Lineage-Bound Multilateration

Mechanism

The mechanism operates in three phases: contribution, solution, and admission. In the contribution phase, anchors and peers produce range observations against a target. Each range observation is a credentialed artifact: it carries the producing anchor's signature, a timestamp drawn from a clock whose synchronization state is itself attested, the measured pseudorange or time-of-flight value, the noise model under which the measurement was obtained, and a reference to the target's transient identifier. The range observation is the atomic input to multilateration, and from this point forward it cannot be modified without breaking its signature.

In the solution phase, a producing unit collects a set of range observations sufficient to multilaterate the target. Before any computation, the producing unit verifies each observation's credential against the policy of the scope under which the position will be admitted: the observing anchor must be enrolled, the timestamp must fall within the synchronization window the scope admits, the noise model must be within the scope's accepted bounds, and the target identifier must be consistent across the set. Any observation that fails verification is excluded; if the remaining set is below the scope's minimum quorum, no position is produced.

The producing unit then runs the multilateration algorithm declared by the scope — least-squares, weighted least-squares, particle-filter, or another method named in the scope's policy — over the validated set, producing a position estimate and an uncertainty bound. The uncertainty bound is computed from the input noise models under the algorithm's covariance propagation, so the bound is structural rather than asserted; a producing unit cannot publish a tighter bound than the inputs justify.

The producing unit emits a position observation. The observation is signed by the producing unit and includes: a hash list of the contributing range observations, the identifier of the algorithm and the parameter set used, the computed coordinate triple, the propagated uncertainty bound, the time of solution, and a scope tag declaring the governance scope under which the position is intended to be admitted. The lineage references are content-addressable; a receiver can fetch and verify any contributing range observation from its hash.

In the admission phase, a receiver that consumes a position observation verifies the producing unit's credential, walks each lineage reference and verifies the contributing range observation's credential against the receiver's local admissibility policy, recomputes (or accepts a notarized recomputation of) the uncertainty bound from the inputs, and admits the position if every check succeeds. A position whose contributions cannot be verified, whose declared bound is inconsistent with its inputs, or whose lineage chain cannot be walked is rejected. Admission is therefore a structural property of the position and its inputs, not a property of the producing unit's reputation alone.

Operating Parameters

Quorum size is the minimum number of contributing range observations the scope requires to admit a position. A higher quorum produces tighter bounds and stronger forensic position evidence but requires denser anchor coverage; a lower quorum tolerates sparser deployments at the cost of looser bounds. Quorum is typically configured per scope and may vary with operating context (e.g., higher quorum in a regulated zone, lower in best-effort coverage).

The synchronization window is the maximum permitted spread among the timestamps of the contributing range observations. Multilateration algorithms assume the contributions describe the same target instant; a wider window admits observations that may be temporally inconsistent, while a tighter window discards observations that arrived from clocks with insufficient synchronization. The window is selected to match the target's expected motion and the deployment's clock-synchronization quality.

The accepted noise-model set declares which range-measurement error characterizations the scope admits. A scope admitting only laboratory-calibrated anchors uses a narrow set; a scope admitting field-deployed mixed-vendor anchors uses a broader set. The accepted set governs which range observations contribute to the solution and therefore which uncertainty propagation rules apply.

The algorithm-parameter declaration names the multilateration method and its parameters (regularization, iteration count, convergence threshold). Scopes that require reproducibility pin specific algorithm versions; scopes that permit upgrades declare a permitted version range. Pinning ensures that a re-run of a historical solution from its lineage produces the same coordinate and bound.

The uncertainty-bound expression is the form in which the propagated uncertainty is reported — covariance matrix, confidence ellipsoid, error radius, or a scope-defined alternative. The scope's admission policy declares which forms it accepts, so a position published in an unsupported form is not admitted regardless of the validity of its inputs.

Lineage retention is the period over which the contributing range observations remain fetchable. A scope with long retention supports long-tail dispute resolution; a scope with short retention narrows the audit window. Retention is independent of the position observation's own retention; a scope may keep positions indefinitely while pruning their underlying ranges, in which case admissibility lapses when the lineage becomes unfetchable.

Alternative Embodiments

One embodiment runs in vehicular V2X positioning, where roadside anchors produce credentialed pseudorange observations for passing vehicles, and a vehicle's onboard unit produces a lineage-bound position observation for each fix. The vehicle's position is admissible by an insurance authority years after the fact via lineage walk, surviving disputes that bare GNSS positions would not.

A second embodiment runs in commercial drone operation, where the drone's position is multilaterated against a network of credentialed ground stations operated by an air-traffic authority. A regulator investigating an airspace incursion walks the lineage to verify the drone's claimed position, accepting or rejecting the claim based on the credentialed inputs rather than on the drone operator's assertion.

A third embodiment runs in maritime tracking, where vessel positions are multilaterated against a mix of shore-based and buoy-based anchors. A flag-state authority accepts a vessel's position if the contributing anchors are credentialed under a recognized authority; the receiving port-state authority can independently re-verify by walking the lineage rather than trusting the flag-state aggregation.

A fourth embodiment runs in indoor positioning, where ultra-wideband anchors produce range observations to wearable or asset tags. The position observation's lineage allows a workplace safety authority to reconstruct, after an incident, exactly which anchors contributed and what their measurement quality was — supporting forensic analysis of whether coverage was adequate at the time.

A fifth embodiment runs in tactical defense, where coalition forces operate with cross-recognized credentials. A position multilaterated by one coalition partner's anchors is admissible to another partner's command authority via lineage walk against the cross-recognition table, without re-surveying or re-measuring.

