EP3238182B1 - Bordvorrichtung für ein fahrzeug - Google Patents

Bordvorrichtung für ein fahrzeug Download PDF

Info

Publication number
EP3238182B1
EP3238182B1 EP17709787.0A EP17709787A EP3238182B1 EP 3238182 B1 EP3238182 B1 EP 3238182B1 EP 17709787 A EP17709787 A EP 17709787A EP 3238182 B1 EP3238182 B1 EP 3238182B1
Authority
EP
European Patent Office
Prior art keywords
data
memory
encrypted
short
processing unit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP17709787.0A
Other languages
English (en)
French (fr)
Other versions
EP3238182A1 (de
Inventor
Leonardo GARGIANI
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Autostrade Tech SpA
Original Assignee
Autostrade Tech SpA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Autostrade Tech SpA filed Critical Autostrade Tech SpA
Priority to PL17709787T priority Critical patent/PL3238182T3/pl
Publication of EP3238182A1 publication Critical patent/EP3238182A1/de
Application granted granted Critical
Publication of EP3238182B1 publication Critical patent/EP3238182B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B15/00—Arrangements or apparatus for collecting fares, tolls or entrance fees at one or more control points
    • G07B15/02—Arrangements or apparatus for collecting fares, tolls or entrance fees at one or more control points taking into account a variable factor such as distance or time, e.g. for passenger transport, parking systems or car rental systems
    • G07B15/04—Arrangements or apparatus for collecting fares, tolls or entrance fees at one or more control points taking into account a variable factor such as distance or time, e.g. for passenger transport, parking systems or car rental systems comprising devices to free a barrier, turnstile, or the like
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B15/00—Arrangements or apparatus for collecting fares, tolls or entrance fees at one or more control points
    • G07B15/06—Arrangements for road pricing or congestion charging of vehicles or vehicle users, e.g. automatic toll systems
    • G07B15/063—Arrangements for road pricing or congestion charging of vehicles or vehicle users, e.g. automatic toll systems using wireless information transmission between the vehicle and a fixed station

