METHOD FOR VALIDATING GNSS POSITION SIGNALS

Description

[0001] The invention relates to a method for verifying the plausibility of position signals from a global satellite navigation system in a signal receiver, in particular vehicles or land vehicles.

[0002] In the current state of the art, the use of a global navigation satellite system (hereinafter referred to as GNSS), possibly supported by additional vehicle sensors, with the vehicle sensors potentially being fused together, is a common method for determining the vehicle's own position. Typically, the receiver or sensor of the GNSS position signals is the only sensor that provides the vehicle's own position or absolute position. It also provides a global time base that can be used to synchronize multiple sensors or systems, or Car2X / Vehicle-to-X (hereinafter referred to as V2X) systems. Unlike sensors installed in the vehicle, such as the IMU, wheel speed sensor, etc., the GNSS sensor is influenced by the environment and can be disrupted externally (even without modification of the vehicle hardware). In addition to inherent interference such as shadowing and the so-called...In multipath systems, the GNSS sensor can be deliberately disrupted (jammer) or manipulated (spoofer).

[0003] Jammers can, for example, overlay the GNSS position or data signals with artificial noise, effectively interrupting GNSS reception and preventing a GNSS fix (position resolution). This is equivalent to a shadowing effect and is temporarily non-critical for localization. Spoofers, on the other hand, feed the system false positions by transmitting recorded or artificially calculated GNSS signals. The GNSS sensor cannot detect that these are falsified signals. The result is an incorrect position determination and an incorrect time base. A system disrupted in this way can interfere with V2X communication and even transmit errors to other vehicles. This can create a security vulnerability for the V2X system.If the spoofer data is not only fed directly into the system but also transmitted wirelessly, the forgery spreads throughout the entire environment and is present in all systems.

[0004] The reasons for using jammers or spoofers are varied and range from private interests – for example, not wanting to be tracked or monitored – to economic interests, such as faking maximum speeds, rest / break times, road connections used and toll booths, etc.

[0005] If the fake GNSS position signals are not only fed directly into the spoofer's system, but also transmitted via radio, as is common with inexpensive GPS jammers, the manipulations will not only affect the user's own vehicle, but all vehicles in the vicinity, or the entire system can be manipulated from the outside within a certain range.

[0006] DE102007008853A1 describes a method for detecting a deception field. The deception of a GPS receiver is achieved by offsetting the transmitted data. An actual satellite navigation signal is received by a position sensor at location A, transmitted to a deception field transmitter, and processed by the transmitter, which is located at a distant location B. A deceived GPS receiver can detect the existence of the deception by observing a jump in the time derived from the signal. Such a time signal can be calculated from the signals received by the navigation receiver.

[0007] The document Jovanovic Aleksandar et al., "Multi-test detection and protection algorithm against spoofing attacks on GNSS receivers", 2014 IEEE / ION Position, Location and Navigation Symposium - Plans 2014, IEEE, May 5, 2014, refers to spoofing attacks on GNSS receivers on pages 1258-1271. Spoofing signals can be generated by satellite simulators, and there are three different types of attacks: signal synthesizer type, replay type, and smart spoofer type. The first type is easily identifiable. The second type is based on receiving a GNSS signal and forwarding it after a short delay. The third type transmits signals that exhibit characteristics similar to those of real satellites. In a PTD (Post-Temperature Detection) attack, the C / N0 statistics are recorded; if the value exceeds a threshold, an alarm is triggered. The Doppler shift can also be taken into account. A consistency check is performed during an SCT procedure.The GNSS receiver stores data about location and time and can detect abrupt changes during navigation, or inconsistencies, and then switch to an alarm mode.

[0008] DE102011106591A1 describes a method for determining the position of a GNSS receiver whose function is being deliberately disrupted by an interference source. Interference sources include jammers and spoofers. In this system, a sensor unit is positioned at predetermined points along roadways, where the sensors detect an interference signal. These roadways can include border crossings, toll booths, parking lots, etc. The position of the vehicle is then determined from the location of the roadway point.

[0009] The documents JAFARNIA-JAHROMI ALI ET AL: "GPS Vulnerability to Spoofing Threats and a Review of Antispoofing Techniques", INTERNATIONAL JOURNAL OF NAVIGATION AND OBSERVATION, Vol. 2012, July 18, 2012, and HENGQING WEN ET AL: "Countermeasures for GPS Signal Spoofing", PROCEEDINGS OF ION GPS / GNSS, No. 18th, September 13, 2005, pages 1285-1390, describe various methods for detecting spoofing attacks on GNSS receivers.

