Method and system for controlling data access to an information technology system for a track-bound vehicle

Abstract

The invention relates to a computer-implemented method for controlling data access to an information technology system (7) for a track-bound vehicle (1). In the method, the data access to the information technology system (7) is provided (D, CC) from a further information technology system (19) which was added (B) after production (A, AA) of the track-bound vehicle (1). In order to improve the controlling of data access to the information technology system, the access is mediated exclusively via a masking layer (25, 125), wherein the masking layer (25, 125) masks a masking portion of the information technology system (7) prior to the access from the further information technology system (19).

Description

[0001] Description

[0002] Method and system for controlling data access to an information technology system for a track-bound vehicle

[0003] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identity are included.

[0004] The invention relates to a computer-implemented method for controlling data access to an information technology system for a rail-bound vehicle. In the method, data access to the information technology system is provided from another information technology system, which is added after the production of the rail-bound vehicle.

[0005] Generally, rail-bound vehicles are known to be equipped with a variety of network components and computer systems. These serve to implement functions for operating the rail-bound vehicle. The rail-bound vehicle is currently delivered to a customer with a defined configuration consisting of hardware and software. The hardware and software are configured to ensure the correct function and operation of the rail-bound vehicle.

[0006] Against this background, it is the object of the present invention to improve the control of data access to the information technology system.

[0007] This object is achieved by a computer-implemented method according to the invention of the type mentioned at the outset, in which access is mediated exclusively via a concealment layer, wherein the concealment layer conceals a concealment portion of the information technology system from access from the further information technology system.

[0008] The invention is based on the realization that vehicle manufacturers' customers often express a desire to change the equipment, mode of operation, and / or range of functions of the rail-bound vehicle after completion and delivery. For example, the range of functions of the rail-bound vehicle is to be expanded by adding further hardware and / or software. However, it must be taken into account that the vehicle functions provided and for which the manufacturer is responsible must not be impaired. This could affect the safe operation of the vehicle and even make a new registration procedure for the vehicle necessary.

[0009] To prevent a negative impact on the correct functioning of the track-bound vehicle, the invention proposes that the masking portion of the information technology system be masked from access by the other information technology system. In this way, undesirable repercussions on the information technology system and thus, in particular, on the reliable operation of the vehicle can be prevented.

[0010] In other words: The solution according to the invention has the effect that access to the information technology system can only take place in a defined sub-area and / or to defined sub-functions of the system.

[0011] A key advantage of the invention is that it gives the customer the option of modifying the equipment, mode of operation, and / or range of functions of the rail-bound vehicle without the involvement of the vehicle manufacturer. This can reduce the costs of operating the rail-bound vehicle that would arise if the vehicle manufacturer were to involve the vehicle manufacturer. An example of a modification of this type is the installation of analysis software by the customer without the involvement of the vehicle manufacturer. The masking layer allows, for example, the data required for the analysis to be retrieved and prevents, for example, this analysis software from accessing and influencing functions within the customer's area of ​​responsibility (e.g. passenger payment).

[0012] An example of equipment modification is the installation of a ticket machine in the vehicle by the customer without the involvement of the vehicle manufacturer. The masking layer prevents the ticket machine from accessing functions within the customer's area of ​​responsibility. In return, it allows the ticket machine to receive information from the information technology system, such as seat occupancy.

[0013] The wording "for a rail-bound vehicle" should preferably be understood to mean that the information technology system is part of the rail-bound vehicle. Alternatively or additionally, the information technology system may extend across the vehicle and a land-based facility.

[0014] The track-bound vehicle is preferably a rail vehicle, for example a multiple unit.

[0015] Preferably, the information technology system provides a plurality of services, wherein the concealment layer mediates a subset of the plurality of services for access from the second information technology system.

[0016] By concealing the concealment portion, a virtual image of the information technology system is made available to the additional information technology system. Preferably, the concealment layer specifies which read and write rights the additional information technology system has within the information technology system. Furthermore, it is preferably specified which changes can be made to the vehicle and / or the information technology system from the additional information technology system.

[0017] Further preferably, the concealment layer comprises an application layer gateway.

[0018] According to a preferred embodiment of the computer-implemented method according to the invention, the information technology system forms a first system component of an overall system, and the further information technology system forms a second system component of the overall system. The first and second system components are physically at least partially part of the same hardware of the overall system, with the masking layer forming an information technology separation between the first and second system components.

[0019] Preferably, the first and second system components are fully part of the overall system. This overall system is, for example, a system consisting of network components and computer systems arranged on a track-bound vehicle. The separation between the first and second system components is preferably carried out exclusively by information technology. In other words: the first and second system components are part of a common physical device and are separated from each other only by information technology by the masking layer.

