DE102021119891A1 - Method for authentication of a transmitter unit by a receiver unit - Google Patents

Abstract

The invention relates to a method for authenticating a transmitter unit (12) by a receiver unit (14) in a system (10) for position determination, navigation and time determination. A first navigation message Mn sent by the transmitter unit (12) is received by the receiver unit (14). In addition, nsRanging sequences, which are sent by the sending unit (12) between the first navigation message Mn and a second navigation message Mn+1, are received by the receiving unit (14). The second navigation message Mn+1 sent by the transmitter unit (12) is received by the receiver unit (14). The second navigation message Mn+1 contains a bit sequence Wn, either directly or in the form of a coded representation. The authenticity of the second navigation message Mn+1 is checked by checking a digital signature or by a hash value-based method. If the authentication of the second navigation message Mn+1 was unsuccessful, a lack of authenticity of the second navigation message Mn+1 is determined. If the authentication of the second navigation message Mn+1 was successful, the transmitted bit sequence Wn is determined from the second navigation message Mn+1 and the received bit sequence Ŵn is compared with the transmitted bit sequence Wn. If the received bit sequence Ŵn is identical to the transmitted bit sequence Wn or at least has a predetermined minimum degree of similarity to the transmitted bit sequence Wn, the authenticity of the received ranging sequences is confirmed.

Description

The present invention relates to a method for authenticating a transmitter unit by a receiver unit, in a system for positioning, navigation and position determination (also referred to as positioning, navigation and timing service or PNT service) and a corresponding receiver unit, a transmitter unit and a system several transmitter units and at least one receiver unit.

In particular, the present invention can be applied to an authentication scheme for protecting an open service in a positioning, navigation and timing system provided over a cellular network.

• • Ranging-Sequenzen (im Englischen als ranging sequences bezeichnet): Dies sind im Voraus bekannte Sequenzen, die für das Pseudo-Ranging (zur Abschätzung der Entfernung zwischen Sender und Empfänger) verwendet werden.
• • Navigationsnachrichten: Diese Nachrichten enthalten Metadaten, die für den Pseudo-Ranging-Prozess notwendig sind. Dazu gehören u. a.:
  • ◯ die Position des Senders
  • ◯ Informationen über die lokale Uhr des Senders
  • ◯ Information darüber, welche Ranging-Sequenz von einem Sender verwendet wird
  • ◯ Informationen über die Ressourcenblöcke (z. B. Frequenz- und Zeitschlitz), in denen die Sequenz übertragen wird.

Usually, PNT systems are based on the transmission of two different message types:

• • Ranging sequences: These are sequences known in advance that are used for pseudo-ranging (to estimate the distance between transmitter and receiver).
• • Navigation Messages: These messages contain metadata necessary for the pseudo-ranging process. These include:
  • ◯ the position of the transmitter
  • ◯ Information about the local clock of the sender
  • ◯ Information about which ranging sequence is used by a transmitter
  • ◯ Information about the resource blocks (e.g. frequency and time slot) in which the sequence is transmitted.

In the context of the present invention, a cellular system with a plurality of base stations, which act as transmitters, is considered in particular. The base stations may be part of a communications network that provides data connectivity to users (e.g. a terrestrial cellular network such as 3GPP LTE, 5G or the VHF Data Exchange System (VDES) for maritime communications, or a cellular satellite network).

• • Zeitmultiplex-Vielfachzugriff (auch als time-division multiple access oder TDMA bezeichnet). Es wird ein einziger Frequenzträger verwendet, und die verschiedenen Übertragungen sind in Zeitschlitzen organisiert, welche die Ranging-Sequenzen und die Navigationsnachrichten enthalten. Dies ist bspw. der Fall im System R-Mode
• • Frequenzmultiplex-Vielfachzugriff (auch als frequency-division multiple access oder FDMA bezeichnet). Es werden mehrere Frequenzträger verwendet
• • Mehrfrequenz-TDMA (MF-TDMA). Der Zugriff wird über mehrere Träger organisiert, die jeweils mehrere Zeitschlitze enthalten
• • Orthogonaler Frequenz-Mehrfachzugriff (auch als orthogonal frequency multiple access oder OFDM bezeichnet)
• • CDMA: Code Division Multiple Access
• • SDMA: Spatial Division Multiple Access: Es werden verschiedene räumliche Datenströme verwendet.

The ranging sequences and the navigation messages are transmitted in the downlink of the cellular network, ie the base stations act as transmitter units and the user terminals as receiver units. The downlink can use different multiple access techniques:

• • Time Division Multiple Access (also known as time-division multiple access or TDMA). A single frequency carrier is used and the various transmissions are organized into time slots containing the ranging sequences and the navigation messages. This is the case, for example, in the R-Mode system
• • Frequency Division Multiple Access (also known as frequency-division multiple access or FDMA). Multiple frequency carriers are used
• • Multi-frequency TDMA (MF-TDMA). Access is organized over multiple carriers, each containing multiple time slots
• • Orthogonal frequency multiple access (also known as orthogonal frequency multiple access or OFDM)
• • CDMA: Code Division Multiple Access
• • SDMA: Spatial Division Multiple Access: Different spatial data streams are used.

It should be noted that the navigation messages and the ranging sequences do not have to fit into one resource block, but can occupy several resource blocks (several time slots in one or different frequencies or CDMA carriers).

In the context of the present invention, the communication range of a transmitter unit is defined as the range in which data communication between a receiver unit and a transmitter unit is possible (ie messages can be decoded with a high probability). Within the communication range, the navigation messages sent by the base station can therefore be successfully decoded with a high degree of probability. Furthermore, the concept of ranging coverage of a base station is also defined herein as the area where the ranging sequences transmitted by the base station are useful for PNT services (they result in more or less accurate pseudo-ranging). It should be noted here that ranging coverage is greater than communications coverage, and communications coverage is included in ranging coverage (see 1 ). This is because the navigation message contains information, ie it is to some extent unpredictable while the ranging sequence is known. It should also be noted that the figure in the 1 shows a terrestrial transmitter, but the same concept applies to one non-terrestrial transmitter (satellite, airplane, balloon or similar) would apply.

In the 2 shows the multicasters used for the PNT service, building a cellular network. As you can see, the coverage areas of the different transmitters overlap in some areas. In this particular image, up to two transmission units overlap in some areas. In principle, there could also be areas in which several stations overlap.

• • Empfangen der Ranging-Sequenz von mindestens n Sendeeinheiten (typischerweise gilt n ≥ 3),
• • Zugang zu zeitlich begrenzten, gültigen Navigationsdaten über diese n Sendeeinheiten haben.

In order to be able to perform a position determination, the receiver units must meet the following:

• • Receiving the ranging sequence from at least n transmission units (typically n ≥ 3 applies),
• • Have access to time-limited, valid navigation data via these n transmission units.

In order to receive a transmitter unit's ranging sequence, a receiver unit must be within its range, which, as already mentioned, is greater than its communication radius.

1. a) jede Sendeeinheit sendet Navigationsdaten über sich selbst, aber nicht über benachbarte Sendeeinheiten,
2. b) jede Sendeeinheit sendet Navigationsdaten über sich selbst und auch über seine Nachbarsender,
3. c) die Empfängereinheiten können auf einen Server zugreifen, um die Navigationsdaten zu erhalten. Die Kommunikation mit dem Server kann entweder über dasselbe Mobilfunksystem, das den PNT-Dienst bereitstellt, oder über ein anderes Kommunikationsnetz (z. B. über eine 802.11-, 3GPP LTE- und 5G-Verbindung oder eine nicht-terrestrische Verbindung) hergestellt werden.

There are various ways of gaining access to the navigation data of the n transmitter units:

1. a) each transmitting unit transmits navigation data about itself but not about neighboring transmitting units,
2. b) each transmitter unit transmits navigation data about itself and also about its neighboring transmitters,
3. c) the receiver units can access a server to obtain the navigation data. Communication with the server can be established either over the same cellular system that provides the PNT service or over another communication network (e.g. over an 802.11, 3GPP LTE and 5G connection or a non-terrestrial connection).

Options a) and b) constitute broadcasting services as it is the sending entity that broadcasts the data to all receivers within its communication coverage. Option c) represents a pull service, as it is the end devices that retrieve this data from a server.

Option a) is used in Global Navigation Satellite Systems (GNSS). This option works when the communication coverage of the different transmitters overlaps so that in most locations at least 3 transmitters can communicate most of the time.

Option b) was proposed for the ranging mode (also referred to as R-mode) service in VDES. This option is preferred when the communication coverage of transmitter units does not overlap much (or not at all). In this case, most of the points within the service area of the navigation system are within the communication range of only one transmitter unit. This is e.g. B. in the 2 the case. Like in the 2 shown, a receiver unit must be within communication range of at least one transmitter unit to use the service. In addition, it must be within range of several transmitters in order to position itself.

Option c) could be suitable for a cellular network providing (broadband) wireless Internet access.

• • Die Empfängereinheit kann alle möglichen Ressourcen (z. B. Zeit- und Frequenzschlitze) durchsuchen und versuchen, eine Ranging-Sequenz zu erkennen.
• • Es wird bekanntgegeben, in welcher Ressource die Ranging-Sequenzen übertragen werden sollen. Diese Information könnte in der von einer Sendeeinheit gesendeten Navigationsnachricht übermittelt werden und könnte Informationen über die Ressourcen enthalten, die von anderen Sendeeinheiten zur Übertragung ihrer Ranging-Sequenzen verwendet werden.

It should be noted that the receiver needs to know which is the expected time/frequency slot of the ranging sequences from the different transmitter units. Various options are available here:

• • The receiver unit can search all possible resources (e.g. time and frequency slots) and try to recognize a ranging sequence.
• • It is announced in which resource the ranging sequences are to be transmitted. This information could be conveyed in the navigation message sent by a transmitter and could include information about the resources used by other transmitters to transmit their ranging sequences.

Possible attacks

• • Jamming-Angriffe bestehen aus der Übertragung von unerwünschten Signalen (Interferenzen) in einem bestimmten Teil des Funkfrequenzspektrums. Somit führt ein Jamming-Angriff zu einer Verringerung des Signals des SNIR (signal-to-interference-plus-noise ratio) und damit zu einer Verringerung der Dienstqualität. Im Falle eines PNT-Systems führt die SNIR-Minderung zu einem vergrößerten Positionierungsfehler.
• • Spoofing-Angriffe, bei denen ein Angreifer gefälschte Signale erzeugt, die von der Empfängereinheit als gültig interpretiert werden, aber gefälschte Informationen enthalten. Dies führt zu Fehlfunktionen des Systems und der Empfängereinheit, und zwar aufgrund deutlich abweichender Positionsschätzungen oder dadurch, dass die Empfängereinheit glaubt, sie befinde sich an einem anderen Ort.
• • Meaconing-Angriffe sind zwischen Jamming- und Spoofing-Angriffen anzuordnen. Sie bestehen darin, die Übertragung der Navigationssignale abzufangen, zu speichern und zu einem späteren Zeitpunkt wiederzugeben. Meaconing liegt zwischen Jamming und Spoofing, da es nicht wie beim Jamming das Senden von zufallsbedingten Störungen impliziert, aber auch nicht wie beim Spoofing die Nachahmung der potenziell komplexen Logik des Senders erfordert, um einen Angriff durchzuführen.

