WO2017005502A1

WO2017005502A1 - Policies for access to location-based services

Info

Publication number: WO2017005502A1
Application number: PCT/EP2016/064594
Authority: WO
Inventors: Sandeep Shankaran KUMAR; Ashish Vijay Pandharipande
Original assignee: Philips Lighting Holding B.V.
Priority date: 2015-07-03
Filing date: 2016-06-23
Publication date: 2017-01-12

Abstract

A localization system is used to obtain a location estimate for a user or user device, and an estimated error associated with the location estimate is also obtained. A location-based service is provided whereby the user or device is allowed access to the service on condition of the location estimate (p1, p2, p3, p4, p5) being within a predefined zone (17), subject to an error threshold (T) whereby if the location estimate is outside this zone, but according to the estimated error (e1, e4, e5) the user or device might actually be inside the zone, and the location estimate is not farther from the zone than the error threshold, then the user or device is still allowed access to the service. Further, a spatial and/or temporal variation is determined in one or more factors indicative of a susceptibility of the environment and/or localization system to error, and the error threshold is adapted based thereon.

Description

Policies for access to location-based services

TECHNICAL FIELD

The present disclosure relates to localization, i.e. the process of determining the location of a mobile device or user. Particularly, the present disclosure relates to the defining of policies specifying when a user or user device is allowed access to a location- based service.

BACKGROUND

In a localization system such as an indoor positioning system, the location of a wireless device such as a mobile user terminal can be determined with respect to a location network comprising a plurality of wireless reference nodes, in some cases also referred to as anchor nodes. These anchors are wireless nodes whose locations are known a priori, typically being recorded in a location database which can be queried to look up the location of a node. The anchor nodes thus act as reference nodes for localization. Measurements are taken of the signals transmitted between the mobile device and a plurality of anchor nodes, for instance the RSSI (receiver signal strength indicator), ToA (time of arrival) and/or AoA (angle of arrival) of the respective signal. Given such a measurement from three or more nodes, the location of the mobile terminal may then be determined relative to the location network using techniques such as trilateration, multilateration or triangulation. Given the relative location of the mobile terminal and the known locations of the anchor nodes, this in turn allows the location of the mobile device to be determined in more absolute terms, e.g. relative to the globe or a map or floorplan.

Another localization technique is to determine the location of mobile device based on a "fingerprint" of a known environment. The fingerprint comprises a set of data points each corresponding to a respective one of a plurality of locations throughout the environment in question. Each data point is generated during a training phase by placing a wireless device at the respective location, taking a measurement of the signals received from or by any reference nodes within range at the respective location (e.g. a measure of signal strength such as RSSI), and storing these measurements in a location server along with the coordinates of the respective location. The data point is stored along with other such data points in order to build up a fingerprint of the signal measurements as experienced at various locations within the environment. Once deployed, the signal measurements stored in the fingerprint can then be compared with signal measurements currently experienced by a mobile device whose location is desired to be known, in order to estimate the location of the mobile device relative to the corresponding coordinates of the points in the fingerprint. For example this may be done by approximating that the device is located at the coordinates of the data point having the closest matching signal measurements, or by interpolating between the coordinates of a subset of the data points having signal measurements most closely matching those currently experienced by the device. The fingerprint can be pre-trained in a dedicated training phase before the fingerprint is deployed by systematically placing a test device at various different locations in the environment. Alternatively or additionally, the fingerprint can built up dynamically by receiving submissions of signal measurements experienced by the actual devices of actual users in an ongoing training phase.

The determination of the mobile device's location may be performed according to a "device-centric" approach or a "network-centric" approach. According to a device centric approach, each anchor or reference node emits a respective beacon signal. The mobile device takes measurements of beacon signals it receives from the reference nodes, obtains the locations of those nodes from the location server, and performs the calculation to determine its own location at the mobile device itself. According to a network-centric approach on the other hand, the reference nodes are used to take measurements of beacon signals received from the mobile device, and an element of the network such as the location server performs the calculation to determine the mobile device's location. Hybrid approaches are also possible, e.g. where the mobile device takes the raw measurements but forwards them to the location server to calculate its location.

There also exist techniques for detecting the location of a user directly, such as using infrared or ultrasound presence sensors, or using one or more cameras in conjunction with an image recognition algorithm.

There are various reasons why it may be desirable to be able to detect the location of a wireless device or user of such a device, such as to provide location based services. Particularly, location based policies are increasingly being used for authorization decisions that give access to various resources. For instance, one application of a positioning system is to automatically provide a wireless mobile device with access to control of a utility such as a lighting system, on condition that the mobile device is found to be located in a particular spatial region or zone associated with the lighting or other utility. E.g. access to control of the lighting in a room may be provided to a wireless user device on condition that the device is found to be located within that room and requests access. Once a wireless user device has been located and determined to be within a valid region, control access is provided to that device via a lighting control network. Other examples of location based services include location-based advertising, service alerts or provision of other location-related information, or taking payment of road tolls or other location dependent payments.

SUMMARY

For evaluation of such policies, the position information should preferably be as reliable and stable as possible, especially at the borders of authorization domains.

However, all positioning systems have a certain degree of error and variance in the estimation due to factors such as the inherent limitations of the localization system and/or varying environmental factors. It would be desirable for such randomness to be accounted for during the evaluation of location based policies. Consider for example what happens if a user device is near the edge of an authorization zone (the policy being that the device is allowed to access a certain resource, such as lighting control, when detected to be within the zone but not outside). If the policy is evaluated based on the instantaneous point location estimate alone, then the randomness in the estimate will mean that at times the estimated location will be detected as inside the authorization zone and at other times it will be detected to be outside, leading the system to "flit" back and forth between a state in which the devices is authorized to access the resourced and a state in which it is not.

In the present disclosure, there are presented various techniques for evaluation of location based policy based on the amount of randomness within a given positioning system at a particular place and/or moment in time. Particularly, this is used to select a threshold, which is the amount of error the service will accept while still counting a device or user whose error footprint straddles the zone boundary as being inside the zone despite the fact that its point location estimate is outside the zone (e.g. see position estimate p2 in Figure 3 for an illustration, which will be discussed in more detail later). The estimation is based on knowledge of the positioning system being used and/or the environmental conditions, which may either known be implicitly or detected explicitly using sensors. Further, in embodiments, the thresholds can be fine-tuned for policies related to sensitive application might favour higher false negatives (or vice versa).

According to one aspect disclosed herein, there is provided a method comprising: using a localization system to obtain a location estimate which estimates a location of a user or user device within an environment; obtaining an estimated error associated with the location estimate; and providing a location-based service whereby the user or user device is allowed access to the service on condition of said location estimate being within a predefined zone (a certain spatial region or domain). This is subject to an error threshold whereby if the location estimate is outside said zone, but according to said estimated error the user or user device might in fact be inside the zone, and the location estimate is not farther from said zone than the error threshold, then the user or user device is still allowed access to the service (e.g. see Figure 3). The method further comprises, for one or more factors indicative of a susceptibility of said environment and/or localization system to error, performing one or both of: a) determining a spatial variation of said one or more factors inside said zone, and based thereon adapting the error threshold to take different values at different places around said zone, and/or b) determining a temporal variation of said one or more factors over time, and based thereon adapting the error threshold to take different values over time.

