Method for verifying the plausibility of gnss position signals

Translation of description of equivalent WO 2015193453 A2

0001A method for checking the plausibility of GNSS position signals

0002The invention relates to methods for checking the plausibility of position signals of a global satellite navigation system in a signal receiver, in particular vehicles or land vehicles.

0003In the prior art the use of a global navigation satellite system (hereinafter briefly: GNSS for Global Navigation Satellite System), which possibly supported by other vehicle sensors, the vehicle sensors are optionally fused with each other, a common method for determining the proper position of the vehicle. Usually the receiver or sensor of the GNSS position signals is the only sensor that provides a self-position or absolute position of the signal receiver. He also provides a global timebase is available that the synchronization of multiple sensors and systems, or Car2X / vehicle-to-X (hereinafter briefly referred to V2X for Vehicle-2-Χ) systems can be used. Unlike sensors installed in the vehicle as IMU, Wheel speed etc. of the GNSS sensor is influenced by the environment and can externally be disturbed (even without intervention in the vehicle hardware). Besides Inherent disorders such as shadowing and the so-called. Multipath, the GNSS sensor can deliberately artificially disturbed (Jammer) or manipulated (Spoofer) are.

0004Jammer can be, for example by artificial noise sitions- the polymer or superimpose useful signals of GNSS, which the GNSS receiver effectively torn off and no GNSS Fix (position resolution) is possible. This is equivalent to a shadowing and is momentarily critical for localization.

0005Spoofer however play the system of false positions before by recorded or artificially calculated GNSS signals emit. For the GNSS sensor, it is not possible here to realize that it is counterfeit signals. The result is an erroneous position determination, and also an incorrect time basis. A disturbed in this way the system can interfere with the V2X communication the V2X function and even transfer error on other vehicles. This may be a security leak for V2X system. Will Spooferdaten fed not only directly into their own system but transmitted via radio, the forgery spread throughout the environment and is present in all systems.

0006The reasons for the use of whining or Spoofern are diverse, ranging from a private interest -. For example, would not be tracked or monitored -. To economic interests, such as fake by speed limits, rest / pause times, used roads and toll stations, etc.

0007If the counterfeit GNSS position signals fed not only directly in the system of spoofers, but, as with kos^¬ transmitted-effective GPS Jammers usual, by radio, so the manipulations do not only affect the host vehicle from, but to all vehicles in the area, or the entire system can be manipulated in a certain range from the outside.

0008The GPS system (Global Positioning System) in the civilian use area offers of no systemic way fake data to see if they are reasonable and consistent and are not filtered out by the plausibility check.

0009The object of the invention is therefore to provide a process which received position signals can be checked for plausibility. The object is achieved in accordance with a first aspect of the invention by means of a method for checking the plausibility of position^¬ signals of a global navigation satellite system in a vehicle, comprising at least one detection system for detecting objects in the surroundings of the vehicle and a receiving means for receiving the position signals, comprising the steps of:

0010Receiving the position signals by means of the receiving device and determining the own position of the vehicle based on the position signals,

0011- Detecting at least one object in the environment by means of the detection system and determining the position of the object, checking the plausibility of the position signals by comparing at least one position of an object with the self^¬ position of the vehicle.

0012The first aspect of the invention is the basic idea that by means of the position of objects around an estimate of the own position of the vehicle is possible, which is the one of the position signals of the GNSS-independent and is sufficiently precise to another for plausibility of the position signals. The detection system therefore is a system that works in principle independent of the determination of own position on the position signals from the GNSS. To compare the position of an object with the natural position of the vehicle based on the GNSS position signals different criteria at the plausibility can be used. In the simplest case, a radius around the self-position is used. If the objects within the radius, the position signals can be checked for plausibility. Here, the tolerance ranges when determining the position on GNSS to consider itself also. Assuming that Spoofer want simulate a fundamentally wrong position specification, a plausibility check can be refused if the deviation of Own position is the position of the object in the range of several kilometers. Alternatively, it is also conceivable to create smaller comparison thresholds. This could be advantageously compared with other situational related criteria such. B. same direction, road, etc.

0013Particularly preferably, the step of detecting an object and Determined One of the position of the object is carried out by a self-shipped from the object message. This can for example take place via a V2X message, in which the object itself and describes its position.

