WO2016059451A1 - Method and system for detecting relay attack for pase system - Google Patents

Method and system for detecting relay attack for pase system Download PDF

Info

Publication number
WO2016059451A1
WO2016059451A1 PCT/IB2014/065327 IB2014065327W WO2016059451A1 WO 2016059451 A1 WO2016059451 A1 WO 2016059451A1 IB 2014065327 W IB2014065327 W IB 2014065327W WO 2016059451 A1 WO2016059451 A1 WO 2016059451A1
Authority
WO
WIPO (PCT)
Prior art keywords
signal
ultra
key fob
wideband
low frequency
Prior art date
Application number
PCT/IB2014/065327
Other languages
French (fr)
Inventor
Li Liang ANG
Alexander Heinrich
Original Assignee
Continental Automotive Gmbh
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Continental Automotive Gmbh filed Critical Continental Automotive Gmbh
Priority to PCT/IB2014/065327 priority Critical patent/WO2016059451A1/en
Priority to DE112014006819.5T priority patent/DE112014006819B4/en
Publication of WO2016059451A1 publication Critical patent/WO2016059451A1/en

Links

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/24—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G07C2009/00555—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks comprising means to detect or avoid relay attacks

Definitions

  • the present specification relates to smart keys and in particular to smart keys which allow a passive access to a car door, such as a PASE (passive start and entry) key system.
  • a PASE system is also known as PEPS (passive entry passive start) system.
  • PES Passive Keyless Entry and Start
  • PASE passive start and entry
  • the passive entry is especially advantageous when both hands of the driv- er are occupied, for example when carrying shopping bags with both hands or when holding a suitease and a baby push-cart , mobile phone and a suitcase etc . It is also convenient when the outside temperatures are very cold.
  • Ultra-wideband refers to a radio technology, which is characterized by a very low energy level for short-range, high-bandwidth communications using a large portion of the radio spectrum.
  • UWB signals are spread over a few gigahertz (GHz), achieving relative bandwidths of 25- 100%.
  • a frequency range of an UWV transmitter is greater or equal to the lesser of 500 MHz or 20% of a center frequency.
  • a frequency range of UWB radio transmission is typically in the Gigahertz range.
  • an unlicensed use of UWB in the frequency range is authorized from 3.1 to 10.6 GHz.
  • an object of the present specification to provide an improved evaluation unit for a passive entry system, or also a passive entry and start system, of a car. Further objects include a corresponding passive entry system, a key fob, a method of detecting a relay attack, a computer program and an electronic component for executing the method according to the specification.
  • an evaluation unit for a passive entry system of a car comprises a connection port for receiving signals from an ultra-wideband transceiver and for transmitting signals to the ultra-wideband transceiver and, optionally, a second connection port for transmitting signals to a low frequency antenna of a low frequency transceiver.
  • the first and second connection ports may be provided by a single connection port, for example by a connection port to a data bus of a car, such as a CAN bus, a LIN or a Flexray bus.
  • the evaluation unit is operative to generate signals for a low frequency transceiver.
  • the evaluation unit is electrically connected to an electronic component of the car, which is connected to a low frequency transceiver.
  • the evaluation unit comprises a computation unit.
  • the computation unit may comprise electronic components such as one or more integrated circuits, a microprocessor, special purpose circuitry, computer memory with a computer readable code or any combinations thereof, wherein the aforementioned electronic components are suitable interconnected.
  • the electronic components of the evaluation unit are suitably configured to provide the functionality of the evaluation unit. With respect to the evaluation unit, this property is also referred to as being operative to provide the functionality .
  • the computation unit is operative to receive an encoded ultra-wideband signal from the connection port, to decode the encoded ultra-wideband signal, to derive a first signal strength value of a first low frequency signal from the encoded ultra-wideband signal and to derive a first key fob distance measure from the first signal strength value.
  • key fob distance measure refers to one or more numeric values which are indicative of a distance between a car, or a location in or at the car, and a key fob.
  • encoded ultra-wideband signal also refers to any signal derived from an ultra-wideband signal, for example a digital signal that is derived from the received ultra-wideband signal by reading out symbols from an electromagnetic signal.
  • the encoded signal encodes a signal strength of a low frequency signal, for example by a RSSI value which may be represented by numeric values such as 10, 20, 30 etc.
  • the computation unit is furthermore operative to receive an ultra-wideband measurement signal from the connection port, to derive a time of arrival of the ultra-wideband measurement signal, and to derive a second key fob distance measure from the time of arrival.
  • the measurement signal is suitable for measuring a distance, for example by having an impulse like signal shape.
  • the measurement signal is different from the encoded ultra-wideband signal.
  • the measurement signal may correspond to an ultra- wideband measurement request signal of the evaluation unit before receiving the ultra-wideband measurement signal.
  • the encoded ultra-wideband is used as the ultra-wideband measurement signal.
  • an encoded ultra-wideband signal may be used to determine a distance to a key fob using a time difference of arrival method.
  • the computation unit is operative to compare the first key fob distance measure with the second key fob distance measure and to determine a distance mismatch between the first key fob distance measure and the second key fob distance measure. Furthermore, the computation unit determines if an unlock condition is met and sends a corresponding unlock signal.
  • the unlock condition is fulfilled when the UWB measurement signal is received and there is no distance mismatch between the first and second key fob distance measure.
  • the unlock condition may also comprise further conditions .
  • a distance mismatch may be detected when a difference between the first and second key fob distance measure is greater than a predetermined threshold, wherein the threshold may depend on further conditions, which are indicative of the accuracy of the distance measurement.
  • the computation unit is operative to derive the time of arrival of the ultra-wideband measurement signal from a signal shape of the ultra-wideband measurement signal, for example by determining a rising edge of the signal.
  • the evaluation unit is operative to send an ultra-wideband measurement request signal and the computation unit is operative to compute a time difference between a time of sending the ultra-wideband measurement request signal and a time of arrival of the corresponding ultra-wideband measurement signal and to derive a time of flight from the time difference.
  • the computation unit is operative to receive a second encoded ultra-wideband signal, to decode the second encoded ultra- wideband signal, to derive a second signal strength value of a second low frequency signal from the second encoded ultra- wideband signal and to derive a third key fob distance measure from the second signal strength value.