In embodiments, where the determination of said location estimate is based on signals transmitted between the user device and a plurality of reference nodes of the localization system, said one or more factors may comprise any one or more of the following: (i) a density and/or topology of the reference nodes; (ii) a topology of objects in the environment which reflect and/or attenuate said signals; (iii) a type of medium used for the transmission of said signals (from amongst two or more available types such as radio, visible light, infrared and/or ultrasound); (iv) a type of calculation used to perform said

determination of the location estimate is based on said signals (from amongst two or more available types such as trilateration, multilateration, triangulation and/or fingerprinting); (v) a type of measurement taken of said signals in order to perform the location estimate (from amongst two or more available types such as angle of arrival of said signals, time of flight of said signals, and/or received signal strength of said signals); (vi) a humidity air in the environment through which said signals travel; and/or (vii) a degree of non-locomotive motion of the user, or of a user of the mobile device (motion such as fidgeting or waving that does not move the overall position of the user's body, as opposed to locomotive motion such as walking, running, crawling, etc.); (viii) an orientation of the user, or an orientation of a user of the mobile device, or an orientation of a user of the mobile device relative to the mobile device; and/or (iv) a strength and/or topology of one or more interfering sources that interfere with one or more of said signals (e.g. in the case of coded light being used as the positioning technology, the interfering sources comprise one or more light sources such as one or more luminaires or one or more windows or other such sources of daylight) .

In embodiments, the method may comprise using one or more sensors to detect the temporal variation in said one or more factors, and automatically performing the adaptation of the error threshold over time based on the temporal variation as detected using said one or more sensors.

At least one of said one or more sensors may be used to detect the temporal variation in the strength of the one or more interfering sources.

For instance, where the signals transmitted between the user device and the reference nodes comprise coded light signals, and the interfering source comprises at least one light source, then the at least one sensor may comprise a light sensor. E.g. the interfering source may comprise a source of daylight (such as a window), and the light sensor may comprise an ambient light sensor or daylight sensor.

As another example, where the signals transmitted between the user device and the reference nodes comprise radio signals, and the interfering source comprises at least one interfering radio, then the at least one sensor may comprise a radio sensor arranged to detect the strength of the interfering radio.

In embodiments, the method may further comprise: receiving feedback from said user, or a user of the user device, as to whether access was allowed as expected; and based on said feedback, adjusting an adaptation process according to which the adaptation of the error threshold is performed. Said adjustment may be performed automatically using a machine learning technique.

In further embodiments, the error threshold may be additionally controlled based on a user input from a policy administrator of the location based service.

According to another aspect disclosed herein, there is provided a computer program product embodied on a computer readable storage medium and/or downloadable therefrom, configured so as when run on an application server to perform operations of: interacting with a localization system to obtain a location estimate which estimates a location of a user or user device within an environment; obtaining an error associated with the location estimate; providing a location-based service whereby the user or user device is allowed access to the service on condition of said location estimate being within a predefined zone, subject to an error threshold whereby if the location estimate is outside said zone, but according to the estimated error the user or user device might in fact be inside the zone, and the location estimate is not farther from said zone than the error threshold, then the user or user device is still allowed access to the service; and for one or more factors indicative of a susceptibility of said environment and/or localization system to error, performing one or both of: (a) determining a spatial variation of said one or more factors inside said zone, and based thereon adapting the error threshold to take different values at different places around said zone, and/or (b) determining a temporal variation of said one or more factors over time, and based thereon adapting the error threshold to take different values over time.

In embodiments, the computer program product may be further configured to perform operations in accordance with any of the system features disclosed herein.

According to another aspect of the present disclosure, there is provided an application server configured to perform operations of: interacting with a localization system to obtain a location estimate which estimates a location of a user or user device within an environment; obtaining an error associated with the location estimate; providing a location- based service whereby the user or user device is allowed access to the service on condition of said location estimate being within a predefined zone, subject to an error threshold whereby if the location estimate is outside said zone, but according to the estimated error the user or user device might in fact be inside the zone, and the location estimate is not farther from said zone than the error threshold, then the user or user device is still allowed access to the service; and for one or more factors indicative of a susceptibility of said environment and/or localization system to error, performing one or both of: (a) determining a spatial variation of said one or more factors inside said zone, and based thereon adapting the error threshold to take different values at different places around said zone, and/or (b) determining a temporal variation of said one or more factors over time, and based thereon adapting the error threshold to take different values over time.

In embodiments, the application server may further be configured to perform operations in accordance with any of the relevant method steps disclosed herein.

BRIEF DESCRIPTION OF THE DRAWINGS

To assist the understanding of the present disclosure and to show how embodiments may be put into effect, reference is made by way of example to the

accompanying drawings in which:

Figure 1 is a schematic representation of an environment comprising a localization system in the form of an indoor positioning system;

Figure 2 is a schematic block diagram of a system for providing a location based service; Figure 3 is a schematic top-down view of an access zone, illustrating a corresponding access policy;

Figure 4 is a schematic representation of a location-based access policy;

Figure 5 is a schematic top-down view of an access zone and illustrates another access policy; and

Figure 6 is a schematic top-down view of an access zone and illustrates another access policy.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Figure 1 illustrates an example of a positioning system (localization system) installed in an environment 2 according to embodiments of the present disclosure. The environment 2 may comprise an indoor space comprising one or more rooms, corridors or halls, e.g. of a home, office, shop floor, mall, restaurant, bar, warehouse, airport, station or the like; or an outdoor space such as a garden, park, street, or stadium; or a covered space such as a gazebo, pagoda or marquee; or any other type of enclosed, open or partially enclosed space such as the interior of a vehicle. By way of illustration, in the example of Figure 1 the environment 2 in question comprises an interior space of a building.

The positioning system comprises a location network 4, comprising multiple reference nodes in the form of anchor nodes 6 each installed at a different respective fixed location within the environment 2 where the positioning system is to operate. For the sake of illustration Figure 1 only shows the anchor nodes 6 within a given room, but it will be appreciated that the network 4 may for example extend further throughout a building or complex, or across multiple buildings or complexes. In embodiments the positioning system is an indoor positioning system comprising at least some anchor nodes 6 situated indoors (within one or more buildings), and in embodiments this may be a purely indoor positioning system in which the anchor nodes 6 are only situated indoors. Though in other embodiments it is not excluded that the network 4 extends indoors and/or outdoors, e.g. also including anchor nodes 6 situated across an outdoor space such as a campus, street or plaza covering the spaces between buildings. The following will be described in terms of the reference nodes 6 being anchor nodes of an indoor positioning system or the like, but it will be appreciated this is not necessarily the case in all possible embodiments.

The environment 2 is occupied by a user 10 having a wireless device 8 disposed about his or her person (e.g. carried by hand, or in a bag or pocket). The wireless device 8 takes the form of a mobile user terminal such as a smart phone or other mobile phone, a tablet, or a laptop computer. At a given time, the mobile device 8 has a current physical location which may be determined using the location network 4. In embodiments, it may be assumed that the location of the mobile device 8 is substantially the same as the location of the user 10, and in determining the location of the device 8 it may in fact be the location of the user 10 that is of interest. Another example would be a mobile tracking device disposed about a being or object to be tracked, e.g. attached to the object or placed within it. Examples would be a car or other vehicle, or a packing crate, box or other container. The following will be described in terms of a mobile user device but it will be understood this is not necessarily limiting in all embodiments and most generally the device 8 may be any wireless device having the potential to be found at different locations or an as-yet unknown location to be determined. Further, the location of the mobile device 8 may be referred to interchangeably with the location of the associated user 10, being or object about which it is disposed.

