EP3188133A1 - Position data processing device and toll system and method for operating a position data processing device and a road toll system - Google Patents

Abstract

A position data processing device (1) and a method for operating such a position data processing device (1) are provided in which trajectories (TJ-1,..., TJ-n.) Generated with respect to position data detected by the position data processing device (1) ) trajectory-specific transactions are performed, which are limited in number. With each trajectory-specific transaction, the number of permissible trajectory-specific transactions is reduced, wherein the position data processing device (1) changes from a state of given operational readiness in which it performs trajectory-specific transactions to a state of non-operational readiness in which it does not perform trajectory-specific transactions, if Number of allowed trajectory-specific transactions is zero. According to a preferred embodiment, the number of allowed trajectory-specific transactions in response to a response message (231), the position data processing device (1) from a Betriebsmitteilungsauswertungssystem (2) receives, to which they previously the generated trajectory (TJ-1, ..., T Jn) has been set, in particular increased.

Description

The present invention relates to a position data processing device according to the preamble of patent claim 1, an operating message evaluation system according to the preamble of patent claim 11, a method for operating a position data processing device according to the preamble of patent claim 14 and a method for operating a toll system according to the preamble of patent claim 15.

For the purposes of toll collection, tolling devices, so-called on-board units (OBUs), are currently being installed in vehicles, especially in trucks. A toll device installed in the vehicle records position data indicative of the distance traveled by the vehicle while the vehicle is running. Corresponding to the recorded position data, which are also referred to below as trajectory or trajectory file, and in dependence on preprogrammed vehicle data, such as the emission class, the vehicle weight, the number of axles, etc., and in dependence on preprogrammed tariff data and other vehicle data that a driver entered into the toll, determined in prior art tolls, the toll meter itself the amount of toll to be paid and stores this information in a memory of the toll device.

The information about the amount of toll to be paid is sent to the previously known toll device by means of a communication device, for example via a GSM (Global System for Mobile Communications) network, to a toll center, that is to a central toll collection point. For example, the sending of this information takes place after reaching a certain toll or after a defined time. If the toll unit is switched off at this time, the information will be sent after the next time the toll unit is switched on.

In the toll center, the toll amounts to be paid are assigned to a registered user on the basis of a vehicle identification. Depending on whether the user has been granted a credit rating, invoices will then be sent or the amount deducted from a credit-account.

In locations where satellite-based reception of satellite data from which the position data can be generated is not possible, for example in tunnels or other shielded areas, position data may be transmitted directly via control devices, such as infrared based beacons, or any other communication standard of short range communication be transferred to the toll device. Such a transmission of position data to the tolling device takes place, for example, by means of a short range communication module, for example by means of a so-called DSRC (Dedicated Short Range Communication) module which is installed, for example, in the vicinity or on the windshield of the relevant vehicle and in operative connection with the tolling device stands. Data may also be transmitted from the toll device to the control device and thus to the toll center via such a module if, for example, no GSM network or other wireless communication network (for example UMTS or similar mobile radio network) is available.

If new toll tariffs are introduced, the data on the toll devices are updated centrally via mobile radio and controlled by the toll center.

The problem with the above-known prior art approach is that the toll device itself does not transmit trajectory files to the toll center, but only information about the fees to be paid, so that it can not be checked at the toll center, if the trajectory file, the tolling device for the calculation of fees underlying, has been recorded correctly, or if a tampering attempt has taken place. To detect such manipulation attempts, some approaches are known from the prior art.

For example, describes the EP 2 487 506 A1 a position determination device and a method for signaling a lack of operational readiness of a position determination device. In this case, a decision is provided for signaling a lack of operational readiness of a equipped with a GNSS (Global Navigation Satellite System) - receiver and a mobile radio receiver positioning device, both on the positioning quality of the GNSS reception of the GNSS receiver as well as on several detections of the mobile radio reception characteristic the mobile reception of the mobile receiver is based. Such a decision may be due to the registration of an insufficient GNSS reception of the GNSS receiver and the detection of a regular mobile radio reception of the mobile radio receiver and signaled by a signaling means of a signaling device included in the position determination device.
From the WO 2009/001303 A1 a toll collection system is known in which the tolling devices do not carry out the toll recognition and the toll fee calculation, but forward this work to an external entity, this redirection taking place anonymously, with which data protection purposes shall be pursued.

The DE 694 09 880 T2 describes a so-called structuring method for teletransaction objects of an on-board system. There, a toll device for storing a toll record includes a physical memory space partitioned into four logical memory spaces; wherein the logical spaces correspond to different areas of the physical space. For example, a first logical space corresponds to a physical space of a smart card and serves to store objects in the smart card. It names the DE 694 09 880 T2 as one of the main fraudulent applications in a toll device, that such a smart card is swapped prior to establishing a transaction between a fixed toll station and the entrained toll device. To detect such a fraudulent application, it is envisaged to record in a further logical memory space in the course of a transaction between the toll device and the fixed toll station modified objects, these objects also in the first logical memory space for the purpose of comparison with those of the further logical memory space in Moment of a next transaction are present. The addition of this additional logical memory space has the advantage that a link between the vehicle and the smart card will be made, thus providing a solution for controlling the fraudulent use of the toll device.

Object of the present invention is to propose means by which in a manipulation or a device defect in connection with the generation and / or the transmission of a trajectory, in particular in the form of a trajectory file, such a toll device can be placed in a state of lack of operability. This object is achieved by one or more objects of the independent claims. Features of advantageous embodiments are specified in the subclaims.

A first aspect of the present invention is the position data processing device according to independent claim 1.
A second aspect of the present invention is the
An operation notification evaluation system of the operation notification evaluation system of claim 11, which is adapted to manage at least one positioning data processing means according to the first aspect of the present invention. Third and fourth aspects of the present invention form methods for operating a position data processing device or a toll system according to claims 14 and 15.

In summary, the invention provides a position data processing device and a method for operating such a position data processing device, in which trajectories generated from position data acquired by the position data processing device are trajectory-specific transactions which are limited in number. With each trajectory-specific transaction, the number of permissible trajectory-specific transactions is reduced, the position data processing device changing from a state of given operational readiness in which it performs trajectory-specific transactions to a state of non-operational readiness in which it does not perform trajectory-specific transactions, if the number of permissible trajectory-specific transactions Transactions is zero.

In the following description, reference is made to all aspects of the invention.

The position data processing device according to the invention is suitable for being carried in or on a vehicle and in a state of given operational readiness not to signal a lack of operational readiness and / or a given operational readiness to receive or generate position data which are indicative of positions of the vehicle, depending on generate from the received or generated position data at least one trajectory indicative of a distance traveled by the vehicle to perform at least one trajectory-specific transaction with respect to the at least one generated trajectory, a number of allowable trajectory-specific transactions greater than zero due to the at least one performed reduce trajectory-specific transaction and switch to a state of non-operational readiness, if the number of permissible trajektorerpezifischen transactions Nul l is formed, and trained in the state of lack of operational readiness to perform no trajectory-specific transaction and signal a lack of operational readiness and / or no given operational readiness.

A trajectory is a sequence of at least two different location information representing at least approximately two locations that the vehicle has passed. In the simplest case, a trajectory thus consists of the position data of two successively generated or detected positions of the vehicle, each with a longitude value and a latitude value. In practice, a trajectory includes significantly more than two points, for example, one thousand to ten thousand points, each representing at least approximately a location that the vehicle has passed. The dates of these points do not necessarily coincide with the Position data of the detected or generated positions match. For example, the points of the trajectory may be the result of a selection of positions, a correction of positions, an interpolation between two positions, or a smoothing of multiple positions.
A trajectory may in particular be stored, at least temporarily, in the form of a trajectory file in the position data processing device, which comprises trajectory data in the form of longitude and latitude values of each point of the trajectory. Whenever there is talk of a trajectory in the course of the present documentation, it is implied that it can be stored, processed and transmitted in the form of a trajectory file. Whenever there is talk of a trajectory file in the course of the present documents, the trajectory file is synonymous with the trajectory and thus implies, with reference to data of a trajectory, any other form of data available to the person skilled in the art, for example when saving, Processing or transferring data.

A transaction is understood to be a sequence of program steps executed, for example, by a processor of the position data processing device (for example, the recording unit mentioned below), which are regarded as a logical unit. In this sense, the database of the position data processing device after the error-free and complete execution of the transaction is a consistent state, which requires that the transaction is carried out as such either complete and error-free or not at all. Examples of a transaction are the storage of data in a memory of the position data processing device, the transmission of data from the position data processing device to a location spaced from the position data processing device, the processing of a record from a defined initial state to a defined destination state - for example, the encryption of a record. A transaction which is specific to trajectory data, data from which the trajectory data were derived and / or data derived from the trajectory data takes place, for example as a function of data of the trajectory generated according to the invention or as a function of trajectory-specific transaction Position data on which the trajectory was generated. In this sense, a trajectory-specific transaction is a transaction in which data that is in context with a trajectory generated according to the invention are processed, for example by a processor of the position data processing device. If the position data processing device is designed to perform a plurality of different trajectory-specific transactions, then at least one of the various trajectory-specific transactions is distinguished as the one according to the invention, as a result of which the number of permissible trajectory-specific transactions according to the invention is reduced.

With the invention it becomes possible to determine the number of trajectory-specific transactions in the
Position data processing device and thus to limit the effects of any defect or any manipulation of the position data processing device.

In particular, the position data processing device is designed in a state of lack of operational readiness to carry out a trajectory-specific transaction with respect to no generated trajectory.
In particular, the position data processing device is designed in a state of lack of operational readiness not to generate a trajectory in dependence on the received or generated position data.

In particular, the position data processing device is configured in a state of inoperability not to receive or generate position data that is indicative of positions of the vehicle.

In particular, the position data processing device in the state of given operational readiness is designed to signal no lack of operational readiness, and in the state of lack of operational readiness to signal a lack of operational readiness.
Alternatively or optionally, the position data processing device in the state of given operational readiness is configured to signal a given readiness for operation, and in the state of inability to operate it is configured not to signal a given operational readiness.
In particular, the position data processing device in the state of given operational readiness is configured to signal a given operational readiness by outputting an optical, acoustic and / or electromagnetic signal. For example, the electromagnetic signal may be a radio signal transmitted from the position data processing device to a central device (eg, the service notification evaluation system or the toll control center) as a result of turning on / off the position data processing device with an operating current once and / or repeatedly at random times or on specific occasions.
In particular, the position data processing device is configured in a state of inability to signal a lack of operational readiness by issuing an optical, acoustic and / or electromagnetic signal. For example, the electromagnetic signal may be a radio signal transmitted from the position data processing device to a central device (eg, the service notification evaluation system or the toll center) remote from the vehicle as a result of the change to the non-operational state once and / or repeatedly at random times sent on certain occasions.
The signaling of the lack of or no given operational readiness can serve as an indication to the driver or an employee of the operation of the central device that in turn measures are required to restore the positioris data processing device to a state of given operating readiness. The signaling of no lack or a given operational readiness can serve the driver or an employee of the operation of the central device as an indication that he can rely on the normal operation of the position data processing device and in turn no action on the position data processing device is required.