0014The detection system is in the most general form a system for detecting position information of abstract or GE genständlichen objects, such. As traffic lights, buildings or digital data, which are transmitted via electromagnetic waves.

0015According to an advantageous embodiment of the method, the detection system comprises a camera means and the visual recognition of objects, in particular landmarks, such. As street signs, place names, etc. formed. In this way, different species can be detected by visually detectable objects by means of the vehicle to which the position of the respective objects is known. Alternatively, the use of radar or lidar systems conceivable that visually but can not recognize objects, due to their special signals. According to an advantageous embodiment of the method, the respective position of objects from a local map or from an external source is available.

0016According to an advantageous embodiment of the method according to the invention the detection system comprises a vehicle-to-X or _n

00175

0018V2X communication means for receiving objects in the form of V2X NEW PRODUCTS with a location indication of a transmitter the V2X message. Of particular advantage here is the exchange of position data with fixed objects, whose position does not change and, at best, by a trusted authority, eg. As a State or government facility, is set.

0019According to an advantageous embodiment of the method verified and / or signed V2X messages will be used for plausibility. In this way, the authenticity of V2X and the authenticity of the position information can be ensured. According to an advantageous embodiment of the method according to the invention, the detection system includes a motion sensor, in particular for detecting accelerations. In this way, uneven road surfaces, which have a characteristic acceleration curve can be used to to determine the egg others position of the vehicle. Of particular advantage here is the recognition of fixed-decorated road irregularities such. As speed bumps, the position of which usually does not change. According to an advantageous embodiment of the method detects the detection system of the objects from the following group:

0020Infrastructure, such as traffic signs, traffic lights,

0021Toll stations, tunnels, signs, place names,

0022- Point-of-Interest, POI, such as public buildings,

0023Shops, parking garages, and / or

0024Road irregularities.

0025The object is further achieved according to a second aspect of the invention by means of a method for checking the plausibility of .

0026b

0027Position signals from a global navigation satellite system to determine the self-position of a signal receiver, especially a vehicle, having a receiving means for receiving a plurality of position signals, comprising the steps of: - receiving the position signals by means of the receiving device,

0028Analyzing the relative movements between the signal receiver and a plurality of signal transmitters, the position signals and / or analyze the relative movements between the plurality of signal transmitters each other based on the respective

0029Position signals

0030Plausibility of the position signals when no Korre^¬ lation exists between the relative motions. The second aspect of the invention is based on the recognition that true or regular position signals from GNSS satellites for signal receiver move relative independently. The relative movements of the satellites to the receiver signal are not dependent on each other and do not correlate with each other. Similarly, the probability that those satellites that are visible to a signal receiver, move interdependent. While it is possible that multiple satellites are present in an orbit, thus preventing dependencies sporadically. Usually, however, lower this case separates clearly from the case in which a plurality of position signals Spoofer starting simulated by a single signal transmitter. Since this is only a single signal transmitter, the relative movements of the simulated transmitter or sources correlate with each other and also relative to the signal receiver. For plausibility of the position signals thus different thresholds may be set correlations between the relative motions. ^

0031According to an advantageous embodiment of the method according to the invention the relative movement between the signal receiver and each signal transmitter is carried out by means of a Doppler-effect and / or phase measurement and / or a measurement of the delta Ranges of the respective received signals. is lower Delta Ranges is a change of route or change in distance or the relative speed between a satellite and a signal receiver, z. B. vehicle to understand.

0032According to an advantageous embodiment of the method a determination of the signal strength for each position signal is performed by the signal receiver. Additionally or alternatively to the aforesaid embodiment, thereby a further possibility for detection of Spoofern be created. The signal strength of the position signals that are emitted from Spoofern is usually even harder and much faster than real position signals from GNSS satellites. the uniform change, particularly that increase or decrease the signal strength, the different location signals is to be used to detect a spoofer.

0033According to an advantageous embodiment of the method the respective direction is determined based on the signal strengths from the respective signal, z. B. position signal a Satellits or another signal of V2X communication^¬ tion participant is received, wherein the position signal is checked for plausibility, if no other position signal is received from the substantially same directions. The term substantially the same direction in this case comprises a tolerance range that defines the expected reception direction. In three-dimensional space it does not happen that two satellites from the same direction transmitting their position signals. They differ in at least one of the spatial directions and Vectors. The situation is different in adulterated po- sitionssignalen of a spoofer, all from a direction generally come.