Referring to Figures 1 and 2, the environment 2 also comprises at least one wireless access point or router 12 enabling communication with a location server 14

(comprising one or more server units at one or more sites). The one or more wireless access points 12 are placed such that each of the anchor nodes 6 is within wireless communication range of at least one such access point 12. The following will be described in terms of one access point 12, but it will be appreciated that in embodiments the same function may be implemented using one or more access points 12 and/or wireless routers distributed throughout the environment 2. The wireless access point 12 is coupled to the location server 14, whether via a local connection such as via a local wired or wireless network, or via a wide area network or internetwork such as the Internet. The wireless access point 12 is configured to operate according to a short-range radio access technology such as Wi-Fi, ZigBee or Bluetooth, using which each of the anchor nodes 6 is able to wirelessly communicate via the access point 12 and therefore with the location server 14. Alternatively it is not excluded that instead of using a wireless access point 12, each of the anchor nodes 6 could be provided with a wired connection to the location server 14, or one or more of the anchor nodes 6 could be arranged to act as an access point for the others. The following may be described in terms of a wireless connection via an access point 12 or the like, but it will be appreciated that this is not limiting to all possible embodiments.

The mobile device 8 is also able to communicate via the wireless access point 12 using the relevant radio access technology, e.g. Wi-Fi, ZigBee or Bluetooth, and thereby to communicate with the location server 14. Alternatively or additionally, the mobile device 8 may be configured to communicate with the location server 14 via other means such as a wireless cellular network such as a network operating in accordance with one or more 3 GPP standards. Further, the mobile device 8 is able to wirelessly receive beacon signals from, or transmit beacon signals to, any of the anchor nodes 6 that happen to be in range. In embodiments this communication may be implemented via the same radio access technology as used to communicate with the access point 12, e.g. Wi-Fi, ZigBee or Bluetooth, though that is not necessarily the case in all possible embodiments.

Generally any of the communications described in the following may be implemented using any of the above options or others for communicating between the respective entities 6, 8, 12, 14 and for conciseness the various possibilities will not necessarily be repeated each time.

The beacon signals between the anchor nodes 6 and the mobile device 8 are the signals whose measurements are used to determine the location of the mobile device 8. In a device-centric approach the anchor nodes 6 each broadcast a signal and the mobile device 8 listens, detecting one or more of those that are currently found in range and taking a respective signal measurement of each. Each anchor node 6 may be configured to broadcast its beacon signal repeatedly. The respective measurement taken of the respective beacon signal from each detected anchor node 6 may for example comprise a measurement of signal strength (e.g. RSSI), time of flight (ToF), angle of arrival (AoA), and/or any other property that varies with distance or location.

In a network-centric approach on the other hand, the mobile device 8 broadcasts a beacon signal and the anchor nodes 6 listen, detecting an instance of the signal at one or more of those nodes 6 that are currently in range. In this case the mobile device 8 may broadcast its beacon signal repeatedly. The respective measurement taken of each instance of the beacon signal from the mobile device 8 may comprise a measure of signal strength (e.g. RSSI) or time of flight (ToF), angle of arrival (AoA), and/or any other property that varies with distance or location. In an example of a hybrid approach, the nodes 6 may take the measurements but then send them to the mobile device 8, or the mobile device 8 may take the measurements but send them to the location server 14.

There are various options for the manner in which such measurements may be started and conducted. For example, either the mobile device 8 may initiate the transmission upon which the measurement is based, or the network may initiate the transmission. Both are possible, but it may have some impact how the rest of the process is implemented, in particular for time-of- flight measurements. Time-of- flight measurements can be obtained by establishing either a one way transmission delay or a two-way transmission delay (round trip time, RTT). A measurement of one-way delay can suffice if all relevant elements in the network have a synchronized clock or can reference a common clock. In this case the mobile device 8 may initiate the measurement with a single message transmission, adding a timestamp (e.g. time or time+date) of transmission to the message. If on the other hand the measurement is not based on a synchronized or common clock, the anchor or reference nodes 6 can still perform a measurement by bouncing individual messages back from the mobile device 8 and determining the round-trip time-of-flight. The latter may involve coordination from the nodes attempting to measure.

In the case of signal strength measurements, there are also different options for implementing these. The determination of distance from signal strength is based on the diminishment of the signal strength over space between source and destination, in this case between the mobile device 8 and anchor or reference node 6. This may for example be based on a comparison of the received signal strength with a-prior knowledge of the transmitted signal strength (i.e. if the nodes 6 or mobile device 8 are known or assumed to always transmit with a given strength), or with an indication of the transmitted signal strength embedded in the signal itself, or with the transmitted signal strength being communicated to the node 6 or device 8 taking the measurement via another channel (e.g. via location server 14).

Any one or a combination of these approaches or others may be applied in conjunction with the system disclosed herein. Whatever approach is chosen, once a beacon signal measurement is available from or at each of a plurality of the anchor nodes 6, it is then possible to determine the location of the mobile device 8 relative to the location network 4 using a technique such as trilateration, multilateration, triangulation and/or a fingerprint based technique.

In addition, the "absolute" locations of the anchor nodes 6 (or more generally reference nodes) are known, for example from a location database maintained by the location server 14, or by the respective location of each anchor node 6 being stored at the node itself (e.g. and communicated from each relevant nodes to the mobile device 8 in a device centric approach). The absolute location is a physical location of the node in a physical environment or framework, being known for example in terms of a geographic location such as the location on a globe or a map, or a location on a floorplan of a building or complex, or any real-world frame of reference. By combining the relative location of the mobile device 8 with the known locations of the anchor nodes 6 used in the calculation, it is then possible to determine the "absolute" location of the mobile device 8. Again the absolute location is a physical location of the device in a physical environment or framework, for example a geographic location in terms of the location on a globe or a map, or a location on a floorplan of a building or complex, or any more meaningful real- world frame of reference having a wider meaning than simply knowing the location relative to the location network 4 alone.

In embodiments, the absolute location of the nodes 6 may be stored in a human understandable form and/or the absolute location of the mobile device 8 may be output in a human understandable form. For example, this may enable the user 10 to be provided with a meaningful indication of his or her location, and/or may enable the administrator of a location-based service to define rules for granting or prohibiting access to the service or aspects of the service. Alternatively it is possible for the location of the nodes 6 and/or mobile device 8 to only ever be expressed in computer-readable form, e.g. to be used internally within the logic of the location based service.

In other embodiments it is not excluded that the location is only ever expressed relative to the location network 4, 6 and not as a more meaningful "absolute" location. For example if each anchor node 6 is integrated with a respective luminaire (see below) and the location is being determined for the purpose of controlling those luminaires, then in some embodiments it may only be necessary to determine the user's location relative to the framework of points defined by the anchor nodes of these luminaires (though in other similar arrangements it may still be desired to define lighting control regions relative to the floorplan of a building or the like).