In particular, the position data processing device in the state of given operational readiness can also be configured to send the at least one generated trajectory or a first reference value determined from the at least one generated trajectory according to at least one reference value determination method to an off-vehicle and off-vehicle operating message evaluation system.
In this case, the position data processing device is preferably configured in the state of non-operational readiness, no generated trajectory and no first reference value (RWA-1,..., RWA-n) determined from the at least one generated trajectory according to at least one reference value determination method to an outside and outside To send vehicle operating message evaluation system.

According to an advantageous further development, the position data processing device is in the state of readiness for operation due to or in the context of carrying out the trajectory-specific transaction the at least one generated trajectory or a first reference value determined from the at least one generated trajectory according to at least one reference value determination method within an operating message to an outside and sending off-vehicle off-line message evaluation system, receiving a response message sent by the on-line message evaluation system in response to the at least one sent message of service, and modifying the number of allowed trajectory-specific transactions to greater than zero, depending on the received response message; leave unchanged or set equal to zero.

Thus, on the one hand, it becomes possible to keep the position data processing means in a state of operational readiness automatically and without the cooperation of the driver or an employee of the operation of the operation notification evaluation system, if the evaluation of the sent operation notification by the operation notification evaluation system shows that there is no defect and no manipulation on the position data processing means , in particular to the data of the trajectory file (in this case, the response message contains, for example, the instruction to modify the predetermined number of allowable trajektoriespezifischen transactions to a number greater than zero) and on the other hand to put the position data processing device in a state of non-operational readiness when the Evaluation of the sent operating message by the Betriebsmitteilungsauswertungssystem indicates that a defect or tampering with the position data processing device, in particular on the data of the trajectory file is present (in this case, the response message contains, for example, the instruction to leave the number of allowed trajectory-specific transactions unchanged or equal to zero).
In particular - and this is the particular merit of the invention - the position data processing device automatically reaches the state of non-operational readiness when the defect or the manipulation at the position data processing device is such that the sending of the operating message from the position data processing device to the operation message evaluation system fails because the position data processing device is configured, with each trajectory-specific transaction to reduce the number of (remaining) allowable trajectory-specific until the number of allowed trajectory-specific transactions is zero, without (in the absence of sent operating messages) a response message increasing the predetermined number of allowed trajectory-specific transactions Service message evaluation system could receive.

In particular, the position data processing device in the state of given operational readiness is configured to receive a response message which the operating message evaluation system has sent as a function of an evaluation of the at least one sent operating message.
The position data processing device may be configured in a non-operational state to receive a restart operation message from the operation message evaluation system and the number of allowable trajectory-specific transactions depending on the received restart operation message to modify to a number greater than zero and to return to the state of given operational readiness.
For sending the operation message to the operation message evaluation system and for receiving response messages from the operation message evaluation system, the position data processing means preferably comprises or is connected to a communication device.

The position data processing device is designed, for example, as a toll device, which is designed, for example, for an arrangement in a vehicle. For example, the toll device is an on-board unit (OBU). Alternatively, the tolling device as a mobile device, such as a smartphone or tablet PC, and so far also be designed to be carried in a vehicle.
Preferably, the toll device has a data memory in which a user identification is stored. This user identification can be, for example, an identification of the toll device, the vehicle or the driver / holder / owner of the vehicle and serves for the assignment of data received or generated by the toll device, the represent the use of a toll road, to an instance on the basis of which the toll can be determined.

The position data processing device is managed, for example, by an off-vehicle service message evaluation system. For example, the operation notification evaluation system manages a plurality of toll devices each including a position data processing device. The service message evaluation system includes, for example, a toll center and / or one or more roadside controllers, the latter being mobile or stationary (eg, stationary toll booths). Alternatively, the service message evaluation system is comprised of a toll system having such a toll center and one or more such roadside controllers. For example, the toll center is configured to calculate, based on data of the received trajectory that the service message evaluation system received from a managed location data processing device, in particular a toll device, a toll charge associated, for example, with the user identifier stored in the toll device and together with or is sent independently of the trajectory by the toll device to the toll center with the purpose of assigning the toll fee to the toll road of the vehicle from which the position data processing device has been carried.

Thus, a position data processing device serving as a toll device can have a user identifier stored in the position data processing device, in particular an identifier of the vehicle or the position data processing device, and send the at least one generated trajectory to an outside and off-vehicle operating message evaluation system as part of an operating message and the Send user identification together with the trajectory in the context of the operating message or without the trajectory in an independent of the operating message identification message to the Betriebsmitteilungsauswertungssystem.
In this case, data technology ensures that the identification message is in a context to the operating message, so that the operating message evaluation system assigns the user identifier to the trajectory or to a result generated from the trajectory by the Betriebsmitteilungsauswertungssystem, for example, a Maütgebühr is possible.
Alternatively or optionally, a position data processing device serving as a toll device may have a user identifier stored in the position data processing device, in particular an identifier of the vehicle or the position data processing device, and be configured to determine from the at least one trajectory a toll road section traveled by the vehicle and / or at least one toll and to send at least one first reference value, determined according to at least one reference value determination method from the at least one generated trajectory, to the operating message evaluation system as part of an operating message together with the user identification.

Preferably, the position data processing device has a receiver which is designed to receive and / or to generate position data which are indicative of the position of the vehicle. The receiver is, for example, a Global Navigation Satellite System (GNSS) receiver configured to receive satellite signals and to generate the position data in response to the received satellite signals. For example, the satellite signals are GPS, GLONASS, GALILEO or COMPASS signals. However, the position data can also be transmitted by stationary roadside devices, for example so-called support beacons, which passes the vehicle and received by the receiver of the position data processing device, which in this case can be designed as a DSRC receiver.

Coupled to the receiver is preferably a recording unit included in the position data processing device, which is designed to generate trajectories, for example in the form of trajectory files, as a function of the position data. Each of the trajectory files is indicative of a distance traveled by the vehicle. Thus, for example, a trajectory file includes a set of positional data that the receiver has generated and / or received during a time period. The generation of the trajectory files by the recording unit takes place, for example, at intervals, for example at time intervals or in distance intervals. By way of example, the recording unit is thus designed to store, in particular to store, in a trajectory file for all position data which has been received and / or generated during the passage of a specific route interval of a specific length of, for example, 100 km. In another embodiment, the recording unit is designed, for example, to store the position data, which has been received and / or generated during a past time interval, in a trajectory file, in particular to store it. For example, the recording unit creates a new trajectory file for all position data received and / or generated in a time interval of a few minutes or hours.

For storing the trajectory file, a memory may be provided in the position data processing device, which memory can be operated by the recording unit.

The recording unit is also preferably configured to provide at least one of the trajectory files to a communication device of the position data processing device for transmission as part of at least one operating message to the service message evaluation system, wherein the communication device is further configured to receive a response message of the service message evaluation system that the operating message evaluation system in response to an evaluation of at least has created an operating message. In particular, the operation notification evaluation system generates the response message depending on the evaluation result of the evaluation of the operation notification. First, the communication device thus transmits the at least one trajectory file to the service message evaluation system and, for example, receives said response message in response thereto.

The position data processing device may further comprise a security module. With the security module, certain processing steps of the position data processing device can be performed. Such a security module is configured, for example, as a chip card. A security module is, for example, a "specially protected" independent unit, for example a chip card, which has at least one autonomous control module and a memory area, wherein the autonomous control module is preferably configured to request for data from the memory area and / or the change or Recording data in memory only against authentication. The authentication procedure can be carried out by analyzing a digital signature by means of a public key stored by the signer in the security module.

The position data processing device preferably has at least one processor, for example in the form or comprising of the recording unit, which is designed to be ready for operation at least in the state of generating the at least one trajectory in dependence on the received or generated position data; In addition, the position data processing device preferably has at least one security module which is embodied at least in the state of ready operational readiness to carry out at least one trajectory-specific transaction, the processor being configured at least in the state of ready operability to provide the security module with the generated trajectory for performing the trajectory-specific transaction. The provision can take place in that the processor deposits the trajectory in a data memory of the position data processing device from which the security module can retrieve the trajectory, for example after the security module has received a message from the processor that this trajectory for the security module is stored in the data memory has been.
Alternatively, the provision can be made by the processor transmitting the trajectory to the security module.

In addition to generating the trajectory files, the position data processing device, for example the recording unit or the security module, according to an embodiment is further configured to determine a first reference value from the data of the trajectory (file) (trajectory data) according to a reference value determination method. The reference value determination method includes, for example, a hash algorithm, and the first reference value is, for example, a hash value. For example, in the implementation of the reference value determination method, the recording unit performs a cyclic Redundancy Check (Cyclic Redundancy Check; CRC). As a result, the first reference value is, for example, a CRC value. Thus, the position data processing device can deterministically determine a reference value from data of the trajectory in accordance with the reference value determination method. This reference value determination can be encompassed by, form, follow or follow the trajectory-specific transaction.

The specification of the number of permissible trajectory-specific transactions can, for example, be made expressly by means of a counter which, for example, names a number of 10 or 20 or another number of permissible trajectory-specific transactions. However, the number can also be predetermined indirectly, for example by a number of available TANs or a number of available memory locations in a memory area of the security module. These variants will be discussed in more detail later.

With each trajectory-specific transaction that the security module makes to a trajectory file, the number of allowed trajectory-specific transactions is automatically reduced, in particular independently of a response message from the operational message evaluation system. This reduced number then in turn forms the predetermined number for the next trajectory-specific transaction, unless the predetermined number is determined in the meantime, for example as a function of the received response message. In particular, the number of permissible trajectory-specific transactions can also be zero. In this case, the position data processing device, in particular the security module, does not perform a trajectory-specific transaction. She then refuses her service.
In particular, in the absence of execution of the trajectory-specific transaction, no dispatch of the operating message comprising the generated trajectory to the operating message evaluation system takes place, because the transmission of such an operating message takes place only as a result of or in the context of carrying out the trajectory-specific transaction.

• die Entgegennahme wenigstens eines der ersten Referenzwerte und/ oder einer der Trajektoriendateien von der Aufzeichnungseinheit durch das Sicherheitsmodul;
• fakultativ das Speichern wenigstens eines der ersten Referenzwerte und/oder wenigstens einer der Trajektoriendateien in einem Speicherbereich des Sicherheitsmoduls;
• Berechnen eines ersten Prüfwerts für wenigstens einen der ersten Referenzwerte und/oder für wenigstens eine der Trajektoriendateien;
• fakultativ das Speichern wenigstens eines der ersten Prüfwerte in dem Speicherbereich des Sicherheitsmoduls; und/oder
• Bereitstellen wenigstens eines der ersten Referenzwerte und/oder eines der ersten Prüfwerte für die Aufzeichnungseinheit, sodass der bereitgestellte wenigstens eine erste Referenzwert und/oder der wenigstens eine erste Prüfwert im Rahmen der Betriebsmitteilung von der Kommunikationseinrichtung an das Betriebsmitteilungsauswertungssystem übermittelt werden kann/können.

For example, a trajectory-specific transaction includes:

• accepting at least one of the first reference values and / or one of the trajectory files from the recording unit by the security module;
• optionally storing at least one of the first reference values and / or at least one of the trajectory files in a memory area of the security module;
• Calculating a first check value for at least one of the first reference values and / or for at least one of the trajectory files;
• optionally storing at least one of the first check values in the memory area of the security module; and or
• Providing at least one of the first reference values and / or one of the first test values for the recording unit so that the provided at least one first reference value and / or the at least one first test value can be transmitted by the communication device to the Betriebsmitteilungsauswertungssystem within the operating message.

