Method and system for evaluating the correctness of information transmitted by a vehicle

Abstract

A method for evaluating the correctness of information transmitted by a vehicle is provided. Vehicle information about vehicle characteristics of the vehicle is received, wherein a vehicle trust value is assigned to the vehicle. Detector information about the vehicle characteristics is received, the detector information being based on detection of the vehicle characteristics by at least one detector external to the vehicle, wherein a detector trust value is assigned to the detector. The correctness of the vehicle information is then evaluated. A correctness value is assigned to the vehicle information, and the vehicle trust value is updated. When the correctness value is too low, the vehicle information can be discarded. Vehicles with high trust values ​​can verify other vehicles, which in turn can verify even more vehicles. In this way, a chain of vehicles (or trusted vehicles) with high trust values ​​can be established.

Description

Background Art

[0001] The vehicle may send information to a central server about its position, brake position, whether the vehicle is experiencing hydroplaning, etc. The server may send this information to other vehicles in the vicinity of the vehicle so that the other vehicles may use the information, e.g., for anticipating the behavior of the vehicle or for anticipating road conditions.

[0002] To prevent abuse, communications between the vehicle and the central server are encrypted and signed. However, if an attacker gains access to the car's computer system, he or she can forge, tamper with, or manipulate information - such as GPS information - which is then sent to the central server. In this way, the attacker can send incorrect information to the central server, which will distribute the incorrect information to other vehicles. This could create a dangerous situation for these other vehicles.

[0003] It is therefore an object of the present invention to reduce the risk of assigning incorrect or false information. Summary of the invention

[0004] The object of the present invention is achieved by providing a method according to claim 1 and a remote server according to claim 9.

[0005] According to a first aspect of the present invention, there is provided a method for evaluating the correctness of information transmitted by a vehicle, the method comprising the following steps:

[0006] - receiving vehicle information about vehicle characteristics of a vehicle, wherein a vehicle confidence value is assigned to the vehicle;

[0007] - receiving detector information about a characteristic of the vehicle, the detector information being based on detection of the characteristic of the vehicle by at least one detector external to the vehicle, wherein the detector is assigned a detector trust value;

[0008] - evaluating the correctness of the vehicle information based on the vehicle information, the vehicle trust value, the detector information and / or the detector trust value;

[0009] - assigning a correctness value to the vehicle information based on the evaluation;

[0010] - updating the vehicle confidence value based on the vehicle information, the vehicle confidence value, the detector information and / or the detector confidence value; and

[0011] - Processing the vehicle information using the correctness value.

[0012] In one or more embodiments, the vehicle is one of the group consisting of: a car, a motorcycle, a van, a truck, a bicycle, and a scooter.

[0013] In one or more embodiments, the vehicle characteristic comprises at least one of the group consisting of: GPS position, speed, acceleration, external weather conditions, stop time at a traffic light, color, license plate number of the vehicle. In one or more embodiments, the information about external weather conditions may comprise information about use of windshield wipers, outside temperature, use of fog lights and / or (sun) light intensity.

[0014] In one or more embodiments, any of the vehicle characteristics may be detected by one or more sensors on the vehicle. The color, license plate, or vehicle identification number may not need to be detected by one or more sensors on the vehicle. However, in the presence of a malicious attacker, information about any of these vehicle characteristics may be falsified.

[0015] Therefore, in one or more embodiments, the correctness of the information provided by the vehicle regarding these characteristics is compared with information regarding these same characteristics provided by other entities or detectors, such as vehicles in the vicinity of the vehicle, or roadside units such as traffic lights or traffic signs.

[0016] In one or more embodiments, the roadside unit may include a sensor (such as a camera) arranged to detect one or more vehicle characteristics.

[0017] The correctness of the vehicle information is evaluated based on the vehicle information and the detector information. However, the detector and / or vehicle may have provided incorrect information about one or more of the features in the past. The detector and / or vehicle may have been previously attacked or malfunctioned.

[0018] Therefore, both the vehicle and the detector are assigned a trust value. Generally, a higher trust value indicates that the information provided is more trustworthy or generally more correct. In one or more embodiments, the trust value can be a value between 0 and 100, where 100 is the highest trust value.