In a device-centric approach, the beacon signal from each anchor node 6 comprises an ID of the respective anchor node. The mobile device 8 then uses these IDs to look up the locations of the relevant nodes 6 by querying the location server 14 (e.g. via the wireless access point 12). Alternatively the beacon signal from each node 6 could even comprise an explicit indication of the respective location. Either way, the mobile device 8 can then perform the calculation to determine its own location at the device 8 itself (relative to the location network 4 and/or in absolute terms). In a network-centric approach on the other hand, the beacon signal comprise an ID of the mobile device 8, and the anchor nodes 6 submit the beacon signal measurements they took to the location server 14 along with the mobile device's ID (e.g. via the wireless access point 12). The location server 14 then performs the calculation of the device's location at the server 14 (again relative to the location network 4 and/or in absolute terms). In an example of a hybrid approach, the mobile device 8 may take the measurements of the beacon signals from the nodes 6, but submit them along with the respective received IDs to the location server 14 in a raw or partially processed form for the calculation to be performed or completed there.

Typically a beacon signal measurement is needed from at least three reference nodes, though if other information is taken into account then it is sometimes possible to eliminate impossible or unlikely solutions based on two nodes. For example, if the location is assumed to be constrained to a single level (e.g. ground level or a given floor of a building), the measurement from any one given node 6 defines a circle of points at which the mobile device 8 could be located. Two nodes give two circles, the intersection of which gives two possible points at which the mobile device 8 may be located. Three nodes and three circles are enough to give an unambiguous solution at the intersection of the three circles (though more may be used to improve precision). However, with only two nodes, sometimes it may be possible to discount one of those points as being an unlikely or impossible solution, e.g. being a point in an area to which the user 10 does not have access or it is impossible to reach, or a point that is not consistent with a plotted trajectory (path) of the user 10 (elimination by "dead reckoning"). Similar comments may be made in relation to three-dimensional positioning: strictly four nodes defining four spheres are required to obtain an unambiguous solution, but sometimes an estimate may be made based on fewer nodes if additional information can be invoked. Assuming the user 10 is constrained to a particular level to constrain to a two-dimensional problem is an example of such information. As another example, it may be assumed the user 10 is found on one of a plurality of discrete floors, and/or a dead reckoning type approach may be used to eliminate unlikely jumps in the user's route.

By whatever technique the location is determined, this location may then be used to assess whether the mobile device 8 is granted access to some location-based service (LBS). To this end, there is provided a service access system 16 in the form of an LBS server, configured to conditionally grant access to the service in dependence on the absolute location of the mobile device 8. In a device centric approach the mobile device 8 submits its determined absolute location (e.g. in terms of global coordinates, map coordinates or coordinates on a floor plan) to the service access system 16 over a connection via the wireless access point 12 or other means such as a cellular connection. The service access system 16 then assesses this location and grants the mobile device 8 with access to the service on condition that the location is consistent with provision of the service (and any other access rules that happens to be implemented, e.g. also verifying the identity of the user 10). In a network centric approach, the location server 14 submits the determined absolute location of the mobile device 8 to the service access system 16, e.g. via a connection over a local wired or wireless network and/or over a wide area network or internetwork such as the Internet. Alternatively the location server 14 may send the absolute location to the mobile device 8, and the mobile device may then forward it on to the service access system 16. In another alternative the service could be provided directly from the location server 14, or could even be implemented on an application running on the mobile device 8 itself.

The following are some examples of location-related services or functions that may be provided in accordance with embodiments of the present disclosure:

• allowing control of a utility such as lighting from an application running on the

mobile device 8, where the user can only control the lighting or utility in a given room or zone when found to be located in that room or zone, or perhaps an associated zone;

· providing a navigation service such as an indoor navigation service to the mobile device 8 (in which case the location-related function comprises at least providing the device's absolute location to an application running on the mobile device 8, e.g. which the application may then use to display the user's location on a floor plan or map);

· providing location based advertising, alerts or other information to the mobile device

8, e.g. providing the device 8 with information on exhibits as the user 10 walks about a museum, providing the device 8 with information about products as the user 10 walks about a shop or mall, providing the device 8 with access to medical data only if present inside a hospital or specific zone within a hospital, or providing the device 8 with access to complementary media material only if present physically within a movie theatre or the like;

• accepting location dependent payments from the mobile device on condition that the device 8 is present in a certain region, e.g. payments in shops, payment of road tolls, "pay as you drive" car rental, or entrance fees to venues or attractions;

· providing access to medical data to a mobile device 8 on condition that the device 8 is detected to be within a hospital or other such medical facility; and/or

• providing access to complementary media material to a mobile device (8) on

condition that the mobile device 8 is detected to be within a certain movie theatre. With regard to security, provided that the localization messages are distributed internally within the localization system 4, 6, 14 security may be less of an issue; but in the case of two-way time of flight messages (RTT) for example, or where the reports are transmitted over a public network, it may be advantageous to provide them with a time-stamp (measurement time) or a nonce, and/or to "hash" the messages (digital signature) so as to thwart any replay attacks on the network backbone. The same could be done with the measurement reports sent to the location server 14. Such measures are not essential but may be desirable in embodiments, particularly if the location-based service or functionality is susceptible to abuse or involves financial transactions or the like.

Note that Figure 2 shows arrows in all directions to illustrate the possibility of either device centric or network centric approaches, but in any given implementation not all the communications shown need be bidirectional or indeed present at all.

According to embodiments of the present disclosure, each of the anchor nodes 6 does not take the form of a dedicated, stand-alone anchor node, but rather a unit of another utility that is present in the environment 2 for another purpose, and which is exploited in order to incorporate the additional functionality of an anchor node. The luminaires 6 may for example be installed in the ceiling and/or walls, and/or may comprise one or more free standing units. In one particularly preferred implementation, each of the anchor nodes 6 is incorporated into a respective "smart luminaire" having an RF transceiver such as a Wi-Fi, ZigBee or Bluetooth transceiver for facilitating wireless control of the lighting in the environment 2 (as discussed in more detail later), and the anchor node functionality 6 is incorporated by exploiting the existence of this RF transceiver to additionally broadcast and/or receive localization beacon signals for an additional purpose of locating a mobile device 8. Alternatively, the beacon signal could be a coded light signal embedded in the visible illumination emitted by the luminaire (preferably at a high enough frequency to be imperceptible to the human eye). In this case the illumination has a primary function of illuminating the environment 2, and the anchor node functionality 6 is incorporated as a secondary by exploiting the possibility of modulating the illumination at high frequency in order to embed data, such as a unique ID of each anchor 6.

In further alternative arrangements, each of the anchor nodes 6 need not be incorporated into a luminaire but rather may be incorporated into another unit such as a smoke alarm, a presence sensor and/or light sensor unit, a security alarm, an air-conditioning unit, a ventilation unit, or a heating unit (and each anchor node 6 does not necessarily have to be incorporated into the same type of unit, though they may be). In yet further alternatives, the anchor nodes 6 may be dedicated anchor nodes 6 having no other function than localization.

In embodiments the service access system 16 (LBS server) may be configured to control access to the control of the lighting 6. In this case, the access system 16 of the lighting controller is configured with one or more location dependent control policies. For example, a control policy may define that a user 10 can only use his or her mobile device 8 to control the lights in certain region such as a room only when found within that region or within a certain defined nearby region. As another example control policy, the mobile device 8 only controls those luminaires within a certain vicinity of the user's current location.

However, note that this is only one example of a location-based service that may be provided based on the anchor nodes incorporated into the luminaires 6. In other examples, the control of the lighting could be unrelated to the localization in terms of its user- facing function, and instead the location-based service could be something else such as control of another utility such as heating or air conditioning; or the provision of location-based advertising, map data or other location-based information; or the taking of location-dependent payments; etc.

