Method for ensuring a refuelling process at a trusted fuel supply device

Abstract

The invention relates to a method for ensuring a refuelling process of a vehicle (1) operated by an internal combustion engine at a trusted fuel supply device (4), wherein the vehicle (1) has a first communication device (10) and the fuel supply device (4) has a second communication device (11), wherein the first communication device (10) and the second communication device (11) are configured in such a way that communication can be generated between the two communication devices (10, 11), wherein the fuel supply device (4) has a communication link to a network which is suitable for transporting data and via which a connection to a data processing device (6, 23) can be established, wherein, before the start of the refuelling process, a method having the following steps is performed:  transmitting a first data packet from the vehicle (1) to the fuel supply device (4),  forwarding a part or all of the first data packet from the fuel supply device (4) to the network (5),  processing the data packet received from the fuel supply device (4) via the network (5) in the data processing device (6, 23),  returning the data packet processed in the data processing device (6, 23) to the fuel supply device (4) via the network (5),  returning the data packet received from the data processing device (6, 23) from the fuel supply device (4) to the vehicle (1);  enabling the refuelling process.

Description

[0001] Description

[0002] Method for ensuring a refueling process at a trusted fuel supply device

[0003] Technical field

[0004] The invention relates to a method for ensuring the refueling process of an internal combustion engine-powered vehicle at a trusted fuel supply device, wherein the vehicle has a first communication device and the fuel supply device has a second communication device, wherein the first communication device and the second communication device are designed such that communication between the two communication devices can be established, wherein the fuel supply device has a communication connection to a network suitable for data transport, via which a connection to a data processing device can be established.

[0005] State of the art

[0006] As part of the effort to reduce overall carbon dioxide (CO2) emissions, a ban on combustion engine vehicles is planned within the European Union (EU). According to current plans, this ban is to take effect from 2035. If a complete ban on combustion engine vehicles is not implemented, or if exemptions are granted, combustion engine vehicles will likely only be able to run on sustainably produced e-fuel. E-fuel is characterized in particular by its close resemblance to conventional petroleum-based fuel, but its CO2-neutral production process.

[0007] While the sufficient production of such e-fuels presents one challenge, it is particularly important to ensure that vehicles registered as e-fuel vehicles can only be operated with e-fuels from a certain cut-off date. This requires the creation of devices that guarantee that an e-fuel vehicle cannot be refueled with conventional fuel.

[0008] A disadvantage of existing devices for preventing misfuelling, such as putting diesel in instead of gasoline, is that mechanical barriers, like thicker or thinner nozzles, require more complex construction, as mechanical components must be incorporated both on the vehicle and at the gas station to prevent misfuelling. Furthermore, the number of different fuels that can be distinguished by such mechanical barriers is very small. In addition, misfuelling is not completely prevented by these methods, as a smaller nozzle can still be inserted into a larger fuel tank opening.

[0009] Furthermore, the methods known on the market so far for preventing misfuelling are primarily aimed at preventing damage to the vehicle, whereas the corresponding devices and methods for preventing misuse when refuelling with conventional fuel instead of e-fuel must have a higher security threshold, since misuse constitutes a violation of the law, which may have to be punished depending on the applicable legal situation.

[0010] Description of the invention, problem, solution, advantages

[0011] Therefore, the object of the present invention is to create a method which prevents, as safely as possible, the misuse of a vehicle declared as an e-fuel vehicle by filling it with a conventional fuel.

[0012] The problem with regard to the method is solved by a method with the features of claim 1. An embodiment of the invention relates to a method for ensuring a refueling process of an internal combustion engine-powered vehicle at a trusted fuel supply device, wherein the vehicle has a first communication device and the fuel supply device has a second communication device, wherein the first communication device and the second communication device are configured such that communication between the two communication devices can be established, wherein the fuel supply device has a communication connection to a network suitable for data transport, via which a connection to a data processing device can be established, wherein a method is carried out before the start of the refueling process which comprises the following steps:

[0013] ■ Transmission of an initial data packet from the vehicle to the fuel supply device,

[0014] ■ Transmission of part or all of the first data packet from the fuel supply device to the network,

[0015] ■ Processing of the data packet received from the fuel supply device via the network in the data processing device,

[0016] ■ Return of the data packet processed in the data processing device via the network to the fuel supply device,

[0017] ■ Return of the data packet received by the data processing device from the fuel supply device to the vehicle.

