Control system for vehicle communications

Abstract

Aspects of the present invention relate to a control system and a method for controlling a communications system, as well as a vehicle comprising the control system. The control system comprises one or more processors collectively configured to receive, from an electric charging system, a request for a vehicle identifier for use during a charging session. The one or more processors are collectively configured to perform a trust assessment to determine whether the electric charging system satisfies a trust criterion. In dependence on the electric charging system failing to satisfy the trust criterion, the one or more processors are collectively configured to generate a dynamic random reference number; and to output, to the electric charging system, a vehicle identification signal comprising the dynamic random reference number as the vehicle identifier.

Description

[0001] CONTROL SYSTEM FOR VEHICLE COMMUNICATIONS

[0002] TECHNICAL FIELD

[0003] The present disclosure relates to a control system for (electric) vehicle communications, particularly in relation to a charging session for an electric vehicle. Aspects of the invention relate to a system, to a method, and to a (electric) vehicle.

[0004] BACKGROUND

[0005] During communications between an electric vehicle and an electric charging system, for the purposes of initiating a charging session, it is known to share a vehicle identifier (and specifically the MAC address, or Media Access Code address) of the vehicle's charge controller with the charging system. This is done primarily for the purpose of authenticating a vehicle and establishing the charging session during which the electric vehicle is charged with electric power.

[0006] In some instances, this vehicle identifier can be retained or stored by the electric charging system to remember an electric vehicle for future charging sessions. In such cases, the vehicle identifier may also be linked to a user’s (usually the vehicle driver’s) payment device, such that every time the vehicle visits that charging system (or one belonging to the same overall ‘network’), the user’s payment details can be retrieved and used to bill the user for the charging session. This process is commonly referred to as ‘Autocharge’.

[0007] However, it will be appreciated that the functionality of linking the vehicle identifier with a user’s personal I payment details is not always desirable, particularly in public settings.

[0008] It is an aim of the present invention to address one or more of the disadvantages associated with the prior art.

[0009] SUMMARY OF THE INVENTION

[0010] Aspects and embodiments of the invention provide a control system and a method for controlling a communications system, as well as a vehicle comprising the control system as claimed in the appended claims.

[0011] According to an aspect of the present invention there is provided a control system for controlling a communications system of a (electric) vehicle. The control system comprises one or more processors collectively configured to receive, from an electric charging system, a request for a vehicle identifier for use during a charging session. The one or more processors are collectively configured to perform a trust assessment to determine whether the electric charging system satisfies a trust criterion. In dependence on the electric charging system failing to satisfy the trust criterion, the one or more processors are collectively configured to generate a dynamic random reference number; and to output, to the electric charging system, a vehicle identification signal comprising the dynamic random reference number as the vehicle identifier.

[0012] The control system comprises one or more controllers collectively comprising at least one electronic processor having an electrical input for receiving an input signal; and at least one memory device electrically coupled to the at least one electronic processor and having instructions stored therein; and wherein the at least one electronic processor is configured to access the at least one memory device and execute the instructions thereon so as to: receive, from an electric charging system, a request for a vehicle identifier for use during a charging session; perform a trust assessment to determine whether the electric charging system satisfies a trust criterion; and in dependence on the electric charging system failing to satisfy the trust criterion: generate a dynamic random reference number; and output, to the electric charging system, a vehicle identification signal comprising the dynamic random reference number as the vehicle identifier.

[0013] The charging session corresponds to a session during which the electric vehicle is charged with electric power, and the charging session takes place between the electric charging system and the electric vehicle.

[0014] ‘Dynamic’ is used here to indicate that the reference number changes with each charging session or with each interaction between the processor(s) and the charging system. More specifically, the ‘dynamic’ reference number is generated by the processor(s) for each charging session and in response to receiving the request from the charging system. ‘Random’ is used here in the sense that the number in question is generated or selected, at random, from a large number of possible values. This differentiates the process of generating the dynamic random reference number described above from other processes whereby the number may be selected in a more predictable manner - e.g., where a number is simply selected as a consecutive / sequential number from a predefined list of values, or is generated in a specific manner by combining a set of numbers using predefined rules. The term ‘random’ as used herein may therefore encompass pseudo-random numbers. For example, the dynamic random reference number may be generated based on the use of predefined parameters (e.g., using known start and end points) relating to a predefined set of available I acceptable numbers, whereby the processor(s) uses these parameters to then select a number randomly from the predefined set of available I acceptable numbers.

[0015] By generating and using a dynamic random reference number as a vehicle identifier, the above-described system beneficially allows identifying information about an electric vehicle to be obscured I securely retained, during communications with the charging system in relation to the charging session, in scenarios where there may be questions about the trustworthiness or security in relation to data retention of the charging system and / or charging session. Generating a random reference number dynamically means that each charging session may result in a new vehicle identifier being exchanged, which can prevent the tracking of a vehicle I user based on the vehicle identifier. This is particularly beneficial in scenarios where the vehicle identifier is associated with user details (such as user identifying information and / or user payment device data), as it prevents any fraudulently obtained vehicle identifiers and their associated user details from being re-used by an unauthorised user. Moreover, a balance may be struck to avoid unnecessary processing by virtue of the trust assessment being performed, whereby the generation and use of the random reference number as the vehicle identifier is carried out on-demand, in orderto maintain the security of the vehicle identifying information (and any associated user identifying or payment device data), in scenarios where it is appropriate to do so.