Definitions

  • the present invention relates in general to the field of telematic traffic services.
  • the present invention relates to an on-board device for a vehicle, suitable for use in a system which supports a telematic traffic service.
  • Systems which support traffic telematic services comprise both services for the user (such as payment of tolls for access to road/motorway stretches, payment of car park fees, etc.) and administrator services (such as control of access to restricted-traffic urban zones, monitoring of traffic along a road/motorway stretch, etc.).
  • These systems generally comprise an on-board device (also known as “OBU”, i.e. “On Board Unit”) suitable for installation on-board a vehicle, and a plurality of road-side devices (also known as “RSU”, i.e. “Road Side Units”) suitable for installation on the road side, on gateways or at access points, or at toll stations.
  • OBU On Board Unit
  • RSU Road Side Units
  • both the on-board device and the road-side devices are provided with respective radiofrequency communication stages (typically, DSRC, i.e. "Dedicated Short Range Communication” stages) which allow the on-board device to exchange information with the road-side devices.
  • radiofrequency communication stages typically use radiofrequency carriers, for example within the frequency range 5-6 GHz.
  • Each on-board device typically has an associated unique identification code OBU-ID, with which it is configured via software during manufacture. Moreover, when an on-board device is assigned to a user, it may be configured with information about the user (for example, personal details) and information about the vehicle (number plate, etc.). The configuration of an on-board device generally involves also the loading of the software applications which provide the telematic traffic services supported by the device.
  • an on-board device After an on-board device has been configured and installed on-board, it may be necessary to modify its configuration, for example in order to update or activate the software applications already present, or load new applications, or remove or disable those applications which are no longer of interest for the user. This is for example the case where a user wishes to activate temporarily a toll payment service in a foreign country. In this case, the configuration of the user's on-board device must be modified by loading and activating temporarily a software application able to support this service.
  • an on-board device after an on-board device has been configured and installed on-board, it may be necessary to carry out checks on operation thereof and diagnostic tests, such as a check of the charge level of its battery. It might also be necessary to check the configuration information (relating to the user and/or to the vehicle) stored by the on-board device.
  • All the aforementioned operations require access to the on-board device in order to perform writing or reading of its memory and are generally carried out by means of equipment provided with radiofrequency communication stages able to communicate with the communication stage present in the on-board device.
  • This equipment is generally present at the operating centres managed by the company which provides the telematic traffic service or by the company which manages the road or the motorway along which the telematic traffic service is provided. If a user therefore wishes to modify the configuration of his/her on-board device or check operation thereof, generally he/she must go to one of these operating centres.
  • US 2014/0316685 describes an onboard device for a system supporting traffic telematic services, which comprises a near-range communication module for communication with a first external communication device (for example, the mobile phone of the user), a far-range communication module (for example, DSRC) for communication with second external devices (for example, the road-side devices of the system) and a non-volatile memory which is accessible by both the communication modules.
  • the near-range communication module may be for example a passive NFC tag. This is supplied by the user's mobile phone during communication and in this way may access the non-volatile memory, and in so doing can supply power to it, even when the rest of the on-board device is not in an operative condition.
  • the contents of the non-volatile memory may therefore be read and/or written by means of the connection between the user's mobile phone and the near-range communication module, irrespective as to whether the rest of the on-board device is in operating mode or not. It is thus possible to modify the configuration of the on-board device, for example writing configuration data in the non-volatile memory, via the user's mobile phone. Similarly it is possible to read the contents of the non-volatile memory via the user's mobile phone.
  • the Applicant has noticed that the near-range communication module included in this device, since it has direct access to the non-volatile memory of the device both during reading and during writing, disadvantageously reduces the security of the on-board device.
  • the short-range and near-field technologies (such as NFC technology) generally have mechanisms for authentication and protection of the connection which are not particularly secure, the security of the connection being mainly based on the fact of having a coverage range of only a few centimetres.
  • a third party should come into possession of the on-board device of a user, he/she could access the on-board device using his/her own mobile phone (or another device equipped with NFC reader), and thus modify the configuration thereof, or read information stored there and use it to clone the on-board device (i.e. copy it onto another on-board device).
  • the direct access to the non-volatile memory by the near-range communication module disadvantageously could result in inefficient use of the computational and storage resources of the on-board device.
  • the user could in fact decide, for example, to write configuration data in the memory (or, similarly, read configuration data from the memory) not knowing that, precisely in that moment, the on-board device is engaged in another priority activity, for example an exchange of data with one of the road-side devices.
  • the configuration data writing operation started by the user, while being lower priority could disadvantageously deprive the higher priority activity of computational resources, with the risk of slowing down or even stopping execution thereof.
  • the object of the present invention is to provide an on-board device for a motor vehicle, according to independent claim 1, which is suitable for use in a system supporting a telematic traffic service and which solves the aforementioned problems.
  • the object of the present invention is to provide an on-board device for a motor vehicle, according to independent claim 1, which is suitable for use in a system supporting a telematic traffic service, which is more secure and which uses more efficiently its associated computational and storage resources.
  • an on-board device for a vehicle which comprises a radiofrequency communication stage for communication with the road-side devices, a short-range communication stage for communication with an electronic device (for example a mobile phone) situated in the vicinity thereof, two memories and a data processing unit cooperating with both the communication stages.
  • a first memory acts as a central operating memory accessible by the data processing unit alone and stores at least one first encryption key.
  • a second memory is directly accessible instead by the short-range communication stage, is electrically connected thereto or integrated therein and stores first data relating to the on-board device.
  • the short-range communication stage is configured to transmit to the electronic device this first data, also in power down mode or in the event of malfunctioning of the radiofrequency communication stage.
  • the short-range communication stage is moreover configured to receive encrypted second data from the electronic device and store it temporarily in the second memory.
  • the data processing unit is configured to decrypt, upon reception of a wake-up signal, this encrypted second data using the encryption key stored in the first central operating memory and to store the second data in the first central operating memory.