[0018] ■ Release of the refueling process.

[0019] Due to anticipated future legislation, there will be vehicles with combustion engines that must be refueled with demonstrably climate-neutral e-fuels. E-fuels are artificially produced fuels that, in particular, contain no fossil fuels. To prevent misuse and to prevent the operation of the vehicle with conventional fuels, it must be ensured that the fuel supply facility, such as a filling station, can only be used if it is trustworthy and the dispensing of the appropriate fuel is guaranteed.

[0020] For this purpose, the vehicle has a communication device that allows it to communicate with the fuel supply unit's communication device and, in particular, to exchange data packets. NFC (Near Field Communication) devices can be used for this purpose. Since the vehicle must both send data to and receive data from the fuel supply unit, the communication must be bidirectional.

[0021] A communication process can be triggered preferably by bringing the fuel nozzle close to the vehicle's fuel filler neck. The transmitting and receiving elements, preferably antennas, are ideally located near the fuel filler neck and the nozzle. A particular advantage of using NFC technology in conjunction with a suitable antenna arrangement is that it ensures the nozzle cannot be removed from the vehicle's fuel filler neck without interrupting the connection. This makes misuse and incorrect refueling of the e-fuel vehicle more difficult. If the connection is interrupted, the vehicle can, for example, halt the refueling process.

[0022] The fuel supply device also has the means to establish communication with a data processing device via a suitable network, such as the internet, in order to forward the data received by the vehicle and to receive data from this data processing device. Preferably, the connection to the network is established using encryption, for example, via a VPN (virtual private network). An advantageous embodiment provides that the fuel supply device communicates with an internal company network, for example, a network of the operator of the fuel supply device or a central umbrella organization, which in turn communicates with the data processing device using the internet.

[0023] In a preferred embodiment, the method begins with the transmission of an initial data packet from the vehicle to the fuel supply device. This can occur, for example, when the fuel nozzle approaches the vehicle. The data packet preferably consists of a task that is transmitted from the vehicle to the fuel supply device. A task is generally defined as a request sent by the vehicle, which must be supplemented by a matching response from the fuel supply device. The vehicle alone is not capable of solving the task. Tasks can be formed, for example, using a PIN / TAN procedure, a challenge-response method, or digital certificates. Other tasks are also conceivable, as long as they are issued by the vehicle and cannot be solved independently by the vehicle.

[0024] The fuel supply system is also unable to solve the task independently without support from other systems. Preferably, the task is presented in a new form with each login process, i.e., with each start of a refueling process, so that no repetitions occur. This can be achieved, for example, by incorporating a random element into the task.

[0025] After receiving the task in the form of a data packet, the fuel supply device forwards the entire data packet, or at least the task it needs to solve. To do this, the fuel supply device can contact a network. This network can be, for example, an internal network operated by the fuel supply device's operator, perhaps structured as a virtual private network (VPN), or directly through the internet. The operator's VPN can also preferentially contact the internet to forward the data packet in a targeted manner. The advantage of using an intermediary VPN network is that it is secured by suitable encryption, thus ensuring the transmission of data that cannot be altered externally between the fuel supply device and the internet.

[0026] The data packet is then transmitted via the internet to a data processing device. This device is able to solve the task using the information available to it. The data processing device can be a cloud storage system, a database, or another suitable system capable of receiving data from the internet, processing it, and sending a response back to the data sender. A particularly advantageous solution would be a cloud storage system provided by the vehicle manufacturer, or a manufacturer-independent cloud storage system operated by a reputable organization, such as the German Association of Service Station Operators (ZTG) or a government agency.

