IL101263A - Process for data protection during data transmission in a taximeter - Google Patents

Abstract

A method for data protection during a data transfer, particularly of tariff parameters in a taximeter or distance drive meter by means of using a signature calculation and a display is described. To protect a correct transmission of the tariff parameters, the signature R(x) (= remainder of a division) is determined after the parametrisation of the device has been completed, and conveyed in a sealed form to the Board of Weights and Measures. Taximeter devices with newly entered parameter set can be checked in abbreviated manner at the Board of Weights and Measures by means of a new device-internal calculation and indication of the signature R(x) and comparison with the conveyed signature R(x). <IMAGE>

Description

PROCESS FOR DATA PROTECTION DURING DATA TRANSMISSION IN A TAXIMETER ; i naioa D>.iinj niayn *it>na__ D^aina imni> •p nn Process for data protection during data transmission in a taximeter The invention relates to a process for data protection during data transmission, in particular of tariff parameters in a taximeter or odometer by means of a signature calculation and a display.

A series of processes are known from serial data transmission, which use the above-mentioned process comprising a data stock and the appending of a remainder from a polynomial division to form the code word to be transmitted. In this connection, the reader is referred for example to the literature indicated below: "Codierung zur Fehlerkorrektur und Fehlererkennung [Coding for error correction and error recognition]" printed by R. Oldenburg, Munich, Vienna (ISBN: 3-486-39371-5), in particular chapters 3.4.2 and 4.1.2. The code word is then divided again in the receiver by the generator polynomial used in the transmission, expecting the remainder to be 0. Formation of the security code (remainders) and checking after reception are generally carried out by feedback shift registers, with the feedback points generally being determined by the polynomial description of the data stock or of the generator polynomial. The relationships between these are explained in a paper with the title "Datensicherung auf Ubertragungswegen mit zyklischen Codes [Data protection over transmission paths using cyclic codes]" by Reiner Munchrath, published in the periodical ELEKTRONIK, 1976, Issue no. 8 on pages 55 to 59.

Data stocks on rotating media (disks) are also typically protected using cyclic codes, in this case, as also in data transmission, the codes being designed such that typical errors are both recognizable as well as, under predictable circumstances, being correctable.

Data protection means for internal operation are often based on parity checks and are predominantly restricted to small data stocks . The task here is reduced to recognition and output of an error message or temporary reduction of the capacity of the data-processing program.

An advantage of checking using the process of a parity check is the uncomplicated and rapid formation of the security data (parity bits or parity words); a disadvantage consists in the "weakness" of the security, since in principle several data bit combinations exist for a single parity word or, with single-bit testing, also parity bits.

Furthermore, processes are known which use a signature test to ensure the correct signal profile in a digital circuit. A known test device for this purpose is designed such that signals are received in the circuit to be tested by means of a test pin and are entered cyclically in a feedback shift register in the test device. Here, the cycle must be generated in synchronism with the digital circuit to be tested. As a result, a four-digit hexadecimal number appears on the display of the test device. A corresponding hexadecimal number is specified in an associated circuit diagram, to the individual test points in a circuit, so that a service engineer can interpret a correct signal sequence without complicated testing and assessment by means of an oscilloscope.

Data protection by transmitting a security code (signature) in the use for securing parameters, in particular in the field of taximeters/odometers , to be accepted by the Weight and Measures Office, have not previously been carried out. However, shortening of the test of the parameter set with the Weight and Measures Office is urgently required, especially when further development of the devices leads to the occurrence of data lengths which no longer allow individual testing, for example by using lists .

It is the object of the invention to provide a process for shortened and rapid checking of the corrected transmission of parameters in a taximeter, for the passing of devices .

This object is achieved in the process specified in the characterizing part of Claim 1.

The sub-claims specify details regarding an advantageous embodiment of the process steps.

The invention is explained below with reference to the drawings, in which: Fig. 1 shows a flow diagram to explain the mode of operation of a taximeter having program selection, parameter load, duration of the signature, and Fig. 2 shows a front view of a taximeter with display and operating elements .

