DE102017213298A1 - Data transmission to a motor vehicle - Google Patents

Abstract

The present invention relates to a method for the wireless transmission of data to a motor vehicle (motor vehicle) with a motor vehicle sensor device (3), namely from a communication partner (KP, KP motor vehicle) with a KP emitter device (1), in which method - the KP emitter device (1) emits a KP signal (2), - a first (2a, 2aa, 2ba) and a second KP signal component (2b, 2ab, 2bb) of the KP signal (2) under one Angles (α) to each other on the vehicle sensor device (3) of the motor vehicle (motor vehicle) fall, - the motor vehicle sensor device (3) the first (2a, 2aa, 2ba) and the second KP signal portion (2b, 2ab, 2bb) direction-resolved receives the directionally resolved KP signal components (2a, 2aa, 2ba, 2b, 2ab, 2bb) for KP emitter authentication by means of triangulation at least indirectly a place of origin and thus the KP emitter device (1) are assigned.

Description

Technical area

The present invention relates to a method for wireless data transmission to a motor vehicle.

State of the art

In the course of the data transfer in question in this case, for example, information about the traffic situation or distance warning, in particular also for accident warning or for warning of danger can generally be transmitted wirelessly to the motor vehicle. The communication partner can be another motor vehicle (however, the invention is generally not limited to this as well as the information content just mentioned).

Presentation of the invention

The present invention is based on the technical problem of an advantageous method for the wireless transmission of data from a communication partner ( KP ) to a motor vehicle ( automotive ).

According to the invention this object solves a method according to claim 1, wherein one of the communication partner emitted KP Signal by means of triangulation at least indirectly a place of origin and thus the communication partner or the latter KP -Emittervorrichtung be assigned. Specifically, that contains KP Signal (at least) a first and a second signal component, and fall these signal components at an angle to one another automotive Sensor device of the motor vehicle. Of the automotive Sensor device will be the automotive Receive signal components direction resolved (see below in detail), which figuratively speaking (at least) two mutually tilted connecting lines between KP Emitter and automotive Sensor device results. These connecting lines (signal components) span a triangle with one another, wherein the communication partner can be located at a side edge or a corner thereof (see below in detail). In any case, the signal components can be assigned to the place of origin via this triangle (this means triangulation) and can thus be used to identify and authenticate the communication partner. It can thus be ensured that the signal actually comes from the communication partner.

Preferred embodiments are to be found in the dependent claims and the entire disclosure, wherein the presentation does not always distinguish in detail between process or device aspects; In any case, implicitly, the disclosure must be read with regard to all categories of claims, in particular always with regard to the method as well as to a suitably arranged motor vehicle or a set of several motor vehicles.

The triangulation is in principle a bearing, in which the communication partner is located on the basis of at least two mutually tilted signal components. A "signal component" is considered to be what is emitted by the emitter device, then to fall onto the sensor device and also be received in a directionally resolved manner, that is to say assigned to a specific direction and thus to the emitter device ("receive" means to measure and evaluate, respectively).

In principle, a completely directed signal is also conceivable, which then exclusively contains the signal components, for example in each case as a laser beam between emitter and sensor device. In general, however, the signal will be non-directional or only partially directed, so it may contain components that are not on the sensor device or even not on the automotive fall; These components then do not constitute a "signal component" in the above sense. The signal can, for example, also be emitted by a single emitter of the emitter device as a single signal, in which case the first signal component is received with a first sensor of the sensor device and the second with a second sensor signal component. The first and the second sensor are spaced from each other, the distance corresponds to a side edge of the triangle spanned by the measurement.

However, the signal can also be composed of a plurality of individual signals, wherein each individual signal is emitted by a separate emitter of the emitter device. Based on a sensor of the sensor device, there is then a respective signal component of each of the emitter to this sensor; Preferably, there are also several sensors, so can pull more than two connecting lines and are accordingly spanned several triangles. For illustration, reference is also made to the embodiments according to the 1 and 3 and the related description.

The signal components used to authenticate the emitter by locating it are tilted relative to each other, thus enclosing an angle with each other. In detail, this angle also depends on the distance between the motor vehicle and the communication partner, possible lower limits may be, for example, at least 1 °, 2 °, 3 °, 4 ° or 5 °, and (independent) upper limits, for example, at most 160 °, 140 °, 120 °, 100 °, 90 ° or 80 °. The directional resolution does not necessarily result from the measurement signal itself measured with the sensor unit, but as a rule from an evaluation of the measurement signal (by means of an evaluation unit with at least a certain logic). This means "direction-resolved received", in the measurement signal, the direction information is at least indirectly included. It can, for example, be calculated back from the signal strength to a distance or can be concluded from a spatially resolved measurement with knowledge of an associated optics on a solid angle distribution, cf. also 2 with the accompanying description for illustration.

For the "triangulation", in a (central or decentralized) evaluation unit of the motor vehicle, at least one triangle can be formed metaphorically from the first and the second signal component, that is to say the connecting lines. From this triangle, an angle is known, namely the angle between the connecting lines (signal components). Furthermore, a side edge is known, namely as a distance between two sensors or two emitters. Thus, a completely defined triangle is spanned, at the top (exactly one emitter, cf. 1 ) or side edge (two emitters, cf. 3 ) of the communication partner is arranged. The communication partner is thus located and can be confirmed (authenticated) as the originator of the signal.

The present invention may be particularly of interest with regard to partially or fully autonomous vehicles because in these vehicles a reliable vehicle control may require relatively large amounts of information. On the other hand, this information can be sensitive (see below), which may require encrypted or at least authenticated data transmission. Possible data or data acquisition processes can be, for example: acquisition of their own absolute position via GPS coordinates; Detecting a relative position to another vehicle, capturing the vehicle trajectories of another vehicle as well as the own, detection of traffic signals (traffic lights, signs, barriers, etc.), detection of special dangerous situations (road condition, accident, traffic jam, weather warnings, ghost drivers, etc .), Recording a map, recording an air purity grade, etc.

