Method for checking the association of radio nodes and of objects with a radio environment

Abstract

A method for checking the association of radio nodes and objects to a radio environment with a radio node set having at least three radio nodes spaced apart from one another, each with a radio interface and its separate timer, wherein at least two radio nodes are reference radio nodes with known distances from one another and at least one radio node is a test radio node, the association of which with the radio environment of the reference radio node is checked. During a measuring process, signals are emitted and received by radio nodes of the radio node set, wherein at least two radio nodes of the radio node set operate as transceivers and at least one radio node exclusively operates as a transmitter or exclusively operates as a receiver or a transceiver.

Claims

1. A method for checking an association of radio nodes and of objects with a radio environment, the method comprising: providing a radio node set of at least three radio nodes spaced apart from each other, each radio node of the radio node set has a radio interface and a timer, wherein there is a time offset between each timer of the radio nodes, wherein at least two radio nodes of the radio node set are reference radio nodes, a distance between each reference radio node and the other reference radio nodes being known and the reference radio nodes form a reference system with the radio environment, at least one radio node of the radio node set is a test radio node, and an association of the at least one test radio node with the radio environment of the reference system is checked, transmitting and receiving signals during a measuring process of radio nodes of the radio node set; operating, during the measuring process, at least two radio nodes of the radio node set operate as transceivers and at least one radio node exclusively as a transmitter or exclusively as a receiver or as a transceiver during the measuring process; determining, in a first evaluation step of an evaluation process, a system transfer function between two radio nodes of the radio node set and/or a time offset between the timers by two radio nodes of the radio node set by received signals; determining, in a second evaluation step of the evaluation process, on the basis of the system transfer function and/or the time offset from the first evaluation step, at least one distance information between an object in the radio environment of the two radio nodes and the two radio nodes and/or at least one distance information between the two radio nodes as a result; performing, during the evaluation process, in a first pass, the first evaluation step and the second evaluation step at least once for at least one pair of reference radio nodes; performing, during the evaluation process, in a second pass, the first evaluation step and the second evaluation step at least once for a test radio node and a reference radio node; comparing, in the comparison process, at least one result of the first pass of the evaluation process with at least one result of the second pass of the evaluation process; and making a decision as to whether the association of the test radio node and/or the object with the radio environment of the reference system is positive or negative, based on at least one result of the comparison process.

2. The method according to claim 1, wherein, in the second evaluation step, on the basis of the system transfer function and/or the time offset from the first evaluation step, at least one distance information between the two radio nodes is determined.

3. The method according to claim 1, wherein, the measuring process comprises at least two measurement cycles, wherein in each measurement cycle, successively each transceiver transmits a transmission signal having a carrier frequency during a transmission period, and the transmitted transmission signal is received by at least the other transceivers during a receive period, wherein the transmission signals of the transceiver are mutually coherent at least during a measurement cycle, wherein the carrier frequency of each measurement cycle differs from the carrier frequencies of all other measurement cycles, and wherein, if a radio node operates as a transmitter during the measuring process, the at least one transmitter in each case emits a transmission signal having a carrier frequency during at least one additional transmission period, before or during or after one of the measurement cycles, wherein the transmission signal is received by the transceivers.

4. The method according to claim 1, wherein the radio node set comprises at least four radio nodes and at least three radio nodes of the radio node set operate as transceivers during the measuring process.

5. The method according to claim 1, wherein the radio node set comprises at least four radio nodes and during the measuring process at least two radio nodes of the radio node set operate exclusively as transmitters or exclusively as receivers or as transceivers during the measuring process.

6. The method according to claim 1, wherein the radio node set comprises at least four radio nodes and at least three radio nodes of the radio node set form the reference system as reference radio nodes.

7. The method according to claim 3, wherein within each measurement cycle, a second signal transmitted and each subsequent transmission signal is formed from at least part of one of the signals received during the same measurement cycle.

8. The method according to claim 3, wherein during the measuring process, the measurement cycle is repeated a plurality of times and the carrier frequency of the transmission signals for each repetition assumes a predetermined value within the frequency domain and the received signals are determined within a measurement frequency domain.

9. The method according to claim 8, wherein each transmission signal has a bandwidth in the transmission period, and wherein the bandwidth is at most 1% of the measurement frequency domain.

10. The method according to claim 1, wherein in the evaluation process, both in the first pass and in the second pass, in each case a distance information is determined for a plurality of objects and the distance information from the first pass is in each case compared with the corresponding distance information from the second pass.

11. The method according to claim 1, wherein at least the measuring process and the evaluation process are repeated several times and several system transfer functions are determined, a first motion profile of at least one object or of the test radio node is determined on the basis of the results of the first passes and on the basis of the results of a second run, a second motion profile of the object or of the test radio node is determined and the first motion profile is compared with the second motion profile in the comparison process.

12. The method according to claim 1, wherein a first motion profile of the test radio node is determined by means of an inertial sensor and is compared in the comparison process to a second motion profile, wherein the second motion profile is determined based on the results of several first passes and/or on the results of several second passes.

13. The method according to claim 1, wherein at least the measuring process and the first pass of the evaluation process are repeated a plurality of times and in the comparison process, the results of the plurality of first passes are compared with at least one result of the second pass.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) The present invention will become more fully understood from the detailed description given hereinbelow and the accompanying drawings which are given by way of illustration only, and thus, are not limitive of the present invention, and wherein:

(2) FIG. 1 shows a reference system and test radio node,

(3) FIG. 2 shows a reference system and test radio,

(4) FIG. 3 shows chaining of radio environments in the event of a relay attack,

(5) FIG. 4 shows formation of an extended radio environment ID in connection with classification and pattern recognition methods for the identification and defense of relay attacks,

(6) FIG. 5 shows an overview of the measurement constellation, and

(7) FIG. 6 shows a time measurement sequence.

DETAILED DESCRIPTION

(8) 1 Definition and Modeling of a Radio Environment

(9) The content of the method according to the invention is to check a test radio node with regard to its association (presence) within the radio environment of a system of reference radio nodes. For this purpose, the transmission behavior between the radio nodes (test radio nodes and reference radio nodes) is to be determined and used to determine the positional relationships of radio nodes and objects.

(10) A radio environment is a space around a system of reference radio nodes, the properties of which are determined by physical (e.g., free-space path loss), structural (e.g., walls) or system-related boundary conditions (e.g., maximum output power). The reference radio nodes are spatially distributed; the distances from each other or the position to one another is known. Thus, the reference radio nodes form a reference system coordinate system by means of their positional relationships.

(11) Radio nodes with their antennas as sources and sinks of electromagnetic radiation energy: With the help of their antennas (also emitters), the radio nodes are able to convert electrical signals into electromagnetic waves and, conversely, convert the energy of an electromagnetic wave into an electrical signal, which can then be further processed.

(12) In the sense of the other embodiments, the radio nodes with their antennas, which are small in comparison to the dimensions of the space or the objects, are regarded as point sources and point sinks of electromagnetic energy.

(13) The radio nodes in the sense of the method each have their own time base T, with which a timer Z (T) controls all processes and on the basis of which transmission signals are generated and received signals are evaluated. When performing the method, the time and frequency offsets must be observed, and their effects corrected. The details of this correction are not the subject of this description. For the further considerations, it is assumed that this correction has been implemented.