Fig. 2 shows the front view of a taximeter or odometer having a display 30 and four operating elements 31 in the form of keys Tl to T4, by way of which switches SI to S4 (not shown in more detail) on a printed circuit board are correspondingly actuated. The display 30 is also secured to the printed circuit board and may be read off through a glass front plate 32 in a front housing cover 33. The display 30 is divided into a plurality of controllable display elements and may be categorized into a main display 34, a secondary display 35, a charge stage display 36, a time calculation symbol 37, an error word display symbol 38 and six flags 41 to 46. The main display 34 comprises a six-digit number and during use serves to display the fare, the distance travelled, the check counter values, the parameters and the error display. The secondary display 35 is a four-digit number, by means of which during use a surcharge, a tip amount, a fixed value (e.g. distance amount ) , a maintenance index ( service ) , a functional display of the maintenance programs or a pulse count in test mode are displayed. In accordance with a controllable segment combination, the charge stage display 36 displays the tariff stage which has been selected by way of a figure. The time calculation symbol 37, in the form of a clock symbol, indicates the status of a time calculation within a charge stage. The flags 41 to 46 are user-assignable characters to aid in the display of special functions of the individual charge stages. The flag 41 as a rule serves to mark the charge stage 13, flag 42 serves to indicate a "total" position in a charge stage, and finally flag 43. serves as an indicator arrow to the functional position "free" printed on a mask 39. Flag 44 may for example mark a display of the check counters ; The flag 45/ when set, indicates release of a parameterization which takes place in conjunction with the setting of a switch 40 to appropriately indicated release contacts 47 (for "0") and 48 (for "1"). Furthermore, an eight-pin test socket 49 is provided which serves for data input/data output by way of a serial interface. The access way to the release contacts 47, 48 and to the test socket 49 is covered by a cover flap 50 and secured by a lead seal 51. For security against tampering, in particular for securing the tariff-relevant parameter data, the calling of the maintenance program and thus the possibility of release of datat input is protected by a lead seal 51. Before the maintenance program is called for parameter input via keys or via SCO , the lead seal 51 must therefore be broken, whereby other functions such as delete functions and a number of other test functions at the same time become open to use. By removing the lead seal 51 and the cover flap 50, the now accessible test switch 40 can be actuated and an influence on the previous data stock via key input and via serial communication (SCOM) is possible.

To determine a signature R(x), the data stock of a complete parameter set in the taximeter, comprising control data for determining the sequence of fare calculations (control functions for operation, symbol display, assignments of data to check counters, etc.) and data for fare determination, is subjected to a polynomial division after manual call of a program. Here, the division takes place in several steps, in that for example starting with the data of the highest value a bit-wise modulo 2 addition is carried out in the power of the generator polynomial G(x) (cf . in this regard chapter 3.4.2. from the literature cited, "Codierung zur Fehlerkorrektur und Fehlererkennung" ) .

The shift in the data stock D(x) by the degree of the generator polynomial G(x) which is otherwise conventional in data protection is not carried out here, since after the remainder has been determined this remainder is not appended to the data stock (cf. in this regard Chapter 1 from the literature cited at the beginning, "Datensicherung auf Ubertragungswegen mit zyklischen Codes").

The calculation also includes memory positions which are not alterable by inputting the parameters . These memory positions are loaded with defined values in the course of the production process . In this way, it is possible to incorporate for example externally non-visible assignment features which result in different signatures with a parameterization of the device which is otherwise the same. Such assignment features are suitable to separate for example business areas in different service stations or business areas of different authorized representatives. Alternatively, it is possible to ensure that only memory chips, in particular EEPROMs, which have been "authorized" by a service point are used for example for repair.