For this purpose, an exchange of information between a vehicle and one (or more) central servers or a network can take place, whereby these can advantageously be cloud-based. This type of communication is also known as Car-to-X (C2X). Furthermore, a direct data exchange between two vehicles can be done (car-to-car, C2C). The communication can take place via LTE radio, WLAN, Bluetooth, light signals etc. A group of vehicles may also form a (time-bounded) local area network with, for example, a selected vehicle as a central hub.

An advantage of data participation is that the calculation or estimation of complex solutions (vehicle guidance, accident prevention) can be faster or easier or more precise or predictive. Also, C2C communication helps two (or more) vehicles to authenticate themselves, both in regular driving and in anticipated damage (minimizing overall damage).

In the case of danger, a fully autonomous vehicle must decide on the basis of a rating criterion (and quickly) which (minimal) damage it may cause in the event of danger or which (maximum) damage it must avoid (but then must accept the minimum damage ). Here it is helpful if vehicles can exchange information directly in order to develop joint solution strategies and / or have more time to work on them and thus obtain a better or safer solution.

However, it is important to know whether the information provided by another vehicle really originates from this vehicle, or whether a third party unjustifiably transmits this data and pretends that it was generated by a certain transmitter vehicle. Also, exchanged vehicle data may be sensitive, so that a need for protection, such as protection, may be required. encryption and / or unique authentication.

The sensitive data may include: ID information, camera images, video and / or audio recordings, number, age, etc. of the persons traveling, vehicle history and / or destination, but also other sensor data (which, for example, leads to allow the health of the occupants), etc. These examples illustrate why it is of interest to perform at least one transmitter verification (authentication) to establish an authenticated / secure data communication, which is then also encrypted data in a further step.

In a preferred embodiment, the automotive Sensor device has a first and a second automotive Sensor on. These sensors are preferably spaced apart from one another, preferably by at least 1 m, further and particularly preferably by at least 1.2 m or 1.4 m. Possible upper limits can be (independently of this), for example, not more than 3 m, 2.75 m or 2.5 m. The distance is taken as the smallest distance between the active sensor surfaces of the sensors. The first KP Signal component falls on the active sensor surface of the first automotive Sensor and is received by it, the second KP Signal component falls on the active sensor surface of the second automotive Sensors and is received by it.

Referring to the picture at the beginning with the triangle, which is the two KP -Spreading signal components is in this case the automotive arranged on one side edge of the triangle. The emitter device of the communication partner can the KP -Signalanteile then from the same place, but just in (slightly) different directions emit. The KP -Signalanteile can also be sent "crosswise", which results in a rollover trapezoid, see 3 for illustration.

The spaced-apart sensors can, for example, enable a particularly reliable triangulation. By their nature, the sensors are on the KP Matched, for example, as optical, wireless or acoustic sensors (such as in the case of an ultrasonic signal). A combination of different sensors is also possible, in particular for a 2-way authentication or a comparison of the authentication (with, for example, a camera image or a time-based distance measurement, see below). In general, the tilted to each other KP -Signalanteile but also with exactly one, so the same sensitive sensor surface are detected, as far as just directional resolution is measured. Thus, for example, a CMOS or CCD sensor field may be provided in conjunction with an optical system that guides incident light from different spatial directions to different locations of the sensor field, cf. 2 for illustration.

In a preferred embodiment, the KP -Emittervorrichtung a first and a second KP Emitter on. These emitters are preferably spaced apart from one another, preferably by at least 1 m, further and particularly preferably by at least 1.2 m or 1.4 m. Possible upper limits can be (independently of this), for example, not more than 3 m, 2.75 m or 2.5 m. The distance is taken as the smallest distance between the emitter emitter active surfaces. The first KP Signal component is at the active emitter surface of the first KP -Emitters emitted, the second KP Signal component at the active emitter surface of the second KP -Emitters.

In a preferred embodiment, the communication partner is also a motor vehicle ( KP - automotive ). All information on possible embodiments of the first motor vehicle should also be disclosed with regard to the second motor vehicle (this preferably has a sensor device, more preferably with a first and a second sensor, etc., see also below). If references are made to the "communication partner", this always applies to a motor vehicle ( KP - automotive ) to read. The automotive and the KP or that KP - automotive are also generically called "communication participants" or even "participants".

In general, however, for example, a static communication partner is also conceivable, the emitter device can therefore be mounted, for example, next to or above the roadway, for example on a motorway bridge. Furthermore, the communication partner can also be another type of vehicle, in particular an aircraft, for example also unmanned in the form of a drone. A second motor vehicle, which is also referred to below as a "KP vehicle" in order to distinguish it from the first (main claimant) and designated as a "motor vehicle", is preferred.

On a motor vehicle (whether automotive or KP - automotive ) may be mounted several emitters, preferably at least two with a defined, in particular standardized distance, see the front. The emitter can z. B. also be attached to the exterior mirrors or otherwise on the vehicle chassis.

In a preferred embodiment, the KP -Emittervorrichtung in an outdoor lighting system of the second motor vehicle ( KP - automotive ) integrated. Is the first motor vehicle with an emitter device ( automotive -Emittervorrichtung), this can additionally or alternatively in the outdoor lighting system of the first automotive be integrated. The "integration into the outdoor lighting system" may, for example, an arrangement on or preferably in the or the headlamp (s) mean, for example, the front or rear headlamps. In general, however, for example, an integration in a brake light or signal light (turn signals, etc.) is possible, or an attachment anywhere on the car, also on the side or on the vehicle roof or in the underbody area. It is also conceivable, for example, for integration in the exterior mirrors.

The first is preferred KP -Emitter on / in one and is the second KP -Emitter on / in the other headlight of a headlight or tail lamp pair of the KP - automotive arranged. Alternatively or additionally, the first is preferred automotive -Emitter one automotive -Emittervorrichtung on / in the one and is the second automotive -Emitter on / in the other headlight or headlamp pair of the first headlamp automotive arranged. In the case of motor vehicles driving one behind the other in the same direction, the emitter device of one motor vehicle is then integrated in its rear headlight and the emitter device of the other, behind-traveling motor vehicle in its front headlight. Of course, the motor vehicles then preferably also on the respective other headlights emitter, for communication with other vehicles (which can then be comparable to a chain in conjunction). In general, however, the motor vehicles can also encounter, for example, on different tracks; they can travel one behind the other in the same direction; they can drive on different levels of a multi-level street layout.

