DE102018007885A1 - Safe traffic accident prevention - Google Patents

Abstract

The present invention is directed to a method and a correspondingly set up system arrangement which allow geographic data provided by a mobile terminal to be evaluated and an error message to be issued in the case of falsified geographic data. In this way, other road users who rely on the geographical position of the mobile terminal can be warned, or an autonomous method can be adapted to this. The present invention is also directed to a computer program product with control commands which execute the method or operate the system arrangement.

Description

The present invention is directed to a method and a correspondingly configured system arrangement which allow geographic data provided by a mobile terminal to be evaluated and an error message to be issued in the case of falsified geographic data. In this way, other road users who rely on the geographical position of the mobile terminal can be warned, or an autonomous method can be adapted to this. The present invention is also directed to a computer program product with control commands which execute the method or operate the system arrangement.

DE 10 2015 011 748 A1 shows a method for managing a plurality of subscription profiles of mobile terminals, wherein a security element is provided and special events such. B. a vehicle accident.

US 2009/005061 A1 shows a mobile device in which the predicted position accuracy is taken into account and then reacted accordingly.

KR 2005/00090155 A1 shows a mobile device, which provides that a location is registered and also information is stored that relates to how the location measurement conditions are to be evaluated. These conditions relate to a flow parameter that can influence geographic position determinations.

CN 206684953 U teaches that vehicles transmit their positions and speeds to a server, which evaluates all incoming data and checks for possible accident situations. If one is found, the vehicles involved will be notified or warned.

In addition, it is known that with the next generation of the 5G mobile radio networks, a significantly improved location of the connected devices is also possible. The accuracy of this location can be accurate to within 30 cm.

Different communication scenarios are known from the prior art, vehicles for example communicating with one another and then exchanging traffic information. For example, a vehicle that has broken down can send corresponding accident data to vehicles in its vicinity and then request help or notify that, for example, a vehicle has remained on the road behind an unclear curve. Typically, newer vehicles have a data communication interface, which makes it possible to exchange data with other road users indirectly or directly. An indirect type of data communication is the provision of data to a server, which is then transmitted to other road users.

Network topologies and corresponding hardware are known from mobile radio technology, which set up and provide a communication network. In particular, the person skilled in the art knows base stations which span a mobile radio cell and which can also be used to determine the position of vehicles. So it is u. a. known to measure a response time of a mobile terminal with respect to a base station and to compare the response times among several base stations. The geographic position of the mobile terminal can then be determined. The person skilled in the art also knows other position determination methods, which are typically satellite-based.

The prior art has the disadvantage that primarily automobiles are viewed as the source and destination of position data and speed data. This applies in particular to self-driving, i.e. autonomous, automobiles, but also to existing driver assistance systems. However, road traffic also includes pedestrians and cyclists, who must or should also be taken into account.

Another disadvantage of the prior art is that pedestrians and automobiles have a completely different level of security in the existing hardware. Pedestrian smartphones are susceptible to viruses and Trojans, which can be downloaded and installed with apps despite all security measures. In contrast, there is a very secure hardware in automobiles. Only apps that have been tested and approved by the manufacturer can be run with the provided hardware or software containers. With regard to the data determined by the hardware, such as position and speed, this means that it also has a completely different level of security. Position information determined by an automobile is therefore significantly more trustworthy than that of a smartphone.

The aforementioned disadvantages show that a system that relies on the positions and speeds determined by devices itself is susceptible to attacks. A malicious attacker could use a trojan on a smartphone to remotely change the GPS coordinates determined in the smartphone. This then transfers the smartphone to the background system to avoid accidents. From the point of view of the background system, the smartphone would now appear to be moving on the street and therefore apparently carried by a pedestrian or a cyclist. The background system reacts, warns the surrounding vehicles and thus solves U. a completely unexpected emergency braking of an autonomously driving or equipped with assistance systems from. This can result in further consequential accidents and consequential damage.