(14) Propagation of electromagnetic waves: The propagation of electromagnetic waves is determined by the electric and magnetic properties of the medium in which the waves propagate. Electromagnetic waves radiate from the antennas in a straight line. The propagation along a path can be mapped by a linear time-invariant system with a transfer function

(15) $H\left(j\omega \right)=\underset{i=1}{\overset{n}{.Math.}}{a}_i.Math.e^{-j\omega \frac{\mathrm{di}}{c}}.$
A path is characterized by the amplitude response a=e.sup.−αd (first term) and the phase response

(16) $-j{\omega }^{\frac{di}{c}}.$
α describes an attenuation coefficient and d describes the electrical length of the path between the antennas. The phase response is largely determined by the quotient

(17) $\frac{d}{c}.$
This is also called group delay t.sub.g, wherein c is the speed of light. The term

(18) $e{-}_g^{\mathrm{wt}}$
describes the delay of a wave by t.sub.g in the frequency domain.

(19) In a radio environment, airborne propagation is of particular interest, wherein the waves can be reflected, refracted, diffracted and scattered at interfaces, while interfaces are to be understood as transitions to bodies having properties other than air, which are also referred to below as objects.

(20) Objects are bodies with electrical material properties other than air, which essentially reflect incident electromagnetic waves but also influence the propagation behavior through diffraction, scattering or refraction. Objects are not able to generate electromagnetic waves, nor can they convert electromagnetic energy into electrical signals.

(21) It should be noted that phase shifts can occur at interfaces. In addition, the passage through a body or an object influences the direction of propagation through refraction and the speed of propagation of a wave. In the sense of the further considerations, these effects will not be discussed further since they would make the selected models more complex without fundamentally changing the overall message.

(22) Basically, with regard to the propagation of radiation between two points, a distinction is made between the propagation along the direct path and the propagation along indirect paths extending along objects through reflection. In the other representations, the propagation of a wave is represented by a beam and thus the point of reflection (of the beam) is reduced to a point on the surface of the object. For clarity of presentation, the objects are reduced to the point-shaped reflection point, which implicitly includes compliance with the continuity conditions at the interfaces.

(23) Indirect paths are longer than the direct path; the electromagnetic wave is generated with the help of an antenna and propagates indirectly via a reflection point to the receiving antenna, where part of the energy is converted into an electrical signal.

(24) At the receiving antenna, the field distribution is created as a superposition of the energy that spreads over each path. In n propagation paths, the result is the channel transfer function as a superposition of the channel transfer functions of the individual propagation paths

(25) $H\left(j\omega \right)=a.Math.e^{-j\omega }\frac{d}{c}.$
If you now consider the corresponding transformation of the channel transfer function H (jω) in the time domain, then the channel impulse response is created:
h(t)=F.sup.−1{H(jω)}  a.
h(t)=Σ.sub.i=1.sup.na.sub.i.Math.δ(t−t.sub.g,i)  b.

(26) It can be seen that the individual signal paths, attenuated by the factor a.sub.i, are mapped into the channel impulse response as single pulses δ(t), each being delayed by the group delay t.sub.g,i.

(27) With the presented properties, a radio environment in the sense of the transmission properties can be modeled by a spatial distribution of radio nodes and objects in the space, wherein:

(28) the transmission behavior between the antennas of the radio nodes is determined by a linear, time-invariant system of propagation paths,

(29) the propagation paths are shown as beams whose transfer function is determined by the propagation velocity and the length of the path,

(30) radio nodes with their antennas are reduced to points in a coordinate system, wherein the antennas operate as sources and sinks of electromagnetic energy and their supply or received signals form the input as well as the output quantities of the linear time-invariant transfer system.

(31) Objects are reduced to points in a coordinate system and in each case map the positions of the reflection of the corresponding propagation beam or path.

(32) In the sense of the method, a measuring process is assumed in which the corresponding input signals can be generated within an environment with radio nodes and objects by using the radio nodes, and in which the corresponding output signals can be made available for further processing.

(33) This measuring process can run in the time domain as well as the frequency domain. The basis for obtaining channel impulse responses is created in the time domain, preferably by using impulse-like signal forms. In the frequency domain, the basis for obtaining channel transfer functions is preferably created by using ramp frequency signals. The derivation of the system transfer functions M.sub.ij=F(H.sub.ij (jω); T.sub.offset,ij, f.sub.offset,ij) takes place in a first evaluation step after the measuring process in the frequency domain, or the equivalent representation takes place in the time domain m.sub.ij=f (h.sub.ij (t); T.sub.offset,ij, f.sub.offset,ij) with the corresponding channel impulse responses h.sub.ij (t) or channel transfer functions H.sub.ij (jω). The channel impulse responses or channel transfer functions describe the propagation behavior of an electromagnetic wave from the position P.sub.j (x.sub.j, y.sub.j, z.sub.j) of the radio node j, where it is generated by a point source, to the position P.sub.i (x.sub.i, y.sub.i, z.sub.i) of the radio node i, where energy of this electromagnetic wave is converted by the antenna (punctiform energy sink) of the radio node i into an electrical signal and is processed further by the radio node. The corresponding time offsets result from the offset between the time bases T.sub.i and are determined by T.sub.offset,ij=T.sub.i−T.sub.j. In this case, T.sub.ij=−T.sub.ji.

(34) For the purposes of further considerations, first the measuring process and the first evaluation step are completed, and the system transfer function for the radio nodes involved is available. The number and length of the paths or accumulated paths or differential paths have been determined using known methods. An evaluation option utilizes the representation of the system transfer function in the time domain—the channel impulse response—in which the paths can be derived directly as Dirac impulses, which are shifted in time with the signal delays. If the measuring process was performed in the frequency domain, the equivalent representation in the time domain must first be determined.

(35) 2 Derivation of Position Information from Distance Information

(36) Below, the derivation of position information on the basis of the functions or determined paths described above shall be addressed.

(37) FIG. 1 shows a corresponding minimal configuration of a radio node set of three radio nodes F1, F2 FE and an object PO in two dimensions. An interpretation of the method within a space is expressly part of the method. For the sake of clarity, the presentation has been reduced to a flat image. The radio nodes F1 and F2 operate as transceivers. The radio node FE as a further radio node operates in one of three different operating modes during the measuring process. In mode 1, the further, here third radio node FE operates like the transceivers F1 and F2 as a transceiver. In mode 2, the further radio node FE operates exclusively as an emitter or a transmitter and in mode 3, only as a receiver. It applies to all radio nodes that the transmission operation only takes place in assigned time domains and that two radio nodes of the radio node set do not transmit at the same time.

(38) The four units (three radio nodes and one object) are shown as double circles, with the inner circle symbolizing the differences. A dashed inner circle represents an object. A black filled inner circle represents a radio node F1 or F2, which operates exclusively as a transceiver. A not-filled inner circle represents the further radio node FE, which operates in one of three different modes.

(39) The distance from one another is known for two of the radio nodes of the radio node set. These radio nodes are reference radio nodes and form a reference system. They are at different positions in the space. They form the basis for the introduction of a reference coordinate system, the dimensions of which are determined by the number of reference radio nodes with different positions in the space and which allow for the derivation of positional relationships.

(40) According to the assumptions presented, the units are reduced to points in the space p.sub.i (x.sub.i, y.sub.i, z.sub.i; these are located in the center of the associated circles. The propagation paths are represented by rays that begin and end at the points pertaining to the units. Continuous rays indicate direct propagation paths between radio nodes. Dashed rays indicate propagation paths that lead to an object or come from an object. The electromagnetic wave is reflected on the object in order to be processed by the radio nodes that are in the receive mode. Rays with two arrows indicate that the propagation path is traversed in both directions. Rays with only one arrow indicate that the propagation path is only traversed in one direction. From the many possible configurations, 3 will be highlighted.