[0016] Optionally, the one or more processors are collectively further configured to, in dependence on the electric charging system satisfying the trust criterion: retrieve a stored static reference number; and output the vehicle identification signal comprising the stored static reference number as the vehicle identifier. ‘Static’ is used here to indicate that the reference number in question corresponds to a stored value that does not change, and more specifically is not re-generated, with each charging session; or with each interaction between the processor(s) and the charging system. In other words, the term is used here to highlight the difference between the retrieval of a stored value, and the generation of the dynamic number by the processor(s), as was set out previously.

[0017] It is noted that in this instance, where a static reference number is retrieved, the dynamic random reference number would not need to be generated. This is beneficial as it reduces the processing burden associated with provision of the vehicle identifier; and obviates any associated need to ensure that the number which is used as the vehicle identifier is an appropriate I acceptable one.

[0018] In some embodiments, the one or more processors are collectively further configured to: receive input from a user indicative of whether to perform the trust assessment of the electric charging system. In dependence on the input indicating that the trust assessment / s to be performed, the one or more processors are collectively further configured to perform the trust assessment. In dependence on the input indicating that a trust assessment / s not to be performed, the one or more processors are collectively further configured to retrieve a stored static reference number and output the vehicle identification signal comprising the stored static reference number as the vehicle identifier.

[0019] The above-described functionality is particularly beneficial in the case of ‘behind-the-fence’ (secure / private) charging session implementations (e.g., home-charging and depot-charging). In these implementations, the electric charging systems are in locations that cannot be easily accessed publicly and hence are much less accessible by random vehicles having ‘fake’ vehicle identifiers. Moreover, such locations are also less susceptible to attacks by malicious third parties attempting to obtain the vehicle identifier data for fraudulent use. In such implementations, the user input would indicate that no trust assessment is to be performed. Alternatively, if the user had a preference to maintain an ongoing association between their vehicle identifier and the vehicle / user details, they may also choose not to carry out a trust assessment to allow for a more seamless charging session.

[0020] To summarise, the stored static reference number may be output under certain conditions: in a first scenario where it is determined that the charging station satisfies the trust criterion (i.e., because the charging station is a trusted one and / or adopts trusted processing mechanisms); and / or in a second scenario where it is determined that a trust assessment is not to be performed (i.e., regardless of whether the charging station is a trusted one, but simply because the user does not wish for a trust assessment to be carried out).

[0021] Optionally, the one or more processors are collectively further configured to determine whether the electric charging system satisfies the trust criterion by: retrieving a set of one or more predefined trusted charging systems; and determining whether the electric charging system corresponds to any of the one or more predefined trusted charging systems. For example, the trust criterion could correspond to determining if the electric charging system is operated by a trusted provider / operator, and / or if the electric charging system operates trusted processing (e.g., ‘Plug and Charge’ processing where the data shared is encrypted).

[0022] Additionally or alternatively, the one or more processors are collectively further configured to determine whetherthe electric charging system satisfies the trust criterion by: determining a current location of the electric vehicle; retrieving a set of one or more (user defined) trusted locations; and determining whether the current location of the electric vehicle corresponds to any of the one or more trusted locations. For example, the one or more trusted locations may comprise at least one ‘home’ location of the vehicle, and / or one or more trusted secure locations for charging the vehicle, such as one or more private residence locations or secured properties (e.g., charging depot).

[0023] In other words, the trust criterion is that the charging system is a trusted one, but there are multiple different ways of defining ‘trust’ in this sense - i.e., operated by a trusted provider, and / or located in a subset of locations that are defined as being trusted / safe. As noted above, this means that the dynamic random reference number is primarily generated and used as the vehicle identifier when doing so would be particularly useful (to avoid ongoing associations and tracking between a static identifier and the user’s identifying or payment device data). However, where obscuring user and / or vehicle identifying information is not required, a simple retrieval of a static identifier can be carried out instead.

[0024] Optionally, the vehicle identifier corresponds to a MAC (Media Access Control) address of the vehicle. It is useful to implement the above-described processing functionality in relation to the vehicle MAC address since this is typically a static (unchanging) value that is associated with and used by the vehicle during various communications.

[0025] Optionally, the one or more processors are collectively configured to generate the dynamic random reference number based on a predefined set of available random reference numbers. As noted above, ‘random’ is used here to also encompass ‘pseudo-random numbers’ that have been generated at random. In other words, in this scenario, the processor(s) may be configured to generate a random number using a random number generation algorithm to generate or select a number at random from a predefined range of possible random numbers, for example where the range of numbers is defined based on a block / set of available possible vehicle identifier numbers.