In particular, the position data processing device may be configured to carry out at least one of the following steps during the execution of the trajectory-specific transaction or outside thereof: (a) the at least temporary storage of trajectory data in a security module of the position data processing device; (b) sending the trajectory as part of an operational message to an off-site and off-vehicle message reporting system; (c) the determination of a first reference value from the trajectory according to at least one reference value determination method, (d) the at least temporary storage of a first reference value determined from trajectory data according to at least one reference value determination method in a security module of the position data processing device.

In particular, the position data processing device, in particular the security module, can be designed to determine a first reference value from trajectory data (data of the trajectory file) in the course of the execution of the trajectory-specific transaction or outside thereof, and the position data processing device is configured to (a) generate the first reference value first reference value in the context of an operating message together with the trajectory from whose data the first reference value was determined, or (b) within the scope of a separate second operating message temporally spaced from a first operating message as a reference value message by means of a communication device to the operating message evaluation system after or before the trajectory in the context of the first operating message as a trajectory message by means of a communication device to the Betriebsmitteilungsauswertungssyste m was or will be shipped. In particular, in the case of (a) the position data processing device comprises a long-range communication with base stations of a mobile radio network connected to the operating message evaluation system and a processor embodied-for example in the form of the recording unit or of the recording unit-which is designed to communicate the trajectory (in the form of Trajectory data or as a trajectory file) and providing the first reference value and instructing the first communication device to send the first operational message having the trajectory and the first reference value to the operational message evaluation system. In particular, in case (b), the position data processing device comprises a communication device for long-range communication with base stations of a mobile network connected to the service message evaluation system, the position data processing device further comprising a processor, for example in the form of the recording unit or of the recording unit, which is designed for the communication device provide the trajectory (in the form of trajectory data or as a trajectory file) and instruct the first communication device to send the first operating message with the trajectory to the service message evaluation system and to provide the communication device with the first reference value (eg in the form of first reference value data) the communication device is designed to receive the first reference value in response to a signal received via the mobile radio network from the operating message gsauswertungssystem sent to send a request message in the context of the second operating message to the Betriebsmitteilungsauswertungssystem over the mobile network.
By way of example, the said communication device is a mobile radio communication device, for example a mobile radio module, for example a GSM module, a UMTS and / or an LTE module.

Alternatively, in case (b), the position data processing means may include a first communication device for long-range communication with base stations of a mobile network connected to the operation message evaluation system and a second communication device for short-range communication with roadside controllers connected to the operation message evaluation system or included in the operation message evaluation system, the position data processing means further comprising Processor - for example in the form of the recording unit or from the recording unit - configured to provide the trajectory (in the form of trajectory data or as a trajectory file) to the first communication device and instruct the first communication device to send the first operating message with the trajectory to the operating message evaluation system send, and the second K ommunikationseinrichtung the first reference value (z. In the form of first reference value data), wherein the second communication device is configured to send the first reference value to the roadside control device in response to a request message received from the roadside controller as part of the second operational message.
By way of example, the said first communication device is a mobile radio communication device, for example a mobile radio module, for example a GSM module, a UMTS and / or an LTE module. For example, the said second communication device is a DSRC communication device, for example a DSRC communication module.

In particular, the position data processing device, in particular the security module, may be configured to perform the determination of a reference value according to at least one reference value determination method by applying a cryptographic function, in particular a hash function or a CRC function, generating the first reference value to trajectory data, such that the reference value is cryptographic.Value, in particular as a hash value or CRC value is formed.
In particular, the reference value determination may be a possible trajectory-specific transaction.

In particular, the position data processing device, in particular the security module, can be designed to carry out the trajectory-specific transaction by a transaction based on the first reference value derived from data of the trajectory. This trajectory-specific transaction related to the first reference value may comprise the storage of the reference value in the security module, the sending of the first reference value as part of an operating message together with the trajectory, or in the context of an operating message as a reference value message without the trajectory.

For example, the position data processing device, in particular the security module, is configured to perform a respective trajectory-specific transaction only when a response message has been successfully authenticated by the operational message evaluation system. For these purposes, the position data processing device is preferably designed to authenticate the response message using at least one key. In this case, for example, a public key is used which is present both for the position data processing device and for the operating message evaluation system, and / or a private key which is present only for the position data processing device. The key or keys are stored in the security module according to one embodiment. The aspect of authentication will be discussed later.

The recording unit is designed, for example, to provide at least one of the trajectory files and at least one of the first reference values to a communication device of the position data processing device for transmission as part of the at least one operating message to the operating message evaluation system. The operation message evaluation system then receives both the at least one trajectory file and the at least one first reference value associated with the at least one trajectory file, which has thus determined, for example, the recording unit or security module for the at least one trajectory file according to the reference value determination method. For these purposes, the operation message evaluation system comprises a message receiver adapted to receive the operation message of the position data processing means. In this case, as described in more detail below, the operating message may include a trajectory message with the at least one trajectory file and a reference value message with the at least one first reference value. The message receiver comprises, for example, a number of first receiving modules for receiving the trajectory message and a number of second receiving modules for receiving the reference value message. For example, at least one of the second receiving modules is disposed at a roadside controller of the service message evaluation system.

The operation notification evaluation system makes an evaluation of the received operation notification.

On the basis of the evaluation of the operating message should be checked centrally, whether a manipulation attempt or a defect in the position data processing device is present. This can be done, in particular, by the operating message evaluation system determining a second reference value for each received trajectory file in accordance with the same reference value determination method used in the position data processing device.

For example, the operational message evaluation system performs a first comparison for a respective trajectory file, between the second reference value and the first reference value associated with the respective trajectory file. If these two values do not agree with each other, the service message evaluation system may conclude that a tampering attempt has occurred. If the first reference value and the second reference value coincide with one another, then the operating message evaluation system can evaluate this as an indication that no manipulation attempt is present.

Already, for example, the automated evaluation of the trajectory file alone may be sufficient to allow the Betriebsmitteilungsauswertungssystem to detect a deficiency in the operation of the position data processing device: For example, interpret intervals between two in the trajectory immediately successive positions that are incompatible in size with a usual driving speed (so-called position jumps) on spoofing, with which the receiver incorrect satellite or position data was fed or a temporary failure of the receiver. An unusually large dispersion within a group of multiple, immediately adjacent positions indicates a receiver defect or jamming that interferes with the reception of satellite data.

In any case, the Betriebsmitteilungsauswertungssystem creates depending on the evaluation of the operating message, the response message and transmits them back to the position data processing device, for example according to a wireless communication standard, such as GSM, DSRC, UMTS etc .. The creation of this response message will be discussed later.

The communication device of the position data processing device is configured to receive the response message created and sent by the service message evaluation system and to make this or a message content of the response message available to the recording unit and / or the security module by means of the recording unit.

For example, position data processing means provides the received by the communication means the received response message of the Betriebsmitteilungsauswertungssystems or a meaningful message to the security module by means of the recording unit. The security module is designed in this case to modify the number of predetermined allowable trajectory-specific transactions in response to the response message to a number greater than zero.

If, for example, no reply message is received, there is no modification of the number of permissible trajectory-specific transactions. The response message may also indicate that the number is not to be modified. However, if the service message evaluation system-side evaluation of the at least one service message indicates that the number is to be modified, the response message contains a corresponding request and the security module modifies the number.

In particular, modifying the number of permissible trajectory-specific transactions may include increasing the number.

In the case of a count, the number indicated by the count is increased accordingly, for example from 5 to 8 or from 9 to 10, depending on the contents of the reply message. If the specification of the number of permissible trajectory-specific transactions is based on the number of available TANs and if the response message contains one or more new TANs, the number of permissible trajectory-specific transactions is modified by including the new TANs. In the case of a specification of the number of permissible trajectory-specific transactions by a number of available memory locations, new memory locations are released as a function of the response message, for example by deleting previously occupied memory locations. The above variants will be explained in more detail later.

One advantage of the present invention is that it is possible to determine on the central side, that is to say the operating message evaluation system side, based on the evaluation of the operating message whether there is a manipulation attempt and / or a defect in the position data processing device or not. Includes the service message evaluation system a manipulation attempt and / or a defect, it does not send, for example, a reply message or a reply message which prohibits a modification of the number of permissible trajectory-specific transactions, in particular an increase of the number. In any case, since the number of permissible trajectory-specific transactions is reduced (irrespective of the response message) with each trajectory-specific transaction, the trajectory-specific transaction is then suppressed if this number is zero. If so, the position data processing device enters a state of non-operational readiness, which can be detected by the operating message evaluation system based on the lack of operational readiness signaling. Then appropriate measures can be initiated centrally. The response message may also indicate immediately that the position data processing device is to be put into this state, for example by requesting the position data processing device to set the number of permissible trajectory-specific transactions to zero.

If the number of permissible trajectory-specific transactions is zero, for example, the security module generates an error message and the position data processing device uses this error message to enter the state of non-operational readiness, for example to block the operation of the position data processing device and / or to notify the operational message evaluation system of a tampering attempt. These measures can be taken even if, for example, a user prevents the transmission of the operating message by the communication device, for example by covering a transmitting antenna coupled to the communication device, since no response message is sent out to the absence of the operating message from the operating message evaluation system and only the response message thereto can increase the number of allowed trajectory-specific transactions. If the reception of the response message and / or the reply message does not indicate that the number is to be increased, this leads to the number of permissible trajectory-specific transactions resulting from the constant reduction of the number of permissible trajectory-specific transactions with each trajectory-specific transaction Reaches zero and thus to the production of the error message, so that the position data processing device and / or the Betriebsmitteilungsauswertungssystem can conclude the presence of a tampering attempt.

An outstanding advantage of an embodiment of the position data processing device thus consists in the fact that a transfer of trajectory files, which or whose reference values have already been processed by the security module within the scope of a trajectory-specific transaction, is prevented by the operating message evaluation system in the absence of corresponding response messages In this case, the position determination device automatically leads, by the number of remaining trajectory-specific transactions automatically reduced with each trajectory-specific transaction, into a state in which trajectory-specific transactions are no longer performed by the security module. The same applies in the case of a deletion of the trajectory file before its intended transmission to the operating message evaluation system.

Hereinafter, further preferred embodiments of the present invention will be explained. The further features of these preferred embodiments can be used together as well as with the optional ones already described above Characteristics for forming further embodiments are combined, unless they are expressly described as alternatives to each other.

In a preferred embodiment of the position data processing device, the position data processing device is designed to enter a state of inoperability if the number of permissible trajectory-specific transactions is zero. For example, in such a case, the security module of the recording unit refuses the requested processing of the trajectory file and / or the first reference value optionally determined for the trajectory file, whereupon the recording device generates a corresponding error signal.

For example, the position data processing device is designed and configured to optically communicate such a state to a user of the position data processing device, for example by means of a signaling device of the position data processing device provided for this purpose, for example by means of a red-colored LED. By way of example, the position data processing device is designed to transition into a state of inoperability even if the response message indicates that the position data processing device is to be transferred to this state.

