DE102012008121A1 - Operating method for mobile network node of vehicle in wireless network using computer program product, involves estimating difference between movement of one mobile network node and detected movement of another mobile network node - Google Patents

Abstract

The operating method involves identifying mobile network nodes in communication with each other by pseudonyms, where one mobile network node is selected (S4). The movement of the former mobile network node is detected (S6), where a difference between the movement of another mobile network node and the detected movement of former mobile network node is estimated (S8). The pseudonyms are switched (S10) to a time when the deviation falls below a threshold value.

Description

The present invention relates to a method for operating a mobile network node in a wireless network, in particular a vehicle-based network node in an ad hoc network, in which network nodes of several vehicles communicate with each other and / or with stationary network nodes.

Data packets transmitted in such a network must contain the designation of a sending network node in order to give the receivers an opportunity to check where a received data packet comes from and whether it is trustworthy. Similarly, a data packet that is not intended for all nodes of the network should be accompanied by the name of the node that is to receive the data packet so that the remaining network nodes can ignore it.

Such wireless networks can provide significant added value for motor vehicle drivers, e.g. B. by a vehicle collects information about the traffic situation on a road he has traveled and passes on to subsequent vehicles to allow them to react proactively.

However, if a mobile network node of a vehicle always uses the same designation and moves through different networks one after the other, then it is possible to track the movement of the vehicle based on the data packets sent by this network node. However, such tracking would be a sensitive intrusion on the privacy of the user of the vehicle. Therefore, it is important for the public acceptance of such networks and the services they support to ensure that tracing the vehicle movement is safely excluded.

One way to complicate tracking is to use different, alternate aliases instead of a fixed name by a mobile network node. If the number of nodes in a network is large enough, there is a high probability that at least two network nodes will change their pseudonym at approximately the same time, so that it is no longer possible for an external observer to determine which of the new pseudonyms belongs to which network node ,

However, such a coincidence is the less likely the smaller the number of network nodes and the more frequently they send. Moreover, if an observer compares the location and direction of movement of the network nodes before and after the pseudonym change, it may be possible with good certainty to decide which of the new pseudonyms belongs to which node.

The object of the invention is to provide an operating method for a mobile network node, which effectively impedes the tracing back of a path traveled by the network node.

• a) Auswählen wenigstens eines weiteren mobilen Netzknotens;
• b) Erfassen von dessen Bewegung;
• c) Abschätzen einer Abweichung zwischen der eigenen Bewegung des mobilen Netzknotens und der erfassten Bewegung des weiteren Netzknotens; und
• d) Wechseln des Pseudonyms zu einem Zeitpunkt, an dem die Abweichung einen Grenzwert unterschreitet.

The object is achieved by an operating method for a mobile network node in a wireless network whose network nodes identify themselves in communication with one another by means of pseudonyms, with the following steps:

• a) selecting at least one further mobile network node;
• b) detecting its movement;
• c) estimating a deviation between the own movement of the mobile network node and the detected movement of the further network node; and
• d) Changing the pseudonym at a time when the deviation falls below a threshold.

The estimation of the deviation and the selection of the changeover time based on it affect the tracking of the movement in two ways. On the one hand, an assignment between old and new pseudonyms of two network nodes is made considerably more difficult for an external observer if the movements of the two network nodes hardly differ; on the other hand, there are two network nodes which independently execute the method according to the invention and compare their two movements , usually for the same assessment of the deviation, so that a simultaneous change of the pseudonym is likely at both network nodes, without the need for a complex synchronization between the network nodes.

When estimating the deviation in step c), both the distance between network nodes and a difference between their directions of movement, preferably between their speeds, should be taken into account. This takes account of the fact that when two vehicles equipped with mobile network nodes travel in opposite directions on a same road and change their pseudonyms at the moment of the shortest distance as they pass each other, an association between the new and the new ones is determined by the unchanged driving directions Old pseudonyms with great certainty remains feasible, while in two with low speed difference overtaking vehicles such a mapping is significantly less secure.

In order to be able to prepare a pseudonym change in time and to be able to execute it at an appropriate time, the estimation of step c) should suitably be based on forecasts of the mobile node's own movement or the detected movement of the selected further network node.

For this forecast, data about the course of roads on which the network nodes are located can be used. Such data allow z. As the detection of whether a vehicle with one of the network nodes on an access lane to a highway or a highway and therefore must change its lane in the foreseeable future. In such a case, the network node of a vehicle already on the highway may be ideally suited for simultaneously changing the pseudonym with it.

If two network nodes change their pseudonym at the same time, then the longer an interruption between the last data packet sent with an old pseudonym and the first one sent with a new pseudonym, the more difficult it is to establish a secure association between old and new pseudonyms the extent to which the direction of movement, speed and location of the network nodes between two data packets can change, the greater, the greater the time interval between the data packets.