0034According to an advantageous embodiment of the method according to the invention, the receiver includes an antenna device on at least one directional antenna and / or multiple antennas. In this way, different analyzes of the positi^¬ onssignale be performed. The object is further solved according to a third aspect of the invention by means of a method for checking the plausibility of position signals of a global navigation satellite system in a signal receiver, especially a vehicle, comprising a receiving means for receiving the position signals, comprising the steps of:

0035Receiving the position signals to determine the proper position of the signal receiver,

0036Comparing the position signals with the previous position^¬ signals of the signal receiver,

0037- Plausibility of the position signals, if no abrupt change of characteristics of the received position signals present at properties previous position signals. The third aspect of the invention is based on the finding that non of Spoofern position signals as opposed to propagate from real satellite signals of a GNSS over a limited range and thus of a vehicle may be identified by comparison with previous position signals. Through this use of received, especially plausibilisierter position signals, sudden changes of properties of the position signals can be well recognized. By adjusting the jump thresholds then can not be detected in the position signals plausible jumps. _

0038y

0039According to an advantageous embodiment of the method, the characteristics of the position signals include information about the time or clock or the time stamp of the position signal used by the transmitter. Problematic sitionssignalen at po- particular is the exact synchronization of time indicating the spoofers for real time the satellite. In this way, therefore, be carried out a Plausbilisierung the position signals. According to an advantageous embodiment of the method, the position signals are checked for plausibility, if no abrupt change in the values ​​determined by the position signals own position to previous proprietary positions present.

0040According to an advantageous embodiment of the method, the method is by means of a piece of infrastructure, especially traffic lights, performed. In this case, two alternatives are conceivable. According to a first alternative, the infrastructure device to a receiving device for receiving GNSS position signals. In this way Spoofer can easily be detected by comparing the deduced on the position signals own position with the stored self location of the infrastructure. A detecting forged GNSS position signals is possible because these do not match the expectations and has jumps. An infrastructure may calculate on GNSS position and time by comparison with a stored position and undisturbed network connection, which is tantamount to an undisturbed or real time indication, a contradiction and thus fake GNSS he^¬ know. In the event that the Spoofer brings the counterfeit item data in V2X messages a V2X communication-capable infrastructure device can recognize the Spoofer on the wrong position information in the message and V2X possibly warn the cars. By comparing their own position and time with the transmitted position and time of an infrastructure, which is preferably transmitted securely and encrypted, a contradiction and thus manipulation of the host vehicle can be detected.

0041According to an advantageous embodiment of the method according to the invention, the method is performed in a vehicle, wherein said position signals are in addition a plausibility check by means of a method according to one of the above embodiments according to the first and / or second aspect of the invention. This embodiment allows the position signals even the plausibility, if a vehicle is for a longer time in the area and transmission area of ​​Spoofer position signals and thus a recognition of implausible Posi^¬ tion signals by means of a comparison with earlier time position signals is not possible.

0042According to an advantageous embodiment of the method of the characteristics of the position signals and / or the self-position depending on the direction of change in an entry or exit from a range or transmission range is determined by a signal transmitter in an abrupt change, not sending a plausible position signals.

0043In the border region between "good" reception and "manipulation" are via V2X data from both areas received that do not fit together, whereby a manipulation can be detected, even if the host vehicle throughout is in the manipulated area and no jumps own received position signals can detect.

0044According to an advantageous embodiment of the method, a signal transmitter, which is not plausible position termination signals sends, by means of a handshake or Verifi^¬ zierungsverfahrens determined. The handshake process includes a secure transmission of a communication over V2X with to^¬ mature content is at the correct answer with respect to the random content. Partial content of random content should own position and time, and the position and time and a confirmation information of the remote site to be, as well as a random number which must be the same in both messages. This can be ruled out, which may not respond correctly to the random content replay attacks, or properly respond but through contradiction or plausibility sierungsmaßnahmen uncover manipulation.

0045According to an advantageous embodiment of the method according to the invention, a signal transmitter, which is not plausible Posi^¬ tion data sends, determined by tracking or exclusion proceedings.

