EP3104338B1

EP3104338B1 - On-board device for a vehicle

Info

Publication number: EP3104338B1
Application number: EP15465520.3A
Authority: EP
Inventors: Sorin Soare; Iosif Mudra; Daniel-Adrian Pascu; Doru-Marian Aldea-Ungurean; Silviu Stan; Ciprian Vasile Botiz
Original assignee: Continental Automotive Technologies GmbH
Current assignee: Continental Automotive Technologies GmbH
Priority date: 2015-06-12
Filing date: 2015-06-12
Publication date: 2023-05-03
Anticipated expiration: 2035-06-12
Also published as: EP3104338A1

Description

The invention relates to an arrangement comprising an on-board device for a vehicle, an external activation device and an external service device. The invention further relates to a method for a secure communication between an external service device and an on-board device for a vehicle.
In the field of commercial vehicle usage a plurality of applications exist in which data needs to be sent to or received from an on-board device of a vehicle, for instance for analyzing data that has been recorded by the on-board device, for updating the on-board device's software or for modifying operating parameters of the on-board device. In each of the applications different external service devices are used in order to send data to or to receive data from the on-board device.
Exemplary on-board devices that exchange data with external service devices are tolling on-board units, digital tachographs, on-board fleet management devices and advanced driver assistance systems.
The data volume that has to be sent from the external service device to the on-board device and/or from the on-board device to the external service device will increase in almost each application in which a regular data exchange is necessary, since the used hardware and software will be refined such that it will allow recording and/or processing a larger data volume to obtain better or more accurate results.
It is known in the art to use a physical data connection that allows for a high data transfer rate to exchange a large data volume between two electronic devices.
However, the data exchange between the on-board device and the external service device might also be used to manipulate the on-board device. Furthermore, an improperly conducted data exchange may lead to a damage of the on-board device and/or the external service device. Also, there are applications in which the data that has to be exchanged between the on-board device and the external service device is confidential. Therefore, the data connection between the on-board device and the external service device needs to be secure, such that unauthorized access is prevented.
The known physical data connections does always allow some interaction with the electronic control unit of the on-board device, since the electronic control unit has to initialize the external service device upon establishment of the physical connection to allow for a communication. Even when the software requires an authorization, for instance by requesting account information such as user name and password, a data exchange between the on-board device and the external service device is established and might be used to manipulate one of the devices or the data to be exchanged.
It is also known in the art to use a wireless data connection to exchange data between two electronic devices. Wireless data connections provide a more secure data transfer and are more protected against unauthorized access. However, wireless data connections feature significantly lower data transfer rates than physical data connections. Furthermore, particular wireless data connections such as mobile communication is accompanied by high costs, because wireless networks of commercial providers have to be used.
EP 2 189 948 A2 discloses a system with a wake-up circuit and an electronic device that can be a data logger. The wake-up circuit can sense the state of a power source and take action depending on that state.
WO 2012/018733 A2 relates to a diagnostic tool for diagnosing a vehicle in various environments. The tool comprises a processor to control functions of the diagnostic tool, a first memory that stores a software to operate the diagnostic tool and retrieved diagnostic data from the vehicle, a connector interface that connects the diagnostic tool to a data link connector in the vehicle, a serial communication interface that allows the diagnostic tool to communicate with the vehicle in at least one communication protocol and a power management unit that manages the diagnostic tool in various power states depending on the diagnostic tool's activity.
US 2015/066287 A1 discloses a method of removing a vehicle telematics unit from an invalid state. The method comprises sensing that the vehicle telematics unit wirelessly received an invalid state code, determining at the vehicle telematics unit that a reset trigger applicable to invalid state codes has been activated and commanding the vehicle telematics unit to reset the invalid state code.
US 2005/110635 A1 relates to a system, methods and computer program products for monitoring transport containers. The system comprises a monitoring unit secured to a transport container, an interface unit being configured to communicate with the monitoring unit and at least one data key configured to communicate with the monitoring unit. The data key is capable of being configured as an activation key or a deactivation key to activate or to deactivate the monitoring unit.
US 2003/018429 A1 discloses a vehicle tracking system comprising a vehicle tracking unit and a monitoring station communicating therewith. The vehicle tracking unit comprises a controller and a wireless communications device, the controller being switchable between an unregistered mode and a registered mode.
WO 2010/121150 A1 discloses a method of management of a wireless device in an aircraft. The method comprises transitioning the wireless device using a processor, from a first mode to a second mode based on data that is indicative of a change in flight condition of the aircraft, one of the first mode and the second mode being a state of the device in which a transmitter of the device is deactivated and the other of the first mode and the second mode being a state of the device in which the transmitter is activated.
Therefore, the object of the invention is to provide a solution that allows for a quick and secure data transfer between an on-board device for a vehicle and an external service device.
The object of the invention is solved by means of the arrangement according to claim 1 and a method for secure communication according to independent claim 8, while additional aspects of the invention are set out in the dependent claims.
The arrangement comprises an on-board device for a vehicle, an external activation device and an external service device according to claim 1.
The on-board device comprises a first communication module configured for receiving an activation signal from an external activation device. The on-board device further comprises a second communication module configured for communicating with an external service device and for being switched between an activated state and a deactivated state and an electronic control unit configured for activating the second communication module upon receipt of the activation signal at the first communication module.
By using a communication module that can be switched between an activated state and a deactivated state upon receipt of an activation signal at another communication module, a secure communication between the on-board device and the external service device can take place independent from the type of connection between the on-board device and the external service device. According to the invention, a data transfer from the service device to the on-board device or from the on-board device to the service device is only possible when the second communication module of the on-board device is in the activated state. In the deactivated state the second communication module is not able to perform any function; even the detection of a connected external service device does not take place. Therefore, the possibility to switch the second communication module of the on-board device between an activated state and a deactivated state leads to a more secure data transfer between the on-board device and the external service device without any limitations regarding the type of connection between the second communication module of the on-board device and the external service device. This allows using any type of connection between the second communication module of the on-board device and the external service device that provides a high data transfer rate, independent from the level of security the type of connection provides.