The integration of an emitter in a headlamp can preferably even assume that the actual lighting unit of the headlamp (in particular of the headlight), in which the headlight is generated, is also used for the signal generation. This may in particular be the case with a lighting unit designed for adaptive street lighting, for example a so-called matrix LED system or also a (scanning) LARP arrangement. Such a lighting unit has a "directional competence", so it can selectively (or not) supply solid angle areas with light. Accordingly, it is then also possible to "illuminate" another motor vehicle selectively, for example even in very short time intervals below the threshold of human perception.

In general, a signal transmission may, for example, be time-synchronous and / or time-coordinated (also counter-clocked), which is then particularly preferred in the case of a transmission via the two headlights. An advantage of the use of headlamps may, for example, be that they are anyway present and preferably arranged at a defined distance from each other. Of course, other suitable and with (standardized) distance placed transmitting devices can be used. Standardization seems to make sense because it can facilitate triangulation, but it is not compulsory.

In a preferred embodiment, the KP -Embitter authentication is compared with a result of a time-of-flight-based (Time of Flight, ToF) distance measurement. The distance measurement may, for example, from the first automotive or also by the communication partner ( KP - automotive ). This is done accordingly by the automotive or the KP - automotive sent a distance measurement signal and measured after a reflection at the respective other participant (it is, for example, on KP - automotive reflected if that automotive transmits and measures the distance measurement signal, or vice versa). The distance measurement signal can generally also be acoustic, an electromagnetic signal, for example an IR beam according to the LIDAR principle, being preferred. Then a runtime determination is made according to the time-of-flight principle (twice the distance results from the time between sending and measuring in connection with the signal speed).

The respective other, "second" subscriber can use the same distance measurement signal for a stand-alone distance determination; For this purpose, for example, the emission time signal can be stored in the distance measurement signal. Preferably, the respective other participant in turn sends out a second distance measurement signal in order to measure its transit time after a reflection at the first participant. The first participant can additionally measure the second distance measurement signal, cf. the beginning of the paragraph. In general, therefore, it is also possible to carry out a plurality of distance measurements and compare their results with each other or even to average them. Irrespective of this in detail, the results are preferably used for a check of the position determination by means of triangulation.

In a preferred embodiment, the first automotive in addition one automotive -Emittervorrichtung and the communication partner, in particular the KP - automotive , in addition one KP Sensor device, cf. also the comments above. The automotive Emitter device sends in automotive Signal with a first automotive Signal component and a second automotive Signal component off. The automotive -Signalanteile have an angle to each other and are with the KP Sensor device received direction resolved. This can be the KP or that KP - automotive the automotive Assign signal components by means of triangulation at least indirectly to a place of origin, so again emitter authentication can be performed.

All information the KP -Emittervorrichtung regarding expressly also with respect to the automotive -Emittervorrichtung be disclosed. The latter is then, for example, also preferably from at least two emitters ( automotive -Emitter) constructed, which are arranged at a distance from each other.

In a preferred embodiment this is KP Signal an electromagnetic signal, so are in particular the first and the second KP Signal component of electromagnetic nature. Alternatively or preferably in addition, the automotive Signal to be an electromagnetic signal. The signal (s) may be, for example, a radio signal (radio waves). Likewise, visible light (wavelengths from 380 nm to 780 nm) or infrared radiation, for example in the wavelength range from 905 to 1600 nm, or in general also UV radiation is conceivable.

Combinations are also possible, the communication should preferably be possible during the day and at night, even in bad weather and fog. Therefore different emitters and sensors can be combined (visible light, UV and IR light, RADAR, LIDAR, acoustic waves). Depending on the type of emitter, for example, the transmission power can also be angle-dependent (even with a non-electromagnetic signal), which, knowing the corresponding angular dependence or function, can also be used when receiving, in particular evaluating. In general, an optical triangulation by camera detection is conceivable (camera of the automotive recognizes KP ); In general, camera data can at least be used for verification.

A combination of different signal types may even be preferred. In particular, it can make use of the later communication of a signal type other than that used in the communication setup.

In general, the transmission of information per se, that is to say the transmission of bits, can take place, for example, by means of a bit sequence similar to a Morse code. As information carrier emitted by the emitters radiations (light, IR, ultrasound) can be used. Common PWM methods can also be used. For this, only the logs need to be known. These can be regulated by standards. In general, it may be preferred that, in the case of an emitter device with a plurality of emitters, these are distinguishable, at least in groups, according to their individual signals, even if the individual signals are of the same nature (eg, electromagnetic) and, for example, even have the same wavelength. For this purpose, an individualization information can be stored in the signal, for example, modulated by PWM.

In a preferred embodiment, in the course of KP Emitter Authentication transmits a record ("encryption record") that is used as a key for encrypted data transmission or to generate such a key. In general, however, the main method according to the invention can also be of interest independently of a later encryption, namely, the authentication of a signature can similarly ensure that the information in question actually originates from the specified source. Additional encryption may be of interest, especially with regard to sensitive data (see above).

The exchange of the encryption data record "in the course of authentication" can generally also mean, for example, that the authentication takes place by means of triangulation, in the sense of a communication request ("handshake"), and the actual encryption data record is then sent separately, possibly without renewed triangulation. but, for example, so soon after the handshake that an assignment is still possible (at least with some probability). The latter may be the case, for example, if between handshake and exchange of the data set with / for the key not more than 1 s, or preferably not more than 0.5 s or 0.2 s pass (lower limits may be due to technical reasons, for example 1 μs or 1 ms).

The encryption data set may also, for example, from the first automotive be communicated to the communication partner after the communication partner has been authenticated by triangulation or in the course of a handshake.

The data record or a corresponding key can, for example, be created externally (eg by the vehicle owner) and in the automotive to be saved (the automotive can, for example, also request the input of a new key at certain intervals). The automotive can the key but z. As well as even generate, for example, each also has its own key for each communication partner. The key generation can be done, for example, in a tap-proof arrangement (so-called "black box computer").