[0027] A key requirement for this is that the fuel supply device must authenticate itself to the data processing device using a known authentication method. This is necessary to ensure the requesting fuel supply device is trustworthy. Since refueling e-fuel vehicles with e-fuel will be a legally regulated process, it is essential to ensure that refueling cannot be carried out by fraudulent fuel supply devices. At the very least, the goal is to minimize the effort required for a deliberately fraudulent refueling. Only if the fuel supply device successfully authenticates itself will the data processing device complete the transmitted task and send it back to the fuel supply device.

[0028] Once the task is solved, the response, in the form of the processed data packet, is sent back directly to the fuel supply device via the network used, or indirectly via the internal VPN network.

[0029] The fuel supply device then returns the received solution to the vehicle, which can thus evaluate whether the fuel station is trustworthy (in the case of a correct solution) or untrustworthy (in the case of an incorrect solution). Depending on this, the vehicle can either authorize the refueling process and accept fuel, or abort the refueling process and refuse fuel intake using appropriate locking mechanisms. One conceivable example would be a tamper-proof locking flap in the fuel filler neck, which only opens when proof of a trustworthy fuel supply device can be provided.

[0030] A major advantage of the method described here is that only the fuel supply device actually needs to be connected to the internet. This is easier to guarantee with a fixed structure than with a moving vehicle. This would allow for safe refueling even in regions with weak mobile network coverage.

[0031] It is particularly advantageous if the first data packet contains a task that needs to be solved, whereby the refueling process is only authorized by the vehicle if the task has been correctly solved and returned to the vehicle. The task can be performed, for example, using PIN / TAN procedures, challenge-response methods, digital certificates, or similar methods. It is also advantageous if the transmitted task can be solved by the data processing device. Specifically, the task must be solvable exclusively by the data processing device and not by the fuel supply device itself, the vehicle itself, or the network used for transmission. In this way, misuse can be prevented or significantly hindered, as local intervention to fraudulently solve the task is not possible.

[0032] A preferred embodiment is characterized in that the data processing device includes a database, or is connected to a database, which contains a complete list of all vehicles eligible for refueling. This is necessary to ensure that vehicles approved as e-fuel vehicles are reliably identified and can be refueled with certified e-fuel by trusted refueling stations.

[0033] Each e-fuel vehicle can be registered in a database and assigned a unique identifier, ensuring that every e-fuel vehicle is known and can be identified through a query. The database can also contain information that is preferably not available outside of it, which serves to solve the tasks transmitted by the fuel supply devices.

[0034] It is also preferable if the data processing device, in order to solve the task transmitted to it by the fuel supply device via the data packet, accesses at least one vehicle-specific value from the database. This is advantageous to make external manipulation more difficult. Furthermore, this ensures that only vehicles stored in the database, i.e., registered vehicles, can be refueled.

[0035] Furthermore, it is advantageous if the data processing device is a cloud storage system that has access to the vehicle database and on which a processing routine trained to solve the given task can be executed. This is beneficial to ensure that the fuel supply devices can be provided with solutions for the transmitted tasks at any time.

[0036] Furthermore, it is advantageous to perform an authentication process whereby the fuel supply device must identify itself to the data processing device using the authentication procedure in order to communicate with the data processing device. This serves to ensure that the fuel supply device is trustworthy and that the vehicle can therefore expect to be supplied with certified e-fuel.

[0037] It is also advisable that the task transmitted to the data processing device is only completed after the authentication of the fuel supply device by the data processing device has been successful. This prevents fraudulently transmitted requests from going unprocessed and thus preventing the vehicle from being denied refueling.

[0038] Furthermore, it is advantageous if the data packet is transmitted from the vehicle to the fuel supply unit via a bidirectional NFC connection, a Wi-Fi connection, a Bluetooth connection, or a UWB (Ultra Wideband) connection. This ensures that data can be sent from the vehicle to the fuel supply unit and received from the vehicle. Various established communication standards can be used for this purpose.