In one illustrative embodiment of the on-board device, the second communication module comprises an electrical connector for establishing a physical data connection with the external service device. The electrical connector is an electro-mechanical device for joining electrical circuits. A physical data connection allows for a high data transfer rate between the external service device and the on-board device. By using an electrical connector for establishing a physical data connection with the external service device the exchange of a large data volume can be realized within a short time and results thereby in a less time consuming and more economic data exchange process.
In another non-claimed embodiment of the on-board device, the second communication module is configured for wirelessly communicating with the external service device. It is preferred that the second communication module is configured to use high-speed wireless communication technology, such as Bluetooth or local area wireless computer networking technology, preferably using the 2.4 gigahertz ultra high frequency and/or the 5 gigahertz super high frequency industrial, scientific and medical (ISM) radio bands. Such wireless connection types also allow for a quick and secure data exchange.
In a preferred embodiment of the on-board device, the electrical connector is Universal Serial Bus (USB) connector. A USB connector is a standardized connector type which already achieved a high degree of market penetration with respect to the coupling of electronic devices. The usage of a USB connector does not lead to increased hardware or software costs for the on-board device, since USB connectors are available in large quantities and for low rates. Furthermore, the software implementation is easy and tried and tested over years.
In another embodiment of the on-board device, the electrical connector is a plug and/or socket connector, an 8P8C connector or a D-subminiature connector. These connector types are also used in some fields of technology and provide another possibility to establish a data communication between the on-board device and the external service device featuring a high data transfer rate.
According to the invention, the first communication module is configured for wirelessly communicating with the external activation device. It is preferred that the first communication module is configured to communicate using at least one of the following standards: GSM, UMTS, LTE, WLAN, Bluetooth, RFIF or infrared data communication.
Another embodiment of the on-board device further comprises a monitoring unit configured for monitoring the operation time of the on-board device. The monitoring unit is preferably configured for interrupting the operation of the on-board device upon expiry of a scheduled operation time. Some electronic on-board devices, such as tolling on-board units, need to be serviced regularly, e.g. once a year. The service carried out on on-board tolling devices includes maintenance processes like a self test, a software update or a security card replacement. The monitoring unit ensures that the service is carried out regularly, since it interrupts the operation when the service is not carried out within the scheduled period of time. After interruption of the operation of the on-board device by means of the monitoring unit, the operation can be reactivated by the service personnel.
It is preferred that the on-board device comprises one or more human-machine interfaces such as a display, push-button, a speaker or LEDs for providing an operator, such as a vehicle driver, with information and to allow for manually inputting control commands into the on-board device. In one exemplary embodiment, in which the on-board device is configured as a tolling on-board unit, the on-board device comprises 5 LEDs and 1 push-button for interaction with the vehicle driver. The on-board device may also comprise one or more slide-in modules for entering cards, e.g. security cards, into the on-board device. Such security cards can contain security information, allowing an operator to use specific functions of the on-board device. The on-board device may also comprise a memory device, e.g. for storing data, which is recorded and/or processed during the operation of the on-board device.
In a particular embodiment of the on-board device, the electronic control unit is configured for deactivating the second communication module. Preferably, the deactivation of the second communication module is performed upon receipt of a deactivation signal at the first communication module or at the second communication module of the on-board device. Alternatively, the deactivation of the second communication module is performed upon expiry of a predetermined period of time after termination of the communication between the second communication module and the external service device.
In one embodiment of the on-board device, the on-board device is a tolling on-board unit. In another embodiment of the on-board device, the on-board device is a digital tachograph. In yet another embodiment of the on-board device, the on-board device is an on-board fleet management device.
The external activation device is configured for sending an activation signal to the first communication module of the on-board device. The sending of the activation signal from the external activation device to the on-board device can either take place directly without any additional connection points or in a non-direct way, wherein the activation signal is sent from the external activation device over one or more connection points to the on-board device. The external service device is configured for communicating with the second communication module of the on-board device. The communication between the external service device and the on-board device can also either take place directly without any additional connection points or in a non-direct way, wherein the data is sent from the external service device over one or more connection points to the on-board device and vice versa. Regarding the advantages of the arrangement according to the invention it is referred to the advantages of the on-board device.
In a preferred embodiment of the arrangement according to the invention, the external activation device is configured as a network or internet server. The external activation device runs an application allowing a client to initiate the sending of the activation signal to the first communication module of the on-board device. It is preferred that the external activation device is configured to request identification information, such as a user name and/or a password upon receipt of a request from the client to initiate the sending of the activation signal to the first communication module of the on-board device.
In an advantageous embodiment of the arrangement according to the invention, the external service device is configured as a client of the server. In this embodiment the external service device is configured to send a request to the external activation device to initiate the sending of the activation signal to the first communication module of the on-board device. The external service device is further configured for receiving a request of identification information from the external activation device and for sending such identification information back to the external activation device. The external service device further comprises one or more human-machine interfaces such as a display, push-button, a speaker or LEDs for providing an operator of the external service device with information and to allow for manually inputting control commands into the external service device.
The object of the invention is also solved by means of the method according to claim 8.
the advantages of the method according to the invention it is referred to the advantages of the on-board device and the arrangement according to the invention.
The invention will be further described below with reference to two accompanying drawings, wherein