PNT systems can be exposed to various attacks:

• • Jamming attacks consist of the transmission of unwanted signals (interference) in a specific part of the radio frequency spectrum. Thus, a jamming attack leads to a reduction in the signal's SNIR (signal-to-interference-plus-noise ratio) and thus to a reduction in the quality of service. In the case of a PNT system, SNIR degradation leads to increased positioning error.
• • Spoofing attacks, in which an attacker generates fake signals that are interpreted by the receiving device as valid but contain fake information. This leads to system and receiver unit malfunctions due to significantly different position estimates or the receiver unit believing it is in a different location.
• • Meaconing attacks are to be classified between jamming and spoofing attacks. They consist in intercepting the transmission of the navigation signals, storing them and playing them back at a later time. Meaconing falls somewhere between jamming and spoofing in that it does not involve sending random interference like jamming, but neither does it require mimicking the sender's potentially complex logic to carry out an attack like spoofing does.

State-of-the-art security countermeasures

• Nicht-kryptografische Gegenmaßnahmen
  • • Eine erste Klasse von nicht-kryptografischen Gegenmaßnahmen stellen die Signal- und Zustandsanalysetechniken dar, die in [3] ausführlich beschrieben sind. Diese Techniken bestehen aus der Modellierung, wie sich ein Satz von Parametern mit der Zeit ändert. Diese Parameter werden dann im empfangenen Signal überwacht und mit den Vorhersagen des Modells verglichen. Wenn die Vorhersage mit dem Modell übereinstimmt, werden die Navigationssignale als authentisch angesehen, andernfalls, wenn die gemessenen Parameter erheblich von den durch das Modell vorhergesagten abweichen, geht die Empfängereinheit davon aus, dass sie Opfer eines Angriffs ist. Parameter, die verfolgt werden können, sind die Positionen der Empfängereinheit und der Sendereinheit sowie deren Taktverschiebungen und die Verzögerung, Frequenz und Phase der empfangenen Signale.
  • • Antennen-Array-Techniken. Wenn der Empfänger mit einem Antennen-Array ausgestattet ist, kann er die Ankunftsrichtung eines empfangenen Signals leicht abschätzen, was den Empfänger in die Lage versetzen könnte, einen Störsender oder Spoofer nicht nur zu erkennen, sondern auch zu lokalisieren und Gegenmaßnahmen durch Strahlauslöschung (auch als beam-nulling bezeichnet) anzuwenden.
  • • Das Vorhandensein eines Inertialsystems hilft, die Robustheit zu erhöhen. Das Inertialsystem kann Messungen liefern, die völlig unabhängig von denen sind, die durch die Navigationssignale gewonnen werden. Obwohl die Messungen des Inertialsystems im Allgemeinen viel ungenauer sind als die durch den Navigationsdienst erhaltenen, können sie eine vertrauenswürdige externe Referenz zum Vergleich liefern.
• Symmetrische Verschlüsselungsverfahren
  • • Die symmetrische Verschlüsselung beruht auf einem gemeinsamen Geheimnis zwischen Sender und Empfänger (einem sogenannten geheimen Schlüssel), um die Vertraulichkeit der übertragenen Informationen zu schützen. Symmetrische Verschlüsselung wird zum Schutz aller militärischen Global Navigation Satellite Systems (GNSS) Signale sowie des Galileo Public Regulated Service (PRS) verwendet, der nur für autorisierte staatliche Nutzer bestimmt ist. Normalerweise basieren GNSS auf Direct-Sequence Spread-Spectrum (DSSS)-Techniken, und die Rolle der symmetrischen Verschlüsselung ist die Erzeugung eines verschlüsselten Spreizcodes, der dann zur Verbreitung des Navigationssignals verwendet wird (siehe [4] für weitere Details).
  • • Bei Wasserzeichen-Verfahren (im Englischen auch als watermarking techniques bezeichnet) werden einige Informationen (ein sogenanntes Wasserzeichen) in einem Trägersignal versteckt. Im vorliegenden Fall sind die Trägersignale die Navigationssignale, und das Wasserzeichen enthält einige authentifizierungsbezogene Informationen, mit denen ein Empfänger feststellen kann, ob das Signal von einer vertrauenswürdigen Quelle stammt oder nicht. Im Zusammenhang mit GNSS wurden Wasserzeichen-Verfahren vorgeschlagen, um die Navigationssignale zu schützen (siehe [1]). Systeme wie Galileo und GPS verwenden (Direktsequenz-) Spreizspektrumverfahren (im Englischen aus als spread spectrum techniques bezeichnet) mit großen Spreizfaktoren, so dass das Navigationssignal am Empfänger etwa 20 dB unter dem thermischen Rauschpegel liegt. Wasserzeichen-Verfahren beruhen auf der Annahme, dass ein potenzieller Angreifer ein sehr niedriges SNR erfährt. Im Folgenden wird das Funktionsprinzip eines Wasserzeichensystems näher erläutert, wie es von Kuhn (siehe [1]) vorgeschlagen wurde. Zunächst sei die Senderseite zu betrachten. Dabei soll ein System mit mehreren Sendeeinheiten betrachtet werden. Die i-te Sendeeinheit wählt ihr pseudozufälliges Wasserzeichen s_i, i = {1,2,3,4} unabhängig von den anderen Sendeeinheiten. Alle Wasserzeichen haben die gleiche Zeitdauer δ. Zur Zeitinstanz t₀ senden alle Sendeeinheiten ihre Wasserzeichen und werden zur Zeitinstanz t_i, i = {1,2,3,4}. Von einer Empfängereinheit aus gesehen überschneiden sich also die Wasserzeichen aller Sendeeinheiten zumindest teilweise. Zum Zeitpunkt $$t_{}$$$${}_0+\varrho$$
    
    sendet jede der Sendeeinheiten eine digital signierte Nachricht M_i die ihre Wasserzeichensequenz s_i offenbart. Die Empfängereinheit arbeitet dabei wie folgt: Die Empfängereinheit erfährt ein niedriges SNR, so dass es nicht möglich ist, die Wasserzeichen s_i zuverlässig zu dekodieren bzw. zu schätzen. Stattdessen digitalisiert (d.h. tastet ab und speichert) der Empfänger das Fenster der Abtastungen, in dem die Wasserzeichen empfangen werden. Nach $$\varrho$$
    
    Zeiteinheiten erhält die Empfängereinheit die digital signierten Nachrichten M_i, die die Sequenzen mit den Wasserzeichen s_i enthalten. Die Empfängereinheit verifiziert zunächst die digitale Signatur. Wenn die digitale Signatur korrekt ist, versucht die Empfängereinheit anschließend, die Wasserzeichen-Sequenzen in dem aufgezeichneten Fenster von Abtastwerten mittels einer Korrelation zu erkennen. Wenn die Sequenz s_i genau $$\varrho$$
    
    Zeiteinheiten bevor Nachricht M_i empfangen wurde gefunden wurde, kann die Empfängereinheit sicher davon ausgehen, dass der Signalgeber i vertrauenswürdig ist. Stimmt dagegen entweder die digitale Signatur nicht überein oder weicht die Verzögerung von $$\varrho$$
    
    ab, kann die Empfängereinheit dem Signal der i-ten Sendeeinheit nicht vertrauen.
• Authentifizierung der Navigationsnachricht (auch als Navigation Message Authentication oder NMA bezeichnet)
• Dieses Verfahren zielt darauf ab, die Authentizität der Navigationsnachricht zu schützen, indem es eine digitale Signatur anwendet oder ein Hash-Chain-basiertes Protokoll, wie beispielsweise Timed Efficient Stream Loss-Tolerant Authentication (TESLA) verwendet. Dieses Verfahren fügt jeder Navigationsnachricht ein zusätzliches Tag hinzu (entweder eine digitale Signatur oder einen Message Authentication Code). Dieses Tag ermöglicht es den Empfängern, die Authentizität der Navigationsnachricht zu überprüfen, ist aber für einen Angreifer schwerer zu fälschen (siehe [2] für Details).
  • • Digitale Signaturen sind Public-Key-Kryptosysteme, die zur Überprüfung der Authentizität von digitalen Nachrichten oder Dokumenten verwendet werden. Angenommen, Alice möchte eine Nachricht m an Bob senden und Bob möchte sicher sein, dass die Nachricht tatsächlich von Alice stammt. Die Funktionsweise von digitalen Signaturen ist wie folgt. Alice erstellt eine digitale Signatur s unter Verwendung einer Verschlüsselungsfunktion s = enc(m, k_s) die eine Funktion der Nachricht m und einem geheimen Schlüssel k_s ist, welcher nur ihr selbst bekannt ist. Es wird angenommen, dass das Berechnen von s ohne Kenntnis des geheimen Schlüssels k_s rechnerisch besonders schwierig ist. Bob und alle anderen haben Zugriff auf die Nachricht m und einen öffentlichen Schlüssel k_p. Es muss eine Entschlüsselungsfunktion existieren dec), mit der es möglich ist, die Nachricht m aus s und k_p zu erzeugen. Das heißt, Bob kann verifizieren, dass die Nachricht von Alice stammt, indem er prüft, ob m = dec(s, k_p) ist. Zur Implementierung digitaler Signaturen können verschiedene kryptografische Primitive verwendet werden, was zu unterschiedlichen Größen für die digitale Signatur führt. Ein guter Kandidat hierfür ist ECDSA, das bei einer Sicherheitsstufe von 128 Bit zu Signaturen der Größe 512 Bit führt. Digitale Signaturen bieten an sich keinen Schutz gegen Replay-Attacken. Das heißt, ein Angreifer kann eine Nachricht mit einer gültigen Signatur zum Zeitpunkt t aufzeichnen und sie zum Zeitpunkt t + Δ wiedergeben, und die wiedergegebene Nachricht besteht die Signaturprüfung (sie wird als authentisch angesehen). Das Standardverfahren zum Schutz einer digital signierten Nachricht vor einem Replay-Angriff ist das Hinzufügen eines Zeitstempels, mit dem der Empfänger erkennen kann, ob eine Nachricht aufgezeichnet und wiedergegeben wurde. Digitale Signaturen zusammen mit Zeitstempeln können verwendet werden, um die Authentizität von Navigationsnachrichten zu sichern, sie können jedoch nicht verwendet werden, um die Ranging-Sequenzen zu schützen, da diese keine Daten tragen (sie sind deterministische Sequenzen). In der Praxis wird eine vertrauenswürdige dritte Partei, bekannt als Public Key Infrastructure (PKI), verwendet, um die öffentlichen Schlüssel herunterzuladen (und sie an ihre Besitzer zu binden), wie in der 4 gezeigt.
  • • Das Timed Efficient Stream Loss-Resilient Authentication (TESLA)-Protokoll ist ein effizientes, rechenarmes Broadcast-Authentifizierungsprotokoll, das sich auf viele Empfänger erstreckt und den Verlust von Paketen toleriert (siehe [6]). Da das Einschleusen von bösartigen Paketen in vielen Broadcast-Netzwerken ein Risiko darstellen kann, wollen die Empfänger sicherstellen, dass ihre empfangenen Pakete von einer vertrauenswürdigen Quelle stammen. Bei der Punkt-zu-Punkt-Kommunikation wird die Authentizität (und Integrität) einer Nachricht in der Regel durch einen sogenannten Message Authentication Code (MAC) geschützt, der ein (schwer zu fälschendes) Kennzeichen ist, das an die ausgetauschten Nachrichten angehängt wird. MACs werden mit einem geheimen Schlüssel generiert, der von den beiden Kommunikationsendpunkten gemeinsam genutzt wird. Die Verwendung von MACs in der Broadcast-Kommunikation bietet keine sichere Quellenauthentifizierung, da sie voraussetzt, dass alle Empfänger Zugriff auf den geheimen Schlüssel haben, und der Zugriff auf den geheimen Schlüssel macht es möglich, gültige MACs zu erzeugen. Somit kann jeder, der im Besitz des geheimen Schlüssels ist, den MAC einer Nachricht fälschen. Offensichtlich bietet die Anwendung einer digitalen Signatur auf jedes Datenpaket eine sichere Broadcast-Authentifizierung, aber sie ist mit einem hohen Overhead verbunden, sowohl in Bezug auf die Bandbreite als auch auf die Signier- und Verifizierungszeit. Die Kernidee von TESLA ist, dass der Sender jedem Paket einen MAC anhängt, der mit einem (geheimen) Schlüssel berechnet wird, den nur er selbst kennt. Die Empfänger wiederum puffern die empfangenen Nachrichten, ohne sie authentifizieren zu können. Kurze Zeit später legt der Sender den (geheimen) Schlüssel offen und die Empfänger können das Paket authentifizieren. Auf diese Weise genügt ein einziger MAC, der an jede Nachricht angehängt wird, um eine Broadcast-Authentifizierung durchzuführen, was im Vergleich zur Verwendung digitaler Signaturen zu einem geringeren Overhead und weniger Rechenzeit führt. Eine Anforderung des TESLA-Protokolls ist eine lose Zeitsynchronisation des Empfängers mit der Uhr des Senders. Insbesondere muss der Empfänger eine Obergrenze für die lokale Zeit des Senders kennen. Außerdem erfordert TESLA, dass der Empfänger eine Anzahl von Paketen puffert, was zu einer Verzögerung bei der Authentifizierung führt, die üblicherweise in der Größenordnung einer Round-Trip-Verzögerung zwischen Sendeeinheit und Empfängereinheit liegt. Die Authentifizierung im TESLA-Protokoll basiert auf einer Einweg-Schlüsselkette. Eine Einweg-Schlüsselkette wird durch Verwendung einer Einwegfunktion F(·) erstellt, so dass ein Schlüssel K_iaus einem anderen Schlüssel K_i+1 als K_i = F(K_i+1) errechnet wird. Jeder Schlüssel K_i ist mit einem Zeitintervall einheitlicher Dauer verbunden, welche als i bezeichnet wird. Außerdem wird mit einer weiteren Einwegfunktion F'(·) ein Schlüssel $K_i^{\text{'}}$
    
