Method for unlocking a service, computer program, device and vehicle

Abstract

Exemplary embodiments of the present invention provide a method 100 for use by a communication device to activate a service. The method 100 comprises receiving 110 identification data indicative of a user's identity. The identification data is received by a user terminal device. The identification data is signed with a private key of a digital vehicle key. Furthermore, the method 100 comprises determining 120 a user's identity based on the identification data. The method 100 further comprises verifying 130 a user's authorization to use the service based on the determined user's identity. Finally, the method 100 comprises activating 140 the service based on the verified authorization.

Description

[0001] Embodiments of the present invention relate to methods for activating a service, a computer program, a device and a vehicle, in particular but not exclusively to a concept for activating the service based on an identity of a user.

[0002] Using a service, e.g., on a toll road or in a parking garage, can be cumbersome because a vehicle user has to go to a terminal outside the vehicle. This applies, for example, to payment systems that are not connected to the vehicle, e.g., in a parking garage. Activating a service can only be done after using the payment system outside the vehicle. Therefore, it may be necessary to improve the activation of a service.

[0003] There is therefore a need to provide an improved method for activating a service. The method, device, computer program, and vehicle according to the independent claims address this need.

[0004] Embodiments are based on the core idea that a method for activating a service can be implemented based on a user's identity and a user authorization check. This allows a service to be activated for a user who is authorized to use this service. In particular, activation can be improved based on the authorization check. For example, based on the user's identity, it can be verified whether the user has paid for the service.

[0005] Embodiments relate to a method for activating a service, carried out by a communication device. The method comprises receiving identification data indicative of a user's identity. The identification data is received by a user terminal. The identification data is signed with a private key of a digital vehicle key. The method further comprises determining an identity of the user based on the identification data. The method further comprises checking an authorization of the user to use the service based on the determined identity of the user. The method further comprises activating the service based on the checked authorization. By receiving identification data, the communication device can obtain information about an identity of a user of the user terminal. The communication device can thereby determine an identity of the user.For example, the identification data includes metadata associated with a digital vehicle key. Information about the user's identity can be stored in the metadata. Based on the determined identity, a check can be performed to verify the user's authorization to use the service. This allows the communication device to determine whether the user is authorized to use the service. This can improve the activation of the service.

[0006] In one embodiment, the method may further comprise sending confirmation data indicative of the activation of the service to the user terminal. This allows a user of the user terminal to be informed of the activation of the service.

[0007] In one embodiment, determining the identity can comprise obtaining verification data indicative of an account identifier (ID) assigned to the user. Furthermore, determining the identity can comprise determining the user's identity based on the verification data and the identification data. The verification data can increase the security of determining the user's identity. The assigned account ID can, for example, have been verified by a certified authority (CA). For example, the identification data can comprise a certificate chain of the private key of the digital vehicle key. Information about the user's identity can be stored in this certificate chain. The verification data can then be used to determine an assigned account ID based on the certificate chain.This allows a reliable and unambiguous assignment of the user’s identity.

[0008] In one embodiment, obtaining the verification data may include receiving the verification data from a backend. The backend may, in particular, be a CA. This allows the communication device to receive the verification data from a trusted authority.

[0009] In one embodiment, verifying authorization may include receiving usage data indicative of the user's authorization to use the service and verifying the user's authorization to use the service based on the determined identity and the usage data. The usage data may be received, for example, from a parking garage operator or a toll road operator. In particular, the usage data may be received from a contractual partner of the user who provides the service. By using the usage data, the up-to-dateness of the user's authorization can be ensured.

[0010] In one embodiment, receiving can occur via a local communication connection. This allows common communication connections to be used for the digital key to unlock the service.

[0011] Embodiments relate to a method for activating a service by a user terminal. The method comprises creating identification data indicative of the user's identity by signing an authentication request using a private key of a digital vehicle key and transmitting the identification data.

[0012] In one embodiment, the method may further comprise receiving, from a communication device, the authentication request for signing with the private key of the digital vehicle key. This allows the user terminal to create a signature for a specific service.

