FR2857315A1 - Vehicle utilization access controlling method, involves verifying presence and validity of link between control center of vehicle and radio frequency badge of authorized user, and authorizing use of vehicle when link is verified - Google Patents

Abstract

The method involves verifying the presence and the validity of a link between a control center (20) of a vehicle (A) and a radio frequency badge of an authorized user. The use of the vehicle is authorized to the user when the presence and the validity of the link are verified and the use of the vehicle is prohibited when the link does not exist or is invalid. An engine of the vehicle is stopped when the vehicle is immobile. An independent claim is also included for a device of controlling access for use of a vehicle.

Description

PASSIVE AND SECURE SYSTEM FOR CONTROLLING THE USE OF A VEHICLE OR A

  APPARATUS, WHICH VERIFIES SECURITY CONDITIONS AND THE PRESENCE OF A RADIOFREQUENCY BADGE APPEARING IN A DEFINED PERIMETER.

  Glossary TK TwinKey Name of the invention, can be applied to any element constituting the process or the device.

  AM Amplitude Modulation A radiofrequency process for transmitting information by amplitude modulation of a fixed frequency signal.

  FM Frequency Modulation A radiofrequency process for transmitting information by modulating the frequency of a signal around a reference frequency called CARRIER.

  Central Control Vocabulary Conventions: In the absence of precision, regarding the main or secondary character, a Control Panel may be primary or secondary.

  Authorized User: Person authorized to use the TwinKey protected system.

  Paired systems: Separate systems sharing a common secret enabling them to authenticate securely, and able to communicate by secure link after mutual authentication.

  TK badge: electronic element, worn by the authorized user, matched to a single main control center, and can also be paired to one or more secondary control centers with shared secrets Scan, scrutinize spying and capture process radio frequency signals.

  Challenge-Response: challenge to answer a question correctly. During the process of authentication of B by A, A submits to B a question (challenge) and waits in return for a response (response) which will prove the authenticity of B.

INTRODUCTION

  The present invention relates to a method and a device for controlling access and the right to use a vehicle and / or an appliance.

  This method is provided by a distributed architecture communicating by secure radio frequency links which verifies the presence and validity of a link between a central control and an appropriate badge (in a coverage area adapted to the circumstances of use.).

  It will particularly find its application in the field of the protection of vehicles against theft by cunning or aggression but its universality could not be limited to this application.

anteriority

  The state of the art can be defined by the document US5349329 which proposes a method of protection against theft by trickery or aggression with extraction by unidirectional link between the carrier of a radiofrequency transmitter with limited range and the corresponding receiver in the vehicle , which prevents the use of the latter when the stop of the reception exceeds a predefined time.

  The existing method uses a type of protection that has many limitations in terms of security and robustness compared to piracy, particularly because of the unidirectional character between the badge and the vehicle controller.

  The transmitter of the existing process is unidirectional. Since the transmitter can not receive a signal acknowledgment, it must transmit its code continuously, whether or not it is close to the system to be controlled. This implies a high vulnerability to espionage and piracy. Indeed, the transmitted code can be scanned and recovered permanently near the badge wearer. In addition, the unlock code is always the same, so reusable as is for piracy purposes.

  Similarly, the fact that the portable transmitter has to operate continuously, even if the vehicle is not used for long periods of time (several weeks of vacation or absence), implies a constant and unnecessary consumption of energy, which limits the autonomy, and requires the regular replacement of the energy source.

  The remotes or conventional badges as used in the existing process are removable, if only to renew the energy source. They can therefore be reproduced or modified in particular at their secret code, when assigned by contacts or lines of conductors cut or left continuous to form the combination of code. This means in particular that a malicious buyer A, having bought a protection system of the same model as another user B, will be able to scan the messages sent and received by the user B during the normal operation of his protection system. Subsequently, the user A will be able to modify his badge according to the data scanned with the user B. Therefore the user A, will have a badge with the behavior identical to that of the user B, that he will be able to use for malicious purposes.

