DE102014014440B4 - Procedure and arrangement for the evidential measurement and documentation of a delivered service - Google Patents

Abstract

Method for measuring and documenting a transferred service, in particular electrical energy or petrol, which is transferred between a supplier and a consumer, at least one of whom is mobile, in which the consumer is identified and the transferred service is measured by the supplier with a measuring device, whereby communication electronics are used on the supplier side and the consumer side, in a first step before the service is transferred, a communication channel is established, whereby the time is recorded on the supplier side and the consumer side, and then the actual exchange of services takes place, which is recorded on the supplier side and the consumer side,
characterized by
that both the provider and the consumer use measuring devices with a unique, cryptographic identification,
that cryptographically signed data on the type of service to be provided and on mutual identification are exchanged via the established communication channel,
that before the exchange of services, the time is recorded on both the consumer and the supplier side using a respective internal clock, that after completion of the exchange of services, the time is recorded on both the supplier and the consumer side using the respective internal clock,
that the data measured during the exchange of power are exchanged between the supplier-side meter and the consumer-side meter so that a complete service exchange data set is available on the supplier side and on the consumer side.

Description

The invention relates to a method for measuring and documenting a transferred power, in particular electrical energy or petrol, which is transferred between a provider and a consumer, at least one of whom is mobile, in which the consumer is identified and the transferred power is measured by the provider with a measuring device, wherein communication electronics are used on the provider and consumer sides, in a first step before the power is transferred, a communication channel is established, wherein the time is recorded on the provider and consumer sides and then the actual exchange of power takes place, which is recorded on the provider and consumer sides. The invention further relates to an arrangement for measuring and documenting a transferred power, in particular electrical energy or petrol, which is transferred between a provider and a consumer, at least one of whom is mobile, wherein a measuring device is present on the provider side and the transferred power is measured with the measuring device.

The fact that at least one party is mobile creates a new application for measuring and documenting the transfer of services that cannot be satisfactorily solved by conventional measuring devices. Firstly, because they do not identify changing participants and ensuring this is difficult in itself, and secondly, because they do not usually perform process-related measurements with documentation of the process time, but rather time-interval-related measurements. Furthermore, there is no easy manual access for those involved to the calibrated measuring devices for testing, there is little time available for testing and frequent manual testing is time-consuming and therefore undesirable.

A procedure of the type mentioned above is known from the US 2008/0269953 A1 This document describes any power generation device and power consumption device with variable power parameters, such as voltage, current and alternating current frequencies. These can be mobile phones or MP3 devices. A communication channel is established between these devices and data, including a time, is exchanged.

From the EN 10 2009 037 968 A1 Billing centers are known that carry out a process for distributing contract keys from a billing center to vehicles. Identical contract keys can also possibly be distributed to different vehicles, provided they are subject to the same contract.

From the WO 2010/057631 A2 Stationary consumer measuring devices and processes are known that sign a measured value together with an identification of the device and a time stamp and output it as a data set and can read in exactly such data sets again, display them and check for data changes. A process for identifying another party, whereby this is recorded and assigned at the same time, is not described here.

Another procedure and another arrangement are known, for example, from a proposal by the Physikalisch-Technische Bundesanstalt in Braunschweig. This is published, for example, as "Comments and suggestions from the legal department of the E-Energy funding project of the BMWI and BMU on data protection in the smart grid"; as of January 2011. This document was published on the Internet at http://www.modellstadt-mannheim.de/moma/web/media/pdf/FGR11_E-Energy_DATENSCHUTZ_Public_Onl.pdf. In the model presented there on page 115, the electrical power supplied by a supplier to a mobile consumer is measured using a calibration-capable measuring device from the supplier, and a large amount of data is collected and confirmed by the supplier. There remain considerable problems with fraud protection and thus the unequivocal proof of the exchange of power. The fundamental problem of energy supply, especially to electric vehicles, has also been described in other publications, for example in the publications US 2010 / 0 161 469 A1 , US 2010 / 0 156 349 A1 and US 2010/0161480 A1 . The printed matter US7,956,570 B2 and US 2011/0145141 A1 fundamentally deal with the problem of billing for electrical energy supplied to vehicles.