  • An ultra-wideband receiver of a car receives the second en- coded ultra-wideband signal at a later time than the first encoded ultra-wideband signal,
  • the second low frequency sig- nal which is encoded in the second encoded ultra-wideband signal, is derived from a low frequency signal that is send at a later time than the first low frequency signal.
  • the computation unit is further operative to compare the first key fob distance measure with the third key fob distance measure and to determine if there is a distance mismatch between the third key fob distance measure and the first key fob distance measure.
  • the distance mismatch is detected if a difference between the first and the first key in a pre-determined time is smaller than a pre-determined value .
  • the computation unit is operative to receive a first measurement signal from a first ultra-wideband antenna, to receive a second measurement signal from a second ultra-wideband antenna, and to receive a third measurement signal from a third ultra- wideband antenna.
  • the first, second and third ultra-wideband antenna are arranged at suitable locations in a car.
  • the first, second and third measurement signals correspond to wave fronts of the same electromagnetic signal.
  • the computation unit is further operative to compute a key fob distance measure from time differences of arrival between the first, second and third measurement signals.
  • the current specification discloses a passive entry system for a passenger car with a low frequency transmitter for transmitting a low frequency signal.
  • An antenna of the LF transceiver is provided in or at a door of the passenger car or next to it.
  • the door may be a driver door next to a driver seat.
  • the passive entry system further comprises an ultra-wideband transceiver, which is connected to the connection port of the evaluation unit.
  • the passive entry system further comprises a key fob with a low frequency (LF) transceiver, an ultra-wideband transceiver, and an evaluation means, which are suitably in- terconnected .
  • the evaluation unit is operative to determine a signal strength value, such as an RSSI value, of a received LF signal .
  • the key fob comprises encoding means for encoding the signal strength value in a digital signal and a modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver.
  • the key fob is configured to receive a measurement request signal and to send a measurement response signal after a pre-determined time delay.
  • the time delay is predetermined within a required accuracy, such as an accuracy of 1 na- nosceond or less .
  • the current specification discloses a car with the abovementioned passive entry system.
  • the car comprises a low frequency transceiver with a low frequency antenna.
  • the low frequency antenna is provided at a door of the car, such as the driver door.
  • a command line of the passive entry system is connected to lock of the door, and the passive key entry system is opera tive to unlock the lock if the computation unit in response to an unlock signal of the evaluation unit that is sent via the command line.
  • the evaluation unit sends the unlock signal if the computation unit of the evaluation unit determines that there is no mismatch between the first key fob distance measure and the second key fob distance measure .
  • the low frequency antenna is provided at a driver door
  • the low frequency transceiver comprises, or is connected to, a second low frequency antenna and a third low frequency antenna.
  • the second low frequency antenna is provided at a second door
  • the third low frequency antenna is provided at a boot door of the car. If a range of the low frequency signals is low, the placement of more than one low frequency antennas helps to assure that the low frequency signals cover a larger area in the vicinity of the car.
  • the current specification discloses a key fob for a passive entry system of a car with a low frequency transceiver, an ultra-wideband transceiver, and evaluation means for determining a signal strength value of a received LF signal.
  • the key fob comprises an encoding means for encoding the signal strength value in a digital signal and modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver.
  • the key fob comprises retransmission means for receiving and retransmitting a UWB distance measurement signal.
  • the retransmission means are provided by portions of an ultra- wideband antenna of the key fob.
  • the retransmission means may also comprise means for generating a response signal, for amplifying the response signal, or for determining a direction of an incoming signal and for retransmitting a corresponding signal inessentially to the same direction using antenna shaping and/or beam forming.
  • key fob is configured to transfer energy from a received LF signal to the evaluation means and to the encoding means, for example by providing an electronic circuit for storing electric energy.
  • the current application discloses a method for determining the presence of a relay attack in a passive entry system.
  • the method comprises receiving an encoded ultra-wideband signal, decoding the encoded ultra- wideband signal, deriving a first signal strength value of a first low frequency signal from the encoded ultra-wideband signal, and deriving a first key fob distance measure from the first signal strength value.
  • the method comprises receiving an ultra-wideban measurement signal, deriving a time of arrival of the ultra- wideband measurement signal and deriving a second key fob distance measure from the time of arrival.
  • the ultra-wideban measurement signal may be different from the encoded ultra- wideband signal or it may be the same as the encoded ultra- wideband signal.
  • the ultra-wideband measurement signal corresponds to a measurement request signal that is sent out from an ultra-wideband antenna of the car and reflected or retransmitted by an ultra-wideband antenna of a key fob, wherein retransmission also includes the trans mission of a corresponding measurement response signal.
  • the method further comprises comparing the first key fob dis tance measure with the second key fob distance measure, and determining a distance mismatch between the first key fob distance measure and the second key fob distance measure.
  • the present specification discloses a computer program for executing the abovementioned method and an electronic component which is operative to execute the method according to claim 14.
  • the electronic component may comprise the abovementioned computer program, or portions of it, in a computer readable storage medium.
  • a PASE systems makes use of low range low frequency signals for communication between the car and a key fob.
  • a frequency range for LF radio waves extends from 30 to 300 kHz.
  • a passive entry/passive start system uses the LF signals to detect a location of the key fob. It detects if the key is near the vehicle, and, if the system is not only a passive entry but also a passive start system, the system, it also detects if the key fob is inside or outside the vehicle.
  • the key fob measures an LF signal level (RSSI) during the communication with the vehicle. It acquires the RSSI and sends it back to the vehicle, which analyzes the RSSI to determine the fob's position.
  • the received signal strength indicator (RSSI) may be derived from a signal in the intermediate frequency (IF) stage before the IF amplifier.
  • the RSSI is derived from a signal in the baseband signal chain, before the baseband amplifier.
  • RSSI output is often provided as DC analog levels.
  • the RSSI output can also be sampled by an internal ADC.
  • the resulting codes can be made available in digital form via a peripheral or via an internal processor bus.
  • a key fob may use three discrete antenna coils or one 3D-coil to determine the field intensities in the x-, y- and z-axes.
  • a UWB radio transmission is pulse-based and uses a pulse-position or time- modulation.
  • One of the modulation methods currently used for UWB radio signal is OFDM (orthogonal frequency division multiplexing) .
  • UWB systems can achieve a high bandwidth by transmitting an impulse-like waveform.
  • Such waveforms are inherently broadband.
