WO2013017446A2

WO2013017446A2 - Method and system for accessing an energy charging service

Info

Publication number: WO2013017446A2
Application number: PCT/EP2012/064361
Authority: WO
Inventors: Holger Lenz
Original assignee: Gemalto Sa
Priority date: 2011-08-01
Filing date: 2012-07-20
Publication date: 2013-02-07
Also published as: WO2013017446A3

Abstract

The invention relates to a method (20) for accessing an energy charging service. According to the invention, a vehicle (12) comprising or being connected to a controller (14), the controller being coupled to a removable token (16), the token storing at least one identifier relating to a user, the vehicle being connected to an energy charging station 18, a remote server (110) being connected to the energy charging station, the server storing at least one identifier relating to at least one user, the method comprises the following steps. The token sends to the controller the identifier (22). The controller sends, via the energy charging station, to the server the identifier (24). The server identifies, thanks to the identifier, the concerned user. The invention also relates to a corresponding system for accessing an energy charging service.

Description

METHOD AND SYSTEM FOR ACCESSING AN ENERGY CHARGING

SERVICE

Field of the invention:

The present invention relates, in a general manner, to a method for accessing an energy charging service.

State of the art:

The number of vehicles with an electric motor is increasing. Each vehicle is equipped with a battery or an accumulator that allows providing the electric motor with electrical energy.

There is a need to charge the battery or the accumulator with electrical energy.

Summary of the invention:

The invention proposes a solution for satisfying the just hereinabove specified need by providing a method for an energy charging service.

According to the invention, a vehicle comprising or being connected to a controller, the controller being coupled to a removable token, the token storing at least one identifier relating to a user, the vehicle being connected to an energy charging station, a remote server being connected to the energy charging station, the server storing at least one identifier relating to at least one user, the method comprises the following steps. The token sends to the controller the identifier. The controller sends, via the energy charging station, to the server the identifier. The server identifies, thanks to the identifier, the concerned user.

The principle of the invention consists in that a portable smart object carried by a user/subscriber to an energy provider (or on its behalf) transmits, via a controller and an energy charging station in which a vehicle is plugged, to a remote server one identifier. The server recognizes the concerned user with the help of the identifier.

It is to be noted that the token is electrically connected to the controller through a contact-less link and/or a contact link. It is to be noted that the identifier is related to the user and does not involve to disclose an identity of the user.

The portable smart object or token being carried by a user, a provision of energy is dependent on a user account.

The invention solution makes it possible, via an identifier originating from the token, to access, in a simple, easy and convenient manner for the user, an energy service.

Preferably, the identifier relating to a user includes an identifier relating to a contract with an energy charging service provider. Due to a use of an identifier that does not allow to recognize directly the concerned user, the user remains anonymous.

Accordingly, one and the same token may be used for supplying in energy a plurality of vehicles.

The invention solution is user friendly since the user has only to couple her or his token to a vehicle to be provisioned with energy and to plug the vehicle in an energy charging station.

According to a further aspect, the invention is a system for accessing an energy charging service.

According to the invention, the system comprises a vehicle, a removable token, an energy charging station and a remote server. The vehicle comprises or is connected to a controller. The controller is coupled to the removable token. The token stores at least one identifier relating to a user. The vehicle is connected to the energy charging station. The remote server is connected to the energy charging station. The server stores at least one identifier relating to at least one user. And the token comprises means for sending to the controller the identifier. The controller comprises means for sending, via the energy charging station, to the server the identifier. And the server comprises means for identifying, thanks to the identifier, the concerned user.