  The existing method operates only on the detection of an event of the door opening contact type, and therefore can not protect vehicles without a door (two-wheelers, tricycles, jet-skis, snowmobiles or other vehicles with four doors). wheels without a door).

  The existing process is not compatible with European legislation [ref: TRANS / WP.29 / GRSG / 2000/7 of 16 February 2000 relating to documents TRANS / WP.29 / 2000/18 and TRANS / WP.29 / 2000/3 of the Inland Transport Committee of the Economic Commission for Europe] which prohibits for safety reasons to stop a vehicle while it is moving. However, the existing method can stop the engine of the vehicle while it is not stopped. Indeed, it performs the engine shutdown without checking the speed because this parameter does not enter the process of stopping the engine.

  Similarly, the existing method is in default compared to the highway code of some US states, since it may cause the stopping of a vehicle in unauthorized areas, even dangerous. In fact, the law prohibits parking in fire stations, in bends, on motorways, etc. For example Vehicle Code Sections 22500 to 22506 that list these different parking zones and prohibited stops.

  The document US2002 / 0024428 A1 and its French equivalent published under the reference 2791728 mentions a system of connections that make it possible to prevent the opening and starting of the engine of a vehicle by means of one or more identifiers.

  The document FR2813258 following the publication US 60227409 describes a bidirectional system controlling the opening and starting of a vehicle by verifying the presence of a valid badge in a restricted range around the vehicle and for a certain time after starting the vehicle. this last.

  Existing processes do not check the immobility of the vehicle before shutting down the engine. They all use a door-opening event to initiate the presence check of the valid badge.

  They can not guarantee that the vehicle has moved following the assault of the authorized driver, so the authorized driver can be attacked again to unlock the system, if the thief is still nearby.

  Existing processes only protect the vehicle, and their use for control of additional devices or related functions is not provided.

  The present invention provides a method and a device whose components use wired or radio frequency bidirectional secure links for both the paired badge and the sensors and actuators.

  Therefore, our invention is a set of innovative, effective and robust solutions to correct the shortcomings and weaknesses of existing processes.

  In a non-exhaustive manner, the invention makes it possible to: Adapt to any type of vehicle with or without a door, the element triggering the interrogation of the presence of the badge being an attempt to move the vehicle.

  - Guarantee for the safety of individuals, following a robbery or assault, that the vehicle has been driving for at least some time or that it has traveled at least some distance before initiating the shutdown process.

  - In a version intended for road professionals (deliverymen, taxi drivers, demonstrators of new vehicles ...) the vehicle can be stopped immediately after detection of attempted startup, and before it is in motion. This option can be activated or inhibited according to the request of the authorized user.

  - Limit the operation of the badge only to the periods and conditions in which it must and can operate, which reduces its energy consumption, increases its autonomy, and reduces the risk of espionage, secure the links between the elements of the protective device , to facilitate their installation because of the radio frequency links, - to protect the system against the counterfeiting of the badge, by protecting it from the radio frequency espionage and against the physical attacks, to protect the system against an attack by reuse of a scanned message (request or response), using a variable encryption key for each communication session, secure the use or a function already controlled by a remote control (such as the opening of a gate, a barrier etc ...) with the verification of the presence of the badge proving that it is an authorized user who has to press the opening remote control and this without major modification Existing installations, - Protect vehicles or devices that do not have a door, protect vehicles in compliance with European (but also other) legislation, which prohibits stopping the engine when the vehicle is in motion, - Protect vehicles vehicles passively. The authorized user has no action to perform for the TwinKey system to issue the authorizations or prohibitions for use.

  Easily interfere with an existing system of remote shutdown of the engine (by GSM, remote control ...), by delaying the order so as to shut down the engine only when the vehicle is immobilized.

  Other objects and advantages will become apparent from the description which follows. The invention will now be described in more detail by way of non-limiting example, with reference to the appended figures.