[0019] In one or more embodiments, the vehicle trust value includes vehicle characteristic trust values ​​corresponding to various vehicle characteristics included in the vehicle information, which may reflect the trustworthiness of various sensors of the vehicle.

[0020] In one or more embodiments, the detector trust value includes detector characteristic trust values ​​corresponding to the respective vehicle characteristics included in the detector information, which may reflect the credibility of the respective sensors of the detector.

[0021] In one or more embodiments, some detectors (such as road cameras) may have the highest trust value because these detectors are operated and maintained by official agencies or national organizations. Therefore, the trust value of such road cameras may be 100.

[0022] Therefore, the correctness of the vehicle information is also evaluated based on the vehicle trust value and the detector trust value. The vehicle information is assigned a correctness value based on the evaluation. Generally, a higher correctness value indicates that the provided information is more likely to be correct. In one or more embodiments, the correctness value can be a value between 0 and 100, where 100 is the highest correctness value.

[0023] For example, when the vehicle information is inconsistent with the detector information about a certain vehicle characteristic, and the vehicle confidence value is low and the detector confidence value is high, the correctness value will be low.

[0024] In another example, when the vehicle information is consistent with the detector information about a certain vehicle characteristic within a predetermined margin, and both the vehicle trust value and the detector trust value are high (e.g., both are 100), the correctness value will be high (e.g., 100).

[0025] According to the present invention, the vehicle information is processed using the correctness value. In one or more embodiments, vehicle information having a correctness value above a predefined threshold may be processed to generate information for other vehicles in the vicinity of the vehicle.

[0026] In one or more embodiments, when the correctness value is lower than another predetermined threshold, the vehicle information will be discarded. In this case, the risk of assigning incorrect information is reduced.

[0027] In order to have a trust value that reflects the current trustworthiness of the vehicle, the vehicle trust value may be updated or adjusted based on the vehicle information, the detector information and / or the detector trust value. In practice, a high correctness value may result in an increase in the trust value.

[0028] In one or more embodiments, the detector confidence value may be adjusted based on the correctness value. In practice, a high correctness value may result in an increase in confidence value.

[0029] In one or more embodiments, the detector is another vehicle with a sensor or a roadside unit with a sensor, wherein, preferably, the vehicle is within the detection range of the respective sensor.

[0030] In one or more embodiments, the trust value (of the vehicle and / or detector) is updated or adjusted at predefined time intervals after the previous adjustment. It may be the case that the trust value has not been updated for a long time (e.g., up to 6 months, or up to 12 months, or up to 36 months).

[0031] The probability that a vehicle or detector may send incorrect information due to an attack or malfunction will increase over time. Therefore, it is advantageous to regularly adjust (i.e., reduce) the trust value. In one or more embodiments, the vehicle trust value may be set to a default trust value each time the vehicle is turned on or started. The probability that a detector may send incorrect information is relatively low, so the predefined time interval may be set to 6 months, 12 months, or 36 months.

[0032] In one or more embodiments, the method may further comprise the step of identifying the vehicle. In this step, it is determined that both the vehicle information and the detector information relate to the same vehicle. In one or more embodiments, the vehicle is identified based on information about the license plate number included in both the vehicle information and the detector information. In one or more embodiments, the vehicle is identified based on information about a light sequence of one or more lights of the vehicle.

[0033] In one or more embodiments, the vehicle activates one or more lights according to a predetermined light sequence, and information about the predetermined light sequence is included in the vehicle information. In one or more other embodiments, information about the predetermined light sequence is first sent to the vehicle, and in response, the vehicle activates one or more lights according to the predetermined light sequence.

[0034] In one or more embodiments, a light sequence emitted by the one or more lights of the vehicle is detected by the detector, and the detector information includes information about the detected light sequence.

[0035] In these embodiments, the vehicle is identified based on a comparison of the information about the predetermined light sequence and the information about the detected light sequence.

[0036] In one or more embodiments, the method may further include providing a session key for the vehicle, wherein the vehicle information includes the session key. The session key may be used to identify the vehicle. In one or more embodiments, a new session key is provided for the vehicle each time the vehicle is turned on or started. In one or more embodiments, the session key is exchanged between the vehicle and the remote server.