[0026] Using a predefined set of available numbers to generate the random reference number means that the vehicle identifier that is ultimately provided by the processor(s) should correspond to an ‘acceptable’ number - i.e., one that it is considered is acceptable to be associated with the vehicle. For example, it will have the right number of digits and correspond to a number that could conceivably be a realistic number for use as the vehicle identifier.

[0027] In some embodiments, the one or more processors are collectively further configured to: receive a signal indicative that the dynamic random reference number does not fulfil at least one cross-check criterion to correspond to an allowed vehicle identifier; and re-generate the dynamic random reference number. The received signal may be received from a remote serverthat is in operative communication with the processor(s).

[0028] Optionally, the at least one cross-check criterion includes a determination that the dynamic random reference number: (a) is currently in use by a different vehicle for a charging session; (b) has been used for a charging session within a previous time period; (c) has been used for a charging session at a given location and / or (d) corresponds to the vehicle identifier of the vehicle provided for a previous interaction with the electric charging system. This allows the processor(s) to ensure that the number which is being used as the vehicle identifier is an appropriate and acceptable one, and which will also avoid potentially causing any confusion as to the legitimacy of the charging session in question by avoiding multiple vehicles implementing charging sessions at the same I similar times using the same vehicle identifier. It also avoids the same number being generated for the same vehicle in a short space of time, thereby minimising the chances of tracking the vehicle.

[0029] Additionally or alternatively, the at least one cross-check criterion includes a determination that the dynamic random reference number has been used for a charging session within a previous time period and at a location exceeding a maximum distance that the vehicle could have travelled within the previous time period. In such instances, the cross-check may actually identify instances of potential fraudulent use of the vehicle identifier (and the associated user I vehicle details).

[0030] According to another aspect of the invention, there is provided a (electric) vehicle comprising the control systems substantially as described above.

[0031] According to another aspect of the invention, there is provided a method for controlling a communications system of an electric vehicle. The method comprises receiving, from an electric charging system, a request for a vehicle identifier for use during a charging session. The method further comprises performing a trust assessment to determine whether the electric charging system satisfies a trust criterion. In dependence on the electric charging system failing to satisfy the trust criterion, the method further comprises generating a dynamic random reference number; and outputting, to the electric charging system, a vehicle identification signal comprising the dynamic random reference number as the vehicle identifier.

[0032] It will be appreciated that corresponding features and effects associated with the above-described aspects of the monitoring system are also equally applicable in relation to the corresponding monitoring method.

[0033] Optionally, the method further comprises, in dependence on the electric charging system satisfying the trust criterion: retrieving a stored static reference number; and outputting the vehicle identification signal comprising the stored static reference number as the vehicle identifier.

[0034] In some embodiments, the method further comprises receiving input from a user indicative of whether to perform the trust assessment of the electric charging system. In dependence on the input indicating that the trust assessment is to be performed, the method further comprises performing the trust assessment. In dependence on the input indicating that a trust assessment is not to be performed, the method further comprises retrieving a stored static reference number and outputting the vehicle identification signal comprising the stored static reference number as the vehicle identifier.

[0035] Optionally, the method further comprises, determining whether the electric charging system satisfies the trust criterion by: retrieving a set of one or more predefined trusted charging systems; and determining whether the electric charging system corresponds to any of the one or more predefined trusted charging systems. For example, the trust criterion could correspond to determining if the electric charging system is operated by a trusted provider / operator, and / or if the electric charging system operates trusted processing (e.g., ‘Plug and Charge’ processing where the data shared is encrypted).

[0036] Additionally or alternatively, the method further comprises determining whether the electric charging system satisfies the trust criterion by: determining a current location of the electric vehicle; retrieving a set of one or more trusted locations; and determining whether the current location of the electric vehicle corresponds to any of the one or more trusted locations. For example, the one or more trusted locations may comprise at least one ‘home’ location of the vehicle, and / or one or more trusted secure locations for charging the vehicle, such as one or more private residence locations or secured properties (e.g., charging depot).

[0037] Optionally, the vehicle identifier corresponds to a MAC (Media Access Control) address of the vehicle.

[0038] Optionally, the method comprises generating a dynamic random reference number based on a predefined set of available random reference numbers.

[0039] In some embodiments, the method further comprises receiving a signal indicative that the dynamic random reference number does not fulfil at least one cross-check criterion to correspond to an allowed vehicle identifier; and re-generating the dynamic random reference number.

[0040] Optionally, the at least one cross-check criterion includes a determination that the dynamic random reference number: (a) is currently in use by a different vehicle for a charging session; (b) has been used for a charging session within a previous time period; (c) has been used for a charging session at a given location and / or (d) corresponds to the vehicle identifier of the vehicle provided for a previous interaction with the electric charging system. Additionally or alternatively, the at least one cross-check criterion includes a determination that the dynamic random reference number has been used for a charging session within a previous time period and at a location exceeding a maximum distance that the vehicle could have travelled within the previous time period.