  The present invention relates to a device consisting of a central control unit of the use of an apparatus or a vehicle that can wake up or send orders and receive information from all the elements that constitute the device. Only an authorized user who has a paired badge at the control center will be able to use the protected functions of the device or the vehicle.

  The protection of the device or the vehicle is conditioned by the validity of a bidirectional link between the main control unit and the badge. This link is limited in scope to the normal use area of the device to be protected. For a vehicle, this space covers the passenger compartment and a few meters around the vehicle.

  Our process perfectly meets the proposal of the regulation number 97, Ref. para. 31.4 referred to in TRANS / WP.29 / GRSG / 2000/7 and quoted below: Owners of commercial vehicles, delivery vehicles or Taxis vehicles, etc, are subject to frequent stops during which the vehicle is left behind. a few moments running engine. The vehicle is not protected during this time. There is a demand, increasingly strong, to have an immobilizer that can be armed voluntarily or automatically by the driver when leaving the vehicle. When an attempt is made to steal the vehicle, the immobilizer would be activated and lead to a stopping of the vehicle engine before the motion of the vehicle intervenes. In this case, when the vehicle is stopped while the engine is running, our device will launch a challenge / response process between the controller and the badge as soon as it has detected a significant increase in the engine speed. In case of failure the main controller will stop the engine before the vehicle has begun to move.

  The alarm or theft protection systems of vehicles are mainly based on wired information transmission systems, between the security management center of the vehicle and sensors and alarm systems or blocking the functionality of the vehicle. vehicle. Our invention proposes a preferred, but not mandatory, use of low-frequency radiofrequency links for communication between the elements constituting the vehicle protection system. This feature guarantees an extremely easy, adaptable and fast installation of the various elements constituting the system. These elements can be unidirectional when the control panel has no secret data to transmit, and it does not need an acknowledgment of receipt.

  In a more advanced representation, all the links will be bidirectional, and the communication channels will be secure, with non-reusable communication protocols from one session to another. Such a bidirectional links architecture also ensures that for any message, an acknowledgment will be sent by return.

  In addition, during installation and each initialization of the distributed system, a complete functional and validity check of the functionalities ensures the integrity and security of the system. In the case of transmitting transmitters with a logically adjustable transmit power, the distributed elements (control unit, sensors, badge, etc.) will be able to adjust their transmit power to a minimum in order to guarantee a quality link, to avoid excessive consumption and to limit the radius of coverage to prevent easy reception by a spy system outside a perimeter of proximity of the vehicle.

  The authorized user may also use other secondary devices protected by an additional box. The secondary control center will communicate with the badge through the central control unit or directly with the badge. This will depend on the distance between the badge and the secondary device to be controlled and the presence or not of the main control center. This feature extends the range of the badge, when used in the presence of the protected main unit.

  The badge worn by the user can be combined with the use of a remote control of an ancillary system to validate the ability to perform a function. In this case, it is ensured that the remote control function can be performed only in the presence of the badge worn by the authorized user. For example, a gate and / or garage door remote control will send its original signal to a control box of a function, such as the motor. An additional box (secondary control unit) will intercept the control signal of the function. It will block it as long as the presence of a valid badge or vehicle plus a valid badge will not be proven. This additional box can integrate a transmitter / receiver, allowing bidirectional communication with the badge and the main unit, to perform a mutual challenge / response type of authentication, which will allow the command to reach the opening of the gate or the door of garage. For this, the secondary box will successively send valid requests to the main control panel and the badge, and will analyze the responses as and when.

  This allows in particular: - to use the main control unit as relay whose range is greater than that of the badge (when the badge is worn by the driver in the vehicle and the secondary device to be controlled is a garage door for example) while allowing control of the use of the secondary device, when the main control unit is not in operation (eg opening of a garage door when the main control unit is de-energized in the vehicle parked in the garage).