The invention is based on the object of providing a method with the features of the generic term of claim 1 with documentation that is as fraud-proof as possible, with which the service provided can be proven in all essential points (participant identification, process identification, type of service and other contract criteria, quantity, time). Furthermore, the invention is based on the object of creating an arrangement with the features of the generic term of claim 13, with which the inventive The invention can be implemented using a method according to the invention. Preferred developments of the invention are described in the subclaims.

In a method for measuring and documenting a transferred service, in particular electrical energy or petrol, which is transferred between a provider and a consumer, at least one of whom is mobile, in which the consumer is identified and the transferred service is measured by a measuring device on the provider side, it is essential to the invention that a measuring device with associated communication electronics is used on the provider side and the consumer side, that measuring devices with a unique cryptographic identification are used on the provider side and the consumer side, that in a first step before the service is transferred, a communication channel is established between the measuring devices, that cryptographically signed data on the type of service to be transferred and on mutual identification are exchanged via the established communication channel, that the time is recorded on the provider side and the consumer side, that the actual exchange of services then takes place, which is recorded by the measuring devices on the provider side and the consumer side, that after the service exchange has been completed, the time is recorded on the provider side and the consumer side, that the data measured during the service exchange are exchanged between the provider-side measuring device and the consumer-side measuring device so that a complete power exchange data set is available on the supplier side and the consumer side.

This method according to the invention enables a largely fraud-proof documentation of an exchange of services. By using two measuring devices that communicate with each other and exchange the recorded data in various steps, with the respective time also being recorded so that a complete service exchange data set is available on both sides, it is possible to document the service provided in a way that is secure as evidence.

Preferably, a calibrated measuring device is used on the supplier side and the consumer side. Particularly preferred is a calibrated measuring device in each case.

The service exchange data set preferably includes at least the identification of the parties involved, the identification of the processes by process counter numbers of the respective measuring devices, the progress status of the respective process, the agreed service type, e.g. the direction of the service exchange between the partners, and other contract criteria, e.g. if necessary, price expectations of both parties, as well as preferably all meter readings of all service types of all measuring devices involved before and after the service exchange, particularly preferably also during the service exchange (to calculate the quantity of the service transferred) and the times before and after the service is transferred.

The measuring devices must use dedicated communication electronics with which they can communicate with the communication electronics of the calibration-capable measuring device on the other side. The measuring devices must have a unique and reliable identification in the form of a cryptographic, asymmetric procedure with private and public keys and certificates or identifications so that fraud by feigning a false identity is reliably prevented.

A communication link must then be established between the two measuring devices via a communication channel. This communication channel is then used to identify who is supplying power to whom and what type of power exchange is involved, e.g. electrical energy, petrol or other, power direction, etc. Data on the time period is also exchanged.

Preferably, the exchanged data before the exchange of services includes a contract conclusion, whereby the contract conclusion contains three data parts, namely a first data part A, which is transmitted as a contract offer from the provider to the consumer, a second data part B, in which the consumer checks the identification of the provider and, upon acceptance of the contract offer, supplements his own contract data by means of a signature and transmits it to the provider, and a third data part C, in which the provider checks the consumer's data, also accepts it with a signature and sends it back to the consumer.

This means that both parties, i.e. the provider and the consumer, have complete documentation of the conclusion of the contract. Furthermore, both parties have a statement about the identity of the other party, which has also been verified.

In a further preferred embodiment of the invention, the data measured during the exchange of services are confirmed to one another after the exchange of services and are transmitted in three data packets between the consumer and the provider, whereby in a data part D the measured data including the time are transmitted from the provider to the consumer, in a data part E the measured data and the recorded time are transmitted to the provider upon acceptance by the consumer and in a third data part F the provider transmits a corresponding confirmation to the consumer via the communication connection upon acceptance of the data.

In this way, the data is transferred back and forth between the provider and the consumer in its entirety and checked in each case. At the end, both sides have a mutually confirmed, consistent service exchange data set, which also contains the data packets from the other side, which are each provided with identifications or certificates and times by the other side.