[0041] According to a further aspect of the invention, there is provided (a set of) computer readable instructions which, when executed by one or more processors, cause the one or more processors to perform the methods substantially as described above.

[0042] Within the scope of this application, it is expressly intended that the various aspects, embodiments, examples and alternatives set out in the preceding paragraphs, in the claims and / or in the following description and drawings, and in particular the individual features thereof, may be taken independently or in any combination. That is, all embodiments and / or features of any embodiment can be combined in any way and / or combination, unless such features are incompatible. The applicant reserves the right to change any originally filed claim or file any new claim accordingly, including the right to amend any originally filed claim to depend from and / or incorporate any feature of any other claim although not originally claimed in that manner.

[0043] BRIEF DESCRIPTION OF THE DRAWINGS

[0044] One or more embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0045] Figure 1 shows a schematic illustration of a (communications) control system in accordance with an embodiment of the invention;

[0046] Figure 2 summarises the steps of a method performed by the control system of Figure 1 in accordance with an embodiment of the invention;

[0047] Figure 3 shows an overall communications and processing system architecture, comprising the system of Figure 2, in accordance with an embodiment of the invention;

[0048] Figure 4 summarises the steps of a method performed by the system architecture of Figure 4 in accordance with an embodiment of the invention; and

[0049] Figure 5 shows a vehicle implementing the control system of Figure 1 in accordance with an embodiment of the invention.

[0050] DETAILED DESCRIPTION

[0051] With reference to Figure 1 , there is illustrated a control system 100 for a vehicle, and more particularly for an electric vehicle (i.e., one powered wholly or partially via electric power). The control system 100 comprises one or more controllers 110. The control system 100 is configured to receive a vehicle identifier request signal 135 from an electric charging system 301 , the signal 135 indicative of a request by the electric charging system 301 for a vehicle identifier; and to determine (via a trust assessment) whether the electric charging system 301 satisfies a trust criterion. In dependence on the result of the trust assessment, the control system 100 is configured to generate or retrieve the vehicle identifier and to output a control signal 155 to the electric charging system 301 , the control signal 155 corresponding to a vehicle identification signal comprising the requested vehicle identifier. The vehicle identifier is for use in a charging session between the vehicle and the electric charging system 301 .

[0052] The control system 100 as illustrated in Figure 1 comprises one controller 110, although it will be appreciated that this is merely illustrative. The controller 1 10 comprises processing means 120 and memory means 130. The processing means 120 may be one or more electronic processing devices 120 which operably execute computer-readable instructions. The memory means 130 may be one or more memory devices 130. The memory means 130 is electrically coupled to the processing means 120. The memory means 130 is configured to store instructions, and the processing means 120 is configured to access the memory means 130 and execute the instructions stored thereon.

[0053] The controller 110 comprises an input means 140 and an output means 150. The input means 140 may comprise an electrical input 140 of the controller 110. The output means 150 may comprise an electrical output 140 of the controller 110. The input means 140 is arranged to receive the vehicle identifier request signal 135 from the electric charging system 301 . The vehicle identifier request signal 135 is an electrical signal which is indicative of a request by the electric charging system 301 for a vehicle identifier for use during a charging session. The output means 150 is arranged to output an identification control signal 155 to the electric charging system 301 , comprising the vehicle identifier for use in the charging session.

[0054] The form taken by vehicle identifier comprised in the control signal 155 differs depending on the result of the trust assessment. More specifically, in dependence on the electric charging system 301 failing to satisfy the trust criterion, the controller 110 is configured to generate a dynamic random reference number for use as the vehicle identifier.

[0055] Figure 2 summarises the steps of a method 200 that is performed by the control system 100 (and specifically by the controller 1 10) according to an embodiment of the invention. The method 200 is a method of controlling a communications system of an electric vehicle, such as the vehicle 500 illustrated in Figure 5, and more particularly a method of determining and providing a vehicle identifier of the vehicle 500 to an electric charging system 301 for use during a charging session. In particular, the memory means 130 may comprise computer- readable instructions which, when executed by the processing means 120, perform the method 200 according to an embodiment of the invention.

[0056] At step 205, the method involves receiving the incoming vehicle identifier request signal 135 from the electric charging system 301. The received request signal 135 is indicative of a request from the electric charging system 301 for a vehicle identifier that is to be used during the charging session between the electric vehicle 500 and the electric charging system 301. The charging session corresponds to a session during which the electric vehicle 500 is charged with electric power. In some examples, the requested vehicle identifier corresponds to identifying information of a MAC (Media Access Control) address of the vehicle.

[0057] At step 210, the method involves performing a trust assessment corresponding to a determination as to whether the electric charging system 301 satisfies a trust criterion. If it is determined at step 210 that the electric charging system fails to satisfy the trust criterion, the method proceeds to step 215 during which a dynamic random reference number is generated for use as the vehicle identifier. If it is instead determined at step 210 that the electric charging system does satisfy the trust criterion, the method proceeds to step 220 during which the vehicle identifier is retrieved or obtained via a different mechanism. In one particular embodiment, step 220 involves retrieving a stored static reference number for use as the vehicle identifier.