[0039] Furthermore, it is preferable to have an instance downstream of the fuel supply device and upstream of the data processing device that provides secure communication with the fuel supply device and serves as a gateway to the data processing device. This can preferably be implemented using a virtual private network (VPN). The advantage of using a VPN network is that secure communication between the respective fuel supply devices and this instance can be ensured, thereby reducing the susceptibility to manipulation.

[0040] In principle, the timing and frequency of authentication of the fuel station to the data processing device can vary. It can be queried before refueling, after refueling, or continuously at intervals. Authentication before refueling allows for the prevention of refueling via an intermediate valve installed between the filler neck and the tank. Authentication after refueling enables the transmission of additional data, such as information about the refueling process (quantity, duration, etc.), to the data processing device. This data could, for example, be used to compile statistics. Alternatively, queries can be performed at intervals during refueling, thus ensuring continuous authentication of the fuel station.

[0041] Furthermore, it is advantageous to continuously monitor the refueling process. This allows, in particular, verification of the ongoing communication connection. Additionally, the amount of fuel dispensed can be documented, for example, for statistical purposes.

[0042] Furthermore, it is preferable to continuously monitor the uninterrupted communication link between the vehicle and the fuel supply device during the refueling process. Specifically, queries can be performed at regular intervals to ensure that the fuel nozzle is still correctly inserted in the vehicle's fuel filler neck. If the communication link is interrupted for a certain period of time, refueling can be stopped, as an interruption could indicate an attempted tampering. Upon an interruption, for example, an error log can be written or a message can be sent to the data processing device or another control instance. To make the monitoring system more robust, tolerable interruption times can be defined, so that an error message is only generated after the interruption time has been exceeded.

[0043] Advantageous embodiments of the present invention are described in the dependent claims and in the following description of the figures.

[0044] Brief description of the drawings

[0045] The invention will now be explained in detail using exemplary embodiments and with reference to the drawings. The drawings show:

[0046] Fig. 1 shows a schematic view of how the process can be implemented.

[0047] Fig. 2 shows a schematic view of the authentication steps within the procedure, and

[0048] Fig. 3 shows a flowchart of the process.

[0049] Preferred embodiment of the invention

[0050] Figure 1 shows an overview of the method and its implementation. Reference numeral 1 indicates a vehicle that is designed to run on e-fuel via an internal combustion engine. Due to anticipated legal regulations, the vehicle must be refueled with e-fuel if it has been sold as such. Vehicle 1 has a refueling port 2, and a communication device 10 is located directly adjacent to the refueling port 2. The dispensing nozzle 3, which also has a communication device 11, is inserted into the refueling port.

[0051] The communication devices 10 and 11 are designed such that bidirectional communication 7 can be established between the fuel supply device 4, to which the fuel nozzle 3 belongs, and the vehicle 1. Common communication methods can be used for this purpose. Near Field Communication (NFC) is particularly advantageous for this bidirectional communication. The antennas on the vehicle 1 and the fuel supply device 4, or the fuel nozzle 3, are advantageously arranged such that the connection is terminated when the fuel nozzle 3 is removed.

[0052] The fuel supply device 4, which can be a conventional filling station, can dispense certified e-fuel to the vehicle 1 via the nozzle 3, provided the vehicle 1 has recognized the fuel supply device 4 as a trusted fuel source. Otherwise, the vehicle 1 aborts the refueling process, for example by sending a corresponding signal to the fuel supply device 4 or by stopping the fuel flow by a suitable means, such as a valve.

[0053] To start the refueling process, as soon as the fuel nozzle 3 is approached or inserted into the fuel filler neck 2, the vehicle 1 sends a task in the form of a data packet to the fuel supply device 4. This task serves as a secure means for the vehicle 1 to identify a trusted fuel source.

