Patent Publication Number: US-5898782-A

Title: Method and system to secure the transmission of data elements between a sensor and a recorder

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     An object of the present invention is a method by which it is possible to secure the transmission of data elements between a sensor delivering pulses and a recorder processing these pulses, as well as a system to implement the method. 
     The field of application that is a particular object of the invention is that of chronotachographs used in heavy road vehicles to verify their speed of movement and check compliance by truck drivers with the regulations on time. 
     2. Description of the Prior Art 
     At present, chronotachographs consist essentially of a tachometric sensor that transmits one or more pulses by a differential electrical link to a recorder, for example a disk, each time that the wheels of the heavy road vehicle have made one revolution. By examining the period of repetition of the recorded pulses, the speed of the vehicle in motion is deduced. 
     The sensor and the recorder are generally separated by a distance of 2 to 10 meters. 
     For the time being, there is no security system provided on existing chronotachographs. This enables all types of fraudulent activity: it is possible in particular to set up a parallel connection of a false sensor on the link between the existing sensor and recorder. This false sensor modifies (in this case reduces) the number of pulses transmitted. 
     The aim of the present invention is to secure the transmission of data elements between the sensor and the recorder, and to do this at several levels: 
     First of all it is sought to secure the transmission at the level of the link, on the one hand to prevent false information from being transmitted to the recorder and, on the other hand, to prevent a falsified sensor from being connected instead of the one that has been certified by the checking organization. 
     More specifically, an aim of the invention is to detect and record any attempt to falsify the link between the sensor and the recorder. 
     Then, with regard to the information transmitted, the invention is designed to prevent the data elements of the sensor from being modified. 
     The present invention may be extended to any type of transmission between a sensor delivering pulses and a recorder in charge of processing them. 
     SUMMARY OF THE INVENTION 
     To achieve the above aim, an object of the present is a method for the securing of the transmission of data elements between a sensor delivering pulses and a recorder processing these pulses, wherein said method comprises the following steps: 
     setting up an exchange of enciphered data elements between a recorder module comprising said recorder and a sensor module comprising said sensor through a series link, said data elements comprising digital command messages generated by the recorder module and enciphered by a first enciphering code C, digital return messages generated by the sensor module, either in response to command messages received and deciphered or for the transmission of said pulses with a view to their processing, the return messages being enciphered by a second enciphering code C&#39;; 
     performing a deciphering and a checking of the return messages received by the recording module to permanently validate the integrity of the link and of the data elements. 
     The command messages used may be of several types: 
     There may be, for example, at least one message requesting sensor identification, messages requesting modification of-the first enciphering code C and/or of the second enciphering code C&#39;, or again link testing messages. The return messages coming from the sensor module are then adapted accordingly and the verification step enables the checking of their coherence. 
     Advantageously, the enciphered data elements exchanged between the recording module and the sensor module are modulated before transmission by a pulse width modulation with two states of a fixed frequency carrier, and are demodulated at reception. 
     Furthermore, an object of the present invention is also a system to implement the securing method, said system comprising a recorder module, a sensor module and a series link between the recorder module and the sensor module, wherein the recorder module comprises means to generate the enciphered digital command messages, means to decipher the return messages and means to check the return messages, wherein the sensor module comprises means to decipher the command messages received and means to generate the enciphered return messages. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     Other characteristics and advantages of the present invention shall appear from the following description, given with reference to the appended figures, of which: 
     FIG. 1 illustrates the general principle of the enciphering and deciphering according to a code generated by a reversible polynomial; 
     FIGS. 2a and 2b give a view, in the form of a flow chart, of the working of a possible system implementing the method according to the invention on the recorder module side (FIG. 2a) and the sensor module side (FIG. 2b). 
    