  Many existing systems offer the authorized user to shut down the engine of his stolen vehicle by operating a control system such as a radio frequency remote control, a number or a specific code transmitted to a mobile phone service. In this case, the vehicle engine is stopped instantly upon receipt of the stop request, which is against the law and can affect the safety of people in the vehicle or surrounding. By interposing between the system for receiving the immediate shutdown request and the engine, our invention transforms the immediate shutdown request into a shutdown of the engine during the next immobilization of the vehicle.

ROBUST MANUFACTURING PROCESS

  In terms of resistance to physical attacks, our invention protects electronic components and electronic boards from tampering, by a manufacturing process that completely drowns the boards and components in a black opaque monolithic material and resistant to mechanical and chemical attack. .

  In addition, the energy source of the badge is not interchangeable, which limits access to cards and components.

  In addition, the code is not assigned to the badge by mechanical means, but by a unique and final programming respectively of a component of the badge, and a component of the control unit.

  The critical functions of the badge and the control panel are kept inactive as long as the programming process, which can only be done once, has not been performed.

  Only the manufacturer of the protection system has the correspondence table of the serial numbers and the secret codes of the badge and the central control unit. Therefore, to reproduce a badge, is possible only by proving its identity with the manufacturer, as it is the case for the keys of high security lock. These measures and their implementation in a context where the secret data are kept with particular care (networks of computers not connected to public networks and whose access is authorized only to sworn and restricted personnel subject to prior identification), ensures that the reproduction of a badge would require enormous technical and financial means not known to date.

  Due to the manufacturing process of the badge molded in a plastic housing or other composite material, it has a particular resistance to moisture (perspiration, washing), mechanical shock (falls from a man's height from a pocket , shocks in a pocket of clothing ...), dust (sand, mud, dust of everyday life or industrial).

MODES OF REALIZATION

  One of the embodiments of the system (B) according to the present invention is schematically illustrated in FIG. 1, together with an associated vehicle (A). Said vehicle (A) is equipped with sensors (speed sensor (10) and engine speed sensor (11) for our example.This vehicle (A) is also equipped with a motor (12), buzzer or visual warning devices (for example, hazard flashers) referenced (13) and a referenced status indicator (14) (fuel gauge witness for our example).

  Said system (B) called TwinKey is composed for our example, a main control unit (5) can be stopped by an external inhibitor (9), said system (B) is also composed of one or more badges (6) paired with the main control unit (5). Said badge (6) is worn by the authorized user (C). Said system (B) is also composed for our example figure (4) of a secondary control unit (7).

  For our example Figure 4, the secondary system (D) is a remote control gate controlled by remote control (22). Said portal is composed of an original central unit (23) receiving the order of opening of the command (22) and delivering the order of opening to the engine (24). This application is only one example among the many applications of the invention.

  According to a first embodiment illustrated in FIG. 2, the transceiver of a main control unit (20) of the vehicle will check the presence of a valid badge (6) in the coverage area of the transmitters and receivers (z6 and z20). For this, the analyzer ((19) FIG.l) of the main control unit ((5) FIG.l) will detect the stopping of the vehicle then a change of the engine speed thanks to the information given by the detectors (( 10), (11) FIG. When these two conditions are valid, the main control unit ((5) FIG.1) will start its challenge-response process with a potential badge.

  Only a paired badge ((6) in FIG 2) will be able to respond correctly to requests, and the authorized user (C) may continue to use the device or vehicle. (A) On the contrary, as illustrated in FIG. 3, in the absence of a paired badge (6) in the coverage area (z20) of the transceiver (20), the main control unit (5) ) will go into alarm, stop the engine ((12) FIG.1) at the next stop of the vehicle (A) by triggering or not (according to the user's choice (C)) audible or visual alarms ((13) FIG.l) Attempts to discover a paired badge can still be attempted to counter a possible false alarm in case of poor communication with a badge that would have been present.

  According to a second embodiment, particularly adapted to the opening of a garage door while the authorized user's vehicle is parked, powered off in said garage, a secondary control unit is used.