[0010] The GPS (Global Positioning System) in civilian applications does not offer a systemic way to detect falsified data, provided that it is meaningful and consistent and is not filtered out by the plausibility check.

[0011] The object of the invention is therefore to demonstrate an efficient method by which received position signals can be checked for their plausibility.

[0012] This task is solved by the subject matter of the independent claim. Possible variations are described in the dependent claims.

[0013] A first aspect of the disclosure includes a method for verifying the plausibility of position signals from a global satellite navigation system in a vehicle, comprising at least one detection system for detecting objects in the vicinity of the vehicle and a receiving device for receiving the position signals, comprising the steps: Receiving the position signals using the receiving device and determining the vehicle's own position based on the position signals, detecting at least one object in the environment using the detection system and determining the object's position, verifying the plausibility of the position signals by comparing at least one object's position with the vehicle's own position.

[0014] The first aspect of the disclosure is based on the fundamental idea that the vehicle's own position can be estimated using the positions of objects in the surrounding environment. This estimate is independent of the GNSS position signals and sufficiently precise to validate those signals. The detection system is therefore a system that, in principle, functions independently of determining the vehicle's own position via the GNSS position signals.

[0015] To compare the position of an object with the vehicle's own position based on GNSS position signals, various plausibility criteria can be used. In the simplest case, a radius around the vehicle's own position is used. If the objects lie within this radius, the position signals can be validated. The tolerance ranges inherent in position determination via GNSS itself must also be considered. Assuming that spoofers intend to falsely report a position, validation can be denied if the deviation of the vehicle's own position from the object's position is several kilometers. Alternatively, it is also conceivable to establish smaller comparison thresholds. These could advantageously be combined with other situation-dependent criteria, such as the same direction of travel, road type, etc.

[0016] The step of capturing an object and determining its position via a message sent by the object itself is particularly preferred. This can be done, for example, via a V2X message in which the object describes itself and its position.

[0017] In its most general form, the detection system is a system for capturing positional information of abstract or tangible objects, such as traffic lights, buildings, or digital data transmitted via electromagnetic waves.

[0018] According to an advantageous embodiment of the method, the detection system comprises a camera device and is designed for the visual detection of objects, in particular landmarks such as road signs, town signs, etc. In this way, a wide variety of visually detectable objects can be detected by the vehicle, provided their positions are known. Alternatively, the use of radar or lidar systems is also conceivable; these systems do not detect objects visually, but can detect them based on their specific signals.

[0019] According to an advantageous embodiment of the method, the respective position of objects can be retrieved from a local map or from an external server.

[0020] According to an advantageous embodiment of the method according to the invention, the detection system comprises a vehicle-to-X or V2X communication device for receiving objects in the form of V2X messages containing the position of a sender of the V2X message. The exchange of position data with stationary objects whose position does not change and is ideally determined by a trusted entity, e.g., a government or public institution, is particularly advantageous.

[0021] According to an advantageous embodiment of the method, verified and / or signed V2X messages are used for plausibility checks. This ensures the authenticity of the V2X and the accuracy of the position data.

[0022] According to an advantageous embodiment of the method, the detection system comprises a motion sensor, particularly for detecting accelerations. In this way, road irregularities with a characteristic acceleration profile can be used to determine the vehicle's position. The detection of fixed road irregularities, such as speed bumps, whose position typically does not change, is particularly advantageous.

[0023] According to an advantageous embodiment of the method, the detection system detects one of the objects from the following group: Infrastructure features such as traffic signs, traffic lights, toll stations, tunnels, signposts, town signs, points of interest (POIs) such as public facilities, shops, parking garages, and / or road irregularities.

[0024] A second, unclaimed aspect of the disclosure relates to a method for verifying the plausibility of position signals from a global satellite navigation system for determining the self-position of a signal receiver, in particular a vehicle, which has a receiving device for receiving multiple position signals, comprising the steps: Receiving the position signals using the receiving device, analyzing the relative movements between the signal receiver and several signal transmitters of the position signals and / or analyzing the relative movements between several signal transmitters to each other based on the respective position signals, checking the plausibility of the position signals if there is no correlation between the relative movements.