  • the on-board device is advantageously secure since, at the moment of reception of data from the electronic device via the short-range communication stage, the data to be decrypted and the encryption key which is needed to decrypt it are stored in two physically separate memories, one of which (namely that which stores the key) is accessible only by the data processing unit, i.e. cannot be directly accessed by the short-range communication stage. Despite the fact, therefore, that the short-range communication stage allows an unprotected connection to be established between electronic device and on-board device, the on-board device is advantageously more secure.
  • the on-board device allows moreover more efficient use of its computational and storage resources, since the transfer of the data into the first central operating memory and the subsequent processing thereof are triggered upon reception of the wake-up signal in the data processing unit.
  • This allows implementation of the mechanisms for managing the priority of the various operations which involve the data processing unit and the first central operating memory of the on-board device, whereby, for example, for the activity of processing data received from the short-range communication stage, the data processing unit receives wake-up signals after completing execution of the higher priority activities (for example, the data exchange activities between radiofrequency communication stage and road-side devices).
  • the present invention provides an on-board device for a vehicle, the on-board device being suitable for use in a system which provides a telematic traffic service, the on-board device comprising:
  • the first central operating memory is implemented inside in the data processing unit.
  • the first central operating memory is implemented outside the data processing unit, and the first central operating memory stores a hardware identifier UID 120 of the data processing unit in a non-modifiable and non-erasable manner.
  • the device also comprises a hardware encryption interface between the first central operating memory and the data processing unit.
  • the short-range communication stage is configured to send said wake-up signal to the data processing unit.
  • the device also comprises a button manually accessible from the outside of the device, the button being configured so that, when pressed, said wake-up signal is sent to the data processing unit.
  • the first data is stored in the second memory, encrypted with a private key of an asymmetric encryption mechanism, and the short-range communication stage is configured to transmit the first data to the electronic device, encrypted with said private key.
  • the first data made available for reading and encrypted with private key in the second memory preferably comprises tag data of the on-board device, including in particular its unique identification code OBU-ID.
  • the short-range communication stage is configured to receive said first data from a central server via the electronic device and the short-range communication stage in a form encrypted with said private key, and to store directly in a permanent manner the encrypted first data in the second memory, without requesting any action of the data processing unit.
  • the short-range communication stage is configured to receive the first data from a central server via the electronic device and the short-range communication stage in a form not yet encrypted with said private key
  • the first central operating memory also stores said private key
  • the data processing unit is configured to encrypt said first data with said encrypted key and to store permanently the encrypted first data in the second memory.
  • the second memory also stores its hardware identifier UID 160 , the hardware identifier UID 160 being stored both unencrypted and encrypted with the private key together with the first data, and the short-range communication stage is configured to transmit to the electronic device the hardware identifier UID 160 unencrypted and the hardware identifier UID 160 also encrypted with the private key together with the first data, for further authentication of the first data by the electronic device.
  • the second data is received by the short-range communication stage in a form encrypted with a symmetric key identical to the encryption key stored in the first central operating memory.
  • the data processing unit is configured, upon reception of said wake-up signal, to transfer firstly the encrypted second data from the second memory to the first central operating memory and then decrypt it using the encryption key stored in the first central operating memory.
  • the data processing unit is configured, upon reception of said wake-up signal, to decrypt firstly the encrypted second data using the encryption key stored in the first central operating memory and then transfer the decrypted second data into the first central operating memory.
  • the encrypted second data is received in separate encrypted blocks and the data processing unit is configured to start decryption of the encrypted second data only after receiving, in the second memory, all the separate encrypted blocks.
  • the data processing unit is configured to read third data stored in the first central operating memory, to encrypt the third data using said encryption key stored in the first central operating memory and to forward the encrypted third data to the short-range communication stage, the short-range communication stage being configured to transmit the encrypted third data to a central server via the electronic device.
  • the second memory stores, together with said first data, also a unique identification code OBU-ID of the on-board device, the unique identification code OBU-ID of the device being stored both unencrypted and encrypted with the symmetric key, the short-range communication stage being configured to transmit to the central server via the electronic device also said unique identification code OBU-ID both unencrypted and encrypted with the symmetric key, so as to allow the central server to perform authentication of the device and decrypting of said third data.
  • the present invention provides a system for providing a telematic traffic service, the system comprising a plurality of road-side devices, an electronic device and an on-board device for a vehicle, the on-board device being configured to communicate both with the plurality of road-side devices and with the electronic device, the on-board device being as described above.
  • FIG 1 shows in schematic form a system for providing a telematic traffic service, comprising an on-board device according to embodiments of the present invention.
  • This telematic traffic service may be a service for the users (such as payment of tolls for access to road/motorway stretches, payment of car park fees, etc.) or a service for the administrator (such as control of access to restricted-traffic urban zones, monitoring of traffic along a road/motorway stretch, etc.).
  • the system comprises an on-board device 100, electronic device 210, a plurality of road-side devices (for the sake of simplicity not shown in Figure 1 ), a communications network 600 and central server 700 which communicates with the electronic device 210 via the communications network 600.
  • the on-board device 100 is preferably suitable for installation on-board a vehicle (for the sake of simplicity not shown in Figure 1 ), for example a motor vehicle.
  • the road-side devices are instead configured to be installed in a fixed position, for example along a road side, on an overpass or on an access gateway (for example to a car park, an urban zone, a road or motorway section, etc.).
  • the on-board device 100 is configured to communicate via radio both with the road-side devices and with the electronic device 210.
  • the on-board device 100 preferably comprises a battery 110, a data processing unit 120, a first memory 130, a radiofrequency communication stage 140, a short-range communication stage 150 and a second memory 160.
  • the on-board device 100 may comprise other components (for example GNSS components for satellite positioning) which will not be described in greater detail hereinbelow since they are not useful for the purposes of the present description.
  • the battery 110 is preferably electrically connected directly or indirectly to each of the other components of the on-board device 100 (in particular to the data processing unit 120, to the first memory 130, to the radiofrequency stage 140 and to the short-range communication stage 150), so as to power them if and when necessary.
  • the first memory 130 is preferably electrically connected to the data processing unit 120.
  • the first memory 130 may be implemented on the outside or on the inside of the data processing unit 120. In any case, the first memory 130 is accessible by the data processing unit 120 alone (in particular it is not directly accessible by the short-range communication stage 150).