Thus, for example, the position data processing device automatically assumes a state of non-operational readiness if either the number of permissible trajectory-specific transactions is zero or because the response message immediately indicates that the position data processing device is to be transferred to this state, for example by virtue of the position data processing device being configured from such a response message set the number of allowed trajectory-specific transactions equal to zero.

In a preferred embodiment, the security module is configured to cause the transition to the idle state, for example, if either the number of allowed trajectory-specific transactions is zero, or because the response message immediately indicates that the position data processing device is to be transitioned to that state.

The state of lack of operational readiness means, for example, that the position data processing device no longer fulfills its intended function, which may be required for toll collection, for example. For example, the position data processing device thus omits the generation of trajectory files and / or the transmission of the operating message, for example the transmission of the trajectory message and / or the reference value message.

The position data processing device is preferably designed to automatically communicate the transition to the state of lack of operational readiness to the operating message evaluation system, for example by means of a message intended for this purpose. On the central side, it can then be easier to detect that a manipulation attempt has been made in the relevant position data processing device and corresponding measures can then be managed and initiated on the central side.

In one embodiment of the position data processing device, the recording unit comprises a processor which is designed to carry out the function of the recording unit, in particular to generate trajectory files as a function of the position data.

For example, a computer program executed on the processor of the recording unit comprises commands by means of which the optionally provided signaling device converts from a state in which it signals the existing operational readiness, for example by a green-emitting LED, into a state in which it detects the lack of operational readiness of the position data processing device , in particular the lack of operational readiness of the recording unit, signaled, for example, by a red-lit LED.

For example, the state of lack of operational readiness is generated and stored in the form of a data element representing this state. In one embodiment, the position data processing device is designed to transmit the data element to the operating message evaluation system by means of the communication device, for example at the request of a roadside control device to the relevant roadside control device.

In a further embodiment of the position data processing device, the operating message comprises a trajectory message and a reference value message. For example, during a first communication phase, the communication device is designed to transmit one or more of the trajectory files generated by the recording unit to the operating message evaluation system in the context of the trajectory message. The transmission of the trajectory message, for example, via a wireless communication network, such as the GSM network. But there are also other transmission paths into consideration, for example, a UMTS network or other data packet mediating communication network.

For example, during a second communication phase, the communication device transmits at least one of the first reference values by means of the reference value message. The communication device therefore preferably transmits the trajectory files, on the one hand, and the first reference values, on the other hand, in separate messages to the operating message evaluation system.

The transmission of first reference values on the one hand and trajectory files on the other hand in separate messages is expedient because the respective file types can be different: Usually, a trajectory file is used for charging a toll, whereas by means of the first reference value is to be checked in particular whether in the position data processing means Manipulation attempt has been or is present or not. In addition, an embodiment provides that the communication device is designed to transmit the trajectory message to the service message evaluation system according to a first communication standard, for example GSM, and a short range communication module comprising the position data processing device transmits the reference value message via a second message transmission state, for example a DSRC standard to transmit to the business message evaluation system.

In order to ensure an unambiguous association between the first reference values on the one hand and the trajectory files on the other hand, in one embodiment the position data processing device is expediently designed to provide a respective trajectory file and the first reference value determined for it with an identification, for example with a time stamp. A trajectory file and the first reference value determined for this then receive the same time stamp. Instead of a time stamp, another identification option or another identifier can be provided which ensures the assignability between first reference values on the one hand and trajectory files on the other hand.

In a further preferred embodiment of the position data processing device, the position data processing device, for example the recording unit, is designed to integrate a position data processing device identifier within the operating message, for example within the trajectory message and / or within the reference value message. This facilitates the central-side management of a plurality of position data processing devices by the operation notification evaluation system.

The position data processing device, in particular a safety module encompassed by the position data processing device, is designed to determine one or more first test values for the at least one trajectory and / or for at least one first reference value determined by the position data processing device from trajectory data according to at least one reference value determination method according to a test value determination method, and that
the position data processing device is designed to transmit the at least one trajectory and / or the at least one first reference value together with the associated first test value as part of the operating message to the operating message evaluation system

For example, in a preferred embodiment of the position data processing device, the security module is designed to determine one or more first test values for the respective trajectory file and / or the respective first reference value according to a test value determination method. For example, the security module stores the first check values in a memory area of the security module.

The security module is preferably designed to determine a first test value for each first reference value according to the test value determination method and to store it together with the first reference value in the memory area of the safety module.
This test value determination can also be considered to be a trajectory-specific transaction according to the invention, because the first test value is determined from a first reference value, which in turn was determined as a function of data of the generated trajectory.

If the first reference values are preferably determined by the recording unit of the position data processing device, the determination of the test values according to the test value determination method does not take over the recording unit but the safety module itself. The determination of the first test values is also preferred in a deterministic manner in dependence on the first reference value. Nevertheless, a random number may be involved in determining the test values, as explained below.

Preferably, the position data processing device is configured to transmit the at least one first reference value together with the associated at least one first test value within the context of the operating message, for example in the context of the reference value message to the Betriebsmitteilungsauswertungssystem. For this purpose, for example, the security module provides both the at least one first reference value and the at least one associated first check value by means of the recording unit of the communication device, so that the communication device can transmit these within the context of the operating message, for example in the context of the reference value message to the Betriebsmitteilungsauswertungssystem.

The security module preferably stores exactly one first reference value and one first test value determined in each memory location of the memory area. A pair of a first reference value and a first test value form, for example, a test data record which the position data processing device transmits to the operating message evaluation system as part of the operating message, for example in the context of the reference value message.

It is possible that the security module determines a separate first check value for each first reference value. Alternatively or cumulatively, the security module determines a first check value for a multiplicity of first reference values.

The check value determination method comprises, for example, a message authentication algorithm and the first check value, for example, a message authentication code. Specifically, for example, the security module employs a Message Authentication Code (MAC) method to determine the first check values for the first reference values.

Accordingly, it is preferable that the operation notification evaluation system is configured to calculate a second check value for each first received reference value according to the same check value determination method used in the position data processing means and to make a second comparison between the second check value and the first one associated with the respective first reference value Check value and for generating the response message as a function of the second comparison result.

The operating message evaluation system, for example, calculates the test value for each transmitted first reference value and compares the first test values, that is to say the test values transmitted by the position data processing device, with the second test values, that is to say with the self-calculated test values. For example, within the framework of the response message, the service message evaluation system only sends a request to the position data processing device to increase the number of permissible trajectory-specific transactions if both the first reference values correspond to the second reference values and the first test values coincide with the second test values. Determining the first check value by the security module and determining the second check value by the Betriebsmitteilungsauswertungssystem thus represents a further security step, with the conspicuous tampering with the trajectory files and / or at the first reference values are detected.

In a further preferred embodiment, it is provided that the position data processing device comprises a short range communication module which is designed for coupling to the recording unit and is designed to exchange data with a control device of the operating message evaluation system passed by the vehicle, wherein the short range communication module is preferably designed for storing a copy of the first test values and / or the first reference values so that the first test values and / or the first reference values can be read out by the control device and transmitted to a control center of the operating message evaluation system. The short-range communication module is, for example, a DSRC module of the position data processing device. This variant also facilitates the checking of the position data processing device for manipulation attempts, since it can be determined by the control devices passed by the vehicle whether the position data processing device correctly calculates, for example, the first test values and / or the first reference values. If this is not the case, this can be communicated by the control device to the control center of the operating message evaluation system so that sanctions can be initiated centrally.

In a further embodiment of the position data processing device, the response message contains a management request to the security module. The management request is verified by the security module prior to the execution of the administrative measure, for example as follows: The position data processing device receives in the response message a positive acknowledgment of the successful evaluation of the service message from the service message evaluation system together with a central MAC of this receipt created centrally by means of a centrally available key. Then, the security module receives the central MAC and at least parts of the receipt and attempts to emulate the MAC by applying a key available to it on the receipt or the transmitted parts of the receipt. If successful, the requested administrative action, for example a modification of a meter reading, an addition of new TANs, a release of memory locations, is carried out; in the case of failure, the requested administrative action is ignored or denied by submitting an error message to the incident notification system.

For example, the key used is formed from a master key and a random number generated by the service message evaluation system, the master key being known to the security module and the position data processing means receiving the random number with the acknowledgment so that the security module can emulate the key used.

In a further embodiment of the position data processing device, processing of the first reference value by the security module proceeds as follows: The security module receives the first reference value and creates a MAC using a public key of the service message evaluation system Reference value. Thereafter, the first reference value, the MAC and a sequence number and / or a TAN are returned to the recording unit, and the record number and / or TAN used is endorsed with a notation which prohibits reuse of the sequence number and / or TAN she completely. If a one-time key (session key) is formed by means of a random number and a base key (master key), the random number is also transmitted back to the recording unit with this data record. In this case, it is expediently provided with the first reference value and the MAC also to transmit the random number to the operating message evaluation system so that it can emulate the session key for verifying the MAC by means of the master key.

In one embodiment of the position-determining device, a component of the position-determining device which has at least the safety module has a device-side connecting element which is designed for connection to a corresponding vehicle-side receiving device for the component. The security module is arranged, for example, within a housing of the position data processing device and, in order to fulfill its function, is in operative connection with further components of the position data processing device, in particular with the recording unit.

In particular, information about the number of permissible trajectory-specific transactions is stored in the position data processing device, in particular in a memory area (141) of a security module (14) of the position data processing device, and the position data processing device, in particular the security module (14), is formed with each trajectory-specific transaction to change the information in such a way that the changed information indicates the reduced number of permissible trajectory-specific transactions.

For example, information about the number of permissible trajectory-specific transactions is stored in the security module, for example in said storage area of the security module, wherein the security module has, for example, said autonomous control module, which is designed to change the information with each trajectory-specific transaction in such a way that the changed information indicates the reduced number of allowed trajectory-specific transactions.

In the following, several variants are presented, how the number of permissible trajectory-specific transactions that may be performed by the security module can be specified and modified. The variants can also be combined in whole or in part:

a) Meter reading

For example, the number of permissible trajectory-specific transactions is predetermined by a count of a counter of the position data processing device, in particular of a security module of the position data processing device.

In one embodiment of the position data processing device, the security module comprises a counter that indicates a count. The count indicated by the counter is identical to the number of permissible trajectory-specific transactions.

For example, the counter reading is set to a default value when the position data processing device is first put into operation, such as 10, 20, 50, 100 or 200. With each trajectory-specific transaction applied by the security module to one or more trajectory files and / or one or more first reference values, for example with each storage of a first reference value or with each determination of a first test value, and / or with each provision of a first reference value or a first test value by means of the recording unit for the communication device, the counter is reduced by one.

In this embodiment, the answer message indicates whether the count is to be increased and to what extent. If no response message is received and / or the response message indicates that the counter reading is not to be increased, no corresponding modification of the counter reading takes place either.

If the count drops to zero, then the position data processing device goes into the state of lack of operational readiness, because no further trajektorypezifische transaction is performed by the security module more.

b) transaction numbers (TAN)

In a further embodiment of the position data processing device, the position data processing device or a security module encompassed by the position data processing device is configured to access a list of transaction numbers, the number of transaction numbers included in the list being indicative of the number of permissible trajectory-specific transactions. With each trajectory-specific transaction, for example, a TAN is invalidated by the position data processing device or the security module, for example deleted. Preferably, the list of transaction numbers is temporarily stored in a memory area of the security module.