[0025] The second aspect of the revelation is based on the understanding that real or regular position signals from GNSS satellites move independently relative to the signal receiver. The relative movements of the satellites to the signal receiver are not dependent on each other and do not correlate. Similarly, the probability is that those satellites visible to a signal receiver move in a dependent manner. While it is possible for multiple satellites to be present in an orbit, and thus dependencies can occasionally occur, this case generally differs significantly from the case where a spoofer simulates multiple position signals emanating from a single signal transmitter. Since there is only one signal transmitter in this case, the relative movements of the simulated transmitters or sources correlate with each other and also relative to the signal receiver.To verify the plausibility of the position signals, different thresholds of correlations between the relative movements can therefore be set.

[0026] According to an advantageous embodiment of the non-inventive method, the relative motion between the signal receiver and each signal transmitter is determined by means of a Doppler effect and / or phase measurement and / or a measurement of the delta ranges of the respective received signals. Delta ranges are understood to be a change in distance or the relative velocity between a satellite and a signal receiver, e.g., a vehicle.

[0027] According to an advantageous embodiment of the non-inventive method, the signal receiver determines the signal strength for each position signal. In addition to or as an alternative to the aforementioned embodiment, this provides a further means of detecting spoofers. The signal strength of the position signals emitted by spoofers is generally uniform and significantly stronger than that of genuine position signals from GNSS satellites. In particular, the uniform change, i.e., the increase or decrease in signal strength, of the different position signals can be used to detect a spoofer.

[0028] According to an advantageous embodiment of the non-inventive method, the direction from which the respective signal, e.g., a satellite position signal or another signal from a V2X communication participant, is received is determined based on the signal strengths, whereby the position signal is validated if no other position signal is received from substantially the same direction. The term "substantially the same direction" encompasses a tolerance range that defines the expected direction of reception. In three-dimensional space, it is not possible for two satellites to transmit their position signals from the same direction. They differ in at least one of the spatial directions or vectors. This is different with distorted position signals from a spoofer, which generally all originate from one direction.

[0029] According to an advantageous embodiment of the method not according to the invention, the receiver has an antenna arrangement with at least one directional antenna and / or several antennas. In this way, different analyses of the position signals can be carried out.

[0030] A third aspect of the disclosure includes a method for verifying the plausibility of position signals from a global satellite navigation system in a signal receiver, in particular a vehicle, which includes a receiving device for receiving the position signals, comprising the steps: Receiving the position signals to determine the signal receiver's own position, comparing the position signals with previous position signals of the signal receiver, and verifying the plausibility of the position signals if there is no abrupt change in the properties of the received position signals compared to the properties of previous position signals.

[0031] The previous position signals were validated through the following steps: Detecting at least one object in the environment using the detection system and determining the object's position, and verifying the plausibility of previous position signals by comparing at least one object's position with the signal receiver's own position.

[0032] The third aspect of the revelation is based on the understanding that position signals propagated by spoofers, unlike genuine GNSS satellite signals, spread over a limited area and are therefore detectable by a vessel through comparison with previous position signals. By using previously received, especially validated, position signals, abrupt changes in the characteristics of the position signals can be readily identified. By adjusting the jump thresholds, implausible jumps in the position signals can then be detected.

[0033] According to an advantageous embodiment of the method, the characteristics of the position signals include information about the time or clock used by the transmitter, or the timestamp of the position signal. A particular problem with position signals is the precise synchronization of the spoofer's time signal with the actual satellite time. Therefore, this method can also be used to verify the plausibility of the position signals.

[0034] According to an advantageous embodiment of the method, the position signals are made plausible if there is no abrupt change in the own position determined on the basis of the position signals compared to the previous own positions.

[0035] According to an advantageous embodiment of the method, the procedure is carried out using an infrastructure device, in particular traffic lights. Two alternatives are conceivable here. According to a first alternative, the infrastructure device has a receiver for receiving GNSS position signals. In this way, spoofers can be easily detected by comparing the self-position derived from the position signals with the stored self-position of the infrastructure device. Detection of fake GNSS position signals is thus possible, since these do not correspond to expectations and exhibit jumps. An infrastructure can detect a discrepancy and thus fake GNSS by comparing the position and time determined via GNSS with the stored position and an undisturbed network connection, which is equivalent to an undisturbed or true time signal.If the spoofer also includes the falsified location data in V2X messages, a V2X-enabled infrastructure can detect the spoofer via the incorrect location information in the V2X message and, if necessary, warn following vehicles. By comparing its own position and time with the transmitted position and time from an infrastructure, preferably one that is transmitted securely and encrypted, a discrepancy and thus manipulation of the vehicle can be detected.