    
     MORE DETAILED DESCRIPTION 
     The principle of the securing method according to the invention relies on a permanent exchange of enciphered data elements between a recorder module comprising the recorder and a sensor module comprising the sensor. 
     According to the invention, the exchange is carried out on the initiative of the recorder module which sends enciphered command messages to the sensor module. The sensor module acknowledges the commands and then, in its turn, generates enciphered return messages either to indicate the acknowledgement of the command or to transmit pulses from the sensor with a view to their processing by the recorder. The recorder module then deciphers and verifies the return messages in order to firstly check the coherence of these messages and secondly restore the pulses to the recorder. 
     Preferably, for the enciphering and deciphering, codes generated by reversible polynomials are used. Hereinafter, referring to FIG. 1, the general principle of the enciphering/deciphering of any message M is recalled. 
     A shift register 4 with a size N working at a rate H enables the generation of a pseudo-random code Q whose sequence has the size 2 N  -1. An OR gate 5 receives firstly the enciphering code Q and secondly the message M to be transmitted, and delivers an enciphered message Q M! transmitted through the link 3. The output of the gate 5 is looped to the input of the register 4. At reception, another shift register 6 also working at the rate H receives the enciphered message Q M! at input. The output of the register is delivered to another logic gate 7 also receiving the enciphered message. Consequently, the deciphered message M is received at output of the gate 7. 
     A detailed description is given here below of the principle of the method according to the invention with reference to FIGS. 2a and 2b which show a flow chart of operation for a possible system implementing the method according to the invention. More specifically, FIG. 2a illustrates the system at the level of the recorder module and FIG. 2b illustrates the system at the level of the sensor module. 
     As can be seen in FIG. 2a, the recorder module 1 comprises, on the one hand, first means 11 to 14 enabling it to generate enciphered command messages and, on the other hand, second means 10 and 15 to 19 to check the return messages. 
     The first means comprise a module 11 to generate a first enciphering code C. This enciphering code is advantageously generated by a reversible polynomial. 
     A module 12 furthermore generates the command messages M c  proper. These messages are then enciphered according to the first enciphering code C by an enciphering module 13, so as to deliver enciphered command messages C(M c ). 
     These messages are advantageously modulated by a pulse width modulation with two states of a fixed frequency carrier, equal for example to 2 MHz. This means that it is not necessary to transmit the clock signal used to synchronize the circuits of the sensor module for the demodulation and the deciphering of the messages. 
     The enciphered and modulated command messages X C(M c )! are then transmitted to the sensor module 2 by a differential type of series link 3 for example an RS 422 type series link. 
     Referring to FIG. 2b, the sensor module 2 then carries out a demodulation 21 of the messages received and then a deciphering 22 of the demodulated messages C(M c ) obtained so as to return to the initial command messages M c . 
     Depending oh the command messages received, the sensor module will perform certain tasks. 
     In a preferred embodiment of the invention, the command messages are of three types: 
     The command message may be, for example, a message requesting the identification of the sensor 20, in which case the sensor module, by means of a module 24, will generate a return message M R  comprising an information element Id c  identifying the sensor 20, for example its series number. This message may be sent at the beginning of the exchange, or periodically. 
     The message may also be a request for the initialization of the enciphering codes, the initialization code being conventionally generated by a pseudo-random sequence generator with a size N&#39; that thus extends the size of the total resultant sequence. This operation herein is achieved by the module 11 which sends the modules 23, 25 and 130 the codes for the future exchanges. The enciphering modules 13 and 26 and the deciphering module 22 and 16 are then capable of interfacing with the new codes. 
     The message may be a link testing message. In this case, the module 24 generates simply a return message meeting this test. 
     Furthermore, apart from the return messages corresponding to responses to command messages, the module 24 also generates return messages comprising the pulse delivered by the sensor 20. 
     In any case, the return messages M R  are also enciphered by an enciphering module 26, according to a second enciphering code C&#39; generated by a module 25. 
     Like the first code C, the second code C&#39; is advantageously generated by a reversible polynomial according to standard techniques. 
     Then the enciphered response messages are modulated by the module 27, and the messages obtained X C&#39; (M R )! ate transmitted through the series link 3. 
     Referring again to FIG. 2a, the return messages X C&#39; (M R )! received by the recorder module 1 are then demodulated by a demodulation module 15, and then deciphered by the deciphering module 16 as a function of the second enciphering code C&#39;. 
     A step is then performed to verify the messages M R  obtained. To do this, the recorder module 1 has a module 17 for processing transmission defects. This module 17 makes it possible to check the coherence of the messages received following a command. Should the command be a request for the identification of the sensor, this module 17 makes a check to find out whether the return message comprises an information element corresponding to a predetermined identification Id. This makes it possible to detect the connections of falsified sensors. Should the command be a request for reinitializing enciphering codes, the module 17 ascertains that the return message M R  includes an information element pertaining to the acknowledgement of reinitialization. Should the command be a linking test, the module 17 ascertains that it receives a response at the end of a predefined period T. 
     A module 18 then enables the management of the defects that have been detected. For the application to the chronotachograph of heavy road vehicles, it may be planned that the detection of a defect, whatever its nature, will be expressed by an oscillation of the speedometer needle between, for example, 8 km/h and 20 km/h and/or by the flashing of the light that indicates the recording and the operation of the recording styluses, and/or by a plotting on the recorder disk. 
     In another embodiment, the processing of the return messages activates defects that will be identified specifically (sensor, link, data, etc.). 
     Furthermore, a module 19 enables the restitution, from the return message M R , of the pulse sent out by the sensor 20 with a view to its processing by the recorder 10. 
     Certain alternative embodiments may be achieved without departing from the framework of the present invention. It is possible especially to provide for command messages other than those explained here above, with an adequate checking of the response of the sensor module.