A typical application example for using the process according to the invention for testing the correctness of the input data by determining the signature R(x) is explained below. The starting point for using the signature R(x) is the provision of a tariff which is established for setting the taximeter devices in a particular local area. A change in tariff for a delimited compulsory travel area is also output or indicated. In accordance with this, in a first step the responsible representative of a taximeter manufacturing company produces by means of code tables or with the aid of a PC a parameter set comprising the following: a) Basic data determining general functions of the taximeter, b) Tariff stage data containing .the assignment of amounts, routes, times, displays and subsequent control functions , c) Parameters determining the fare, the distances, the times, calendar and clock data for processing time-dependent special tariffs and other variables . Here, it is assumed that the operating representative is authorized to carry out changes in tariff in devices, to test them and to lead-seal them as a precaution.

In a second step, the data are entered in a test taximeter and a subsequent test for correct functioning is carried out.

In the third step, a signature R(x) of the tested parameter set is produced and prepared for transfer to the responsible Weights and Measures Office. To this end, by means of operating keys in the test taximeter, a program is started which calculates a signature R(x) in accordance with the process described above and,, after calculation, displays it as for example a four-digit hexadecimal number. The signature R(x) is then sent to the responsible Weights and Measures Office in a sealed communication or by telephone.

A tariff adjustment of taximeter devices in taxi vehicles takes place for example in accordance with the following steps: 1. For adjusting the tariff data in the taximeter device, the taxi vehicle is taken to an authorized representative of the taximeter manufacturing company, where the lead seal of the taximeter is removed. 2. Following the release of a data input interface which may now be set, the previously tested tariff data are now input by means of a data copying device or with relatively small modifications (e.g. only an alteration of a distance parameter) by means of operating , keys . When inputting by means of operating keys, it is assumed that a complete parameter transfer to the device now to be parameterized has taken place in a previous tariff adjustment. This is necessary to ensure that unused parameters (unused tariff stages or parts of other parameters) do not falsify the signature R(x) to be generated . 3. After the data transmission has taken place, by calling the calculating program in the taximeter, the signature R(x) of the parameter set entered is created and displayed. The signature displayed in the taximeter display is now compared with the signature R(x) which was previously determined during creation and testing of the new tariff. 4. After the agreement of the signature R(x) calculated in the taximeter and the signature R(x) determined and conveyed during creation of the new tariff has been established, the taximeter device is lead-sealed and the taxi vehicle released for resumption of service. It is also possible after lead sealing to repeat a calculation of the signature R(x) and a comparison, for checking purposes . 5. After a period determined by law, the taxi vehicle must be presented once more to the responsible Weights and Measures Office for testing. In principle, it would be possible at this time to carry out data alterations in a tampering manner, in particular if alteration is possible without aids. When the taxi vehicle is presented once more, the Weights and Measures inspector first checks the signature R(x) of the parameter set by calling the calculation program in the taximeter and by comparing it with the signature R(x) which has been conveyed some time before by the taximeter manufacturer's representative. If there is an agreement in the comparison of the signature data, it can be assumed that the taximeter functions run correctly and that the fare formation as a whole is correct. A differentiated checking of the individual functions, in particular those which require adjustment of the calendar and the time clock, for testing calendar and time-dependent special tariffs can now be omitted.

If the signature R(x) does not agree, then in principle the Weights and Measures inspector can reject it or carry out a differentiated individual test.

After checking the parameter set by the process of determining the signature R(x)* other checks are conventionally also carried out, such as checking the distance matching. 6. After an inspection by the Weights and Measures Office, which may be shortened by the process indicated, the taxi vehicle can resume service.

Fig. 1 shows in a flow diagram the mode of operation of a taximeter with program selection, parameter load and generation of the signature R(x) . The program is started by the step 1 after applying an operating voltage or a power fade ( corresponding to cold start ) .

In stage 2 of the flow diagram, there is a branch to the two programs "program management maintenance" 4 or "taximeter program in normal operation" 3, in dependence on a control bit. Influence of the control bit is not shown in more detail and takes place in program stages 3 and 4, with the "program management maintenance" 4 being called in stage 3 if the device switch position is at FREE and a reset from stage 4 taking place in stage 4.