  This unit is matched with the same badge used to protect the vehicle, but the common secret used by the challengeresponse is advantageously different from that used to protect the vehicle.

  This secondary control unit intercepts the orders to open the door, and only reestablishes the connection to the motor of the door when the presence of a matched badge is proven.

  In this embodiment, the remote control, the receiver and the actuators under the protection of the secondary control unit are all original, and only the implantation of said secondary control unit is intrusive in the system. Furthermore, the vehicle under protection of the main control unit is not powered, it does not come into play in the control of use of this secondary device.

  According to a third embodiment, illustrated in FIG. 4, the link between the badge (6) and the secondary control unit (7) is made by means of the transceiver (21) of the main control unit (5). . This embodiment is perfectly adapted to the following situation: an authorized user (C) is in his vehicle (A), and is about to open a gate or a garage door (D) (a motorized automatic door), at means of the original remote control (22) of said door. The use of the door (D) is protected by a secondary control unit (7) matched to the badge (6) and to the main control unit (5) of the vehicle (A). Being in his vehicle (A), the range of the badge (z6) of the user (C) authorized is insufficient and much lower than that of the original remote control of the door (z22).

  When the door original control system (23) is stimulated by the door's original remote control (22), the secondary control unit (7) is stimulated and starts a badge search process is unsuccessful, while alternately, it seeks, in its coverage area (z7) the presence of a main control unit (5). The main control unit (5) stimulated by the secondary control unit (7), will search in the coverage area (z20) of its intra-cabin transceiver (20) the presence of a badge (6) paired control centers (5) and (7). The badge (6) having proved its presence, the main control unit (5) will use the range (z2l) of its transceiver (21), to issue the order to the secondary control center (7). ) to authorize the central station (23) of the gate (D) to control the motor (24) so that the portal opens.

  Example of an event sequence applied in FIG. 8 during the communication between a badge and its main paired control unit when the authorized user will want to start his vehicle for non-professional use: 1. The badge is in standby, and the power plant is off.

  2. The authorized user opens the door, installs and puts the ignition on, the main control unit switches to the powered state. The user starts the engine.

  3. The control unit initializes successfully, and waits for a variation of the tachometer or speed sensor to issue the challenge-response.

  4. When acting on the accelerator pedal or speed indication the control center starts the challengeresponse process.

  4.1. the central control unit emits a carrier to wake the badges in its radiofrequency coverage area.

  4.2. If a badge is present, it wakes up and in turn emits its carrier to indicate its presence.

  4.3. The control center then issues its challenge 4.4. The badge decrypts the challenge, in particular to know if it is addressed to him and to recover the data to be used to calculate the answer. As the badge is paired, it is able to process this data and issues its response.

  4.5. As the answer sent by the badge is valid, the control unit goes into standby state, and stops transmitting its carrier. 4.6. The badge no longer receiving a carrier, it also goes to sleep.

  5. The waking state continues until a door is opened or closed.

  System Actions in Case of Aggression or Extreme Assault 6. During a stopping of the vehicle, an attacker opens the door and ejects the authorized driver from his vehicle.

  7. The aggressor takes the place of the driver.

  8. When attempting to move the vehicle (action on the accelerator pedal or non-zero speed), the control unit starts the challenge-response process: 8.1. The central control unit sends a carrier to wake the badges in its radio coverage area, during the entire timeout.

  8.2. Since the badge is out of the range of the control unit, at the end of the timeouts of the BTK central alarm clock and the BTK required central station, the control unit switches to the state Zero speed waiting alert.

  8.3. At the next stop of the vehicle, the control unit enters the blocking central state and switches off the engine.

  9. The system remains in this state until it is inhibited by an action on (9).

  Reverse action on (9). returns the TK system to the Central powered state and resets the badge protection. Explanations of the states of the badge management automaton (FIG. 7):

  TK badge in sleep mode: Description: This is the power-on and no-activity state with extremely low power consumption.