On the one hand to enforce unnecessarily long interruptions of data traffic, but on the other hand to achieve a high degree of non-traceability at each pseudonym change, the interruption of data transmission is preferably longer in a pseudonym change, the greater the deviation between the movements of the participating network nodes.

In order not to occupy unnecessarily much bandwidth of the network with pseudonym changes, it can be provided that the above-defined step d) is only performed if a first waiting time has elapsed since a previous pseudonym change.

However, if there is no opportunity to carry out step d) because no suitable further mobile network node is found, then an unconditional pseudonym change can be performed if a second waiting time has elapsed since a previous pseudonym change. This should be longer than the first waiting time mentioned above.

In particular, if mobile network nodes implementing the method according to the invention are not ready to change pseudonyms at any time, such as during the first waiting period, then step a) should preferably further comprise the step of checking whether the selected further mobile network node is ever to a pseudonym change is ready, and in the case of non-availability yet another mobile network node should be selected. This step can be repeated at will, until, if any, finally a ready to pseudonym change another network node is found.

Synchronizing a planned time for the pseudonym change between the participating network nodes may be useful if the time interval between data packets transmitted consecutively from a same network node is short. Such a short time interval requires a correspondingly high bandwidth of the network, which does not depend on the bandwidth consumption for the synchronization.

Subject of the invention is further a computer program product with program code means which enable a computer to carry out the method described above.

A further subject of the invention is a vehicle, in particular a motor vehicle, having a network node suitable for carrying out the method described above.

Further features and advantages of the invention will become apparent from the following description of embodiments with reference to the accompanying figures. Show it:

1 a typical traffic situation in which the method according to the invention is applicable; and

2 a flowchart of the method.

1 shows a motorway entrance in a map-like representation. The highway entrance includes a Auffahrspur 4 as well as continuous lanes 5 . 6 , Two vehicles A, B are each represented at three different times, designated A1, A2, A3 or B1, B2, B3. At the earliest time, the vehicles A, B are at the left edge of the figure at the positions designated A1 and B1. The vehicle A is already on the lane 5 while the vehicle B is still on one of the lanes 5 . 6 leading curve of the Auffahrspur 4 located. Shortly thereafter, according to the positions A2, B2, the vehicles A, B drive side by side, and last has the on the Auffahrspur 4 Adding vehicle B to the lane 5 threaded and both move in tandem, corresponding to the positions A3, B3.

The vehicles A, B each carry an on-board computer, which can work as a network node of a wireless ad hoc network. The reference symbols A, B are used below for the sake of simplicity both for the vehicles A, B and for their on-board computer. In the ad hoc network, the on-board computer of the vehicles A, B and possibly a fixed network node connect 7 , The network node 7 can be provided to provide the on-board computers access to the Internet to transmit information about the route in front of them to the passing vehicles etc. Such information can, for. B. indications of a soon to reach jam end, black ice or the like.

An observer network node 8th , the traffic of the on-board computer of the vehicles A, B with each other and with the network node 7 is listening, is arranged like this next to the roadway. If such observer network nodes are used nationwide, they can track the path of a vehicle, provided that this is a pseudonym for communicating with other vehicles or the network node 7 used, not from time to time in one by the observer network node 8th exchanges not to be detected.

An example of a method by which the pseudonym of about the vehicle A in for the observer network node 8th can not be replaced or at best with a very high technical effort traceable way, with reference to the flowchart of 2 explained.

In step S1 it is checked whether since the last change of the pseudonym a first waiting time T1 has elapsed. If this is not the case, then the on-board computer A continues the communication with the remaining network nodes using the current pseudonym, and the step S1 is repeated after a short time. Then, when it is determined that the first waiting time T1 has elapsed, the process goes to step S2 or, in a simpler embodiment, to step S4.

In step S2, it is checked whether a request has been received from another network node, for example the on-board computer of the vehicle B, whether the vehicle A is ready to change its pseudonym or whether the waiting time T1 for the vehicle A has expired. If so, the vehicle A sends a stand-by display to the vehicle B in step S3 and then proceeds to step S4.

In step S4, it is checked whether the cordless network to which the on-board computer A belongs still has mobile network nodes besides it. Such a review may, for. Example, by querying a table stored locally on the on-board computer A, in which the nodes of the network are recorded and which is continuously updated when nodes exit or thrust out of the network. It is an on-board computer of another vehicle, also referred to for simplicity as B, selected from the table, and using his pseudonym also listed in the table, a request to the on-board computer B is directed in step S5, if he to a change of Pseudonym is ready. If the on-board computer B also the procedure of the 2 He answers to the request only when he is ready. If there is no response to the request, either because the waiting time T1 for the Node B is not over, or because the Node B is responding but the response from the Node A is not perceived due to poor transmission conditions, then the process returns to step S5 back to select another on-board computer. Conversely, if the addressed on-board computer B confirms its readiness for change, then the method continues to step S6.