0046According to an advantageous embodiment of the method according to the invention, the aforementioned process is carried out by means of an external system, which receives motion information of vehicles that have a V2X communication device. The invention is described below by means of embodiments and figures. Show it:

0047Figure 1 is a schematic representation of a vehicle for carrying out the method according to the invention, and

0048Figure 2 is a schematic illustration of a driving situation with a vehicle for carrying out the method according to the invention. In the figures, identical technical elements are provided with the same reference numerals and described only once.

0049Reference is made to Figure 1., Which shows a schematic diagram of a vehicle 1 with a chassis 4 which is supported movable in a direction indicated in Fig. 2 driving direction 5 on wheels 6.

0050To determine the proper position or absolute position of the vehicle 1, the vehicle receives 1 via a known GNSS antenna device 16 a plurality of position signals 112 from multiple GNSS satellites 110, cf. FIG. 2. In Figure 1, only one satellite 110 is exemplarily shown. A reception^¬ device 10 is connected to the antenna device 16 and evaluates the position signals 112 from such a way, in order to determine the self-position. The absolute position is derived as a rule in a manner known to the expert on the basis of the emitted GNSS satellite 110 position signals 112th In this example, the antenna device 16 and the receiving device 10 shown separately and be^¬ wrote. However, it is also conceivable that both parts are integrally formed in a single receiving device.

0051Moreover, the vehicle 1 is a detection system 2 for detecting objects and for checking the plausibility of the own position on. The detection system 2 comprises a plurality of components 18, 24, 16, 10. The Chocolatiers described in this exemplary recordable^¬ configuration of the detection system 2 is only one configuration. According to requirements, the detection system 2 may be equipped with less or more components wasbspw. is fixed, depending on the method for exporting.

0052Firstly, the detection system more motion sensors in the form of an inertial sensor 18, the vehicle dynamics data 20 of the Vehicle 1 detected. Among known fall a longitudinal acceleration, a lateral acceleration and a vertical acceleration and roll rate, a pitch rate and a yaw rate of the vehicle 1. This vehicle dynamics data 20 are used in the present embodiment, in order to increase the information content data 12 over the natural position of the vehicle 1 and, for example, to clarify the position and speed of the vehicle 1 on the roadway. 13 The more precise data can then be used even by a navigation device when the GNSS position signal 101 is not available, such as a tunnel. To further increase the information content of the self-position optionally further movement pickup sensors in the form of wheel speed sensors 26 may be used, which speeds the wheel detect 28 of the individual wheels 6 of the vehicle. 2

0053In addition, the detection system 3 comprises a further sensor cluster 24 for acquiring representational objects. The sensor cluster 24 includes a camera device, a radar device and a Lidareinrichtung and allows the objects around the vehicle to detect. The data of the sensor 22 sorclusters 24 can then be used in order to recognize in the evaluation 8 the objects or identify and to determine their position.

0054Furthermore, the detection system comprises a V2X communication^¬ device which is integrated in this embodiment, in the antenna device 16 and the receiving device 10th It should be noted that in the context of the invention V2X messages 30 are understood as objects. The antenna 16 is also used to V2X messages for receiving and transmitting 30th The receiving device 10 has a partition for reading and processing the V2X messages 30th In this way, for example, the polymer contained in the V2X messages 30 sitionsinformationen read. In addition, the receiving device 10 allows the verification of signatures of V2X messages and conducting handshaking or verification procedures with other V2X communication subscribers.

0055The evaluation device 8 receives from the various components 18, 24, 16, 10 of the detection system 2 data and information on the own position and the surroundings of the vehicle 1 and compares them with each other. For plausibility bilize the self-position are several methods provided individually depending on the configuration of the evaluation device 8 or combined executable.

0056It will now proceed approximately to the plausibility of the invention and discussed in FIG. 2

0057Figure 2 illustrates the following driving situation. The vehicle 1 travels on the road 13 in the direction of arrow 5. In the field of view of the vehicle 1, four GNSS are satellites 110, 120, 130, 140, which are each in their orbits 111, 121, 131 moving 141st Each of the satellites 110, 120, 130, 140 sends Po^¬ sitionssignale 112 from what the vehicle 1 his own^¬ can determine position. For clarity, the position signals 112 are shown only for the satellite 110th In the same way also send the satellites 120, 130, 140 Posi^¬ termination signals from.

