Patent Description:
In Intelligent Transportation Systems (ITS), communication between vehicles (classified as vehicle-to-vehicle (V2V)) or communication between vehicles and other traffic participants (vehicle to everything (V2X)) is becoming increasingly important. For many use cases, a direct communication via multicast or broadcast messages is necessary, whereby the authenticity and authorization of the messages as well as the anonymity or data protection of the vehicles are of primary importance. In addition, however, there will also be use cases where mutually authenticated and/or encrypted communication between two or a defined group of vehicles is also important.

Currently, there are numerous activities in standardization committees, industry committees, official/political institutions, etc. to specify such an Intelligent Transportation System and to expedite their widespread implementation. Vehicle-to-everything (V2X) communication is an important component of this, and "cellular"/mobile-based V2X communication is considered in this application.

3GPP has standardized LTE-based V2X communication services in Rel. The standards are being further developed for <NUM> as the latest mobile communications generation, which not only supports the existing use cases. <NUM> and later generations V2X communications will offer new application possibilities for V2X services, e.g. through even lower latency, higher data rates or greater reliability. Tus this invention is not limited to the current mobile communications generation.

V2X communication in intelligent transportation systems offers the standardised possibility that traffic participants (VT) in the intelligent transportation system can communicate directly with each other without involving the mobile radio infrastructure. The relevant V2X architecture has been standardised with <NPL>". The V2X-communication without involving the mobile radio infrastructure, like the V2X unmanaged mode <NUM> in LTE named PC5 Sidelink, is addressed in this application as broadcasting, whereby such broadcasted V2X-messages have a limited range (max. Anonymized certificates can be used for the V2X-communication, i.e. it is ensured that the messages are sent by authorized VT in the ITS, whereby the identity of the sender must not be determined.

There are use cases for traffic participants (VTs) where they need or want to prove their current location or their location at a certain point in time to a "location verification" application, e.g. a service of an official entity, an insurance company, other VTs, etc.. In doing so, the service categorically does not trust the VT when he submits his location without any proof.

Document <CIT> discloses gathering group information with data relating to location and time and sending it to a server. Document <CIT> discloses attributing certificates to the vehicles with the effect of securing the communications among said vehicles. Document <CIT> uses a device gateway to authenticate the location information.

It is an object of the present invention to provide a method for verifying a location of a traffic participant (VT) in an intelligent transportation system. A basic idea of the invention is to create an method where neither the service who requests the location verification nor the application (POS-App) which provides the service to the traffic participant (VT) have to trust the traffic participant (VT).

To achieve this object the present invention defines a method according to claim <NUM>. The key features of the inventive method according to claim <NUM> are, that.

Due to these key features the first traffic participant (VT1) can proof his location without been trusted by the application or the service he wants to use. When required or requested, the VT1 makes a location verification request within an ITS by means of a V2X broadcast message, e.g. using the PC5 sidelink. Therefore, a function/service has to be implemented in the ITS that supports the V2X broadcast requests and answers with this functionality. If necessary, this function/service must be introduced in the ITS.

A second traffic participant VTx who is within the range of the V2X broadcasted message, which is approximately <NUM>, then sends a corresponding answer. This response is also send by means of a V2X broadcast message, e.g. PC5 sidelink. The answer of the VTx contains the ID as a reference to the location verification request as well as the current location of the VTx and the current time information. The VTx signs this message with the key of his certificate in the ITS. Since V2X anonymized certificates are used, the VTx remains anonymous.

The VTx also sends his signature and certificate in the V2X answer message. After receiving the answer N-VTx, the VT1 can now send the answer of the VTx via the application to the service. The application POS-App provides a mobile network interface for access to the service, which could be a web application. The POS-App is possibly a part of a broader application of a provider.

Thus, a key feature of this method is that the verifier of the location of VT1 only must verify the signatures with the supplied certificates and therefore does not have to be registered in the ITS and does not even need a connection to the ITS. However, the ITS may only offer the service to registered applications with appropriate commercial agreements. This, and ensuring that only registered applications can use the service, if applicable, are out-of-scope of this invention.