[0036] According to an advantageous embodiment of the method, the method is carried out in a vehicle, wherein the position signals are additionally validated by means of a method according to one of the preceding embodiments as described in the first and / or second aspect of the disclosure. This embodiment makes it possible to validate the position signals even if a vehicle remains within the range or transmission range of the spoofer position signals for an extended period of time, and thus it is not possible to detect implausible position signals by comparison with older position signals.

[0037] According to an advantageous embodiment of the method, in the event of a sudden change in the properties of the position signals and / or the own position, depending on the direction of the change, an entry into or exit from an area or transmission area with a signal transmitter that sends implausible position signals is determined.

[0038] In the borderline area between "good" reception and "manipulation", data from both areas is received via V2X, which do not match, thus revealing manipulation even if the vehicle itself is continuously in the manipulated area and cannot detect any jumps in its own received position signals.

[0039] According to an advantageous embodiment of the method, a signal transmitter sending implausible position signals is identified using a handshake or verification procedure. The handshake procedure comprises a secure transmission of a randomly generated message via V2X, to which a correct response is received with reference to the random content. The random content should include the transmitter's own position and time, as well as the position and time and confirmation information of the receiving station, and a random number that must be identical in both messages. This prevents replay attacks that cannot respond correctly to the random content, or that respond correctly but detect manipulation through contradiction or plausibility checks.

[0040] According to an advantageous embodiment of the method, a signal transmitter that sends implausible position data is identified by means of tracking or a process of elimination.

[0041] According to an advantageous embodiment of the method, the aforementioned method is carried out by means of an external system which receives movement information from vehicles that have a V2X communication device.

[0042] The invention is described in more detail below with reference to exemplary embodiments and figures. These show: Figure 1 is a schematic representation of a vehicle for carrying out the methods according to the invention, and Figure 2 is a schematic representation of a driving situation with a vehicle for carrying out the methods according to the invention.

[0043] In the figures, identical technical elements are labelled with the same reference symbols and described only once.

[0044] It will be on Fig. 1Referring to a schematic diagram of a vehicle 1 with a chassis 4 mounted on wheels 6 in a Fig. 2 The indicated direction of travel 5 is carried in a drivable manner.

[0045] To determine the self-position or absolute position of the vehicle 1, the vehicle 1 receives several position signals 112 from several GNSS satellites 110 via a GNSS antenna system 16 known per se, cf. Figure 2 In Figure 1Only one satellite 110 is shown as an example. A receiving device 10 is connected to the antenna device 16 and evaluates the position signals 112 in such a way as to determine its own position. The absolute position is generally derived in a manner known to those skilled in the art from the position signals 112 transmitted by GNSS satellite 110. In this example, the antenna device 16 and the receiving device 10 are shown and described separately. However, it is also conceivable that both parts are integrated into a single receiving device.

[0046] Furthermore, vehicle 1 has a detection system 2 for detecting objects and verifying its own position. Detection system 2 comprises several components 18, 24, 16, and 10. The configuration of detection system 2 described in this example represents only one possible configuration. Depending on requirements, detection system 2 can be equipped with fewer or more components, which can be determined, for example, based on the procedures to be executed.

[0047] Firstly, the detection system has several motion sensors in the form of an inertial sensor 18, which records vehicle dynamics data 20 of the vehicle 1. This includes, as is known, longitudinal acceleration, lateral acceleration, vertical acceleration, roll rate, pitch rate, and yaw rate of the vehicle 1. In the present embodiment, this vehicle dynamics data 20 is used to increase the information content 12 about the vehicle 1's own position and, for example, to refine the position and speed of the vehicle 1 on the road 13. The refined data can then be used by a navigation device even if the GNSS position signal 101 is unavailable, for example, under a tunnel.To further increase the information content of the self-position, additional motion recording sensors in the form of wheel speed sensors 26 can optionally be used, which record the wheel speeds 28 of the individual wheels 6 of the vehicle 2.