[0037] In one or more embodiments, the method further comprises the step of sending information related to the vehicle information to other vehicles in the vicinity of the vehicle when the correctness value is higher than a predetermined threshold.

[0038] In one or more embodiments, the method further comprises the step of sending the vehicle information with the correctness value to other vehicles near the vehicle. In this case, the computer on the nearby vehicle can evaluate the correctness value and can process or discard the vehicle information based on the evaluation.

[0039] In one or more embodiments, the term "nearby vehicles" refers to vehicles other than the vehicle that are within a certain range relative to the vehicle, so that information about the vehicle is relevant to driving these vehicles. For example, braking of a vehicle may be relevant to other vehicles behind it.

[0040] In another aspect of the present invention, a method for establishing a vehicle chain with an updated vehicle trust value includes repeating a loop, wherein the loop includes the steps of any of the embodiments described in this document, and wherein the detector in loop n is the vehicle that was assigned an updated vehicle trust value in loop n-1. Here, n is an integer with a value of 1 or greater. In one or more embodiments, the detector in the first loop is a roadside unit with a high or highest detector trust value (for example, a detector trust value of 100). By repeating the loop, a vehicle chain with a high vehicle trust value can be established.

[0041] In another aspect of the invention, a remote server for evaluating the correctness of information transmitted by a vehicle is provided, wherein the remote server is arranged to perform the steps of any embodiment of the method as described in this document. The wording "remote server" relates to a computer external to the vehicle. In one or more embodiments, the remote server is located in a computing center.

[0042] In another aspect of the invention, there is provided a computer program comprising instructions which, when executed by a computer, cause the computer to perform the steps of any embodiment of the method as described in this document. In yet another aspect, there is provided a computer readable medium having such a computer program stored thereon.

[0043] The operation, advantages and embodiments of the remote server and system and the operation, advantages and embodiments of the computer program and computer readable medium correspond mutatis mutandis to the operation, advantages and embodiments of the method as described in this document. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] For a more complete understanding of the present invention, reference will be made to the following description taken in conjunction with the accompanying drawings, in which:

[0045] Figure 1 A schematic diagram showing a system including a remote server and a detector according to one or more embodiments of the present invention; and

[0046] Figure 2 A schematic diagram of a method according to one or more embodiments of the present invention is shown. DETAILED DESCRIPTION

[0047] Figure 1 A schematic diagram of a system 170 including a remote server 160 and detectors (120, 150) is shown in accordance with one or more embodiments of the present invention.

[0048] In one or more embodiments, the vehicle 100 may have received the session key, for example, when it was started or turned on.

[0049] The vehicle 100 is traveling on a road. The vehicle sends vehicle information about vehicle characteristics of the vehicle 100 to the remote server 160. The vehicle characteristics may include GPS location, speed, acceleration, stop time waiting for a traffic light, external weather conditions, vehicle color, and / or a license plate number of the vehicle. In one or more embodiments, the vehicle information may also include information about the operation of the car by the driver or an auxiliary driving system, for example, information about the use of brakes, windshield wipers, etc. One or more vehicle characteristics may be detected by a detector 110 on the vehicle 100.

[0050] In one or more embodiments, the remote server 160 is arranged to receive said vehicle information regarding vehicle characteristics of the vehicle 100 .

[0051] Information about these vehicle characteristics may be relevant to other vehicles near vehicle 100, such as vehicle 130. For example, when vehicle 100 suddenly decelerates (ie, has negative acceleration), vehicle 130 may want to start decelerating immediately.

[0052] In the presence of malicious attackers, information about these characteristics may be forged. For example, in order to forge vehicle information, a hacker may use parts of a scrapped car, which is still able to send vehicle information to the remote server 160 using the correct encryption and signature.

[0053] Thus, in one or more embodiments, the correctness of the information provided by the vehicle regarding these characteristics is compared with information regarding these same characteristics provided by other entities or detectors, such as vehicles 130 near vehicle 100, or roadside units 140 (such as traffic lights 140).