[0020] According to a further preferred embodiment of the computer-implemented method according to the invention, the first system component comprises software from a vehicle manufacturer, and the second system component comprises software from a third party. The vehicle manufacturer's software and the third-party software are executed on a computing device of the vehicle manufacturer.

[0021] Preferably, the information technology system comprises physical components, such as computing devices, network components, and software, with the further information technology system consisting of software. In other words, the vehicle manufacturer's software and the third-party software are executed together on the same computing device. This computing device is the responsibility of the vehicle manufacturer. The computing device is, for example, a computer with one or more processors, wherein the processors have one or more computing cores.

[0022] For example, the first software component runs as the first container and the second software component runs as the second container on the same computing device. These containers are implemented, for example, using Kubernetes (https: / / de. Wikipedia.or g / wiki / Kubernetes).

[0023] The third party is preferably a customer of the vehicle manufacturer, more preferably an operator of the vehicle. Alternatively or additionally, the third party is preferably an authorized user or an authorized service provider commissioned by the authorized user. The authorized user is to be understood as an authority or institution that has a legitimate interest in accessing the information technology system. For example, the authorized user is an executive authority. The authority is, for example, the federal police, the state police or the public prosecutor's office. The authorized service provider is, for example, a commercial provider commissioned by the authorized user to retrieve the information to be protected.

[0024] The computing device is preferably a computing device of the rail-bound vehicle. Alternatively or additionally, the computing device is a land-based computing device. In a further preferred embodiment of the computer-implemented method according to the invention, the information technology system comprises hardware from a vehicle manufacturer and the further information technology system comprises hardware from a third party. The third-party hardware is assigned to a virtual subnetwork of an operator network of the rail-bound vehicle. Access to the information technology system occurs via the concealment layer.

[0025] The virtual subnetwork is preferably designed as a VLAN (Virtual Local Area Network). The hardware preferably receives the required network settings from a central network service of the operator network. Further preferably, a server device of the vehicle manufacturer serves as a gateway via which the information technology system can leave the virtual subnetwork assigned to it. Further preferably, access to the information technology system which is located outside the virtual subnetwork occurs in that the concealment layer provides a predefined set of services. This set can correspond to the complete set of services provided by the vehicle manufacturer. Alternatively or additionally, this set can correspond to a subset of the services provided by the vehicle manufacturer.Alternatively, the masking layer provides an adapter for the respective third party, which converts protocols and content of the third party to those of the vehicle manufacturer.

[0026] A person skilled in the art understands the term "operator network" as a network that is physically and / or logically separate from a control network. For example, the passenger information system (FIS), passenger counting system and / or the camera surveillance system for monitoring the interior and exterior of the rail vehicle (CCTV: Closed Circuit Television) are connected to the operator network for data purposes. The corresponding components of the FIS, passenger counting system and / or camera surveillance system are interconnected for communication purposes via the operator network. A person skilled in the art understands the term "control network" as a network that includes one or more components for vehicle control. The corresponding components are interconnected for control and communication purposes via the control network.

[0027] In a further preferred embodiment of the method according to the invention, the concealment portion of the information technology system is concealed by making a predefined amount of content and / or functions available to the further information technology system via the concealment layer.

[0028] For example, a request for access by the further information technology system to a hidden content and / or a hidden function is ignored or acknowledged with a corresponding error message.

[0029] According to a further preferred embodiment of the method according to the invention, the concealment portion of the information technology system is concealed by limiting a load that is generated in the information technology system by access from the further information technology system.

[0030] Preferably the limitation is such that the function and operation of the rail-bound vehicle, in particular the parts for which the manufacturer is responsible, are not adversely affected.

[0031] Furthermore, the limitation is preferably achieved by so-called load limiting, in which, for example, the load of a central processor (e.g., CPU: Central Processing Unit), a working memory (e.g., RAM: Random Access Memory), and / or an input / output interface is limited. Furthermore, the limitation is preferably achieved by so-called traffic shaping, in which a data rate during data transmission is dynamically limited.

[0032] According to a further preferred embodiment of the method according to the invention, the switching takes place on the application level of the OS I model.

[0033] The term “application layer” is understood by experts to mean layer 7 of the ISO / OS I reference model.

[0034] Mediation at application level facilitates handling both for the owner ( e . g . vehicle manufacturer ) of the information technology system and the owner ( third party ) of the further information technology system .

[0035] In further training, the teaching at the application level includes filtering and converting the data access from the other information technology system.

[0036] The conversion preferably comprises a protocol conversion which takes place between a first protocol which is used on the information technology system and a second protocol which is used on the further information technology system.