As a vehicle, it may be any kind of vehicle. Instead of a vehicle, it may any kind of device which needs to be provided in energy to work for at least one of the functions carried out by the device. As a removable token, it may be any chip embedded within a medium, like a card, a dongle, for instance of the Universal Serial Bus (or USB) type, a document or the like. Brief description of the drawings:

Additional features and advantages of the invention will be more clearly understandable after reading a detailed description of one preferred embodiment of the invention, given as an indicative and non-limitative example, in conjunction with the following drawings:

- Figure 1 illustrates a simplified diagram of one exemplary embodiment of a system comprising a car, a controller, a smart card, an electricity charging station and a remote server, the system being adapted to authorize or refuse access to an energy charging service thanks to data originating from the smart card, according to the invention; and

- Figure 2 represents a simplified message flow of one exemplary embodiment of a method implemented notably by the entities of the system of figure 1 , so that the car is charged in energy, in a secure manner, thanks to the smart card, under the server control .

Detailed description:

Figure 1 shows one embodiment of a system 10 for accessing an energy charging service.

The system 10 for accessing an energy charging service includes a car 12, a controller 14, a smart card 16, as token, an electricity charging station 18 and a remote server 1 10.

For the sake of clarity and conciseness, the smart card 16, the electricity charging station 18 and the remote server 1 10 are termed hereinafter the card or token 16, the station 18 and the server 1 10 respectively.

For the sake of simplicity, only one car 12, only one card 16 and only one station 18 are represented. However, the server 1 10 is preferably connected, through one or several networks, to other stations (not represented) in which another vehicle(s) (not represented) are plugged to access an electricity delivery service thanks to the single card 16 or other card(s) or token(s) (not represented).

The car 12, as a vehicle, is equipped with an electricity motor (not represented). The electricity motor is preferably used for operating the car 12. According to another embodiment, the electricity motor may be used for another purpose(s), like operating a refrigerator, an air conditioner (not represented) and/or the like provided within the car 12.

The electricity motor is linked to a battery or an accumulator accommodated within the car 12. The battery or accumulator supplies the electricity motor with electricity power.

The car 12 is provided with or connected to a Man Machine Interface (or MMI), like a keyboard and/or a display screen (not represented), as means for interfacing with a user.

The car 12 includes or is connected to a controller 14, such as a logic circuitry or a microprocessor.

The controller 14 is connected, through a bidirectional contact-less and/or contact link(s) 15, to the card 16.

As a contact-less link 15, it may be a short range radio-frequency link, like at 13, 56 MHz. The link may constitute a Near Field Communication link, a Bluetooth (trademark) link, a Wifi link, a Zigbee link or the like.

As a (physical) contact link, it may be an International Organization for Standardization (or ISO) 7816 link, a USB link, a Serial Peripheral Interface (or SPI) link.

A user who owns the card 16 carries the card 16, as a removable token. The card user desires to put the battery (or accumulator) on charge, in order to operate the car 12.

The card 16, as medium, incorporates a chip 160, i.e. an integrated circuit.

Instead of a card, the medium of the chip 160 may be of any type, like a paper document that may be used as a driving license, a USB dongle, or an electronic device, such a mobile telephone.

The chip 160 includes at least one microprocessor 162, as means for processing data, at least one memory 164, as means for storing data, and at least one Input/Output (or I/O) interface 166. The microprocessor 162, the memory 164 and the I/O interface 166 are internally linked together through a data and control bus 163.

The chip 160 is preferably a secure chip that plays, as such, a role of a safe for data stored within the chip memory 164.

The I/O interface 166 allows exchanging data with the controller 14.

The memory 164 can be constituted by one or several EEPROM (acronym for "Electrically Erasable Programmable Read-Only Memory"), one or several ROM (for "Read Only Memory"), one or several Flash memories and/or any other memories of different types, like a RAM (for "Random Access Memory") type.

The memory 164 stores preferably an identifier relating to a user contract with an electricity charging service provider, as an identifier relating to a user, a private key relating to the identifier and a corresponding digital certificate relating to the identifier. The digital certificate is issued by a Certificate Authority (or CA) of an electricity charging service provider or by a trusted third party.