Fig. 1 is a schematic representation of the arrangement according to the invention; and
Fig. 2 is a schematic representation of the method according to the invention.

The following examples/aspects/embodiments which are not covered by the claims are not according to the invention and are present for illustration purposes only.
As shown in fig. 1 the arrangement 100 according to the invention comprises an on-board device 1, an external activation device 10 and an external service device 20.
The external activation device 10 is configured for sending an activation signal (AS) to a first communication module 2 of the on-board device 1. The external activation device 20 is configured for communicating with a second communication module 3 of the on-board device 1.
The on-board device 1 is a tolling on-board unit and comprises an electronic control unit 4 that is configured for activating the second communication module 3 upon receipt of the activation signal at the first communication module 2. The second communication module 3 comprises an electrical connector 5 for establishing a physical data connection with the external service device 20. The electrical connector 5 is Universal Serial Bus USB connector.
The first communication module 2 is configured for wirelessly communicating with the external activation device 10, preferably by using one of the following standards: GSM, UMTS, LTE, WLAN, Bluetooth, RFIF or infrared data communication.
The on-board device 1 further comprises a monitoring unit 6 configured for monitoring the operation time of the on-board device 1, wherein the monitoring unit 6 is configured for interrupting the operation of the on-board device 1 upon expiry of a scheduled operation time. The on-board device 1 also has various human-machine interfaces 7 such as push-button and LEDs, a slide-in module 8 and a memory device 9.
The electronic control unit 4 of the on-board device 1 is configured for deactivating the second communication module 3 upon receipt of a deactivation signal at the first communication module 2 or at the second communication module 3 of the on-board device 1 or upon expiry of an predetermined period of time after termination of the communication between the second communication module 3 and the external service device 20.
The external activation device 10 comprises human-machine interfaces 11 and is configured as an internet server. The external activation device 10 runs an application allowing the external service device, which operates as a client of the server, to initiate the sending of the activation signal (AS) to the first communication module 2 of the on-board device 1. The external activation device 10 is also configured for creating, updating and storing access logs based on the information sent from the client to the external activation device 10 in order to initiate the sending of the activation signal.
The method 200 for a secure communication between an external service device and an on-board device for a vehicle shown in fig. 2 uses an arrangement comprising an on-board device for a vehicle, an external activation device configured for sending an activation signal to a first communication module of the on-board device, and an external service device configured for communicating with a second communication module of the on-board device. The external activation device is configured as an internet server. The method comprises the following steps:

201) running an application on the server allowing a client to initiate the sending of the activation signal from the external activation device to the first communication module of the on-board device,
202) sending an activation request from the external service device to the external activation device,
203) sending an identification request from the external activation device to the external service device,
204) entering identification information into the external service device,
205) sending the identification information from the external service device to the external activation device,
206) checking the identification information at the external activation device in order to decide whether or not the activation signal from the external activation device is to be sent to the first communication module of the on-board device,
207) sending the activation signal from an external activation device to a first communication module of the on-board device, and
208) switching the second communication module of the on-board device from a deactivated state to an activated state upon receipt of the activation signal at the first communication module of the on-board device.

The steps 202, 203, 205, 206, 207 and 208 are followed by the step of updating an access log at the external activation device 10 based on the information sent from the client to the external activation device 10 in order to initiate the sending of the activation signal (step 209).
After the second communication module of the on-board device is switched from the deactivated state to the activated state the following steps are performed:

210) establishing a communication between the activated second communication module of the on-board device and the external service device, and
211) sending a confirmation of the activation of the second communication module of the on-board device from the first communication module of the on-board device to the external activation device.

After the confirmation of the activation of the second communication module of the on-board device is sent from the first communication module of the on-board device to the external activation device the following steps are performed:

212) sending a confirmation of the activation of the second communication module of the on-board device from the external activation device to the external service device,
213) informing the operator of the external service device that the second communication module of the on-board device is activated by means of a human-machine interface of the external service device.
214) informing the operator of the external activation device that the second communication module of the on-board device is activated by means of a human-machine interface of the external activation device.

After the communication between the activated second communication module of the on-board device and the external service device has been established one of the following steps is performed:

215) switching the second communication module of the on-board device from the activated state to the deactivated state upon receipt of a deactivation signal at the first communication module or at the second communication module of the on-board device, or
216) switching the second communication module of the on-board device from the activated state to the deactivated state upon expiry of an predetermined period of time after termination of the communication between the second communication module and the external service device.

After switching the second communication module of the on-board device from the activated state to the deactivated state the following steps are performed:

217) sending a confirmation of the deactivation of the second communication module of the on-board device from the first communication module of the on-board device to the external activation device,
218) sending a confirmation of the deactivation of the second communication module of the on-board device from the external activation device to the external service device,
219) informing the operator of the external service device that the second communication module of the on-board device is deactivated by means of the human-machine interface of the external service device, and
220) informing the operator of the external activation device that the second communication module of the on-board device is deactivated by means of a human-machine interface of the external activation device.

The shown embodiment of the method according to the invention comprises also the following steps:

221) monitoring the operation time of the on-board device,
222) interrupting the operation of the on-board device upon expiry of a scheduled operation time, and
223) reactivating the on-board device by a communication between the activated second communication module of the on-board device and the external service device.

Claims

Arrangement (100), comprising:
an on-board device (1) for a vehicle , an external activation device (10) and an external service device (20), the on-board device (1) being a tolling on-board unit, a digital tachograph or an on-board fleet management device, the on-board device comprising

a first communication module (2) configured for receiving an activation signal from the external activation device (10) and configured for wirelessly communicating with the external activation device (10),

a second communication module (3) configured for communicating with the external service device (20) and for being switched between an activated state and a deactivated state, a data transfer from the service device (20) to the on-board device (10) or from the on-board device (10) to the service device (20) only being possible when the second communication module (3) of the on-board device (10) being in the activated state, in the deactivated state the second communication module (3) being not able to perform any function and even a detection of a connected external service device (20) does not take place, and

an electronic control unit (4) configured for activating the second communication module (3) upon receipt of the activation signal at the first communication module (2),

the arrangement further comprising the external activation device (10) configured for sending an activation signal to the first communication module (2) of the on-board device (1), and