Accordingly, it is an object of the present invention to provide a corresponding method which makes it possible to evaluate the data of individual road users with regard to their validity, i. H. to check specifically the geographic position data provided by road users. Furthermore, it is an object to provide a correspondingly set up system or a system arrangement and a computer program product with control commands which execute the method or operate the proposed system arrangement.

The object is achieved with the features of the independent claims. Further advantageous refinements are specified in the subclaims.

Accordingly, a method for recognizing unreliable geographic data of a road user together with error handling is proposed, comprising the steps of providing a security indicator which indicates how reliable geographic data provided by a mobile terminal is, an iterative comparison of the geographic data provided by the mobile terminal are provided, and further geographic data which are provided by a reference system, the time intervals between iterations of the comparison being set depending on the security indicator provided, and performing a warning function if the geographic data provided by the mobile terminal is different from the other geographic data may differ.

Unreliable geographic data can be data that is falsified or cannot be properly determined due to unfavorable geographic or technical conditions. As a result, unreliable data is data that is generally provided in the correct format, but does not reflect the actual location of the mobile device. The unreliability therefore not only relates to manipulation of the data, but moreover, for example, there may also be a technical defect in the mobile device.

Countless application scenarios are known that motivate an attacker to change position data. By way of example only, reference is made to so-called location-based services, in which the user uses services which depend on his position. A falsification of the position data can, however, in particular traffic situations lead to other road users being misdirected or an autonomous vehicle being misdirected. Unreliable geographic data can also be understood to mean data that cannot be updated regularly, for example because there is no permanent data interface. This refers u. a. to so-called dead spots, i.e. areas in which the wireless data communication network only functions insufficiently or not at all.

According to the present invention, geographical data are to be interpreted broadly so that all types of location information can be taken into account. This also applies to direction data or speed data. Consequently, a sequence of data that indicates a position can also be understood as geographic data. On the basis of the sequence of different positions, a trajectory of a vehicle can be calculated or generally a movement model of a pedestrian or a cyclist. The speed can be determined on the basis of the position shifts of the electronic terminal. If there is talk of the speed of the pedestrian, the cyclist or the vehicle, this refers to the mobile terminal device which is carried along in each case.

A mobile end device can typically be a smartphone or a mobile navigation system. Such a navigation system typically prevails in automobiles, and in this respect the position determination or the determination of the geographic data can also be carried out by an on-board system of a motor vehicle. Consequently, a road user is generally a motorist, a pedestrian or a cyclist, but this is not to be interpreted conclusively and broadly. The position of the road user is determined indirectly via the mobile device that is carried along. The error handling includes the execution of a warning function, which is designed in accordance with the underlying application scenario.

Since different mobile end devices are also to be evaluated differently with regard to the reliability of the data provided, a security indicator is provided according to the invention. This security indicator assesses the trustworthiness of the provided geographical data and can be provided depending on the underlying mobile device. For this purpose, the type or a specification of the mobile device can be read out, or corresponding information can also be stored within the mobile device by the manufacturer. The movement data can also be used to determine how trustworthy the information provided is. For example, if a road user moves faster, he moves more strongly relative to existing base stations or changes the base station more often by means of a handover. This information can also be used to assess the trustworthiness of the geographic data provided.

Typically, a navigation device that is installed in a vehicle is classified as more trustworthy than a mobile terminal. This is not least because the manufacturer of corresponding navigation systems often restricts the applications to be installed. Often no applications can be installed on navigation devices or only navigation data can be updated. It is therefore more difficult for a virus or a trojan to manipulate the data than on a smartphone, which typically allows any application to be installed. These security concerns generally refer not only to viruses and Trojans, but to malware in general.

Then a reference system also measures which geographical data the mobile terminal actually has. Consequently, first geographical data are provided by the mobile terminal itself, which are potentially forged or falsified, and second geographical data are also provided, which are generated by the reference system. A comparison is thus possible and it can be determined whether the information provided actually matches the information available. The data of the mobile device are preferably used for accident prevention, which is why reference data does not have to be obtained permanently. This relates in particular to the frequency of the comparison of the geographic data provided by the mobile terminal and the geographic data of the reference system.