[0048] Furthermore, the detection system 3 includes another sensor cluster 24 for detecting physical objects. Sensor cluster 24 comprises a camera, a radar, and a lidar system and enables the detection of objects in the vehicle's vicinity. The data 22 from sensor cluster 24 can then be used in the evaluation unit 8 to recognize or identify the objects and determine their position.

[0049] Furthermore, the acquisition system includes a V2X communication device, which in this embodiment is integrated into the antenna device 16 and the receiver 10. It should be noted that, for the purposes of the invention, V2X messages 30 are understood as objects. The antenna 16 is also used to receive and transmit V2X messages 30. The receiver 10 has a partition for reading and processing the V2X messages 30. In this way, for example, the position information contained in the V2X messages 30 can be read out. In addition, the receiver 10 enables the verification of signatures of the V2X messages as well as the execution of handshake or verification procedures with other V2X communication participants.The evaluation unit 8 receives data and information about the vehicle's own position and its surroundings from the various components 18, 24, 16, 10 of the detection system 2 and compares this data with each other. Several methods are provided for verifying the vehicle's own position, which can be executed individually or in combination depending on the configuration of the evaluation unit 8.

[0050] The following section discusses the individual plausibility checks and... Figure 2 received.

[0051] Figure 2The following driving situation is depicted. Vehicle 1 is driving on road 13 in the direction of arrow 5. Within the vehicle's field of vision are four GNSS satellites: 110, 120, 130, and 140, each moving in its respective orbit 111, 121, 131, and 141. Each of the satellites 110, 120, 130, and 140 transmits position signals 112, which vehicle 1 can use to determine its own position. For clarity, the position signals 112 are shown only for satellite 110. Satellites 120, 130, and 140 also transmit position signals in the same way.

[0052] In addition to satellites 110, 120, 130, and 140, there is another position signal transmitter in the form of a spoofer 15f, which transmits inauthentic or falsified position signals 14f. The spoofer 15f transmits its falsified position signals 14f within a transmission range 17f, which is limited to the vicinity of the spoofer 15f and varies depending on the transmission power. However, if vehicle 1 is located within the transmission range 17f, the position signals 112 from satellites 110, 120, 130, and 140 are overwritten. This can lead to the vehicle's position being determined even if it is located in a completely different location.

[0053] The spoofer 15f can, for example, be a stationary or moving vehicle on road 13. The direction of movement of the spoofer 15f is indicated by arrow 5f. Similar to satellites 110, 120, 130, and 140, the spoofer 15f emits internally plausible position signals 14f, which are sufficient to determine the vehicle's own position. However, the position signals 15f do not originate from different signal transmitters, as is the case with satellites 110, 120, 130, and 140. Therefore, although the vehicle's own position can be determined, it does not correspond to the vehicle's actual position. The incorrect position could deviate by several kilometers compared to the actual position.

[0054] According to a first embodiment, a check or the plausibility of the position signals 14f can be carried out using the following steps.

[0055] First, the position signals 14f of the spoofer 15f are received via the antenna assembly 16 of the receiver 10. The receiver 10 uses the spoofer position signals 14f to determine the vehicle's own position in the same way as regular position signals are used to determine the vehicle's own position.

[0056] In parallel, the detection system 2 detects several objects 66, 64 in the surroundings and determines their positions. In this example, the vehicle 1 detects the traffic light 66 using the camera system of the sensor cluster 24. The cobblestone street 64 is detected via the inertial sensors 18. While the latter only allows for a localization of the respective object in a specific area, it can be sufficient for plausibility checks. Other road irregularities, such as a manhole cover 70 or road ramps 72, enable more precise localization of the object and thus of the vehicle's surroundings via the motion sensors. The respective position of objects can be retrieved, for example, from a local map or from an external server. It is also conceivable that the traffic light is equipped with a V2X communication device and sends V2X messages 67 describing the traffic light's position. It is particularly advantageous if the messages 67 are signed.Additionally or alternatively, it is conceivable that certain objects, such as town entrance signs or directional signs, are detected by the camera system and their content is analyzed by the evaluation unit. In this way, the position of vehicle 1 can be determined precisely based solely on the detection of the object.