The current time could be determined using a challenge and response method via an online connection, but in an embodiment of the invention, an internal clock is available on both the consumer and provider sides to determine the time. This is used to record the respective time. In particular, data parts are provided with the current time so that when the data is checked, an exact sequence can also be checked, thereby achieving additional security against forgery. Preferably, the internal clock is read out in each case. This is designed so that its service life preferably exceeds the service life of the entire device. If the accuracy of the clock is not completely sufficient for the service life of the device and therefore has to be readjusted at predictable times, this is determined the next time the device is used and documented internally. Preferably, it is provided that in the event of a failure, the internal clock can be synchronized and is synchronized by an external, cryptographically authenticated and authorized time signal via an internal time signal receiver part. If the internal clock cannot be used and an external time signal is not available, the respective party will abort the process. If an external time signal is available when the internal clock cannot be used, the external time signal is cryptographically checked so that the internal clock can be adjusted and used. If the internal clock can be used, the external time signal is checked with the internal clock, as are the time information from the other party. However, the internal clock is preferred for generating your own data.

In a preferred embodiment of the invention, all data parts are signed by the senders using asymmetric cryptographic methods and a private key (cf. Diffie, W. and Hellman, ME: New Directions in Cryptography. In: IEEE Transactions on Information Theory. 22, No. 6, 1976, pp. 644-654 ) and transmitted in encrypted form via the communication channel. Private cryptographic keys are always kept inside the device and are never issued. In a preferred embodiment of the invention, all keys originate from an authenticated and authorized source, e.g. an issuing authority.

Preferably, the sending party provides the data parts with a certificate for identification. The identification or certificates make the devices recognizable.

To increase security, it is preferable to use several cryptographic methods in parallel, so that the breach of one cryptographic method does not make it necessary to replace the devices immediately, because then another cryptographic method may exist in parallel and continue to confirm the authenticity.

Preferably, all previously transmitted data is transmitted again with each data transfer. This increases redundancy and ensures verifiability.

For this purpose, various checks to detect manipulation are preferably carried out during each data transfer on the sender side and the receiver side as well as during the exchange of services, and if manipulation is detected, communication is terminated. On the one hand, this affects the identification or certificates and the signatures, which are checked using a suitable cryptographic procedure that can be used to determine whether the cryptographic certificates and signatures are genuine, and on the other hand, the times, the type of service, the process counter numbers, the process progress status, all time sources, the process and the overall data consistency, but not the exact match of the quantity measurements of the transmitted service on both sides. If there are any anomalies in the respective data or if errors are detected in the test routines, the party carrying out the check will explicitly refuse and terminate communication and the exchange of data and services. The The entire process is aborted. Preferably, the measuring device will interrupt the power exchange to end it independently if the electronics outside the measuring device signal the desire to end it by selecting the power type "no power type". At the interface for reading the power exchange data sets, additional internal data on the situation in question, e.g. the status of the internal clock, can be provided in a signed form, which should not be made available to the other party. If the measured values of the power transmitted by the two parties differ significantly from one another, disputes may be resolved organizationally afterwards but not taken into account by the devices.

A further aspect of the invention relates to the arrangement for measuring and documenting a transferred power, in particular electrical energy or gasoline, which is transferred between a provider and a consumer, at least one of whom is mobile, in which a measuring device is present on the provider side and the transferred power is measured with the measuring device. This arrangement is used in particular for carrying out the method described above and is characterized according to the invention in that a measuring device is present on the provider side and a consumer side and that a communication electronics with a unique cryptographic identification is present on the provider side and a consumer side, each associated with the measuring devices.

The measuring instruments are preferably those that can be calibrated. They are particularly preferred to be calibrated measuring instruments.

With such an arrangement, the power transferred can be measured on both sides using a calibrated measuring device. Data is exchanged with the associated communication electronics, which can be verified using unique identification and, as a result, enables fraud-proof billing. For details of how the process is carried out and the communication between the two measuring devices or the associated communication electronics, please refer to the above description.

The calibration-capable measuring device is preferably a smart meter with corresponding performance counters and an additional process counter. This enables measurement on the one hand and communication between two smart meters on the other hand is technically possible without any problems. The measuring device is preferably enclosed together with the communication electronics in such a way that it cannot be opened without leaving permanently detectable traces. The internal program logic cannot be reprogrammed from the outside, not even via attacks via the data interfaces, e.g. by using internally non-reprogrammable read-only program memories (ROM). This creates security against manipulation.

Furthermore, the measuring device is preferably assigned a unique identification. For this purpose, the devices have a corresponding, readable label on the outside. This can be read by people. Alternatively and/or additionally, a machine-readable label can also be present. The label that can be read on the outside is clearly assigned to the associated, unique, public key, e.g. via an official register.

