Procedures for securing communication

Abstract

Method for securing communication between at least two participants (1, 2), each of whom has an identification (ID) and a security (PIN), and who communicate using this identification, preferably encrypted, wherein the participants (1, 2) exchange their identification (ID), wherein at least one of the participants (1, 2) communicates their position (P3, P4) to the other participant (2, 1) in addition to their identification (ID), wherein the position (PP3, PP4) of the participant (1, 2) is determined or queried by the other participant (2, 1), after which the other participant (2, 1) validates the participant (1, 2) by comparing the communicated position (P3, P4) and the determined or queried position (PP3, PP4), characterized in that the determined or queried position (PP3, PP4) of the participant (1, 2) is derived from the signal propagation times between the participant (1, 2) and satellites (3.1, 3.2, 3.3, 3.4) is calculated using the timestamp (T8, T9) and at least four satellites (3.1, 3.2, 3.3, 3.4) are included in the calculation.

Description

[0001] The invention relates to a method for securing communication between at least two participants, according to the type defined in more detail in the preamble of claim 1. Furthermore, the invention relates to the use of such a method according to the type defined in more detail in claim 7.

[0002] Methods for communication between two or more participants that are appropriately secured are known from the state of the art. Typically, each participant has an identification, such as a user name, user ID, or the like, as well as communication security, such as a password-protected account or the like. The actual security of the communication is then achieved technically through encryption. The password is also the "key" to this.

[0003] The problem with such approaches is always the fundamental risk that a participant's data, such as their ID and password, will be stolen. Criminal hackers can then contact the other participant instead of the previous participant and, based on the ID and password they know, can make the other participant believe that they are the expected participant. This type of verification, which is so widespread and can use other means such as storage media or the like instead of a password, is typically used for many types of communication. However, as the example above shows, it is not secure in the event that the user data is known to other people or has been stolen or hacked.

[0004] Regarding the state of the art, reference can be made to ALLIG, C. et al., "Trustworthiness Estimation of Entities with Collective Perception," in: IEEE Vehicular Networking Conference (VNC), 2019, 8 pages, ISSN 2157-9865. This paper describes how to verify a participant's position from two data sources.

[0005] The Cooperative Awareness Service referred to in this document is described in the standard ETSI EN 302 637-2 V1.3.2 (2014-09). Intelligent Transport Systems (ITS); Vehicular Communications; Basic Set of Applications; Part 2: Specification of Cooperative Awareness Basic Service; pages 1 to 44.

[0006] The object of the present invention is to provide improved security for communication between participants, which offers a high level of security through improved verification of geodetic positions, even in the event of stolen or hacked participant data.

[0007] According to the invention, this object is achieved by a method having the features of claim 1. Advantageous embodiments and further developments of these features emerge from the dependent claims. Claim 7 also specifies a particularly preferred use for the method.

[0008] In the method according to the invention for securing communication between two participants, the participants, just as in the prior art, have an identification, for example a user ID, a customer number or the like. They also have communication security, for example through a personal identification number (PIN), a password or the like. This means that the two participants are in principle able to communicate in an encrypted manner. However, the problem described above exists that if the identification and password or the like are stolen, an unauthorized person could take the place of one of the participants. This can cause considerable damage, as malware, for example, could be introduced into a system. If the system is a motor vehicle, for example, this results in considerable disadvantages with regard to road safety and user security.

[0009] According to the invention, at least one of the participants, in addition to identifying themselves, communicates their position to the other participant as a physical property. This property cannot really be manipulated, as a participant can only be in one location. They communicate this to the other participant. At the same time, the other participant queries the position of their respective counterpart, in this case the first participant, using a parallel method, without the first participant being able to actively influence the determination of this value, for example, via active positioning using satellite navigation. The second participant now has one data set communicated by the other participant and one queried. The two data sets, and in particular the positions of the first participant, can therefore be compared by the other participant. If they match, the communicated position can be validated accordingly.Based on this additionally transmitted physical attribute, if it is correct, it can be assumed that the first participant is indeed the expected participant. This allows for a high degree of security, and the risk of a hacker "sneaking in" and abusing the communication can be relatively safely ruled out.