  • the first memory 130 preferably stores a hardware identifier UID 120 of the data processing unit 120 (preferably, its silicon number) in a non-modifiable and non-erasable manner.
  • This hardware identifier UID 120 is used by the processing unit 120 to check the authenticity of the data read from the first memory 130. This advantageously makes it possible to prevent the contents of the central operating memory of one on-board device from being cloned and transferred onto another on-board device.
  • the first memory 130 is implemented outside the data processing unit 120, an interface (not shown in the drawings) is provided between the unit 120 and the memory 130, said interface being configured to perform hardware encryption of the data which the unit 120 writes into the memory 130 and hardware decryption of the data which the unit 120 reads from the memory 130.
  • the data stored in the memory 130 is thus advantageously protected at the hardware level.
  • the first memory 130 is therefore a non-volatile memory which acts as a secure central operating memory of the on-board device 100.
  • the first memory 130 stores the unique identification code OBU-ID of the on-board device 100 and, optionally, information about the user who is owner of the vehicle and about the vehicle itself (for example number plate and/or toll class of vehicle).
  • the first memory 130 also preferably stores the software applications which provide the telematic traffic services for the user and/or for the administrator supported by the on-board device 100 and the data generated by communication of the on-board device 100 with the road-side devices of the system via the radiofrequency communication stage 140 (for example, data relating to the position of the vehicle or transit thereof through an access way).
  • the radiofrequency communication stage 140 is preferably configured to establish radio links with the road-side devices.
  • the radiofrequency stage 140 may be implemented using DSRC (Dedicated Short Range Communications) technology which, as is known, comprises radio channels and authentication, encoding and decoding procedures which have been specifically developed for telematic traffic services and uses frequency bands in the range of 5.7 - 5.9 GHz.
  • DSRC Dedicated Short Range Communications
  • the short-range communication stage 150 is preferably configured to support short-range radio links (maximum 10 cm) with the electronic device 210.
  • the electronic device 210 may belong to the same user who has been assigned the on-board device 100 or may belong to third parties (for example, the administrator of the road or motorway infrastructure along which the telematic traffic service supported by the on-board device 100 is provided, the telematic traffic service administrator, or the body or authority responsible for monitoring traffic offences).
  • the electronic device 210 is also preferably provided with cabled or wireless connectivity (for example WiFi or cellular network) to the communications network 600.
  • the electronic device 210 may be a smartphone, a tablet or a generic commercial or specially designed reader.
  • the electronic device 210 is also provided with a user interface 200 comprising input and/or output elements comprising for example pushbuttons, cursors, touchscreen, etc.
  • the electronic device 210 also comprises a short-range communication stage compatible with the short-range communication stage 150 of the on-board device 100.
  • the short-range communication stage 150 (and therefore also the corresponding short-range communication stage of the electronic device 210) is implemented using near-field technology, such as RFID (Radio-Frequency IDentification) technology with short range (i.e. radius less than 10 cm).
  • RFID Radio-Frequency IDentification
  • short range i.e. radius less than 10 cm.
  • NFC Near Field Communication
  • the short-range communication stage included in the electronic device 210 is configured as initiator, while the short-range communication stage 150 is configured as target.
  • the short-range communication stage 150 is configured to receive from the short-range communication stage included in the electronic device 210 a radio carrier, from which it extracts its own power supply.
  • the configuration of the short-range communication stage 150 as reader is advantageous, since it allows the electronic complexity and software of the on-board unit to be reduced. It also allows the short-range communication stage 150 to operate (and therefore communicate with the corresponding short-range communication stage included in the electronic device 210) also when the battery 110 of the on-board device 100 is completely discharged, or when the remainder of the on-board device (in particular the data processing unit 120, the first memory 130 and the radiofrequency stage 140) is damaged or in any case not functioning.
  • the second memory 160 may be electrically connected to the short-range communication stage 150.
  • the second memory 160 may be integrated in the short-range communication stage 150.
  • the second memory 160 is directly accessible by the short-range communication stage 150 which may carry out on it both write operations and read operations also without involving the processing unit 120, as will be described in greater detail hereinbelow.
  • the second memory 160 is preferably a non-volatile memory able to retain the data even when not electrically powered.
  • the second memory 16 may be a memory of the E 2 PROM type.
  • the second memory 160 preferably permanently stores a set of basic data relating to the on-board device 100, comprising a unique identification code OBU-ID of the on-board device 100 and, optionally, information about the user and/or the vehicle.
  • the second memory 160 moreover is suitable for storing in a temporary or transient manner data sent by the central server 700 and destined for the data processing unit 120 and/or for the first memory 130, as will be described in greater detail hereinbelow.
  • the communications protocol via which the short-range communication stage 150 and the corresponding short-range stage included in the electronic device 210 operate thus establishes automatically a radio link.
  • the radio link thus established is preferably a two-way point-to-point link which allows a two-way exchange of data between on-board device 100 and electronic device 210.
  • the short-range communication stage 150 may transmit to the electronic device 210 data read from the second memory 160 or other components of the on-board device 100, thus allowing the reading of this data from the on-board device 100 via the electronic device 210.
  • the data read may be displayed in the form of texts or graphics on the user interface 200 of the electronic device 210.
  • the data read may be transmitted from the electronic device 210 to the central server 700 via the communications network 600.
  • read operations may allow the user of the electronic device 210 (who may be the user who has been assigned the on-board device 110 or the personnel of the provider of the telematic traffic service supported by the on-board device 100) to carry out for example diagnostic checks or operational tests of the on-board device 100 (for example, checking of the charged level of its battery 110) or checking of the configuration information about the user and/or the motor vehicle stored by the on-board device 100.
  • the short-range communication stage 150 advantageously may read it even if the battery 110 is completely discharged, or when the data processing unit 120 and/or the first memory 130 are not functioning.
  • the basic data stored in the second memory 160 can therefore be advantageously read by means of the electronic device 210, irrespective as to whether the on-board device 100 is functioning or not.
  • the second memory 160 therefore advantageously performs substantially an electronic tag function.
  • the short-range communication stage 150 may read it only if the battery 110 is charged and the on-board device 100 (at least the data processing unit 120 and the first memory 130) is functioning correctly.
  • the electronic device 210 preferably sends a command signal to the short-range communication stage 150.
  • the short-range communication stage 150 retrieves the required data from the second memory 160 and sends it to the electronic device 210, without requesting any action by the data processing unit 120.
  • the short-range communication stage 150 forwards the command signal to the data processing unit 120 which retrieves the data required (for example from the first memory 130) and sends it to the short-range communication stage 150 which in turn forwards it the electronic device 210.