The digital certificate relating to the identifier includes a public key corresponding to the private key and an identifier relating to a user contract with an electricity charging service provider or on its behalf, as operator. A use of an identifier relating to a user contract with an electricity charging service provider allows protecting a privacy of the user, i.e. no information specific to the user, such as a driving license identifier, a personal card identifier is disclosed. The user contract identifier, as an identifier relating to the user, may be a string that is composed of a country code, an identifier of an electricity charging service provider and a user contract number.

The memory 164 may also store a public key corresponding to the private key relating to the user, user data, like a first name, a last name, a bank account number, a birth date, a Personal Identity Number (or PIN), biometric data (like a fingerprint(s), a facial print(s) and/or an iris print(s)), as authentication data, and/or other appropriate data.

The stored data relating to the user is preferably accessed, through the controller 14 and the station 18, from the server 1 10, so as to be provided to the server 1 10.

The chip microprocessor 162 processes data originating from either the chip memory 164 or, through the I/O interface 166, outside. The chip microprocessor 162 executes preferably security functions, in order to protect an access to information, like data stored and managed by the chip 160.

The security functions include preferably a user authentication application to be executed before accessing, in particular, data stored within the chip memory 164. To authenticate the user, the chip 160 stores an application for verifying a PIN or personal biometric data stored securely within the chip 160 and to be input by the chip user, so as to compare with the stored PIN or personal biometric data. Only when successful, the chip 160 authorizes in particular access to data stored within the chip memory 164. Otherwise, the chip 160 forbids access to data stored within the chip memory 164 and/or a running of any application supported by the chip 160.

The security functions include preferentially an encryption/decryption process to be used before sending data to outside/after receiving data from outside, so as to protect access to data managed by the chip 160. To encrypt data to be sent, the chip 160 uses a key and an encryption algorithm, such as an Advanced Encryption Standard (or AES), a Data Encryption Standard (or DES) or the like, that are stored within the chip memory 164. To decrypt data to be received, the chip 160 may use a key and a decryption algorithm, such as an AES, a DES or the like, that are stored within the chip memory 164.

The security functions include preferentially a data signature process to be used before sending data, like a challenge or electricity charging information, to outside, so as to prove an origin of data originating from the chip 160. To sign data to be sent, the chip 160 uses the private key relating to the user and an encryption algorithm, such as an AES, a DES, or the like, that are stored within the chip memory 164, to encrypt the data to be sent.

The chip microprocessor 162 is preferably able to initiate actions, in order to interact directly with the outside world, in an independent manner of the controller 14. Such a capacity of interaction at the initiative of the chip 160 is also known as proactive capacity. The chip 160 is thus able to send to the controller 14, at its own initiative, for instance, a proactive command, such as "Display text", for displaying, through the display screen, some predefined message, a proactive command "Refresh", for re-initializing the chip 160, another proactive command for requesting, through the MMI, a user input, and/or other command(s). The station 18 is located in a public or private place while being accessible to the car 12 and the user.

The station 18 belongs to an electricity charging infrastructure controlled by an electricity provider or a charging infrastructure provider. The charging provider (or on its behalf) operates, as an operator, the server 1 10.

The station 18 is connected, through a network or a plurality of networks symbolized by a bidirectional arrow 19, to the server 1 10. The network(s) use(s) one or several wire and/or wireless technologies.

The server 1 10 may be connected to a plurality of electricity charging infrastructures. Instead of electricity, the concerned energy may be constituted by any fuel oil, any fluid, any liquid, and/or any gaz.

By plugging the car 12 (or another vehicle) into another station that belongs to another electricity charging infrastructure that is operated by another operator, the user, thanks to data stored by her or his card 16, is still able to access electricity charging service. The operator with which the card user has an agreement provides with an electricity charging service even if the card user changes from electricity charging infrastructure operated by the other operator.

The station 18 is provided with a cable 17.

The user plugs the cable 17 into a car 12 socket (not represented). The socket is connected to the battery (or accumulator).