    abgeleitet aus K_i als $K_i^{\text{'}}=F\text{'}\left(K_i\right).$
    
    Wenn eine Nachricht M_j während des i-ten Zeitrahmens gesendet wird, verwendet der Absender den Schlüssel $K_i^{\text{'}}$
    
    um einen MAC $MAC\left(K_i^{\text{'}},M_j\right)$
    
    des Pakets P_j zu berechnen. Zusätzlich enthält das Paket P_j den Schlüssel K_i-d von d Zeitintervallen in der Vergangenheit. Der Parameter d wird als Paketoffenbarungsverzögerung (bzw. packet disclosure delay) bezeichnet und wird zusammen mit der Dauer der Zeitintervalle und der maximalen Länge der Einweg-Schlüsselkette vorher festgelegt. Das Paket ist dann gegeben als $$P_j=\left\{M_j\left|MAC\left(K_i^{\text{'}},M_j\right)\right|K_{i-d}\right\}$$
    
    TESLA-Empfängereinheiten arbeiten wie folgt:
    • Wenn ein Empfänger ein Paket P_j empfängt, kann der Schlüssel K_i-d verwendet werden, um i zu bestimmen. Unter der Annahme einer losen synchronisierten Uhr mit dem Sender kann der Empfänger das spätestmögliche Zeitintervall l prüfen, in dem sich der Absender gerade befinden könnte. Wenn l < i + d ist, dann wird das Paket als sicher angesehen.
    • Der Empfänger muss alle Pakete zurückweisen, die nicht sicher sind, d. h. die bereits offengelegte und öffentlich bekannte Schlüssel enthalten. Pakete mit l < i + d enthalten Schlüssel, die zu diesem Zeitpunkt nur dem Absender bekannt sein können.
    • Beim Empfang eines Pakets P_j, das im Zeitintervall i gesendet wurde, kann der Empfänger die Authentizität noch nicht überprüfen und muss die gesammelten Informationen in einen Puffer aufnehmen, bis er den Schlüssel K_i erfährt, welcher erst nach d Zeitintervallen offenbart wird.
    • Die Verwendung von TESLA zum Schutz der Navigationsmeldungen in einer PNT-Nachricht wurde erstmals in [7] vorgeschlagen. Kürzlich wurde vorgeschlagen, TESLA zum Schutz der Navigationsnachrichten von Galileo zu verwenden (siehe [2]). Insbesondere bilden gemäß diesem Vorschlag alle Galileo-Satelliten eine einzige TESLA-Kette, die es ermöglicht, dass sich Navigationsnachrichten von verschiedenen Satelliten gegenseitig authentifizieren können. Der Hauptvorteil dieses Ansatzes ist eine Reduzierung der Authentifizierungsfehlerrate (oder eine Verringerung der Zeit zwischen den Authentifizierungen). Zur Vereinfachung soll der Fall betrachtet werden, in dem die Empfängereinheit vier Satelliten sieht. Wenn jede Sendeeinheit seine eigene unabhängige TESLA-Kette verwendet, muss der Empfänger die vier MACs und die vier entsprechenden Schlüssel fehlerfrei empfangen, um den Dienst erfolgreich zu authentifizieren. Wird jedoch eine einzige Kette verwendet, reicht es aus, die vier MACs und einen Schlüssel fehlerfrei zu empfangen. Diese Eigenschaft ist besonders nützlich, wenn die vier Satelliten nicht mit der gleichen Verbindungsqualität empfangen werden, wie es in einer städtischen Umgebung der Fall sein könnte, wo ein Satellit mit hoher Elevation gesehen wird, während die verbleibenden drei Satelliten mit einer etwas geringeren Elevation (und damit mit einer höheren Bitfehlerrate) empfangen werden. Der Nachteil dieses Schemas ist, dass die TESLA-Hash-Kette um einen Faktor S länger wird, der der (maximalen) Anzahl der Sender entspricht. Dies impliziert auch eine Erhöhung der Komplexität.
    • In [8] wird ein Schema zur Authentifizierung der Navigationsnachrichten von BeiDou auf Basis von TESLA vorgeschlagen. Das Schema basiert auf einer einzigen TESLA-Kette, die von einem Kontrollzentrum aufgebaut wird. Das Kontrollzentrum ist für die Erzeugung der Navigationsnachrichten und der entsprechenden MACs zuständig. Insbesondere tragen zu einem bestimmten Zeitpunkt diejenigen Satelliten, die vom Kontrollzentrum überwacht werden, Navigationsnachrichten mit ihren entsprechenden MACs, und tragen auch einen TESLA. Satelliten, die gerade nicht von einer Leitstelle überwacht werden, tragen jedoch keine Navigationsnachricht (und auch keinen MAC- oder TESLA-Schlüssel). Daher werden in [8] die GNSS-Satelliten in gewisser Weise als Kommunikationskanal genutzt, um (mit TESLA geschützte) Navigationsnachrichten zu übermitteln, die von einem Kontrollzentrum stammen.

Various countermeasures are known from the prior art to protect PNT systems against so-called spoofing and meaconing attacks. They can be divided into three different techniques:

• Non-cryptographic Countermeasures
  • • A first class of non-cryptographic countermeasures are the signal and status analysis techniques, which are described in detail in [3]. These techniques consist of modeling how a set of parameters changes over time. These parameters are then monitored in the received signal and compared to the model's predictions. If the prediction agrees with the model, the navigation signals are considered authentic, otherwise, if the measured parameters deviate significantly from those predicted by the model, the receiver unit assumes that it is the victim of an attack. Parameters that can be tracked are the positions of the receiver unit and the transmitter unit and their clock skews and the delay, frequency and phase of the received signals.
  • • Antenna array techniques. If the receiver is equipped with an antenna array, it can easily estimate the direction of arrival of a received signal, which could enable the receiver to not only detect but also locate a jammer or spoofer and take countermeasures by beam cancellation (aka referred to as beam-nulling).
  • • The presence of an inertial system helps to increase robustness. The inertial system can provide measurements that are completely independent of those obtained from the navigation signals. Although the inertial system measurements are generally much less accurate than those obtained by the navigation service, they can provide a trusted external reference for comparison.
• Symmetric encryption methods
  • • The symmetric encryption is based on a shared secret between sender and recipient (a so-called secret key) to protect the confidentiality of the transmitted information. Symmetric encryption is used to protect all military Global Navigation Satellite Systems (GNSS) signals as well as the Galileo Public Regulated Service (PRS), which is intended for authorized government users only. Usually, GNSS are based on Direct-Sequence Spread-Spectrum (DSSS) techniques, and the role of symmetric encryption is to generate an encrypted spreading code, which is then used to propagate the navigation signal (see [4] for more details).
  • • Watermarking techniques hide some information (called a watermark) in a carrier signal. In this case, the carrier signals are the navigation signals, and the watermark contains some authentication-related information that a recipient can use to determine whether the signal is from a trusted source or not. In connection with GNSS, watermarking methods have been proposed to protect the navigation signals (see [1]). Systems such as Galileo and GPS use (direct sequence) spread spectrum techniques with large spreading factors such that the navigation signal at the receiver is about 20 dB below the thermal noise floor. Watermark methods are based on the assumption that a potential attacker experiences a very low SNR. The functional principle of a watermark system as suggested by Kuhn (see [1]) is explained in more detail below. The first thing to look at is the transmitter side. A system with several transmission units is to be considered. The i-th transmission unit you choose the pseudo-random watermark s _i , i={1,2,3,4} independently of the other transmission units. All watermarks have the same duration δ. At time instance t ₀ all transmission units send their watermarks and at time instance t _i , i={1,2,3,4}. Viewed from a receiver unit, the watermarks of all transmitter units therefore overlap at least partially. At the time $$t_{}$$$${}_0+\varrho$$
    
    each of the transmitting units sends a digitally signed message M _i which reveals its watermark sequence s _i . The receiver unit works as follows: The receiver unit experiences a low SNR, so that it is not possible to reliably _decode or estimate the watermark si. Instead, the receiver digitizes (ie, samples and stores) the window of samples in which the watermarks are received. After $$\varrho$$
    
    units of time, the receiver unit receives the digitally signed messages M _i , which contain the sequences with the watermarks s _i . The receiver unit first verifies the digital signature. If the digital signature is correct, the receiver unit then tries to recognize the watermark sequences in the recorded window of samples by means of a correlation. If the sequence _si exactly $$\varrho$$
    