  Input Circumstances: The badge returns to this state after a TIMEOUT from any other state of the controller, or when the data sent by a control panel is invalid or the data received is not valid. intended for this badge, or when the badge leaves the field of action of the carrier, or that this carrier ceases to be issued.

  Actions, Status of the outputs: The energy consumption is minimized, there is only the day before detection of CARRIER, so the outputs of the badge are all inactive: TK P + TK D means that the badge does not emit CARRIER nor VALID DATA.

  Exit Circumstances: Exit from this state is only possible by receiving CT_P, the signal carrier of a control center (primary or secondary).

  TK badge initialized, valid request waiting: Description: The badge is in operating mode, and initialized after the exit of the standby mode, it waits for a valid request coming from a paired CONTROL PANEL.

  Input Circumstances: This state results from the exit of standby mode by receiving a CARRIER from a control center (main or secondary). This carrier can come from the entry of the badge into the field of action of a CONTROL PANEL (matched or not), or the reactivation of the CARRIER by said CONTROL PANEL for a rights check, or this carrier can come from an attempted attack by a malicious third party.

  Actions, Status of the outputs: Upon receipt of a suitable CARRIER, the badge is initialized and returns a CARRIER in return to signal its presence, without delivering any element of his identity or secret in any way.

  Exit Circumstances: To exit from this state, only a valid request (signed by a paired CONTROL PANEL) will cause the request to be processed and the corresponding answer to the CHALLENGE contained in the QUERY. A TIMEOUT or a valid sleep message (CT SO).

  List of illustrations and tables: The illustrations, the text and the tables respect the same numbering and notation.

  Figure 1 is a schematic illustration of a system according to the present invention and an associated vehicle.

  Figure 2 is a sketch of the operation of the system of Figure 1 when the authorized user is in the coverage area of the Twinkey system.

  Figure 3 is a sketch of the operation of the system of Figure 1 when the authorized user is not in the coverage area of the Twinkey system.

  Figure 4 is a sketch of the system of Figure 1, applied to an example of an ancillary function control, for controlling a gate opening command.

  Figure 5 is a descriptive diagram of the elements in a generic embodiment and shows the functional blocks and their interactions, in terms of communication. The blocks are all represented with their distributed components. The vehicle (A) carries the main control unit (5) and its interface and actuator blocks. The paired badge (6) belongs to the group (B) since it belongs to the TwinKey system attached to the vehicle. On the other hand, it is worn by the authorized user (C) who also carries the control (22) of the secondary system (D) (typically a garage door). The external system (E) is not defined by TwinKey, but can interface with it, insofar as it makes it possible to remotely force a request to shut down the engine.

  FIG. 6 describes the notation conventions used for the automata of FIGS. 7, 8 and 9.

  Figure 7 describes the controller used to manage the badge worn by the authorized user. The description which follows corresponds to the first transitions from one state to another of the automaton of said badge, according to the convention described in FIG. 6.

  Figure 8 corresponds to the control system of the main control unit of a vehicle for use by an individual, while Figure 9 shows the system set for delivery vehicles, taxis, etc ...

  In the first case, (FIG. 8) the control system will ensure that the vehicle has been traveling for a certain time or a certain distance, before the engine is stopped at the next vehicle speed cancellation. This ensures the safety of the assaulted driver by keeping a certain distance when stopping the engine between the attacker and the stolen driver.

  On the other hand, in the second case (FIG 9) where the cargo of the vehicle has a certain value, the driver does not want the vehicle to move away before the engine is shut down. In this case, the check of the rights and the stopping of the engine are done during the acceleration of the engine speed, and before the vehicle is set in motion.

  description table of referenced elements

Ref Description

  (A) The vehicle to be protected (8). System for supplying, switching on and stopping the vehicle (eg battery and key switch) (10). Speed sensor (11). Engine speed sensor (tachometer, alternator output voltage) (12). Engine operation control system (ignition, injection pump solenoid valve, circuit breaker _) (13). Central warning audible and / or visual (14). Visual and / or audible indicator, controlled by (17). to indicate the status of the TwinKey (B) TwinKey System (5). Main Control Central TK, matched with the (6). and the (7). optional (6). Badge worn by the authorized user, matched with the main (5) and secondary (7) central. May have a hooking system (hole, clip._) (7). Secondary control station (portal or others), matched with (5). and (6).