[0037] According to a further preferred embodiment of the method according to the invention, a programming interface is provided as part of the information technology system. Data access from the further information technology system is provided exclusively via the programming interface.

[0038] The term programming interface is preferably to be understood in the sense of the technical term "API" (Application Programming Interface). The provision of data access from the further information technology system via the programming interface has the advantage that access with a wide range of functions can be provided. This range of functions can be flexibly designed by the third party via the programming interface.

[0039] Preferably, the concealment layer is provided by the programming interface.

[0040] Preferably, the programming interface is provided at the application level of the OS I model.

[0041] The above-mentioned object is further achieved by a computer-implemented method for expanding an information technology system for a rail-bound vehicle. In the method, data access to the information technology system is provided from a further information technology system, which is supplemented after the production of the rail-bound vehicle and expands the information technology system. Access is mediated exclusively via a concealment layer, wherein the concealment layer conceals a concealment portion of the information technology system from access from the further information technology system.

[0042] The object mentioned at the outset is further achieved by a computer program. The computer program comprises instructions which, when the program is executed by a computing device, cause the computing device to carry out the computer-implemented method for controlling data access to an information technology system for a rail-bound vehicle or the computer-implemented method for expanding an information technology system for a rail-bound vehicle of the type described above. The invention further relates to a computer program product with a computer program of this type. The computing device is preferably at least in part a computing device of the rail-bound vehicle and / or a computing device of a land-based facility.

[0043] The object mentioned at the outset is further achieved by a provision device for the computer program of the type described above, wherein the provision device stores and / or provides the computer program. The provision device is, for example, a storage unit that stores and / or provides the computer program. Alternatively and / or additionally, the provision device is, for example, a network service, a computer system, a server system, in particular a distributed, for example cloud-based computer system and / or virtual computer system, which stores and / or provides the computer program product preferably in the form of a data stream.

[0044] The provision takes place in the form of a program data block as a file, in particular as a download file, or as a data stream, in particular as a download data stream, of the computer program. This provision can also take place, for example, as a partial download consisting of several parts. Such a computer program is, for example, read into a system using the provision device, so that the method according to the invention is executed on a computer.

[0045] The object mentioned at the outset is further achieved by a device for controlling data access to an information technology system for a rail-bound vehicle. The device comprises an interface device which is configured to provide data access to the information technology system from the further information technology system, which is added after the production of the rail-bound vehicle. The device further comprises a concealment layer which is configured to mediate the access and to conceal a concealment portion of the information technology system from access from the further information technology system.

[0046] The object mentioned at the outset is further achieved by a track-bound vehicle which comprises a device of the type described above.

[0047] The aforementioned object is further achieved by a system comprising a rail-bound vehicle of the type described above and a land-based facility. The system provides a communication link for communication between the rail-bound vehicle and the land-based facility.

[0048] The land-based facility includes, for example, a computing facility of a customer of the vehicle manufacturer, in particular an operator of the vehicle.

[0049] The system according to the invention is to be understood as an overall system which comprises the information technology system and further preferably the further information technology system.

[0050] For advantages, embodiments and design details of the computer-implemented method according to the invention for expanding an information technology system, the computer program according to the invention, the provision device according to the invention, the device according to the invention for controlling data access to an information technology system, the track-bound vehicle according to the invention and the system according to the invention, reference can be made to the above description of the corresponding method features of the method according to the invention for controlling data access to an information technology system.

[0051] Embodiments of the invention are explained with reference to the drawings. Figure 1 shows schematically the sequence of a first embodiment of a computer-implemented method according to the invention,

[0052] Figure 2 shows schematically the structure of a first embodiment of a system according to the invention,

[0053] Figure 3 schematically shows the sequence of a second embodiment of a computer-implemented method according to the invention and

[0054] Figure 4 shows schematically the structure of a second embodiment of a system according to the invention.

[0055] Figure 1 shows a flow chart representing the sequence of the first embodiment of the method according to the invention.

[0056] Figure 2 shows a track-bound vehicle 1. The track-bound vehicle 1 is a rail vehicle 2. The track-bound vehicle 1 is connected to a land-based facility 5 via a communications link 3. The track-bound vehicle 1 and the land-based facility together form a system according to the invention.

[0057] The track-bound vehicle 1 has a first information technology system 7. This first information technology system 7 contains an Ethernet network 9, a server device 11, and at least one terminal 13. The server device 11 and the terminal 13 are connected to the Ethernet network 9 for data purposes.