The service can use the certificate of the VTx to verify that the information sent by the VTx are valid. If the verification is successful, the VT1 must be within the range of a message broadcasted by the VTx at the time information submitted by the VTx. To verify that the VT1 is in a certain time in the range of the message broadcasted by a VTx, which is as said above approximately <NUM>, only the broadcasted message of one VTx is sufficient.

Therefore, a location verification of the VT1 means that an area is determined in which the VT1 is located at a certain time. The range of the broadcasted answer of the VTx limits this area. If several VTx respond, the service can even determine the location of VT1 more precisely, especially when the time information sent by the several VTs lie in a short period of time. This preferred embodiment of the invention will be described in more detail later.

Any traffic participant VT named in this application communicates through a device. This device could be a device used by a person who participates in traffic, a device used by a vehicle or a device of an infrastructure (V2I communication). The device is able to communicate via "cellular"/mobile-based V2X infrastructure and to broadcast and/or receive messages via V2X-communication without involving the mobile radio infrastructure.

In a preferred embodiment of this invention, the application POS-App sends a location verification inquiry to the first traffic participant VT1. Thus, the location verification is only performed, when the application, e.g. triggered by the service, sends an inquiry. This contributes to data economy of the communication.

In another preferred embodiment, a challenge CH is sent along with the location verification inquiry. This challenge could be used for identifying the response to the location verification inquiry. Any indicator of the inquiry, e.g. a random number, could be used to identify the challenge.

Preferably, the first traffic participant VT1 broadcasts the challenge CH together with the location verification request and the broadcasted answer N-VTx of the second traffic participant VTx includes the challenge CH. This allows a better assignment of the several steps of the inventive method.

In an advantageously embodiment, the first traffic participant VT1 broadcasts the challenge CH as the message-ID (ID). In other words, the challenge CH is used as the ID for the location verification request, so that less data must be transmitted.

In a preferred embodiment, the first traffic participant VT1 sends his own time information t_VT1 and/or his own location information POS_VT1 together with the answer N-VTx to the application POS-App. Thus, the service receives a concrete location information, which may be trusted, when it is in the range verified by the answer N-VTx of the VTx.

Preferably, the time information t_VT1 of the first traffic participant VT1 and/or the time information t_VTx of the second traffic participant VTx is a time stamp. Such a time stamp enables the service to narrow the location of the VT1 more precisely.

In a very preferred embodiment answers N-VTa, N-VTb, N-VTc of a plurality of second traffic participants, here described as VTa, VTb and VTc are available and evaluated to verify the location of the first traffic participant VT1. Since the ranges of the answers are overlapping, this intersection is the area where the VT1 has his location at a certain time. Therefore, this embodiment allows to significantly narrowing down the area of location of the VT1, too. Thus, the inventive method is not limited to a specific number of second traffic participants.

In an advantageously embodiment, the evaluation of the location of the first traffic participant VT1 uses mathematical methods, based e.g. on the number of responses and/or the distribution of the positions of the other traffic participants, to further narrow down the location of the first traffic participant VT1. This feature allows to further narrowing down the area of location of the VT1.

Preferably, the location of the first traffic participant VT1 is evaluated by the application POS-App or by the service. In principle, the verification could be performed by the application, the service or another entity. If the application POS-App or the service verify the location of the VT1, time delay could be minimised.

A preferred embodiment of this invention is described in more detail. The two figures related to this preferred embodiment show some of the basic features of claim <NUM> together with some preferred features. However, the joint description of the preferred features shown in this embodiment do not restrict the specified basic features.

At the bottom of <FIG> a legend explains that broken arrows show broadcast communication of the VTs which does not use the mobile infrastructure and continuous arrows show the communication between the VT1 and the POS-App via mobile radio.

As described before the method is not limited to a certain number of second traffic participants VTx. <FIG> shows a plurality of traffic participants VT1, VTa, VTb, VTc and VTd registered in an ITC marked with the serial number [<NUM>]. A grey section R_VT1 displays the range of the request broadcasted by VT1.