Preferably, each measuring device is designed or has an interruption device with which the power exchange can be independently released and interrupted.

In another preferred embodiment of the invention, each measuring device is assigned an external electronics which is designed for communication with the measuring device, but is not intended or designed for communication with the opposite measuring device.

• 1: eine schematische Darstellung des Gesamtaufbaus;
• 2: eine schematische Darstellung des gesamten Verfahrensablaufs;
• 3: eine Darstellung des Verfahrens gemäß Punkt 16 aus 2; und
• 4: eine Darstellung des Verfahrens gemäß Punkt 20 aus 2.

The invention is explained in more detail below using an embodiment shown in the drawing. The schematic representations show in detail:

• 1 : a schematic representation of the overall structure;
• 2 : a schematic representation of the entire procedure;
• 3 : a description of the procedure according to point 16 of 2 ; and
• 4 : a description of the procedure according to point 20 of 2 .

In 1 The overall structure is shown in a schematic diagram. On the supplier side, there is a calibration-capable measuring device 1 with associated electronics 3, on the consumer side, there is also a calibration-capable measuring device 2, to which an electronics 4 is assigned. In the measuring devices 1 and 3, In each case, further communication electronics (not shown here) are installed or assigned to them, which are used to communicate with the calibration-capable measuring device opposite. This is shown here as a double arrow 6. This communication channel, which is indicated here as bidirectional, can also be implemented via two separate communication channels. The communication between the calibration-capable measuring device 1 and the associated electronics 3 of the provider and the communication that takes place during this, which is indicated by arrows 9 (agreed type of service provider) and 10 (type of service to be provided by provider) on the one hand and on the consumer side by arrows 11 (agreed type of service consumer) and 12 (type of service to be provided by consumer), is exclusively internal within the respective party and takes place under the exclusion of the influence of the other party. Within these communication channels, therefore, no exchange with cryptographically mutually secured identification needs to take place. Here, for example, the agreed type of service is communicated and further processed internally by the consumer and provider. In addition to the communication channel 6, a power exchange is also carried out between the provider's calibration-capable measuring device 1 and the consumer's calibration-capable measuring device 2, which takes place here via the power channel marked 5. There are also arrows 7 and 8, which indicate that the provider's measuring device 1 and the consumer's measuring device 2 receive external time signals, via which an internal clock can be reset or synchronized in the event of a failure. Arrows 13 and 14 symbolize the final output of a power exchange data set (LADS), which is output by the respective measuring devices 1 and 3 at the end of the process.

In 2 The overall process is shown. It is described as follows:

15 Willingness to contract

The provider electronics 3 signal to the provider's calibration-capable measuring device 1 which type of service is currently required and, if applicable, other contract criteria. The consumer electronics 4 signal to the associated calibration-capable measuring device 2 which type of service is supported and, if applicable, other contract criteria. The consumer electronics 4 can support different types of service for different, consecutive charging processes, i.e. it can also take into account and select what is required from the consumer's perspective. This means that both sides are self-determined and a real agreement is reached or not.

16 Contractual agreement

Once the service types of both sides have been set and a communication connection (see 6 in 1 ) between the two calibratable measuring devices and their associated communication electronics, the calibratable measuring device 1 of the provider initiates a new process and communication with the calibratable measuring device 2 of the consumer. Both sides increase their internal process counter and conclude a contract agreement if all contract criteria match. In the event that the two measuring devices 1 and 3 are identical, the measuring device can take on the role of the provider's measuring device and thus initiate communication, the electronics of which signal to it a desired type of service and not just a supported type of service. As part of the contract agreement, data parts A, B and C are created, which also contain the time information. These data parts are indicated here with 24 result data parts A, B, C. These are referred to in connection with 3 discussed further.

17 Willingness to perform

If the two measuring devices have agreed on the type of service because the type of service desired by the provider and the type of service supported by the consumer as well as other contractual criteria, if applicable, match, the two measuring devices signal to their associated provider electronics 3 or consumer electronics 4 that the agreed type of service is approved so that the actual exchange of services can begin.

18 Exchange of services

The exchange of power is released by both measuring devices, which is then measured by the meter readings in the measuring devices. The meter readings determined are indicated in block 23, Result of meter readings. Preferably, the actually measured type of power is checked against the agreed type of power (see also line 16 in the table of tests).