(41) 2.1 Configuration: Reference Nodes: FE, F2 Test Node: F1

(42) In the first configuration, the further radio node FE operates exclusively in a receive mode. Reference radio nodes are the further radio node FE and the second transceiver F2, the positions or distances of which are known. The test radio node is the radio node F1 operating as a transceiver. In this configuration, all time offsets between the radio nodes can be determined and thus, the four system transfer functions M.sub.12, M.sub.21, M.sub.FE,1, M.sub.FE,2 can be determined in the frequency domain, or m.sub.12, m.sub.21, m.sub.FE,1, m.sub.FE,2 can be determined in the time domain.

(43) Since the radio nodes have been reduced to points, there is no reflection at the radio nodes. Thus, each of said system transfer functions contains the information about two propagation paths W.sub.1 and W.sub.2, wherein W.sub.1 is the direct path with the length D(W.sub.1) between the radio nodes and W.sub.2 is the indirect path with the length D(W.sub.2) between the respective radio nodes via a reflection on the object at point P.sub.4.

(44) M.sub.FE,1:

(45) M.sub.FE,1:W1 (H.sub.FE,1:W1(jω);T.sub.off:FE,1) With W.sub.1: P.sub.1.fwdarw.P.sub.3 .fwdarw.D.sub.FE,1 (W.sub.1)=D.sub.P3,P1

(46) M.sub.FE,1:W2 (H.sub.FE,1:W2(jω);T.sub.off:FE,1) With W.sub.2: P.sub.1.fwdarw.P.sub.4.fwdarw.P.sub.3 .fwdarw.D.sub.FE,1 (W.sub.2)=D.sub.P4,P1+D.sub.P3,P4
M.sub.21:

(47) M.sub.21:W1 (H.sub.21:W1M;T.sub.off:21) with W.sub.1: P.sub.1.fwdarw.P.sub.2 .fwdarw.D.sub.21 (W.sub.1)=D.sub.P2,P1

(48) M.sub.21:W2 (H.sub.21:W2M;T.sub.off:21) with W.sub.2: P.sub.1.fwdarw.P.sub.4.fwdarw.P.sub.2 .fwdarw.D.sub.21 (W.sub.2)=D.sub.P4P1+D.sub.P2P4
M.sub.FE, 2:

(49) M.sub.FE,2: W1 (H.sub.FE,2:W1 (jω); T.sub.off:FE,2) with W.sub.1: P.sub.2.fwdarw.P.sub.3 .fwdarw.D.sub.FE,2 (W.sub.1)=D.sub.P3,P2

(50) M.sub.FE,2: W2 (H.sub.FE,2:W2(jω); T.sub.off:FE,2) with W.sub.2: P.sub.2.fwdarw.P.sub.4.fwdarw.P.sub.3 D.sub.FE,2 (W.sub.2)=D.sub.P4,P2+D.sub.P3,P4
M.sub.12:

(51) M.sub.12:W1 (H.sub.12:W1(jω); T.sub.off:12) with W.sub.1: P.sub.2.fwdarw.P.sub.1 .fwdarw.D.sub.12 (W.sub.1)=D.sub.P1,P2

(52) M.sub.12:W2 (H.sub.12: W2(jω); T.sub.off:12) with W.sub.2: P.sub.2.fwdarw.P.sub.4.fwdarw.P.sub.1 .fwdarw.D.sub.12 (W.sub.2)=D.sub.P4P1+D.sub.P2P4

(53) With the aid of the distances D.sub.P1, P2 and D.sub.P1,P3 determined from the direct paths, two circles result about the positions P.sub.2 and P.sub.3 with the radii D.sub.P1,P2 and D.sub.P1, P3, respectively. The position of the test radio node is located at the intersections of these two circles. Since there are two intersections, the position determination for the test node is not unambiguous in this configuration.

(54) The position of the object can be determined via the indirect paths D.sub.ij (W.sub.2). The length of the respective indirect paths forms the leg length sum of two legs of a triangle, each beginning at the position of the two radio nodes involved and ending at a common point, and which create an ellipse (in 3D, an ellipsoid) on the edge (in 3D, the surface) where the object is located. It is therefore only possible to determine the position of the object with respect to an isoline (in 3D, an isosurface) which has the shape of an ellipse. If only the reference nodes are used to determine the position of the object, then only one ellipse can be parameterized and thus used to determine the position. The ellipse has its focal points in the positions P.sub.2 and P.sub.3 of the reference radio nodes, the sum of the two legs of the triangle having the length

(55) D.sub.FE,1 (W.sub.2)=D.sub.P4, P2+D.sub.P3,P4. This ellipse is not shown within FIG. 1.

(56) If the results found using the test node are also used to determine the position, the parameters for three ellipses with different focal points can be determined. The object is located at the intersection of the three ellipses:

(57) 1. Ellipse: focal points: P.sub.1 and P.sub.2, leg sum of the triangle D.sub.2,1 (W.sub.2)=D.sub.P4,P1+D.sub.P2,P4

(58) 2. Ellipse: focal points: P.sub.1 and P.sub.3, leg sum of the triangle D.sub.3,1 (W.sub.2)=D.sub.P4,P1+D.sub.P3,P4

(59) 3. Ellipse: focal points: P.sub.2 and P.sub.3, leg sum of the triangle D.sub.3,2 (W.sub.2)=D.sub.P4,P2+D.sub.P3,P4

(60) 2.2 Configuration: Reference Nodes: F1, F2 Test Node: FE

(61) In the second configuration presented, the further radio node FE is the test node and operates exclusively in the receive mode. The transceivers F1 and F2 are the reference nodes that form the reference system. The position of the radio nodes F1 and F2 is thus known. In this configuration, not all time offsets can be determined between the radio nodes and therefore only the two system transfer functions M.sub.12, M.sub.21 in the frequency domain or m.sub.12, m.sub.21 in the time domain can be fully determined.

(62) The system transfer functions again contain the information about two propagation paths W.sub.1 and W.sub.2, wherein W.sub.1 is the direct path with the length D(W.sub.1) between the radio nodes and W.sub.2 is the indirect path with the length D(W.sub.2) between the respective radio nodes via a reflection on the object at point P4.

(63) M.sub.21:

(64) M.sub.21:W1(H.sub.21:W1(jω); T.sub.off:21) with W.sub.1: P.sub.1.fwdarw.P.sub.2 .fwdarw.D.sub.21(W.sub.1)=D.sub.P2,P1

(65) M.sub.21:W2 (H.sub.21:W2 (jω); T.sub.off:21) with W.sub.2:P.sub.1.fwdarw.P.sub.4.fwdarw.P.sub.2 .fwdarw.D.sub.21(W.sub.2)=D.sub.P4P1+D.sub.P2P4
M.sub.12:

(66) M.sub.12:W1 (H.sub.12:W1(jω); T.sub.off:12) with W.sub.1: P.sub.2.fwdarw.P.sub.1 .fwdarw.D.sub.12 (W.sub.1)=D.sub.P1,P2

(67) M.sub.12:W2 (H.sub.12:W2(jω); T.sub.off:12) with W.sub.2:P.sub.2.fwdarw.P4.fwdarw.P1 .fwdarw.D.sub.12 (W.sub.2)=D.sub.P4P1+D.sub.P2P4

(68) Since the distance between the radio nodes F1 and F2 is known, the result can only be used to check the measurement. With these functions, no further positional relationships for the test radio node can be generated directly:

(69) Since both functions are closely related to each other due to the reciprocal channel behavior, the extractable information regarding the indirect path W.sub.2 is equivalent. Thus, only the position information relating to an ellipse can be extracted from the results, namely: focal points of the ellipse: P.sub.1 and P.sub.2; leg sum of the triangle D.sub.2,1 (W.sub.2)=D.sub.P4,P1+D.sub.P2,P4. The position of this ellipse is shown in FIG. 1.