Preferably, the encryption record is from the communication partner to the first automotive hereafter referred to as "KP record". In addition, particularly preferred from the first automotive transmitted to the communication partner an encryption record, hereinafter also referred to as "car record". Of the KP - and the automotive Data record can, for example, be identical, namely if z. B. the one communication participant ( automotive or KP ) transmits an encryption record to the other communication party and sends it back the same record to confirm receipt. Preferably, then both the forward and the return in the course of an authentication (triangulation).

In a preferred embodiment, the transmission of the KP Encryption record with receiving the first and / or the second KP Signal component, so this contains or contain the encryption record. In other words, in the transmission of the encryption data record triangulated, so the key or the record is transmitted to its generation under authentication. Preference is given to the replacement of the KP Encryption record a handshake, in which further preferably also triangulated.

In general, symmetric or asymmetric encryption can then be used for encrypted data transmission. Symmetric encryption uses the same key for encryption and decryption; in other words, the two communication participants use the same key. In asymmetric encryption, different keys are used for encryption and decryption, and the key for encryption is preferably public. A combination of symmetric and asymmetric encryption is possible, which is also referred to as hybrid encryption. For this purpose, for example, a key for symmetric encryption can be exchanged by means of asymmetric encryption (and vice versa).

In symmetric encryption, it is important that the key be transmitted to the other party in a secure transmission path. This can be a risk, but can be reduced via the authentication according to the invention (triangulation). An advantage of symmetric encryption may be the high speed of decryption and encryption, for example, such techniques may rely on efficient operations such as bit shifts and XORs. The following symmetric encryption methods are mentioned as examples: DES (Data Encryption Standard), Triple-DES (also referred to as TDES, 3DES or DESede), AES (Advanced Encryption Standard), IDEA (International Data Encryption Algorithm), Blowfish, Twofish, CAST-128 , CAST-256, RC2, RC4, RC5, RC6, Fox.

In a preferred embodiment, the key is generated for the encrypted data transmission, so is not the encryption record itself used as a key, but the key is generated from it. Of course, as far as a "key for encrypted data transmission" is mentioned, this does not mean that one and the same key has to be used for the entire subsequent data transmission. For example, in the course of the (then already encrypted) data transmission, a new key can also be regularly exchanged or generated. The key exchanged / generated in the course of the authentication is in any case an introduction to the encrypted data transmission.

The preferred generated key is further preferred from the automotive - and the KP Record, these two encryption records being different. Both encryption data sets are exchanged in each case in the course of an authentication, preferably the respective receiving subscriber triangulates the corresponding signal components (of the KP - respectively. automotive Signal) with which the respective transmitting subscriber transmits the encryption record.

The generation of the key itself can take place according to a cryptographic protocol known per se, for example with the Diffie-Hellman method, cf. the embodiment for illustration in detail. "Key" is to be read on exactly one single key, as well as on several individual keys, in particular also a key pair or pairs. With a cryptographic protocol, the two communication participants have the opportunity to vote a common secret k as the key by exchanging non-secret information. This secret k can then be considered a symmetric key be used permanently or represent only the entry into the encrypted data transmission, encrypted exchange of another or further key.

However, the agreement or generation of a common (symmetric) key is generally not mandatory, the participants can also each generate their own key pair (asymmetric encryption). Each key pair can consist of a secret part (private key) and a non-secret part (public key), the public keys are exchanged. This can also be done without listening protection ("public"), but with the authentication (see above) it is ensured that the respective key also originates from or arrives at the respective participant. As already mentioned, it is then possible to encrypt permanently asymmetrically or, in the future, also use a symmetrical key. An asymmetric approach can be very secure, but requires a high level of coding and decoding overhead and time. The hybrid approach can help combine the benefits of asymmetric with the speed of symmetric encryption.

In the case of two vehicles ( automotive . KP - automotive ) can each have a public and a private key (for example, entered by the vehicle owner and / or generated by the vehicle itself, see the comments above). It is a multiple use of the keys possible, but these can also be used only once for exactly one communication.

After a successful handshake between the vehicles ('Hello, I want to communicate' / 'Hello, I'm ready'), preferably with mutual authentication, the keys can be exchanged. automotive sends his public key KP - automotive , and vice versa (simultaneously or consecutively). In the case of a transmission in succession, the public key previously sent by a subscriber can, for example, also already be used for encryption of the public key of the other subscriber. Then, using a per se known asymmetric encryption method, an encryption record can be created. One, "first" participant ( automotive or KP - automotive ) can then send an encrypted C2C key and possibly other data for communication setup to the other, "second" subscriber, this data being encrypted with the public key of the second subscriber. This then communicates back, encrypted with the public key of the first participant, it creates a secure data exchange.

Particularly in C2C communication, symmetric off-the-record encryption (OTR) may be of interest. The OTR protocol is well-known in instant messaging message encryption and governs the ongoing updating and management of short-lived session keys. One advantage is that it is then no longer possible to determine whether a specific key was used by a particular subscriber (principle of credible repudiation, plausible deniability). After completing the conversation, nobody, not even the communication participants, can prove that the respective other participant has made a certain statement.

In a preferred embodiment, which relates to the generation of a key by one or the communication participants, a result of a signal delay based distance measurement is additionally used for the key generation, so it is a distance information. The distance information is thus used in the calculation method, possibly after a previous rounding and / or conversion. The distance information can therefore be used, for example, as a random variable, for example in the Diffie-Hellman method (see below). The result of the distance measurement, ie the instantaneous, for example, in centimeters measured, possibly rounded distance can then represent a random number a and used for key generation.

In a preferred embodiment, the transmitted or generated key is used as a "primary key" for the encrypted transmission of a secondary key, which is then used for the subsequent encryption, at least temporarily. It is also referred to the above information, for example, the "hybrid encryption". For example, the primary key may be asymmetric, the secondary key symmetric. But it is also the reverse sequence possible. In general, asymmetric encryption algorithms can later be used for an initially / temporarily symmetric encryption and replace the symmetric encryption algorithm. The asymmetric encryption can then be used temporarily or permanently.