0058In addition to the satellites 110, 120, 130, 140 there is a further position signal transmitter in the form of a spoofers 15f not authentic or fake position signals 14f emits. The Spoofer 15f sends its fake positi^¬ onssignale 14f within a coverage area 17f, which is limited to the environment of spoofers 15f and varies depending on transmission power. the vehicle 1 but located within the Send area 17f, the position signals 112 of satellites 110, 120, 130, 140 will be dubbed. This can lead to a self-position of the vehicle is determined, which is completely at a different location.

0059The Spoofer 15f can eg. A stationary or a moving vehicle on the road 13 be. The direction of movement spoofers 15f is shown above the arrow 5f. Similarly to the satellites 110, 120, 130, 140 sends the Spoofer 15f from in itself plausible position signals 14f, which are sufficient to determine the proper position of the vehicle. 1 However, the position signals 15f do not originate from different signal transmitters, as is the case with the satellites 110, 120, 130, 140th Therefore, although the natural position of the vehicle 1 can be determined, but it does not match the actual self-position of the vehicle 1 match. The false self location could have a deviation of several kilometers as compared to actual own position. According to a first embodiment, a check or the plausibility of the position signals 14f performed using the following steps.

0060First, the position signals are received 14f of spoofers 15f via the antenna device 16 of the receiving device 10th The receiving device 10 determined by the Spoofer position signals 14f own position of the vehicle 1 in the same manner as regular position signals to determine the egg^¬ others position are used.

0061In parallel, the detection system detects two more objects 66, 64 in the environment and determines the positions of the objects 66, 64. In the present example, the vehicle 1 detected by the Ka^¬ meraeinrichtung the sensor cluster 24 the lights 66. About Inertial sensors 18 cobblestone street 64 is detected. Although the latter allows only regionally localization of the respective object, but may suffice for plausibility. Other uneven road surfaces, such as. For example, a 70 or Guilideckel road ramps 72 allow a more precise localization of the object, and thus the environment of the vehicle via the motion sensors. The respective position of objects eg. From a local map or from an external source is available. It is also conceivable that the traffic light is equipped with a V2X communication device and V2X messages sent 67, in which the position of the traffic light is described. it, if the messages are signed 67 is particularly advantageous. Additionally or alternatively, it is conceivable that certain Obj ects how local entry signs or signs, are recorded on the camera device and analyzed the content of the evaluation. In this way, the position of the vehicle 1 can be determined in precise positions solely on the basis of the detection of the object. Through a comparison of the positions of the traffic light 66 and the cobblestone street 64 with the natural position of the vehicle 1, can be found out that a deviation between the natural position of the vehicle and the position of the objects, for example. In the order of several kilometers is present. Since this deviation is significantly higher than the fault tolerance of GNSS, the position signals 14f recognized as implausible and not used for in-vehicle applications. In addition, can also be issued a warning about V2X messages. Particularly advantageous properties to the plausibility egg^¬ others position include

0062Infrastructure, such as traffic signs, traffic lights, toll stations, tunnels, signs, place names, Point-of-Interest, POI, such as public buildings,

0063Shops, parking garages, and / or

0064Road irregularities. A second embodiment for checking the plausibility of self-position is described hereinafter.

0065In the first step as already described the position signals received 14f and determines the proper position of the vehicle. 1

0066The received position signals 15f by means of a measurement of the Doppler effect or phase or delta Ranges (distance changes) is analyzed as it is known from the distance measurement of GNSS position signals already. By means of these measurements can be found on the one hand the relative movement between the signal receiver and the vehicle 1 and the signal transmitter. As a rule, may be made of the position signal 112 of the satellite, the relative movement of the satellites 110, 120, 130, 140 are determined to the vehicle first Since each satellite 110, 120, 130, 140 to move on its own orbit 111, 121, 131, 141 independently of the other satellites 110, 120, 130, 140, there is no correlation in these relative movements. In the case of spoofers 15f is true, however, so that this can indeed simulate multiple signal channels. This, however, all come from the same source, so that the relative movement between the simulated signal transmitters and the vehicle 1 having a correlation, that is, the relative movements of a dependency on^¬ have today.