(70) It can be shown that instead of the system transfer functions M.sub.FE,2, M.sub.FE,1 in the frequency domain or m.sub.FE,2, m.sub.FE,1 in the time domain, the distance difference transfer function H.sub.Δ(FE,1; FE,2) (jω) or its equivalent function h.sub.Δ(FE,1; FE,2)(jω) can be determined in the time domain using the determined time offset T.sub.offset,21=−T.sub.offset,12. The components of this function include the differences in the delays of electromagnetic waves that propagate from F1 to the node FE, relative to the delays of electromagnetic waves that propagate from F2 to the node FE. The extractable delays of this function lead to differences in distance. ΔD (FE,1; FE, 2)=D.sub.P3, P1−D.sub.P3,P2. With this extracted difference in distance, a hyperbola in the surface (or a hyperboloid in 3D) can be determined with regard to the position information of the radio node FE. The parameters of this hyperbola are: focal points: P.sub.1 and P.sub.2 distance difference of the leg sum of the triangle, which begin in each case at the focal points and end on the hyperbola at one point ΔD(FE,1; FE,2)=D.sub.P3,P1−D.sub.P3,P1−D.sub.P3,P2. This hyperbola is shown in FIG. 1.

(71) In this configuration, the position of the test node along a hyperbolic function in the space, and the position of the object on the edge of an ellipse in the space are limited. With regard to the association, the hyperbole is a particular challenge, since the space of possible positions also includes positions having great, absolute distances.

(72) It can be shown that the test radio node's mode of operation (which is complementary to this configuration from the test radio node's point of view), in which the test radio node solely transmits during an interval and otherwise receives no signals, only results in a parameterized hyperbole as position information for the test radio node.

(73) 2.3 Configuration: All Radio Nodes Operate as Transceivers

(74) It is understood that the configuration in which all three radio nodes F1, F2, FE operate as transceivers delivers the greatest number of usable reception signals. The set of measurements is based on the determination of three system transfer functions, wherein the distance between the radio nodes can be determined: since the distance between the two reference radio nodes is already known, the measurement can be checked by comparing it with the measurement result. A position determination of the test radio node in the plane is possible with only two distance measurements, wherein two positions fulfill the corresponding distance conditions. The position determination is therefore ambiguous.

(75) The position of the object can be determined via the indirect paths. The length of the respective indirect paths forms the sum of the distances or lengths of the two legs of a triangle, each beginning at the position of the two radio nodes involved and ending in a common point, and resulting in an ellipse (in 3D, of an ellipsoid) on the edge where the object is located. It is therefore only possible to determine the position of the object with regard to an isoline that has the shape of an ellipse. If only the reference nodes are used to determine the position of the object, only an ellipse can be parameterized and thus used to determine the position. If the measurement results that were created with the inclusion of the test node are also used to determine the position, the parameters for three ellipses with different focus points can be determined. The object is located at the intersection of the three ellipses.

(76) 2.4 Conclusions

(77) The structure of a system based on radio nodes that operate as transceivers and radio nodes that operate exclusively in a transmit mode or a receive mode allows for a variety of variants, which makes it difficult to predict the system behavior.

(78) The smallest configuration limited to three radio nodes sometimes only allows for limited extraction of position information. It therefore makes sense to increase the number of radio nodes in the reference system in order to increase the reliability of the extracted position information.

(79) However, there are a variety of applications that restrict mobility and access to certain spaces in other ways, for example with walls. In such cases, systems with only two reference radio nodes can provide reliable statements regarding the position of the test node and can support the identification of objects.

(80) 3 Description of a Reference Node System for Determining Propagation Properties

(81) 3.1 Feature Recognition for Reference Radio Node Systems and Qualified Test Radio Nodes

(82) After the possibilities for extracting position information of radio nodes and objects have been presented using system transfer functions, an example of a method in connection with the identification and defense of relay attacks against challenge-response authentication methods will now be explained.

(83) To measure the propagation properties in the system environment, the antennas (and corresponding transmit/receive functions) are configured such that the system both emits electromagnetic radiation and also receives it. More complex approaches, which involve simultaneous sending and receiving, are part of the method but not part of this exemplary embodiment. In the simplest case, only one antenna is used for transmission, whereas all other antennas operate in the receive mode. FIG. 2 shows a reference system consisting of five reference radio nodes spaced apart from one another and a test radio node, each of which are equipped with an antenna.

(84) To characterize the environment, the antennas ANT1 to ANT5 should be positioned at exposed locations so that they radiate energy mainly into areas that are of particular interest. In turn (round-robin), in each case a reference signal is emitted from one position, which is then received by all other antennas. These received signals are then used to extract the complex signal vectors M.sub.ij.sup.A(jω)=f(H.sub.ij.sup.A(jω), T.sub.offset,ij.sup.A, f.sub.offset,ij.sup.A), wherein the useful signal energy is decisively extracted from the measurement result. The channel transfer function H.sub.ij.sup.A(jω) as well as the time and frequency offset T.sub.offset,ij.sup.A, f.sub.offset,ij.sup.A between the radio nodes can be determined by the signal vectors. Following completion of all measurements, a matrix M.sup.A is obtained, which summarizes all determined signal vectors M.sub.ij.sup.A(jω)=f(H.sub.ij.sup.A(jω), T.sub.offset,ij.sup.A, f.sub.offset,ij.sup.A):

(85) $M^A=\left[\begin{array}{ccccc}{M}_{11}^A& M_{12}^A& M_{13}^A& M_{14}^A& M_{15}^A\\ M_{21}^A& M_{22}^A& M_{23}^A& M_{24}^A& M_{25}^A\\ M_{31}^A& M_{32}^A& M_{33}^A& M_{34}^A& M_{35}^A\\ M_{41}^A& M_{42}^A& M_{43}^A& M_{44}^A& M_{45}^A\\ M_{51}^A& M_{52}^A& M_{53}^A& M_{54}^A& M_{55}^A\end{array}\right]$

(86) As already shown, the channel transfer functions H.sub.ij.sup.A(jω) are an essential component of the measured values and contain the information about the propagation behavior or the different propagation paths between the nodes i and j. An important property of the channel transfer function is its reciprocal character (transfer behavior is independent of direction), i.e.,:
H.sub.ij.sup.A(jω)=Hj.sub.ji.sup.A(j)

(87) This property becomes part of the integrity analysis. Taking these restrictions into account, this property can also be used for the generation of position-specific keys and the implementation of corresponding encryption techniques. The channel impulse responses h.sub.ij.sup.A(t) can be derived from the inverse Fourier transform, and via the former, the length of direct and indirect paths can be extracted h.sub.ij.sup.A(t)=F.sup.−1 {H.sub.ij.sup.A(jω)}. An alternative to the inverse Fourier transform is the eigenvalue analysis or signal classification.

(88) The elements M.sub.ii.sup.A(jω) indicate the system property at the respective position, as far as the transmitted and received energy can be separated (high insulating properties required). This creates an image of the transfer function of this antenna to itself. If this property is not implemented, the diagonal elements are all zero.

(89) The system-inherent parameters such as frequency and time offset resulting during extraction require differentiated treatment. The frequency offset, which is largely determined by deviations from the ideal time reference and thus from quartz tolerances, can be regarded as stable over longer periods of time. However, the time offset depends on many unknowns which form a new constellation with each measuring process. Therefore, the calculated time offset is only valid for the length of a measuring process and can be treated as deterministic within this period. In addition, there are other individual parameters that allow for individual recognition of a system component. These mark specific deviations from ideal behavior and can be derived using corresponding models and comparison methods.