[0013] Embodiments also provide a computer program for performing any of the methods described herein when the computer program runs on a computer, a processor, or a programmable hardware component.

[0014] Another embodiment is a device for activating a service. The device comprises an interface for communicating with a user terminal or a communication device and a data processing circuit configured to carry out at least one of the methods described herein.

[0015] Exemplary embodiments are explained in more detail below with reference to the accompanying figures. They show: Fig. 1 shows a schematic representation of a method for activating a service; Fig. 2 shows a schematic representation of another method for activating a service; and Fig. 3 shows a block diagram of an embodiment of a device for enabling a service.

[0016] Various embodiments will now be described in more detail with reference to the accompanying drawings, in which some embodiments are illustrated. In the figures, the thickness dimensions of lines, layers, and / or regions may be exaggerated for clarity.

[0017] Fig. Figure 1 shows a schematic representation of a method 100 for activating a service. The method can be carried out by a communication device. The communication device can include a data processing circuit for performing processes (e.g., for determining the user's identity or for activating the service) and a communication interface (e.g., for receiving the identification data).

[0018] The method 100 includes receiving 110 identification data indicative of a user's identity. The identification data is received by a user terminal. The identification data is signed with a private key of a digital vehicle key. High security standards can apply to a digital vehicle key. For example, a private key of the digital vehicle key is stored in a secure element of the user terminal. This can increase security. Furthermore, the use of the digital vehicle key allows access to an existing infrastructure for user identification.

[0019] The digital vehicle key can in particular be a digital vehicle key as defined by the Car Connectivity Consortium (CCC), for example as defined in Digital Key Release 3.0 [1]. Signing can ensure the integrity and / or authenticity of the identification data. This can, for example, ensure that a service request can be assigned to a user's identity. The private key of the user terminal can be stored in a security element of the user terminal. A security element can be used to securely store confidential information and to protect against unauthorized access to sensitive data. The security element can be a storage device. The security element can be physically separated from other components of the communication device. The security element can have strict security measures to protect the integrity of the stored data.This allows an increased security standard to be achieved by using the CCC infrastructure.

[0020] Furthermore, the method 100 includes determining 120 an identity of the user based on the identification data. The identification data can, for example, comprise information about the user of the user terminal. This information can be signed using the private key of the digital vehicle key. For example, the user terminal can generate information for identifying the user and sign it using the private key. This can ensure the integrity and authenticity of the information.

[0021] Optionally or alternatively, the identification data may include a certificate chain linked to the digital key. Information about the user's identity can then be determined based on the certificate chain. For example, metadata of the certificate chain can enable the user's identity to be assigned or determined. For example, the certificate chain can include information for assigning an account ID (as described below).

[0022] The method 100 further includes checking 130 the user's authorization to use the service based on the determined identity. Based on the determined identity, the communication device can check whether a user is authorized to use the service. For example, a user may have a contract with a parking garage operator that authorizes them to use a parking garage. For example, a user may have paid a fee for a toll road online, thereby authorizing the user to use the toll road. By checking 130, the communication device can therefore determine, for example, whether the service should be activated for the user because the user is authorized to use the service.

[0023] Furthermore, the method 100 comprises enabling 140 the service based on the verified authorization. Activating 140 can, for example, comprise controlling or triggering the opening of a barrier. This allows a user to obtain access to a service, for example, the use of a toll road or a parking garage. Optionally or alternatively, enabling 140 can comprise permitting the establishment of a communication connection between the user terminal and the communication device (or triggering the establishment of a communication connection between the user terminal and another communication device). For example, the user can establish a local communication connection, for example, a wireless local area network (WLAN) communication connection, for data communication. This allows a user to obtain access to a service, i.e., the WLAN communication connection, for communication purposes.

[0024] In one embodiment, method 100 may further comprise sending confirmation data indicative of the activation of the service to the user terminal. For example, the confirmation data may include information about the activated service, a usage period of the service, and any remaining credit for using the service. This allows the user to be informed of relevant information regarding the service in a simplified manner.