[0054] The task reaches the fuel supply device 4, which cannot solve the task independently. Via a communication link 8, the fuel supply device 4 forwards the task to an internal network 5. This could, for example, be a VPN network operated by the fuel supply device 4 operator, suitable for establishing an internal connection to a company server that is protected from external access. The intermediate step of the internal network 5 is advantageous, but ultimately not strictly necessary. Particularly with regard to the practical implementation of the procedure at numerous filling stations, it is advantageous if the individual fuel supply devices of an operator first communicate with an internal network instance, such as a central server, and only then is the request transmitted from there to the downstream data processing device 6.

[0055] Data processing device 6 finally receives the task sent by vehicle 1. Only data processing device 6 is capable of solving the task and sending back the correct solution.

[0056] The data processing device 6, which may, for example, be a central cloud storage system, can be accessed via the public internet. The data processing device 6 is either itself a database or has access to a database in which all vehicles 1 capable of being refueled with e-fuel are listed. For this purpose, it is necessary that each e-fuel vehicle 1 is centrally registered in this database or a comparable medium, enabling the unique identification of each vehicle 1. This is preferably done by the manufacturers of the vehicles 1 during production or when selling the respective vehicle 1.

[0057] The data processing device 6 solves the transmitted task using the vehicle-specific data from the database and sends the solution back via the internet to the internal network 5, if one is interposed, or directly to the fuel supply device 4. The fuel supply device 4 then sends the solution to the vehicle 1, which, if the solution is correct, finally enables the refueling process and, if the solution is incorrect, aborts the refueling process.

[0058] If necessary, the procedure can be repeated upon receipt of an incorrect solution to ensure that no communication error occurred. Upon receipt of an incorrect solution, an entry can also be made in the memory of vehicle 1 to document the aborted refueling process. It would also be conceivable to store geodata from the navigation system or the communication module, if present in vehicle 1, to identify potentially corrupt fuel supply devices 4. Such data could be read out during a workshop visit or sent via the communication interface of vehicle 1 to a central location to make misuse more difficult.

[0059] Communication via communication link 9 in the case of an upstream internal network 5, or via direct communication between the fuel supply device 4 and the data processing device 6, only occurs after successful authentication of the fuel supply device 4 by the data processing device 6. This can be achieved, for example, using a public key and a private key. Alternative authentication methods can also be used, provided that the fuel supply device 4 or the interposed internal network 5 is among the authorized and trusted partners and thus has access to the data processing device 6.

[0060] This ensures that the data processing device 6 trusts the fuel supply device 4 or its intermediate internal network 5, and that the vehicle 1 also trusts the fuel supply device 4. If both of these conditions are met and the task is correctly solved, a safe refueling operation can be carried out.

[0061] Figure 2 schematically shows a database 24 or cloud, for example, of the vehicle manufacturer. From this database 24, uniquely descriptive information about the vehicle is passed to the so-called authentication instance 22. This occurs, for example, when the vehicle is registered in database 24. The authentication instance 22 can be the instance described above as a database, which the data processing device 23 accesses. Reference numeral 21 denotes a so-called certification authority, with which the fuel supply device must register and authenticate itself, either directly or via the downstream internal network 20. As described above, a public key and a private key can be used for this purpose. Other authentication methods are also possible. The certification authority 21 and the authentication authority 22 together form the data processing device 23 with its database.

[0062] Figure 3 shows a flowchart of the procedure. In step 30, the fuel nozzle is approached or inserted. In step 31, the vehicle transmits the task to the fuel supply device. In step 32, the fuel supply device forwards the task to an internal company network. In step 33, the internal company network contacts the data processing device and transmits an identification element. In step 34, the data processing device responds to the internal company network, provided a successful verification has occurred. In step 35, the internal company network transmits the task to the data processing device. In step 36, the data processing device solves the task and, in step 37, sends the solution back to the internal company network. In step 38, the internal company network forwards the solution to the fuel supply device, which, in step 39, transmits the solution to the vehicle.In step 40, the vehicle checks the solution and either releases the refueling process in step 41 or cancels the refueling process.

[0063] The embodiments shown in Figures 1 to 3 are not particularly limiting in nature and serve to illustrate the inventive concept.