(90) A system usually interacts with other components that are part of a larger overall system and should therefore be allowed to access system resources. In the case of an access system, the solution is designed to identify additional objects and to provide them with access to access areas. Through their presence alone (change in the propagation properties due to additional reflections) and their function (emitting electromagnetic radiation, interference radiation), they change or extend the radio environment to a certain extent.

(91) These changes will be considered below. FIG. 2 already shows such an extended radio environment A* using the example of an access system in the presence of a key (qualified component). In this specific case, the influence of the key is to be understood in a broader sense since the key influences the radio environment in connection with its carrier (a person). The carrier of the test radio node can be recognized as an object. A connection is established between the test radio node and the test radio node object represented by the carrier.

(92) The occurrence of a test node and correspondingly associated objects leads to changes in the propagation conditions. In the simplest case, an access system can only conclude that there are changes in the environment if there is a change in the propagation behavior. The extraction of position information as well as motion profiles is also possible for passive objects.

(93) In the active case, all antennas (including the antennas of the additional components) can both send reference signals and receive electromagnetic energy, and the received signals are analyzed, for example, with regard to the useful and interference signal curve and also with regard to the noise properties. The expansion of the system by at least one test radio node leads to an expansion of the matrix of the measurement results.
M.sub.ij.sup.A*(jω)=f(H.sub.ij.sup.A*(jω),T.sub.offs,ij.sup.A*,f.sub.offs,ij.sup.A*).

(94) By including the test radio node in the measuring process, it is possible to expand the features of the radio environment A, so that characteristic features of an extended radio environment A* arise. FIG. 2 shows the expanded measurement options if the test radio nodes, for example test radio nodes contained in keys, are included in the measuring process.

(95) For each additional radio node, the corresponding matrix M.sup.A expands by one row and one column to form a matrix M.sup.A*:

(96) $M^{A*}=\left[\begin{array}{cccccc}{M}_{11}^{A*}& M_{12}^{A*}& M_{13}^{A*}& M_{14}^{A*}& M_{15}^{A*}& M_{16}^{A*}\\ M_{21}^{A*}& M_{22}^{A*}& M_{23}^{A*}& M_{24}^{A*}& M_{25}^{A*}& M_{26}^{A*}\\ M_{31}^{A*}& M_{32}^{A*}& M_{33}^{A*}& M_{34}^{A*}& M_{35}^{A*}& M_{36}^{A*}\\ M_{41}^{A*}& M_{42}^{A*}& M_{43}^{A*}& M_{44}^{A*}& M_{45}^{A*}& M_{46}^{A*}\\ M_{51}^{A*}& M_{52}^{A*}& M_{53}^{A*}& M_{54}^{A*}& M_{55}^{A*}& M_{56}^{A*}\\ M_{61}^{A*}& M_{62}^{A*}& M_{63}^{A*}& M_{64}^{A*}& M_{65}^{A*}& M_{66}^{A*}\end{array}\right]$

(97) The matrix elements M.sub.ij.sup.A*(jω)=f(H.sub.ij.sup.A*(jω), T.sub.offset,ij.sup.A*, f.sub.offset,ij.sup.A*) are essentially characterized by the channel transfer functions H.sub.ij.sup.A*(jω) and the link-specific time and frequency offset (link means connection between two components).

(98) The channel transfer functions now include the passive changes in the propagation behavior due to the additional components as well as the additional characteristics that result from integration into the measuring process. Accordingly, an expanded matrix of channel impulse responses h.sub.ij.sup.A(t) is created, which contains information about the change in propagation paths. It is important to note that the elements of the matrix M.sup.A and the matrix M.sup.A* are not independent of one another since the propagation conditions do not change in all aspects. This can be used for feature extraction and corresponding integrity and plausibility tests.

(99) Similar statements also apply for the system-inherent parameters resulting from the extraction such as frequency and time offset, and for individual features of the individual components extracted beyond that.

(100) 3.2 Changes in a Radio Environment in the Event of a Relay Attack

(101) This section focuses on the changes in the parameters/features of a radio field identification integrity check in the case of a relay attack. Since a relay attack is essentially based on the transfer of signals, this attack should be viewed as a chaining of radio environments, each of which, individually and by way of their interaction, influence the propagation of the reference node signals and the test radio node signals and their evaluation, thus forming a new radio environment. FIG. 3 shows an overview of the constellation in an attack of this type. The result is a radio environment, which is referred to here as A−. It can be seen as a link between the effects of the individual radio environments.

(102) The test radio node ANT6—as a component to be checked for its association/presence in a radio environment—is outside the range of the access system or reference system 1, comprising reference radio nodes ANT1, ANT2, ANT3, ANT4 and ANT5. An attack occurs via a relay system with the attackers 2 and 3, which is spanned by the antennas ANT7.1 and ANT7.2 of the first attacker 2 and the antennas ANT8.1 and ANT8.2 of the second attacker 3. While the first attacker 2 enters the environment of the access system, thereby producing an A* environment characteristic, the second attacker 3 approaches the key owner, that is to say the test radio node ANT 6. A closer look reveals that three radio field environments interact in a relay attack:

(103) the extended environment A* of the access system 1 in the presence of an additional component ANT1-5⇔ANT7.1, which includes properties of the environment A of the access system 1; the first attack system 2 with the antennas ANT7.1 and ANT7.2 produces analog changes of the propagation conditions in the environment A of the access system 1, just like a qualified system (4) would produce them in the case of presence

(104) the environment B (ANT7.2⇔ANT8.1) of the relay system between the two attackers 2 and 3,

(105) the environment C of the key or test radio node ANT6 (ANT8.2⇔ANT6).

(106) A relay attack, which includes security measures in its strategy (terrorist attack) with respect to time and distance bounding based on the signal vector measurements is focused on mapping the shortest path (as shown in A. R. S. C. Hildur Olafsdottir, “On the Security of Carrier Phase-based Ranging”, https://www.researchgate.net/publication/254008732_Physical-layer_attacks_on_chirp-based_ranging_systems, Proceedings of Cryptographic Hardware and Embedded Systems (CHES)). By modifying the signal characteristic, the influence of the phase shift caused by the group delay is compensated for, taking advantage of the periodicity inherent in the method and the associated ambiguity in distance.

(107) This results in a whole series of elements, which are very similar in their properties to the radio environments A and A* and thus form a corresponding link to the extracted features of the environment A for the integrity and plausibility tests. (These basically form the starting point of a feature extraction, in which the access system evaluates the environment.) In addition, configurations are created that connect the radio environments A.fwdarw.A*, B and C to each other via the relay system. On the one hand, information that characterizes the environment A or A* of the access system 1 and the environment B of the relay system 2 and 3 is relocated to the environment C of the key system 4 and received there by the key. On the other hand, information/features of the key radio environment C and the relay radio environment B are transported via the relay system to the reference radio nodes of the access system. The individual radio environments are basically superimposed in their reflection behavior. Key and access system can communicate in encrypted form via the data communication and thereby exchange the most varied results of the feature check with one another, without the relay system being able to influence it. This allows for a coordinated approach when evaluating the various features on both sides (access system and tag).

(108) Before an access request is made by a test radio node, the access system builds up a database and keeps it up to date. This is limited to the radio environment A of the access system 1.

(109) As soon as the system receives an access request, an expanded matrix is created that contains the additional rows and columns that are created when the measuring process is expanded to include the additional key component 4. The results are used for feature extraction and for plausibility testing.