19 Exchange completion

As soon as the provider electronics 3 or the consumer electronics 4 want to end the exchange of services, they signal this to their measuring device by resetting the type of service to be provided (arrows 10 and 12) to "no service". In a preferred embodiment, the respective measuring device then ends the exchange of services by interrupting the exchange line. The measuring devices 1 and 3 then record the time after the exchange of services for the purpose of preserving evidence.

20 Exchange confirmation

As soon as the power exchange has been completed in this way, the two measuring devices 1, 2 carry out a power confirmation. As part of the exchange confirmation, the data parts D, E and F are created, which also contain the time information. These are indicated here with 22 Result LADS. This is referred to in connection with 4 The exchange confirmation also includes the data parts A, B and C 24 Result A, B, C that were previously created in step 16 when the contract was agreed. In this way, a service exchange data set (LADS) is created that can prove the service exchange.

21 Process completion

This service exchange data set can be read via the corresponding interface (see 13 and 14 Readout interface LADS provider and consumer in 1 ) can be read out.

In 3 the creation of data parts A, B and C according to reference numeral 24 from 2 explained in detail.

The provider begins a new process and increases its internal process counter and carries out all the necessary checks during each process (according to the Checks section), creates a non-binding contract offer to the as yet unknown consumer and thereby defines the type of service to be exchanged, identifies itself to the consumer, provides the contract data and already provides a signature that supports the credibility of the identification (data part A). This signature does not yet represent a contract signature, but merely an identification, since the trustworthiness of the consumer could not yet be verified.

The consumer also begins a new process and increases his internal process counter and carries out all the necessary checks during each process (according to the Checks section), receives data part A, now already knows the provider, but has not yet identified himself. The consumer checks the trustworthiness of the provider's identification and then accepts the provider's contract offer to the consumer, provides his own contract data and signs the contract and delivers this unilaterally signed contract to the provider (data part B). The consumer and subsequently the provider therefore have a complete contract with a signature. However, the provider has not yet been able to check the consumer's identification.

The provider receives a complete contract with all the contract data from both parties, which already has the consumer's signature on it. The provider also checks the consumer's trustworthiness and also signs the contract and sends it to the consumer (data part C). This means that the provider first and then the consumer also have a complete contract signed by both parties.

The consumer now also receives and checks the second contract signature from the provider. This means that the provider, and subsequently the consumer, has a complete contract signed by both parties. This means that both parties have a trustworthy contractual agreement and the devices that can be calibrated can give their respective electronics the signal to begin delivery/exchange of services using the agreed service type.

In every case, both parties do not always know in advance which side is to be the supplier and which is to be the recipient, for example in weather-dependent situations in the power grid and bidirectional exchange of services. Regardless of this, the process is designed in such a way that the provider, as is usual in end-customer business transactions, first unilaterally opens a contract offer to an initially unknown end customer. This has the advantage that the provider also has the opportunity to design the content of the offer (services type of offer), because as a rule only the provider has the information and the possibility to design what the content of the offer should be.

In 4 are the 2 The service exchange confirmation 20 shown and the three additional data parts D, E and F created in this way are explained.

The provider determines the current time and current meter data and signs the correctness of this data and sends it to the consumer (data part D). The provider cannot yet formulate acceptance or rejection of the other party's information because the provider does not yet have the consumer's information.

The consumer now already knows the provider's data, determines his current time and meter data and thus has all relevant information from both sides, carries out his checks and decides whether to accept or reject the provider's data. These results are signed and sent to the provider (data part E).

The provider now also knows the consumer's details and thus has all relevant information from both sides and also checks this and decides whether to accept or reject the consumer's data. These results are signed and sent to the consumer (data part F).

The consumer now also receives information about the provider's consent or refusal. This means that the provider, and subsequently the consumer, have a complete data set signed by both parties, which contains the consent or refusal of both parties as well as the underlying agreed or disputed data.

Either side can refuse the process at any time and thus abort it, in particular according to the tests and criteria described in the section on tests. Both sides then save the incomplete service exchange data set created up to that point in a signed form in the respective local database for evidence purposes and signal to the other side that the process has been aborted. If the process is aborted due to suspicion of manipulation, no further information is made available to the other side, i.e. the data set is not further enriched in order not to reveal any further information.