  • this command signal is preceded by a wake-up signal which activates the data processing unit 120.
  • the short-range communication stage 150 may receive from the electronic device 210 data to be supplied to the other components of the on-board device 100 (in particular to the data processing unit 120 and/or to the first memory 130 and/or to the second memory 160), thus allowing writing of this data onto the on-board device 100 via the electronic device 210.
  • These write operations may for example allow the user of the electronic device 210 (who may be the user who has been assigned the on-board device 100 or the personnel of the provider of the telematic traffic service supported by the on-board device 100) to modify the configuration of the on-board device 100, for example updating or activating the software applications which are already present or loading new applications or removing or deactivating those applications which are no longer of interest for the user.
  • These write operations may therefore be advantageously performed without having to visit a customer service operating centre.
  • a write operation preferably envisages that the central server 700 transmits the data to be written to the on-board device 100 via the communications network 600 and the electronic device 210.
  • the electronic device 210 preferably does not perform any processing of the data, merely performing a transducer function between the connection to the communications network 600 (for example Wi-Fi or cellular network) and the short-range radio link with the on-board device 100 (for example NFC).
  • the data transmitted on the short-range radio link between electronic device 210 and on-board device 100 is therefore the same as the data transmitted on the communication network 600 between the central server 700 and the electronic device 210.
  • the establishment of the short-range radio link does not require any manual setting or any pairing procedure and is therefore very quick (about 1/10th of a second).
  • the short-range link has a maximum radius of 10 cm, it is intrinsically not exposed to the risk of sniffing of the transmitted data which, in any case, as will be explained below, is preferably encrypted by the central server 700.
  • the short-range communication stage 150 preferably saves it temporarily in the second memory 160.
  • a passcode write protection mechanism is provided in order to prevent any overwriting or unauthorised access to the second memory 160.
  • the short-range communication stage 150 may identify and store said data directly in a permanent manner in the second memory 160 (without requiring any action by the data processing unit 120), for example in an address location of the second memory 160 dedicated for the permanent storage of the basic data.
  • the short-range communication stage 150 may forward the data to be written in a transparent manner to the data processing unit 120, which identifies said data and transfers it back into the second memory 160, for example in the address location of the second memory 160 dedicated for the permanent storage of basic data.
  • the short-range communication stage 150 forwards said data preferably in a transparent manner to the data processing unit 120, which processes it and if necessary writes it in the first memory 130.
  • the write operation involves the data processing unit 120, the battery 110 must be charged. If, on the other hand, the data processing unit 120 is not involved, the write operation may be performed even if the battery 110 is discharged.
  • the data processing unit 120 if it is involved in the write operation, it preferably starts processing of the data to be written upon reception of a wake-up signal.
  • This wake-up signal may be sent to the data processing unit 120 by the short-range communication stage 150 or by the user of the on-board device 100, for example by means of a special button which can be accessed manually on the outside of the on-board device 100.
  • the on-board device 100 may be provided with one or more indicators (for example LED light indicators) designed to provide the user with visual feedback as regards the outcome of the data write operation on the on-board device 100.
  • the on-board device 100 may be provided with a light indicator configured to signal to the user whether the operation of writing the data in the first memory 130 has been successfully completed.
  • the on-board device 100 therefore is substantially able to operate in three different operating configurations:
  • the system shown in Figure 1 is preferably configured to provide a secure connection between the on-board device 100 and electronic device 210 and optionally between central server 700 and on-board device 100.
  • a mechanism for ensuring the authenticity of the data read from the second memory 160 namely so that the electronic device 210 and/or the central server 700 can be sure that the read data really relates to the on-board device 100 and has not instead been cloned by another on-board device
  • a mechanism for protecting the data exchanged between the central server 700 and the on-board device 100 is preferably configured to provide a secure connection between the on-board device 100 and electronic device 210 and optionally between central server 700 and on-board device 100.
  • the mechanism for ensuring the authenticity of the data read from the second memory 160 is based on asymmetric encryption of the data made available during reading by means of permanent storage in the second memory 160.
  • the data which can be read from the second memory 160 is stored in the second memory 160 encrypted with a private key.
  • the central server 700 preferably sends to the on-board device 100 the data to be rendered readable from the second memory 160 in a form already encrypted with private key.
  • the short-range communication stage 150 may store it directly in the second memory 160, without requesting any action by the data processing unit 120.
  • the central server 700 may send to the on-board device 100 the data to be rendered readable from the second memory in a form not yet encrypted with private key.
  • the short-range communication stage 150 preferably forwards it to the data processing unit 120 which encrypts it with private key and stores it permanently in the second memory 160. In this second case, therefore, action by the data processing unit 120 and storage of the private key in the first memory 130 are required.
  • the electronic device 210 or the central server 700 requests reading of this data
  • said data is transmitted, encrypted with private key, to the electronic device 210 via the short-range communication stage 150.
  • no command is sent to the data processing unit 120 of the on-board device 100, which is not required to perform reading operations from the second memory 160.
  • the electronic device 210 preferably uses the public key in order to decrypt the read data which is encrypted with private key.
  • the public key since it may be freely distributed, is preferably saved locally in the electronic device 210 (for example within an application executed by the device 210 for managing reading of data from the device 100), thus freeing the electronic device 210 from the need to be connected to the central server 700 during the whole of the operation of reading of the data stored by the second memory 160.
  • the hardware identifier UID 160 is preferably written by the manufacturer of the memory 160 in a specific area thereof so that it is stored permanently and is available in read-only mode and therefore cannot be modified.
  • the hardware identifier UID 160 is stored both unencrypted and encrypted with private key together with the data to be rendered readable (for example the basic data) permanently saved in the second memory 160 (containing, as described above, the identifier OBU-ID and optionally data about the user and/or the vehicle).
  • the hardware identifier UID 160 is preferably transmitted to the electronic device 210 unencrypted, together with the data to be read encrypted with private key.
  • the electronic device 210 After carrying out decryption of the data to be read with public key, the electronic device 210 preferably compares the hardware identifier UID 160 received unencrypted with the hardware identifier UID 160 obtained from decryption with public key. If the two hardware identifiers coincide, the data to be read is further authenticated.