In the above-mentioned simplified embodiment of the method which does not comprise steps S2, S3, step S5 is also missing, and the method jumps to step S6 directly after selection of the further mobile network node B in S4.

In step S6, the current location r and the current speed vector v of the vehicle A and location r 'and speed vector v' of the vehicle B are determined for the current time t = 0. Based on these data, the further movement of the participating vehicles is predicted in step S7. In the simplest case, such a prognosis can be based on the assumption that the velocity vectors v, v 'remain unchanged during the prognosis period Δt. Refined forecasting techniques can provide data on the course of roads, such as lanes 4 to 6 out 1 on which the vehicle executing the method A or the vehicle B selected in step S4, use to predict changes of direction of the vehicles A, B. Such data may be supplied by a vehicle carried in the vehicle A, which is aligned to the vehicle in front of the lane oriented camera; Preferably, they are provided by a navigation system, which determines the location of the vehicle A in a manner known per se on the basis of satellite signals and compensates this for an accurate location determination of the vehicle A with entrained map data.

It is these map data that can also be used in the present method for the route prediction of step S7.

Based on the predicted movements, the deviation between the movements of the vehicles A, B in the subsequent step S8 during the forecast period .DELTA.t. Such a judgment can be based, in particular, on the fact that the development over time of a deviation measure δ (t) is determined during the prognosis period 0 ≦ t ≦ Δt and the time at which the deviation measure δ falls below a predefined limit value or, after falling below the limit value temporary minimum of the deviation measure δ is identified as a suitable time for a pseudonym change.

The deviation measure δ can z. B. a weighted sum of the vectorial differences of the locations r, r 'and speeds v, v' of the vehicles A, B be: δ (t) = c ₁ | r → (t) | - r → '(t) | + c ₂ | v → (t) - v → '(t) |.

fällt, dann kehrt das Verfahren zu Schritt S4 zurück. Nur wenn die Abweichung zwischen den Bewegungen der Fahrzeuge A, B zu irgendeinem Zeitpunkt t* des Prognosezeitraums unter dem Grenzwert

liegt, wird zu diesem Zeitpunkt t* der Pseudonymwechsel ausgeführt.If it turns out in step S9 that the movements of the vehicles A, B are too different, the tracing back of a pseudonym change by the observer network node 8th because δ (t) never falls below a given threshold in the forecast period

falls, then the process returns to step S4. Only if the deviation between the movements of the vehicles A, B at any time t * of the forecast period is below the limit

is at this time t * the pseudonym change is executed.

If, at the same time, the vehicle B has carried out the above-described procedure, then the probability is high that it has selected the vehicle A in step S4 and then arrived at the same motion prognosis as the vehicle A and the same time t * as that for a pseudonym change has identified appropriately. Consequently, both vehicles change their pseudonym at the same time, without first having to communicate with each other about a suitable time for the change.

For a simultaneity of the pseudonym change, it is not necessary that both vehicles A, B make a switchover at the same time at the time t *; it is sufficient if both vehicles send their last data packet under the old pseudonym before and the first data packet with a new pseudonym after the time t *.

If no further on-board computer B is found in step S4, either because it does not exist or because all have already been tried unsuccessfully, then it is checked in step S11 whether a waiting time T2 has elapsed since the last pseudonym change. If this is not the case, the method returns after a short delay to step S2 (or, as the case may be, directly back to step S4), and the list of network nodes is checked again as to whether there is an on-board computer B whose movement similar to that of the vehicle A is.

If this waiting time T2 has also elapsed without result, then an unconditional pseudonym change is performed in step S12.

festgestellt wurde, der Zeitpunkt berechnet, an dem δ(t) ein Minimum

durchläuft, und der Pseudonymwechsel wird zu diesem Zeitpunkt vollzogen. Dieser Zeitpunkt ist der für einen vom Beobachter-Netzknoten nicht nachvollziehbaren Pseudonymwechsel best geeignete.According to a further development of the method, when in S8 the limit value falls below the limit

was determined, the time calculated at the δ (t) a minimum

goes through, and the pseudonym change is completed at this time. This point in time is the most suitable for a pseudonym change that can not be understood by the observer network node.