[0064] Reference symbol list

[0065] 1. Vehicle

[0066] 2. Fuel filler neck

[0067] 3. Fuel nozzle

[0068] 4. Fuel supply device

[0069] 5. Internal network

[0070] 6. Data processing device

[0071] 7. Bidirectional communication link

[0072] 8. Communication link

[0073] 9. Communication link

[0074] 10. Communication device

[0075] 11. Communication device

[0076] 20. Internal Network

[0077] 21. Certification body

[0078] 22. Authentication point

[0079] 23. Data processing device

[0080] 24. Database

[0081] 30th procedural step

[0082] 31. Procedure step

[0083] 32nd procedural step

[0084] 33rd procedural step

[0085] 34th procedural step

[0086] 35th procedural step

[0087] 36th procedural step

[0088] 37th procedural step

[0089] 38th procedural step

[0090] 39th procedural step

[0091] 40th procedural step

[0092] 41. Procedure step

Claims

Patent claims 1. Method for ensuring the refueling of an internal combustion engine-powered vehicle (1) at a trusted fuel supply device (4), wherein the vehicle (I) has a first communication device (10) and the fuel supply device (4) has a second communication device (II) having, wherein the first communication device (10) and the second communication device (11) are configured such that communication between the two communication devices (10, 11) can be established, wherein the fuel supply device (4) has a communication link to a network suitable for data transport, via which a connection to a data processing device (6, 23) can be established, characterized in that, before the start of the refueling process, a procedure is carried out which comprises the following steps: ■ Transmission of a first data packet from the vehicle (1) to the fuel supply device (4), ■ Transmission of part or all of the first data packet from the fuel supply device (4) to the network (5), ■ Processing of the data packet received from the fuel supply device (4) via the network (5) in the data processing device (6, 23), ■ Return of the data packet processed in the data processing device (6, 23) via the network (5) to the fuel supply device (4), ■ Return of the data packet received by the data processing device (6, 23) from the fuel supply device (4) to the vehicle (1). ■ Release of the refueling process.

2. The method according to claim 1, characterized in that the first data packet contains a task contains a task to be solved, whereby the refueling process by the vehicle (1) is only released if the task has been solved correctly and returned to the vehicle (1).

3. Method according to claim 2, characterized in that the transmitted task can be solved by the data processing device (6, 23).

4. Method according to one of the preceding claims, characterized in that the data processing device (6) has a database or is connected to a database which contains a complete list of all vehicles (1) that are eligible for refueling.

5. Method according to claim 4, characterized in that the data processing device (6, 23) accesses at least one vehicle-specific value from the database to solve the task transmitted to it by the fuel supply device (4) by means of the data packet.

6. Method according to one of the preceding claims, characterized in that the data processing device (6, 23) is formed by a cloud storage which has access to the database comprising the vehicles (1) and on which a processing routine designed to solve the task at hand can be executed.

7. Method according to one of the preceding claims, characterized in that an authentication process is carried out, wherein the fuel supply device (4) must identify itself to the data processing device (6, 23) for communication with the data processing device (6, 23) by means of the authentication procedure.

8. Method according to claim 7, characterized in that the solution of the task transmitted to the data processing device (6, 23) is only carried out when the authentication of the fuel supply device (4) to the data processing device (6, 23) has been successful.

9. Method according to one of the preceding claims, characterized in that the transmission of the data packet from the vehicle (1) to the fuel supply device (4) is carried out by means of a bidirectionally communicating NFC connection, a WIFI connection, a Bluetooth connection or a UWB (Ultra Wideband) connection.

10. Method according to one of the preceding claims, characterized in that an instance (5) is provided downstream of the fuel supply device (4) and upstream of the data processing device (6, 23), which has a secure communication capability to the fuel supply device (4) and serves as a gateway to the data processing device (6, 23).

11. Method according to one of the preceding claims, characterized in that the refueling process is continuously monitored.

12. Method according to claim 11, characterized in that the uninterrupted existence of the communication link between the vehicle (1) and the fuel supply device (4) is continuously monitored during the refueling process.

Images