[0058] In the above-mentioned method, the term ‘dynamic’ has been used to reflect the fact that the reference number in step 215 is generated (or otherwise produced afresh) by the processing means 120 for each charging session, and in response to receiving the request from the electric charging system 301 . By comparison, the term ‘static’ has been used to reflect the fact that the reference number in step 220 corresponds to a stored value that does not change, and more specifically is not re-generated, with each charging session; or with each interaction between the processing means 120 and the electric charging system 301 . In other words, the terms ‘dynamic’ and ‘static’ are used here to highlight the difference between the retrieval of a stored (static) value, and the generation of a new (dynamic) number by the controller 1 10.

[0059] Additionally, although the term ‘random’ is used here in relation to step 215, it should be appreciated that this term is used to reflect the fact that the reference number in question is assigned at random as the vehicle identifier, and its value is not necessarily predictable. More particularly the reference number value is not defined or allocated specifically to the charging session or to the electric charging system via any predefined and predictable rules (for example, where a number is simply selected as a consecutive I sequential number from a predefined list of values, or is generated in a specific manner by combining a set of numbers using predefined rules). As such, the term ‘random’ used here would encompass ‘pseudo-random’ numbers, rather than merely being limited to ‘true’ random numbers.

[0060] For example, it is envisaged that the processing means 120 may generate the dynamic reference number using certain predefined parameters to select a number at random, albeit from a predefined set of available I acceptable numbers. Such predefined parameters include start and end points of the predefined set of available I acceptable numbers. In such an example, the reference number selected would be a pseudorandom one, whereby the number was selected at random but from a subset of available numbers. It is useful to adopt this type of number generation mechanism when the vehicle identifier is a MAC address, and where the predefined set of available I acceptable numbers corresponds to a block (of several hundreds or thousands) of valid MAC addresses allocated for this purpose, since it is necessary to ensure that the number which is subsequently provided as the vehicle identifier can validly be used as a MAC address.

[0061] Thereafter, at step 225, the method involves outputting the identification control signal 155 comprising the vehicle identifier that was obtained via one of steps 215 or 220, whichever is appropriate depending on the result of the trust assessment.

[0062] The present Applicant has appreciated that it would be beneficial to be able to avoid exposing the vehicle’s static stored identifier (such as the MAC address) for vehicle identification purposes during every charging session, so as to minimise the opportunities for a malicious third party to obtain the MAC address without permission and use it in a fraudulent manner. For example, in cases where the vehicle MAC address was to be associated with the vehicle driver’s personal (financial) details, interception of the MAC address would also expose the vehicle driver’s details to potential fraudulent activity, which is undesirable. The use of a dynamic random reference number thereby prevents such activity from taking place, since the number that would be intercepted by the malicious third party would not then be able to be reused in subsequent sessions in combination with the vehicle driver’s details (as it is not a static number).

[0063] There are, nevertheless, certain electric charging systems (such as a private electric charging system, located in a secure location) where the conditions are such that storage of the vehicle identifiers, and / or transmission of the vehicle identifier to the electric charging system would carry a low risk of exposure of the vehicle identifier to fraudulent and malicious activity. The present Applicant has therefore appreciated that there is a further benefit to be achieved in relation to performing a trust assessment in relation to the request for provision of the vehicle identifier, and particularly a trust assessment of the electric charging system itself. In this manner, sub- optimal conditions for exposing the vehicle identifier can be determined and the vehicle identifier can be appropriately selected depending on the results of the trust assessment. As such, increased security of vehicle data (and of corresponding vehicle driver data) can be achieved, whilst nevertheless maintaining the flexibility of the original stored static identifier being used in appropriate conditions.

[0064] Figure 3 schematically illustrates an overall communications and processing system architecture 300, having various constituent processing blocks or modules that are associated with a plurality of communicating entities involved in the process of establishing a charging session for an electric vehicle. At least some aspects of the overall system 300 are implemented by the control system 100 (as indicated by modules located within the dashed lines shown in Figure 3) in accordance with an embodiment of the invention.

[0065] The overall system 300 comprises the electric charging system 301 that is configured to output the vehicle identification signal 302, requesting the return of a vehicle identifier from the vehicle for use during the charging session. The control system 100 is configured to receive the vehicle identification signal 302, and includes at least one processor 303 programmed with instructions 304 regarding the trust assessment (and associated trust criterion) that is to be performed following receipt of the vehicle identification request signal 302 from the electric charging system 301 .

[0066] The control system 100 also includes a plurality of memories or data storages 305a, 305b that are each in operative communication with the processor 303. These data storages are configured to store data relating to the performance of the trust assessment (and the associated trust criteria), as well as relating to the subsequent generation and / or retrieval of the vehicle identifier in dependence on the trust assessment result. Although two data storages are shown in Figure 3, it will be appreciated that these may be combined into a single overall data storage, and / or may be split into more than two data storages. Data described as being stored in one of the data storages 305a, 305b, may also instead be stored in a different one of the data storages, and / or in a different location.