[0058] The information technology system 7 is provided by the vehicle manufacturer 8 of the rail-bound vehicle 1 during the manufacture of the vehicle 1 according to a method step A and is installed or incorporated into the rail-bound vehicle 1 during vehicle manufacture and prepared for commissioning. The Ethernet network 9 functions as an operator network, which is informationally separated from a control network (not shown) of the rail-bound vehicle 1.

[0059] An operator device 15 is connected to the Ethernet network 9 for data purposes and forms hardware 16 of a third party 17. In the illustrated embodiment, the third party 17 is an operator of the rail-bound vehicle 1. The operator device 15 is part of a further information technology system 19, which is supplemented in a method step B after the production of the rail-bound vehicle 1.

[0060] In a method step C, the operator device 15 is assigned to a virtual subnetwork 21 of the operator network of the rail-bound vehicle 1. This virtual subnetwork 21 is virtually separated from a virtual subnetwork 23, which is intended for components of the vehicle manufacturer 8. The virtual subnetworks 21 and 23 are each configured as VLANs (VLAN: Virtual Local Area Network) and form part of the physical Ethernet network 9.

[0061] In a method step D, data access from the further information technology system 19 to the information technology system 7 is provided.

[0062] For this purpose, the server device 11 provides network settings to integrate the operator device 15 into the virtual subnetwork 21.

[0063] In addition, the server device 11 of the vehicle manufacturer 8 provides a gateway. The operator device 15 can leave the virtual subnetwork 21 and access the virtual subnetwork 23 exclusively via this gateway.

[0064] In this way, the server device 11 creates a concealment layer 25, via which access to the information technology system 7 is mediated. Since this concealment layer 25 only releases parts of the information technology system 7 for access, a concealment portion of the information technology system 7 is, conversely, concealed from access from the further information technology system 19. This concealment portion contains, for example, the terminal device 13, which the operator device 15 therefore cannot access.

[0065] Access to vehicle functions located within the virtual subnetwork 23 by the operator device 15 from the subnetwork 21 occurs via services provided by the concealment layer. In this way, the services provided can fully correspond to the services provided by the vehicle manufacturer 8. Alternatively, a subset of the services provided by the vehicle manufacturer 8 is made available for access by the operator device 15. Alternatively or additionally, an information technology adapter is provided specifically for the third party 17 by the concealment layer 25, which adapter converts a protocol of the information technology system 7 and corresponding contents to a protocol and corresponding contents of the further information technology system 19.

[0066] In addition, additional devices 27, 29 of the third party 17 can be provided as hardware 16 and connected to the Ethernet network 9. The operator device 15 can access these devices 27, 29 directly (without going through the concealment layer 25).

[0067] Figure 3 shows a flowchart representing the sequence of the second exemplary embodiment of the method according to the invention. The second exemplary embodiment of the system according to the invention shown in Figure 4 is constructed in many respects similarly to the system shown in Figure 2. Identical and functionally identical elements are provided with the same reference numerals.

[0068] The information technology system 7 comprises the Ethernet network 9, the server device 11, and the terminal device 13. Furthermore, the information technology system 7 has software 113 from the vehicle manufacturer 8, which is installed on the server device 11 and can be executed by means of the server device 11.

[0069] Software 115 of a third party 17 is also installed on the server device 11 and can be executed by the server device 11. The third party 17 is, for example, an operator of the rail-bound vehicle 1.

[0070] The software 113 is installed on the server device 11 by the vehicle manufacturer 8 in a method step AA during the production of the rail-bound vehicle 1 and can be executed during operation of the rail-bound vehicle 1 by means of a computing device 12 of the server device 11.

[0071] The software 115 is provided in a method step BB1 after the production of the rail-bound vehicle 1 by the third party 17 in the form of a so-called virtual machine (SW image) or as a software container. In a method step BB2, the software 115 is installed on the server device 11 (the so-called hosting system) and executed by the vehicle manufacturer 8 in a method step BB3. For this purpose, an operating system 116 and a software framework are installed on the server device 11. The software framework consists of several services. In addition, the software framework provides a runtime environment for the software 115 provided by the third party 17.

[0072] The information technology system 7, together with the software 115, forms an overall system 120. A first system portion 121 of the overall system 120 is formed by the elements of the information technology system 7, i.e., the Ethernet network 9, the server device 11, the operating system 116, and the software 113. A second system portion 122 is formed by the software 115. This is illustrated in Fig. 4 by diagonally dashed patterns filling the corresponding elements 9, 13, 113 shown. The first and second system portions 121 and 122 are therefore physically part of the same hardware; this is because the software 113 and the software 115 are installed on the same server device 11 and can be executed there.

