are:

- a command input, the corruption may bypass the Si ^¬ reliability of the signal system, an auxiliary redistribution of infrastructure elements (eg switches),

- Unlock infrastructure elements (tracks, points, intersections) that are closed for access, - activate a substitute signal,

- auxiliary dissolution of driveways,

- a basic location of axle counters,

- setting up restrictions for sections of the route (drivability barrier, slow driving), - removing restrictions on sections of the route.

FIG. 1 shows a schematic flow diagram illustrating the performance of an auxiliary operation:

The operator selects a corresponding auxiliary operation on an operating unit 101 or enters this in the form of text commands. This auxiliary operation is transmitted to a signal system 102 in a step 103. The transmission is in this case, for example, not gesi ^¬ chert. In particular, the transmission could be corrupted by out ^¬ cases or undefined states (eg not at all, partially or repeatedly transferred). Optionally, the transmission can also be signed and / or encrypted transmitted.

In the signal system 102, the received Hilfsbe ^¬ dienung is processed into a CAPTCHA, for example based on a unique transaction number (see. Step 104). The CAPTCHA is transmitted in a step 105 to the Be ^{¬ service} unit 101 and displayed to the operator. In addition, a time window can be determined within which to wait for a (valid) response. If the time period associated with the time window has expired, for example, no input is accepted and / or accepted by the operator - see also (4). The operator checks whether the CAPTCHA describes the auxiliary operation desired by the user or - possibly textually or graphically - is associated with the desired auxiliary operation. For example, a text and / or an image may additionally be displayed (cf.

Step 106) or the auxiliary operation be ^¬ writes or identified. If there is no association with the desired auxiliary operation, it is an error, the operator aborts the auxiliary operation and / or indicates the error. If there is an association with the desired auxiliary operation, the operator enters the transaction number in plain text (see step 106) and confirms that the auxiliary operation can be carried out

Step 107 (possibly signed and / or encrypted) transmitted to the signal system 102.

In the signal system 102, the transaction number is collected (the received confirmation of the operator respectively) ^¬ emp. It is checked in a step 108 whether the confirmation is received in the given time window and correct. If these conditions are met, the auxiliary operation is performed in a step 109.

Thus is achieved through the CAPTCHA that the desired auxiliary operation is visualized so that they can be translated only by ei ^¬ nen people in an understandable form for the machine. This prevents the Be ^¬ dienhandlungen be automated.

The CAPTCHA can have different configurations aufwei ^¬ sen. In particular, the CAPTCHA itself may be combined with text and graphics, such as the content of the

Specify auxiliary operation. The CAPTCHA can create a transaction Show number in a way that can only be recognized by the operator (not a machine). When the operator enters the transaction number shown in the CAPTCHA, he indicates to the signal system that the auxiliary service is from him.

For example, the CAPTCHA may also have pictograms that visualize the auxiliary operation and help the operator identify the auxiliary operation. This allows the operator to easily identify if there is an error. In this way it is possible to reduce the likelihood of erroneous input while satisfying advantageous ergonomic requirements for the operator.

2 schematically shows information 201 comprising a CAPTCHA 202. In addition, the information 201 may include a graphic (e.g., image, icon, icon, bitmap, etc.) 203 and / or text 204.

By using a unique transaction number, it can be ensured that no old auxiliary operation is re-recorded. Furthermore, a habitual, "reflex" confirmation (that is, a passage always the same input) is prevented by the operator through the geforder ^¬ th input of the transaction number.

For example, in a signal system, the following functions may be provided (regardless of the order below):

(a) One-time transaction numbers are generated.

(b) A CAPTCHA is generated to represent the

Auxiliary operation with a transaction number as a bitmap on the basis of the defined auxiliary operations. (c) The bitmap comprising CAPTCHA with transaction number is stored as a compressed graphic.

(d) The feedback from the operator is evaluated on the basis of expected (projected) waiting times.

The operating unit can be part of a control system; It is also possible that the operating unit is an ei ^¬ genständige component or integrated in another component of the railway system as the control system.

Preferably, to input the auxiliary operation, e.g. the following functions are provided (regardless of the order chosen below): (a) A dialog system for visualizing CAPTCHAs received in compressed graphics format.

(b) A dialog for entering and capturing CAPTCHA content by the operator.