[0057] By comparing the positions of traffic light 66 and cobblestone street 64 with the vehicle's own position, it can be determined that there is a deviation between the vehicle's own position and the positions of the objects, for example, on the order of several kilometers. Since this deviation is significantly above the error tolerance of GNSS, the position signals 14f are recognized as implausible and are not used for applications within the vehicle. Additionally, a warning can also be issued via V2X messages.

[0058] Particularly useful objects for verifying the plausibility of one's own position include, among others... Infrastructure features such as traffic signs, traffic lights, toll stations, tunnels, signposts, town signs, points of interest (POIs) such as public facilities, shops, parking garages, and / or road irregularities.

[0059] A second example of how to verify the plausibility of the self-position is described below.

[0060] In the first step, as described above, the position signals 14f are received and the vehicle 1's own position is determined from them.

[0061] The received position signals 15f are analyzed by measuring the Doppler effect or the phase or delta range (distance changes), as is already known from the distance measurement of GNSS position signals. These measurements allow the relative motion between the signal receiver or vehicle 1 and the signal transmitter to be determined. As a rule, the relative motion of satellites 110, 120, 130, 140 to vehicle 1 can be determined from the satellite position signal 112. Since each satellite 110, 120, 130, 140 moves independently on its own orbit 111, 121, 131, 141, there is no correlation between these relative motions. In the case of the spoofer 15f, however, it can simulate multiple signal transmitters.However, these all originate from the same source, so the relative movement between the simulated signal transmitters and vehicle 1 shows a correlation, i.e., the relative movements are dependent on each other.

[0062] If such a correlation is found, it is possible to infer the existence of fake position signals 14f and these should not be validated.

[0063] Additionally or alternatively, the signal strength and / or direction can serve as a basis for determining the plausibility of the position signal 14f. The signal strengths can also be used to determine the direction from which the respective position signal is received. The position signal 14f is only considered plausible if no other position signal is received from essentially the same direction. For this purpose, it is advantageous to equip the antenna system 16 with at least one directional antenna and / or several antenna modules. If the direction from which the position signals of the actual satellites must originate is known, a position signal can be validated in this way based on its direction.

[0064] A third example of how to verify the plausibility of the self-position is described below.

[0065] In the first step, as in the previous embodiments, position signals 14f are received to determine the own position of the signal receiver or vehicle 1.

[0066] In the second step, these position signals 14f are compared with previous or older position signals from vehicle 1. This step can be performed, for example, in the evaluation unit 8. Previous or older position signals are defined as those received earlier. The applicable time period for the older position signals can be predefined or selected depending on movement activity, e.g., the vehicle's speed. Alternatively, position signals that have already been validated using other methods, such as the two aforementioned embodiments, can also be used.

[0067] In this way, the situation for vehicle 1 is as follows: Figure 2The following situation arises. Vehicle 2 is currently transitioning from the transmission range of the regular GNSS satellites 110, 120, 130, 140 into the transmission range 17f of spoofer 15f. The two different transmission ranges could also be defined as regular and irregular, or authentic and non-authentic.

[0068] If the vehicle moves from a regular transmission range into the irregular transmission range 17f, the properties of the position signals change, such as phase, propagation time, timestamp, and other information contained in a GNSS position signal, because the spoofer 15f cannot perfectly synchronize the satellites with reality. Ultimately, the vehicle's own position also changes. These changes in properties are abrupt, so that a transition from a regular transmission range to an irregular transmission range 17f is recognizable due to this change pattern, and the position signals 14f should not be validated.

[0069] If a vehicle remains within the irregular transmission range 17f for an extended period, the plausibility of the position signals 14f cannot be verified using this method. In such cases, the aforementioned embodiments can be useful for verifying the plausibility of the position signals 14f. Therefore, a combination of these embodiments is particularly advantageous. In particular, the exchange of V2X messages containing position data enables a vehicle to perform a plausibility check even in such a situation.

[0070] The embodiment described here is not limited to application in a vehicle. The method can also be implemented particularly advantageously in an infrastructure facility. For example, a traffic light 66 could be equipped with a GNSS position signal receiver. When a spoofer 15f passes by, this receiver would compare its position signals 14f with its own position signals, position information, or position data. Since the position of the traffic light 66 does not change, this information could be used as a fixed reference point. A GNSS position signal 14f that results in a different position could thus be quickly identified as a spoofer 15f.