[0025] In one embodiment, determining 120 the identity may comprise obtaining verification data indicative of an account identifier assigned to the user. Furthermore, determining the identity may comprise determining the identity of the user based on the verification data and the identification data. The verification data may allow a unique assignment of the user or an identity of the user. The verification data may, in particular, be indicative of an account ID of a user of the private key of the user terminal. An identity of the user may be associated with the account ID. For example, authentication of the user, for example by means of an identity card or a passport, may be required to create the account ID. Accordingly, the account ID can be uniquely assigned to a user.For example, the account ID can replace verification with an identity card or passport.

[0026] In addition to being a vehicle key, the digital vehicle key can also be used as the user's digital identity. The digital vehicle key can provide a unique, particularly cryptographically confirmed, association with a user terminal. The so-called account ID according to the CCC specification can be used for this purpose. The account ID can be used to establish an association with a user account of the user on the respective user terminal platform used. This association (digital vehicle key to account ID) can be used to uniquely identify the user. In particular, a certificate chain associated with the digital vehicle key can be used for this purpose. The certificate chain can include metadata. The metadata can include an associated account ID; see also the CCC specification [1].The link between the digital vehicle key and a user's account ID can be defined in accordance with the CCC, for example, as defined in [1]. The verification data can, in particular, include information about the assignment of the account ID to the vehicle key. The verification data can be stored in a storage unit of the communication device. This allows the verification data to be read from the storage unit when needed.

[0027] Optionally or alternatively, the verification data can be received from a backend, for example, a user terminal platform. In one embodiment, obtaining the verification data can include receiving the verification data from a backend. The verification data can be received, for example, in response to the identification data being sent to the backend. This allows the communication device to obtain the information required to determine the user's identity. In particular, this can ensure that the verification data is up-to-date.

[0028] In one embodiment, verifying authorization may include obtaining usage data indicative of the user's authorization to use the service and verifying the user's authorization to use the service based on the determined identity and the usage data. The usage data may, for example, be stored in a storage unit of the communication device. Obtaining the usage data may then include reading it from the storage unit. This allows the communication device to access the usage data without a communication connection, for example, to a server.

[0029] Optionally or alternatively, the usage data can be received by a server. For example, the communication device can send information about the user's identity to a server, such as a server of a parking garage operator or toll road operator. The communication device can then receive usage data from the server, which may include information about the user's authorization. This ensures that the usage data is up-to-date.

[0030] In one embodiment, receiving can occur via a local communication connection. This allows common communication connections to be used for the digital key to unlock the service. A local combination connection can be a Bluetooth communication connection, a WLAN communication connection, and / or an ultra-broadband communication connection.

[0031] The communication device can generally be a device capable of wireless communication. The communication device can communicate with a backend, e.g., a base station, a user terminal in a mobile communication system. For example, the communication device can communicate within / via a mobile communication system. The mobile communication system can comprise a plurality of transmission points and / or base stations capable of transmitting radio signals to the control unit. The communication device can communicate with the user terminal in a local communication system.

[0032] Further details and aspects are mentioned in connection with the embodiments described below. Fig. 1 may comprise one or more optional additional features corresponding to one or more aspects related to the proposed concept or one or more embodiments described below (e.g. Fig. 2 - 3) were mentioned.

[0033] Fig. 2 shows a schematic representation of a further method 200 for activating a service. The method 200 can be carried out by a user terminal. The user terminal can comprise a data processing circuit for carrying out processes (for example, for creating identification data) and an interface for communication (for example, for sending the identification data). The method 200 can be used in particular together with the method described with reference to Fig. 1, within the framework of the transmitter and receiver.