The controller 14 is connected to the station 18 via a bi-directional link (not represented), for instance, via a Power Line Communication (or PLC) over the cable 17. Instead of the PLC between the controller 14 and the station 18, there may be a short range radiofrequency link, as a contact-less link.

The server 1 10 to be addressed may be identified within data stored within the chip memory 164, like the identifier relating to a user contract when used as the identifier relating to a user.

The server 1 10 may be identified by an Uniform Resource Identifier (or URI), like an Uniform Resource Locator (or URL), as server identifier.

The server 1 10 may be operated by either an electricity charging service operator or on its behalf, a mobile radio-communication network operator, a bank operator and/or any other service provider. The server 1 10 comprises a microprocessor(s), as means for processing data, means for storing data and one I/O interface(s).

The server 1 10 is hosted by a computer.

The server 1 10 is dedicated to running an application for managing at least an electricity charging service that allows identifying and preferably authenticating a requesting user before accessing the electricity charging service.

The server 1 10 manages a database stored at the server 1 10 side. The database includes at least one list of at least one identifier relating to a plurality of users. As identifier(s), there is preferably an identifier that allows keeping the privacy of the user, such as an identifier relating to a user contract with an electricity charging service provider.

The server 1 10 is adapted to know whether received data, as presumed an identifier relating to a user, is effectively a registered user comprised within the list(s).

The server 1 10 is preferably arranged to know whether received data is effectively data that originates from the card 16 as the authentic interlocutor. To do this, for instance, the server 1 10 analyses whether received data is effectively the digital certificate relating to the identified user. Previously, the server 1 10 ensures that the digital certificate stored at the server 1 10 side is not yet revoked. The server 1 10 can thus trust the identity included within the digital certificate relating to the identified user, such as an identifier relating to a user, like preferably a user contract identifying number.

The server 1 10 is preferably arranged to send a challenge to an identified interlocutor, so as to be able to authenticate this latter.

The server 1 10 is preferably adapted to analyze whether data, like presumed signed data that is received from the chip 160, as an identified interlocutor, does or does not allow authenticating the requesting user before accessing a service(s) managed by the server 1 10. To carry out such an analysis, the server 1 10 compares received data with reference data, as expected authentication data that is generated for the associated identified user.

The server 1 10 is preferably adapted to check a presence of the concerned vehicle, in a regular manner, for instance each second, after having authorized an access to the electricity charging service, i.e. during an electricity charging session, and/or after an interrupt of electricity charging or provision. Thus, the server 1 10 is ensured that the vehicle that is being provisioned with electricity is effectively the vehicle the card user desires to be charged in electricity.

Figure 2 depicts an example of steps 20 of a method implemented by the controller 14, the card 16, as token, (and more exactly the chip 160), the station 18 and the server 1 10.

It is assumed that a user owns the token 16 that is coupled to the controller 14.

It is further assumed that the user has plugged a station 18 cable into the car 12 socket, so as to charge in electricity the battery or the accumulator of the car 12.

Optionally, once the token 16 is electrically connected to the controller 14, the token carries out an authentication of the user by requesting, through preferably an intuitive user interface, as MMI, to enter a PIN and/or biometric data. As soon as the token 16 has verified that the data entered by the user matches the stored PIN and/or biometric data, the token 16 allows accessing data stored within the token memory 16.

The token 16 sends to the controller 14 an identifier 22 relating to the user. The token 16 and the controller 14 may use Application Protocol Data Unit, as the protocol for exchanging data.

Then, the controller 14 sends, via the station 18, to the server 1 10 the identifier 24 relating to the user originating from the token 16.

The server 1 10 searches within the managed user lists whether the received identifier 24 relating to the user does or does not exist.

If the received data does not match any user identifier, then the server 1 10 rejects an access to its interlocutor which does not provide a registered identifier by sending to the station 18 a message for forbidding the token to supply the currently plugged vehicle with electricity.

Otherwise, i.e. if the received identifier relating to the user does exist, then the server 1 10 goes on by sending, via the station 18 and the controller 14, to the token 16 a challenge 26.