For example, the interface between the signal ^¬ system and the control unit comprise a data transmission by means of a secure protocol that is supported by both the signal system and the control unit. Preferably, the secure protocol is independent of the physical transmission channel. The transmission of the CAPTCHA as a compressed graphic can be done in a PNG or JPG format. Accordingly, uncompressed graphics can also be used. The transmission of the feedback from the operator can (possibly encrypted) in text form (eg as ASCII text).

It is thus proposed, based on a

(Auxiliary) operation of an operating unit, which is directed to a sig- nalsystem to generate from the signal system an information ^¬ tion comprising a CAPTCHA, and to transmit this information to the operating unit. There is one Operator the characters shown in the CAPTCHA into ^¬ particular a transaction number, which is transmitted to confirm to the signal system. If the entry is correct, the operation is carried out. It is advantageous that it can be ensured that such an input is not from a machine, but only from the Be ^¬ servant. This automated and unwanted Be ^¬ operations can be effectively and safely prevented. Although the invention in detail by the at least one shown embodiment illustrated in greater detail and was ^¬ be written, so the invention is not be limited ^¬ and other variations can be derived therefrom by the skilled artisan without departing from the scope of the invention.

Reference sign list

101 operating unit, e.g. workstation

102 signal system

103 Transmission of the auxiliary operation

104 Creation of CAPTCHA, possibly together with other components such as graphics, text

105 Transmission of information with CAPTCHA to the operating unit 101

106 Display Information, Entry Entry

107 Transmission input to the signaling system 102

108 Check whether input within time window and whether

Input correct

109 Carrying out the auxiliary operation

201 Information

202 CAPTCHA

203 graphic (e.g., picture or icon)

204 text

Claims

claims

Method for carrying out an operation in a signaling system (102) of a railway system,

- In which an operation of a control unit

(101) is transmitted to the signal system (102) (103),

- in which the operation based on a Informati ^¬ on is generated comprising a CAPTCHA (104)

in which the information is transmitted to the operating unit (101) (105),

In which an entry is made based on the information on the Be ^¬ diene unit (101) and this input signal to the system (102) is transmitted (106, 107), -

in which the signaling system performs the operation if the input confirms the content of the CAPTCHA (109).

The method of claim 1, wherein the operation comprises at least one of the following actions:

- a command input, the corruption may bypass the Si ^¬ reliability of the signal system,

an auxiliary diverting of track elements (e.g., switches),

- activate a replacement signal,

- auxiliary dissolution of driveways,

- a basic location of axle counters,

- removing restrictions on sections of the route. Method according to one of the preceding claims, in which the CAPTCHA is based on a string he ^¬ represents.

A method according to any one of the preceding claims, wherein the information comprises a transaction number.

Method according to one of claims 1 to 3, wherein the CAPTCHA is created based on a transaction number.

Method according to one of the preceding claims, in which the information (201) comprises a text (204).

Method according to one of the preceding claims, wherein the information (201) includes an image (203) or a symbol that is in particular ciated with the operation asso ^¬ or it represents.

Method according to one of the preceding claims, in which the signal system (102) performs the operation (109) if the input bes ^¬ makes the contents of the CAPTCHA and if the input is he ^¬ on the signal system (102) received before the expiry of a Zeitdau ( 108).

The method of claim 8, wherein the information is transmitted to the operating unit and a timer is started, the timer specifying the amount of time that may elapse until the input to the signal system is to be received.

Method according to one of the preceding claims, wherein if the input does not match the contents of the CAPTCHA, the signal system does not perform the operation from ^¬, and particularly to an error message or an alarm is triggered. Means (101) for inputting an operation for a signal system of a rail system which is incorporated in such a rich ^¬ tet that

an operation is transferable to the signal system (103),

- Based on an information received from the signal system, an input is detectable and this input to the signal system is transferable (106, 107), wherein the received information on a display unit is at least partially darstell ^¬ bar, wherein the received information on

CAPTCHA generated based on the operation and transmitted by the signaling system.

Signal system (102) of a railway system, which is so ^¬ directed that

- An operation of a control unit is receivable (103),

- based on the control information umfas ^¬ send a CAPTCHA can be generated (104)

the information can be transmitted to the operating unit (105),

the signaling system performs the operation (109),

if an input the contents of the CAPTCHA bestä ^¬ Untitled, wherein the input from the operation unit is about ^¬ indirectly (107).