Location based policies are increasingly used to automatically enforce access to various resources based on the current position of the accessing device. As discussed above, the resource in question could be the control of one or more devices in a room, access to the map data, etc. For example a person may be allowed to control lighting in a particular room with a mobile device if the person's mobile device is physically present inside that room. However, almost all positioning techniques have a certain amount of randomness in the calculated position. Randomness here refers to the amount by which the position estimate may be expected to vary, i.e. the typical amount of error or the degree of unpredictability in the estimate, e.g. measured in terms variance or standard deviation. The actual error for any given position estimate is the difference between the true (actual) position of the mobile device 8 and the estimated position as output by the positioning algorithm. Let q be the true position of the mobile device 8 and p be the estimated position. Then the position error is p-q, and the variance is E[{p-q}^A2], where E[.] denotes the mathematical expectation operator. Of course the actual error in any given instance is impossible to know. However, it is possible to put an estimate e on the expected amount error. For instance the standard deviation, which is the square root of the variance, may be used as an estimate e of the expected magnitude of the error p-q. Other ways of estimating amount of expected, typical or representative error may also be familiar to a person skilled on the art. The following may be described in terms of an "error" e as a short hand, but it will be appreciated this refers not to the actual error p-q for a given position estimate (which is unknowable), but rather a measure of the expected, typical or representative error in the estimate.

The randomness distribution is dependent on multiple factors, some static and others dynamic. The static component may result from one or more of: the density and/or topology of the anchor nodes 6 in the localization network 4, the density and/or topology of obstacles in the environment, the inherent precision in the location estimate computation, and/or the type of positioning technology being used. The type of positing technology may include factors such as the type of positioning calculation being used (e.g. is it based on received signal strength or angular measurements), and/or the type of medium being used to transmit the beacon signals (e.g. radio is typically more precise than coded light). The dynamic component of the randomness may result from: time varying environmental factors that affect how signals propagate (like humidity, shifting of the metallic objects), as well as any non- locomotive movements of the user (e.g. the user fidgeting or waving his or her arms with the tracked device 8 in hand, but while still standing at the same spot).

To try to ensure a more reliable decision on the location based policy, one approach is to tolerate a certain degree of randomness in the estimated position when deciding if the device is granted access to a location based service, as long as this is known to the policy evaluation engine and still within a certain threshold.

This approach is illustrated schematically in Figure 3. Figure 3 illustrates an example access zone 17, which could be the bounds of the environment 2 (edges of a room), or a certain sub-region within the environment (e.g. sub-region of a room). The LBS server 16 is configured so that if the estimated position of a mobile device 8 (as estimated by the localization system 4, 14 and reported to the LBS server 16) is inside the access zone 17, then the LBS server 16 will grant the mobile device 8 access to the service (assuming the device 8 requests it, and any other criteria such as authorization of the user 10 and arbitration are met). In addition, the LBS server 16 defines an error threshold T being a contour a certain defined distance beyond the border of the access region 17. This works as follows.

Figure 3 illustrates the fact that each position estimate p will have some estimated error e associated with it. This error e corresponds to a radius defining a circle or "error footprint" drawn around the estimated location p. Thus, when a user device 8 is near a boundary of the access zone 17, the centre point p of that device's estimated location may fall outside the zone 17, but the error on the estimate may mean that the user device 8 could actually just about be inside the zone 17. Therefore without taking further measures, a policy evaluation engine on the LBS server 16 cannot make consistent decisions about whether the device's location 8 fulfils the location based policy, especially at the border of such authorization domains 17 where the apparent position might be considered to be constantly shifting from inside to outside the access zone 17 and vice versa. Such jerky behaviour leads to continual change in the access to the resource, making it a nuisance for the user 10. For example, a user's access to controlling the lighting in a room may change constantly if he is close to a wall on a room boundary, and the system might change the lighting to default every time the user device 8 is estimated to be outside the room.

To go some way towards addressing this, the approach illustrated in Figure 3 is to receive an estimate e of the error on the position estimate p, and to allow a user device 8 to still obtain access to the service despite having a position estimate p outside the access zone 17, but only on condition that both: (I) the position estimate p is still inside the threshold region T; and (II) the error estimate e (e.g. standard deviation) is such that then the true position of the device 10 could in fact fall within the access zone 17 (assuming as an approximation that the error e is the maximum extent of possible positions). That is to say, if the position estimate e is within the threshold T and the error footprint straddles the boundary of the access zone 17, then the user device 8 is still granted access (assuming the device 8 requests it, and any other criteria such as authorization of the user 10 and arbitration are met); but otherwise the user device 8 will not be granted access. Thus the threshold T specifies how much error is acceptable to make a positive decision or a negative decision as to access.

By way of illustration, consider a position estimate pi that is exactly on the threshold T and happens to have an error estimate el exactly equal to the distance of the error threshold T from the boundary of the access zone 17 (at the point at which the position estimate pi sits). This position estimate pi would be on the exact borderline between access being granted or not. If the user device 8 moves closer so as to gain a new position estimate p2 inside the threshold, but with the same error el , then it is granted access to the service.

However, if the device 8 instead moves farther away, farther from the edge of the access zone 17 than the threshold T, then the mobile device 8 will not be granted access. What happens for the position estimate pi on the cusp would be a matter of design choice.

As another illustration, consider a position estimate p4 beyond the threshold T from the edge of the access zone 17, and having a large error e4 such that potentially the true position of the mobile device 8 actually falls inside the access zone 17. In this case, while it is possible that the device 8 is indeed inside the access zone 17, the threshold T is set not to tolerate such a large error, and hence the device 8 is not granted access to the service. In a further example, consider the case where the position estimate p5 is inside the threshold T but the error e5 is small such that, even if the true position of the device 8 is as close as possible to the access zone 17 within the range of the error footprint, then the device 8 still could not actually be inside the access zone 17. In this case, although inside the threshold T, this is not enough and the user device 8 is not granted access to the service.

The above additions to the location-based policy in themselves provides some degree of protection of against the above-mentioned jerkiness or "flitting" in the access decision. However, currently, the only knowledge of the estimated error that location based policy decision engines receive is a current estimate of the computational error in the position caused due to the measurement errors. Often this is insufficient to make a reliable and stable decision especially at the borders of the authorization domain. Often the policy evaluation engine is unaware of the current positioning technique being used or the amount of randomness (e.g. its error variance) that might be associated with the positioning algorithm. Further, the policy engine may not be aware of the changing environmental factors that might deteriorate the positioning information that is being presented. Therefore the policy evaluation engine still cannot make consistent decisions on a location based policy, especially at the border of authorization domains.

To overcome this deficiency, according to embodiments herein, a policy decision engine which adapts error threshold T to take different values at different positions and/or different times depending on one or more factors that are functions of space and/or time. That is, it adapts the maximum size of error radius (the error threshold) for which, if its circumference just falls inside the zone, access is still granted. In embodiments, the policy decision engine receives three additional inputs: a static error estimate, a dynamic error estimate, and a threshold to be used during the decision. These additional inputs are generated by additional components based on: location based data, sensor data, user input, and/or feedback from the application.

Figure 4 illustrates more detail of a location based service (LBS) server 16 configured in accordance with embodiments of the present disclosure.