Once received, the token 16 signs the challenge thanks to the private key relating to the user and sends, via the controller 14 and the station 18, to the server 1 10 a message 28 including the signed challenge accompanied with the digital certificate relating to the user. If the received data does not match expected data associated with the identifier relating to the user, as signed challenge, and/or if the digital certificate relating to the user is not authentic, the server 1 10 sends to the station 18 a message for forbidding to supply the currently plugged vehicle with electricity.

Otherwise, i.e. if the received data matches expected data associated with the identifier relating to the user, as signed challenge, and/or if the digital certificate relating to the user is authentic, i.e. if the token 16 is authenticated, the server 1 10 sends to the station 18 a message 210 for authorizing to supply the currently plugged car 12 with electricity.

Preferably, after an electricity charging session, the station 18 sends, via the controller 14, to the token 16 electricity charging information (not represented), the token 16 signs the received electricity charging information. Then, the token 16 sends, via the controller 14 and the station 18, to the server 1 10 the signed electricity charging information, so as to be able to bill the token user for the given electricity charging service.

Claims

1 . A method (20) for accessing an energy charging service,

characterized in that, a vehicle (12) comprising or being connected to a controller (14), the controller being coupled to a removable token (16), the token storing at least one identifier relating to a user, the vehicle being connected to an energy charging station (18), a remote server (1 10) being connected to the energy charging station, the server storing at least one identifier relating to at least one user, the method comprises the following steps:

- the token sends to the controller the identifier (22);

- the controller sends, via the energy charging station, to the server the identifier (24);

- the server identifies, thanks to the identifier, the concerned user.

2. Method according to claim 1 , wherein the identifier relating to a user includes an identifier relating to a user contract with an energy charging service provider.

3. Method according to claim 2, wherein, the token storing a private key relating to an identifier and a corresponding digital certificate relating to the identifier, the digital certificate relating to the identifier including a corresponding public key relating to the identifier and the identifier relating to a user contract with the energy charging service provider, the server sends, via the energy charging station and the controller, to the token a challenge (26), the token signs the challenge thanks to the private key and sends, via the controller and the energy charging station, to the server the signed challenge together with the digital certificate relating to the identifier (28), if the digital certificate relating to the identifier is authentic and if the signed challenge matches expected data associated with the identifier relating to the user, then the server sends to the energy charging station a message (210) for authorizing the energy charging station to deliver energy to the connected vehicle.

4. Method according to any of claims 1 to 3, wherein the energy charging station sends, via the controller, to the token energy charging information, the token signs the energy charging information and sends, via the controller and the energy charging station, to the server the signed energy charging information.

5. Method according to any of claims 1 to 4, wherein, prior to a sending of the identifier from the token to the controller, the method further includes a user authentication step.

6. Method according to claim 5, wherein, the token storing user authentication data, the token carries out the user authentication step.

7. Method according to claim 6, wherein the user authentication data comprises a Personal Identity Number and/or biometric data.

8. Method according to claim 7, wherein the method further comprises a vehicle presence verification step by which the server verifies that the vehicle is still connected after an interrupt of energy charging and/or regularly during an energy charging session.

9. Method according to any of claims 1 to 8, wherein the energy includes at least one element of a group comprising electricity, fuel oil, at least one fluid, at least one liquid and at least one gaz.

10. A system (10) for accessing an energy charging service,

characterized in that the system comprises a vehicle (12), a removable token (16), an energy charging station (18) and a remote server (1 10), the vehicle comprising or being connected to a controller, the controller being coupled to the removable token, the token storing at least one identifier relating to a user, the vehicle being connected to the energy charging station, the remote server being connected to the energy charging station, the server storing at least one identifier relating to at least one user, and

in that the token comprises means for sending to the controller the identifier, the controller comprises means for sending, via the energy charging station, to the server the identifier and the server comprises means for identifying, thanks to the identifier, the concerned user.