[0071] In the event that the spoofer 15f is a vehicle equipped with a V2X communication device, which, in addition to the falsified position signals 14f, also sends V2X messages with correspondingly false position information, it would be helpful to implement a handshake or verification procedure. The handshake procedure comprises the following steps: Sending a request from a first vehicle to a second vehicle with a variable or random size, wherein the expected response to the request from the second vehicle to the first vehicle depends on the variable or random size, receiving the response from the second vehicle by the first vehicle, and checking the response depending on the variable random size.

[0072] Since a spoofer would routinely or by default falsify its V2X messages with position information, this fact could be exploited to detect the spoofer. A request containing a variable or random value regarding the position information could then be incorrectly answered by a spoofer, resulting in a failed handshake.

[0073] A Spoofer 15f can be reliably detected by assessing its plausibility or lack thereof. Based on this, various solutions can be implemented in a V2X network to track the Spoofer 15f.

[0074] One possibility is to examine the direction of any abrupt change in the properties of the position signals and / or the vehicle's own position to determine whether it has entered or exited an irregular area. In heavy traffic, this allows the boundary of the irregular transmission area 17f to be quickly identified. This information is then logically forwarded to an external evaluation system that aggregates and analyzes the data. By contextually filtering the information, for example, by direction of travel, vehicle speed, etc., this system could narrow down the pool of suspect vehicles to the point where, ideally, one vehicle is identified as the spoofer 15f. This vehicle could then be further tracked via V2X by appropriately authorized bodies.

[0075] It should be noted that the architecture of the acquisition system 2 described here is only an example, and the described functions and methods can be implemented based on other architectures. The invention is therefore not limited to the example described here.

Claims

1. A method for checking the plausibility of position signals (112, 14f) of a global satellite navigation system in a vehicle (1), the method comprising at least one detection system (2) for detecting objects in an environment of the vehicle and a receiving device (16, 10) for receiving the position signals (112, 14f), comprising the steps: - receiving the position signals (112, 14f) with the receiving device (16, 10) for determining the vehicle's own position (1), - comparing the received position signals (112, 14f) with previous position signals of the vehicle (1), - checking the plausibility of the received position signals (112, 14f) if there is no abrupt change in the properties of the received position signals compared to the properties of the previous position signals; wherein the previous position signals were received by means of the receiving device (16, 10) and were checked for plausibility by the following steps: - detecting at least one object in the environment of the vehicle using the detection system (2) and determining the position of the object, - checking the plausibility of the previous position signals by comparing the determined position of the at least one detected object with the vehicle's own position as determined based on the previous position signals (1).

2. The method of claim 1, wherein the properties of the position signals comprise information about the time or clock used by the transmitter.

3. The method of any one of the preceding claims, wherein the position signals (112, 14f) are deemed plausible if there is no abrupt change in the vehicle's own position as determined based on the position signals (112, 14f) compared to its previous own positions.

4. The method of any one of the preceding claims, wherein the method is carried out by means of an infrastructure facility, in particular traffic lights (66).

5. The method of any one of the preceding claims, wherein, in the event of an abrupt change in the properties of the position signals and / or the own position, an entry or exit from an area with a signal transmitter that sends implausible position signals is determined depending on the direction of the change.

6. The method of any one of the preceding claims, wherein a signal transmitter (15f) that sends implausible position data is identified by means of tracking.

7. The method of claim 6, wherein the method is carried out by means of an external evaluation system which receives movement information from vehicles which have a vehicle-to-X communication device.

8. The method of any one of the preceding claims, wherein the step of detecting an object and determining the position of the object is carried out via a message sent by the object itself.

9. The method of any one of the preceding claims, wherein the detection system comprises a camera device and is designed for the visual recognition of objects.

10. The method of any one of claims 1 to 8, wherein the detection of an object is carried out by means of a radar system and / or a lidar system.

11. The method of any one of the preceding claims, wherein the respective position of objects can be retrieved from a local map or from an external server.

12. The method of any one of the preceding claims, wherein the detection system comprises a vehicle-to-X communication device for receiving objects in the form of vehicle-to-X messages with a position indication of a transmitter of the vehicle-to-X message.

13. The method of any one of the preceding claims, wherein the detection system detects one of the objects from the following group: - infrastructure devices, - points of interest, and / or - road irregularities.