After the creation and before sending a data part, it is always saved in a corresponding internal data structure and remains available at the LADS interface (13 and 14 of 1 ) ready for reading. Likewise, after receiving a piece of data, it is always saved in a corresponding data structure, which is still available for reading on the LADS interface even after manipulation or errors. If cooperation is refused due to tests, the reason for refusal/test number (according to the table in the Tests section) is also saved internally and is available for reading on the LADS interface.

After the process has ended, the data can be read from any device via the LADS interface. They must be saved for billing and evidence purposes. This can be waived, but then it will not be possible to bill for services provided or to defend against unjustified claims.

In case of rejection, the data may be subject to a clarification procedure.

At each subordinate step, checks are carried out in accordance with the detailed check rules in the "Checks" section. They lead to acceptance and continuation of the process or to rejection and termination of the process by means of a notice of further refusal to cooperate. All data underlying the decision is recorded/saved. With each subsequent communication, the previous data set is supplemented with the next piece of data.

However, during the inspection and, if necessary, the approval or rejection, the measured values of the other party are not checked (during the service confirmation after the service exchange). A deviation in the measured values of the exchanged service is permissible and does not lead to a rejection. However, significantly different measured values should never occur in devices that are capable of being calibrated during their approved service life and are therefore ignored. If measured values nevertheless differ significantly differ from each other, disputes over differing measured values are subsequently resolved organizationally, but are not taken into account by the devices. In contrast, the devices only check for signs of other, obvious manipulations throughout the entire process, but not the mutual performance measurements.

Examinations

During the creation of data parts and when receiving them after a data part has been transferred from one side to the other, the data is checked for validity, correctness and plausibility. If checks give an alarm, the process is aborted and the corresponding reason for aborting (check number) is recorded at least internally in the service exchange data record, but is not communicated to the other side. Only the fact of an abort is communicated to the other side. The other side must be prepared for aborts and must also document this using the received and signed abort data record.

To permanently check the validity and plausibility of the external time signals as well as all received data packets, all certificates, signatures and plausibilities are always checked.

All of the checks listed in the table below are carried out, and can also be carried out later using complete service exchange data sets for re-checking and resolving disputes. The check number is always recorded as the internal status of the reason for refusal of cooperation, but is not passed on to the other party during the service exchange process. Real problem cases can be looked up using the check number in the table below.

The table lists 2 columns for each of the 6 pieces of data that are transferred, making a total of 12 columns that detail all of the checks that are carried out on the provider and consumer side for each data transfer. For each piece of data to be transferred, the data piece is created and received separately. Each time a piece of data is created or received, the sequence of checks must be carried out along a column from top to bottom. Additional columns in the table describe the checks to be carried out in more detail. The column headed "Category" specifies in more detail which rough portion of the transferred data is being checked. The column headed "Check" describes which check is to be carried out. The column headed "Remarks" describes which prerequisites/conditions may have to be met for a check, or the reason why such a check should be carried out.

Claims (24)