  • This property can be demonstrated mathematically by representing the impulse-like waveform by a product of a signal function with a window function and computing a Fourier transform thereof. For example, the product of a sine function with a rectangular window becomes the convolution of a delta distribution with a sinc-function, which yields a sinc- function that contains arbitrary high frequencies.
  • the pulses of a UWB signal may be used to estimate a distance between a transmitter and a receiver, once a sending time of the transmitter is known to the receiver. This can be achieved by synchronizing the transmitter with the receiver with high accuracy or by using a two-way time of flight (TW-TF) method.
  • TW-TF time of flight
  • a time of flight is obtained by subtracting antenna delays at the transmitter and at the receiver from a signal response time. The distance can then be calculated by multiplying the speed of light with the time of flight.
  • an UWB centre frequency of 5 GHz corre- sponds to a wavelength of 6 cm.
  • an UWB ranging applica- tion can have an approximate resolution in the cm range .
  • One oscillation at this frequency lasts 2 x 10 ⁇ (-10) seconds or 200 picoseconds. Therefore, it is desirable for an UWB rang ing application to provide a clock with an accuracy of the order of picoseconds .
  • a typical operating range of an UWB ranging system is in the range of several hundred meters.
  • a range of the UWB distance measurement may extend up to 100 meters, 300 meters or even up to 1000 meters. Furthermore, the use of ultra- wideband signals can provide robustness against multipath effects, interference and jamming attempts.
  • Figure 1 shows a passive entry system using a time of flight
  • Figure 2 shows a second embodiment of a passive entry system using a time distance of arrival UWB distance measurement
  • Figure 3 illustrates a distance computation according to the embodiment of Fig. 2
  • Figure 4 shows a method of determining a distance mismatch according to the embodiment of Fig. 1.
  • FIG. 1 shows a passive entry system 10.
  • the passive entry system comprises low frequency antennas 8, 9, 11, an ultra- wideband receiver 12 in a passenger car 13 and an electronic key or key fob 14, which also referred to as smart key 14.
  • the key fob 14 comprises components that provide a passive entry and start functionality.
  • the components of the key fob 14, which are not shown in Figs. 1 - 2, comprise a computation unit, a transceiver and an antenna.
  • the key fob 14 comprises remote control buttons 15 for the manual activation of start and entry and other functions.
  • the key fob 14 takes the energy for generating a response signal from the electromagnetic field energy of the incoming signals and/or from a battery, which is provided in the key fob 14.
  • the LF communication of the key fob 14 can be provided by a passive LF RFID component, which har- nesses the energy of the received electrical field.
  • Fig. 1 illustrates the operation of the passive entry system 10 during a relay attack.
  • An intruder or a team of intruders performs a relay attack through the use of a paired set of radio devices . These are used to capture the signals emitted by the vehicle and the replies from the Smart Key, and extend their range so that the key and the vehicle believe that they are within the authorised operation area.
  • Relay attacks can typical- ly operate over a range of 100 to 1,000 metres, depending on the equipment used and on the environmental conditions.
  • the first radio device of the set of paired radio devices is referred to as transceiver 20 or "intruder's transceiver 1" and the second radio device of the set of paired radio devices is referred to as transceiver 21 or "intruder's transceiver 2".
  • the first transceiver 20 comprises an LF antenna coil 26 for picking up the LF signal of the car 13 more easily.
  • a first intruder 23 positions himself and the coil 26 of the first transceiver 20 next to a car door and is ready to open the car's door.
  • a second intruder 24 places himself and the second transceiver 21 next to the car owner 25.
  • the second intruder 24 may be sitting next to the car owner 25, which is sitting in a cafeteria next to a car park and sipping a coffee .
  • the cars' electronic causes the LF antenna 11 to transmit request signals, either permanently or in response to a wake-up signal, which is caused by the first intruder 23.
  • the wake-up signal may be generated when a person approaches the car door or the door handle or tries to pull the door handle.
  • the first intruder 23 uses the LF coil to pick up the request signals of the car 13. This step is labelled as "LF from car” in Fig. 1.
  • the transceiver 20 of the first intruder transforms the received LF signal into a RF signal and transmits it to the second transceiver 21 via a private channel. This procedure is also referred to as "relaying" the signal over the private channel.
  • second transceiver 21 of the second intruder receives the signals over the private channel and transforms them back LF signals .
  • This step is labelled as "LF relayed to fob" Fig. 1.
  • the key fob 14 receives the LF request signals from the second transceiver 21 and processes them in the same way as a request signal that it would have received directly from the car 13.
  • the key fob 14 After receiving the LF request signal, the key fob 14 measures the signal strength of the received LF signal and sends back a UWB response signal in which the signal strength of the received LF signal is encoded.
  • the key fob 14 may encode the signal strength as an RSSI level.
  • the UWB receiver 12 receives the UWB response signal.
  • a car electronic which is connected to the UWB receiver 12, decodes the RSSI signal strength and derives a first distance between the car 13 and the key fob 14 from the RSSI signal strength, which is encoded in the received signal.
  • the car electronic which is not shown in Fig. 1, comprises, among others, a motor control unit (MCU) and a vehicle control unit (VCU) .
  • the cars' sensors and the car electronic ar electrically connected, for example using a special purpose data bus such as the CAN bus, the FlexRay bus or others.
  • a special purpose computation unit may be provided for handling the signals of the passive entry system 10.
  • an evaluation unit performs a two-way time of flight measurement and derives a second distance between the car 13 and the key fob 14 using the UWB response signal of the key fob 14. The evaluation unit compares the first and the second distance and determines if there is a distance mismatch .
  • an evaluation unit with a computation unit for the receiving, processing and sending out ultra-wideband signals of an ultra- wideband transceiver of the car 13.
  • the evaluation unit may be provided as a separate electronic component, which is connected to the car electronics, or it may be integrated into a component of the car electronics, such as the vehicle control unit.
  • the evaluation unit may furthermore be capable of receiving, processing and sending low frequency signals of a low frequency transceiver of the car 13.
  • the car electronic performs the UWB two-way time of flight measurement after it has received a response signal from the key fob 14 and only releases the doors if it receives a response from the UWB measurement and if there is no distance mismatch.
  • the car electronic performs the two-way time of flight measurement already before it receives a response signal of the key fob 14, for example after sending an LF signal or after detecting the presence of a person next to the door.