The LBS server 16 comprises a location-based application 18 providing the location based service, and a policy evaluation engine 20 configured to decide access to the service 18 based on the current position p of a requesting user device 8 and its estimated error e, this being an estimate of the amount of error that is expected based on one or more factors. To this end, the LBS server 16 also comprises a static error estimator 22 configured to estimate positioning error based on pre-existing knowledge of the positioning system, and a dynamic error estimator 24 configured to estimate positioning errors based on the current environmental factors or due to user movement. The LBS server 16 also comprises a policy admin module 26 for receiving a user input from an administrator of the location-based policy. The policy decision engine 20 is configured to determine a combined estimation of error combining the static and dynamic errors provided by the estimators 22, 24. It then fine tunes the error threshold T based on the combined estimate, and optionally also based on the security requirements of the application 18 as specified by the administrator via the policy admin input 26. In embodiments, the policy decision engine 20 is also arranged to receive feedback information regarding failed access requests (false negatives), which are used to learn and correct the combined estimations.

In operation, at step 100 the policy admin block 26 receives a user input from the policy administrator specifying a location-based access policy for the location based service provided by the application 18, including an access zone 17 and a nominal value for the error threshold T. At step 101 the policy admin block 26 provides the nominal threshold value to the policy decision engine 20. At step 102 the location based application 18 optionally provides an indication of its own security requirements (e.g. a security

categorization such as "high or "low", or an explicitly requested value for the error threshold T). At step 112 the location server 104 provides an estimate of the current location of the mobile device 8 to the policy decision engine 20, along with an estimate of the inherent computational error associated with the computation it uses to arrive at this estimate. At step 108 the static error estimator 22 receives information about the localization system 4, 14 from the location server 14 (e.g. about its topology) and uses this to determine an estimate of the static error on the location estimate due to such factors (these not being taken into account in the computational error 112). At step 110, the static error estimator 22 provides the estimated static error to the policy decision engine 20. At step 106 the dynamic error estimator provides an estimate of the dynamic error in the location estimate due to one or more time-varying environmental factors (e.g. strength of an interfering source). In embodiments, this is generated based on sensor input received by the dynamic error estimator 24 at step 104.

Note that steps 100, 101, 102, 104, 106, 110 and 112 do not necessarily have to occur in any particular order (except that step 100 must come before step 100, step 108 must come before 110, and if sensor input is used step 104 must come before 106).

The policy decision engine 20 then calculates a combined error estimate e based on a combination of two or three of: the static error estimate 110, and dynamic error estimate 106, and the computational error 112. Alternatively the policy decision engine may 20 simply take just one of these as the error estimate e. Either way, the estimated error e along with the estimated position p itself are used by the policy decision engine 20 to assess whether the mobile device 8 is granted access to the location based service provided by the application 18, according to the principle discussed above in relation to Figure 3. At step 114 the policy decision engine 20 issues its decision to the application 18, which then provides the service accordingly to the mobile user device 8.

Furthermore, the static and/or dynamic error estimators 22, 24 are also arranged to provide the policy decision engine 20 with an indication of the susceptibility of the system and environment to their respective kinds of error - i.e. a measure of how error- prone the localization system 4, 14 and/or environment 2 is. Based on one or both of these, the policy decision engine 20 then automatically adapts the error threshold T so as to adapt to the localization system 4, 14 and/or the environment 2. E.g. a certain localization system 4, 14 may be more error-prone than another because it has a lower the density of anchor nodes 6, or because it uses a less precise signalling medium (e.g. coded light as opposed to radio). Or a certain environment 2 may be more error-prone than another because it contains more obstacles or more interference. Examples will be discussed in more detail shortly in relation to Figures 5 and 6.

In embodiments, the error threshold T may also be set based on the application-specific security requirements 102, and/or the nominal value 101 of the threshold T set by the administrator. In such cases, the policy decision engine 20 thus determines the error threshold T based on a combination of: one or both of the susceptibility static and/or dynamic error 106, 110, combined with one or both of the administrator-defined nominal threshold 101 and/or the application-specific security requirements 102. For instance, the application-specific security requirements 102, and/or the nominal threshold value 101, may be used to determine a basic default or reference value of the threshold T, and then the policy decision engine 20 then automatically adapts the threshold T relative to this by an amount dependent on the determined susceptibility to the static and/or dynamic errors. E.g. so for a typical or average environment or system, the reference threshold is used, but for a more error-prone environment a wider (more forgiving) threshold may be selected, whilst for less error-prone environment or location system a narrower (stricter) threshold may be selected.

As an alternative, the application 18 and/or administrator may have the option to override the threshold set automatically by the policy decision engine 20 based on the static and/or dynamic error susceptibility. Note also, in some embodiments, the adaptation of the threshold T to static error-affecting properties of the location system 4, 14 and/or dynamic error-affecting properties of the environment 2 need not be automatic. In embodiments, this adaptation could be automatic or manual. In the latter case, the information (optionally along with the application-specific requirements) is provided to the policy administrator via the policy admin module 26, and the administrator uses this information in conjunction with his or her judgement in order to select the desired threshold T.

The static error estimate, and/or the susceptibility of the localization system 4, 14 to error due to static factors, can be derived by using the knowledge from the location server 14 of the positioning system 4, 14 in use, and/or from measurements taken during an initial commissioning phase, and/or from pre-existing data of similar systems that were calibrated. Such information may comprise one or more of various factors. For instance, this may comprise information on the spatial density and/or topology of the anchor nodes 6 (topology herein means the spatial layout or distribution of the anchor nodes 6, i.e. the positions at which they are deployed). E.g. a location network 4 with a higher density of anchor nodes 6 will produce more fine-grained results than a sparser installation. Other potential examples of factors that affect the static error (the error due to the intrinsic properties of the location system 4, 14 itself) include the type of medium used to convey the beacon signals. E.g. if a coded-light positioning system is being used, then this can indicate that this position estimate is less precise than when it switches to radio based positioning. As another example, the static error may be affected by the type of location calculation performed: e.g. trilateration, multilateration, triangulation and fingerprinting may all result in slightly different errors. Yet another example is the type of measurement taken: e.g. received signal strength, time of flight and angle of arrival based techniques may all have different errors associated with them. Thus various factors such as those discussed above can provide an estimate of the error distribution (including a maximum expected error) that can happen when using a particular positioning system.

The dynamic error estimate, and/or the susceptibility of the environment 2 to error due to dynamic factors, can be derived by measuring the time varying environmental factors. The measurement can be determined explicitly by use of one or more sensors on the localized device or elsewhere, or by other means such as by crowdsourcing from devices in the vicinity, or implicitly based on calibrating signal measurements. Such information may again comprise one or more of various factors. For instance, this may comprise a strength and/or topology of one or more interfering sources (topology here meaning the spatial layout, distribution or positions of the interfering source(s)). As another example, the humidity of the air in the environment 2, through which the beacon signals must travel, can also effect the error. As another example, the non- locomotive movement of the user 10 can be measured using accelerometers on the mobile device 8 and/or worn about the user's person 10, and fed as additional error-causing factors based on the how fast the user moves. That is to say, movement whereby the user 10 is not intentionally moving his or her whole body to a different location, but rather is staying on the same spot and simply moving some constituent parts of his her body, will not be considered by the user 10 as moving to a new location but may still result in a variation in the location estimate (e.g. because the user is moving his or her arm while holding the device 8 being localized). As yet another example, the orientation of the mobile device 8 may affect the error experienced - e.g. a device 8 may experience more or less interference depending on its orientation relative to one or more interfering sources, or the user's body may act as an obstacle such that the orientation of the user 10 relative to his or her mobile device 8 has an effect on the amount of error.