For example, in this embodiment, the security module requires one TAN for each trajectory-specific transaction, for example, for each determination or storage of a first reference value and / or for each calculation of a first check value, each TAN of the list being usable only once.

In this embodiment, in the case of a positive first comparison result (and possibly in the case of a positive second comparison result), the response message contains one or more new TANs and the security module is preferably adapted to add the new TAN (s) to the list, whereby the number the permissible trajectory-specific transactions are increased. If, however, no reply message is received or if the reply message does not contain a new TAN, no increase in the number of permissible trajectory-specific transactions takes place either.

For example, a given TAN is a multi-digit number code. The number codes may be continuous or non-continuous. Each TAN of the list can be provided with a sequence number.

The position data processing device is preferably designed to integrate the TAN used for a specific first reference value and / or the sequence number associated with the TAN used into the operating message. This allows a still secure zeniralseitige management of the position data processing device.

The order of the TANs to be used may be predetermined by the service message evaluation system, for example by the response message. For example, the response message identifies the next TAN to be used or the next TANs to be used by means of the corresponding sequence numbers.

In another embodiment, the TANs are non-consecutively numbered character combinations that are always available in normal operation in a limited number and are each consumed by the processing of the first Referehzwerte by appropriately marked or stored together with the reference values become. In the case of normal operation, the security module will receive new TANs from the corporate message evaluation system as reference values of used TANs have been centrally verified. A lack of operational readiness is achieved if the safety module no longer has TANs available.

c) Limited number of memory locations

In a further embodiment, the security module comprises a storage area, wherein the storage area comprises a limited number of storage locations and the security module is configured to store a respective trajectory file and / or a respective first reference value in one of the storage locations, and wherein the number of free storage spaces is indicative of the number of allowed trajectory-specific transactions. For example, the limited number of memory locations is 100 memory locations. In this case, a maximum of 100 trajectory files and / or 100 first reference values can be stored in the memory area of the security module.

The security module is preferably designed to manage the memory area in dependence on the response message of the service message evaluation system.

In order to receive the trajectory files and / or the first reference values from the recording unit, the security module is, for example, wirelessly and / or wired coupled to the recording unit.

The security module is configured to manage the storage area in response to the response message of the service message evaluation system. For example, managing the storage area by the security module includes deleting one or more of the stored trajectory files and / or first reference values; releasing one or more of the memory locations so that the shared memory locations may be described with a new trajectory file and / or a new first reference value; and / or a Beauflagen one and / or a plurality of the memory locations with a write protection, so that the memory locations that are protected by a write protection can not be described with a new trajectory file and / or a new first reference value. For example, the write protection also includes an erase protection.

In order to operate the memory area, the security module comprises, for example, an autonomous control module which is designed to manage the individual memory locations of the memory area, for example for storing the trajectory files and / or the first reference values, for deleting certain trajectory files and / or first reference values, for enabling certain memory locations of the memory area and / or for loading certain memory locations with a write protection. In this case, the term "autonomous" means that the control module of the security module is designed to be operated by means of stand-alone operating software.

The response message of the service message evaluation system, in this embodiment, instructs the security module of the position data processing device to delete a number of specific trajectory files and / or first reference values identified by the response message from the storage area such that the thus released storage locations are used to store new trajectory files and / or new ones first reference values are available. However, the response message may also indicate that no memory space is to be released, such that the situation may arise that the security module may not place any further trajectory files and / or first reference values in its memory area; In this case, the number of allowed trajectory-specific transactions is zero.

The memory area of the security module of the position data processing device is thus managed by the response message and thus centrally by the Betriebsmitteilungsauswertungssystem.

An advantage of this variant for specifying and modifying the number of permissible trajectory-specific transactions lies, in particular, in the fact that the number of available memory locations in the memory area of the security module is reduced by one space with each newly generated trajectory file, ie with each newly determined first reference value, since each memory location of the memory area is configured to store only a single trajectory file and / or a single first reference value. If the response message therefore does not indicate over a longer period of time that stored trajectory files and / or first reference values are to be deleted and new free memory locations for new trajectory files and / or first reference values can be formed, the memory capacity of the memory area is exceeded and thus to an error message.

For example, the position data processing device uses this error message to enter the state of non-operational readiness, for example, to inhibit the operation of the position data processing device and / or notify the operation message evaluation system of a tampering attempt. These measures can also be taken when, for example, a user of the position data processing device prevents receiving and / or generating the position data by the receiver or prevents the transmission of the operating message, for example the trajectory message and / or the reference value message, for example by covering one of the Communication device coupled transmitting antenna, since then no response message is received by the Betriebsmitteilungsauswertungssystem and leads only to the response message, the security module releases memory locations in the memory area. If the reception of the response message and / or the response message does not indicate that no new storage space is to be released or no trajectory file and / or first reference value is to be deleted, this results in the storage capacity of the storage medium prescribed by the limited number of storage locations being exceeded Memory area and thus to produce the error message, so that the position data processing device and / or the Betriebsmitteilungsauswertungssystem can conclude the presence of a tampering attempt.

The memory locations of the memory area of the security module and / or the stored trajectory files and / or the stored first reference values are each provided, for example, with a consecutive serial number which is stored in the security module together with the first reference value and which in the context of the operating message, for example in the context of the trajectory message and / or as part of the reference value message, is communicated to the operational message evaluation system. This allows the service message evaluation system to determine if it has received the required trajectory files and / or reference values without gaps. If the service message evaluation system detects a gap due to a missing serial number, the transmission of a response message according to which one or more of the memory locations are released is omitted from the position data processing device.

By way of example, the security module is also designed to allocate transaction numbers to be used once to the individual memory locations of the memory area, for example by the response message requesting the deletion of individual entries from the service message evaluation system to the position data processing device and transmitting them in the row of their input, for example be linked to the first reference values to be sent and optionally first test values. For example, these transaction numbers form an independent identifier for the comparisons between the first reference values and the second reference values performed by the service message evaluation system, the service message evaluation system, which knows the assigned transaction numbers, associating each second reference value with such a transaction number, in the expectation that the transaction numbers, which were transmitted with the transmission of the first reference values, supplies a comparable data pair.

A second aspect of the present invention is an operation notification evaluation system for managing at least one position data processing device according to the first aspect of the present invention, wherein the position data processing means is adapted to send the at least one generated trajectory to the off-board and off-vehicle operating message evaluation system as part of an operation message the operating message evaluation system is configured to receive the operating message sent by the position data processing device, to evaluate the received operating message and to generate a response message depending on the evaluation of the operating message.

The operation notification evaluation system is, for example, characterized by a message receiver adapted to receive the operation message and to provide the operation message to an evaluation unit (22) of the operation message evaluation system; wherein the evaluation unit is designed to evaluate the An operation message for generating a response message in response to the evaluation of the operation message, and for providing the response message to a message sender of the operation message evaluation system.

If the position data processing device is designed to receive a response message from the operating message evaluation system, the operating message evaluation system is preferably designed to send the response message preferably to the at least one position data processing device by means of the message transmitter. For this purpose, the evaluation unit is preferably designed to instruct the message sender to send the response message.

The operation message evaluation system comprises, for example, a center in the form of a server integrated in a network or connected to a network for communicating with the at least one position data processing device, for example via a wireless communication network. However, the exact spatial-physical design of the company message evaluation system is less important.

The operation message evaluation system receives at least one trajectory file and optionally also at least one first reference value associated with the at least one trajectory file which, for example, the recording unit has determined for the at least one trajectory file according to the reference value determination method. For these purposes, the operation message evaluation system comprises a message receiver adapted to receive the operation message of the position data processing means. The message receiver comprises, for example, a number of first receiving modules for receiving the trajectory message and a number of second receiving modules for receiving the reference value message. For example, at least one of the second receiving modules is disposed at a roadside controller of the service message evaluation system.

For example, the operation notification evaluation system sorts the trajectory messages and reference value messages depending on a position data processing means identifier contained therein. The exact configuration of the message recipient of the service message evaluation system is less important as long as it is ensured that the service message evaluation system can receive the trajectory message and the reference value message sent out by the position data processing device to be managed.

The Betriebsmitteilungsauswertungssystem also includes an evaluation that evaluates the received operating message and generates the response message depending on the evaluation of the operating message. For example, the evaluation unit is designed to determine a second reference value for each received trajectory file, which is optionally used by the position data processing device that sent the trajectory file to the operating message evaluation system as part of the operating message, for example in the context of the trajectory message , In this example, therefore, there are two reference values for the transmitted trajectory file: a first reference value (formed on the decentral side) and a second reference value (formed on the central side). The evaluation unit is for example configured to perform a first comparison between the second reference value and the first reference value associated with the respective trajectory file and generate the response message in response to the first comparison result. If, however, no forming and transmission of a first reference value, but merely the transmission of the respective trajectory file, the evaluation unit is preferably designed to evaluate the received trajectory file and to provide the response message as a function of the evaluation, in particular as a function of an evaluation result.

Preferably, the evaluation unit of the operation message evaluation system is further configured to determine, for each received first reference value, a second test value according to the same test value determination method that the position data processing device used to send the operation message to the operation message evaluation system. In the case of the operating message evaluation system, there is then a first test value (formed on the decentralized side) for each first reference value as well as a second test value (formed on the central side). Preferably, the evaluation unit is designed to perform a second comparison between the second test value and the first test value associated with the respective first reference value, and also to generate the response message as a function of the second comparison result.

Preferably, the evaluation unit of the operating message evaluation system is configured to generate the response message in dependence on the first comparison result and / or in dependence on the second comparison result such that the response message of the at least one position data processing device indicates that the number of permissible trajectory-specific transactions is to be increased, for example the first reference value underlying the first comparison is to be deleted and the corresponding storage space of the storage area is to be released, or that the position data processing device is to be placed in a state of inoperative state.

The security module of the managed position data processing device modifies the number of permissible trajectory-specific transactions in response to the response message, for example by setting a count, by adding new TANs to a list, and / or by managing the memory area accordingly, as described in detail above: If the response message indicates, for example, that certain first reference values are to be deleted from the memory area (and possibly associated first test values), then the security module deletes the corresponding entries from the memory locations, whereby the memory locations for new first reference values (and possibly first test values) be released.

If the response message of the operating message evaluation system does not contain such a request, the security module does not modify the number, for example no deletion of the entries in the memory locations, and thus there is no creation of newly allocated memory locations for any further first reference values and / or trajectory files. As a result, the storage capacity of the security module is exhausted at some point, namely after the last available storage space has been used, whereby the number of permissible trajectory-specific transactions is zero and the position data processing device is placed in a state of non-operational readiness. The same applies mutatis mutandis to the variants in which the number of permissible trajectory-specific transactions by a Counter reading is predetermined and / or by a number of available TANs. Thus, it can be checked in a secure and reliable manner on the central side whether there is a manipulation attempt in the position data processing devices managed by the operating message evaluation system or not.

Also proposed according to the invention is a toll system which comprises at least one position data processing device and an inventive message notification system and is characterized in that the position data processing device and / or the operating message evaluation system is / are designed to use at least one of the at least one trajectory generated by the position data processing device User assigned assigned by the vehicle toll road section and / or one of the user ID assigned toll fee to determine.