[0054] In one or more embodiments, the detector includes a sensor. For example, vehicle 130 may include sensor 120 , and / or traffic light 140 may include sensor 150 .

[0055] In one or more embodiments, such a sensor may be one of the group consisting of: a camera, a lidar, a radar, a GPS module, a microphone, a temperature sensor, and a humidity sensor.

[0056] In one or more embodiments, the detector sends detector information about vehicle characteristics to the remote server 160. For example, the vehicle 130 and / or the traffic light 140 may use its sensors 120, 150 to measure the acceleration of the vehicle 100, detect its license plate number, and / or estimate the GPS position of the vehicle 100.

[0057] In one or more embodiments, the detector information and / or vehicle information may include identification information of the vehicle 100, such as a session key, a license plate number, a GPS location, brand / model information, and / or color information. The identification information may further include vehicle speed, vehicle acceleration, and / or a timestamp. The timestamp may indicate when one or more characteristics were measured.

[0058] The identification information may further include information about the vehicle and the detector's surroundings, respectively. When the information is consistent with each other, it may indicate that the vehicle is near the detector. This may be used when assessing the correctness of vehicle information related to the vehicle's GPS location. The information about the surroundings may include information about wireless networks or wireless signals received by the vehicle and / or the detector.

[0059] In one or more embodiments, based on identification information in the detector information and / or in the vehicle information, the vehicle 110 may be identified, ie, it may be determined that both the detector information and the vehicle information relate to the same vehicle.

[0060] The providers of detector information and vehicle information (i.e., vehicle 100 and detectors 130, 140) may be assigned trust values ​​indicating the extent to which the information provided by the vehicle and the detector is considered trustworthy. For example, a detector trust value may be 100, indicating that the information provided by the detector is considered to be always correct. A vehicle trust value may be 50, indicating that its trustworthiness has not been previously evaluated and therefore there is a 50% chance that its information is correct and a 50% chance that its information is incorrect.

[0061] In one or more embodiments, the vehicle trust value includes vehicle characteristic trust values ​​corresponding to individual vehicle characteristics whose information is included in the vehicle information. In one or more embodiments, the vehicle trust value includes vehicle characteristic trust values ​​corresponding to individual vehicle characteristics whose information is included in the vehicle information. This may reflect the trustworthiness of information about a single vehicle characteristic, or indeed the trustworthiness of a sensor within the vehicle that measures or determines the single vehicle characteristic. For example, an acceleration sensor in a vehicle may be accurate, while the vehicle's windshield wipers may be malfunctioning.

[0062] In one or more embodiments, the detector trust value includes detector characteristic trust values ​​corresponding to the respective vehicle characteristics whose information is included in the detector information. This may reflect the trustworthiness of the detector's sensor, as explained with respect to the vehicle trust value.

[0063] The remote server 160 may then evaluate the correctness of the vehicle information using the vehicle information, the vehicle trust value, the detector information and / or the detector trust value, and assign a correctness value to the vehicle information based on the evaluation.

[0064] Based on the vehicle information, a vehicle characteristic may be calculated or determined. Based on the detector information, the same vehicle characteristic may be calculated or determined. Due to sensor inaccuracies, it is expected that there will generally be differences between the vehicle characteristic determined based on the vehicle information and the vehicle characteristic determined based on the detector information.

[0065] In one or more embodiments, the vehicle characteristic determined based on the vehicle information and the vehicle characteristic determined based on the detector information are considered equal when the difference is below a predetermined value.

[0066] In one or more embodiments, a correctness value of 100 may indicate a 100% chance that the vehicle information is correct. In one or more embodiments, a correctness value of 50 may indicate a 50% chance that the vehicle information is correct and a 50% chance that the information is incorrect. In one or more embodiments, a correctness value of 0 may indicate a 100% chance that the vehicle information is incorrect.

[0067] In one or more embodiments, based on the correctness value, the vehicle information may be discarded when the correctness value is below a predetermined threshold. In one or more embodiments, the remote server 160 is arranged to discard the vehicle information when the correctness value is below a predetermined threshold.