noch deutlich kleiner als

sein kann, kann noch einer Weiterbildung des Verfahrens zufolge ausgenutzt werden, um die mit einem Pseudonymwechsel verbundene Kommunikationsunterbrechung zu minimieren: Je länger die Zeitspanne zwischen dem letzen mit alter Pseudonym gesendetem Datenblock und dem ersten mit neuem Pseudonym gesendeten Datenblock ist, um so weiter kann sich das Fahrzeug A in dieser Zeitspanne bewegt haben und um so stärker kann sich seine Fahrtrichtung und Geschwindigkeit geändert haben. Daher kann eine Verfolgung des Pseudonymwechsels durch den Beobachter-Netzknoten 8 trotz einer deutlichen Abweichung zwischen den Bewegungen der Fahrzeuge A, B erheblich erschwert werden, wenn nur beide die Kommunikation lang genug unterbrechen. Sind jedoch die Bewegungen einander so ähnlich, dass eine lange Unterbrechung keinen wesentlichen Zugewinn an Sicherheit mehr bringt, dann kann die Kommunikation bereits nach einer kurzen Unterbrechung wieder aufgenommen werden. Die Dauer der Kommunikationsunterbrechung kann demnach vorteilhaft als – diskrete oder kontinuierliche – Funktion der Abweichung zum Zeitpunkt des Pseudonymwechsels

oder

gewählt werden.The fact that

still much smaller than

According to a further development of the method, this can be exploited in order to minimize the interruption in communication associated with a pseudonym change: the longer the time interval can be between the last data block sent with the old pseudonym and the first data block transmitted with the new pseudonym have moved the vehicle A in this period and the more its direction of travel and speed may have changed. Therefore, a tracking of the pseudonym change by the observer network node 8th despite a significant deviation between the movements of the vehicles A, B are made considerably more difficult, if only both interrupt the communication long enough. However, if the movements are so similar to each other that a long interruption does not provide any significant gain in security, then the communication can be resumed after a short break. The duration of the communication interruption can therefore be advantageous as - discrete or continuous - function of the deviation at the time of the pseudonym change

or

to get voted.

To ensure that the movement of vehicle A can not be tracked, it is not necessary for the observer node to get any clues to guess which new one belongs to which old pseudonym. It is sufficient if such a presumption has a sufficient degree of uncertainty. Even if the observer network node were able to correctly assign old and new aliases to each other with 80% certainty, four aliases suffice to ensure a 75% error rate in tracking the path of the vehicle A.

If the traffic is sufficiently dense, then the likelihood is high that, using the method described above, three or more vehicles will simultaneously change their pseudonym; In such a case, the assignment of old to new pseudonyms is still much more error prone.

LIST OF REFERENCE NUMBERS

A

vehicle

A1, A2, A3

Positions of the vehicle A

B

vehicle

B1, B2, B3

Positions of the vehicle B

4

Auffahrspur

5

lane

6

lane

7

node

8th

node

Claims (12)

Operating method for a mobile network node (A) in a wireless network whose network nodes (A, B, 7 ) identify themselves in the communication by means of pseudonyms, with the steps: a) selecting (S4) at least one further mobile network node (B); b) detecting (S6) its movement; c) estimating (S8) a deviation

between the movement of the own mobile network node (A) and the detected movement of the further network node (B); d) changing (S10) the pseudonym at a time at which the deviation

falls below a threshold. Operating method according to claim 1, characterized in that in the estimation (S8) of the deviation

in step c) the distance (r-r ') between the network nodes (A, B) and a difference (v-v') between their directions of movement is taken into account. Operating method according to claim 1 or 2, characterized in that the estimation (S8) of step c) is based on forecasts (S7) of the own movement of the mobile network node (A) and the detected movement of the selected further network node (B). Operating method according to claim 3, characterized in that for the forecast (S7) data on the course of roads are used, on which the network nodes (A, B) are located. Operating method according to one of the preceding claims, characterized in that the network node (A) interrupts the transmission of data temporarily in a pseudonym change, and that the longer the interruption, the longer the interruption

is. Operating method according to one of the preceding claims, characterized in that the step d) (S10) is performed only when a first waiting time (T1) has elapsed since a previous pseudonym change. Operating method according to one of the preceding claims, characterized in that an unconditional pseudonym change (S12) is performed when a second waiting time (T2) has elapsed since a preceding pseudonym change, without a suitable time for performing step d) having been found. Operating method according to one of the preceding claims, characterized in that step a) further comprises the step of checking (S5) whether the selected further mobile network node (B) is ready for a pseudonym exchange, and in the case of non-availability yet another mobile network node is selected ( S4). Operating method according to one of the preceding claims, characterized in that the mobile network node (A) and the further mobile network node (B) change their pseudonyms at the same time (t *). An operating method according to claim 9, further comprising the step of synchronizing a scheduled time for the pseudonym switch between the network nodes. A computer program product having program code means for enabling a computer to carry out the method of any one of the preceding claims. A vehicle characterized by a mobile network node configured to perform the method of any one of the preceding claims.

Images