Specifically, in such a toll system, the position data processing means is configured to determine a first reference value from the generated trajectory according to a reference value determination method and to send the first reference value and the generated trajectory to the operation message evaluation system in at least one operation message, and the operation message evaluation system is constructed by the position data processing means according to the reference value determination method, determining a second reference value from the received trajectory, comparing the received first reference value with the generated second reference value, if the first reference value matches the second reference value, a positive one comprising an instruction to increase the number of allowed trajectory-specific transactions Reply message to the position data data processing device to in the event of a mismatch of the first reference value with the second reference value, send a neutral response message comprising no instruction for increasing the number of allowed trajectory-specific transactions to the position data data processing device or a negative response message comprising an instruction for setting the number of trajectory-specific transactions equal to zero, wherein the Position data processing means is adapted to receive the response message that has sent the Betriebsmitteilungsauswertungssystem in response to the at least one sent operating message, and to increase the number of permissible trajectory-specific transactions upon receipt of the positive response message, upon receipt of the neutral response message, the number of permissible trajectory-specific transactions unchanged and upon receipt of the negative response message, the number of zulässi to set zero trajectory-specific transactions.

Alternatively or optionally, in such a toll system, the position data processing device is configured to determine a first reference value from the generated trajectory according to a reference value determination method and to determine a first check value from the first reference value according to a check value determination method and the first reference value and the first check value in at least one operating message to send to the Betriebsmitteilungsauswetungssystem and the Betriebsmitteilungsauswertungssystem designed to determine from the received from the position data processing device reference value according to the Prüfwertbestimmungsverfahrens a second test value from the received first reference value, the received first test value to compare the generated second check value, if the first check value coincides with the second check value, to send a positive response message comprising an instruction for increasing the number of permissible trajectory-specific transactions to the position data data processing device and if there is a mismatch of the first check value with the second check value, a no instruction neutral response message to the position data data processing device or a negative response message comprising an instruction for setting the number of trajectory-specific transactions equal to zero, the response message informing the operational message evaluation system in dependence on the has sent at least one sent operating message to receive and at Empfan g the positive response message, increase the number of allowed trajectory-specific transactions, leave the number of allowed trajectory-specific transactions unchanged upon receipt of the neutral response message, and set the number of allowed trajectory-specific transactions equal to zero upon receipt of the negative response message.

A third aspect of the present invention is a method of operating a position data processing device according to claim 14. A fourth aspect of the present invention is a method of operating a toll system according to claim 15. These further aspects of the present invention share the advantages of the first aspect described above and the second aspect of the present invention described above, and have corresponding preferred embodiments, in particular, as defined in the dependent claims. In that regard, reference is made to the above.

An example method for transmitting position-relevant data within such a system is explained below:

A toll device managed by the service message evaluation system sends one (or more) of the generated trajectory files to the service message evaluation system as part of the trajectory message in a first communication phase. This sending of the trajectory message by the position data processing means may be done with or without prior request by the service message evaluation system. The transmission of the trajectory message is carried out, for example, for the purpose of having an evaluation and checking for the passage of toll road sections carried out centrally by the toll center of the Betriebsmitteilungsauswertungssystems.

The recording unit of the position data processing device forms from the trajectory file the first reference value according to the reference value determination method, for example, a hash value or a CRC value. The operation notification evaluation system forms a second reference value from the received trajectory file according to the same reference value determination method.

In addition, it can be provided that the security module of the position data processing device determines the first test value for the specific first reference value, in accordance with the test value determination method. The security module stores the first reference value and the first check value together as a check data record in one of the memory locations of the memory area of the security module.

In a second communication phase, the position data processing device sends one or more of these check data records to the service message evaluation system, as part of the reference message. The reference value message thus contains the test data record (s). This sending of the reference value message can also take place after or without prior request by the operating message evaluation system.

If the safety module of the position data processing device has also determined first test values for the first reference values, the operating message evaluation system determines second test values for the received first reference values according to the same test value determination method. The test values are, for example, MAC values.

The operating message evaluation system compares the transmitted first reference values with the self-determined second reference values and optionally for each transmitted first reference value the transmitted first check value with the self-determined second check value.

In the event of a detected match, the service message evaluation system sends a request to the position data processing means, within the response message, to delete the transmitted check records from the memory area and thereby release the corresponding memory locations for new check records.

In the case of a mismatch, the service message evaluation system does not send such a request to the position data processing device or sends a signal to the position data processing device, in response to the response message, that the position data processing device is in a non-operational state. The position data processing device may optically display such a state, for example, by flashing or lighting a red LED.

When the position data processing means detects the reaching of the maximum number of check records storable in the memory area, that is, exhausting the memory capacity of the memory area (in this case, the number of permissible trajectory-specific transactions is zero), the position data processing means enters the standby state in which it is refuses to perform any other trajectory-specific transactions, for example, indicating this condition by the flashing of a red LED.

The first reference values are preferably formed by the recording unit of the position data processing device and forwarded to the security module, which calculates the first check value for each first reference value by means of the optionally provided autonomous control module operated by stand-alone operating software and stores it in the check data records.

By way of example, the first test values are each formed with the aid of a random number newly determined by the security module for each first test value, which, for example, is likewise included in the test data record and optionally transmitted to the operating message evaluation system. From the random number, using a master key known to both the position data processing device and the operational message evaluation system, a session key can be generated, with which the first check value from the first reference value is generated cryptographically. The first check value, together with the random number, is transmitted to the service message evaluation system so that the service message evaluation system is able to simulate the session key with the masterkey and random number also present to it.

Preferably, the service message evaluation system deletes the trajectory files after being checked for toll relevance and determining the second reference values to accommodate privacy regulations.

The communication between the position data processing device and the Betriebsmitteilungsauswertungssystem is preferably encrypted. For example, the encryption of the messages that the position data processing device transmits to the operation notification evaluation system (operation message, trajectory messages and reference value messages) according to asymmetric encryption, and encryption of messages that the operation notification evaluation system sends to the position data processing device (response messages) is performed according to symmetric encryption.

The individual components, in particular the receiver, the recording unit, the communication device and the security module of the position data processing device need not necessarily be integrated in a housing, but can also be arranged distributed from each other and communicate, for example, wirelessly according to a communication standard of short range communication, for example Bluetooth. The exact arrangement of the components and design of the coupling between the components of the position data processing device is less important, provided that it is ensured that the position data processing device can perform its intended function and the operative operative connections required for this are implemented between the components of the position data processing device.

The idea underlying the invention will be described below with reference to the in the Fig. 1 illustrated embodiment will be explained in more detail.

Fig. 1 FIG. 12 is a schematic and exemplary illustration of an embodiment of a position data processing device 1 and a non-limiting embodiment of an information reporting system 2 of a toll system 3, which is not to be construed as limiting the independent claimed invention.

The position data processing device 1 is to be carried in one in the Fig.1 vehicle, not shown, which travels toll road sections for the use of which a toll system charges 3 tolls by means of the position data processing device 1 and an off-site and off-vehicle operating message evaluation system 2. To the position data processing device 1 includes a in the Fig.1 schematically illustrated DSRC communication module 15, which is for example attached to a windshield of the vehicle and is designed to exchange data with a vehicle passed by the control device 25 of the Betriebsmitteilungsauswertungssystems 2. The control device 25 is, for example, a control bridge under which the vehicle passes.

The position data processing device 1 is operatively connected to the substantially stationary operation notification evaluation system 2 located outside the vehicle. The operation notification evaluation system 2 is configured to manage a plurality of position data processing devices 1.

For example, the position data processing device 1 on the one hand and the Betriebsmitteilungsauswertungssystem 2 on the other hand communicate with each other via a wireless communication network, for example via a GSM and / or UMTS network.

The position data processing device 1 has a receiver 11 which receives satellite data 111 and generates therefrom position data 111-1 which are indicative of the position of the vehicle in which the position data processing device 1 is carried. The receiver 11 is designed, for example, as a GNSS receiver and receives, for example, satellite data 111 according to the GPS system or another global navigation satellite system.

However, the position data 111-1 may also be contained in said data 151 if the reception of satellite data 111 is not possible, for example in tunnels or other shielded areas. In any case, the position data 111-1 is indicative of the position of the vehicle.

To the receiver 11, a recording unit 12 is coupled, which receives the received or generated position data 111-1 and in response thereto generates trajectory files TJ-1,..., TJ-n and stores them in a memory unit 122. The generation of the trajectory files TJ-1 to TJ-n by a processor 121 of the recording unit 12, for example, at intervals, for example, about every 100 km or zeitintervallmäßig. Each trajectory file TJ-1 to TJn is therefore indicative of a distance traveled by the vehicle.

The recording unit is further configured to determine a first reference value RWA-1, ..., RWA-n for each trajectory file TJ-1 to TJ-n according to a reference value determination method and to provide at least one of the trajectory files TJ-1, ..., TJ -n and at least one of the first reference values RWA-1, ..., RWA-n for a communication device 13 for transmission in the context of at least one operating message 131, 132 to the Betriebsmitteilungsauswertungssystem 2, wherein the communication device 13 is further adapted to receive a response message 231st of the operation message evaluation system 2, which has prepared the operation message evaluation system 2 in response to an evaluation of the at least one operation message 131, 132.

The communication device 13 is designed to communicate with the out-of-vehicle service message evaluation system 2, in particular for transmitting the service message 131, 132, which is a Trajektoriennachricht 131 and a separate reference value message 132 may include. The communication device 13 transmits, for example, during a first communication phase, at least one of the stored trajectory files TJ-1 to TJ-n in the context of a trajectory message 131 to the Betriebsmitteilungsauswertungssystem 2. In the trajectory message 131 may also contain an identifier of the position data processing device 1, so that the Betriebsmitteilungsauswertungssystem 2 can associate the received trajectory file with the position data processing device 1.

To receive the trajectory message 131, the service message evaluation system 2 has a message receiver 21. On the basis of the trajectory file contained in the trajectory message 131, the operating message evaluation system 2 can carry out toll recognition and calculate a toll charge for the user of the vehicle in which the position data processing device 1 is carried.

To the recording unit 12 of the position data processing device 1, a security module 14 is further coupled. The security module 14 is designed, for example, as a chip card and has, in particular, a memory area 141 and a control module 142 for operating this memory area 141. The control module 142 is an autonomous control module, which in particular has its own operating software and in any case not exclusively a ( in the Fig.1 not shown) control unit, in particular the recording unit 11, the position data processing device 1 is controlled.

• Entgegennehmen wenigstens eines der ersten Referenzwerte RWA-1, ..., RWA-n und/oder einer der Trajektoriendateien TJ-1, ..., TJ-n von der Aufzeichnungseinheit (12);
• Speichern wenigstens eines der ersten Referenzwerte RWA-1, ..., RWA-n und/oder wenigstens einer der Trajektoriendateien TJ-1, ..., TJ-n in dem Speicherbereich 141 des Sicherheitsmoduls 14;
• Berechnen eines ersten Prüfwerts PWA-1, ..., PWA-n für wenigstens einen der ersten Referenzwerte RWA-1, ..., RWA-n und/oder für wenigstens eine der Trajektoriendateien TJ-1, ...,TJ-n;
• Speichern wenigstens eines der ersten Prüfwerte PWA-1, ..., PWA-n in dem Speicherbereich 141 des Sicherheitsmoduls 14; und/ oder
• Bereitstellen wenigstens eines der ersten Referenzwerte RWA-1, ..., RWA-n und/oder eines der ersten Prüfwerte PWA-1, ..., PWA-n für die Aufzeichnungseinheit (12), sodass der bereitgestellte wenigstens eine erste Referenzwerte RWA-1, ..., RWA-n und/oder der wenigstens eine erste Prüfwert PWA-1, ..., PWA-n im Rahmen der Betriebsmitteilung 131, 132 von der Kommunikationseinrichtung 13 an das Betriebsmitteilungsauswertungssystem 2 übermittelt werden können.