Since the comparison and the provision of geographic data are carried out iteratively by the reference system, the geographic data of the mobile terminal device is checked each time. If the two geographic data provided match, the mobile terminal has actually provided correct information and is therefore trustworthy. As a result, the information provided must be checked at shorter intervals. However, if a deviation of the two pieces of information is recognized, the electronic terminal is not considered to be trustworthy and a corresponding warning function is triggered. Since the geographic data of the mobile terminal was not correct, it is then also necessary to set shorter iterations with regard to the comparison and provision of reference data.

The choice of the time intervals between two iterations can be determined by the manufacturer and adapted based on the degree of deviation. If the geographic data of the mobile terminal agree with the geographic data determined by the reference system, the time interval can be increased.

The degree of trustworthiness of a mobile device can be assessed on a scale from 0 to 100 merely by way of example and not by way of limitation. Also by way of example and not by way of limitation, provision of reference data and comparison of the reference data with the geographic data of the mobile terminal can be carried out every 5 seconds. If a match is identified, the time interval from two iterations can be increased to 10 seconds, for example. However, if it is determined that the data do not match, it can be specified that the iterations take place every 1 second. The person skilled in the art knows further gradations and, moreover, the person skilled in the art recognizes how he can link the scale of trustworthiness with the time intervals of the iterations. In this way, the time interval between two iterations can be linearly adjusted with the underlying trustworthiness.

In addition, it is possible to terminate the procedure if multiple false values have been identified. The underlying mobile terminal is thus eliminated from the proposed method and is possibly blocked from the provision of geographic information. Thus, although it is generally no longer possible to determine the position of the mobile terminal, this also prevents the mobile terminal from triggering a manipulation of the overall traffic situation assessment.

According to one aspect of the present invention, the method is carried out for a plurality of mobile terminals and a traffic situation is assessed on the basis of the geographic data provided. This has the advantage that several road users can collectively collect data relating to the current traffic situation and then an overall picture of the traffic situation can be created. In particular, this is in Autonomous driving advantageous because the current position of a vehicle can be compared with that of a pedestrian. In this example, it can thus be determined whether the pedestrian provides reliable position data, and the autonomously driving vehicle can then take the pedestrian into consideration. Consequently, the proposed method is carried out several times on different end devices and autonomous driving is made possible, even if decisions are essentially made by the underlying navigation system. Here, the proposed method is particularly advantageous because the human control body is less active and the reliable geographic data therefore enable autonomous decision-making.

According to a further aspect of the present invention, the geographic data provided are taken into account in a longitudinal guidance and / or a transverse guidance of a motor vehicle. This has the advantage that the position data or the geographical data are taken into account both when accelerating and when braking according to the longitudinal guidance and when steering to the left and right according to the lateral guidance. As a result, the vehicle can be controlled autonomously and, according to the invention, can access particularly reliable geographic data.

According to a further aspect of the present invention, the geographic data are available as position data, direction data and / or speed data. This has the advantage that any location information of the mobile terminal can be taken into account and thus predictions can be made as to how the corresponding road user is moving. In this way, a trajectory or a speed can be derived on the basis of a sequence of punctual location information. In autonomous driving in particular, this makes it possible to assess other road users with foresight.

According to a further aspect of the present invention, the security indicator is stored in a home location register HLR, a subscription management system and / or a server. This has the advantage that existing components of the underlying mobile radio network can be accessed without having to create new instances. In particular, these components are specially secured so that it is again difficult for an attacker to falsify the stored data. As a result, data integrity is guaranteed and data can also be more easily distributed among the different road users.