The invention also relates to a motor vehicle ( automotive ) with a automotive Sensor device adapted for carrying out a method disclosed herein. In addition to the sensors, the Sensor device then, for example, have a decentralized evaluation with a corresponding logic, but it can also take a central computer unit of the motor vehicle evaluation. This preferably has automotive also an emitter device ( automotive -Emittervorrichtung, cf. also the details given above) and / or (one) further sensor device (s), particularly preferably in each case a plurality of sensor and emitter devices (in each case at least one in and counter to the direction of travel). Furthermore, the vehicle is, for example, equipped with a computing and storage unit, which is programmed accordingly.

The invention also relates to a set of such a motor vehicle ( automotive ) and another motor vehicle ( KP - automotive ). The further motor vehicle preferably has the same features as the first automotive on (emitter and sensor device, preferably each several, computer and memory unit, etc.). The motor vehicles of the set are arranged to carry out a method disclosed herein.

list of figures

In the following, the invention will be explained in more detail with reference to embodiments, wherein the individual features in the context of the independent claims in another combination may be essential to the invention and continue to distinguish not in detail between the different categories of claims.

• 1 in einer schematischen Aufsicht eine erste Möglichkeit zur drahtlosen Datenübermittlung zwischen zwei Kraftfahrzeugen;
• 2 für eine Datenübermittlung gemäß 1 einen Kfz-Sensor zur richtungsaufgelösten Signalanteilerfassung;
• 3 eine gegenüber 1 erweiterte Möglichkeit zur drahtlosen Datenübermittlung, unter Beteiligung eines zusätzlichen Emitters;
• 4 eine weitere Möglichkeit zur richtungsaufgelösten Erfassung von Signalanteilen;
• 5 eine Möglichkeit zur Ausstattung eines Kraftfahrzeugs mit Emittern und Sensoren;
• 6 in einem Ablaufdiagramm den Aufbau eines gesicherten Datenaustausches.

In detail shows

• 1 in a schematic plan a first way to wireless data transmission between two vehicles;
• 2 for a data transmission according to 1 one automotive Sensor for direction-resolved signal component detection;
• 3 one opposite 1 extended possibility for wireless data transmission, with participation of an additional emitter;
• 4 Another possibility for the direction-resolved detection of signal components;
• 5 a possibility for equipping a motor vehicle with emitters and sensors;
• 6 in a flow chart the structure of a secure data exchange.

Preferred embodiment of the invention

1 shows a first possibility for wireless data transmission according to the invention between a motor vehicle automotive and a communication partner KP , in the present case also one automotive ( KP - automotive ). The KP - automotive has a KP -Emittervorrichtung 1 with a first emitter 1a and a second emitter 1b , in the situation according to 1 only the first emitter 1a is operated. The KP - automotive drives in the present behind the automotive ago, so the direction of travel has in the presentation down. The KP -Emittervorrichtung 1 is in the headlights of the KP - automotive integrated.

In the situation according to 1 emits the first emitter 1a one KP -Signal 2 , which in the present case is shown somewhat simplified as a spherical wave, but in practice can also be partially directed (comparable to the emission profile of a piggery). The KP -Signal 2 In any case, proportionally applies to the automotive , and it will also have a partially directed radiation usually signal components that on the automotive pass by (therefore the exemplary rendering with the spherical wave).

The automotive has a sensor device 3 on, with a first automotive -Sensor 3a and a second one automotive -Sensor 3b , The automotive sensors 3a , b are each set up for a direction-resolved signal acquisition, cf. to that too 2 in detail. At first automotive -Sensor 3a falls a first automotive signal portion 2a of automotive signal 2 and is received, the same applies to a second automotive signal portion 2 B , the second one automotive -Sensor 3b falls.

The direction-resolved reception results from each signal component 2a , b is a line on which the signal source, ie the first emitter 1a , must lie. From a single signal component 2a , b would be but still no precise location possible, because although the respective line, but not the exact position is set on the respective line. For illustration, the lines are in 1 over the respective signal component 2a , b also indicated by dashed lines.

Because the signal components 2a , b, however, have an angle α to each other, results in knowledge of a distance 5 between automotive sensors 3a , b the position of the signal source (the first emitter 1a) as the intersection of the two lines. The measuring signals of the automotive sensors 3a , b are in an evaluation unit 4 merged, for example, the central automotive -Bordcomputer or even a decentralized logic unit. In the evaluation unit 4 is also the distance 5 between automotive sensors 3a , b deposited, bringing a triangle 6 is completely defined ("triangulation"). The enlarged view in 1 illustrates in this respect an operation or a result of the evaluation in the evaluation unit 4 ; the solid lines correspond to known quantities, the dotted lines can then be calculated (for example by decomposing into two right-angled triangles and using angle sets, etc.).

That can be done with this triangulation KP -Signal 2 clearly the first emitter 1a can be assigned, so this can be the author of the KP signal 2 be authenticated. This can do that automotive make sure that KP -Signal 2 actually from that KP - automotive comes. This can then be the beginning of the construction of an encrypted data transmission, which will be described in more detail below. It can, for example, with the KP -Signal a so-called handshake done ("Do you want to communicate?"), But it can additionally or alternatively in the course of a triangulation and a key or data set to generate a key are exchanged.

2 shows the first one automotive -Sensor 3a in a detailed view, the second automotive -Sensor 3b is constructed analogously. The KP -Signal 2 is in the present case an infrared signal, for example, emitted by an infrared diode with 950 nm. The first automotive -Sensor 3a has an area sensor 20 on, which is radiation-sensitive in the corresponding wavelength range, for example, a corresponding CCD array. The area sensor 20 has a sensitive sensor surface 20a , And the infrared radiation falling on it is detected with a spatial resolution (pixelwise).

Furthermore, the first one automotive -Sensor 3a a condenser lens 21 on. This is relative to the sensor surface 20a arranged such that it the sensor surface 20a depicts in the infinite. This in turn means that from different directions 22a , b incident infrared radiation in each case to another area 20aa, 20ab of the sensitive sensor surface 20a falls, in each case on a different pixel. Abstract is expressed with the condenser lens 21 In the course of a Fourier transformation, a solid angle is converted into a spatial distribution, the latter being done with the area sensor 20 detected.