    Time units before message M _i was received was found, the receiver unit can safely assume that the signal transmitter i is trustworthy. If, on the other hand, either the digital signature does not match or the delay differs from $$\varrho$$
    
    decreases, the receiver unit cannot trust the signal of the i-th transmitter unit.
• Navigation Message Authentication (also known as Navigation Message Authentication or NMA)
• This method aims to protect the authenticity of the navigation message by applying a digital signature or using a hash chain-based protocol such as Timed Efficient Stream Loss-Tolerant Authentication (TESLA). This technique adds an additional tag (either a digital signature or a message authentication code) to each navigation message. This tag allows recipients to verify the authenticity of the navigation message, but is more difficult for an attacker to forge (see [2] for details).
  • • Digital signatures are public-key cryptosystems used to verify the authenticity of digital messages or documents. Suppose Alice wants to send a message m to Bob, and Bob wants to be sure that the message actually came from Alice. How digital signatures work is as follows. Alice creates a digital signature _s using an encryption function _s = enc(m,ks) which is a function of the message m and a secret key ks known only to herself. It is believed that computing s without knowledge of the secret key k _s is particularly computationally difficult. Bob and everyone else have access to the message m and a public key k _p . There must be a decryption function dec) with which it is possible to generate the message m from s and k _p . That is, Bob can verify that the message came from Alice by checking whether m = dec(s, k _p ). Different cryptographic primitives can be used to implement digital signatures, resulting in different sizes for the digital signature. A good candidate for this is ECDSA, which results in 512-bit signatures with a security level of 128 bits. Digital signatures do not in themselves provide protection against replay attacks. That is, an attacker can record a message with a valid signature at time t and replay it at time t + Δ, and the replayed message will pass signature verification (it will be considered authentic). The standard way to protect a digitally signed message from a replay attack is to add a timestamp that allows the recipient to tell if a message was recorded and played back. Digital signatures along with timestamps can be used to ensure the authenticity of navigation messages, but they cannot be used to protect the ranging sequences as they do not carry any data (they are deterministic sequences). In practice, a trusted third party known as Public Key Infrastructure (PKI) is used to download the public keys (and bind them to their owners), as in the 4 shown.
  • • The Timed Efficient Stream Loss-Resilient Authentication (TESLA) protocol is an efficient, low-calculation broadcast authentication protocol that extends to many recipients and tolerates the loss of packets (see [6]). Because injection of malicious packets can be a risk on many broadcast networks, receivers want to make sure their received packets are from a trusted source. In point-to-point communication, the authenticity (and integrity) of a message is usually protected by a so-called Message Authentication Code (MAC), which is a (difficult-to-forge) identifier appended to the exchanged messages. MACs are generated using a secret key that is shared between the two communication endpoints. Using MACs in broadcast communication does not provide secure source authentication as it requires all receivers to have access to the secret key, and access to the secret key makes it possible to generate valid MACs. Thus anyone in possession of the secret key can forge the MAC of a message. Obviously, applying a digital signature to each data packet provides secure broadcast authentication, but it comes with a high overhead, both in terms of bandwidth and signing and verification time. The core idea of TESLA is that the sender attaches a MAC to each packet, which is calculated using a (secret) key that only he knows. The recipients, in turn, buffer the received messages without being able to authenticate them. A short time later, the sender reveals the (secret) key and the recipients can authenticate the packet. In this way, a single MAC attached to each message is sufficient to perform broadcast authentication, resulting in lower overhead and computing time compared to using digital signatures. A requirement of the TESLA protocol is a loose time synchronization of the receiver with the sender's clock. In particular, the receiver must know an upper limit for the sender's local time. In addition, TESLA requires the receiver to buffer a number of packets, resulting in a delay in authentication that is typically of the order of a round-trip delay between the sending unit and the receiving unit. Authentication in the TESLA protocol is based on a one-way key chain. A one-way key chain is constructed by using a one-way function F(•) such that a key K _i is computed from another key K _i+1 as K _i = F(K _i+1 ). Each key K _i is associated with a time interval of uniform duration, denoted as i. In addition, with another one-way function F'(·) becomes a key $K_i^{\text{'}}$
    
    derived from K _i as $K_i^{\text{'}}=f\text{'}\left(K_i\right).$
    
    If a message M _j is sent during the ith time frame, the sender uses the key $K_i^{\text{'}}$
    
    around a MAC $MAC\left(K_i^{\text{'}},M_j\right)$
    
    of the packet P _j . In addition, the packet P _j contains the key K _id of d time intervals in the past. The parameter d is called the packet disclosure delay and is predetermined together with the duration of the time intervals and the maximum length of the one-way key chain. The package is then given as $$P_j=\left\{M_j\left|MAC\left(K_i^{\text{'}},M_j\right)\right|K_{i-\mathrm{i.e}}\right\}$$
    
    TESLA receiver units work as follows:
    • When a receiver receives a packet P _j , the key K _id can be used to determine i. Assuming a loosely synchronized clock with the sender, the receiver can check the latest possible time interval 1 that the sender could currently be in. If l < i + d then the packet is considered secure.
    • The recipient must reject all packets that are not secure, ie that contain already revealed and publicly known keys. Packets with l < i + d contain keys that can only be known by the sender at this point in time.
    • When receiving a packet P _j that was sent in time interval i, the receiver cannot yet check the authenticity and has to store the collected information in a buffer until it learns the key K _i , which is only revealed after d time intervals.
    • The use of TESLA to protect the navigation messages in a PNT message was first proposed in [7]. It has recently been proposed to use TESLA to protect Galileo's navigation messages (see [2]). In particular, according to this proposal, all Galileo satellites form a single TESLA chain, which allows navigation messages from different satellites to be mutually authenticated. The main benefit of this approach is a reduction in the authentication failure rate (or a reduction in the time between authentications). For simplification, consider the case where the receiver unit sees four satellites. If each sending unit uses its own independent TESLA chain, the receiver must correctly receive the four MACs and the four corresponding keys in order to successfully authenticate the service. However, if a single chain is used, it is sufficient to receive the four MACs and one key without error. This property is particularly useful when the four satellites are not received with the same link quality, as might be the case in an urban environment where one satellite is seen at high elevation while the remaining three satellites are seen at slightly lower elevation (and thus with a higher bit error rate). The disadvantage of this scheme is that the TESLA hash chain becomes longer by a factor S, which corresponds to the (maximum) number of transmitters. This also implies an increase in complexity.
    • In [8] a scheme for authentication of BeiDou's navigation messages based on TESLA is proposed. The scheme is based on a single TESLA chain built by a control center. The control center is responsible for generating the navigation messages and the corresponding MACs. In particular, at any given time, those satellites monitored by the control center carry navigation messages with their respective MACs, and also carry a TESLA. However, satellites that are not currently being monitored by a control center do not carry a navigation message (nor do they have a MAC or TESLA key). Therefore, in [8] the GNSS satellites are used in a certain way as a communication channel to transmit navigation messages (protected with TESLA) originating from a control center.

• Mobilfunksysteme wie 3GPP LTE, 802.11 a/g/n und 5G nutzen Mehrträgersysteme (OFDM) und fügen Ranging-Sequenzen hinzu, um entweder dem Netzwerk oder dem Mobiltelefon eine Abschätzung der Distanz zu ermöglichen [11]. Derzeit sind keine dedizierten Ranging-Sequenzen definiert, die ein Authentifizierungsverfahren verwenden. Für den Downlink könnte ein Authentifizierungsverfahren angewendet werden, um das Ranging auch im Uplink abzusichern. Allerdings werden die Ranging-Sequenzen per Unicast übertragen, so dass die Ranging-Protokolle im Netzwerk für mehrere Nutzer nur bedingt skalierbar sind. Abstandsbestimmung und Positionierung als Broadcast-Dienst dieser Kommunikationsdienste sind vorstellbar, z. B. von Bezahl-Diensten genutzt, wird aber derzeit nirgends angewendet.

So far, countermeasures for broadcast PNT services have been presented. Some techniques for securing PNT systems based on unicast communication are presented below:

• Cellular systems such as 3GPP LTE, 802.11 a/g/n and 5G use multi-carrier systems (OFDM) and add ranging sequences to allow either the network or the mobile phone to estimate the distance [11]. There are currently no dedicated ranging sequences defined that use an authentication mechanism. An authentication method could be used for the downlink in order to also secure the ranging in the uplink. However, the ranging sequences are transmitted via unicast, so that the ranging protocols in the network can only be scaled to a limited extent for multiple users. Distance determination and positioning as a broadcast service of these communication services are conceivable, e.g. B. used by payment services, but is currently not used anywhere.

Safe positioning is applied to estimate the proximity of the sending unit to the receiving unit to allow payment or door opening. In [9], methods based on multilateration and using trusted transmitters to identify a malicious participant by reducing the possibilities of position estimation were discussed. Known applications are proximity-based security access methods, for example for cars.

In [10] the authors present a secure positioning method between at least two devices that communicate with each other via ultra-wideband (UWB) protocols. The focus of the present invention is on the surreptitiously exchanged response time of the returning second device, which is encrypted and relayed privately by the first or second device over an additional communication channel. The main disadvantage is that the method is not scalable and can hardly be applied in a cellular network with broadcast transmission. Also, it doesn't exploit the ranging sequences themselves.

The disadvantages of previously known cryptographic countermeasures are explained below.

Non-cryptographic Countermeasures

Signal and status analysis methods

These methods can provide very good protection, especially if the receiver is locked into the authentic navigation signals and continuously tracks the phase, frequency, and delay of the received signals. However, this is not possible in a cellular system where navigation is provided as a service, since the navigation signals are transmitted intermittently. In particular, each transmitter sends its ranging sequence z. B. once per second to match its transmission within a slot or resource block. If the receiver works in a snapshot and tracks the signals intermittently rather than continuously, the degree of protection drops significantly. In this case, the Emp only catches its position, which the transmitter and the clock offsets track. Finally, the protection provided by signal and state analysis techniques is lowest when the receivers perform a cold start, i.e. when the receiver is powered on and the navigation system has not yet authenticated (and its local clock is either uninitialized or has a large offset). In this case, these techniques (in general) may not allow to distinguish a fake signal from a real signal.

Antenna Array Techniques

Their main disadvantage is that an antenna array is required at the receiver, which increases costs and for small receivers such as e.g. B. handheld may not be possible.

Symmetric encryption methods

In general, symmetric encryption is the cryptographic technique that can offer the best protection (see [4]). However, it also comes at a high price. With symmetric encryption, anyone in possession of the secret key can impersonate the sender. In order to protect the system, it is therefore necessary to equip the receivers with tamper-proof modules. In addition, it is necessary to implement methods for securely distributing the secret keys, e.g. B. the provision of keys for new users or the exchange of encryption keys after a certain period of time (rekeying). Such methods are used in some civil applications such. B. Pay-TV systems used, but would mean a significant increase in the cost of the terminal and the operation of the system. For this reason, symmetric encryption techniques are generally not suitable to protect an open service civilian PNT system.

watermark process

There are a total of three disadvantages to watermarking methods. First, the digitized (sampled) received signal must be stored for the watermark. This can require a significant amount of disk space. Second, authentication is only possible for receivers within communication range of a sender, since they must correctly decode the navigation message to extract the watermark and verify that it was sent exactly ρ time units before. Finally, and this is the most important disadvantage in the context of the present invention, the watermarking methods rely heavily on the assumption that the watermarks cannot be reliably decoded/estimated due to the low receiver SNR. This requirement is perfectly justifiable for GNSS, but in a cellular system an attacker can take advantage of the proximity of a transmitter (i.e. base station) and receive the PNT signal with a high SNR.

Navigation Message Authentication (NMA)

The main disadvantage of NMA is that it only protects the navigation message and not the ranging sequences. This may not be a big problem with GNSS systems as these systems are characterized by continuous transmission. Therefore, as explained in [3], it is possible to take countermeasures to ensure that the ranging sequence and the navigation message belong to the same continuous transmission stream (signal and state analysis method). However, for cellular systems where navigation is offered as a service, this solution is unsatisfactory because PNT signals are transmitted intermittently, i. H. the receiver is forced to work in a snapshot.