[0010] For example, if a vehicle control system wants to download an update relevant to traffic safety, it can use the method according to the invention to validate its counterpart based on the physical properties of its position. This can highly reliably rule out the possibility of a hacker offering it manipulated software that could lead to security problems or similar issues.

[0011] Different satellite systems have different requirements. For example, the Beidou satellite navigation system, which is currently available primarily in the Asian and Pacific regions, includes active positioning as part of its service, allowing the position of the other participant to be easily and actively queried via the satellite navigation system. This function is not readily available in other satellite systems. However, it can be used by calculating the position of the other participant from the signal propagation times between the participants and the navigation satellites using the timestamp. This allows for a correspondingly precise calculation of the signal propagation times. If at least four navigation satellites are included in the calculation, a very precise picture of the position of each participant is obtained.

[0012] This position can then be compared with the position reported by the participant to validate the security. If the two positions do not match, or if the match lies outside a tolerance range or a range that may have arisen due to the movement of one of the participants, then it must be assumed that the request did not originate from the participant themselves, but rather, for example, from a hacker who has access to the account but does not know the participant's actual location at the current time. In this case, the security of the communication cannot be validated, meaning no communication takes place, and a potential hacker is unable to use the participant's account.

[0013] Depending on the distance between the participants, the data transmission and calculation can be carried out directly via the navigation satellites. However, it can also be carried out via one or more relay stations, in particular a satellite control center as a service provider, or the corresponding position can be provided by this service provider.

[0014] A particularly advantageous embodiment of the method according to the invention provides for the participants to mutually validate their positions. This makes the method particularly secure.

[0015] According to a very advantageous development of the concept, a timestamp is automatically transmitted along with the notification of one's own position during communication. Based on this timestamp, corresponding signals can then be processed simply and efficiently to calculate the signal propagation times from the respective participant across multiple navigation satellites to the other participant or, if these are too far apart, via one or more relay stations, typically in the form of a satellite control center.

[0016] According to an extremely advantageous development of the method according to the invention, it can now also be provided that the communicated and / or determined position is validated using map data. This enables a further level of security. When validating the position using map data, it can be taken into account, for example, that the communicated and / or determined position deviates from a position communicated and / or determined shortly before or during the last communication. If the deviation is within a small distance, then this is probably not critical. However, if it is so far away that the subscriber is unlikely to have been able to cover this distance in the time between the two communications, this is already an indication that the subscriber's account has been hacked and that the subscriber was not personally involved in the communication.

[0017] When validating using map data, an advantageous development of the idea allows locations, distances, and / or time periods between stored locations and the current locations to be used. In addition to the example already mentioned above, locations can also be specified as particularly safe or unsafe. If, for example, communication is established between a service provider and a vehicle as a participant, workshops, the vehicle owner's own garage, or similar locations can be marked as safe locations. On the other hand, locations that cannot be reached by vehicle, for example, can be specified as illogical and therefore unsuitable for validation, such as mountainous regions, landscapes without roads accessible to the vehicle, or the like.

[0018] The method according to the invention can be used to secure any type of communication between participants, thus validating various accounts with physical characteristics of the participants in the form of their location. The method is particularly well-suited for securing communication between a vehicle manufacturer's service center and the vehicles manufactured by the manufacturer. Accordingly, according to a favorable application of the method according to the invention, the method is used to secure communication between vehicles or between servers and vehicles. This allows for the establishment of correspondingly secure communication, guaranteeing a very high level of security with regard to the transmitted data.The method according to the invention thus makes it possible to create a largely tamper-proof way to transmit important information from a vehicle manufacturer's server to the vehicle, for example, software updates with safety-relevant content, which include, for example, driving functions, driver assistance systems, autonomous driving functions, and the like. According to a very advantageous development of the use according to the invention, it can accordingly be provided that it is used for the transmission of software updates.

[0019] The invention also relates to a computer program product by means of which the method can be implemented.