3 indicates the situation according to 1 building a more complex data transmission pattern with correspondingly more signal components. The KP -Signal 2 not only from the first emitter 1a as a single signal 2.1 but results together with that of the second emitter 1b emitted single signal 2.2 , The individual signals 2.1 However, 2.2 can be quite distinguishable, for example due to a modulation frequency superposed in each case for individualization or else due to a slightly time-delayed emission.

From the first emitter 1a falls in accordance with the situation 1 comparably a first signal portion 2aa to the first automotive -Sensor 3a and a second signal portion 2ab on the second automotive -Sensor 3b , Triangulation can be the first emitter 1a be located as a signal source and authenticated. In an analogous manner, the second emitter is incident 1b another first signal component 2ba at first automotive -Sensor 3a and another second signal portion 2bb on the second automotive -Sensor 3b , In knowledge of the distance 5 can with the evaluation unit 4 again triangulated and the second emitter 1b be authenticated as a signal source.

A triangulation is also ever automotive -Sensor 3a , b possible, ie with the two signal components falling on each. At first automotive -Sensor 3a In the present case, the first signal portion 2aa of the first emitter falls 1a and a second signal portion 2bb from the second emitter 1b , In knowledge of the distance 30 between the emitters 1a , b is thus in turn a completely defined triangle spanned, the emitter device 1 can be located and thus authenticated as a signal source. The distance 30 can, for example, with the signal 2 to the evaluation unit 4 of automotive can be transmitted, but it can also be a standardized size.

On the second automotive -Sensor 3b falls a first signal portion 2aa from the first emitter 1a and a second signal portion 2bb from the second emitter 1b , The emitter device 1 can thus be localized again, alternatively or preferably in conjunction with a triangulation according to the previous paragraphs. Such multiple triangulation can increase accuracy and thus improve the degree of authentication.

Furthermore, that of the first emitter 1a emitted and from the second automotive -Sensor 3b received signal portion 2aa together with that of the second emitter 1b emitted and from the first automotive -Sensor 3a received signal portion 2bb are used for triangulation. These two signal components 2aa, 2bb together span a hurled trapezoid, ie two triangles. These two triangles have the same cutting angle, and the distances 5.30 are known. This evaluation can then preferably be used for a verification of the position determinations described above.

4 illustrates an alternative way of locating with two automotive sensors 3a , b, in which case the first emitter 1a an acoustic signal 2 emitted. this acoustic signal 2 is emitted with a defined (standardized) volume and can be distinguished, for example, by a modulation of ambient noise, etc. With the first automotive Sensor, a first sound pressure is measured, with the second automotive -Sensor 3b a second sound pressure. The second sound pressure is lower than the first sound pressure, because the sound pressure decreases with increasing distance from the sound source.

Accordingly, it can be explained with reference to the first automotive -Sensor 3a measured sound pressure from a distance function (the sound pressure decreases with increasing distance) a first circle 31a determine on which the first emitter 1a must lie. Accordingly, the distance function for the second automotive -Sensor 3b measured sound pressure a second circle 31b , and gives the position of the first emitter 1a then as the intersection of the circles 31a B. This in turn is a first signal component 2a and a second signal component 2 B as connecting lines between the first emitter 1a and the automotive sensors 3a , b, and the KP emitter 1a can be considered the origin of the signal 2 be authenticated.

5 shows a motor vehicle ( automotive or KP - automotive ) in a plan and illustrates a preferred equipment with emitters and sensors. The emitters and sensors are present in each case to a functional group 50 summarized, each of the functional groups 50 contains each (at least) one emitter and one sensor. There are initially two front-side, facing in the direction of travel function groups 50a , The one functional group 50aa is integrated in the left headlight, the functional group 50ab in the right headlight.

There are also two backward-looking function groups 50b of which one functional group 50ba is integrated in the left rear headlight, the other functional group 50bb in the right rear headlight.

Furthermore, there are also laterally functional groups 50c , Which are thus provided for emitting and receiving angled to the direction of travel, that is, for example, for communication with a vehicle traveling on the neighboring lane. Two functional groups 50ca are on the left side of the vehicle and two more functional groups 50CB arranged on the right hand side of the vehicle. the respective front functional groups 50caa . 50cba can, for example, be integrated into the exterior mirrors. The back functional groups 50cab . 50cbb would be present in the C-pillar integrated.

There are also two functional groups on the car roof 50d namely, a front function group 50da and a rear function group 50db. These can be provided, for example, for communication with a motorway bridge or even a control system in a tunnel.

Furthermore, the motor vehicle is equipped with ToF units 51, in the present case so-called LIDAR systems (Laser Detection And Ranging). These also each have an emitter and a sensor. The former emits a laser pulse (in this case infrared), which after reflection at z. B. a front, side or subsequent vehicle or other object is detected by the sensor. From the runtime can then be calculated the distance.

Here are a forward-looking ToF unit 51a two sideways ToF units 51ca . 51cb , a backward facing ToF unit 51b, and an upwardly facing Tof unit 51d intended. Further, in the illustration, a forward facing camera 52 to detect a lying in front of the vehicle area. Of course, even more, backward, sideways or top turned cameras may be provided. By means of an image processing software, for example, other vehicles or even pedestrians or generally other traffic participants can be identified. Such a camera-based identification can also be compared with an authentication by triangulation.

The motor vehicle is further provided with a computing and storage unit 53 equipped, in which of the individual functional groups 50 , the ToF units 51 and the camera 52 collected data (and in particular signal components, see above) and compared with each other. After the authentication of a communication partner this can then also between the individual function groups 50 be passed on, for example, if a communication with a preceding vehicle is built, which is then overhauled and drives accordingly afterwards.