[0067] In an embodiment, one of the data storages 305a comprises a (predefined) set of available reference numbers 306 that are used by the processor 303 when the result of the trust assessment indicates that electric charging system 301 fails to satisfy the trust criterion, and hence requires the generation of a dynamic random reference number. This set of available reference numbers was originally defined by a remote server and provisioned into the data storage 305a prior to the charging session being initiated, for example, during an early set up process of the control system 100, or during a scheduled update of the control system 100. Alternatively, the instructions 304 may include information indicative of start and end values of a numerical range that can be used by the processor 303 to generate the dynamic reference number, for example, using a random number generation algorithm.

[0068] The data storage 305a may also store the static reference number that is to be retrieved and used as the vehicle identifier in scenarios when the result of the trust assessment indicates that the electric charging system 301 satisfies the trust criterion. Alternatively, the static reference number may be stored elsewhere, e.g., in a completely separate data storage location that is associated with an engine control unit of the vehicle.

[0069] The data storage 305b is configured to store trust data 307 relating to the trust criterion I criteria using during the trust assessment. In one embodiment, the trust data 307 includes a set of predefined trusted electric charging systems that have been defined as ‘safe’ or ‘trusted’ (e.g., by a user who may correspond to the vehicle driver), such that the stored static reference number can be used as the vehicle identifier during charging sessions implemented with these trusted electric charging systems. This trust data 307 may include an indication of, or identifier associated with, specific electric charging systems that are known to be trusted. For example, the trust data 307 may identify a set of electric charging systems that are defined as being trusted because they: are of a certain type; belong to a specific network of charging systems; perform a specific type of charging that is deemed to be particularly secure (e.g., ‘Pay-to-Charge’); or are known to be located in a particularly secure or private location. Additionally or alternatively, the trust data 307 may include an indication of a set of trusted secure I private locations (e.g., ‘Home’, or ‘Work’ location). In such embodiments, each location would have a GPS position or coordinate set defined in association with it, and any electric charging systems located in corresponding positions are then deemed to be trusted. In such cases, the trust assessment may then also involve determining the location of the vehicle so that it can be compared against the set of trusted locations to ascertain whether there is a match (in which case, the trust criterion is satisfied).

[0070] The overall system further comprises a remote server 308 configured to communicate with the processor 303 via a suitable communications network (e.g., wireless data communication, the Internet etc.). The remote server 308 may store vehicle identifier information 309 associated with vehicle identifiers that have been used in a plurality of charging sessions, by one or more electric vehicles, and in relation to one or more electric charging systems. The remote server 308 may also be programmed with instructions 310 regarding crosschecks that can be performed in relation to the vehicle identifier information 309, and specifically in relation to whether the dynamic random reference numbers that are used as the vehicle identifiers under certain circumstances fulfil one or more cross-check criteria. These cross-checks can be performed at the request of the processor 303. For example, the instructions 310 may allow the remote server 308 to ascertain whether any given dynamic random reference number that is generated by the processor 303 is appropriate for use in the current charging session. The remote server 308 may provide a cross-check signal 311 to the processor 303 that is indicative of whether the cross-check criteria has been fulfilled. This will be discussed in more detail subsequently with reference to Figure 4.

[0071] With continuing reference to Figure 3, and with additional reference to Figure 4, a method 400 by which the overall system architecture of Figure 3 can implement the desired communications and processing relating to a charging session, according to an embodiment of the invention, will now be described.

[0072] The method begins at step 405 with the initiation of a charging session, and the requisite exchange of initial information, between the electric charging system 301 and the processor 303 of the vehicle control system 100. At step 410, the processor 303 receives a request for identifying information of the vehicle (and specifically for a vehicle identifier), for use in the charging session, in the form of the vehicle identification signal 302. At step 415, in order to determine the appropriate vehicle identifier to provide, the processor 303 first ascertains whether a trust assessment is to be performed. In particular, the processor 303 determines whether input has been received from a user (typically the vehicle driver) as to whether the trust assessment is to be performed at all. This determination may involve actively seeking feedback from the vehicle driver via a human-machine interface (HMI) 505 of the vehicle, e.g., via a touchscreen display of the vehicle. Alternatively, the instructions 304 may contain programming that defines the circumstances under which a trust assessment is required.