[0034] The method 200 comprises creating 210 identification data indicative of an identity of the user by signing an authentication request using a private key of a digital vehicle key and sending 220 the identification data. The identification data can be sent to a communication device. Optionally, the method 200 further comprises receiving an authentication request, for example from a communication device. The received authentication request can then be signed 210. By receiving an authentication request, the identification data for a specific service can be created. The authentication request can be indicative of the request for identification data of the user terminal by the communication device. For example, the communication device can request an identification ortrigger a creation 210 of identification data by the user terminal.

[0035] In one embodiment, the method may further comprise receiving, from a communication device, the authentication request for signing with the private key of the digital vehicle key. This allows the user terminal to create a signature for a specific service.

[0036] The user terminal can generally be a device capable of wireless communication. In particular, the user terminal can be a mobile user terminal, e.g., a user terminal suitable for being carried by a user. The user terminal can, for example, be a user terminal (UT) or user equipment (UE) within the meaning of the respective communication standards used for mobile communication. The user terminal can, for example, be a mobile phone, such as a smartphone, or another type of mobile communication device, such as a smartwatch, a laptop, a tablet computer, autonomous augmented reality glasses, etc.

[0037] Further details and aspects are mentioned in connection with the embodiments described below and / or above. Fig. 2 may comprise one or more optional additional features corresponding to one or more aspects related to the proposed concept or one or more of the above (e.g. Fig. 1) and / or embodiments described below (e.g. Fig. 3) were mentioned.

[0038] Fig. Figure 3 shows a block diagram of an embodiment of a device 30 for enabling a service. The device 30 comprises an interface 32 for communication with a user terminal (for example, a user terminal which is described with reference to the method in Fig. 2) or a communication device (toys are a communication device which, with reference to the method in Fig. 1). The device 30 further comprises a data processing circuit 34 which is designed to carry out at least one of the methods described herein, for example the method which is described with reference to Fig. 1 for the communication device or with reference to Fig. 2 for the user terminal. Further embodiments include a parking meter 40 or a terminal for activating the service with a device 30.

[0039] The Fig. The interface 32 shown in Figure 3 can, for example, correspond to one or more inputs and / or one or more outputs for receiving and / or transmitting information, for example in digital bit values, based on a code, within a module, between modules, or between modules of different entities. The interface 32 can, for example, be configured to communicate with other network components via a (radio) network or a local area network.

[0040] In exemplary embodiments, the data processing circuit 34 can correspond to any controller or processor or a programmable hardware component. For example, the data processing circuit 34 can also be implemented as software programmed for a corresponding hardware component. In this respect, the data processing circuit 34 can be implemented as programmable hardware with appropriately adapted software. Any processors, such as digital signal processors (DSPs), can be used. Exemplary embodiments are not limited to a specific type of processor. Any processor or even multiple processors are conceivable for implementing the data processing circuit 34.

[0041] As in Fig. 3, the interface 32 may be coupled to the respective data processing circuitry 34 of the device 30. In examples, the device 30 may be implemented by one or more processing units, one or more processing devices, any means of processing, such as a processor, a computer, or a programmable hardware component operable with appropriately adapted software. Likewise, the described functions of the data processing circuitry 34 may also be implemented in software, which is then executed on one or more programmable hardware components. Such hardware components may be a general-purpose processor, a digital signal processor (DSP), a microcontroller, etc.The data processing circuit 34 may be capable of controlling the interface 32 such that any data transfer that occurs over the interface 32 and / or any interaction that the interface 32 may be involved in can be controlled by the data processing circuit 34.

[0042] In one embodiment, the device 30 may include a memory and at least one data processing circuit 34 operatively coupled to the memory and configured to perform one of the methods described above.

[0043] In examples, interface 32 may correspond to any means for obtaining, receiving, transmitting, or providing analog or digital signals or information, e.g., any terminal, contact, pin, register, input terminal, output terminal, conductor, trace, etc., that enables the provision or receipt of a signal or information. Interface 32 may be wireless or wired and may be configured to communicate with other internal or external components, e.g., to send or receive signals or information.