Method for measuring and documenting a transferred service, in particular electrical energy or petrol, which is transferred between a provider and a consumer, at least one of whom is mobile, in which the consumer is identified and the transferred service is measured by the provider with a measuring device, whereby communication electronics are used on the provider and consumer sides, in a first step before the service is transferred, a communication channel is established, whereby the time is recorded on the provider and consumer sides, and then the actual service exchange takes place, which is recorded on the provider and consumer sides, characterized in that the provider and consumer sides each use measuring devices with a unique, cryptographic identification, that cryptographically signed data on the type of service to be transferred and on mutual identification are exchanged via the established communication channel, that before the service exchange, the time is recorded on the consumer and provider sides using a respective internal clock, that after completion of the service exchange, the time is recorded on the provider and consumer sides using the respective internal clock, that the data measured during the service exchange between the supplier-side meter and the consumer-side meter, so that a complete power exchange data set is available on the supplier side and the consumer side. Procedure according to Claim 1 , characterized in that a calibration-capable measuring instrument is used. Procedure according to one of the Claims 1 or 2 , characterized in that the service exchange data set includes at least the identifications of the parties involved, the process counter numbers of the respective measuring devices, the progress status of the respective process, the service type, and other contract criteria as well as all meter readings of all service types and the times before and after the service transferred. Method according to one of the preceding claims, characterized in that the data exchanged before the actual exchange of services contain a contract conclusion, the contract conclusion containing three data parts, namely a first data part A, which is transmitted as a contract offer from the provider to the consumer, a second data part B, in which the consumer checks the identification of the provider and, upon acceptance of the contract offer, supplements his own contract data and transmits it to the provider and a third data part C, in which the provider checks the consumer's data, accepts it with a further signature, which corresponds to a mutually accepted and signed contract, and sends it back to the consumer. Method according to one of the preceding claims, characterized in that the data measured during the service exchange are transmitted after the service exchange in three data packets between the consumer and the provider and contain a mutual service confirmation, wherein in a data part D the measured data including the time are transmitted from the provider to the consumer, in a data part E the consumer transmits the measured data and the own recorded time to the provider and in a third data part F the provider transmits a corresponding confirmation to the consumer via the communication connection upon acceptance of the data. Method according to one of the preceding claims, characterized in that if an internal clock fails, it is synchronized by an external cryptographically authenticated and authorized time signal. Method according to one of the preceding claims, characterized in that each data part is signed by the sending party with a private key according to an asymmetric cryptographic method. Method according to one of the preceding claims, characterized in that data parts are provided by the sending party with a cryptographic certificate with a public key for identification. Method according to one of the preceding claims, characterized in that for cryptographic signing and certification the data are each encrypted using one or more established, cryptographic, asymmetric methods in parallel. Method according to one of the preceding claims, characterized in that with each data transmission all previously transmitted data are retransmitted. Method according to one of the preceding claims, characterized in that during each transmission of the data on the transmitter side and the receiver side as well as during the exchange of power, various checks are carried out to detect manipulation and if manipulation is detected, the process is aborted. Method according to one of the preceding claims, characterized in that the measuring device independently interrupts the power exchange for termination if the electronics outside the measuring device signals the termination request by the power type "No power type". Arrangement for measuring and documenting a transferred power, in particular electrical energy or gasoline, which is transferred between a provider and a consumer, at least one of whom is mobile, in which a measuring device is present on the provider side and the transferred power is measured with the measuring device, for carrying out the method according to one of the preceding claims, characterized in that a measuring device with a unique, cryptographic identification is present on the provider side and the consumer side, that communication electronics assigned to the measuring devices are present on the provider side and the consumer side, that an internal clock is used on the consumer side and on the provider side to determine the time. Arrangement according to Claim 13 , characterized in that the measuring device is a calibration-capable measuring device. Arrangement according to one of the Claims 13 or 14 , characterized in that the measuring devices are like a smart meter with corresponding usual counter values and additionally a process counter. Arrangement according to one of the Claims 13 until 15 , characterized in that the measuring device, together with the communication electronics and the internal states/data, is housed in such a way that opening or manipulation is not possible without leaving permanently detectable traces and its internal program logic cannot be reprogrammed from the outside. Arrangement according to one of the Claims 13 until 16 , characterized in that a unique, cryptographic public and private key for signing and a certificate (including public key) for identification are housed in the measuring devices, whereby the private key exists exclusively in the measuring devices. Arrangement according to one of the Claims 13 until 17 , characterized in that the devices have a corresponding, legible marking on the outside for unique identification. Arrangement according to one of the Claims 13 until 18 , characterized in that the public key is uniquely assigned to the marking readable on the outside if it differs from it, e.g. via an official register, or is identical with it. Arrangement according to one of the Claims 13 until 19 , characterized in that in order to determine an external cryptographic time signal on the consumer side as well as on the provider side, an internal time signal receiver part is used for receiving the external time signal. Arrangement according to one of the Claims 13 until 20 , characterized in that the measuring devices, in addition to the current counter values or measured values for different types of services, keep a process counter number, a process progress status, times before the start and after the end of the service exchange and other status fields, e.g. for the status of the internal clock, desired or confirmed service type and other contract criteria for the service exchange, last received external time signal nal, the received certificate of the counterpart, last received data parts of the counterpart, signature, etc. Arrangement according to one of the Claims 13 until 21 , characterized in that each measuring device is assigned an external electronics which is intended and designed for communication with the measuring device, but not for communication with the opposite measuring device. Arrangement according to one of the Claims 13 until 22 , characterized in that each measuring device is assigned an interface for reading out the power exchange data records, with the aid of which all relevant data can be determined from the measuring device both in the event of success and in the event of an error. Arrangement according to one of the Claims 13 until 23 , characterized in that each measuring device can independently enable and interrupt the power exchange.

Images