[0020] Further advantageous embodiments of the method according to the invention also emerge from the exemplary embodiment which is described in more detail below with reference to the figures.

[0021] Showing: Fig. 1 an exemplary process for securing communication and for using the security by means of the method according to the invention; Fig. 2 a scenario for determining the position involving a satellite control center; and Fig. 3 an alternative scenario without a satellite control center.

[0022] In the presentation of the Fig. 1 is a schematic illustration of how the method according to the invention can function and be used, in various successive steps. Fig. 1 on the left is a participant 1 in the form of a vehicle 1, in the representation of the Fig. 1 on the right, for example, participant 2 is a service center 2 of the vehicle manufacturer or its backend server. Vehicle 1 communicates with the service center as participant 2 via a corresponding account. Its identification (ID) can be, for example, the vehicle identification number. In the example shown here, this is V1. In addition, vehicle 1 as a participant has a PIN, which is specified here purely as an example with N5. Service center 2 as a second participant also has an ID, which is specified here as an example with S2. The PIN of service center 2 is specified as an example with N6. In addition, both participants 1, 2 are in a corresponding position, i.e. are located at a geodetic position. This position is specified as P3 in the case of vehicle 1 as a participant, and as P4 in the case of service center 2 as a participant.

[0023] In a first step 100, a request is sent from the service center 2 to the vehicle 1 with the identification V1, for example, with the message that a software update is due. The vehicle 1, as a participant with the identification V1, now establishes communication with the service center via its account with the identification V1 and the corresponding PIN, and inquires who sent the message from the first step 100. This is shown in the Fig. 1, the second step 200. In the area of ​​the service center 2, the third step 300 now occurs, in which this service center communicates its current position P4 together with its identification and a time stamp T8. This data is transmitted to the vehicle 1 in the fourth step 400. In the fifth step 500, the vehicle 1 now calculates the physical position PP4 of the service center 2, for example, based on the time stamp T8 and the signal propagation times between the service center 2 and at least four satellites 3.1, 3.2, 3.3 and 3.4, which will be described in more detail later, and if necessary with the involvement of a satellite control center 4. At the end of this fifth step 500, it can then be checked whether the position PP4 thus calculated corresponds to the communicated position P4.If so, the communication is validated accordingly, and in return, the vehicle's own position is compiled with its own ID and its own timestamp T9 in a sixth step 600 and sent to the service center 2 in the seventh step 700, along with a confirmation of the validation from vehicle 1. If P4 and PP4 do not match, the communication from vehicle 1 is terminated in step 610.

[0024] In an eighth step 800, the check performed on vehicle 1 in the fifth step 500 is then also performed by service center 2. In this eighth step, designated here by 800, service center 2 determines the same data in the same way and then, without vehicle V1 being able to actively influence the determination of this value, arrives at a calculated position PP3. This position is then reliable, regardless of whether vehicle 1 has been hacked or not, just as the position PP4 of service center 2 was previously. If the determined position PP3 and the communicated position P3 are again the same in step 900, then service center 2 also performs the validation, which is communicated to the vehicle in a tenth step 1000. Otherwise, the process is aborted in step 910.

[0025] Following positive validation by both participants 1, 2, secure communication can then take place, for example in the step represented here with 1100 as bidirectional communication. The security of this communication is correspondingly high because, as already described at the beginning of the description, hackers' interference with this communication is virtually impossible or only possible with extreme effort due to the verification of the physical property in the form of the position of participants 1, 2. During this communication in the tenth step 1000, for example, the software update can then be installed from service center 2 to vehicle 1. It is possible to secure this communication with a one-time key that is only valid for the current communication, so that after the end of the communication, this key is also virtually worthless if it falls into the wrong hands.