[0073] If it is determined that a trust assessment is to be performed, the processor 303 then proceeds to step 420 where the trust assessment is carried out - i.e., where it is ascertained whether the electric charging system 301 satisfies a trust criterion. In an embodiment, the trust criterion may be defined as the electric charging system 301 being a ‘trusted’ one. For example, this may correspond to the electric charging system 301 being associated with a trusted location (e.g., a secure or private location). Additionally or alternatively, this may correspond to the electric charging system 301 itself inherently being defined as ‘trusted’ (for example, corresponding to a certain type of charger, or carrying out a certain type of charging procedure). In order to assess whether the trust criterion is satisfied, the processor 303 is configured to determine if the electric charging system 301 corresponds to one of a predefined set of ‘trusted’ charging systems; these may be stored in data storage 305b, for example. Alternatively, the processor 303 is configured to assess a location of the electric charging system 301 in relation to a predefined set of trusted locations to determine if the location of the electric charging system 301 matches a ‘trusted’ location. In such instances, the processor 303 may be configured to query a vehicle position sensor 502 (e.g., a GPS sensor) to ascertain a current location of the vehicle, and to then compare the current location with the set of predefined trusted locations to determine whether a match is obtained.

[0074] If it is determined in step 420 that the trust criterion is satisfied (i.e., that the electric charging system is ‘trusted’), step 425 is implemented wherein the processor 303 retrieves the static stored reference number (e.g., the vehicle MAC address) for use as the vehicle identifier. Similarly, if it is determined in step 415 that a trust assessment is not even required, step 425 is likewise implemented by the processor 303.

[0075] On the other hand, if is determined in step 420 that the trust criterion is not satisfied (i.e., the electric charging system 301 is not trusted), step 430 is implemented wherein the processor 303 dynamically generates a random reference number for use as the vehicle identifier. As noted previously, this may involve the processor 303 retrieving a reference number at random from a list of available stored values (for example, from data storage 305a); or it may involve the processor 303 determining start and end values of a range of predefined available I acceptable numbers and then implementing a random number generation algorithm to select a number at random from that range.

[0076] Optionally, in step 435, the processor 303 may then perform one or more cross-checks of the generated random reference number to ascertain that the number which has been generated is appropriate for use in the current charging session. More specifically, the processor 303 may ascertain whether the random reference number fulfils one or more cross-check criteria. This may involve the processor 303 querying the remote server 308 and receiving the cross-check signal 31 1 in response indicative of the cross-check result. However, in some instances, it may be possible for the processor to query a data storage (not shown) in the control system 100.

[0077] The cross-check criterion may correspond to any one or more of the following. In some cases, a cross-check criterion may be defined as confirming whether the generated random reference number was previously used as a vehicle identifier during a charging session. Such a charging session may have been implemented in relation to either the same or a different electric charging system; and / or in relation to the same or a different electric vehicle. For example, the cross-check criterion may be defined as confirming whether the random reference number generated is currently in use by a different vehicle for a charging session, and if so, the cross-check criterion is considered not to be fulfilled since it is not desirable for the same number to be used to identify different vehicles at the same time since this raises the possibility of fraudulent use of one of the identifiers. As another example, the cross-check criterion may be defined as confirming whether the random reference number has been used for a charging session within a previous (predefined) period, particularly in relation to the same electric charging system 301 . If so, the cross-check criterion is considered not to be fulfilled since it would not be desirable for the same number to be used by the same vehicle during charging sessions (and / or with the same electric charging system) to avoid associating the vehicle with this number over multiple charging sessions. Such cross-checks beneficially prevent the vehicle identifier from being constantly associated with the vehicle driver’s details over multiple charging sessions, and thereby reduce the chance of the vehicle driver’s details being used fraudulently in instances where the vehicle identifier is intercepted by a malicious third party. By changing the form of the vehicle identifier between charging sessions, it is also possible to minimise the possibility of vehicle tracking.

[0078] In a further example, the cross-check criterion may be defined as confirming whether the random reference number has been used for a charging session under conditions where it is likely that fraudulent activity is occurring. More specifically, the cross-check criterion may be whetherthe random reference number has been used in relation to a charging session within a previous time period, and at a location or distance, where it would not have been possible for the vehicle to be at, given the current location of the vehicle. If so, the crosscheck criterion is considered not to be fulfilled. This particular cross-check criterion is particularly beneficial in relation to identifying the possibility of fraudulent activity in relation to the vehicle identifier, and specifically use by an unauthorised malicious third-party of an intercepted vehicle identifier (and potentially of any associated vehicle driver details) in relation to a charging session for the third-party’s vehicle.

[0079] If it is determined in step 435 that the cross-check criterion (criteria) is (are) not fulfilled, step 440 involves the processor 303 re-generating the random reference number, substantially as set out above in relation to step 430. No re-generation is necessary if the cross-check criterion (criteria) is (are) fulfilled.

[0080] Thereafter, step 445 involves the processor 303 outputting a signal to the electric charging system 301 comprising the vehicle identifier - either the dynamic random reference number generated as set out in step 430, or in step 440; or the static stored reference number retrieved as set out in step 425. The method then proceeds with step 450 which involves implementing the substantive charging process during which the electric vehicle is charged by the electric charging system 301 and where appropriate the vehicle driver is billed accordingly.