A sixth embodiment composes lineage-bound multilateration with mobile store-and-forward: a position computed during a disconnected operation is carried, with its lineage references intact, to the consuming authority at next contact and admitted on the strength of its lineage rather than any contemporaneous network presence.

A seventh embodiment is layered: an aggregating service consumes lineage-bound position observations and produces a higher-level lineage-bound trajectory observation whose own lineage references the underlying positions. The same admission mechanism applies recursively, supporting forensic walks from a trajectory back to its constituent positions and from those back to their constituent ranges.

Composition With Adjacent Primitives

Lineage-bound multilateration composes with the credentialing layer that signs every observation. There is no separate position protocol; positions are observations whose payload happens to be coordinates and whose lineage happens to reference range observations. Receivers admit positions through the same admissibility evaluator that admits any other observation.

It composes with clock-synchronization attestation: the synchronization-window check at solution time depends on each contributing anchor declaring its synchronization state in a credentialed form. The position's bound effectively inherits the synchronization quality of the inputs, and a deployment with poor synchronization produces wider bounds rather than silently inaccurate positions.

It composes with the trust-weighted voting and proximity-routing primitives in the adaptive index: an anchor whose range observations consistently fail downstream verification accumulates negative evidence in the trust ledger, lowering its trust score and reducing its eligibility under bounded routing. Bad measurement behavior is therefore visible to the routing layer rather than hidden inside the positioning subsystem.

It composes with cross-jurisdictional credential cross-recognition: a position computed under one authority's anchor infrastructure becomes admissible to another authority by configuration rather than re-engineering. The receiving authority declares which originating authorities it admits, and lineage walks succeed accordingly.

It composes with mobile store-and-forward: positions computed in disconnected operation can be carried to a consuming authority along with their full lineage, retaining admissibility across the carriage chain. The position is treated as cargo by carriers; only the consuming authority evaluates it.

It composes with the audit ledger of the consuming scope: admitted positions are written to the ledger together with their lineage references, becoming first-class evidentiary artifacts. Disputes years later resolve by walking the ledger entry's lineage rather than by re-creating evidence that no longer exists.

It composes with policy versioning: the algorithm and parameter set referenced by a position observation are pinned at solution time, so re-running a historical solution from its lineage produces the same coordinate and bound under the algorithm in effect when the position was originally produced.

Prior-Art Distinction

GNSS-based positioning (GPS, Galileo, BeiDou, GLONASS) produces bare coordinate fixes at the receiver. The receiver's position is asserted, with a quality indicator, but the underlying pseudoranges, satellite ephemerides, and ionospheric corrections are not signed by any authority and are not retrievable for after-the-fact dispute. The disclosed architecture differs structurally: the inputs to the solution are credentialed, the lineage is fetchable, and the bound is reproducibly propagated.

RTK and PPP augmentation services improve GNSS positioning accuracy through differential corrections but do not change the credential model: the augmented position remains a bare assertion whose underlying inputs are not auditable. The disclosed architecture is orthogonal to the choice of ranging technology; lineage binding applies whether the inputs are GNSS pseudoranges, UWB time-of-flight, 5G NR positioning measurements, or acoustic ranges.

E911 and emergency-services positioning standards specify positional reporting formats and accuracy requirements but do not specify a credentialed-lineage mechanism. A reported E911 fix is admissible to the emergency-response authority by regulatory mandate rather than by structural verification. The disclosed architecture would supplement E911 with a verifiable evidentiary form if required.

ADS-B and other cooperative surveillance systems publish self-reported positions whose underlying derivations are opaque. A receiver of an ADS-B broadcast cannot independently verify the contributing measurements. The disclosed architecture differs in producing positions whose contributions are structurally inspectable, supporting receivers that require evidentiary depth before admitting position claims.

Multi-sensor fusion frameworks (Kalman-filter aggregations of GNSS, IMU, lidar, etc.) typically produce a fused estimate with a covariance matrix but do not externalize signed lineage to the inputs. The covariance is internally consistent with the implementation's noise models but is not externally verifiable. The disclosed architecture externalizes the lineage so that a receiver can walk it without trusting the fuser's internal state.

Academic work on secure positioning (e.g., distance-bounding protocols against relay attacks) addresses the integrity of individual range measurements but does not specify the lineage-binding, scope-admission, and uncertainty-propagation chain that the disclosed architecture defines as a single composable mechanism.

Disclosure Scope

U.S. Provisional Application 64/049,409 discloses the architecture by which multilateration solutions are produced as credentialed observations bound to the lineage of their contributing range observations, with uncertainty bounds propagated structurally from inputs and admission performed by lineage walk against the receiver's local admissibility policy. The disclosure encompasses the structural rejection of tampered or unstamped contributions at solution time, the structural rejection of un-walkable lineage at admission time, the per-scope policy declarations governing quorum, synchronization window, accepted noise models, algorithm parameters, and uncertainty-bound expression, and the composition of position observations with credential, trust, routing, carriage, and audit primitives.

The disclosed scope contemplates implementation across GNSS, UWB, 5G NR positioning, acoustic, and other ranging modalities; across vehicular, aerial, maritime, indoor, and tactical deployment contexts; and across single-authority, multi-authority, and coalition-cross-recognition operating models. It contemplates layered observations in which higher-level artifacts (trajectories, custody chains, geofence-event records) reference lineage-bound positions, recursively preserving admissibility through the layering. Implementations that bind multilateration solutions to credentialed input lineage and propagate uncertainty structurally are within the disclosure regardless of ranging technology or deployment context.