0067If such a correlation is determined to conclude, fake position signals 14f is possible and they should not be made plausible. Additionally or alternatively, the signal strength and / or direction of the signal can be used as basis for this to determine the plausibility of the position signal 14f. Based on the signal strength may also be the corresponding direction are determined, from which the respective position signal is received. The position signal 14f is only plausibility if no other position signal is received from the substantially same directions. It is advantageous to the^¬ antenna device 16 equipped with at least one directional antenna and / or a plurality of antenna modules. Unless known, the direction from which must come the position signals of the actual satellite, a position signal based on the direction can be checked for plausibility in this way. A third embodiment of the plausibility of the egg^¬ gene position is described hereinafter.

0068In the first step, according as in the previous embodiments, received position signals 14f to determine the proper position of the signal receiver or vehicle. 1

0069In the second step these position signals 14f compared with previous or older position signals of the vehicle. 1 This step can be carried out for example in the evaluation. 8 Under previous or older position signals are understood to have been received previously in time. The applicable period of the earlier position signals can be predefined or be a function of motion activity, eg. As speed of the vehicle selected. Alternatively, also apply to such position signals^¬ be returned grasped that have already been made plausible by other methods, eg. the two aforementioned embodiments. In this way, in the vehicle 1 in Figure 2, the following situation. The vehicle 2 comes straight from the transmission range of regular GNSS satellites 110, 120, 130, 140 in the reception area 17f of spoofers 15f a. The two different transmission areas could also be defined in a regular and irregular or authentic and inauthentic transmission range. If the vehicle is now a regular program area in the irregular transmission region 17f so changing the characteristics of the position signals, such. As phase duration, timestamp and other information contained in a GNSS position signal because of Spoofer 15f satellites not exact time synchronization can mimic to reality. Finally, the self-position of the vehicle changes 1. This changes the properties are erratic, so that due to such a change history, a transition from a regular program area in an irregular transmission area 17f is recognized and position signals 14f should not be checked for plausibility.

0070a vehicle for a longer period is within the broadcast range irregular 17f, so it is with this method can not be verified the plausibility of the position signals 14f. Here, the aforementioned embodiments may be useful to 14f plausibility position signals yet. Therefore, a combination of the embodiments is particularly advantageous. In particular, the exchange of V2X messages with position information enables a vehicle in such a case to carry out a plausibility check.

0071The embodiment described herein is not limited only to an application in a vehicle. In a particularly advantageous manner, the method can also be implemented in an infrastructure facility. For example, could be 66 equipped with a GNSS position signal receiver a traffic light. This would, at a passing Spoofer 15f whose position signals 14f with own position signals compare positional information or proprietary position. Since the self-position of the traffic light 66 does not change, this information base could be used as a fixed reference value. A GNSS position signal 14f, which leads to another self-position could be identified quickly as Spoofer 15f in this manner.

0072In the event that it is the Spoofer 15f is a vehicle with a V2X communication device, which sent in addition to the fake position signals 14f also V2X messages with correspondingly incorrect position information, it would be helpful to implement a handshaking or verification procedures. The handshake process comprises the following steps:

0073- Sending a request from a first vehicle to a second vehicle with a variable or random variable, with the expected response to the request of the second vehicle to the first vehicle depends on the variable or random size,

0074- Get the answer of the second vehicle by the first

0075Vehicle, and

0076- Check the response function of the variable random variable. As a spoofer would 15f his V2X messages routine way or standard with a distorted position information, this fact could be exploited to detect the Spoofer. A request with a variable or random variable with respect to the position information could then be answered correctly by a spoofer, whereby no valid handshake would come about.

0077By means of the plausibility or the lack of plausibility, a Spoofer 15f reliably detected. Assuming Different solutions can be provided to monitor the Spoofer 15f in a V2X network.

0078One possibility provides that after a sudden change in the characteristics of the position signals and / or the self-position the direction of change is examined in order to determine whether an entry or exit has occurred in an irregular area. In a busy traffic flow in this way, the boundary of the irregular transmission range can be detected quickly 17f. Logically, this information will be forwarded to an external evaluation, which brings together the information and analyzes. This could be achieved by contextual filtering of information, for example. The direction of travel, speed of the vehicles, and so reduce the number of suspected vehicles extent, so that, ideally, a vehicle is identified as Spoofer 15f. This could then be further tracked over the V2X by corresponding authorized bodies. It should be noted that the architecture of the detection system 2 described here is only an example and the functions and methods described can be implemented based on other architectures. The invention is therefore not limited to the example described here.