  • the second memory 160 it is possible advantageously to prevent the second memory 160 from being cloned and transferred onto another on-board device. If the contents of the second memory 160 of the on-board device 100 were to be copied onto another on-board device, the lack of correspondence between the two hardware identifiers would be detected and the data read would thus not be authenticated. The non-clonability of the data stored in the second memory 160, namely the impossibility of copying this data into the memory of another on-board device, is thus advantageously ensured.
  • the private key (which is the same for encryption and decryption) is preferably known only to the central server 700 and to the on-board device 100. Therefore, reading of this data in electronic tag mode by the electronic device 210 requires in any case forwarding of the data to the central server 700 which decrypts it with the private key known to it and, if authenticated, retransmits it unencrypted to the electronic device 210.
  • the mechanism for protecting the data transmitted from the central server 700 to the on-board device 100 is preferably based on symmetric encryption of the transmitted data.
  • This symmetric encryption uses a same private key to encrypt and decrypt the data, which key must therefore be known both to the central server 700 and to the on-board device 100.
  • the private key is stored in the first memory 130 of the on-board device 100, preferably in a non-erasable and non-modifiable area of the first memory 130.
  • the central server 700 preferably encrypts the data to be written with the private key and transmits it to the electronic device 210 where, as described above, it is temporarily saved in the second memory 160.
  • the data processing unit 120 preferably (upon reception of a wake-up signal, as described above) decrypts the data to be written using the private key stored in the first memory 130 and stores it in the first memory 130. This operation may be performed in different ways.
  • the data processing unit 120 firstly transfers the encrypted data from the second memory 162 to the first memory 130 and then decrypts it, using the symmetric key stored in the first memory 130.
  • the data processing unit 120 firstly recovers the symmetric key from the first memory 130, then uses it to decrypt the data (for example saved temporarily in an associated internal RAM memory), and finally transfers it into the first memory 130.
  • the data to be decrypted and the private key which is used to decrypt said data reside in two physically separate memories, one of which (namely the first memory 130 which stores the private key) is accessible only for the data processing unit 120 and therefore is not directly accessible by the short-range communication stage 150.
  • the short-range communication stage 150 allows an unprotected connection to be established between electronic device 210 and on-board device 100, the on-board device 100 is advantageously very secure.
  • the central server 700 divides the data to be written into blocks (before or after performing symmetric-key encryption of said data), which it then transmits to the on-board device 100 via the electronic device 210.
  • the data processing unit 120 waits for reception of all the encrypted blocks in the second memory 160. This advantageously further increases the security and reliability of the communication between central server 700 and on-board device 100 since the blocks, before being written in the memory 130, must be decrypted by a process which is totally external to the memory 160 in which it is temporarily stored.
  • the security of the private key used for symmetric encryption is preferably ensured in the manner described below.
  • personalisation at the factory of the on-board device 100 is performed, this operation comprising the following steps:
  • the central server 700 preferably uses a second secure HSM server (also containing the master key(s)), supplying it with the unique identification code OBU-ID of the on-board device 100 and obtaining from it the specific derived key to be used for communication with the on-board device 100.
  • the transmitted data, encrypted by the central server 700 with derived key is received as described above by the data processing unit 120 which, using the appropriate derived key stored in its first memory 130, decrypts the data received which is finally stored in the first memory 130.
  • a first step preferably envisages that the electronic device 210, after being registered (logged in) with the central server 700, obtains from the on-board device 100 via the short-range link with the short-range communication stage 150 the following data read from the second memory 160:
  • This data is then sent to the central server 700 via the communications network 600 ( Figure 2 shows the sake of simplicity a repeater 800 of the communications network 600).
  • the central server 700 preferably uses the aforementioned second secure HSM server (indicated by the reference number 710 in Figure 2 ), supplying it with the unique identification code OBU-ID of the on-board device 100 received unencrypted and obtaining from it the specific derived key to be used for communication with the on-board device 100.
  • the central server 700 decrypts the data received and validates its correctness.
  • the configuration data sent from the central server 700 to the on-board device 100 and encrypted with derived key may also comprise data to be stored in the second memory 160, so that it remains readable by the electronic device 210 via short-range radio communication. This data may or may not be already encrypted by the central server 700 for the purposes of authentication, as described above.
  • the data processing unit 120 once the message with the derived key has been decrypted, identifies the data to be made available for reading and establishes whether it is already encrypted for the purposes of authentication. If this is so, it permanently stores it in the second memory 160. If this is not the case, it retrieves from the first memory 130 the private key of the asymmetric encryption intended to allow authentication of the data read, uses it to encrypt the data and stores it permanently in the second memory 160.
  • a session key may also be used for communication between the central server 700 and the on-board device 100.
  • the sender namely the central server 700 if data is written in the on-board device 100, or the on-board device 100 if data is read from the on-board device 100 calculates a session key, for example based on the derived key and a random number. The session key is recalculated (and is therefore different) for each communication session.
  • the sender preferably uses the calculated session key to further encrypt the data to be transmitted, already encrypted with the derived key of the symmetric encryption mechanism.
  • the sender also preferably encrypts the calculated session key, using for example the public key of the recipient (namely the on-board device 100 if data is written, or the central server 700 if data is read) and also sends this to the recipient.
  • the recipient upon reception of the data and the encrypted session key, decrypts the session key using the associated private key and then uses the session key to decrypt the data received (to be further decrypted using the derived key).
  • This mechanism is advantageous since it represents a solution which is less complex from a computational point of view compared to asymmetric encryption of all the data exchanged between central server 700 and on-board device 100 and which allows the calculation time necessary for encryption and decryption of the exchanged data to be reduced significantly.
  • protection with the session key is used only on the link between electronic device 210 and central server 700.
  • the management of the session keys in this case is entrusted to the electronic device 210 and not to the on-board device 100.
  • writing of the data in the second memory 160 may be managed by the data processing unit 120, interfaced in this case with the data connection interface (for example the radio communication technology internal modem or Bluetooth interface).
  • the data connection interface for example the radio communication technology internal modem or Bluetooth interface.
  • the short-range communication stage 150 may be used solely for the function of reading data from the memory 160.
  • the on-board device described in addition to allowing the reading of data (for example for verification or diagnostic purposes) and the writing of data (for example for configurational purposes) by the electronic device 210 allows in fact the exchange of data with the electronic device 210 and the central server 700 to be managed in a particularly secure manner.