In the diagram stage 3, a taximeter program runs in normal operation; this means that all the standard program parts required for forming the fare and the surcharge are grouped together here (including substantially the following function stages: selection of charge stages, distance and time calculations, automatic charge stage switchovers, and many others). Here, "normal operation" means that the taximeter program runs without the influence of further test routines not shown here.

The program management maintenance in accordance with position 4 is used to select the programs from a list or to release the appropriately indexed program.

The switching stages in accordance with positions 5, 8 and 11 serve for optional assignment of a corresponding maintenance program in dependence on a selected index a, b, c and a release in switching stage 4, the release taking place by means of operating keys Tl to T4 which are predeterminable therefor in switching stage 4.

In the switching phases 6 and 9, in dependence on the setting of a lead-sealable switch 40, a maintenance program indicated in stage 4 and chosen by position 5 or 8 is called and operated. If the lead-sealable switch 40 is not closed, that is to say if authorization is not given, then operation of the corresponding maintenance program 5 or 8 is prevented.

Steps 7 and 10 contain maintenance programs for receiving and displaying parameters for operating the taximeter, in particular parameters for the calculation of the fares from distance and time components, as well as other control parameters which influence operation of the taximeter in normal operation in accordance with function stage 3. Stage 7 serves to receive the parameters by key input, whereas stage 10 controls the receiving of parameters by input by way of SCOM ( serial communication ) .

Finally, step 12 contains the maintenance program for generating the signature R(x) and for displaying the value R(x) found in the main display 34 of the taximeter device.

In accordance with function step 13, the index, chosen in stage 4, of the maintenance program to be activated is displayed until the release of the chosen program in stage 4. On releasing stage 4 and calling of the maintenance program, the display is overwritten by program-specific displays. On deactivation, the function stage 13 becomes active again and displays the current maintenance index.

Abstract Process for data protection during data transmission in a taximeter A process for data protection during a data transmission, in particular of a tariff parameter in a taximeter or odometer, by means of a signature calculation and a display, is described.

To ensure correct transmission of the tariff parameters, after production of the parameterization of the device the signature R(x) (= remainder from a division) is determined and communicated in sealed form to the testing Weights and Measures Office. Taximeter devices with a newly input parameter set can be checked at the Weights and Measures Office in a shortened manner in that a renewed calculation within the device and display of the signature R(x) is carried out and this is compared with the communicated signature R(x) .

Fig. 1

Claims (4)

13 Claims :

1. . Process for data protection during data transmission, in particular of a tariff parameter in a taximeter or odometer by means of a signature calculation and a display, characterized in that the signature R(x) known per se is applied in that to ensure correct transmission of the tariff parameters the signature R(x) is determined by authorized personnel after production of the parameterization of the device and this determined signature R(x) is communicated to the subsequently testing Weights and Measures Office, so that devices having a newly input parameter set can be checked in brief manner at the Weights and Measures Office, in that a renewed calculation within the device and display of the signature R(x) take place and this is compared with the communicated signature R(x).

2. Process according to Claim 1, characterized in that the basis for formation of the device-specific signature R(x) is a formal relationship, given below: D(x) G(x) = Q(x) + R(x) where D(x) is the data stock of the relevant parameters, G(x) is a constant, also called the generator polynomial, Q(x) is a quotient (not used) R(x) is a remainder of the division and these are at the same time designated as the signature, 14 and the generator polynomial G(x) representing a non-reducible polynomial .

3. Process according to Claim 2, characterized by determination of the generator polynomial G(x) such that the length of the generator polynomial G(x) is dependent on the quantity of the data stock, to form the signature R(x) from a cyclic hamming code, the degree of the generator polynomial k being at least k > Id n and n being the number of the data bits to be checked, in accordance with the following: D(x) = anxn+an-ixn"1+an-2xn"2+ ..+aix1+aox°; ai -> 0,1 G(x) = xk+bk-ixk_1+ . .+bix1+box(?

4. Process according to Claim 2, characterized by an inclusion of memory parts/cells in the signature test which cannot be written or read by inputting parameters, these memory parts/cells being preset to defined values in the course of production.