  • the car electronics may send an UWB alert signal to the key fob 14 and in response the key fob does not generate response signals .
  • the car electronic performs a two-way time of flight measurement according to the following steps.
  • the car electronic sends an impulse-like UWB request signal via the UWB transceiver 12. If the key fob 14 is within a UWB signal range, the key fob 14 receives the UWB request signal, generates a corresponding UWB response signal and transmits it back to the UWB receiver 12.
  • the key fob 14 may reflect the signal by some suitable mechanism or it may first amplify the received signal and then send it back.
  • steps are labelled as step 5, "UWB measurement request” and step 6, "UWB measurement response", respective- ly.
  • the ultra-wideband (UWB) signal which is send from the car 13 and which is used for measuring a distance between the car 13 and the key fob 14 is also referred as "measurement request signal" and the signal that the car 13 receives from the key fob 14 in response to the measurement request signal is also referred to as measurement signal or measurement response signal .
  • the car electronic uses a high accuracy clock to determine a time interval between sending the UWB request signal and the UWB response signal. It derives a time of flight from the time interval taking into account antenna delays and delays of the electronics in the key fob 14 and in the UWB transceiver 12. In a next step, the car electronic derives a distance between the car 13 and the key fob 14 from the time of flight .
  • the car electronic and/or the electronic of the key fob 14 determine a leading edge of the received signal, which corresponds to a direct path between the car 13 and the key fob 1 .
  • the signals that have not travelled along the direct path arrive after the leading edge of the response signal.
  • the car electronic of the car 13 and the key fob 14 perform an authentication procedure.
  • the key authentication may use the LF radio link, an RF radio link or the UWB radio link or a combination thereof.
  • the authentication may comprise only one roundtrip of signals from the car 13 to the key fob 14 and back to the car 13, as shown in Fig. 1, or more.
  • a key authentication may be performed in one of the following ways.
  • the vehicle 13 According to a uni-directional authentication, the vehicle 13 generates a random number, which is also referred to as Nonce, and transmits it as challenge to the key fob 14.
  • the key fob 14 encrypts the challenge and sends it as response to the vehicle 13.
  • the vehicle 13 also encrypts the Nonce. If the encrypted Nonce and the received response are identical, the key fob 14 is authenticated and the door is unlocked.
  • the key fob 14 authenticates the vehicle 13 before replying, and in a second step, the vehicle authenticates the fob. Both steps use different secret keys.
  • the vehicle 13 generates a Nonce, encrypts it using a first secret key to obtain the Nonce, and sends both to the key fob 14 together with a command to indicate that bidirectional authentication is used.
  • the key fob 14 encrypts the Nonce with the first secret key and compares it to the Nonce.
  • the vehicle 13 is authenticated to the key fob 14. Then, the key fob 14 encrypts this first encryption result by using the second secret key, and sends it as response to the vehicle 13. The vehicle 13 performs the same procedure and compares its own result with the received response. If these are identical, the fob 14 also is authenticated to the vehicle 13, and the doors unlock or the vehicle 13 starts.
  • Fig. 2 shows a second embodiment of a passive entry system 10' which is similar to the first embodiment shown in Fig. 1.
  • the passive entry system 10' comprises at least three UWB receivers for performing a distance measurement according to a time difference of arrival method.
  • the re- sponse signal of the key fob 14 to ' the LF request signal can be used to determine the distance of the key fob 1 4 to the car 13 and a further roundtrip of UWB signals, sueh as the signal roundtrip labelied as "5. " and “ 6. " in Fig . 1, is not required .
  • a first wavefront 4a of the response signal reaches the first UWB receiver 12 after a time t
  • a second wavefront 4b reaches the second UWB receiver 30 after a time t + At 1
  • a third wavefront reaches the third UWB receiver 13 after a time t + At 2.
  • Fig. 3 shows, by way of example the locus of possible key fob locations for the given delay At 1 and At 2 of Fig. 2 in a measurement plane.
  • the possible locations of the key fob 14 lie on a first hyperbola 32 or on a second hyperbola 33.
  • the possible locations of the key fob 14 lie on a first hyperbola 34 or on a second hyperbola 35.
  • the car electronic computes the location of the key fob 14 as the intersection of one of the hyperbolae 32, 33 with one of the hyperbolae 34, 35.
  • the key fob is at the intersection of hyperbola 34 with hyperbola 32.
  • the time distance of arrival method also provides information about the location of the key fob 14 in addition to providing the distance of the key fob 14.
  • the computation is similar, when the receivers are not arranged in one line or when there are more than three receivers .
  • Fig. 4 shows a method of determining a distance mismatch according to the embodiment of Fig. 1.
  • the sequence of the method steps may be different from the sequence of Fig. 1 without departing from the scope of the present specification.
  • the UWB distance measurement of steps 51 to 55 may be performed before receiving the UWB response signal in step 48.
  • a LF transceiver which is connected to the LF antenna 11, wakes up from a battery-conserving sleep mode.
  • the LF transceiver transmits low frequency request signals, which comprise authentification information of the car 13, such as a NONCE, an encrypted value, an encrypted ID etc .
  • a LF antenna of the key fob 14 receives the LF request signal of the car and, in a step 44, an electronic component of the key fob 14, such as an integrated circuit, measures the LF signal strength and, in a step 45, converts it into an RSSI value.
  • the electronic component of the key fob 14 encodes the RSSI value in a digital signal, modulates the digital signal onto a UWB response signal and, in a step 47, sends out the UWB response signal using a broadband antenna, which is integrated in the key fob.
  • the broadband antenna may be realized by a suitably shaped copper plating of a circuit board or other carrier substance .
  • the UWB transceiver of the car 13 receives the UWB signal from the UWB antenna or UWB receiver 12 and, in a step 49, and evaluation unit of the UWB transceiver or an evaluation unit connected to the UWB transceiver decodes the UWB signal and reads out the previously encoded RSSI value, which was determined by the key fob 14.
  • the evaluation unit causes the UWB transceiver of the car 13 to send out a UWB measurement signal for measuring a distance between the UWB receiver 12 and the key fob 14.
  • the key fob receives the UWB measurement signal and retransmits the UWB measurement signal, or a response signal to the UWB measurement signal in a step 53.
  • the step 53 may simply comprise a step of reflecting the received signal back or it may comprise steps of amplifying the response signal or of generating a response signal.