  (9). System inhibitor - Allows to totally disable the set in case of vehicle of the TK system, useful breakdown or when nobody the user (ex.

authorized entrusts his garage).

  to a third party (15). Engine shutdown (17). Visual indicator of the state of (B). (optional). Be a buzzer, a led, or a system of zeroing the fuel level gauge or other.

  (21). Transceiver-receiver (medium range) managing bidirectional and unidirectional links with elements external to (A) ((7) for example) (C) User (D) System to be controlled by (B). and controlled by (22). (note a) (24). Function to be controlled by (22).

  (E) External control system of immediate shutdown of the engine controlled by radiofrequency (GSM, radiofrequency, ...). (note b) Notes.

  (Note a) The system (D) can be a gate, a motorized barrier, a remote controlled lighting system, an electrical relay, etc. (note b) The system (E) may be an existing anti-theft procedure, initially intended to shut down the engine following an action by a remote control or a telephone call. Since this process does not comply with the European standard mentioned on page 2, the TK intervenes between this antitheft system and the engine to be cut in order to carry out the order only when the safety conditions are in conformity with the legislation ( zero speed).

  Description of the signals used by the TwinKey elements for the PLCs Inputs:

  Description Active state Inactive Details

  (green) (red or crossed) PW = PoWer Power supply No power supply Power supply of the control unit via the car circuit CT = Tour counter Value no Nil value Data signal of the rev counter, or of the voltage zero output of alternator.

  VT = ViTesse Value no Zero value Data signal of the null tachometer BTK_P = Carrier Carrier Badge TK TK Carrier presence signal Carrier absent present BTK_D = Data Data Badge Signal containing valid data (answering TK_Data Values missing or correctly to the challenge) coming from a TK badge present invalid Timeout Event of N / A Stopwatch initiating an event when a state of timeout the PLC has remained active beyond a time limit defined in advance.

  Init Self-test passed Self-test The self-test defines the integrity and the possibility of dialogue and failure of action between all elements of the system. Internal message at the control center.

  IH Inhibition No Signal from (9). to disable vehicle protection activated by the TwinKey DA System Request No Signal from (E). which calls for the immediate stop of the active vehicle stop. The main control unit will execute the requested command only when the engine stopping conditions are in accordance with the TK logic.

Exits:

  Description Active state Inactive Details

  (green) (red or slashed) AL = AL Alarm Alarm activated Alarm Relay command to indicate an alarm inactive OF = OFf Stop command No signal Motor motor cut-off command TM = Control No signal output Empty fuel gauge command or sound or indicator light signal CT_P = CenTrale Transmit No signal Valid communication carrier Radio frequency Carrier carrier of the central station CT_R = CenTrale CT transmits No signal Transmission of request data for the TK (can be Query valid request or data cyclical with a variable period). The request is invalid when (5) invalid and (6) are not matched CT_OV = CenTrale CT transmits a No Emission of a sleep order of the TK control unit Standby message data message sent to the TK badge (can to be cyclic with variable period) Standby Legend in Figure 5 Elements I (A): Vehicle (B): TwinKey (C): User (D): System ^ ti: (E): Command E ... ^. ..

  Unidirectional Links Bidirectional RF 4 ::::::::::::::::: b.

  Wired RF or Wired, Signals Since the control unit is the repository, the signals emitted are in bold and the answers are in bold and in parentheses, as in the model below. QUESTION (ANSWER) Legend of Figure 6 71 [Signal] Rising edge means the appearance of [Signal] [Signal] Falling edge means disappearance of [Signal] [Signal] Variation means a variation of [Signal] AIB Or inclusive means that the condition is valid when A or B is filled (either, or both).