A third input to the policy decision engine 20 affecting the threshold T is the input 100 from the policy administrator (a person, but not the user 10 being localized), and/or the application- specific requirements of the application 18. This then allows some flexibility on behalf of the administrator and/or application as to the decision point and prevent spurious changes between positive and negative decision due to small errors - i.e. it allows the policy decision engine 20 to take the static and dynamic error estimates and fine tune to decide when a change in decision should be performed. In embodiments, the application and/or administrator also has the option to override the automated adjustment, especially in cases where secure requirements are high, by providing their own requirements to the policy decision engine 20.

Further, as an optional step 116, the application 18 may provide feedback to the policy admin module 26, to inform the administrator. The feedback originates from the end-user 10: if the user experiences a false positive (i.e. a situation where he or she expected to be granted access to the service due to knowing him or herself to be in the access zone, but was denied access due to positioning error), then the user 10 has the opportunity to provide feedback through his or her mobile device 8 to the location-based application 18, and hence onwards to the administrator. The administrator can then adjust the policy based on this feedback, e.g. to increase the threshold T. Or as an alternative variant of this, the feedback 118 may be provided to the policy decision engine in order to adapt the policy automatically. In this case, the policy decision engine 20 may apply a machine learning technique to adapt the algorithm it uses to set the threshold T, i.e. to adapt the way in which it selects the threshold from the various inputs 101, 102, 106, 110, 112.

Some particularly advantageous examples of the techniques disclosed herein are now discussed in more detail in relation to Figures 5 and 6.

As mentioned, according to the present disclosure the policy decision engine

20 on the application server 16 selects the error threshold T in dependence on how error- prone the environment and/or localization system is (which could be an in-built, static property of the system or environment, or could be a time-varying, dynamic property). E.g. if there is an interfering source (e.g. window in the case of coded light based positioning), then the environment will be more noisy and so it will be useful to allow for more error in localization. Or as another example, the density of anchor nodes will affect the localization accuracy, and therefore a different policy may need to be set for high density networks than low density networks. Although a certain application or service may be security sensitive, there is no point being too "precious" about the error one will accept, because in some inherently error-prone circumstances the system simply would not work very well at all. I.e. if the intrinsic nature of the application or service is the only thing taken into account, then one may end up with a policy that is too "picky" to be of any practical use. On the other hand if one always defines a blanket policy simply to accommodate for the most error prone environments, then this might not maximally reduce the probability of abuse in other environments.

It is recognized herein that the threshold policy need not be the same throughout a given access zone 17 (e.g. need not be the same for the whole room). Instead it is possible to define an error threshold map within the zone in question (e.g. within a room), e.g. with strict error thresholds at one end of the zone where there is a denser cluster of anchor nodes 6, and looser error thresholds at another end of the room where anchor nodes are sparser. And/or, the threshold can adapt over time, e.g. for coded-light positioning, the policy could be loosened in the daytime when there is a lot of interfering daylight, but could be stricter at night.

Figure 5 illustrates an example in which at least one sensor 30 is disposed in the environment 2 and arranged to detect interference from of at least one interfering source 28 (or e.g. multiple sensors 30 could each be arranged to detect interference from a respective one of multiple interfering sources 28). The sensor 30 may be arranged to detect the interference for example by being placed in the vicinity of the interfering source 28, or could be a directional sensor arranged so as to be directed towards the source 28. The sensor 30 itself may be implemented as a stand-alone sensor installed or otherwise disposed in the environment 2, or a sensor integrated into another unit such as a luminaire, smoke alarm, air conditioning unit, etc. Alternatively, the sensor 30 could be a sensor incorporated into the mobile device 8 so as to be arranged to detect interference in the vicinity of the current location of the mobile deice 8.

Whatever form it takes, the sensor 30 is operative ly coupled to the dynamic error estimator 24 on the application server 16 (connection not shown - but could be by any means, e.g. a local wireless technology such as Wi-Fi, ZigBee, Bluetooth, etc. or other wireless technology such as a cellular connection; and/or a wired connection such as an Ethernet or internet connection). The sensor 30 is configured to measure the current strength of interference from the interfering source 28, and to report this to the dynamic error estimator 24 to use to inform the determination as to how error-prone the environment 2 currently is. The policy decision engine 20 receives an indication of this from the dynamic error estimator 24, and based on this dynamically adapts the error threshold T in accordance with the amount of interference currently being experienced from the interfering source. If the interference is high, the policy decision engine 22 selects a threshold T2 that is farther out from the boundary of the authorization zone 17 (and therefore more forgiving of error);

whereas if the interference is low, the policy decision engine 20 selects a threshold Tl that is closer in to the boundary of the authorization zone 17 (and therefore less forgiving of error).

As an example, in the case where the localization system 4, 14 uses coded light as the means by which to convey beacon signals between the mobile device 8 and the anchor nodes 6, the interfering source 28 may comprise a source of daylight, such as a window or other opening in the room 2. In this case the sensor 30 may comprise a daylight sensor or ambient light sensor placed by the window. It may be assumed that the reading given by the sensor 30 is indicative of the amount of interfering daylight due to its placement by the window. And/or, daylight estimation can be achieved using the same sensors as used for coded light reception, since daylight is not modulated and so the unmodulated component can be estimated. By whatever means the daylight is estimated, the policy decision engine 20 then adapts the threshold T based on the reading from the sensor 30. Hence during the day when there is a lot of interfering daylight, a wider error threshold T2 will be selected, but during the night a stricter error threshold Tl will be selected (N.B. the selection does not have to be between just two discrete values - this is just for illustration, and the decision engine 20 could instead adapt between three or more discrete values or a continuous range of values). An analogous can also be used in the case where radio is the medium by which the beacon signals are transmitted. For example, this may be relevant if the beaconing occurs on the ISM (industrial, scientific and medical) band -e.g. using a popular short-range radio access technology such as Wi-Fi. Consider for example what happens when there are many people, say in a shopping environment, each having their own RF device operating in one and the same frequency band as the localization system 4, 14. In such cases the ISM band will become very crowded. Therefore in embodiments, the error threshold T that will be tolerated by the location-based service 16 may be automatically adapted based on detecting the current strength of radio interference. To achieve this, radio interference such as ISM band interference may be detected by detecting specific signal characteristics of certain interference sources. As example, see the paper "iSCISM: Interference Sensing and

Coexistence in the ISM Band"; Joe Baylon, Ethan Elenberg and Samantha Massengill;

http ://highfrequencyelectronics. com/Apr 12/ 1204_HFE_ismInterference .pdf

A somewhat different example is discussed in relation to Figure 6. The threshold T is basically a distance measured radially outwards (perpendicular to the tangential direction) from the edge of the authorization zone 17. In the above example, it has been assumed that the threshold T is the same all the way around the perimeter of the authorization zone 17. In embodiments, that is indeed the case, but it is also recognized herein that it need not necessarily be so. Rather, the susceptibility of the environment 2 to error may be a function of spatial position, and may vary between different positions even within a given access zone 17 (e.g. within a given room). For example, there could be more interfering sources 28 at one end of a room than another, or a lower density of anchor nodes 6, or more obstacles affecting the propagation of beacon signals. Hence in alternative embodiments, the threshold T may be adapted to take different values at different positions around the perimeter of the access one 17, in dependence on the measure of the susceptibility of the location system 4, 14 and/or environment 2 to error as a function of space - either automatically by the policy decision engine 20 or manually by an administrator. This effectively defines a "threshold map", specifying where more error has to be tolerated and where else a stricter threshold can be applied.