[0073] In a method step CG, the access of the software 115 to the information technology system 7 is mediated exclusively via the concealment layer 125. This occurs in the embodiment shown in Figure 4 in that the concealment layer 125 forms an information technology separation between the first and second system components 121 and 122.

[0074] For this purpose, the runtime environment is configured by the vehicle manufacturer 8 in such a way that the software 115 gains access to the services provided by the software framework exclusively via the concealment layer 125.

[0075] Thus, the services provided can fully correspond to the services provided by the vehicle manufacturer 8. Alternatively, a subset of the services provided by the vehicle manufacturer 8 is made available for access by the software 115. Alternatively or additionally, an information technology adapter is provided specifically for the third party 17 by the concealment layer 25, which adapter converts a protocol of the information technology system 7 and corresponding contents to a protocol and corresponding contents of the further information technology system 115. In other words: the further information technology system 19 shown in Figure 4 is the software 115.

[0076] Although the invention has been illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Claims

Patent claims 1. Computer-implemented method for controlling data access to an information technology system (7) for a rail-bound vehicle (1), in which data access to the information technology system (7) is provided (D, CC) from a further information technology system (19), which is supplemented (B) after the production (A, AA) of the rail-bound vehicle (1), characterized in that the access is mediated exclusively via a concealment layer (25, 125), the concealment layer (25, 125) concealing a concealment portion of the information technology system (7) from access from the further information technology system (19).

2. Computer-implemented method according to claim 1, characterized in that - the information technology system (7) forms a first system part (121) of an overall system (120) and - the further information technology system (19) forms a second system part (122) of the overall system (120), the first and second system parts (121, 122) are physically at least partially part of the same hardware (11) of the overall system (120), and the concealment layer (125) forms an information technology separation between the first and second system parts (121, 122).

3. Computer-implemented method according to claim 2, characterized in that the first system part (121) comprises software (113) of a vehicle manufacturer (8) and the second system part (122) comprises software (115) of a third party (17), and the software (113) of the vehicle manufacturer (8) and the software (115) of the third party (17) are executed on a computing device (12) of the vehicle manufacturer (8).

4. Computer-implemented method according to at least one of the preceding claims, characterized in that the information technology system (7) comprises hardware (11, 13) of a vehicle manufacturer (8) and the further information technology system (19) comprises hardware (16) of a third party (17), the hardware (16) of the third party (17) is assigned to a virtual subnetwork (21) of the operator network of the track-bound vehicle (1) and access to the information technology system takes place via the masking layer (25).

5. Computer-implemented method according to at least one of the preceding claims, characterized in that the concealment portion of the information technology system (7) is concealed by making a predefined amount of content and / or functions available to the further information technology system (19) via the concealment layer (25).

6. Computer-implemented method according to at least one of the preceding claims, characterized in that the concealment portion of the information technology system (7) is concealed by limiting a load generated in the information technology system (7) by access from the further information technology system (19).

7. Computer-implemented method according to at least one of the preceding claims, characterized in that the switching takes place at the application level of the OSI model.

8. Computer-implemented method according to claim 7, characterized in that the mediation at the application level comprises filtering and converting the data access from the further information technology system.

9. Computer-implemented method according to at least one of the preceding claims, characterized in that a programming interface is provided as part of the information technology system (7) and the data access from the further information technology system (19) is provided exclusively via the programming interface.

10. Computer-implemented method for extending an information technology system (7) for a track-bound vehicle (1), in which a data access to the information technology system (7) from a further information technology system (19) which - after the production (A, AA) of the track-bound vehicle (1) is supplemented (B) and - the information technology system (7) is expanded, is provided, characterized in that the access is mediated exclusively via a concealment layer (25, 125), wherein the concealment layer (25, 125) conceals a concealment portion of the information technology system (7) from access from the further information technology system (19).

11. A computer program comprising instructions which, when executed by a computing device (12), cause the computing device (12) to carry out the method according to at least one of claims 1 to 9 or the method according to claim 10.

12. Provision device for the computer program according to claim 11, wherein the provision device stores and / or provides the computer program.

13. Device for controlling data access to an information technology system (7) for a rail-bound vehicle (1), comprising: an interface device which is set up to provide data access to the information technology system (7) from a further information technology system (19), which is supplemented after the production of the rail-bound vehicle (1), characterized by a concealment layer (25, 125) which is set up to mediate the access and to conceal a concealment part of the information technology system (7) from access from the further information technology system (19).

14. A track-bound vehicle comprising a device according to claim 13.

15. System comprising a rail-bound vehicle according to claim 14 and a land-based facility (5), in which a communication connection (3) is provided for communication between the rail-bound vehicle (1) and the land-based facility (5).

Images