• - Empfangen einer ersten, von der Sendeeinheit gesendeten Navigationsnachricht M_n durch die Empfängereinheit;
• - Empfangen von n_s Ranging-Sequenzen, die von der Sendeeinheit zwischen der ersten Navigationsnachricht M_n und einer zweiten Navigationsnachricht M_n+1 gesendet werden, durch die Empfängereinheit, wobei durch jede Ranging-Sequenz b Bit Informationen übermittelt werden; und wobei von der Sendeeinheit eine gesendete Bitfolge W_n der Länge n_w = b × n_s gesendet wird, die sich aus den n_s gesendeten Ranging-Sequenzen zusammensetzt, und von der Empfängereinheit eine empfangene Bitfolge Ŵ_n der Länge n_w = b × n_s empfangen wird, die sich aus den n_s empfangenen Ranging-Sequenzen zusammensetzt;
• - Empfangen der zweiten, von der Sendeeinheit gesendeten Navigationsnachricht M_n+1 durch die Empfängereinheit, wobei die zweite Navigationsnachricht M_n+1 die Bitfolge W_n direkt enthält oder eine kodierte Darstellung der Bitfolge W_n enthält;
• - Prüfung der Authentizität der zweiten Navigationsnachricht M_n+1 durch Prüfung einer digitalen Signatur oder durch ein Hashwert-basiertes Verfahren, wobei die Prüfung durch die Empfängereinheit erfolgt; und
• - falls die Authentifizierung der zweiten Navigationsnachricht M_n+1 nicht erfolgreich war: Feststellen einer mangelnden Authentizität der zweiten Navigationsnachricht M_n+1; und
• - falls die Authentifizierung der zweiten Navigationsnachricht M_n+1 erfolgreich war:
  • - Ermitteln der gesendeten Bitfolge W_n aus der zweiten Navigationsnachricht M_n+1 und Vergleich der empfangenen Bitfolge Ŵ_n mit der gesendeten Bitfolge W_n; und
  • - falls die empfangene Bitfolge Ŵ_n mit der gesendeten Bitfolge W_n identisch ist oder zumindest ein vorgegebenes Mindestmaß an Ähnlichkeit mit der gesendeten Bitfolge W_n aufweist: Bestätigung der Authentizität der empfangenen Ranging-Sequenzen;
  • - falls die empfangene Bitfolge Ŵ_n nicht mit der gesendeten Bitfolge W_n identisch ist und auch nicht das vorgegebene Mindestmaß an Ähnlichkeit mit der gesendeten Bitfolge W_n aufweist: Feststellen einer mangelnden Authentizität der Ranging-Sequenzen.

With the present invention, a method is proposed that allows both the navigation messages and the distance sequences to be authenticated against forgers (also referred to as spoofers). According to the present invention, a method for authentication of a transmitter unit by a receiver unit in a system for position determination, navigation and time determination is proposed, the method having the following steps:

• - receiving by the receiver unit a first navigation message M _n sent by the transmitter unit;
• - Receiving n _s ranging sequences, which are sent by the transmitter unit between the first navigation message M _n and a second navigation message M _n+1 , by the receiver unit, with b-bit information being transmitted by each ranging sequence; and wherein a transmitted bit sequence W _n of length n _w = b × n _s is transmitted by the transmitter unit, which is composed of the n _s transmitted ranging sequences, and a received bit sequence Ŵ _n of length n _w = b × by the receiver unit n _s is received, which is composed of the n _s received ranging sequences;
• - receiving the second navigation message M _n+1 sent by the transmitter unit by the receiver unit, the second navigation message M _n+1 containing the bit sequence W _n directly or containing a coded representation of the bit sequence W _n ;
• - Checking the authenticity of the second navigation message M _{n + 1} by checking a digital signature or by a hash value-based method, the check being carried out by the receiver unit; and
• - if the authentication of the second navigation message M _n+1 was unsuccessful: detecting a lack of authenticity of the second navigation message M _n+1 ; and
• - if the authentication of the second navigation message M _n+1 was successful:
  • - Determining the transmitted bit sequence W _n from the second navigation message M _n+1 and comparing the received bit sequence Ŵ _n with the transmitted bit sequence W _n ; and
  • - if the received bit sequence Ŵ _n is identical to the transmitted bit sequence W _n or has at least a predetermined minimum degree of similarity to the transmitted bit sequence W _n : confirmation of the authenticity of the received ranging sequences;
  • - if the received bit sequence Ŵ _n is not identical to the transmitted bit sequence W _n and also does not have the specified minimum degree of similarity with the transmitted bit sequence W _n : determination of a lack of authenticity of the ranging sequences.

The transmission unit can be designed, for example, as a base station in a mobile radio network. The receiver unit can be designed in particular as a mobile station.

In the method according to the invention, the second navigation message M _n+1 can either contain the bit sequence W _n in its entirety or also contain a coded representation of the bit sequence W _n , so that the complete amount of data does not have to be transmitted. Alternatively, it can be provided that the bit sequence W _n is calculated as a hash value of the second navigation message M _n+1 . As a result, the amount of data contained in the second navigation message M _n+1 can be reduced.

Furthermore, it can be provided in the present invention, in particular, that the authenticity of the second navigation message is checked using a Timed Efficient Stream Loss-Tolerant Authentication (TESLA) method.

• - Ausgabe eines Warnsignals, sofern zuvor eine mangelnde Authentizität der empfangenen Ranging-Sequenzen festgestellt wurde.

According to one embodiment of the method according to the invention, it can be provided that the method has the following method step:

• - Output of a warning signal if a lack of authenticity of the received ranging sequences was determined beforehand.

This enables the receiver unit to recognize that the received navigation data is not trustworthy, so that further action can be taken. In this case, for example, the receiver unit can output a warning signal.

• - Verwerfen von Positionierungs-Messdaten, die auf Grundlage vergangener Ranging-Sequenzen berechnet wurden, sofern zuvor eine mangelnde Authentizität der empfangenen Ranging-Sequenzen festgestellt wurde.

In addition, according to the present invention, it can be provided that the method has the following method step:

• - Rejection of positioning measurement data calculated on the basis of past ranging sequences if a lack of authenticity of the received ranging sequences was previously determined.

In this way, it can be ensured in an advantageous manner that only data that has been classified as trustworthy is used.

• - Speichern der Positionierungs-Messdaten für sämtliche der empfangenen Ranging-Sequenzen und Verwendung der Positionierungs-Messdaten, erst wenn die Authentizität der Ranging-Sequenzen bestätigt wurde.

According to a further embodiment of the present invention, it can be provided that the method has the following method step:

• - Storing the positioning measurement data for all of the received ranging sequences and using the positioning measurement data only after the authenticity of the ranging sequences has been confirmed.

This measure can ensure that only trustworthy data is used for the actual position determination. The security of the method according to the invention can be increased because falsified measured values caused by an attack can be avoided or at least significantly reduced by the measures described.

According to a further embodiment of the present invention, it can be provided that b-bit information is transmitted by means of each ranging sequence in that the transmitting unit can select from 2 ^b different ranging sequences when transmitting each ranging sequence.

Furthermore, it can be provided that the ranging sequences have a total of l symbols and a total of h symbols of the l symbols are reserved for the transmission of b bits of information. The h symbols can be arranged at the beginning, at the end or between the beginning and the end of the ranging sequences. Also, the h symbols can be located at non-contiguous positions of the ranging sequences.

• - Berechnen einer Distanz d_n zwischen der empfangenen Bitfolge Ŵ_n mit der gesendeten Bitfolge W_n, wobei die Distanz d_n insbesondere durch den Hamming-Abstand zwischen der empfangenen Bitfolge Ŵ_n und der gesendeten Bitfolge W_n oder durch die Anzahl der Symbol-Unterschiede, wobei ein Symbol eine Bitlänge b aufweist, ermittelt wird,
• - Vergleichen der Distanz d_n mit einem zuvor festgelegten Grenzwert α; und
• - Feststellen der mangelnden Authentizität der empfangenen Ranging-Sequenzen, sofern die Distanz d_n ≥ α; und
• - Bestätigen der Authentizität der empfangenen Ranging-Sequenzen, sofern die Distanz d_n < α.

According to one embodiment of the method according to the invention, it can be provided that the comparison of the received bit sequence Ŵ _n with the transmitted bit sequence W _n has the following:

• - Calculating a distance d _n between the received bit sequence Ŵ _n and the transmitted bit sequence W _n , the distance d _n being determined in particular by the Hamming distance between the received bit sequence Ŵ _n and the transmitted bit sequence W _n or by the number of symbol differences , where a symbol has a bit length b, is determined,
• - comparing the distance d _n with a predetermined limit value α; and
• - Determining the lack of authenticity of the received ranging sequences, provided that the distance d _n ≥ α; and
• - Confirming the authenticity of the received ranging sequences, provided that the distance d _n < α.

In this way, the limit value α can be adjusted depending on the requirements in a specific application scenario, so that in the specific application scenario it is easy to weigh up protection against attacks and sufficient continuity of the navigation service in those cases in which there is no attack. can be made and the effectiveness of the protection mechanism can be quickly and easily adapted to the requirements.

• - eine erste Navigationsnachricht M_n von einer Sendeeinheit zu empfangen;
• - n_s Ranging-Sequenzen von der Sendeeinheit zu empfangen, die von der Sendeeinheit zwischen der ersten Navigationsnachricht M_n und einer zweiten Navigationsnachricht M_n+1 gesendet werden, wobei durch jede Ranging-Sequenz b Bit Informationen übermittelt werden; und wobei von der Sendeeinheit eine gesendete Bitfolge W_n der Länge n_w = b × n_s gesendet wird, die sich aus den n_s gesendeten Ranging-Sequenzen zusammensetzt, und von der Empfängereinheit eine empfangene Bitfolge Ŵ_n der Länge n_w = b × n_s empfangen wird, die sich aus den n_s empfangenen Ranging-Sequenzen zusammensetzt;
• - die zweite Navigationsnachricht M_n+1 von der Sendeeinheit zu empfangen, wobei die zweite Navigationsnachricht M_n+1 die Bitfolge W_n direkt enthält oder eine kodierte Darstellung der Bitfolge W_n enthält;
• - die Authentizität der zweiten Navigationsnachricht M_n+1 durch Prüfung einer digitalen Signatur oder durch ein Hashwert-basiertes Verfahren zu prüfen; und
• - falls die Authentifizierung der zweiten Navigationsnachricht M_n+1 nicht erfolgreich war: eine mangelnde Authentizität der zweiten Navigationsnachricht M_n+1 festzustellen; und
• - falls die Authentifizierung der zweiten Navigationsnachricht M_n+1 erfolgreich war:
  • - die gesendete Bitfolge W_n aus der zweiten Navigationsnachricht M_n+1 zu ermitteln und die empfangene Bitfolge Ŵ_n mit der gesendeten Bitfolge W_n zu vergleichen, und
  • - falls die empfangene Bitfolge Ŵ_n mit der gesendeten Bitfolge W_n identisch ist oder zumindest ein vorgegebenes Mindestmaß an Ähnlichkeit mit der gesendeten Bitfolge W_n aufweist: die Authentizität der empfangenen Ranging-Sequenzen zu bestätigen;
  • - falls die empfangene Bitfolge Ŵ_n nicht mit der gesendeten Bitfolge W_n identisch ist und auch nicht das vorgegebene Mindestmaß an Ähnlichkeit mit der gesendeten Bitfolge W_n aufweist: eine mangelnde Authentizität der Ranging-Sequenzen festzustellen.

Furthermore, in order to achieve the above-mentioned object within the scope of the present invention, a receiver unit is proposed for use in a system for position determination, navigation and time determination, the receiver unit having a reception module, a memory and a processing unit, the receiver unit being designed to

• - to receive a first navigation message M _n from a transmission unit;
• - receive from the transmitting unit n _s ranging sequences which are transmitted by the transmitting unit between the first navigation message M _n and a second navigation message M _n+1 , each ranging sequence conveying b bits of information; and wherein a transmitted bit sequence W _n of length n _w = b × n _s is transmitted by the transmitter unit, which is composed of the n _s transmitted ranging sequences, and a received bit sequence Ŵ _n of length n _w = b × by the receiver unit n _s is received, which is composed of the n _s received ranging sequences;
• - to receive the second navigation message M _n+1 from the transmission unit, the second navigation message M _n+1 containing the bit sequence W _n directly or containing a coded representation of the bit sequence W _n ;
• - to check the authenticity of the second navigation message M _n+1 by checking a digital signature or by a hash value-based method; and
• - if the authentication of the second navigation message M _n+1 was unsuccessful: determine a lack of authenticity of the second navigation message M _n+1 ; and
• - if the authentication of the second navigation message M _n+1 was successful:
  • - to determine the transmitted bit sequence W _n from the second navigation message M _n+1 and to compare the received bit sequence Ŵ _n with the transmitted bit sequence W _n , and
  • - if the received bit sequence Ŵ _n is identical to the transmitted bit sequence W _n or has at least a predetermined minimum degree of similarity to the transmitted bit sequence W _n : to confirm the authenticity of the received ranging sequences;
  • - if the received bit sequence Ŵ _n is not identical to the transmitted bit sequence W _n and also does not have the specified minimum degree of similarity with the transmitted bit sequence W _n : determine a lack of authenticity of the ranging sequences.