(110) A distinction is made between qualified access and the identification of a relay attack. The measured values determined are evaluated in respect of these two categories. The positive evaluation of the matrix of the extracted (measured) signal vectors with regard to a number of properties/tests leads to a classification of the access request as qualified access. The signal vectors determined correspond to a characteristic of the signal vector matrix M.sup.A*. In the case of a relay attack, the signal vector matrix determined corresponds to a characteristic of the signal vector matrix M.sup.A−, whereby a relay attack can be identified based on the corresponding properties/test. These two matrices are fully illustrated in the following equations:

(111) Qualified Access:

(112) $M^{A*}=\left[\begin{array}{cccccc}{M}_{11}^{A*}& M_{12}^{A*}& M_{13}^{A*}& M_{14}^{A*}& M_{15}^{A*}& M_{16}^{A*}\\ M_{21}^{A*}& M_{22}^{A*}& M_{23}^{A*}& M_{24}^{A*}& M_{25}^{A*}& M_{26}^{A*}\\ M_{31}^{A*}& M_{32}^{A*}& M_{33}^{A*}& M_{34}^{A*}& M_{35}^{A*}& M_{36}^{A*}\\ M_{41}^{A*}& M_{42}^{A*}& M_{43}^{A*}& M_{44}^{A*}& M_{45}^{A*}& M_{46}^{A*}\\ M_{51}^{A*}& M_{52}^{A*}& M_{53}^{A*}& M_{54}^{A*}& M_{55}^{A*}& M_{56}^{A*}\\ M_{61}^{A*}& M_{62}^{A*}& M_{63}^{A*}& M_{64}^{A*}& M_{65}^{A*}& M_{66}^{A*}\end{array}\right]$

(113) Relay Attack:

(114) $M^{A-}=\left[\begin{array}{cccccc}{M}_{11}^{A-}& M_{12}^{A-}& M_{13}^{A-}& M_{14}^{A-}& M_{15}^{A-}& M_{16}^{A-}\\ M_{21}^{A-}& M_{22}^{A-}& M_{23}^{A-}& M_{24}^{A-}& M_{25}^{A-}& M_{26}^{A-}\\ M_{31}^{A-}& M_{32}^{A-}& M_{33}^{A-}& M_{34}^{A-}& M_{35}^{A-}& M_{36}^{A-}\\ M_{41}^{A-}& M_{42}^{A-}& M_{43}^{A-}& M_{44}^{A-}& M_{45}^{A-}& M_{46}^{A-}\\ M_{51}^{A-}& M_{52}^{A-}& M_{53}^{A-}& M_{54}^{A-}& M_{55}^{A-}& M_{56}^{A-}\\ M_{61}^{A-}& M_{62}^{A-}& M_{63}^{A-}& M_{64}^{A-}& M_{65}^{A-}& M_{66}^{A-}\end{array}\right]$

(115) Equivalence on the basis of presence in radio field A: This section initially focuses on the components that display changes in the propagation behavior in the vicinity of the access system.

(116) First, the matrix elements M.sub.ij.sup.A? for i,j=1 . . . 5 are considered.

(117) Since the subsystem 2 of the relay system (ANT7.1⇔ANT7.2) is in the vicinity of the access system 1, the presence of this system only produces changes in the signal vectors which, in a first order, are plausible changes in the sense of a transition of the radio environment A to a possible environment A* (and thus are part of the feature space of A*). The measurement results, however, very effectively show movements in the area of the access system and thus allow for the extraction of motion profiles. If the analysis is now expanded with an inertial sensor system at the test radio node (e.g., in the key, in a smart phone), plausibility tests can be used to demonstrate to what extent the features of the motion on the key side concur with motion on the access system side, and in this way detect an attack.

(118) Equivalence with respect to the additional elements of the radio field A*: Next, the signal vectors derived with the direct inclusion of the key 4 or the test radio node ANT6 and the relay system 2 and 3 or ANT7.1⇔ . . . ANT8.2⇔are considered. While the key is part of the radio environment A* for authorized access, a chaining of 3 transfer functions is created in the event of a relay attack:

(119) ANT1-5⇔ANT71.1.fwdarw.A*

(120) ANT7.2⇔ANT8.1.fwdarw.B

(121) ANT8.2⇔ANT6.fwdarw.C

(122) To map this process in a model, the corresponding channel transfer functions are connected to environments A*, B and C. The changes within the signal vector matrix in the event of a relay attack can thus be represented by the following relationships.

(123) Qualified Access:

(124) 0$M^{A*}=\left[\begin{array}{cccccc}{M}_{11}^{A*}& M_{12}^{A*}& M_{13}^{A*}& M_{14}^{A*}& M_{15}^{A*}& M_{16}^{A*}\\ M_{21}^{A*}& M_{22}^{A*}& M_{23}^{A*}& M_{24}^{A*}& M_{25}^{A*}& M_{26}^{A*}\\ M_{31}^{A*}& M_{32}^{A*}& M_{33}^{A*}& M_{34}^{A*}& M_{35}^{A*}& M_{36}^{A*}\\ M_{41}^{A*}& M_{42}^{A*}& M_{43}^{A*}& M_{44}^{A*}& M_{45}^{A*}& M_{46}^{A*}\\ M_{51}^{A*}& M_{52}^{A*}& M_{53}^{A*}& M_{54}^{A*}& M_{55}^{A*}& M_{56}^{A*}\\ M_{61}^{A*}& M_{62}^{A*}& M_{63}^{A*}& M_{64}^{A*}& M_{65}^{A*}& M_{66}^{A*}\end{array}\right]$

(125) Relay Attack

(126) $M^{A-}=\left[\begin{array}{cccccccc}{M}_{11}^{A*}& M_{12}^{A*}& M_{13}^{A*}& M_{14}^{A*}& M_{15}^{A*}& M_{17}^{A*}& M_{78}^B& M_{86}^C\\ M_{21}^{A*}& M_{22}^{A*}& M_{23}^{A*}& M_{24}^{A*}& M_{25}^{A*}& M_{27}^{A*}& M_{78}^B& M_{86}^C\\ M_{31}^{A*}& M_{32}^{A*}& M_{33}^{A*}& M_{34}^{A*}& M_{35}^{A*}& M_{37}^{A*}& M_{78}^B& M_{86}^C\\ M_{41}^{A*}& M_{42}^{A*}& M_{43}^{A*}& M_{44}^{A*}& M_{45}^{A*}& M_{47}^{A*}& M_{78}^B& M_{86}^C\\ M_{51}^{A*}& M_{52}^{A*}& M_{53}^{A*}& M_{54}^{A*}& M_{55}^{A*}& M_{57}^{A*}& M_{78}^B& M_{86}^C\\ M_{71}^{A*}.Math.M_{87}^B.Math.M_{68}^C& M_{72}^{A*}.Math.M_{87}^B.Math.M_{68}^C& M_{73}^{A*}.Math.M_{87}^B.Math.M_{68}^C& M_{74}^{A*}.Math.M_{87}^B.Math.M_{68}^C& M_{75}^{A*}.Math.M_{87}^B.Math.M_{68}^C& & M_{66}^{A*}& \end{array}\right]$

(127) Since ANT7.1 of the relay attack system 2 is part of the radio environment A*, the elements M.sub.7j.sup.A* are part of the space of the qualified elements M.sub.6j.sup.A* for all j=1..5 and the elements M.sub.7j.sup.A* are part of the qualified space of the elements M.sub.i6.sup.A* for all i=1..5.

(128) In contrast thereto, the elements M.sub.87.sup.B and M.sub.78.sup.B characterize the propagation conditions within the radio environment B, and the elements M.sub.68.sup.B and M.sub.86.sup.B reflect the propagation properties of the radio environment C. When passing through these environments, in addition to the direct path, also the indirect propagation paths existing in these environments are reflected by said environments B and C.