[0068] In one or more embodiments, when the correctness value is above another predetermined threshold, the vehicle information may be processed, for example in a remote server 160 , to generate information for other vehicles 110 in the vicinity of the vehicle 100 .

[0069] In one or more embodiments, when the correctness value is between the above two thresholds, the vehicle information can be processed together with other vehicle information of other vehicles, for example in the remote server 160, where the vehicle information is processed using a corresponding weighting factor based on its correctness value.

[0070] Based on the vehicle information, the vehicle trust value, the detector information and / or the detector trust value, the vehicle trust value can be adjusted or updated. In one or more embodiments, after providing vehicle information with a high correctness value one or more times, the vehicle can be considered more trustworthy than before. Therefore, its vehicle trust value can be adjusted (i.e., improved). In one or more embodiments, the remote server 160 is arranged to update the vehicle trust value and / or the detector trust value.

[0071] In one or more embodiments, when a high correctness value of, for example, 100 is assigned (once, often, or a predetermined number of times) to information that the vehicle has provided, one or more detectors 130, 140 assigned a high confidence value can verify the vehicle 100, i.e., cause the vehicle to have a high confidence value assigned to it. In this way, vehicles with high confidence values ​​can verify other vehicles, which in turn can verify even more vehicles. In this way, a vehicle chain 100 (or trusted vehicles) with high confidence values ​​can be established.

[0072] In one or more embodiments, a vehicle chain with updated vehicle trust values ​​may be established by repeating a cycle including the steps described in this document. In any cycle n, the detector is a vehicle that was assigned an updated vehicle trust value in the previous cycle (n-1).

[0073] In one or more embodiments, it is possible that most vehicles 130 and detectors 140 within a predefined area will have high trust values, because it is expected that most vehicles 130 and detectors 140 have not been attacked and have no damaged sensors. These vehicles and / or detectors will continuously verify each other. In addition, it will allow: the correctness value of the vehicle information of new vehicles 100 in the area will be quickly evaluated, and the vehicle 100 will be quickly assigned an appropriate trust value.

[0074] When the vehicle trust value has not been updated within a predefined period of time after the last update, it may be advantageous to update the trust value (without a new correctness value), i.e. to lower the trust value. In fact, after a period of time, the probability of the vehicle being attacked increases.

[0075] In one or more embodiments, the vehicle 100 is assigned a default trust value whenever the vehicle is started or turned on or enters an area where the remote server 160 manages received vehicle information.

[0076] Figure 2 A schematic diagram of a method according to one or more embodiments of the present invention is shown. The method 200 comprises the following steps:

[0077] Step 210: receiving vehicle information about vehicle characteristics of a vehicle, wherein a vehicle trust value is assigned to the vehicle;

[0078] Step 220: receiving detector information about the vehicle characteristic, the detector information being based on detection of the vehicle characteristic by at least one detector external to the vehicle, wherein the detector is assigned a detector trust value;

[0079] Step 230: Evaluate the correctness of the vehicle information based on the vehicle information, the vehicle trust value, the detector information and / or the detector trust value;

[0080] Step 240: assigning a correctness value to the vehicle information based on the evaluation;

[0081] Step 250: updating the vehicle trust value based on the vehicle information, the vehicle trust value, the detector information and / or the detector trust value; and

[0082] Step 260: Use the vehicle information for processing.

[0083] In one or more embodiments, the method 100 may further include the following steps:

[0084] Step 270: When the accuracy value is higher than the predetermined threshold, information related to the vehicle information is sent to other vehicles near the vehicle.

[0085] and / or

[0086] Step 255: Send the vehicle information with the correctness value to other vehicles near the vehicle.

[0087] In another aspect of the invention, there is provided a computer program comprising instructions which, when executed by a computer, cause the computer to perform the steps of any embodiment of the method as described in this document. In yet another aspect, there is provided a computer readable medium having such a computer program stored thereon.

[0088] The technician will appreciate that the various illustrative logic blocks, modules, circuits and algorithmic steps described about the embodiments disclosed herein can be implemented as electronic hardware, computer software or the combination of the two. In order to clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits and steps have been generally described above with regard to their functions. Whether this function is implemented as hardware or software depends on specific applications and design constraints imposed on the entire system. Those skilled in the art can implement described functions in different ways for each specific application, but this implementation decision should not be interpreted as causing deviation from the scope of the invention.