the external service device (20) configured for communicating with the second communication module (3) of the on-board device (1).
Arrangement (100) according to claim 1,
wherein the external activation device (10) is configured as a network or internet server and runs an application allowing a client to initiate the sending of the activation signal to the first communication module (2) of the on-board device (1).
Arrangement (100) according to claim 2,
wherein the external service device (20) is configured as a client of the server.
Arrangement (100) according to one of the preceding claims, wherein the second communication module (3) of the on-board device (1) comprises an electrical connector (5) for establishing a physical data connection with the external service device (20).
Arrangement (100) according to claim 4, wherein the electrical connector (5) of the on-board device (1) is Universal Serial Bus (USB) connector.
Arrangement (100) according to one of the preceding claims, wherein the on-board device (1) further comprises a monitoring unit (6) configured for monitoring the operation time of the on-board device (1), wherein the monitoring unit (6) preferably is configured for interrupting the operation of the on-board device (1) upon expiry of a scheduled operation time.
Arrangement (100) according to one of the preceding claims, wherein the electronic control unit (4) of the on-board device (1) is configured for deactivating the second communication module (3), preferably upon receipt of a deactivation signal at the first communication module (2) or at the second communication module (3) of the on-board device (1) or upon expiry of an predetermined period of time after termination of the communication between the second communication module (3) and the external service device (20) .
Method for a secure communication between an external service device (20) and an on-board device (1) for a vehicle, the method for an arrangement according to claim 1 and comprising the following steps:
- sending an activation signal from an external activation device (10) to a first communication module (2) of the on-board device (1), the first communication module (2) communicating wirelessly with the external activation device (10),

- switching a second communication module (3) of the on-board device (1) from a deactivated state to an activated state upon receipt of the activation signal at the first communication module (2) of the on-board device (1), an electronic control unit (4) of the on-board device (1) activating the second communication module (3) upon the receipt of the activation signal at the first communication module (2) and

- establishing a communication between the activated second communication module (3) of the on-board device (1) and the external service device (20),
wherein a data transfer from the service device (20) to the on-board device (10) or from the on-board device (10) to the service device (20) is only possible when the second communication module (3) of the on-board device (10) is in the activated state, in the deactivated state the second communication module (3) is not able to perform any function and even a detection of a connected external service device (20) does not take place.
Method according to claim 8,
wherein the external activation device (10) is configured as a network or internet server and the method further comprises the step:
- running an application on the server allowing a client to initiate the sending of the activation signal from the external activation device (10) to the first communication module (2) of the on-board device (1),

wherein the external service device (20) is preferably configured as a client of the server.
Method according claims 8 or 9, further comprising one or more of the following steps before the activation signal is sent from an external activation device (10) to the first communication module (2) of the on-board device (1):
- sending an activation request from the external service device (20) to the external activation device (10),

- sending an identification request from the external activation device (10) to the external service device (20),

- entering identification information into the external service device (20),

- sending the identification information from the external service device (20) to the external activation device (10),

- checking the identification information at the external activation device (10) in order to decide whether or not the activation signal from the external activation device (10) is to be sent to the first communication module (2) of the on-board device (1).
Method according to one of the claims 8 to 10, further comprising one or more of the following steps after the second communication module (3) of the on-board device (1) is switched from the deactivated state to the activated state:
- sending a confirmation of the activation of the second communication module (3) of the on-board device (1) from the first communication module (2) of the on-board device (1) to the external activation device (10),

- sending a confirmation of the activation of the second communication module (3) of the on-board device (1) from the external activation device (10) to the external service device (20),

- informing the operator of the external service device (20) that the second communication module (3) of the on-board device (1) is activated by means of a human-machine interface of the external service device (20).
Method according to one of the claims 8 to 11, further comprising one more of the following steps:
- monitoring the operation time of the on-board device (1),

- interrupting the operation of the on-board device (1) upon expiry of a scheduled operation time,

- switching the second communication module (3) of the on-board device (1) from the activated state to the deactivated state, preferably upon receipt of a deactivation signal at the first communication module (2) or at the second communication module (3) of the on-board device (1) or upon expiry of an predetermined period of time after termination of the communication between the second communication module (3) and the external service device (20),

- sending a confirmation of the deactivation of the second communication module (3) of the on-board device (1) from the first communication module (2) of the on-board device (1) to the external activation device (10),

- sending a confirmation of the deactivation of the second communication module (3) of the on-board device (1) from the external activation device (10) to the external service device (20),

- informing the operator of the external service device (20) that the second communication module (3) of the on-board device (1) is deactivated by means of the human-machine interface of the external service device (20).