According to a further aspect of the present invention, the security indicator is assigned depending on a type of the mobile terminal. This has the advantage that it can be taken into account whether the mobile device is a smartphone or a permanently installed navigation system. There are different types of navigation systems, which have a memory, which, for example, enables further applications to be loaded into this memory and then to be executed. Such navigation systems or smartphones are considered unsafe. If the navigation system is a permanently installed navigation system which is controlled by means of an on-board system of a motor vehicle, applications are typically restricted, and security is thus increased. Such navigation systems are considered safe. The type can be determined by reading manufacturer information or a type designation from a data memory of the mobile terminal. The underlying software can also be read out and then, depending on the operating system, a decision can be made as to how secure or trustworthy the underlying design of the electronic terminal is.

According to a further aspect of the present invention, the reference system creates geographic data using cell towers, base stations, location sensors, GPS sensors, satellite navigation and / or a data interface. This has the advantage that, according to the invention, any systems can be used which create reference data for geographic location information. In particular, it is possible that the individual technologies listed are combined. It can therefore be determined with great certainty whether the geographical data provided by the mobile terminal is valid or reliable or not.

According to a further aspect of the present invention, the time intervals between iterations of the comparison are selected longer for a trustworthy security indicator than for an untrustworthy security indicator. This has the advantage that, for example in the case of a permanently installed navigation system within a motor vehicle, the geographic data does not have to be evaluated as frequently as, for example, in the case of a smartphone. This saves data communication and it is also not necessary for the reference system to always provide geographic data. However, if it is recognized that the respective data differ from one another, the frequency of comparing and providing reference data is increased. When a security indicator is trustworthy or when not, can be based on the design it can be determined how this has already been carried out, or a table can be provided in which the individual terminals are listed, for example, together with the operating systems, and the corresponding security level can then be read out.

According to a further aspect of the present invention, the warning function triggers an optical, acoustic and / or haptic signal. This has the advantage that a driver can be warned if a pedestrian approaches whose position data is unreliable. This in turn relates in particular to autonomous driving, which essentially has to rely on the position data of other road users. As a result, the driver is warned that autonomous driving is based on incorrect position data and thus potentially threatens an accident. A graphic representation can be regarded as an optical signal, which can also be displayed by means of a warning light. An acoustic signal can be reproduced via a conventional loudspeaker and a haptic signal can be generated, for example, by a vibration of the mobile terminal or in the steering wheel of a motor vehicle.

According to a further aspect of the present invention, the warning function triggers an adaptation of the longitudinal guidance and / or transverse guidance of a motor vehicle. This has the advantage that a vehicle that is moving autonomously can be braked or can avoid a road user with unsafe position data. If, for example, a road user whose position data is unreliable is recognized, the underlying system can decide that a road lane would rather avoid or avoid the road user than approach it too closely.

According to a further aspect of the present invention, the warning function terminates the method for the mobile terminal. This has the advantage that an electronic terminal device, which is infected, for example, by malware, can no longer participate in the proposed method and then can no longer provide position data. The provision of geographic data is therefore dispensed with, since these do not offer any added value due to the manipulation.

According to a further aspect of the present invention, the warning function informs other road users. This has the advantage that other road users can also be made aware that another road user is sending manipulated geographical data, and the corresponding behavior can then be adapted. As a result, collaborative evaluation of road users can also take place.

According to a further aspect of the present invention, the security indicator is created as a function of the settings of the mobile terminal. This has the advantage that the security indicator can be set, for example, by reading out the security information of the mobile terminal. For this purpose, a firewall or a protection program can be identified, and it can then be determined that the electronic terminal device is either adequately secured or not. If no corresponding security information is detected, the underlying mobile device is potentially infected with malware.

The object is also achieved by a system arrangement for recognizing unreliable geographical data of a road user together with error handling, comprising a data interface set up to provide a security indicator which indicates how reliable geographic data provided by a mobile terminal is, and a computing unit set up for iterative purposes Comparing the geographic data provided by the mobile terminal and further geographic data provided by a reference system, the time intervals between iterations of the comparison being set depending on the security indicator provided, and a further data interface set up to carry out a warning function, if the geographic data provided by the mobile terminal deviate from the further geographic data.