(129) In order to map the distance of the key 4 relative to the access system, corresponding to the environment A*, the phase response must be adapted when using a frequency domain-based method. As described in A. R. S. C. Hildur Olafsdottir, “On the Security of Carrier Phase-based Ranging”, https: //www. researchgate.net/publication/254008732_Physical-layer_attacks_on_chirp based_ranging_systems, Proceedings of Cryptographic Hardware and Embedded Systems (CHES), this is usually done by exploiting the ambiguity of the phase response, which repeats at multiples of the pitch period (wrap-around distance). With knowledge of the frequency step size, a corresponding delay is inserted that basically shifts the direct propagation path to a range valid for recognizing the environment A*.

(130) However, this correction leaves all the relationships of the original direct path to the existing indirect paths (in the respective radio environments of the relay system B and the key C) untouched, i.e., in the measurement result, all indirect paths of environments B and C appear on the key side and on the access system side. If indirect paths are present in the environments B and C, these result in deviations from valid feature distributions in space A*, which are identifiable by plausibility and integrity testing. A cleanup of the relay signals transmitted in each case to the key or the access system in order to influence the indirect paths of environments B and C (which should occur by a relay system) adds a level of complexity that is greater by several orders of magnitude than the complexity of correcting the direct path.

(131) In addition, influence due to the internal properties of the relay system 2, 3 can be expected:

(132) ANT7.1|ANT7.2

(133) ANT8.1|ANT8.2

(134) On the one hand, it can be expected that other characteristic features such as the device (frequency offset) properties or measuring process-specific properties (time offset) will be influenced by the adjustment of the phase response. Depending on the implementation (e.g., frequency conversion and transfer via radio, active bi-directional cable connection with gain to compensate for free space attenuation, etc.), there are distortions that can be detected.

(135) For detection, it is advisable to perform detection and control of various system parameters in addition to the time and frequency offsets mentioned. The corresponding gain settings of the receivers and transmitters and the determined phase offsets of the oscillators can be used for this purpose. While an attack system modifies the phase response to manipulate the measured direct path, increased tracking of these system and link-dependent parameters increases the demands on the relay system, since all distortions must be kept below the detection threshold.

(136) In conclusion, it should be noted that, in addition to the detectability of inconsistencies with regard to indirect propagation paths, the narrow-band measurement of the round-trip time also sets narrow limits for being able to manipulate the propagation characteristics.

(137) 4 Integrity and Plausibility Test for Extended Sets of Features

(138) In the previous sections, radio node and object detection was used in connection with the evaluation of system transfer functions for testing the integrity of the radio environment of a reference system. A corresponding model was initially presented, which enables objects and radio nodes to be mapped in connection with metrologically determined system transfer functions. After that, the derivation of position information based on the propagation paths extracted from the system transfer functions was shown. In addition, an analysis of system transfer functions was shown in the frequency domain. Further, connection-specific parameters such as frequency, time and phase offset were integrated in a feature analysis.

(139) FIG. 4 illustrates how integrity testing of the radio environment, using analysis of transfer functions by radio node and object recognition, increases the security of an access system that utilizes challenge-response based authentication methods.

(140) Simple methods for establishing distance bounding, as is already possible with narrow-band time-based methods for round-trip time measurement, can be enhanced, and security can be increased. An inclusion of the time and frequency offsets determined on the part of the reference system and the test radio node allows for the definition of further relevant tests and thus an increase in the confidence level.

(141) In conjunction with the existing possibilities for absolute time and distance measurement, a feature space is thus created that allows for unambiguous identification of radio nodes within their radio environment. Channel occupancy scans and protocol statistics allow for conclusions to be drawn about interfering field influences and can also be incorporated in the corresponding integrity tests. In addition to the features described here, it is also possible to use further sensors for the extraction of motion profiles. For this purpose, inertial sensor technology is suitable, which detects both the position of an object and its movement.

(142) Classification analyses, such as the support vector machine, can verify the plausibility and integrity of the measurement results and thus the presence of a radio node within an environment.

(143) Extending to the identification of environment-specific objects and radio nodes and the corresponding determination of the position information allows for a reduction in the sensor data for positional relationships and thus the generation of higher quality features that can be included in the integrity check. In addition, the determined measurement data leads to over-determined equation systems that can be used to derive additional quality parameters.

(144) An expansion to detect further objects also strengthens the quality of the classification.

(145) A distinction is made between:

(146) Reference object that is physically connected to the reference radio node,

(147) The test object that is physically connected to the test radio node,

(148) Environment objects in the immediate vicinity of the reference object and the test object.

(149) This procedure allows for the integrity check to be implemented quantitatively and qualitatively. A possible procedure for determining a minimum number of tests to be tested as positive may include the following aspects:

(150) Was an object recognized (at all) by the reference system and were positional relationships (in the simplest case isolines of a distance, a distance difference or also a distance sum or accumulated distance) extracted?

(151) Was an object recognized with the inclusion of the test node or in the measurement results of the test node?

(152) Was the test radio node recognized by the reference system and were positional relationships (in the simplest case isolines of a distance, a distance difference or a distance sum or accumulated distance) extracted?

(153) Object Detection

(154) Does the determined position information of an object match the position information of the test radio node within predetermined tolerances, so that it can be concluded that the object is the test radio node object?

(155) Do the objects determined by the reference system with the inclusion of the reference radio nodes have a meaningful connection to the objects determined by the reference system with the inclusion of the test radio node? E.g.,:

(156) Are additional objects recognized with the inclusion of the test node?

(157) Does the result of the object recognition, with the inclusion of the test radio node, support the results of the object recognition with exclusive use of the reference node? E.g., does the confidence level increase to a position determination or does the confidence level reduce, e.g., with the use of RAIM (receiver autonomous integrity monitoring)

(158) According to the determined position information, is the test node and the test node object located within a predetermined area within the reference node coordinate system?

(159) Is the test node located within a maximum distance from the reference system? (distance bounding)

(160) Is the test node within a zone around a target position? (zoning)

(161) Motion Profiles

(162) Does the confidence level of the object motion profiles determined by the reference system increase with the inclusion of the test radio node in the measuring process or is the confidence level reduced, e.g., by using RAIM (Receiver Autonomous Integrity Monitoring)

(163) Sensor Fusion

(164) Checking of characteristic features of the motion profiles extracted by object and radio node recognition

(165) Comparison of the characteristic features of the position-based motion detection upon evaluation of motion profiles using inertial sensor technology.

(166) As a rule, the results that are won exclusively by using the measurement results of the reference radio nodes are compared with the results derived by additionally incorporating the test radio nodes. It can easily be shown that a large number of characteristic sensor data can be determined in this way. The extraction of high-quality features is therefore essential in order to quickly reduce the mass of data to a number of decision criteria. All methods can also be used.

(167) 5 Measuring Process

(168) FIG. 5 schematically shows an arrangement of three radio nodes F1, F2 and FE for performing a further alternative embodiment of the method according to the invention for radio measurement applications. Each of the three radio nodes each has a receiving unit RX, a transmitting unit TX, a data interface DS1 or DS2 or DS3 (can also be identical to the radio interface) and its own timer Z(t) or Z (t′) or Z (t″). Further, the radio nodes include a unit which allows for feeding received signal vectors back to the transmitting unit as input signal vectors. The transmission signals are transmitted between the radio nodes via a propagation medium (PM), which is determined by the channel transfer functions.

(169) To distinguish between the radio nodes, the corresponding magnitudes are marked by indents (for example, frequencies and times of f′.sub.p, ω′.sub.p, t′, . . . ).

(170) The associated timers Z(t), Z(t′) Z(t″) each comprise a quartz oscillator and specify a time measure for the respective time base t, t′ or t″ of the respective radio node.