[0089] The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is to be given the widest scope consistent with the principles and novel features disclosed herein.

[0090] The benefits and advantages that the present invention can provide have been described above with respect to specific embodiments. These benefits and advantages, as well as any elements or limitations that can make them occur or become more significant, should not be interpreted as key, necessary or essential features of any or all claims. As used herein, the term "comprises / comprising" or any other variation thereof is intended to be interpreted as non-exclusively including the elements or limitations following these terms. Accordingly, a system, method or other embodiment including a set of elements is not limited to these elements, and may include other elements that are not explicitly listed or inherent to the claimed embodiments.

[0091] Although the present invention has been described with reference to specific embodiments, it should be understood that these embodiments are illustrative and the scope of the present invention is not limited to these embodiments. Many changes, modifications, additions and improvements to the above-described embodiments are possible. It is contemplated that these changes, modifications, additions and improvements fall within the scope of the present invention as detailed in the following claims.

Claims

1. A method for establishing a vehicle chain with updated vehicle trust values, the method comprising repeating a loop, wherein: The cycle comprises the following steps: receiving vehicle information regarding vehicle characteristics of a vehicle, wherein a vehicle confidence value is assigned to the vehicle; receiving detector information regarding a characteristic of the vehicle, the detector information being based on detection of the characteristic of the vehicle by at least one detector external to the vehicle, wherein the detector is assigned a detector trust value; evaluating the correctness of the vehicle information based on the vehicle information, the vehicle trust value, the detector information and / or the detector trust value; assigning a correctness value to the vehicle information based on the evaluation; updating the vehicle confidence value based on the vehicle information, the vehicle confidence value, the detector information and / or the detector confidence value; and processing the vehicle information using the correctness value, wherein the detector in loop n is the vehicle that was assigned an updated vehicle trust value in loop n-1; Therein, the detector in the first cycle is a roadside unit with a high detector confidence value.

2. The method according to claim 1, wherein: The vehicle characteristic comprises at least one of the group consisting of: GPS position, speed, acceleration, stop time at a traffic light, external weather conditions, vehicle color, and a license plate number of the vehicle.

3. The method according to any one of claims 1 to 2, further comprising updating the vehicle trust value at a predefined time interval after a previous update.

4. The method according to any one of claims 1 to 3, further comprising the step of identifying the vehicle, wherein: The identification comprises the following steps: sending information about a predetermined light sequence to the vehicle, wherein the predetermined light sequence activates one or more lights of the vehicle according to the predetermined light sequence; wherein the detector information comprises information about light sequences of one or more vehicle lights detected by the detector; The vehicle is identified based on a comparison of the predetermined light sequence and the detected light sequence.

5. The method according to any one of claims 1 to 4, wherein: The vehicle confidence values ​​include vehicle characteristic confidence values ​​corresponding to respective vehicle characteristics whose information is included in the vehicle information.

6. The method according to any one of claims 1 to 5, wherein: The detector confidence values ​​include detector characteristic confidence values ​​corresponding to respective vehicle characteristics whose information is included in the detector information.

7. The method according to any one of claims 1 to 6, further comprising the step of sending information related to the vehicle information to other vehicles in the vicinity of the vehicle when the correctness value is higher than a predetermined threshold.

8. The method according to any one of claims 1 to 7, further comprising the step of sending the vehicle information with the correctness value to other vehicles in the vicinity of the vehicle.

9. A remote server for establishing a vehicle chain with updated vehicle trust values, the remote server being arranged to perform the steps of the method as claimed in any one of claims 1 to 8.

10. A system for evaluating the correctness of information transmitted by a vehicle, the system comprising: The remote server according to claim 9; A roadside unit external to the vehicle is arranged to detect the vehicle characteristic of the vehicle and to send detector information about the vehicle characteristic detected by the roadside unit to the remote server.

11. A computer program product comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method as claimed in any one of claims 1 to 8.

12. A computer readable medium having instructions stored thereon, which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 8.

Images