  • the key fob 14 comprises electronic means to concentrate a signal, which is spread out in time due to multi path effects to generate a response sig- nal or to use the energy of the received signal to generate a response signal.
  • the UWB receiver 12 receives the UWB measurement response signal of the key fob 14, determines a time of arrival of the received signal and derives a time of flight or time of travel of the signal.
  • the evaluation unit of the car 13 derives a second distance from the time of flight, and, in a step 56, the evaluation unit compares the first and the second distance and determines if there is a distance mismatch.
  • an RSSI value of a low frequency signal is compared to a distance value from a distance measurement via an UWB signal.
  • the passive entry system can be configured such that only a valid combination of the LF RSSI value and the UWB distance value will trigger the unlocking and/or the starting of the vehicle.
  • the LF RSSI value may be used for signal from only one LF antenna of the car, from multiple LF antennas or from all LF antennas.
  • the LF power may be a) higher than expected or b) normal or c) lower than expected.
  • UWB flight time will in general be higher than expect and, furthermore, it will in general not match to the RSSI value .
  • a relay attack can be detected.
  • RSSI response from fob will in general differ from the first check because the car owner is moving around and the distance and orientation of the key fob antenna changes iii) UWB flight time: normal
  • the LF power may be a) higher than expected or b) normal or c) lower than expected.
  • UWB flight time will in general be higher than expected and, furthermore, it will in general not match to the RSSI value .
  • a relay attack can be detected.
  • the RSSI values of the first and second check can be compared.
  • the coil of the intruders' first transceiver of the intruders is typically larger and is not moved around. Therefore, it is a further indication of a relay attack if the RSSI values do not change or change only very little.
  • the second check needs a further signal round trip.
  • the signal round trip which is indicated by the numbers 1, 2, 3 and 4 next to the arrows of Fig. 1, needs to be repeated after a pre-determined time.
  • An evaluation unit for a passive entry system of a car comprising
  • connection port for receiving signals from an ultra- wideband transceiver and for transmitting signals to the ultra-wideband transceiver
  • a computation unit the computation unit being operative to receive an encoded ultra-wideband signal from the connection port, to decode the encoded ultra-wideband signal, to derive a first signal strength value of a first low frequency signal from the encoded ultra- wideband signal and to derive a first key fob distance measure from the first signal strength value,
  • the computation unit being operative to receive an ultra-wideband measurement signal from the connection port, to derive a time of arrival of the ultra-wideband measurement signal, and to derive a second key fob distance measure from the time of arrival,
  • the computation unit being operative to compare the first key fob distance measure with the second key fob distance measure and to determine a distance mismatch between the first key fob distance measure and the second key fob distance measure.
  • the evaluation unit according to item 1, wherein the computation unit is operative to derive the time of arrival of the ultra-wideband measurement signal from a signal shape of the ultra-wideband measurement signal.
  • the evaluation unit according to item 1 or item 2, the evaluation unit being operative to send an ultra- wideband measurement request signal,
  • the evaluation unit according to one of the items 1 to 3, wherein the computation unit is operative to receive a second encoded ultra-wideband signal, to decode the second encoded ultra-wideband signal, to derive a second signal strength value of a second low frequency signal from the second encoded ultra-wideband signal and to de- rive a third key fob distance measure from the second signal strength value,
  • the second encoded ultra-wideband signal is received at a later time than the first encoded ultra- wideband signal and wherein the second low frequency signal is send at a later time than the first low frequency signal
  • the computation unit being further operative to
  • the evaluation unit according to one of the preceding items, wherein the computation unit is operative to receive a first measurement signal from a first ultra- wideband antenna to receive a second measurement signal from a second ultra-wideband antenna, and to receive a third measurement signal from a third ultra-wideband an tenna, wherein the first, second and third measurement signals correspond to wave fronts of the same electromagnetic signal, the computation unit further being operative to compute a key fob distance measure from time differences of arrival between the first, second and third measurement signals.
  • a passive entry system for a passenger car comprising a low frequency transceiver for transmitting a low frequency signal
  • the ultra-wideband transceiver being connected to the connection port of the evaluation unit according to one of the preceding items .
  • the passive entry system according to item 6 the passive entry system comprising a key fob, the key fob comprising
  • a car with a passive entry system according to item 6 o item 7, the car comprising a low frequency transceiver with a low frequency antenna, the low frequency antenna being provided at a door of the car, and wherein a command line of the passive entry system is connected to a lock of the door, and wherein the passive key entry sys tern is operative to unlock the lock if the computation unit in response to an unlock signal of the evaluation unit .
  • the low frequency antenna is provided at a driver door
  • the low frequency transceiver comprises a secori' low frequency antenna and a third low frequency antenna
  • the second low frequency antenna is provided at a second door
  • the third low frequency antenna is provided at a boot door of the car.
  • a key fob for a passive entry system of a car comprising
  • the key fob of item 9 or item 10 being configured to transfer energy from a received low frequency signal to the evaluation means and to the encoding means .
  • a method for determining the presence of a relay attack in a passive entry system comprising

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Mechanical Engineering (AREA)
  • Lock And Its Accessories (AREA)

Abstract

A passive entry system for a passenger car comprises a low frequency transceiver for transmitting a low frequency signal, an ultra-wideband transceiver and an evaluation unit. The evaluation unit comprises a computation unit for deriving a first distance measure of a key fob, which is encoded in a first received ultra-wideband signal and which is derived from a signal strength of the low frequency signal, for de- riving a second distance measure of the key fob from a time of arrival of a second received ultra-wideband signal, for comparing the first distance measure with the second distance measure and for determining a distance mismatch between the second distance measure and the second distance measure.

Description

METHOD AND SYSTEM FOR DETECTING RELAY ATTACK FOR PASE SYSTEM
The present specification relates to smart keys and in particular to smart keys which allow a passive access to a car door, such as a PASE (passive start and entry) key system. A PASE system is also known as PEPS (passive entry passive start) system.
Passive Keyless Entry and Start (PKES) systems, which are al- so referred to as passive start and entry ( PASE) systems, al- low users to open and start their cars while having their car keys in their pockets. This feature is very convenient for the users since they do not need to search for their keys when approaching or preparing to start the car. The passive entry is especially advantageous when both hands of the driv- er are occupied, for example when carrying shopping bags with both hands or when holding a suitease and a baby push-cart , mobile phone and a suitcase etc . It is also convenient when the outside temperatures are very cold.