In this embodiment, three of the second traffic participants VTa, VTb and VTc are located within the range of the broadcasted request. The fourth of the second traffic participants VTd does not receive the broadcast from VT1 as he is out of range.

The trigger for the process is set by VT1 who wants to use a service (arrow with serial number [<NUM>]) that is provided via a POS-App of a provider. The provider of the service or the POS-App determines that location verification is required (arrow with serial number [<NUM>]).

The technical process includes the following steps shown with arrows marked with the following serial numbers:.

The three second traffic participants VTa, VTb and VTc, which are in the range of the broadcast receive the request sent in [<NUM>]. Each of them generates, especially automatically, an answer as shown with arrows [<NUM>] - [<NUM>]. The answer includes the message-ID, the CH as well as the current location POS_VTa, POS_VTb or POS_VTc of the relevant second traffic participant VTa, VTb or VTc and the related current time stamp t_VTa, t_VTb or t_VTc.

This data is signed by the relevant second traffic participant with his certificate SIG_VTa, SIG_VTb or SIG_VTc as registered in the ITS. Every of the three answers N_VTa, N_VTb and N_VTc contains the data of the relevant VTx, his signature SIG_VTx and his VTx certificate Cert_VTx and is sent as a V2X broadcast message.

After VT1 receives the answers sent in [<NUM>] - [<NUM>], VT1 sends the three answers of the location request to the POS-App via mobile radio. While in the present embodiment three answers were transmitted, in general this communication must contain at least one answer N_VTx for the function of the method.

Optionally, VT1 may also send its own location and/or timestamp if it makes sense for the use case.

In [<NUM>] the POS-App verifies the three SIG_VTx signatures with Cert_VTx. Based on the POS_VTx, the POS-App can verify the POS_VT1 location or check its plausibility. If needed, the POS-App as well as the service can also verify the location of VT1 based on the POS_VTx more precisely.

<FIG> shows schematically the closer surroundings around a VT1 as described in <FIG>. At the certain time four VTx, namely VTa, VTb, VTc and VTd are positioned in the surroundings of VT1. Each of the VTs is the center of a circle, which shows the possible range for his broadcasted messages, e.g. the second traffic participant VTb is surrounded by the circle with the range R_VTb.

Claim 1:
Method for a location verification in an intelligent transportation system, ITS, by broadcasting vehicle to everything, V2X, communication, wherein a number of traffic participants are registered in the intelligent transportation system, ITS, wherein a first traffic participant, VT1, uses a service made available by an application, POS-App, of a provider and wherein the service needs a location verification of the first traffic participant, VT1, said method comprising steps in that:
- the first traffic participant, VT1, broadcasts a vehicle to everything, V2X, message with a location verification request and a message-ID, ID,
- at least one second traffic participant, VTx, receives the message broadcasted by the first traffic participant, VT1,
- the second traffic participant, VTx, generates data for an location verification of the first traffic participant, VT1, the data include the message-ID, ID, a location information of the second traffic participant, POS_VTx, and a time information, t_VTx,
- the second traffic participant, VTx, signs the data with his VTx-certificate, Cert_VTx, provided in the intelligent transportation system, ITS,
- the second traffic participant, VTx, broadcasts an answer, N-VTx, to the location verification request of the first traffic participant, VT1, including the data, the signature, SIG_VTx, of the data and the VTx-certificate, Cert_VTx, of the second traffic participant, VTx,
- the first traffic participant, VT1, receives the answer. N-VTx, broadcasted by the second traffic participant, VTx,
- the first traffic participant, VT1, sends the answer, N-VTx, of the second traffic participant, VTx, to the application, POS-App, of the provider and
- the application, POS-App, of the provider receives the answer, N-VTx, of the second traffic participant, VTx, sent by the first traffic participant, VT1, and the location position of the first traffic participant, VT1, is verificated by evaluating the answer, N-VTx, of the second traffic participant, VTx.