The object is also achieved by a computer program with control commands which execute the method or operate the proposed system arrangement.

According to the invention, it is particularly advantageous that the method is set up to operate the proposed system arrangement, and the proposed system arrangement is in turn set up to execute the proposed method. The method thus creates process steps which can also be functionally simulated by the structural features of the system arrangement. The functional properties of the structural features of the system arrangement can in turn be implemented as process steps.

• 1: ein Anwendungsbeispiel des vorgeschlagenen Verfahrens und der vorgeschlagenen Systemanordnung gemäß eines Aspekts der vorliegenden Erfindung; und
• 2: ein schematisches Ablaufdiagramm des vorgeschlagenen Verfahrens gemäß eines weiteren Aspekts der vorliegenden Erfindung.

Further advantageous configurations are explained in more detail with reference to the attached figures. Show it:

• 1 : An application example of the proposed method and the proposed system arrangement according to an aspect of the present invention; and
• 2nd : A schematic flow diagram of the proposed method according to a further aspect of the present invention.

In the present 1 different road users are shown on the left, each carrying a mobile device. In the case of a motor vehicle, this is a permanently installed navigation system or, in the case of a pedestrian, a smartphone. A cyclist can use a specially designed navigation system that is designed to be portable. A security indicator is assigned to the individual mobile devices, as shown in the parameters, which are shown below. The geographical information is the location, the direction and the speed. Corresponding indicators are shown in the last three lines and can be treated individually or combined. The security indicator can be assigned, for example, high, low or medium.

A base station is shown in the middle, which is part of a mobile radio system. The base station serves both for data communication and for the creation of geographical reference data. Typically, several base stations are to be provided, which cooperatively determine the position, direction and speed of the road users. The location by means of base stations is known per se.

The created data is loaded into the so-called "Trafic Accident Prevention Server", which also compares the geographic data provided by the road users and the reference system. The security indicators are stored on a server that operates the Home Location Register HLR or a subscription manager. This is shown on the right side in the present case.

In a first step, a security indicator is added to the subscriptions, the hardware environment of which has a particularly high reliability of the determined data. These can be, for example, subscriptions for so-called “connected cars”, that is, automobiles that are connected to the mobile network. As automobiles, in contrast to normal cell phones, these have a significantly higher level of security with regard to malware.

This information is stored in the background system (Subscription Management System, HLR, ...) in order to be queried there. This further increases the security of the system, since it is extremely difficult for an attacker to manipulate data in the background system in order to classify an insecure mobile radio device as secure.

As soon as a mobile device enters a cell, the security indicators of the subscriptions are determined. This is preferably done with data from the HLR / Subscription Management System in order to exclude manipulated data in the mobile device.

Taking the security indicators into account, the base stations of the mobile radio cells now check how the position information determined by the mobile device at least match the position information determined by the base stations. If you look at the attack, there will be significant deviations from time to time, precisely because the mobile device appears to be moving on, but in reality it stops. Even if the base stations cannot determine the exact position, they can almost certainly determine whether a position has changed.

The lower the security that is specified for a subscription, the more often a position cross-check, direction check and / or speed cross-check is carried out by the mobile radio network, that is to say the reference system, since the low security corresponds to a correspondingly higher probability of manipulation.

In the event that the mobile radio network detects a manipulation of the position information, at least two measures are taken, but this is carried out as an example here. The corresponding mobile device or the user to whom the associated subscription belongs is warned. In the simplest case, this can be done with an SMS or other notifications to the mobile device. The manipulation found to be very likely is taken into account when evaluating possible critical situations. This means, for example, a very early warning to an autonomous automobile that there is a person in the vicinity of the next traffic light whose position cannot be determined exactly because manipulation is likely to have occurred. The autonomous automobile can react to this by reducing the speed or changing lanes early to alleviate the situation. After all, even with manipulated position information, it is possible for a person to actually walk carelessly on the street.