Ultra-wideband (UWB) refers to a radio technology, which is characterized by a very low energy level for short-range, high-bandwidth communications using a large portion of the radio spectrum. In contrast with spread spectrum radio technologies that achieve a few 100s of kilohertz (kHz) to 10s of megahertz (MHz) of bandwidth, UWB signals are spread over a few gigahertz (GHz), achieving relative bandwidths of 25- 100%. According to one definition, a frequency range of an UWV transmitter is greater or equal to the lesser of 500 MHz or 20% of a center frequency. A frequency range of UWB radio transmission is typically in the Gigahertz range. In a FCC Report and Order of February 2002, an unlicensed use of UWB in the frequency range is authorized from 3.1 to 10.6 GHz.
Among others, it is an object of the present specification to provide an improved evaluation unit for a passive entry system, or also a passive entry and start system, of a car. Further objects include a corresponding passive entry system, a key fob, a method of detecting a relay attack, a computer program and an electronic component for executing the method according to the specification.
According to the present specification, an evaluation unit for a passive entry system of a car is disclosed. The evaluation unit comprises a connection port for receiving signals from an ultra-wideband transceiver and for transmitting signals to the ultra-wideband transceiver and, optionally, a second connection port for transmitting signals to a low frequency antenna of a low frequency transceiver. The first and second connection ports may be provided by a single connection port, for example by a connection port to a data bus of a car, such as a CAN bus, a LIN or a Flexray bus.
In one embodiment, the evaluation unit is operative to generate signals for a low frequency transceiver. According to another embodiment, the evaluation unit is electrically connected to an electronic component of the car, which is connected to a low frequency transceiver.
The evaluation unit comprises a computation unit. By way of example, the computation unit may comprise electronic components such as one or more integrated circuits, a microprocessor, special purpose circuitry, computer memory with a computer readable code or any combinations thereof, wherein the aforementioned electronic components are suitable interconnected. The electronic components of the evaluation unit are suitably configured to provide the functionality of the evaluation unit. With respect to the evaluation unit, this property is also referred to as being operative to provide the functionality .
The computation unit is operative to receive an encoded ultra-wideband signal from the connection port, to decode the encoded ultra-wideband signal, to derive a first signal strength value of a first low frequency signal from the encoded ultra-wideband signal and to derive a first key fob distance measure from the first signal strength value. Herein "key fob distance measure" refers to one or more numeric values which are indicative of a distance between a car, or a location in or at the car, and a key fob.
Herein, encoded ultra-wideband signal also refers to any signal derived from an ultra-wideband signal, for example a digital signal that is derived from the received ultra-wideband signal by reading out symbols from an electromagnetic signal. The encoded signal encodes a signal strength of a low frequency signal, for example by a RSSI value which may be represented by numeric values such as 10, 20, 30 etc.
The computation unit is furthermore operative to receive an ultra-wideband measurement signal from the connection port, to derive a time of arrival of the ultra-wideband measurement signal, and to derive a second key fob distance measure from the time of arrival. The measurement signal is suitable for measuring a distance, for example by having an impulse like signal shape. In one embodiment, the measurement signal is different from the encoded ultra-wideband signal. In particu- lar, the measurement signal may correspond to an ultra- wideband measurement request signal of the evaluation unit before receiving the ultra-wideband measurement signal.
According to a further embodiment, the encoded ultra-wideband is used as the ultra-wideband measurement signal. For example, an encoded ultra-wideband signal may be used to determine a distance to a key fob using a time difference of arrival method.
The computation unit is operative to compare the first key fob distance measure with the second key fob distance measure and to determine a distance mismatch between the first key fob distance measure and the second key fob distance measure. Furthermore, the computation unit determines if an unlock condition is met and sends a corresponding unlock signal. By way of example, the unlock condition is fulfilled when the UWB measurement signal is received and there is no distance mismatch between the first and second key fob distance measure. In other embodiments, the unlock condition may also comprise further conditions .
In particular, a distance mismatch may be detected when a difference between the first and second key fob distance measure is greater than a predetermined threshold, wherein the threshold may depend on further conditions, which are indicative of the accuracy of the distance measurement.
In a particular embodiment, the computation unit is operative to derive the time of arrival of the ultra-wideband measurement signal from a signal shape of the ultra-wideband measurement signal, for example by determining a rising edge of the signal. According to a further embodiment, the evaluation unit is operative to send an ultra-wideband measurement request signal and the computation unit is operative to compute a time difference between a time of sending the ultra-wideband measurement request signal and a time of arrival of the corresponding ultra-wideband measurement signal and to derive a time of flight from the time difference.
According to a further embodiment, which takes into account a mismatch between LF signal strengths of received LF signals, the computation unit is operative to receive a second encoded ultra-wideband signal, to decode the second encoded ultra- wideband signal, to derive a second signal strength value of a second low frequency signal from the second encoded ultra- wideband signal and to derive a third key fob distance measure from the second signal strength value.
An ultra-wideband receiver of a car receives the second en- coded ultra-wideband signal at a later time than the first encoded ultra-wideband signal, The second low frequency sig- nal, which is encoded in the second encoded ultra-wideband signal, is derived from a low frequency signal that is send at a later time than the first low frequency signal.
The computation unit is further operative to compare the first key fob distance measure with the third key fob distance measure and to determine if there is a distance mismatch between the third key fob distance measure and the first key fob distance measure. According to one embodiment, the distance mismatch is detected if a difference between the first and the first key in a pre-determined time is smaller than a pre-determined value . According to a further embodiment, which uses wave fronts of an electromagnetic signal from an ultra-wideband transmitter of a key fob to determine a distance measure of the key fob according to a time difference of arrival method, the computation unit is operative to receive a first measurement signal from a first ultra-wideband antenna, to receive a second measurement signal from a second ultra-wideband antenna, and to receive a third measurement signal from a third ultra- wideband antenna. The first, second and third ultra-wideband antenna are arranged at suitable locations in a car.
The first, second and third measurement signals correspond to wave fronts of the same electromagnetic signal. The computation unit is further operative to compute a key fob distance measure from time differences of arrival between the first, second and third measurement signals.