It is obvious to a person skilled in the art that the receiver unit according to the invention can also have those technical features that were described above in connection with the embodiments of the method according to the invention.

• - eine erste Navigationsnachricht M_n an eine Empfängereinheit zu senden;
• - n_s Ranging-Sequenzen an die Empfängereinheit zu senden, wobei die n_s Ranging-Sequenzen zwischen der ersten Navigationsnachricht M_n und einer zweiten Navigationsnachricht M_n+1 gesendet werden, und wobei mittels jeder Ranging-Sequenz b Bit Informationen übermittelt werden; und wobei die Sendeeinheit dazu ausgelegt ist, eine gesendete Bitfolge W_n der Länge n_w = b × n_s an die Empfängereinheit zu senden und die Bitfolge W_n sich aus den n_s gesendeten Ranging-Sequenzen zusammensetzt;
• - die zweite Navigationsnachricht M_n+1 an die Empfängereinheit zu senden, wobei die zweite Navigationsnachricht M_n+1 die Bitfolge W_n direkt enthält oder eine kodierte Darstellung der Bitfolge W_n enthält; wobei
• - die zweite Navigationsnachricht M_n+1 eine digitale Signatur oder einen Message Authentication Code (MAC) aufweist.

In addition, to achieve the object described at the outset, a transmission unit is proposed for use in a system for position determination, navigation and time determination, the transmission unit having a transmission module, a memory and a processing unit, and the transmission unit being designed to

• - to send a first navigation message M _n to a receiver unit;
• - to send n _s ranging sequences to the receiver unit, the n _s ranging sequences being sent between the first navigation message M _n and a second navigation message M _n+1 , and b bit information being transmitted by means of each ranging sequence; and wherein the transmission unit is designed to transmit a bit sequence W _n of Send length n _w = b × n _s to the receiver unit and the bit sequence W _n is composed of the n _s ranging sequences sent;
• - to send the second navigation message M _n+1 to the receiver unit, the second navigation message M _n+1 containing the bit sequence W _n directly or containing a coded representation of the bit sequence W _n ; whereby
• - the second navigation message M _n+1 has a digital signature or a message authentication code (MAC).

It is obvious to the person skilled in the art that the transmission unit according to the invention can also include those technical features that were described above in connection with the embodiments of the method according to the invention.

Finally, to solve the above-described task, a system for position determination, navigation and time determination is described, the system according to the invention having a plurality of transmitter units according to the invention and at least one receiver unit according to the invention. In particular, it can be provided that the system according to the invention has at least three transmission units that transmit navigation data at regular intervals.

Further aspects of the invention are explained in detail below.

• Die Authentifizierung von Navigationsnachrichten erfolgt über einen kryptografischen Authentifizierungsalgorithmus, wie z. B. eine digitale Signatur von TESLA.

As already explained above, the present invention advantageously allows both the navigation messages and the ranging sequences to be authenticated. According to the present invention, the following mechanisms can be provided in particular:

• Navigation messages are authenticated using a cryptographic authentication algorithm, such as B. a digital signature from TESLA.

Additionally, the ranging sequences can be used to convey a limited amount of information to be used for authentication. To clarify the invention, the authentication of the transmission of the j-th transmitter will be considered below.

• • Der Empfänger versucht, eine Schätzung von W_n, die mit Ŵ_n bezeichnet werden soll, vorzunehmen, die zur späteren Verwendung gespeichert wird.
• • Die n + 1-te Navigationsmeldung M_n+1 übermittelt oder erlaubt die Bestimmung von W_n.
• • Die Authentifizierung kann insbesondere die folgenden Schritte aufweisen:
  • ◯ Die Empfängereinheit authentifiziert zunächst M_n+1 (mittels TESLA oder unter Verwendung einer digitalen Signatur).
  • ◯ Wenn die Authentifizierung nicht erfolgreich ist, geht die Empfängereinheit davon aus, dass die Navigationssignale nicht authentisch sind. Wenn die Authentifizierung erfolgreich ist, liest die Empfängereinheit W_n aus M_n+1 bzw. leitet W_n aus M_n+1 ab. In diesem Fall vergleicht die Empfängereinheit anschließend Ŵ_n und W_n. Wenn die beiden Sequenzen ähnlich oder gleich sind, authentifiziert die Empfängereinheit die Ranging-Sequenzen erfolgreich. Unterscheiden sich die beiden Sequenzen hingegen erheblich, geht die Empfängereinheit davon aus, dass die Navigationssignale nicht authentisch sind. Dieser Entscheidungsprozess ist in der 6 zusammengefasst.

The nth navigation message (also referred to as the first navigation message) is to be denoted by M _n . Furthermore, the number of ranging sequences sent by the j-th transmitter between the n-th and the n+1-th navigation message (M _n and M _n+1 ) should be designated as n _s . It is also assumed that b information bits are transmitted with each ranging sequence. Overall, n _w =bn _s bits are therefore transmitted by the ranging sequences between M _n and M _n+1 . Let us also denote by W _n the n _w bits long bit sequence that is transmitted between M _n and M _n+1 by the n _s transmitted ranging messages. The functional principle can be described as follows:

• • The receiver attempts to make an estimate of W _n , to be denoted Ŵ _n , which is stored for later use.
• • The n+1-th navigation message M _n+1 transmits or allows the determination of W _n .
• • Authentication may include the following steps in particular:
  • ◯ The receiver unit first authenticates M _n+1 (using TESLA or using a digital signature).
  • ◯ If the authentication is not successful, the receiver unit assumes that the navigation signals are not authentic. If the authentication is successful, the receiver unit reads _Wn from Mn ₊₁ or derives _Wn from Mn ₊₁ . In this case, the receiver unit then compares Ŵ _n and W _n . If the two sequences are similar or the same, the receiver unit successfully authenticates the ranging sequences. On the other hand, if the two sequences differ significantly, the receiver unit assumes that the navigation signals are not authentic. This decision-making process is 6 summarized.

It should be noted here that the ranging sequences are used not only for the transmission of information but also by the receiver unit to estimate its position. Because the authentication of the ranging sequences occurs with a certain delay (once the next navigation message is received by the receiver unit), the receiver unit can actually use the ranging sequences to calculate its position using pseudo-ranging before waiting for the final authentication . Thereafter, the receiving unit can raise an alarm if it believes that the ranging sequences have been falsified and are therefore not authentic.

In addition, the receiver unit can recalculate its position estimate as soon as it knows which ranging sequences have been sent, ie it can discard the pseudo-ranging measurements previously determined with wrong sequences. Alternatively, the receiver unit can do that Store the result of the pseudo-ranging measurements for all possible sequences and use the measurements at a later time (when it is known which sequences were sent) to estimate their position.

• - Sie ermöglichen dem Empfänger die Durchführung von Entfernungsmessungen und
• - Sie übermitteln eine begrenzte Menge an Informationen.

It should be noted that a certain degree of uncertainty must be assigned to the ranging sequences so that they can transmit information. This can be achieved, for example, by transmitting a ranging sequence from a set of possible ranging sequences. The ranging sequences therefore serve two purposes within the scope of the present invention:

• - They enable the receiver to carry out distance measurements and
• - They transmit a limited amount of information.

Some exemplary embodiments of the present invention are to be explained in more detail below.

Transmission of information in the ranging sequences

A first way of transmitting b bits of information (where b is relatively small) is to use 2 ^b different ranging sequences that are a priori equally probable. In this way, the ranging sequence chosen by the transmitting unit, if correctly received, transmits b bits of information. It should be noted that the use of sequences with different a priori probabilities is also possible and can even be advantageous in some situations.

Also note that some of the ranging sequences may perform better at short ranges than others at long ranges. The ranging sequences can be defined in the existing network for performance reasons and in order to increase the integrity of the selected ranging sequence against an attacker. In the 7 different designs of a ranging sequence show the result of the autocorrelation function, which can indicate what error range the receiver can expect. Thus, this option could be advantageous in terms of ranging accuracy compared to a traditional scheme where the same ranging sequence is always transmitted. In the 7 shows the performance of various ranging sequences associated with the factor γ, which determines the ratio of how two sequences combine. The factor γ can be safely divided using the navigation message.

Another possibility is to reserve h symbols from the set l of symbols that make up the ranging sequence in order to transmit b bits of information. These h symbols can be placed in any position i.e. H. they can be placed at the beginning, at the end, somewhere in the middle, or even in non-contiguous positions.

A further possibility is the transmission of b information bits by means of a hierarchical modulation.

wobei α und β komplexe Zahlen sind, s die (modulierte) Ranging-Sequenz ist (deren Elemente komplexe Zahlen sind) und x_i die i-te informationstragende Sequenz, die ebenfalls eine Folge komplexer Zahlen ist.Another possibility is transmission by overlaying the ranging sequence s with another sequence x _i , i=1,2,...,2 ^b . In this scheme in particular, the transmitting unit transmits $$as+\beta x_i,$$

where α and β are complex numbers, s is the (modulated) ranging sequence (whose elements are complex numbers) and x _i is the ith information-carrying sequence, which is also a sequence of complex numbers.

Furthermore, any other digital communication technique can be used as long as it allows the transmission of b information bits and at the same time the transmission of a ranging sequence s that can be used for pseudo-ranging (within the same resource allocation). In the 7 shows how even very few bits can effectively repel an attack.

It should also be noted that it is not necessary for all ranging sequences to transmit information. In this case, for example, a system can be considered in which the n _s sequences are to be sent by a specific transmission unit between two consecutive navigation messages. One may decide that sequences in odd positions are known a priori, e.g. eg, the first, third, fifth, etc. sequence is always s ₀ , while sequences in even (second, fourth, etc.) positions carry information. For example, even sequences can be selected from the set {s _0, s ₁ } with equal probability, where the sequences convey 1 bit of information.

Determination of the receiver unit which ranging sequence was sent

In order to determine the data bits at the receiver, the receiver unit can use a maximum likelihood approach. This means that the receiver unit generates a reference signal for every possible bit combination and compares this with the received signal using correlation. It can be assumed that the signal with the highest correlation is the right one.

Alternatively, the result of the position determination can be included in the decision-making process. Suppose the receiver unit knows roughly its position (e.g. from position fix and previous measurements) and has a model that determines how its position will change over time (e.g. a maximum velocity and/or acceleration) . In this case, the receiving unit can use this knowledge to determine which sequence was sent. For example, it can be assumed that the receiver unit determines that two sequences s_a and s_b have approximately the same probability of having been sent. Each of these two sequences provides a different result of the distance measurement. The receiver can attempt to identify which of these two range measurements will result in a position estimate closer to that expected by the receiver unit and select that sequence as the one that may be transmitted.

Make a decision about authenticity

Furthermore, a spoofing attack on the ranging sequences is to be considered below. Since the data field W _n is not known until the navigation message M _n+1 is sent, the best an attacker can do is try to randomly guess W _n .

For the sake of simplicity, the case in which each of the ranging sequences is uniformly distributed and randomly selected from a set of 2 ^b sequences is considered below. Furthermore, it can be assumed that n _s sequences are transmitted between the nth and the n+1th navigation message.