6 illustrates in a flowchart how a data exchange between a communication partner (KP / KP- automotive ) and a vehicle ( automotive ) can be constructed. In a first step 60 directs KP / KP automotive a communication request automotive , also known as a handshake. In a next step 61 authenticated automotive the KP or that KP - automotive through a triangulation of the handshake data. These are spatially accepted from where they are supposed to come from automotive the connection is established and sends in the next step 62 in turn, as a handshake ("Yes, I want to communicate.") to KP / KP automotive , Also KP / KP automotive Triangulated this handshake data to ensure that it continues to address the originally addressed automotive Communication participant is.

Furthermore, there are different possibilities. After a first variant 64 can automotive a key to KP / KP automotive transmitted under triangulation by KP / KP automotive Will be received. Conversely, however, KP / KP automotive In general, the other party sends the received key back for confirmation (ideally under triangulation).

Another variant 65 can be that automotive and KP / KP automotive each exchange a public key and generate a key or a key pair in a cryptographic method (eg Diffie-Hellman, see below). Irrespective of this in detail, the next step in the communication is 66 then in any case an encryption available, so it can then be synonymous in particular sensitive data exchanged. The key can be permanently retained or, for example, also (regularly) renewed (see the introduction to the description).

The communication is established under triangulation (see above), in addition to the verification of this measurement also results of measurements with the / the ToF units 51 can be used, so distance measurements. For example, from the automotive transmitted ToF signal is sent to KP / KP automotive reflected, the ToF signal can be, for example, an IR beam (eg LIDAR principle). The KP / KP automotive Reflected ToF signal is then sent to the sensor of the ToF unit 51 from automotive recorded, and it is a runtime determination made on the time-of-flight principle. So knows automotive the current gap with KP / KP automotive with an accuracy that is usually in the cm range.

Also KP / KP automotive can this (from automotive originating) ToF signal with its own ToF unit 51 concretely detect a sensor thereof. Ideally, KP / KP automotive in turn, a ToF signal automotive which looks like a reflection automotive from KP / KP automotive and already from automotive can be detected. The mutual detection of the respective other ToF signal can help to increase the accuracy or reliability of the measurement. However, this is not mandatory, but preferably each participant takes at least one own distance measurement. The distance measurement or measurements can also be repeated (several times), with checking of the previous measurement (s) in order to arrive at an average value.

Well can automotive the obtained instantaneous distance information about its emitter to KP / KP automotive with KP / KP automotive receiving the data under triangulation. The distance information can then be read by KP / KP automotive be checked (based on their own distance measurement). Also KP / KP automotive transmits the result of its distance measurement automotive , Only if this adjustment is positive (with an adjustable tolerance limit due to measurement uncertainties) will the data transfer from both vehicles be accepted as authentic. The distance adjustment should preferably take place within a selected time interval, for. Within one second. The distance data can also be used for a key generation, cf. also the description introduction in detail.

In the following, the above-mentioned Diffie-Hellman key exchange will be explained in detail. The communication participants ( automotive , KP / KP- automotive ) first agree on a prime number p and a matching primitive root g, wherein the data exchange takes place in the course of a triangulation described above and thus authenticated. automotive then generates a secret random number a, calculates g ^ a modulo p and sends the result to KP / KP- automotive , KP / KP automotive also generates a secret random number b, calculates g ^ b modulo p and sends the result automotive , automotive calculates the secret k from its information with (g ^ b) ^ a mod p = g ^ (ba) mod p = k, and KP / KP- automotive determines the same value with the information known to it, via (g ^ a) ^ b mod p = g ^ (ab) mod p = k.

Have with it automotive and KP / KP automotive a shared secret k that can be used for further communication. The random numbers a and b are no longer needed and are discarded. Then sends automotive using the secret k as the session key, a C2C key (FAC2CS) and other communication establishment data to KP / KP- automotive , the communication is already encrypted here. KP / KP automotive then communicates automotive back, also encrypted, so it creates a record; This establishes secure data exchange. The data transfer can, as mentioned, take place via different media; even with simultaneous use of different media.

A communication according to the OTR protocol (off-the-record) may be advantageous, cf. also the description introduction. In contrast to the transmission of encrypted messages with OpenPGP (or in rare cases by means of the X.509 certificate), the OTR protocol can no longer be used to determine whether a particular key was used by a certain subscriber.

• - Verschlüsselung (Encryption): Niemand kann die Nachrichten mitlesen.
• - Beglaubigung (Authentication): Man kann sich sicher sein, dass der Empfänger derjenige ist, für den man ihn hält. Dies wird vorliegend (zumindest) zu Beginn des Datenaustusches mit der Triangulation gewährleistet.
• - Abstreitbarkeit (Deniability): Verschlüsselte Nachrichten enthalten keine eindeutige, permanente und zugeordnete elektronische Signatur, sondern „nur“ eine temporäre und zum Zeitpunkt des Datenaustauschs nur den beiden Teilnehmern bekannte Signatur. Dadurch kann während eines Gespräches bzw. Datenaustausches der Empfänger gewiss sein, dass die empfangenen Nachrichten authentisch und unverändert sind. Nach dem Datenaustausch (bzw. nach jedem Paket) wird die Signatur veröffentlicht, sodass sich nicht mehr beweisen lässt, wer die Daten verschlüsselt/versendet hat, da dies theoretisch jeder hätte tun können bzw. tun kann. Zudem handelt es sich um ein symmetrisches Verfahren, sodass (theoretisch auch schon während der Datenübermittlung) die Verschlüsselung vom Empfänger hätte stammen können.

• - Folgenlosigkeit (Perfect Forward Secrecy): Wenn der (langlebige) private Schlüssel einem Dritten in die Hände fällt, hat dies keine Auswirkung auf die Kompromittierung bisher getätigter Gespräche: Die Gespräche können damit nicht nachträglich entschlüsselt werden (die Kommunikation wurde mit den o. g. temporären Schlüsseln gesichert).