The security module 14 is configured to perform a trajectory-specific transaction by processing a respective one of the first reference values RWA-1,..., RWA-n in one or more processing operations, the number of allowed trajectory-specific transactions being variable and predetermined, and with each trajectory-specific transaction with respect to a first reference value RWA-1, ..., RWA-n is reduced. A respective trajectory-specific transaction includes, for example:

• Accepting at least one of the first reference values RWA-1, ..., RWA-n and / or one of the trajectory files TJ-1, ..., TJ-n from the recording unit (12);
• Storing at least one of the first reference values RWA-1, ..., RWA-n and / or at least one of the trajectory files TJ-1, ..., TJ-n in the memory area 141 of the security module 14;
• Calculating at least one of the first reference values RWA-1,..., RWA-n and / or for at least one of the trajectory files TJ-1, n;
• Storing at least one of the first check values PWA-1, ..., PWA-n in the memory area 141 of the security module 14; and or
• Providing at least one of the first reference values RWA-1,..., RWA-n and / or one of the first check values PWA-1,..., PWA-n for the recording unit (12), so that the provided at least one first reference value RWA -1, ..., RWA-n and / or the at least one first check value PWA-1,..., PWA-n can be transmitted by the communication device 13 to the operating message evaluation system 2 within the context of the operating message 131, 132.

As has been explained in detail in the general part of the description, the number of permissible trajectory-specific transactions can be specified in various ways, namely in particular by a count of one (in the Fig. 1 not shown) counter of the security module 14, a number of available TANs and / or a number of available memory locations of the memory area 141 of the security module 14. With reference to the Fig. 1 Let the latter variant be explained in more detail by means of an example.

The memory area 141 has a limited number of memory locations 141-1 to 141-n. For example, about 100 memory locations (n = 100) of this type are provided. In each memory location 141-1 to 141-n, precisely one first reference value RWA-1; ...; RWA-n and exactly a first check value PWA-1; ...; PWA-n are stored. Hereinafter, a pair of a first reference value and a first check value is also referred to as a check data set. For a new check data record to be stored in one of the memory locations 141-1 to 141-n, it must be available for a corresponding write operation. The number of available memory locations 141-1 to 141-n is therefore indicative of an admissible number of trajectory-specific transactions. This will be explained in more detail below.

First, for each generated trajectory file TJ-1 to TJ-n, the recording unit 12 determines a first reference value RWA-1, ..., RWA-n. The determination of such a reference value is made according to a reference value determination method. For example, the first reference values RWA-1 to RWA-n are hash values, for example CRC values. The recording unit 12 stores the determined first reference values RWA-1 to RWA-n in the memory locations 141-1 to 141-n, provided that these are available for a corresponding write operation.

For each first reference value RWA-1 to RWA-n stored in the memory area 141, the control module 142 determines a first check value PWA-1 to PWA-n. The determination of these first test values PWA-1 to PWA-n is carried out according to a test value determination method, for example according to a MAC method: The first test values PWA-1 to PWA-n are therefore, for example, MAC values.

In a second communication phase, the communication device 13 sends the position data processing device 1 within the scope of a reference value message 132 one or more of the test data sets stored in the memory area 141, each of which has a first reference value RWA-1; ...; RWA-n and a first check value PWA-1; ...; PWA-n, to the operation message evaluation system 2. The operation message evaluation system 2 receives the reference value message 132 by means of the message receiver 21. An association between the check data set on the one hand and the trajectory file on the other hand, for example, by the assignment of time stamps or similar identifiers, so that the Betriebsmitteilungsauswertungssystem 2 on receipt of Trajektoriennachricht 131 and the reference value message 132 may determine which audit record is associated with which trajectory file.

Both messages, that is to say both the trajectory message 131 and the reference value message 132, are received by the message communication system 2 by means of the message receiver 21. For this purpose, the message receiver 21 may, for example, be distributed and have a number of first reception modules for receiving the message Trajectory message 131 and a number of second receiving modules for receiving the reference value message 132 include. For example, at least one of the second receiving modules is arranged at a roadside control device of the operation notification evaluation system 2

The operation notification evaluation system 2 includes an evaluation unit 22 that determines a second reference value for each received trajectory file in accordance with the same reference value determination method that the position data processing device 1 uses, and a second one for every second reference value according to the same check value determination method used in the position data processing device 1 Check value determined.

On the basis of a comparison of the first reference values with the second reference values and on the basis of a comparison of the first test values with the second test values, the operating message evaluation system 2 determines whether the position data processing device 1 has correctly recorded the trajectory files TJ-1 to TJ-n. In particular, proper recording of trajectory files means that the position data processing device 1 transmits the trajectory files completely to the operating message evaluation system 2 and correctly records them on the other hand.

In any case, depending on the comparisons made between the first reference values and the second reference values and between the first test values and the second test values, the evaluation unit 22 of the operating message evaluation system 2 generates a response message 231 and transmits this back to the position data processing device 1 by means of a message transmitter 23.

If the first reference values match the second reference values and the first test values correspond to the second test values, the operation message evaluation system 2 generates the response message 231 to cause the control module 142 to release the corresponding memory location (s) of the memory area 141 for a new write. Upon receipt of such a response message 231, the control module 142 deletes, for example, the check records from the storage area 141 that underlie the central-side comparisons, such that the corresponding memory locations for a new write, that is to store new first reference values and new first check values of a new trajectory file To be available. In this way, the security module 14 manages the memory area 141 in response to the response message 231 of the service message evaluation system 2, which has prepared the service message evaluation system 2 in response to the evaluation of the trajectory message 131 and the reference value message 132.

However, if the operation message evaluation system 2 comes to the result in the evaluation that either the first test values do not coincide with the second test values or the first reference values do not match the second reference values, it generates the response message 231 in such a way as to cause the position data processing device 1 to However, in any case in such a way that the memory locations of the memory area 141 whose test data records were the basis of the evaluation are not deleted by the control module 142 and thereby released. The non-release of the memory locations of the memory area 141 results in an attempt to set a new reference value for to store a new trajectory file in the memory area 141, an error, because just no space in memory area 141 (more) is available. As a result, the position data processing device 1 enters a state of non-operational readiness in which the position data processing device (1) no longer carries out any trajectory-specific transactions in the form of storing first reference values in the memory area 141. A user of the position data processing device 1, this state is displayed, for example, characterized in that a red LED lights up. Moreover, the operation notification evaluation system 2 registers that the position data processing means 1 operates in this state, and initiates appropriate actions, for example, by the operation notification evaluation system 2 setting the position data processing means 1 on an observation list or immediately initiating the introduction of certain sanctions.

In order to make detection of manipulation attempts in the toll apparatus 1 even safer, optional embodiments of the position data processing device 1 provide that the DSRC communication module 15 'is designed to store a copy of the first check values PWA-1 to PWA-n and the first reference values RWA -1 to RWA-n, so that the first test values PWA-1 to PWA-n and the first reference values RWA-1 to RWA-n are also from a control device 25, which is passed by the vehicle, in the context of one by the DSRC Communication module to the control device 25 sent reference value message 132 can be read. Usually, such a control device 25, for example a control bridge, is also in operative connection with the operation message evaluation system 2, so that the first test values PWA1-1 to PWA-n and the first reference values RWA-1 to RWA-n are transmitted to the operation message evaluation system 2 by means of such a control device can be, so that it can be checked centrally in this way, whether the position data processing device 1 operates properly.

It is also possible to dispense with the transmission of the first test values PWA1-1 to PWA-n and the first reference values RWA-1 to RWA-n from the control device to the operating message evaluation system 2 if the control device 25 attempts to transmit a respective first test value PWA-1. k under the determination of a respective second test value from the respective first reference value RWA-k. If the attempt is unsuccessful, the control device sends an error message concerning the corresponding position data processing device 1 to the operating message evaluation system 2.

On the basis of the above-described use of first reference values RWA-1,..., RWA-n, the operating message evaluation system 2 can therefore determine the integrity and the authenticity of the trajectory files TJ-1,..., TJ-n and thus the proper functioning of the position data processing device 1 check. By using the first check values, the first reference values are backed up so that the operation message evaluation system 2 can check that all the trajectory files have actually arrived at the operation message evaluation system 2 unchanged.

In a trajectory message 131, one or more of the trajectory files TJ-1 to TJ-n may be included. The same applies mutatis mutandis to the reference value message 132, which may include one or more test data sets depending on the embodiment. An identifier of the position data processing device 1 may be contained in the trajectory message 131 and / or in the reference value message 132. An association between the trajectory files TJ-1 to TJn on the one hand and the test data sets on the other hand, for example, by the tolling-side assignment of time stamps or similar identifiers that provides an association between the test records and the trajectory files unambiguously.

The position data processing device 1 sends the trajectory message 131 and / or the reference value message 132, for example, upon request by the operating message evaluation system 2. It is also possible for the position data processing device 1 to transmit the trajectory message 131 and / or the reference value message 132 to the operating message evaluation system 2 without being requested by the operating message evaluation system 2.

As has already been explained above, the security module 14 is designed, for example, as an independent chip card, which is coupled to at least one already existing component of the position data processing device 1, in particular to the recording unit 12.

The position data processing device 1 is configured, for example, as an on-board unit (OBU) and has a housing. The security module 14 is preferably arranged within this housing.

It has been explained above that the position data processing device 2 generates the response message 231 in the event of disagreement between the first reference values and the second reference values and / or if the first test values and the second test values do not match, for example, such that the position data processing device 1 ends up in a state lacking Operational readiness passes. Such a mismatch between the first and second reference values or between the first and second test values is also given, in particular, when a first reference value and / or a first checker value has not been transmitted to the operation message evaluation system 2 for a trajectory file. A lack of agreement can also result from the position data processing device 1 transmitting to a trajectory file not only a first reference value but a plurality of first reference values.