Figure 6 illustrates one example, in which an uneven distribution (topology) of interfering sources 28 is found throughout the room. By way of illustration four sources 28a, 28b, 28c, 28d are shown, but it will be appreciated. The strengths and/or positions of the interference sources 28 may be determined in an initial commissioning phase, or may be measured during ongoing operation be means of one or more sensors 30. The threshold T is then adjusted to accommodate different strength interference sources 28a-28d and/or interference sources 28a-28b that are found at different, unevenly distributed positions throughout the environment 2. Hence for example if there is a strong source of interference 28d near one edge of the access zone, and/or a larger number of sources 28d, 28c near one edge, then the threshold T will be further from the edge of the access zone 17 around that edge (compared to other edges where the strength and/or density of interfering sources 28a is less). A similar idea could also be applied in relation to obstacles that affect the propagation of the beacons signals (the more obstacles nearby, the greater the error threshold).

The above process may for example be performed manually by an administrator based on information on the strengths and/or positions of interference sources, and/or positions of obstacles, as determined during an initial commissioning phase.

Alternatively or additionally, the process may be performed automatically and dynamically by the policy decision engine 20, based on sensor readings 104 received from one or more sensors 30 disposed in the environment 2. In some embodiments, the time-varying and spatially- varying adaptation of the threshold T may also be used together, e.g. to adapt to moving interference sources 28 and/or moving obstacles. E.g. the environment 2 could be equipped with a network of multiple interference sensors 30, which may be used to track where and when interference is occurring and to dynamically adapt the threshold T accordingly.

It will be appreciated that the above embodiments have been described only by way of example. For instance, the scope of the present disclosure is not limited to radio or coded light based positioning systems, and alternatively or additionally other modalities could be used to transmit beacon signals, e.g. infrared or ultrasound. Further, while the above has been described in terms of various positioning technologies for detecting the location of the mobile device 8, this is not limiting to all possible embodiment - an alternative or additional approach is to use one or more technologies capable of detecting the location of the user 10 him or herself directly (i.e. detecting the actual person). An example is to use presence sensors such as passive infrared or active ultrasound sensors. Another example is to use one or more cameras (either 2D cameras or depth aware cameras) plus an image recognition algorithm in order to detect the position of a user 10. In such cases, any of the teachings above may equally apply to the error in the position of the user 10.

Other variations to the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed invention, from a study of the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other elements or steps, and the indefinite article "a" or "an" does not exclude a plurality. A single processor or other unit may fulfil the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. A computer program may be stored/distributed on a suitable medium, such as an optical storage medium or a solid-state medium supplied together with or as part of other hardware, but may also be distributed in other forms, such as via the Internet or other wired or wireless telecommunication systems. Any reference signs in the claims should not be construed as limiting the scope.

Claims

CLAIMS:

1. A method comprising:

using a localization system (4, 14) to obtain a location estimate which estimates a location of a user (10) or user device (8) within an environment (2);

obtaining an estimated error associated with the location estimate; providing a location-based service (16) whereby the user or user device is allowed access to the service on condition of said location estimate being within a predefined zone (17), subject to an error threshold whereby if the location estimate is outside said zone, but according to said estimated error the user or user device might in fact be inside the zone, and the location estimate is not farther from said zone than the error threshold, then the user or user device is still allowed access to the service; and

for one or more factors indicative of a susceptibility of said environment and/or localization system to error, performing one or both of: a) determining a spatial variation of said one or more factors inside said zone, and based thereon adapting the error threshold to take different values at different places around said zone, and/or b) determining a temporal variation of said one or more factors over time, and based thereon adapting the error threshold to take different values over time.

2. The method of claim 1, comprising: a) determining the spatial variation of said one or more factors inside said zone, and based thereon adapting the error threshold to take different values at different places around said zone.

3. The method of claim 1 or 2, comprising: b) determining the temporal variation of said one or more factors over time, and based thereon adapting the error threshold to take different values over time.

4. The method of claim 3, comprising using one or more sensors (30) to detect the temporal variation in said one or more factors, and automatically performing the adaptation of the error threshold over time based on the temporal variation as detected using said one or more sensors.

5. The method of any preceding claim, wherein the determination of said location estimate is based on signals transmitted between the user device (8) and a plurality of reference nodes (6) of the localization system (4, 14), and wherein said one or more factors comprise:

a density and/or topology of the reference nodes;

a topology of objects in the environment which reflect and/or attenuate said signals;

a type of medium used for the transmission of said signals;

a type of calculation used to perform said determination of the location estimate is based on said signals;

a type of measurement taken of said signals in order to perform the location estimate;

a humidity air in the environment through which said signals travel;

a degree of non- locomotive motion of said user, or of a user of said mobile device;

an orientation of said user, or of a user of said mobile device, or of a user of said mobile device relative to said mobile device; and/or

a strength and/or topology of one or more interfering sources (28) that interfere with one or more of said signals.

6. The method of claim 5, wherein said factors comprise the strength and/or topology of the one or more interfering sources (28) that interfere with one or more of said signals.

7. The method of claim 4 and 6, wherein at least one of said one or more sensors (30) is used to detect the temporal variation in the strength of the one or more interfering sources (28).

8. The method of claim 7, wherein the signals transmitted between the user device (8) and the reference nodes (6) comprise coded light signals, wherein the interfering source (28) comprises at least one light source, and wherein the at least one sensor (30) comprises a light sensor.

9. The method of claim 8, wherein the interfering source 28 comprises a source of daylight, and the light sensor (30) comprises an ambient light sensor or daylight sensor.

10. The method of claim 4 and 6, wherein the signals transmitted between the user device (8) and the reference nodes (6) comprises radio signals, wherein the interfering source (28) comprises at least one interfering radio, and wherein the at least one sensor (30) comprises a radio sensor arranged to detect the strength of the interfering radio.

11. The method of any preceding claim, wherein the method further comprises:

receiving feedback from said user (10), or a user of the user device (8), as to whether access was allowed as expected; and

based on said feedback, adjusting an adaptation process according to which the adaptation of the error threshold is performed.

12. The method of claim 11, wherein said adjustment is performed automatically using a machine learning technique.

13. The method of any preceding claim, wherein the error threshold is additionally controlled based on a user input (100) from a policy administrator of the location based service (16).

14. A computer program product embodied on a computer readable storage medium and/or being downloadable therefrom, and configured so as when run on a server to perform the operations of any of the preceding claims.

15. An application server (16) configured to perform operations of:

interacting with a localization system (4, 14) to obtain a location estimate which estimates a location of a user (10) or user device (8) within an environment (2);

obtaining an error associated with the location estimate;

providing a location-based service whereby the user or user device is allowed access to the service on condition of said location estimate being within a predefined zone (17), subject to an error threshold whereby if the location estimate is outside said zone, but according to the estimated error the user or user device might in fact be inside the zone, and the location estimate is not farther from said zone than the error threshold, then the user or user device is still allowed access to the service; and

for one or more factors indicative of a susceptibility of said environment and/or localization system to error, performing one or both of: (a) determining a spatial variation of said one or more factors inside said zone, and based thereon adapting the error threshold to take different values at different places around said zone, and/or (b) determining a temporal variation of said one or more factors over time, and based thereon adapting the error threshold to take different values over time.