  A & B And means that the condition is valid when A and B are fulfilled (both at the same time).

  A + B Cumulative means output A is active and at the same time, B is inactive.

Claims (13)

  1. A method of controlling the right of use of a vehicle characterized by the verification of the near presence of an authorized radiofrequency badge and guaranteeing the stopping of the engine only when the vehicle is stationary.   2. Method according to claim 1 characterized in that the control of the presence of the authorized user is performed whenever critical safety conditions are encountered, namely, an action on the accelerator pedal when the vehicle at zero speed.   3. Method according to one of the preceding claims, characterized in that: a request from an external system of receiving stop command (wireless network), alerts the system that will consider this request as a permanent absence of authorized badge, and will cause the engine to stop as soon as the speed of the vehicle is zero.   4. Device for controlling the right of use of a vehicle implementing the method according to one of the three preceding claims and characterized in that it comprises: - a set of analyzers for engine speed and engine speed; vehicle (18), - an engine shutoff actuator of the vehicle to be protected (15), - a main control unit of the distributed elements (5), having a microwave transmitter and receiver communication means (20) - a badge (6) ) carried by the authorized user and capable of communicating with the main control unit by means of a bidirectional microwave link in a field of action voluntarily restricted to the proximity of the vehicle, characterized in that when the information reported by the power analyzer engine and speed indicate an attempt to move the vehicle, and that at the same time, the speed of the vehicle is zero, the control center cuts the mo vehicle if the paired badge is not present in the vehicle's receiving field.   5. Device according to claim 4 characterized in that the main control unit can, depending on the mode of use, cause the immediate shutdown of the engine before the vehicle is in motion, or wait for the stop occurring after a given time or distance guaranteed, to preserve the safety of the driver whose vehicle was stolen by cunning or assault attacked.   6. Device according to claim 4 or 5 characterized in that the badge worn by the authorized user can limit its consumption and the risk of spying by transmitting only in response to a specific request from the main control unit.   7. Device according to claim 6 characterized in that the main control unit and the badge communicate using a secure connection by a method of "Challenge / Response" using cryptographic functions, and a symmetrical or asymmetric secret shared by the two parts.   8. Device according to claims 4 and 5 characterized in that the main control unit can receive a request for immediate shutdown of the engine from an ancillary system, and the engine stop request will be made only when the valid conditions of claim 5 will be verified.   9. Device according to one of claims 4 to 8 characterized in that the badge can also be matched to a secondary control unit to protect a function external to the vehicle.   Device according to Claim 9, characterized in that the secondary control unit is interposed between the original control system of the secondary function to be protected and the corresponding actuator, in order to block the control signal of the said function until the presence of an authorized user is detected according to one of the methods mentioned in claims 1, 2, 3, or 4.   11. Device according to claim 10, characterized in that the secondary station can alternatively search for a badge or the combination of a badge and a main control unit and its paired badge in order to use the main central station. control as relay to interact with the badge when it is limited in scope because it is in the vehicle, which induces a Faraday cage effect.   12. Device according to one of claims (4) to (8) characterized in that the badge and the main control unit store their shared secret in a programmed electronic component during their pairing and embedded in the coating respectively of the central unit and the badge, during their integral molding in a totally opaque material.   13. Device according to claim 12, characterized in that the components containing the shared secrets are programmable once during the production of the distributed elements 14. Device according to one of claims (4) to (13) characterized by the fact that the various elements constituting the distributed system can integrate a unidirectional microwave communication means (transmitter) in order to overcome the wiring of said elements during installation of the system on the vehicle to be protected.   15. Device according to claim 14, characterized in that all the distributed elements constituting the TwinKey system incorporate bidirectional communication means making it possible both to communicate in a secure manner with a central control unit by sharing a secret with this system. last, and prove its ability to perform its function at the control center, during installation or initialization phase of the system.