• • wenn i > α, das Signal als authentisch angesehen wird und
• • wenn i ≤ α, das Signal als nicht authentisch (gespoofed) angesehen wird.

One possibility is that the receiver unit simply keeps track of how many of the n _s transmitted sequences it has correctly estimated. In the present case, this number is denoted by i. One possibility is that the receiving unit simply sets a threshold α such that:

• • if i > α, the signal is considered authentic and
• • if i ≤ α, the signal is considered inauthentic (spoofed).

A numerical example should be considered for clarification. The probability that a spoofer i correctly guesses from the n _s sequences $$P\left[icO\mathrm{right}\mathrm{right}ectG\mathrm{and}esses\right]=\left(\begin{array}{c}{n}_s\\ i\end{array}\right){\left(\frac{1}{2^b}\right)}^i{\left(1-2^{-b}\right)}^{n_s-i}$$

In contrast, the lawful transmission of an authentic signal should be considered. For the sake of simplicity, assume that the correct sequence is recognized with probability 1− _pe , while with probability _pe the receiver estimates that a different sequence has been transmitted. The probability that a receiver correctly estimates i from the n _s sequences $$P\left[icO\mathrm{right}\mathrm{right}ectestimatiOns\right]=\left(\begin{array}{c}{n}_s\\ i\end{array}\right){\left(1-p_e\right)}^i{\left(p_e\right)}^{n_s-i}$$

In the 8th . maps the probability of correctly estimating i sequences for a fake signal and an authentic signal assuming n _s = 20, b = 3, p _e = 0.1. As can be seen, the signal is more likely to be authentic when 11 or more of the 20 sequences are correctly estimated. If 10 or fewer sequences are correctly estimated, the signal is more likely to be fake. In this case the threshold could be chosen as α=10. A low value of α leads to an increased probability that fake signals will be recognized as authentic. A high value of α leads to a higher probability that an authentic signal will be incorrectly classified as fake.

It should also be noted that in practice the receiver unit may estimate p _e based on its estimate for the downlink SNR and take this into account when deciding whether the signal is authentic or not. According to one embodiment, the following can be provided.

• • Die Anzahl der Symboldifferenzen/Fehler, wobei ein Symbol b Bits lang ist (die Anzahl der Bits, die mit jeder Ranging-Sequenz übertragen werden), wie wir oben beschrieben haben.
• • Die Hamming-Distanz (Anzahl der Bit-Differenzen/Fehler)
• • Eine andere „weiche“ Metrik (im Englischen auch als „soft metric“ bezeichnet) wie eine Likelihood-Metrik, die die Wahrscheinlichkeit berücksichtigt, dass eine gegebene Sequenz s₁ empfangen wurde, wenn eine Sequenz s₂ gesendet wurde.

The receiver can calculate the distance d _n between Ŵ _n and W _n . This distance can be calculated in several ways:

• • The number of symbol differences/errors where a symbol is b bits long (the number of bits transmitted with each ranging sequence), as we described above.
• • The Hamming distance (number of bit differences/errors)
• • Another “soft” metric, such as a likelihood metric, that considers the probability that a given sequence s ₁ was received given a sequence s ₂ was sent.

• • wenn d_n > α, die Empfängereinheit nimmt an, dass die Ranging-Sequenzen gefälscht wurden.
• • wenn d_n < α, die Empfängereinheit geht davon aus, dass die Ranging-Sequenzen nicht gefälscht wurden

Next, the distance d _n should be evaluated. A large distance indicates a high probability that the ranging sequences were likely tampered with. A small distance indicates that the ranging sequences are unlikely to have been spoofed.
In one embodiment, the receiver unit can compare d _n with a threshold value α and

• • if d _n > α, the receiver unit assumes that the ranging sequences have been spoofed.
• • if d _n < α, the receiver unit assumes that the ranging sequences have not been tampered with

Transmission of W _n in the navigation message

• • Das Datenfeld W_n kann direkt übertragen werden in M_n+1
• • Das Datenfeld W_n kann aus M_n+1durch Anwendung einer Einweg-(Hash-) Funktion F(·),z.B. SHA 256, auf M_n+1 ermittelt werden. Insbesondere kann W_n abgeleitet werden durch:
  • ◯ Hashen der gesamten Nachricht M_n+1, W_n = F(M_n+1)
  • ◯ Hashen eines Teils der Nachricht M_n+1, indem einige der vielen Datenfelder ausgelassen werden. Mit M̃_n+1 sei die n + 1-te Navigationsnachricht bezeichnet, nachdem ihre Bits neu geordnet wurden. Wir haben M̃_n+1 = [A_n+1,B_n+1], wobei A_n+1 und B_n+1 Bitstrings sind. Schließlich erhalten wir das Datenfeld als W_n = F(A_n+1)
  • ◯ Hashen von M̃_n+1 oder einen Teil davon und einige zusätzliche Daten oder Parameter, wie z. B. ein Zeitgeber (z. B. die UTC-Zeit) oder eine Senderidentifikationsnummer. Insbesondere,
    • • Beispiel 1: W_n = F(M_n+1, t), wobei t zusätzliche Daten oder Parameter sind (z. B. ein Timer oder eine Sequenznummer). Dabei ist zu beachten, dass mehr als ein Parameter vorhanden sein kann,
    • • Beispiel 2: W_n = F(A_n+1, t), wobei A_n+1 ist ein Teil von M̃_n+1 nach der Umordnung und t zusätzliche Daten oder Parameter sind (z. B. ein Timer oder eine Sequenznummer). Dabei ist zu beachten, dass mehr als ein Parameter vorhanden sein kann.

The navigation messages that are sent by a specific transmission unit are to be considered below. The navigation messages form a stream so that it is possible to number the messages in ascending order according to the time they were sent. The (n+1)th navigation message M _n+1 (authenticated, for example, with a digital signature or TESLA) contains or derives a data field W _n that is n _w bits long. For example:

• • The data field W _n can be transferred directly in M _n+1
• • The data field W _n can be determined from M _n+1 by applying a one-way (hash) function F(·), eg SHA 256, to M _n+1 . In particular, W _n can be derived by:
  • ◯ Hashing of the entire message M _n+1 , W _n = F(M _n+1 )
  • ◯ Hashing part of the message M _n+1 , omitting some of the many data fields. Let M̃ _n+1 denote the n + 1-th navigation message after its bits have been rearranged. We have M̃ _n+1 = [A _n+1 ,B _n+1 ], where A _n+1 and B _n+1 are bit strings. Finally we get the array as W _n = F(A _n+1 )
  • ◯ Hashing of M̃ _n+1 or a part of it and some additional data or parameters, like e.g. B. a timer (e.g. the UTC time) or a transmitter identification number. In particular,
    • • Example 1: W _n = F(M _n+1 , t), where t is additional data or parameters (eg a timer or a sequence number). Note that there can be more than one parameter
    • • Example 2: W _n = F(A _n+1 , t), where A _n+1 is a part of M̃ _n+1 after rearrangement and t is additional data or parameters (e.g. a timer or a sequence number ). Note that there can be more than one parameter.

Integration with TESLA

• • die Reichweite wesentlich größer ist als die Kommunikationsreichweite,
• • die Navigationsnachricht einer Sendeeinheit W_n für mehrere benachbarte Sendeeinheiten übermitteln muss.

An embodiment according to the invention is described below, which is particularly advantageous if:

• • the range is significantly greater than the communication range,
• • has to transmit the navigation message of a transmission unit W _n for several neighboring transmission units.

This implementation is based on using a single TESLA chain for a group of transmitter units, where the group can include all transmitter units.

abgeleitet aus K_i als $K_i^{\text{'}}=F\text{'}\left(K_i\right).$

Während der Zeit zum i-ten Zeitintervall, verwenden alle Sender den Schlüssel $K_i^{\text{'}},$

um den MAC für die von ihnen gesendeten Pakete zu berechnen. Wenn also eine Nachricht M_j während des i-ten Zeitintervalls gesendet wird, kann die Sendeeinheit den Schlüssel $K_i^{\text{'}}$

verwenden, um einen MAC zu berechnen, $MAC\left(K_i^{\text{'}},M_j\right)$

des Pakets P_j. Zusätzlich enthält das Paket P_j den Schlüssel K_i-d von d Zeitintervallen in der Vergangenheit. Der Parameter d wird als Paketoffenbarungsverzögerung (oder im Englischen als „packet disclosure delay“) bezeichnet und kann zusammen mit der Dauer der Zeitintervalle und der maximalen Länge der Einweg-Schlüsselkette vorher festgelegt werden. Das Paket ist dann gegeben als $$P_j=\left\{M_j\left|MAC\left(K_i^{\text{'}},M_j\right)\right|K_{i-d}\right\}$$

In particular, according to a standard TESLA method, a one-way key chain is constructed by using a one-way function Fe( ) such that a key K _i consists of a key K _i+1 other than K _i = F(K _i+1 ) is calculated. Each key K _i is associated with a time interval of uniform duration indexed by i. In addition, with another one-way function F'(·) becomes a key $K_i^{\text{'}}$

derived from K _i as $K_i^{\text{'}}=f\text{'}\left(K_i\right).$

During the time at the i th time interval, all transmitters use the key $K_i^{\text{'}},$

to calculate the MAC for the packets they send. So if a message M _j is sent during the i-th time interval, the sending unit can use the key $K_i^{\text{'}}$

use to calculate a MAC, $MAC\left(K_i^{\text{'}},M_j\right)$

of the package P _j . In addition, the packet P _j contains the key K _id of d time intervals in the past. The parameter d is called the packet disclosure delay and can be predetermined together with the duration of the time intervals and the maximum length of the one-way key chain. The package is then given as $$P_j=\left\{M_j\left|MAC\left(K_i^{\text{'}},M_j\right)\right|K_{i-\mathrm{i.e}}\right\}$$

abzuleiten, die den verschiedenen Sendeeinheiten in der Gruppe zugeordnet sind. Im Einzelnen sollen nachfolgend eine Gruppe von h Sendeeinheiten betrachtet werden. Dabei sollen mit id₀, id₁, ..., id_h die (eindeutigen) Bezeichner der Sendeeinheiten bezeichnet werden.The special feature of the described embodiment of the invention can be seen in the fact that an additional key derivation function F''(·) is used to select a number of keys $K_i^{\text{'}}$

derived associated with the various transmitter units in the group. In the following, a group of h transmission units is to be considered in detail. id ₀ , id ₁ , ..., id _h should be used to denote the (unique) identifiers of the transmission units.

und id_j als $$K_{i,i{d}_j}^{\text{'}\text{'}}=F\text{'}\text{'}\left(K_i^{\text{'}}\vee i{d}_j\right)$$

ermittelt werden. Alternativ kann es in manchen Situationen von Vorteil sein, einen zusätzlichen Parameter ψ_i zur Ableitung von $K_{i,i{d}_j}^{\text{'}\text{'}}$

aufzunehmen. In diesem Fall wird der Schlüssel $K_{i,i{d}_j}^{\text{'}\text{'}}$

ermittelt durch: $$K_{i,i{d}_j}^{\text{'}\text{'}}=F\text{'}\text{'}\left(K_i^{\text{'}}\left|i{d}_j\right|{\psi }_i\right)$$

Schließlich soll mit W_n,idj das Datenfeld des Senders id_j bezeichnet werden. W_n,idj ist direkt abgeleitet von $K_{i,j_0}^{\text{'}\text{'}}.$

Insbesondere kann dabei Folgendes gelten:

• • Es kann gelten: $W_{n,i{d}_j}=K_{i,j_0}^{\text{'}\text{'}}$
  
• • Alternativ dazu kann W_n,idj durch Abschneiden von $K_{i,j_0}^{\text{'}\text{'}}$
  
  ermittelt werden, falls die Länge von $K_{i,j_0}^{\text{'}\text{'}}$
  
  größer ist als die von W_n,idj

The key associated with the transmission unit id _j at the i-th time in the i-time can be obtained by applying the key derivation function F″(•). $K_i^{\text{'}}$

and id _j as $$K_{i,i{\mathrm{i.e}}_j}^{\text{'}\text{'}}=f\text{'}\text{'}\left(K_i^{\text{'}}\vee i{\mathrm{i.e}}_j\right)$$

be determined. Alternatively, in some situations it may be advantageous to use an additional parameter ψ _i to derive $K_{i,i{\mathrm{i.e}}_j}^{\text{'}\text{'}}$

record. In this case the key $K_{i,i{\mathrm{i.e}}_j}^{\text{'}\text{'}}$

determined by: $$K_{i,i{\mathrm{i.e}}_j}^{\text{'}\text{'}}=f\text{'}\text{'}\left(K_i^{\text{'}}\left|i{\mathrm{i.e}}_j\right|{\psi }_i\right)$$

Finally, the data field of the transmitter id _j is to be denoted by W _n,idj . W _{n,id j} is directly derived from $K_{i,j_0}^{\text{'}\text{'}}.$

In particular, the following may apply:

• • The following may apply: $W_{n,i{\mathrm{i.e}}_j}=K_{i,j_0}^{\text{'}\text{'}}$
  
• • Alternatively, W _{n,id j} by cutting off $K_{i,j_0}^{\text{'}\text{'}}$
  
  be determined if the length of $K_{i,j_0}^{\text{'}\text{'}}$
  
  is greater than that of W _{n,id j}

In this way, after determining K _i , W _{n,id j} generate for all transmitters in the group, ie for each id ₀ , id ₁ , ..., id _h . Thus, without sending additional data, the TESLA chain can be used to calculate W _{n,id j} to determine.

Furthermore, it should be noted that the functions F, F' and F" can be chosen to be identical, although they can also be different.

The present invention may be employed in any cellular communications network wishing to provide a positioning, navigation and/or timing service. This includes terrestrial cellular networks and cellular satellite networks. In particular, the cellular network can be the VDES network for maritime communication or a 5G or a wireless local area network. All of these networks have the ability to offer a broadcast service. Furthermore, the scheduling or interleaved scheduling of privately and publicly known ranging sequences through the authentication data can make it possible to distinguish between a free service and a paid service.

BIBLIOGRAPHY

• [1] Kuhn, M.G. An Asymmetry Security Mechanism for Navigation Signals. proc. of the Int. Work. on Inf. Hiding, 2004, pp. 239-252.
• [2] Fernandez-Hernandez, I., Rijmen, V., Seco-Granados, G., Simon, J., Rodriguez, I., & Calle, J.D.. A Proposal for Authenticating Navigation Messages for the Galileo Open Service. Navigation, Journal of the Institute of Navigation, 2016, Vo. 63, n. 1, pp 85-102.
• [3] Gunther, Christoph. "A Survey of Spoofing and Counter-Measures". Navigation: Journal of the Institute of Navigation, 2014, Vol. 61, n. 3, pp 159-177.
• [4] Ioannides, R.T., Pany, T., and Gibbons, G. Known Vulnerabilities of Global Navigation Satellite Systems, Status, and Potential Mitigation Techniques. Proceedings of the IEEE, 2016, Vol. 104, n. 6, 1174-1194.
• [5] Margaria, D., Motella, B., Anghileri, M., Floch, J.J., Fernández-Hernández, I., & Paonni, M. Signal Structure-Based Authentication for Civil GNSSs: Recent Solutions and Perspectives. IEEE Signal Processing Magazine, 2017, Vol. 34, n. 5, 27-37.
• [6] Perrig A, Canetti R, Tygar J, Song D. The TESLA Broadcast Authentication Protocol. RSA CryptoBytesSummer/Fall 2002;5:2-13
• [7] Wullems C, Pozzobon O, Kubik K. Signal Authentication and Integrity Schemes for Next Generation Global Navigation Satellite Systems. European Navigation Conference, (ENC-GNSS)2005: 1-10.
• [8] Z Wu, Y Zhang, L Liu, and M Yue, "TESLA-based authentication for BeiDou civil navigation message", in China Communications, vol. 17, no. 11, pp. 194-218, Nov. 2020, doi: 10.23919/JCC.2020.11.016
• [9] S Capkun and J Hubaux, "Secure positioning of wireless devices with application to sensor networks," Proceedings IEEE 24th Annual Joint Conference of the IEEE Computer and Communications Societies., Miami, FL, USA, 2005, pp. 1917 -1928 vol. 3, doi: 10.1109/INFCOM.2005.1498470.
• [10] Zafer Sahinoglu, Philip V. Orlik, Andreas F. Molisch, "Device, method and protocol for private UWB ranging" US7995644B2 United States
• [11] Del Peral-Rosado JA, Raulefs R, López-Salcedo JA, and Seco-Granados G, “Survey of Cellular Mobile Radio Localization Methods: From 1G to 5G”, in IEEE Communications Sur veys & Tutorials, vol. 20, no. 2, pp. 1124-1148, 2018, doi 10.1109/COMST.2017.2785181

Reference List

10

system

12

transmitter unit

14

receiver unit

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• US 7995644 B2 [0081]

Claims (11)

Method for authenticating a transmitter unit (12) by a receiver unit (14) in a system (10) for position determination, navigation and time determination, the method having the following steps: - Receiving a first navigation message M sent by the transmitter unit (12). _n by the receiver unit (14); - Receiving by the receiver unit (14) of n _s ranging sequences sent by the transmitting unit (12) between the first navigation message M _n and a second navigation message M _n+1 , with each ranging sequence transmitting b bits of information become; and wherein the transmitter unit (12) transmits a transmitted bit sequence W _n of length n _w = b × n _s , which is composed of the n _s transmitted ranging sequences, and the receiver unit (14) transmits a received bit sequence Ŵ _n der length n _w = b × n _s is received, which is composed of the n _s received ranging sequences; - receiving the second navigation message M _n+1 sent by the transmitting unit (12) by the receiver unit (14), the second navigation message M _n+1 containing the bit sequence W _n directly or containing a coded representation of the bit sequence W _n ; - Checking the authenticity of the second navigation message M _n+1 by checking a digital signature or by a Message Authentication Code (MAC)-based method, the check being carried out by the receiver unit (14); and - if the authentication of the second navigation message M _n+1 was unsuccessful: establishing a lack of authenticity of the second navigation message M _n+1 ; and - if the authentication of the second navigation message M _n+1 was successful: - determining the transmitted bit sequence W _n from the second navigation message M _n+1 and comparing the received bit sequence Ŵ _n with the transmitted bit sequence W _n ; and - if the received bit sequence Ŵ _n is identical to the transmitted bit sequence W _n or has at least a predetermined minimum degree of similarity to the transmitted bit sequence W _n : confirmation of the authenticity of the received ranging sequences; - if the received bit sequence Ŵ _n is not identical to the transmitted bit sequence W _n and also does not have the specified minimum degree of similarity with the transmitted bit sequence W _n : determination of a lack of authenticity of the ranging sequences. procedure after claim 1 , characterized in that the method has the following method step: - Output of a warning signal if a lack of authenticity of the received ranging sequences was previously determined. procedure after claim 1 or 2 , characterized by the following method step: - Discarding of positioning measurement data, which were calculated on the basis of past ranging sequences, if previously a lack of authenticity of the received ranging sequences was found. Method according to one of the preceding claims, characterized by the following method step: - storing the positioning measurement data for all of the received ranging sequences and using the positioning measurement data only when the authenticity of the ranging sequences has been confirmed. Method according to one of the preceding claims, characterized in that b-bit information is transmitted by means of each ranging sequence in that the transmitting unit (12) can select from 2 ^b different ranging sequences when transmitting each ranging sequence. Method according to one of the preceding claims, characterized in that the ranging sequences have a total of l symbols and a total of h symbols of the l symbols are reserved for the transmission of b bits of information. Method according to one of the preceding claims, characterized in that the comparison of the received bit sequence Ŵ _n with the transmitted bit sequence W _n has the following: - Calculating a distance d _n between the received bit sequence Ŵ _n and the transmitted bit sequence W _n , the distance d _n is determined in particular by the Hamming distance between the received bit sequence Ŵ _n and the transmitted bit sequence W _n or by the number of symbol differences, with a symbol having a bit length b, - comparing the distance d _n with a previously specified limit value α; and - determining the lack of authenticity of the received ranging sequences if the distance d _n ≥ α; and - confirming the authenticity of the received ranging sequences if the distance d _n <α. Method according to one of the preceding claims, characterized by the following method step: - Use of authenticated position estimates to check the position estimate of external position systems, in particular a global one Navigation Satellite System, GNSS, to verify their integrity. Receiver unit (14) for use in a system (10) for position determination, navigation and time determination, the receiver unit (14) having a receiving module, a memory and a processing unit, the receiver unit (14) being designed to - a first navigation message M to receive _n from a transmitting unit (12); - to receive n _s ranging sequences from the transmitting unit (12), which are transmitted by the transmitting unit (12) between the first navigation message M _n and a second navigation message M _n+1 , with b-bit information being transmitted by each ranging sequence ; and wherein the transmitter unit (12) transmits a transmitted bit sequence W _n of length n _w = b × n _s , which is composed of the n _s transmitted ranging sequences, and the receiver unit (14) transmits a received bit sequence Ŵ _n der length n _w = b × n _s is received, which is composed of the n _s received ranging sequences; - Receiving the second navigation message M _n+1 from the transmission unit (12), the second navigation message M _n+1 containing the bit sequence W _n directly or containing a coded representation of the bit sequence W _n ; - to check the authenticity of the second navigation message M _n+1 by checking a digital signature or by a hash value-based method; and - if the authentication of the second navigation message M _n+1 was unsuccessful: ascertaining a lack of authenticity in the second navigation message M _n+1 ; and - if the authentication of the second navigation message M _{n + 1} was successful: - to determine the transmitted bit sequence W _n from the second navigation message M _{n + 1} and to compare the received bit sequence Ŵ _n with the transmitted bit sequence W _n , and - if the received bit sequence Ŵ _n is identical to the transmitted bit sequence W _n or has at least a predetermined minimum degree of similarity with the transmitted bit sequence W _n : to confirm the authenticity of the received ranging sequences; - if the received bit sequence Ŵ _n is not identical to the transmitted bit sequence W _n and also does not have the specified minimum degree of similarity with the transmitted bit sequence W _n : determine a lack of authenticity of the ranging sequences. Transmission unit (12) for use in a system (10) for position determination, navigation and time determination, the transmission unit (12) having a transmission module, a memory and a processing unit, the transmission unit (12) being designed to - a first navigation message M to send _n to a receiver unit (14); - to send n _s ranging sequences to the receiver unit (14), the n _s ranging sequences being sent between the first navigation message M _n and a second navigation message M _n+1 , and b bits of information being transmitted by means of each ranging sequence become; and wherein the transmission unit (12) is designed to send a transmitted bit sequence W _n of length n _w = b × n _s to the receiver unit (14) and the bit sequence W _n is composed of the n _s transmitted ranging sequences; - to send the second navigation message M _n+1 to the receiver unit (12), the second navigation message M _n+1 containing the bit sequence W _n directly or containing a coded representation of the bit sequence W _n ; where - the second navigation message M _n+1 has a digital signature or a hash value. System (10) for position determination, navigation and time determination, comprising a plurality of transmission units (12). claim 9 and at least one receiver unit (14). claim 8 .

Images