LIST OF REFERENCE NUMBERS

1

Position data processing device

11

receiver

111

satellite data

111-1

position data

12

recording unit

121

processor

122

storage unit

13

communicator

131

Trajektoriennachricht

132

Reference value message

14

security module

141

storage area

141-1, ..., 141-n

memories

142

control module

15

DSRC communication module

151

dates

2

Operational memo evaluation system

21

message recipients

22

evaluation

23

news channel

231

reply message

25

control device

3

toll system

TJ-1, ..., TJ-n

Trajectories, trajectory files

RWA-1, ...., RWA-n

First reference values

PWA-1, ..., PWA-n

First test values

Claims (15)

Position data processing device (1) for entrainment in or on a vehicle,
the position data processing device (1) being in a state of given operational readiness, - to signal no lack of operational readiness and / or a given operational readiness, - position data (111-1) indicative of positions of the vehicle to receive or generate and generate at least one trajectory (TJ-1, ..., TJ-n) indicative of a distance covered by the vehicle, depending on the received or generated position data (111-1), characterized in that
the position data processing device (1) is also designed in the state of given operational readiness perform at least one trajectory-specific transaction with regard to the at least one generated trajectory (TJ-1,..., TJ-n), reduce a number of permissible trajectory-specific transactions greater than zero as a result of the at least one trajectory-specific transaction being carried out, and - change to a state of non-operational readiness if the number of permissible trajectory-specific transactions is zero, and
the position data processing device (1) is designed in a state of lack of operational readiness, - do not carry out a trajectory-specific transaction and - signal a lack of operational readiness and / or no given operational readiness .. Position data processing device (1) according to claim 1, characterized in that
the position data processing device (1) is designed in the state of given operational readiness, as a result of or in the context of the execution of the trajectory-specific transaction, the at least one generated trajectory (TJ-1,..., TJ-n) or one of at least one reference value determination method from the at least one generated trajectory (TJ-1,..., TJ -n) specific first reference value (RWA-1, ..., RWA-n) as part of an operating message (131, 132) to an off-board and off-vehicle operating message evaluation system (2), - receive a response message (231) sent by the service message evaluation system (2) in response to the at least one dispatched service message (131, 132), and depending on the received response message (231), to modify the number of allowed trajectory-specific transactions to a number greater than zero, leave it unchanged, or set it equal to zero. Position data processing device according to claim 1 or 2, characterized in that the position data processing device (1) - Has at least one processor (121) which is formed at least in the state given operational readiness of the position data processing means (1), depending on the received or generated position data (111-1) the at least one trajectory (TJ-1, ..., TJ -n), and the position data processing device (1) at least one security module (14), which is embodied at least in the state of ready operation of the position data processing device (1), which carries out at least one trajectory-specific transaction, in which - The processor (121) is formed at least in the state given operational readiness of the position data processing device (1), the safety module, the generated trajectory (TJ-1, ..., TJ-n) or position data (111-1), of which the trajectory depends (TJ-1, ..., TJ-n) was created to provide the trajectory-specific transaction. Position data processing device (1) according to one of the preceding claims, characterized in that the position data processing device (1) is designed to carry out at least one of the following steps during the execution of the trajectory-specific transaction or outside thereof: the at least temporary storage of data of the trajectory (TJ-1,..., TJ-n) in a security module of the position data processing device; - the transmission of the trajectory (TJ-1, ..., TJ-n) as part of an operating message to an outside and off-vehicle Betriebsmitteilungsauswertungssystem (2); the determination of a first reference value (RWA-1,..., RWA-n) from the trajectory (TJ-1,..., TJ-n) according to at least one reference value determination method; the at least temporary storage of a first reference value (RWA-1,..., RWA-n) determined from the trajectory (TJ-1,..., TJ-n) according to at least one reference value determination method in a security module (14) the position data processing device (1). Position data processing device (1) according to one of the preceding claims, characterized in that the position data processing device (1), in particular a safety module (14) encompassed by the position data processing device (1), is formed, in the context of the execution of the trajectory-specific transaction or outside thereof, according to at least one reference value determination method, to determine a first reference value (RWA-1,,, ..., RWA-n) from the trajectory (TJ-1,..., TJ-n) . and the position data processing device is designed the first reference value (RWA-1,..., RWA-n) within the operating message (131) together with the trajectory (TJ-1, '..., TJ-n) from whose data the first reference value ( RWA-1, ..., RWA-n) was determined to send to an off-board and off-vehicle operating message evaluation system (2)
or the trajectory (TJ-1,..., TJ-n) as part of a first operating message (131) to be sent to an outside and off the vehicle operating message evaluation system (2) and the first reference value (RWA-1, ... , RWA-n) to send to the Betriebsmitteilungsauswertungssystem (2) in the context of one of the first operating message (131) temporally spaced, separate second operating message (132). Position data processing device (1) according to one of the preceding claims, characterized in that the position data processing device (1), in particular a safety module (14) encompassed by the position data processing device (1), for the at least one trajectory (TJ-1,..., TJ-n) and / or for at least one according to at least a reference value determination method by the position data processing device from the trajectory (TJ-1, ..., TJ-n) determined first reference value (RWA-1, ..., RWA-n) one or more first test values (PWA-1, ... , PWA-n) according to a test value determination method, and that
the position data processing device (1) is formed, the at least one trajectory (TJ-1, ..., TJ-n) and / or the at least one first reference value (RWA-1, ..., RWA-n) together with the associated first check value (PWA-1, ..., PWA-n) as part of the operating message (131, 132) to the Betriebsmitteilungsauswertungssystem (2) to transmit. Position data processing device (1) according to one of the preceding claims, characterized in that information about the number of permissible trajektorerpezifischen transactions in the position data processing device (1), in particular in a memory area (141) of a security module (14) of the position data processing device (1) is stored, and the position data processing device (1), in particular the security module (14), is designed to change the information with each trajectory-specific transaction in such a way that the changed information indicates the reduced number of permissible trajectory-specific transactions. Position data processing device (1) according to one of the preceding claims, characterized in that the number of permissible trajektorerpezifischen transactions by a count of a counter of the position data processing device (1), in particular a security module (14) of the position data processing device (1) is predetermined. Position data processing device (1) according to one of the preceding claims, characterized in that the position data processing device (1), in particular a security module (14) encompassed by the position data processing device (1), is adapted to access a list of transaction numbers, the number of which in the list transaction number is indicative of the number of allowed trajectory-specific transactions. Position data processing device (1) according to one of the preceding claims, characterized
that in the position data processing means (1) a user identification, in particular an identity of the vehicle or the position data processing means (1) is stored and the position data processing means (1) is formed, the at least one trajectory generated (TJ-1, ..., TJ-n ) or a first reference value (RWA-1,..., RWA-n) determined according to at least one reference value determination method from the at least one generated trajectory (TJ-1,..., TJ-n) as part of an operating message (131) sending the user identification in the context of the operating message (131, 132) or outside the operating message (131, 132) within the scope of an identification message independent of the operating message (131, 132) Send operating message evaluation system (2). An operation message evaluation system (2) for managing at least one position data processing device (1) according to any one of the preceding claims, which is adapted to send the at least one generated trajectory (TJ-1, ..., TJ-n) to the operation message evaluation system as part of an operation message (131) (2) to ship,
characterized in that the operation message evaluation system (2) is designed to receive the operating message (131) sent by the position data processing device (1), - evaluate the received operating message (131) and to generate a response message (231) as a function of the evaluation of the operating message (131). Tolling system (3) characterized by at least one position data processing device (1) according to claim 10 and by an operation message evaluation system (2) according to claim 11,
characterized in that the position data processing device (1) and / or the Betriebsmitteilungsauswertungssystem (2) is / are formed, based on the at least one of the position data processing means (1) generated trajectory (TJ-1, ..., TJ-n) at least one to determine the toll-related route section assigned to the user identification and / or a toll charge assigned to the user identification. Tolling system according to claim 12, characterized in that
the position data processing device is designed to determine a first reference value (RWA-1, ..., RWA-n) from the generated trajectory (TJ-1,..., TJ-n) according to a reference value determination method, and - the first reference value (RWA-1, ..., RWA-n) and the generated trajectory (TJ-1, ..., TJ-n) in the context of at least one operating message (131, 132) to the Betriebsmitteilungsauswertungssystem (2) to send and the operation message evaluation system (2) is designed to determine a second reference value from the received trajectory (TJ-1, ..., TJ-n) from the trajectory received by the position data processing device according to the reference value determination method, compare the received first reference value (RWA-1, ..., RWA-n) with the generated second reference value, - If the first reference value (RWA-1, ..., RWA-n) matches the second reference value, send to the position data data processing device a positive response message comprising an instruction for increasing the number of permissible trajectory-specific transactions if the first reference value (RWA-1, ..., RWA-n) does not match the second reference value, a neutral response message comprising no instruction for increasing the number of permissible trajectory-specific transactions to the position data data processing device or an instruction for setting the number of trajectory-specific transactions equal to zero to send comprehensive negative response message, wherein the position data processing device (1) is formed, the - Receiving message that the Betriebsmitteilungsauswertungssystem (1) has sent in response to the at least one sent operating message (131, 132), and upon receiving the positive response message, increasing the number of allowed trajectory-specific transactions, leaving the number of allowed trajectory-specific transactions unchanged upon receipt of the neutral response message, and setting the number of allowed trajectory-specific transactions equal to zero upon receipt of the negative response message. A method for operating a position data processing device (1), which is suitable for being carried in or on a vehicle, with the steps in a state of given operational readiness of the position data processing device (1) of the Signaling no lack of operational readiness and / or a given operational readiness by the position data processing device (1), Receiving or generating position data (111-1) indicative of positions of the vehicle by the position data processing means (1), Generating at least one trajectory (TJ-1,..., TJ-n) which is indicative of a distance covered by the vehicle, in dependence on the received or generated position data (111-1) by the position data processing device (1), marked by
the further steps in the state of given operational readiness of the position data processing device (1) of the - performing at least one trajectory-specific transaction with respect to the at least one generated trajectory (TJ-1, ..., TJ-n) by the position data processing device (1); Reducing a number of allowed trajectory specific transactions greater than zero as a result of the at least one performed trajectory specific transaction and - automatically changing the position data processing device (1) to a state of non-operational readiness, in which the position data processing device (1) does not perform a trajectory-specific transaction if the number of permissible trajectory-specific transactions is zero, and the step in the state of lack of operational readiness of the position data processing device (1) of the Signaling a lack of operational readiness and / or no given operational readiness by the position data processing device (1). A method of operating a toll system having at least one position data processing device and at least one off-board service message evaluation system comprising a method according to claim 14 and the further steps in the state of ready state of the position data processing device of - Sending the at least one generated trajectory (TJ-1, ..., TJ-n) or according to at least one Referenzwertbestimmungsverfahrens from the at least one generated trajectory (TJ-1, ..., TJ-n) determined first reference value (RWA -1, ..., RWA-n) as part of an operating message (131, 132) to the operating message evaluation system as a result of or in the context of the execution of the trajectory-specific transaction by the position data processing device, - receiving the operation message (131, 132) sent by the position data processing means (1) by the operation notification evaluation system (2); Determining at least one toll segment allocated to a user identifier of the position data processing device and / or at least one toll charge assigned to the user data of the position data processing device by the position data processing device and / or the operating message evaluation system based on the trajectory (TJ-1,..., TJ-n) ; - evaluating the received operation message (131, 132) by the operation notification evaluation system (2); - generating a response message (231) in response to the evaluation of the operation message (131, 132) by the operation message evaluation system (2); Sending the response message (231) to the position data processing device (1) by the operation message evaluation system (2); - Receiving the response message that the Betriebsmitteilungsauswertungssystem (2) has sent, by the position data processing means (1) and Modifying the number of allowed trajectory-specific transactions (TJ-1, ..., TJ-n) to a number greater than zero, maintaining the number of allowed trajectory-specific transactions, or setting the number of allowed trajectory-specific transactions equal to zero, depending on the received response message by the position data processing device.

Images