[0026] In the presentation of the Fig. A first scenario can now be seen in Figure 2. As already mentioned, a vehicle 1 and the service center 2 are depicted as two participants on an indicated globe 5. In space above this globe 5, four individual satellites 3.1, 3.2, 3.3, and 3.4 are depicted. Furthermore, between the two participants 1 and 2 on Earth 5, there is the satellite control center 4, which is included in the communication as a type of relay station and service provider. In order to determine the position of the other participant, for example, service center 2 sends a short request via satellites 3.3 and 3.4, which are located above it, to control center 4: "Please tell vehicle 1 in position P3 where I am." In control center 4, the travel times of the data between service center 2 and satellite 3.4, as well as between service center 2 and satellite 3, are used to determine the position of the other participant.3 determines the position of the service center and, in the embodiment shown here, communicates this information to vehicle 1 via satellite 3.1. Vehicle 1 then uses the position thus obtained via control center 4 as position PP4 and compares it with the position P4 communicated directly by service center 2, for example, via a mobile data connection.

[0027] In the presentation of the Fig. 3 shows the same scenario again, without the need for the satellite control center 4 to intervene. The service center 2 sends a message to the vehicle 1 with its own time stamp and its own ID, preferably via four of the satellites 3.1, 3.2, 3.3 and 3.4. The satellites forward the message and the corresponding signal to the vehicle 1, which then automatically determines the position of the service center 2, i.e. the position PP4, based on the signal propagation times via the individual satellites, as shown in Fig. 1, can be calculated.

[0028] The situation is that in the scenario as it is presented in the Fig. 2, the satellite control center 4 plays an active role by determining the exact position of the satellites 3.3 and 3.4 from the signal propagation times between the service center 2 and the satellites 3.3 and 3.4, using its own known position, and transmitting it accordingly. Alternatively, it would of course also be conceivable that in this scenario, similar to the scenario of the Fig. 3. Satellite service center 4 would then function merely as a relay station and not as a service provider. It would then forward the data accordingly and assign its own timestamp, which would then replace the previous timestamp, enabling the calculation to be performed appropriately directly at participants 1 and 2.

[0029] In both scenarios, it is now possible for vehicle 1 to compare the two positions accordingly, i.e. to compare the position shown in the Fig. 1 executes step 500 accordingly and sends data in the opposite direction, enabling service center 2 to do the same in step 800. If all positions P3 and P4 have been correctly validated, secure communication is now possible without the high risk of communicating with an unauthorized participant.

Claims

[1] Method for securing communication between at least two participants (1, 2), each of which has an identification (ID) and a security (PIN), and thus communicates, preferably in an encrypted manner, wherein the participants (1, 2) exchange their identification (ID), wherein at least one of the participants (1, 2) communicates his position (P3, P4) to the other participant (2, 1) in addition to his identification (ID), wherein the position (PP3, PP4) of the participant (1, 2) is determined or queried by the other participant (2, 1), after which the other participant (2, 1) validates the participant (1, 2) based on a comparison of the communicated position (P3, P4) and the determined or queried position (PP3, PP4), characterized bythat the determined or queried position (PP3, PP4) of the subscriber (1, 2) is calculated from the signal propagation times between the subscriber (1, 2) and satellites (3.1, 3.2, 3.3, 3.4) using the time stamp (T8, T9) and at least four satellites (3.1, 3.2, 3.3, 3.4) are included in the calculation. [2] Method according to claim 1, characterized by that the participants (1, 2) validate each other about the position. [3] Method according to claim 1 or 2, characterized by , that With the notification of the position (P3, P4) a time stamp (T8, T9) is automatically transmitted. [4] Method according to one of claims 1 to 3, characterized by , that the transmission and / or calculation takes place directly or with the involvement of a satellite control center (4) as at least one relay station and / or as a service provider. [5] Method according to one of claims 1 to 4, characterized bythat the communicated and / or determined position (P3, P4; PP3, PP4) is validated using map data. [6] Method according to claim 5, characterized by that locations, distances and / or time periods between stored locations and current locations are used for validation via map data. [7] Use of the method for securing communication according to one of claims 1 to 6 for communication between vehicles (1) and / or servers (2) and vehicles (1). [8] Use according to claim 7, characterized by that the communication is used to transmit software updates. [9] Computer program product which is adapted to carry out a method according to one of claims 1 to 6.

Images