(171) The timers each generate a time reference for sequence control within the respective radio node. The sequence control controls the time response of all relevant function blocks in the respective radio nodes. The sequence control also specifies the times for a frequency change.

(172) It should be noted that the temporal lengths T.sub.MU, T′.sub.MU and T′″.sub.MU each denote a predefined smallest time interval, the smallest time interval also being referred to as the measuring unit time T.sub.MU.

(173) It is assumed that the timers progress in the same units, which are derived from the respective time base. If there is a frequency offset between the timers, the frequency offset must be corrected in order to carry out the method.

(174) FIG. 6 illustrates a sequence of the method according to the invention having three radio nodes, via the respective time axis t or t′ or t″. There is a time offset T.sub.offs,1 or T.sub.offs,2 between the individual time bases.

(175) A step sequence consists of three steps, wherein in the first step S1 in the transmit mode, the radio node F1 emits an initial signal T.sub.F1 which is received by the two radio nodes F2 and FE, in the second step S2, the radio node F2 emits a response signal T.sub.F2 which is received by the radio node F1 transponder FE, and in the third step S3, the radio node FE emits a response signal T.sub.FE which is received by the radio nodes F1 and F2.

(176) The step sequence assumes a time interval T.sub.SF, is repeated several times, thereby changing the frequency ω.sub.p, ω′.sub.p, ω″.sub.p by the phase ω.sub.step, the index m indicating the repetitions. The transmit signals are coherent at least during a step sequence, i.e., during the time interval T.sub.SF.

(177) It should be noted that the method includes:

(178) Steps having one or more transmission windows or receive windows for the individual radio nodes,

(179) Step sequences comprising at least two steps with a time length T.sub.SF, T′.sub.SF or T″.sub.SF of the individual radio nodes,

(180) Measurement cycles as a series of steps sequences with a time length T.sub.Z, T′.sub.Z or a time length T″.sub.Z,

(181) Series of measurement cycles.

(182) Each sequence of steps has transmission and receive areas, which are each divided into transmission windows and receive windows. The time length of a transmission or receive window is T.sub.MU, T′.sub.MU or T″.sub.MU.

(183) It should be noted that the index n indicates the position of the time window within one of the step sequences and has a duration of T.sub.SF=n.sub.max×T.sub.MU. The index has a range of values n=0, 1, . . . (n.sub.max−1), wherein nmax is calculated from the specific configuration of the measurement cycle.

(184) The index m indicates the position of the sequence of steps within the measurement cycle, wherein m=0,1, . . . (m.sub.max−1). m.sub.max is determined by the specific configuration and depends, among other things, on the number of frequencies for which the transfer function is to be determined. A series of step sequences is called a measurement cycle. A measurement cycle of the radio node F1 has a length of T.sub.Z=m.sub.max.Math.T.sub.SF. A measurement cycle of the radio node F2 has a length of T′.sub.Z=m.sub.max.Math.T′.sub.SF, etc.

(185) With regard to the phase coherence, it is noted that the transmitting and receiving unit of the transponder, together with the timer Z(t) and the time-frequency sequence control, form a phase-coherent domain.

(186) For a required length of time, i.e., for any number of steps, the phase-coherent domain of the radio nodes is characterized by a fixed relationship between the phase position of the transmission signals T.sub.FK (m,n) for all indices n within a sequence of steps in which the transmitting unit transmits, and the reference phase for the determination of the receive vectors R.sub.FK (m,n) for all indices n within a sequence of steps in which the receive unit receives.

(187) If the phase coherence is limited to a sequence of steps, the coherence length is T.sub.SF for the radio node F1 or T.sub.SF for the radio node F2, etc. If the phase coherence is expanded to a measurement cycle, the coherence length is T.sub.Z for the radio node F1 or the coherence length is T′.sub.Z for the radio node F2, etc. In the case of a series of measurement cycles, the coherence length is extended accordingly to the time length of the series of measurement cycles.

(188) It is understood that the transition areas, which are characterized by settling processes, are exempt from the requirement for coherence. The requirements regarding the phase coherence of the respective radio nodes result in a phase coherence of the radio nodes to each other, if the timers differ only in a time offset and otherwise both nodes follow the same timing on the basis of T.sub.MU, T′.sub.MU or T″.sub.MU and the receive and transmission response is complementary to each other.

(189) The receive units RX of the radio node transfer the received signals into a discrete-time representation. The receive results R.sub.F1, R.sub.F2 and R.sub.FE are still referred to as receive vectors.

(190) The receive vectors R.sub.FK (m,n) assume the form of a complex number, wherein the number is proportional to the magnitude of the received signal and is determined relative to the respective time base at discrete times, e.g., for F2 relative to the time base t′ at the times t′=n.Math.*T.sub.MU+m.Math.T.sub.SF.

(191) In addition, the transponder FT is designed to determine a signal vector VFK from the received signal R.sub.FK with the aid of a function F(R.sub.FK, . . . ) and to exchange it using the data interface DS-FK.

(192) For the corresponding representation, the abbreviation FK establishes the relationship to the respective radio node.

(193) In order to be able to perform the first mode of the method according to the invention, the radio nodes are additionally designed to transmit the signal vector V.sub.FK to the transmission unit TX and to process them further by means of the transmission unit TX and to generate the next transmission signal based thereon.

(194) The time and frequency control ZFS1 or ZFS2 operates on the basis of a time unit T.sub.MU and ensures that all relevant changes of state (sampling of the signal vectors, RX/TX-TX/RX transitions, frequency changes) are permanently connected to the time base specified by the respective timer and can be related to the latter:

(195) The time and frequency control ZFS of the radio nodes is also responsible for ensuring that the coherence between the signals and vectors is maintained over the required length, i.e., taking into account settling processes, and that all functional units are also located in the transition areas of the linear control areas (such as frequency generator, PLL).

(196) As a result, the time and frequency control ZFS in each case generates a phase-coherent domain PD in which the high-frequency synthesis, the generation of the corresponding transmit vectors and the extraction of the receive vectors are phase-related to one another in a fixed relationship.

(197) The repetitions of a sequence of steps form a measurement cycle, wherein m is incremented with each completed sequence of steps and ωp is selected according to the requirements. In the case of a frequency sweep, ωp is increased by ω.sub.step with each measurement cycle.

(198) In the dimensioning, both the respective settling processes and the limits of maximum time offset fluctuations, achievable through coarse synchronization, should be taken into account and the step delay or guard intervals T.sub.SV are to be interpreted accordingly.

(199) A discrete-frequency sampling of the system transfer function takes place on the basis of the determined signal vectors. These allow for a separate determination of time and frequency offsets, as well as of the corresponding channel transfer functions.

(200) 6 Summary

(201) Published approaches for relay attack strategies on frequency domain-based signal vector measurement systems concentrate solely on the phase characteristics of the direct path. The technology presented, that is, the method according to the invention, however, incorporates the properties of the multipath wave propagation and makes it easy to draw additional conclusions about the distribution of interference energy. In conjunction with radio node-specific properties, such as the frequency offset, and random parameters related to the measuring process, such as the time offset, an expanded set of features is created that uniquely identify an environment.

(202) With the aid of plausibility and integrity testing, including machine learning methods for classification and pattern recognition, these features can be used for secure environment-based authentication and thus successfully detect and ward off relay attacks.

(203) The cost for the analysis and modification of the signals used to perform a successful relay attack is deemed very high and not feasible with today's technical means.

(204) The invention being thus described, it will be obvious that the same may be varied in many ways. Such variations are not to be regarded as a departure from the spirit and scope of the invention, and all such modifications as would be obvious to one skilled in the art are to be included within the scope of the following claims.