According to a further aspect, the current specification discloses a passive entry system for a passenger car with a low frequency transmitter for transmitting a low frequency signal. An antenna of the LF transceiver is provided in or at a door of the passenger car or next to it. In particular, the door may be a driver door next to a driver seat.
The passive entry system further comprises an ultra-wideband transceiver, which is connected to the connection port of the evaluation unit.
The passive entry system according further comprises a key fob with a low frequency (LF) transceiver, an ultra-wideband transceiver, and an evaluation means, which are suitably in- terconnected . The evaluation unit is operative to determine a signal strength value, such as an RSSI value, of a received LF signal .
Furthermore, the key fob comprises encoding means for encoding the signal strength value in a digital signal and a modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver. If a two way time of flight (TOF) measurement is used, the key fob is configured to receive a measurement request signal and to send a measurement response signal after a pre-determined time delay. The time delay is predetermined within a required accuracy, such as an accuracy of 1 na- nosceond or less .
According to a further aspect, the current specification discloses a car with the abovementioned passive entry system. The car comprises a low frequency transceiver with a low frequency antenna. The low frequency antenna is provided at a door of the car, such as the driver door.
A command line of the passive entry system is connected to lock of the door, and the passive key entry system is opera tive to unlock the lock if the computation unit in response to an unlock signal of the evaluation unit that is sent via the command line.
According to one particular embodiment, the evaluation unit sends the unlock signal if the computation unit of the evaluation unit determines that there is no mismatch between the first key fob distance measure and the second key fob distance measure . According to a further embodiment, the low frequency antenna is provided at a driver door, the low frequency transceiver comprises, or is connected to, a second low frequency antenna and a third low frequency antenna. The second low frequency antenna is provided at a second door, and the third low frequency antenna is provided at a boot door of the car. If a range of the low frequency signals is low, the placement of more than one low frequency antennas helps to assure that the low frequency signals cover a larger area in the vicinity of the car.
According to a further aspect, the current specification discloses a key fob for a passive entry system of a car with a low frequency transceiver, an ultra-wideband transceiver, and evaluation means for determining a signal strength value of a received LF signal. Furthermore, the key fob comprises an encoding means for encoding the signal strength value in a digital signal and modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver.
In a further embodiment, the key fob comprises retransmission means for receiving and retransmitting a UWB distance measurement signal. In a particularly simple embodiment, the retransmission means are provided by portions of an ultra- wideband antenna of the key fob. Among others, the retransmission means may also comprise means for generating a response signal, for amplifying the response signal, or for determining a direction of an incoming signal and for retransmitting a corresponding signal inessentially to the same direction using antenna shaping and/or beam forming. According to a further embodiment, key fob is configured to transfer energy from a received LF signal to the evaluation means and to the encoding means, for example by providing an electronic circuit for storing electric energy.
In a further aspect, the current application discloses a method for determining the presence of a relay attack in a passive entry system. The method comprises receiving an encoded ultra-wideband signal, decoding the encoded ultra- wideband signal, deriving a first signal strength value of a first low frequency signal from the encoded ultra-wideband signal, and deriving a first key fob distance measure from the first signal strength value.
Furthermore, the method comprises receiving an ultra-wideban measurement signal, deriving a time of arrival of the ultra- wideband measurement signal and deriving a second key fob distance measure from the time of arrival. The ultra-wideban measurement signal may be different from the encoded ultra- wideband signal or it may be the same as the encoded ultra- wideband signal. In the first case, the ultra-wideband measurement signal corresponds to a measurement request signal that is sent out from an ultra-wideband antenna of the car and reflected or retransmitted by an ultra-wideband antenna of a key fob, wherein retransmission also includes the trans mission of a corresponding measurement response signal.
The method further comprises comparing the first key fob dis tance measure with the second key fob distance measure, and determining a distance mismatch between the first key fob distance measure and the second key fob distance measure. Furthermore, the present specification discloses a computer program for executing the abovementioned method and an electronic component which is operative to execute the method according to claim 14. In particular, the electronic component may comprise the abovementioned computer program, or portions of it, in a computer readable storage medium.
A PASE systems according to the present specification makes use of low range low frequency signals for communication between the car and a key fob. According to an ITU designation, a frequency range for LF radio waves extends from 30 to 300 kHz. A passive entry/passive start system uses the LF signals to detect a location of the key fob. It detects if the key is near the vehicle, and, if the system is not only a passive entry but also a passive start system, the system, it also detects if the key fob is inside or outside the vehicle.
According to type of PASE systems according to the specification, the key fob measures an LF signal level (RSSI) during the communication with the vehicle. It acquires the RSSI and sends it back to the vehicle, which analyzes the RSSI to determine the fob's position. The received signal strength indicator (RSSI) may be derived from a signal in the intermediate frequency (IF) stage before the IF amplifier.
In an embodiment comprising a zero-IF system, the RSSI is derived from a signal in the baseband signal chain, before the baseband amplifier. RSSI output is often provided as DC analog levels. The RSSI output can also be sampled by an internal ADC. Thereby, the resulting codes can be made available in digital form via a peripheral or via an internal processor bus. In order to increase the positioning accuracy, a key fob may use three discrete antenna coils or one 3D-coil to determine the field intensities in the x-, y- and z-axes.
According to one particular embodiment, a UWB radio transmission is pulse-based and uses a pulse-position or time- modulation. One of the modulation methods currently used for UWB radio signal is OFDM (orthogonal frequency division multiplexing) .
UWB systems can achieve a high bandwidth by transmitting an impulse-like waveform. Such waveforms are inherently broadband. This property can be demonstrated mathematically by representing the impulse-like waveform by a product of a signal function with a window function and computing a Fourier transform thereof. For example, the product of a sine function with a rectangular window becomes the convolution of a delta distribution with a sinc-function, which yields a sinc- function that contains arbitrary high frequencies.
According to the present specification, the pulses of a UWB signal may be used to estimate a distance between a transmitter and a receiver, once a sending time of the transmitter is known to the receiver. This can be achieved by synchronizing the transmitter with the receiver with high accuracy or by using a two-way time of flight (TW-TF) method. According to a TW-TF method, a time of flight is obtained by subtracting antenna delays at the transmitter and at the receiver from a signal response time. The distance can then be calculated by multiplying the speed of light with the time of flight.