[0081] By implementing the above method 400, the control system 100 allows the vehicle identifier to be flexibly selected as a randomly generated number so as to preserve not only the privacy of the vehicle identifier itself, but also of any vehicle driver details that may be provided during the charging session in association with the vehicle identifier. Nevertheless, the above method 400 also recognises that there may be some circumstances under which it would be preferable I acceptable to use a static identifier rather than the randomly generated number, and accommodates these accordingly.

[0082] Figure 5 illustrates a vehicle 500 according to an embodiment of the present invention. The vehicle 500 comprises the control system 100 as illustrated in Figure 1 , here shown explicitly communicating with a vehicle position sensor 502 and a (external) communications interface 503. This communication takes places over a vehicle bus 504. Other control connections are not explicitly shown in this figure, but the connection between the control system 100 and a human-machine interface (HMI) 505 is shown. The HMI 505 typically comprises a display 506 and one or more input means 507 (such as sliders, buttons, and regions of a touchscreen display) allowing driver or passenger interaction, for example to provide user input in relation to whether the trust assessment is to be performed. The control system 100 may in principle reside anywhere in connection with the vehicle bus 502, but in practice is likely to be associated with an Engine Control Module (ECM) 508, and here is shown integrated within it.

[0083] It will be appreciated that various changes and modifications can be made to the present invention without departing from the scope of the present application.

Claims

CLAIMS1 . A control system for controlling a communications system of an electric vehicle, the control system comprising one or more processors collectively configured to: receive, from an electric charging system, a request for a vehicle identifier for use during a charging session; perform a trust assessment to determine whether the electric charging system satisfies a trust criterion; and in dependence on the electric charging system failing to satisfy the trust criterion: generate a dynamic random reference number; and output, to the electric charging system, a vehicle identification signal comprising the dynamic random reference number as the vehicle identifier.

2. The control system of claim 1 , wherein the one or more processors are collectively further configured to, in dependence on the electric charging system satisfying the trust criterion: retrieve a stored static reference number; and output the vehicle identification signal comprising the stored static reference number as the vehicle identifier.

3. The control system of claim 1 or claim 2, wherein the one or more processors are collectively further configured to: receive input from a user indicative of whether to perform the trust assessment of the electric charging system; in dependence on the input indicating that the trust assessment is to be performed, perform the trust assessment; and in dependence on the input indicating that a trust assessment is not to be performed, retrieve a stored static reference number and output the vehicle identification signal comprising the stored static reference number as the vehicle identifier.

4. The control system of any preceding claim, wherein the one or more processors are collectively further configured to determine whether the electric charging system satisfies the trust criterion by: retrieving a set of one or more predefined trusted charging systems; and determining whether the electric charging system corresponds to any of the one or more predefined trusted charging systems.

5. The control system of any preceding claim, wherein the one or more processors are collectively further configured to determine whether the electric charging system satisfies the trust criterion by: determining a current location of the electric vehicle; retrieving a set of one or more trusted locations; and determining whether the current location of the electric vehicle corresponds to any of the one or more trusted locations.

6. The control system of any preceding claim, wherein the vehicle identifier corresponds to a MAC address of the vehicle.

7. The control system of any preceding claim, wherein the one or more processors are collectively configured to generate the dynamic random reference number based on a predefined set of available random reference numbers.

8. The control system of any preceding claim, wherein the one or more processors are collectively further configured to: receive a signal indicative that the dynamic random reference number does not fulfil at least one cross-check criterion to correspond to an allowed vehicle identifier; and re-generate the dynamic random reference number.

9. The control system of claim 8, wherein the at least one cross-check criterion includes a determination that the dynamic random reference number: (a) is currently in use by a different vehicle for a charging session; (b) has been used for a charging session within a previous time period; (c) has been used for a charging session at a given location and / or (d) corresponds to the vehicle identifier of the vehicle provided for a previous interaction with the electric charging system.

10. The control system of claim 8, wherein the at least one cross-check criterion includes a determination that the dynamic random reference number has been used for a charging session within a previous time period and at a location exceeding a maximum distance that the vehicle could have travelled within the previous time period.11 . A vehicle comprising the control system of claims 1 to 10.

12. A method for controlling a communications system of an electric vehicle, the method comprising: receiving, from an electric charging system, a request for a vehicle identifier for use during a charging session; performing a trust assessment to determine whether the electric charging system satisfies a trust criterion; and in dependence on the electric charging system failing to satisfy the trust criterion: generating a dynamic random reference number; and outputting, to the electric charging system, a vehicle identification signal comprising the dynamic random reference number as the vehicle identifier.

13. The method of claim 12, further comprising, in dependence on the electric charging system satisfying the trust criterion: retrieving a stored static reference number; andoutputting the vehicle identification signal comprising the stored static reference number as the vehicle identifier.

14. The method of claim 12 or claim 13, further comprising determining whether the electric charging system satisfies the trust criterion by: retrieving a set of one or more predefined trusted charging systems; and determining whether the electric charging system corresponds to the one or more predefined trusted charging systems.

15. Computer readable instructions which, when executed by one or more processors, cause the one or more processors to perform the method of claims 12 to 14.

Images