[0044] Further details and aspects are mentioned in connection with the embodiments described above. Fig. 3 may comprise one or more optional additional features corresponding to one or more aspects related to the proposed concept or one or more of the above (e.g. Fig. 1 - 2) described embodiments were mentioned.

[0045] Further embodiments are computer programs for carrying out one of the methods described herein when the computer program runs on a computer, a processor, or a programmable hardware component. Depending on specific implementation requirements, embodiments of the invention can be implemented in hardware or in software. The implementation can be carried out using a digital storage medium, for example a floppy disk, a DVD, a Blu-ray disc, a CD, a ROM, a PROM, an EPROM, an EEPROM or a FLASH memory, a hard disk, or another magnetic or optical storage device on which electronically readable control signals are stored that can interact or interact with a programmable hardware component in such a way that the respective method is carried out.

[0046] A programmable hardware component can be formed by a processor, a computer processor (CPU = Central Processing Unit), a graphics processor (GPU = Graphics Processing Unit), a computer, a computer system, an application-specific integrated circuit (ASIC = Application-Specific Integrated Circuit), an integrated circuit (IC = Integrated Circuit), a single-chip system (SOC = System on Chip), a programmable logic element or a field-programmable gate array with a microprocessor (FPGA = Field Programmable Gate Array).

[0047] The digital storage medium can therefore be machine- or computer-readable. Some embodiments thus comprise a data carrier having electronically readable control signals capable of interacting with a programmable computer system or a programmable hardware component such that one of the methods described herein is performed. One embodiment is thus a data carrier (or a digital storage medium or a computer-readable medium) on which the program for performing one of the methods described herein is recorded.

[0048] In general, embodiments of the present invention can be implemented as a program, firmware, computer program, or computer program product with program code or data, wherein the program code or data is effective to perform one of the methods when the program runs on a processor or a programmable hardware component. The program code or data can also be stored, for example, on a machine-readable medium or data carrier. The program code or data can be present, among other things, as source code, machine code, or bytecode, as well as other intermediate code. List of reference symbols 30 Device 32 interface 34 Data processing circuit 40 Terminal for activating a service 100 procedures for activating a service 110 Receiving identification data 120 Determining the identity of the user 130 Checking the user's authorization to use the service 140 Activating the service 200 Procedures for activating a service 210 Creating identification data 220 Sending the identification data

Claims

[1] A method (100) for performing by a communication device for activating a service, comprising: Receiving (110), from a user terminal, identification data indicative of an identity of the user, the identification data being signed with a private key of a digital vehicle key; Determining (120) an identity of the user based on the identification data; Checking (130) the user’s authorization to use the service based on the determined identity; and Activation (140) of the service based on the verified authorization. [2] The method (100) of claim 1, further comprising sending, to the user terminal, confirmation data indicative of the activation of the service. [3] The method (100) according to any one of the preceding claims, wherein determining the identity comprises: Obtaining verification data indicative of an account identifier associated with the user; and Determining the user's identity based on the verification data and the identification data. [4] The method (100) of claim 3, wherein obtaining the verification data comprises receiving the verification data from a backend. [5] The method (100) according to any one of the preceding claims, wherein checking an authorization comprises: Obtaining usage data indicative of the user’s authorization to use the service; and Verifying the user's eligibility to use the service based on the identified identity and usage data. [6] The method (100) according to any one of the preceding claims, wherein receiving occurs via a local communication link. [7] A method (200) for performing by a user terminal for activating a service, comprising Creating (210) identification data indicative of an identity of the user by signing an authentication request using a private key of a digital vehicle key; and Sending (220) the identification data. [8] The method (200) of claim 7, further comprising receiving, from a communication device, the authentication request for signing with the private key of the digital vehicle key. [9] A computer program for carrying out one of the methods (100; 200) according to one of the preceding claims, when the computer program runs on a computer, a processor, or a programmable hardware component. [10] A device (30) for activating a service, comprising: an interface (32) for communication with a user terminal or a communication device; and a data processing circuit (34) configured to carry out at least one of the methods (100; 200) according to any one of claims 1-8.

Images