Landscapes

  • Business, Economics & Management (AREA)
  • Finance (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Mobile Radio Communication Systems (AREA)

Claims (17)

  1. On-Board-Vorrichtung (100) für ein Fahrzeug, wobei die On-Board-Vorrichtung (100) für die Verwendung in einem System geeignet ist, welches einen telematischen Verkehrsdienst bereitstellt, wobei die On-Board-Vorrichtung (100) aufweist:
    - eine Radiofrequenz-Kommunikationsstufe (140), welche konfiguriert ist, um mit einer straßenseitigen Einrichtung des Systems zu kommunizieren;
    - eine Kurzstrecken-Kommunikationsstufe (150), welche konfiguriert ist, um mit einem Elektronikgerät (210) zu kommunizieren, welches sich in deren Nähe befindet;
    - eine Datenverarbeitungseinheit (120), welche mit der Radiofrequenz-Kommunikationsstufe (140) und der Kurzstrecken-Kommunikationsstufe (150) kooperiert,
    - einen ersten zentralen Arbeitsspeicher (130), welcher durch die Datenverarbeitungseinheit (120) zugänglich ist, wobei der erste zentrale Betriebsspeicher (130) mindestens einen Verschlüsselungsschlüssel speichert;
    - einen zweiten Speicher (160), welcher elektrisch verbunden mit oder in die Kurzstrecken-Kommunikationsstufe (150) integriert ist und direkt durch die Kurzstrecken-Kommunikationsstufe (150) zugänglich ist, wobei der zweite Speicher (160) erste Daten speichert, welche sich auf die On-Board-Vorrichtung (100) beziehen; und
    wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um die ersten Daten zum Elektronikgerät (210) zu übertragen, auch in abgeschaltetem Modus oder bei Auftreten einer Fehlfunktion der Radiofrequenz-Kommunikationsstufe (140), und darüber hinaus konfiguriert ist, um verschlüsselte zweite Daten von dem Elektronikgerät (210) zu empfangen und diese temporär auf dem zweiten Speicher (160) zu speichern;
    und wobei die Datenverarbeitungseinheit (120) konfiguriert ist, um beim Empfangen eines Wecksignals die verschlüsselten zweiten Daten unter Verwendung des im ersten zentralen Betriebsspeicher (130) gespeicherten Verschlüsselungsschlüssels zu entschlüsseln und die zweiten Daten im ersten Betriebsspeicher (130) zu speichern.
  2. Vorrichtung (100) nach Anspruch 1, wobei der erste zentrale Betriebsspeicher (130) innerhalb der Datenverarbeitungseinheit (120) implementiert ist.
  3. Vorrichtung (100) nach Anspruch 1, wobei der erste zentrale Betriebsspeicher (130) außerhalb der Datenverarbeitungseinheit (120) implementiert ist und wobei der erste zentrale Betriebsspeicher (130) einen Hardware-Identifikator UID120 der Datenverarbeitungseinheit (120) auf eine nicht veränderbare und nicht löschbare Weise speichert.
  4. Vorrichtung (100) nach Anspruch 3, ebenfalls aufweisend eine Hardware-Verschlüsselungsschnittstelle zwischen dem ersten zentralen Betriebsspeicher (130) und der Datenverarbeitungseinheit (120).
  5. Vorrichtung (100) nach einem der vorherigen Ansprüche, wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um das Wecksignal an die Datenverarbeitungseinheit (120) zu senden.
  6. Vorrichtung (100) nach einem der vorherigen Ansprüche, wobei die Vorrichtung (100) ferner einen Knopf aufweist, welcher auf der Außenseite der Vorrichtung (100) manuell zugänglich ist, wobei der Knopf so konfiguriert ist, dass, wenn er gedrückt wird, das Wecksignal an die Datenverarbeitungseinheit (120) gesendet wird.
  7. Vorrichtung (100) nach einem der vorherigen Ansprüche, wobei die ersten Daten auf dem zweiten Speicher (160) in einer mit einem privaten Schlüssel eines asymmetrischen Verschlüsselungsmechanismus verschlüsselten Form gespeichert sind, und wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um die ersten Daten zum Elektronikgerät (210) in einer mit dem privaten Schlüssel verschlüsselten Form zu übertragen.
  8. Vorrichtung (100) nach Anspruch 7, wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um die ersten Daten von einem zentralen Server (700) über das Elektronikgerät (210) und die Kurzstrecken-Kommunikationsstufe (150) in einer bereits mit dem privaten Schlüssel verschlüsselten Form zu erhalten, und um die ersten Daten direkt auf dauerhafte Weise in dem zweiten Speicher (160) zu speichern, ohne jegliche Aktivität der Datenverarbeitungseinheit (120) anzufragen.
  9. Vorrichtung (100) nach Anspruch 7, wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um die ersten Daten von einem zentralen Server (700) über das Elektronikgerät (210) und die Kurzstrecken-Kommunikationsstufe (150) in einer noch nicht mit dem privaten Schlüssel verschlüsselten Form zu erhalten, wobei der erste zentrale Arbeitsspeicher (130) den privaten Schlüssel speichert und wobei die Datenverarbeitungseinheit (120) konfiguriert ist, um die ersten Daten mit dem Verschlüsselungsschlüssel zu verschlüsseln und um diese ersten Daten auf dauerhafte Weise in dem zweiten Speicher (160) zu speichern.
  10. Vorrichtung (100) nach einem der Ansprüche 7 bis 9, wobei der zweite Speicher (160) auch einen Hardware-Identifikator UID160 des zweiten Speichers (160) speichert, wobei der Hardware-Identifikator UID160, sowohl unverschlüsselt als auch mit dem privaten Schlüssel verschlüsselt, gemeinsam mit den ersten Daten gespeichert ist, und wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um den Hardware-Identifikator UID160 unverschlüsselt und den außerdem mit dem privaten Schlüssel verschlüsselten Hardware-Identifikator UID160 zum Elektronikgerät (210) gemeinsam mit den ersten Daten zur weiteren Authentifizierung der ersten Daten durch das Elektronikgerät (210) zu übertragen.
  11. Vorrichtung (100) nach einem der vorherigen Ansprüche, wobei die zweiten Daten von der Kurzstrecken-Kommunikationsstufe in einer mit einem symmetrischen Schlüssel verschlüsselten Form übertragen werden, welcher identisch zu dem Verschlüsselungsschlüssel ist, der in dem ersten zentralen Arbeitsspeicher (130) gespeichert ist.
  12. Vorrichtung (100) nach einem der vorherigen Ansprüche, wobei die Datenverarbeitungseinheit (120) konfiguriert ist, um bei Erhalt des Wecksignals zuerst die verschlüsselten zweiten Daten von dem zweiten Speicher (160) zum ersten zentralen Arbeitsspeicher (130) zu übertragen und um sie anschließend zu entschlüsseln, indem sie den Verschlüsselungsschlüssel nutzt, welcher in dem ersten zentralen Arbeitsspeicher (130) gespeichert ist.
  13. Vorrichtung (100) nach einem der Ansprüche 1 bis 12, wobei die Datenverarbeitungseinheit (120) konfiguriert ist, um bei Erhalt des Wecksignals zuerst die verschlüsselten zweiten Daten zu entschlüsseln, indem sie den Verschlüsselungsschlüssel nutzt, welcher in dem ersten zentralen Arbeitsspeicher (130) gespeichert ist und um die zweiten entschlüsselten Daten anschließend in den ersten zentralen Arbeitsspeicher (130) zu übertragen.
  14. Vorrichtung (100) nach einem der vorherigen Ansprüche, wobei die verschlüsselten zweiten Daten in einzelnen verschlüsselten Blöcken erhalten werden, und wobei die Datenverarbeitungseinheit (120) konfiguriert ist, um die verschlüsselten Daten erst nach Erhalt aller einzelnen Blöcke im zweiten Speicher (160) zu entschlüsseln zu beginnen.
  15. Vorrichtung (100) nach einem der vorherigen Ansprüche, wobei die Datenverarbeitungseinheit (120) konfiguriert ist, um dritte Daten zu lesen, welche in dem ersten zentralen Arbeitsspeicher (130) abgespeichert sind, um die dritten Daten zu verschlüsseln, indem sie den Verschlüsselungsschlüssel nutzt, welcher in dem ersten zentralen Arbeitsspeicher (130) gespeichert ist, um die dritten verschlüsselten Daten zu der Kurzstrecken-Kommunikationsstufe (150) zu übermitteln, wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um die verschlüsselten dritten Daten über das Elektronikgerät (210) zu einem zentralen Server (700) zu übertragen.
  16. Vorrichtung (100) nach Anspruch 15, wobei der zweite Speicher (160) gemeinsam mit den ersten Daten außerdem einen eindeutigen Identifikationscode OBU-ID der Vorrichtung (100) speichert, wobei dieser eindeutige Identifikationscode OBU-ID der Vorrichtung (100) sowohl unverschlüsselt als auch mit dem symmetrischen Schlüssel verschlüsselt gespeichert ist, wobei die Kurzstrecken-Kommunikationsstufe (150) konfiguriert ist, um den eindeutigen Identifikationscode OBU-ID sowohl unverschlüsselt als auch mit dem symmetrischen Schlüssel verschlüsselt zum zentralen Server (700) über das Elektronikgerät (210) zu übertragen, um dem zentralen Server (700) zu erlauben, die Authentifizierung der Vorrichtung (100) und das Entschlüsseln der dritten Daten durchzuführen.
  17. System zum Bereitstellen eines telematischen Verkehrsdienstes, wobei das System eine Vielzahl an straßenseitigen Einrichtungen, ein Elektronikgerät (210) und eine On-Board-Vorrichtung (100) für ein Fahrzeug aufweist, wobei die On-Board-Vorrichtung (100) konfiguriert ist, um sowohl mit der Vielzahl an straßenseitigen Einrichtungen, als auch mit dem Elektronikgerät (210) zu kommunizieren, wobei die On-Board-Vorrichtung (100) die Merkmale eines der Ansprüche 1 bis 16 aufweist.
EP17709787.0A 2016-01-14 2017-01-13 Bordvorrichtung für ein fahrzeug Active EP3238182B1 (de)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PL17709787T PL3238182T3 (pl) 2016-01-14 2017-01-13 Urządzenie pokładowe do pojazdu

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
ITUB2016A009991A ITUB20169991A1 (it) 2016-01-14 2016-01-14 Sistema di comunicazione per dispositivi di esazione pedaggi autostradali o controllo accessi, dispositivo e metodo associato.
PCT/IB2017/050184 WO2017122165A1 (en) 2016-01-14 2017-01-13 On-board device for a vehicle

Publications (2)

Publication Number Publication Date
EP3238182A1 EP3238182A1 (de) 2017-11-01
EP3238182B1 true EP3238182B1 (de) 2019-04-24

Family

ID=55861096

Family Applications (1)

Application Number Title Priority Date Filing Date
EP17709787.0A Active EP3238182B1 (de) 2016-01-14 2017-01-13 Bordvorrichtung für ein fahrzeug

Country Status (6)