This principle can be implemented by a combination of the Advanced Encryption Standard (AES), the Diffie-Hellman asymmetric key exchange, and the SHA-1 cryptographic hash function. A program library and numerous instant messaging programs are available, which make the protocol usable either directly or via additional modules. The OTR protocol comprises the following method steps or features:

• - Encryption: Nobody can read the news.
• - Authentication: You can be sure that the recipient is the one you hold him for. This is ensured in the present case (at least) at the beginning of the data exchange with the triangulation.
• - Deniability: Encrypted messages contain no unique, permanent and associated electronic signature, but "only" a temporary and at the time of data exchange only the two participants known signature. As a result, during a conversation or data exchange, the recipient can be certain that the received messages are authentic and unchanged. After the data exchange (or after each package) the signature is published, so that it can no longer be proved who encrypted / sent the data, as theoretically anyone could or should do so. In addition, it is a symmetrical process, so that (theoretically even during the data transmission) the encryption could have come from the receiver.

• - Perfect Forward Secrecy: If the (long-lived) private key falls into the hands of a third party, this has no effect on the compromise of previously made calls: The conversations can not be subsequently decrypted (the communication was made with the above-mentioned temporary keys secured).

Also in this method (initial) key must be exchanged at the beginning of the communication, with the triangulation advantageously the authenticity of the participants can be mutually checked (initialization). Further communication can be carried out by the OTR method. For example, two autonomous vehicles are then able to exchange only known and authenticated information. Subsequent publication of the (temporary) signature (symmetric encryption) with regard to deniability is harmless for the two vehicles to the extent that this no longer influences the control of the autonomous vehicles (possibly the data history).

LIST OF REFERENCE NUMBERS

KP-emitting device 1 KP signal 2 Single signals from it 2.1 / 2.2 first KP signal components 2a, 2aa, 2ab second KP signal components 2b, 2ab, 2bb Automotive sensor device 3 Automotive sensors 3a, b evaluation 4 Distance (between sensors) 5 triangle 6 area sensor 20 Sensor surface thereof 20a converging lens 21 Different directions 22a, b Distance (between emitters) 30 First / second circle 31a, b function groups 50 forward-looking functional groups 50a backward-looking function groups 50b lateral function groups 50c upper function groups 50d ToF units 51 Forward ToF unit 51a backward facing ToF unit 51b lateral ToF units 51c upper ToF unit 51d Camera (turned forwards) 52 Computing and storage unit 53 communication steps 60-66

Claims (15)

Method for the wireless transmission of data to a motor vehicle (motor vehicle) having a motor vehicle sensor device (3), namely by a communication partner (KP, KP motor vehicle) with a KP emitter device (1), in which method: the KP emitter device (1) emits a KP signal (2); a first (2a, 2aa, 2ba) and a second KP signal component (2b, 2b, 2b) of the KP signal (2) at an angle (α) to one another on the vehicle sensor device (3) of the motor vehicle (motor vehicle) fall; the motor vehicle sensor device (3) receives the first (2a, 2aa, 2ba) and the second KP signal component (2b, 2ab, 2bb) in a direction-resolved manner; - The direction-resolved received KP signal components (2a, 2aa, 2ba, 2b, 2ab, 2bb) for KP emitter authentication by triangulation at least indirectly a place of origin and thus the KP emitter device (1) are assigned. Method according to Claim 1 in which the motor vehicle sensor device (3) has a first (3a) and a second motor vehicle sensor (3b), which motor vehicle sensors (3a, b) are arranged at a distance (5) of at least 1 m from each other, wherein the first vehicle sensor (3a) receives the first KP signal component (2a, 2aa, 2ba) and the second automotive sensor (3b) receives the second KP signal component (2b, 2ab, 2bb). Method according to Claim 1 or 2 in which the KP emitter device (1) has a first (1a) and a second KP emitter (1b), which KP emitters (1a, b) are arranged at a distance (30) of at least 1 m from each other, wherein the first KP emitter (1a) emits the first KP signal component (2aa) and the second KP emitter (1b) transmits the second KP signal component (2bb). Method according to one of the preceding claims, in which the communication partner (KP, KP vehicle) is a second motor vehicle (KP vehicle). Method according to the Claims 3 and 4 in which the KP emitter device (1) is integrated in an exterior lighting system of the further motor vehicle (KP motor vehicle), preferably in the front headlights and / or in the rear headlights. Method according to one of the preceding claims, in which the KP emitter authentication is compared with a result of a signal delay-based distance measurement. Method according to one of the preceding claims, in which the motor vehicle (motor vehicle) additionally has a motor vehicle emitter device and the communication partner (KP, KP motor vehicle) additionally has a KP sensor device, wherein the motor vehicle emitter device generates a motor vehicle signal with a first motor vehicle Signal component and a second vehicle signal component emits which vehicle signal components fall at an angle to each other on the KP sensor device, wherein the vehicle sensor device receives the first and the second vehicle signal component direction-resolved and the direction-resolved received vehicle signal components for a motor vehicle Emitter authentication can be used. Method according to one of the preceding claims, in which the KP signal (2) and optionally the motor vehicle signal are electromagnetic signals. Method according to one of the preceding claims, wherein in the course of the KP emitter authentication a data record is transmitted which is used as a key for an encrypted data transmission or for the generation of such a key. Method according to Claim 9 in which the data record is transmitted by the communication partner (KP, KP vehicle) to the motor vehicle (motor vehicle), preferably with the first (2a, 2aa, 2ba) and / or the second KP signal component (2b, 2ab, 2bb) , Method according to the Claim 7 combined with Claim 9 or 10 in which the key is generated, wherein in the course of motor vehicle emitter authentication, a vehicle record is transmitted, which is used together with the KP record to generate the key. Method according to one of Claims 9 to 11 in which the key is generated, wherein for the generation of the key additionally a result of a signal delay-based distance measurement is used. Method according to one of Claims 9 to 12 in which the transmitted or generated key is used for the encrypted transmission of a secondary key, which secondary key is then used in a subsequent encrypted data transmission. Motor vehicle (motor vehicle) with a motor vehicle sensor device, designed to carry out a method according to one of the preceding claims. Set of a motor vehicle (motor vehicle) according to Claim 14 and another motor vehicle (KP-Kfz), which motor vehicles (motor vehicle, KP-Kfz) for performing a method according to Claim 5 , optionally also in conjunction with one of Claims 6 to 13 , are furnished.

Images