The solution enables all types, and therefore security levels, of mobile devices in avoiding traffic accidents to involve. Even if individual mobile devices are manipulated, their data can still be used. Manipulated mobile devices are recognized by the mobile network and can be notified.

2nd shows in a schematic execution diagram a method for recognizing unreliable geographic data of a road user together with error handling, comprising the steps of providing 100 a security indicator, which indicates how reliable geographic data is, which is provided by a mobile terminal 101 be in iterative comparisons 103 the geographic data provided by the mobile terminal 101 and other geographic data provided by a reference system 102 be, with time intervals between iterations of comparing 103 depending on the 100 security indicator provided 104 become, and performing 105 a warning function if the provided by the mobile device 101 geographical data differ from other geographical data.

The person skilled in the art recognizes that individual method steps can be carried out iteratively and / or have further sub-steps.

QUOTES INCLUDE IN THE DESCRIPTION

This list of documents listed by the applicant has been generated automatically and is only included for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102015011748 A1 [0002]
• US 2009005061 A1 [0003]
• KR 2005/00090155 A1 [0004]
• CN 206684953 U [0005]

Claims (15)

Method for recognizing unreliable geographic data of a road user including error handling, comprising the steps: - Providing (100) a security indicator which indicates how reliable geographic data provided (101) by a mobile terminal is; - iterative comparison (103) of the geographic data provided by the mobile terminal (101) and further geographic data provided by a reference system (102), the time intervals between iterations of the comparison (103) depending on the provided ( 100) security indicators are set (104); and - performing (105) a warning function if the (101) geographic data provided by the mobile terminal deviate from the further geographic data. Procedure according to Claim 1 , characterized in that the method is carried out for a plurality of mobile terminals and a traffic situation is assessed on the basis of the (101) geographic data provided. Procedure according to Claim 1 or 2nd , characterized in that the provided (101) geographical data are taken into account in a longitudinal guidance and / or lateral guidance of a motor vehicle. Method according to one of the preceding claims, characterized in that geographic data are present as position data, direction data and / or speed data. Method according to one of the preceding claims, characterized in that the security indicator is stored in a home location register, a subscription management system and / or a server. Method according to one of the preceding claims, characterized in that the security indicator is assigned depending on a design of the mobile terminal. Method according to one of the preceding claims, characterized in that the reference system creates geographic data using cell towers, base stations, location sensors, GPS sensors, satellite navigation and / or a data interface. Method according to one of the preceding claims, characterized in that the time intervals between iterations of the comparison (103) are chosen to be longer in the case of a trustworthy security indicator than in the case of an untrustworthy security indicator. Method according to one of the preceding claims, characterized in that the warning function triggers an optical, acoustic and / or haptic signal. Method according to one of the preceding claims, characterized in that the warning function triggers an adaptation of the longitudinal guidance and / or transverse guidance of a motor vehicle. Method according to one of the preceding claims, characterized in that the warning function terminates the method for the mobile terminal. Method according to one of the preceding claims, characterized in that the warning function informs other road users. Method according to one of the preceding claims, characterized in that the security indicator is created as a function of settings of the mobile terminal. System arrangement for the detection of unreliable geographic data of a road user including error handling, comprising: - A data interface is set up to provide (100) a security indicator that indicates how reliable geographic data are that are provided (101) by a mobile terminal; - A computing unit set up for iteratively comparing (103) the geographic data provided by the mobile terminal (101) and further geographic data provided by a reference system (102), with time intervals between iterations of the comparison (103) in Dependency of the provided (100) security indicator is set (104); and - A further data interface is set up to carry out (105) a warning function if the (101) geographic data provided by the mobile terminal deviate from the further geographic data. Computer program product with control commands which implement the method according to one of the Claims 1 to 13 execute when executed on a computer.

Images