Country Link
EP (1) EP3238182B1 (de)
CL (1) CL2018001747A1 (de)
ES (1) ES2735805T3 (de)
IT (1) ITUB20169991A1 (de)
PL (1) PL3238182T3 (de)
WO (1) WO2017122165A1 (de)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IT201900010758A1 (it) * 2019-07-03 2021-01-03 Telepass S P A Dispositivo di bordo per servizi di traffico telematico
CN112365614A (zh) * 2020-10-10 2021-02-12 浙江省交通运输科学研究院 一种用于高速公路的车载交互装置、信息交互及收费系统
IT202100016715A1 (it) * 2021-06-25 2022-12-25 Telepass S P A Unita’ di bordo veicolare per servizi di traffico stradale con trasponder di comunicazione a radiofrequenza

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3156562B2 (ja) * 1995-10-19 2001-04-16 株式会社デンソー 車両用通信装置及び走行車両監視システム
ES2555468T3 (es) * 2013-04-19 2016-01-04 Kapsch Trafficcom Ag Instalación de a bordo para un vehículo
ES2627976T3 (es) * 2013-04-19 2017-08-01 Kapsch Trafficcom Ag Procedimiento para la carga de una unidad de a bordo con un tique electrónico
US9111123B2 (en) * 2013-06-28 2015-08-18 International Business Machines Corporation Firmware for protecting data from software threats
PL2860703T3 (pl) * 2013-10-08 2016-12-30 Sposób weryfikacji transakcji opłat drogowych oraz elementy do realizacji tego sposobu

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
CL2018001747A1 (es) 2018-10-26
ES2735805T3 (es) 2019-12-20
PL3238182T3 (pl) 2019-11-29
EP3238182A1 (de) 2017-11-01
ITUB20169991A1 (it) 2017-07-14
WO2017122165A1 (en) 2017-07-20

Similar Documents

Publication Publication Date Title
US10078831B2 (en) Connected toll pass
EP2498225B1 (de) Straßenmautsystem und Verfahren
AU2005304254B2 (en) Method and system for the user-specific initialization of identification devices in the field
US20190058591A1 (en) Systems and methods of providing and electronically validating tickets and tokens
CN104468784B (zh) 一种通过dsrc接口实现车载单元软件升级的系统及方法
JP4167490B2 (ja) 道路通行料徴収システム
KR20120116924A (ko) 차량 액세스 제어 서비스 및 플랫폼
US11716194B2 (en) Vehicle communication for authorized entry
EP3238182B1 (de) Bordvorrichtung für ein fahrzeug
JP2014509414A (ja) ゲートのあるエリアへの安全なアクセスのための方法、装置、およびシステム
CN112888607B (zh) 辨识输送的乘客和货物的方法和设备
US20140316992A1 (en) Method for charging an onboard-unit with an electronic ticket
JP3445490B2 (ja) 移動体通信方法および移動体通信システム
EP3416352B1 (de) Bordvorrichtung für ein fahrzeug
EP2716510B1 (de) Authentifizierungssystem und Verfahren für einen Fahrzeugpark
JP2013258491A (ja) カーシェアリングシステム、カーシェアリング提供方法
JP2014215705A (ja) 車載器制御システム
WO2018213198A1 (en) Systems and methods of providing and electronically validating tickets and tokens
JP5310090B2 (ja) 決済システム
ES2712643T3 (es) Método para la transmisión a través de una red de telecomunicaciones de una información de autorización o de una autorización asociada con un terminal de telecomunicación, terminal de telecomunicación, sistema, programa informático y de programa informático
EP4109416A1 (de) Fahrzeugeinheit für den strassenverkehr mit einem transponder für funkkommunikation
JP6580868B2 (ja) 情報提供システム、情報提供方法及びコンピュータプログラム
JP2003006791A (ja) 情報処理システム，車載機，路側機
JP2002095050A (ja) 情報伝送システム、無線通信装置および移動体
JP2013093063A (ja) 決済システム及び警告方法

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20170726

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 1246479

Country of ref document: HK

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20180919

GRAJ Information related to disapproval of communication of intention to grant by the applicant or resumption of examination proceedings by the epo deleted

Free format text: ORIGINAL CODE: EPIDOSDIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

GRAR Information related to intention to grant a patent recorded

Free format text: ORIGINAL CODE: EPIDOSNIGR71

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTC Intention to grant announced (deleted)
INTG Intention to grant announced

Effective date: 20190214

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1125031

Country of ref document: AT

Kind code of ref document: T

Effective date: 20190515

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602017003524

Country of ref document: DE

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20190424

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

REG Reference to a national code

Ref country code: GR

Ref legal event code: EP

Ref document number: 20190402150

Country of ref document: GR

Effective date: 20191016

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190724

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190824

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190724

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2735805

Country of ref document: ES

Kind code of ref document: T3

Effective date: 20191220

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190824

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602017003524

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

26N No opposition filed

Effective date: 20200127

REG Reference to a national code

Ref country code: AT

Ref legal event code: UEP

Ref document number: 1125031

Country of ref document: AT

Kind code of ref document: T

Effective date: 20190424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200113

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200131

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200131

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200113

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20210113

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210113

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

REG Reference to a national code

Ref country code: DE

Ref legal event code: R081

Ref document number: 602017003524

Country of ref document: DE

Owner name: MOVYON S.P.A., IT

Free format text: FORMER OWNER: AUTOSTRADE TECH S.P.A., ROMA, IT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190424

REG Reference to a national code

Ref country code: ES

Ref legal event code: PC2A

Owner name: MOVYON S.P.A.

Effective date: 20220701

REG Reference to a national code

Ref country code: BE

Ref legal event code: HC

Owner name: MOVYON S.P.A.; IT

Free format text: DETAILS ASSIGNMENT: CHANGE OF OWNER(S), CHANGE OF OWNER(S) NAME; FORMER OWNER NAME: AUTOSTRADE TECH S.P.A.

Effective date: 20220607

REG Reference to a national code

Ref country code: AT

Ref legal event code: HC

Ref document number: 1125031

Country of ref document: AT

Kind code of ref document: T

Owner name: MOVYON S.P.A., IT

Effective date: 20221025

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230124

Year of fee payment: 7

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20230118

Year of fee payment: 7

Ref country code: BE

Payment date: 20230119

Year of fee payment: 7

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230529

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: PL

Payment date: 20231221

Year of fee payment: 8

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GR

Payment date: 20240122

Year of fee payment: 8

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: ES

Payment date: 20240227

Year of fee payment: 8

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: AT

Payment date: 20240122

Year of fee payment: 8

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240119

Year of fee payment: 8