By way of example, an UWB centre frequency of 5 GHz corre- sponds to a wavelength of 6 cm. Thus , an UWB ranging applica- tion can have an approximate resolution in the cm range . One oscillation at this frequency lasts 2 x 10Λ(-10) seconds or 200 picoseconds. Therefore, it is desirable for an UWB rang ing application to provide a clock with an accuracy of the order of picoseconds . A typical operating range of an UWB ranging system is in the range of several hundred meters.
Depending on the transmission power, the required and the objects in between the car and the key fob, a range of the UWB distance measurement may extend up to 100 meters, 300 meters or even up to 1000 meters. Furthermore, the use of ultra- wideband signals can provide robustness against multipath effects, interference and jamming attempts.
The subject of present specification is now explained in further detail with respect to the following Figures in which
Figure 1 shows a passive entry system using a time of flight
UWB distance measurement to a key fob and a corresponding relay attack scenario,
Figure 2 shows a second embodiment of a passive entry system using a time distance of arrival UWB distance measurement,
Figure 3 illustrates a distance computation according to the embodiment of Fig. 2, and
Figure 4 shows a method of determining a distance mismatch according to the embodiment of Fig. 1.
In the following description, details are provided to de- scribe the embodiments of the present specification. It shall be apparent to one skilled in the art, however, that the em- bodiments may be practised wi .hout such details. Figure 1 shows a passive entry system 10. The passive entry system comprises low frequency antennas 8, 9, 11, an ultra- wideband receiver 12 in a passenger car 13 and an electronic key or key fob 14, which also referred to as smart key 14.
The key fob 14 comprises components that provide a passive entry and start functionality. The components of the key fob 14, which are not shown in Figs. 1 - 2, comprise a computation unit, a transceiver and an antenna. Furthermore, the key fob 14 comprises remote control buttons 15 for the manual activation of start and entry and other functions.
The key fob 14 takes the energy for generating a response signal from the electromagnetic field energy of the incoming signals and/or from a battery, which is provided in the key fob 14. In particular, the LF communication of the key fob 14 can be provided by a passive LF RFID component, which har- nesses the energy of the received electrical field.
Furthermore, Fig. 1 illustrates the operation of the passive entry system 10 during a relay attack.
An intruder or a team of intruders performs a relay attack through the use of a paired set of radio devices . These are used to capture the signals emitted by the vehicle and the replies from the Smart Key, and extend their range so that the key and the vehicle believe that they are within the authorised operation area.
If a relay attack is successful, the thief or "intruder" is able to enter the vehicle and start the engine, disarming the onboard security without having the original key and without alerting the owner of the vehicle. Relay attacks can typical- ly operate over a range of 100 to 1,000 metres, depending on the equipment used and on the environmental conditions.
In Fig. 1, the first radio device of the set of paired radio devices is referred to as transceiver 20 or "intruder's transceiver 1" and the second radio device of the set of paired radio devices is referred to as transceiver 21 or "intruder's transceiver 2". The first transceiver 20 comprises an LF antenna coil 26 for picking up the LF signal of the car 13 more easily.
According to the relay attack intrusion scenario, a first intruder 23 positions himself and the coil 26 of the first transceiver 20 next to a car door and is ready to open the car's door. A second intruder 24 places himself and the second transceiver 21 next to the car owner 25. For example, the second intruder 24 may be sitting next to the car owner 25, which is sitting in a cafeteria next to a car park and sipping a coffee .
The cars' electronic causes the LF antenna 11 to transmit request signals, either permanently or in response to a wake-up signal, which is caused by the first intruder 23. The wake-up signal may be generated when a person approaches the car door or the door handle or tries to pull the door handle.
The first intruder 23 uses the LF coil to pick up the request signals of the car 13. This step is labelled as "LF from car" in Fig. 1. The transceiver 20 of the first intruder transforms the received LF signal into a RF signal and transmits it to the second transceiver 21 via a private channel. This procedure is also referred to as "relaying" the signal over the private channel. second transceiver 21 of the second intruder receives the signals over the private channel and transforms them back LF signals . This step is labelled as "LF relayed to fob" Fig. 1.
If the second intruder 24 places the second transceiver 21 sufficiently close the key fob 14, the key fob 14 receives the LF request signals from the second transceiver 21 and processes them in the same way as a request signal that it would have received directly from the car 13.
After receiving the LF request signal, the key fob 14 measures the signal strength of the received LF signal and sends back a UWB response signal in which the signal strength of the received LF signal is encoded. In particular, the key fob 14 may encode the signal strength as an RSSI level.
The UWB receiver 12 receives the UWB response signal. A car electronic, which is connected to the UWB receiver 12, decodes the RSSI signal strength and derives a first distance between the car 13 and the key fob 14 from the RSSI signal strength, which is encoded in the received signal.
The car electronic, which is not shown in Fig. 1, comprises, among others, a motor control unit (MCU) and a vehicle control unit (VCU) . The cars' sensors and the car electronic ar electrically connected, for example using a special purpose data bus such as the CAN bus, the FlexRay bus or others. In addition, a special purpose computation unit may be provided for handling the signals of the passive entry system 10. Furthermore, an evaluation unit performs a two-way time of flight measurement and derives a second distance between the car 13 and the key fob 14 using the UWB response signal of the key fob 14. The evaluation unit compares the first and the second distance and determines if there is a distance mismatch .
According to the present specification, an evaluation unit with a computation unit is provided for the receiving, processing and sending out ultra-wideband signals of an ultra- wideband transceiver of the car 13. The evaluation unit may be provided as a separate electronic component, which is connected to the car electronics, or it may be integrated into a component of the car electronics, such as the vehicle control unit. The evaluation unit may furthermore be capable of receiving, processing and sending low frequency signals of a low frequency transceiver of the car 13.
According to one embodiment, the car electronic performs the UWB two-way time of flight measurement after it has received a response signal from the key fob 14 and only releases the doors if it receives a response from the UWB measurement and if there is no distance mismatch.
According to another embodiment, the car electronic performs the two-way time of flight measurement already before it receives a response signal of the key fob 14, for example after sending an LF signal or after detecting the presence of a person next to the door. In this case, the car electronics may send an UWB alert signal to the key fob 14 and in response the key fob does not generate response signals . More specifically, the car electronic performs a two-way time of flight measurement according to the following steps. The car electronic sends an impulse-like UWB request signal via the UWB transceiver 12. If the key fob 14 is within a UWB signal range, the key fob 14 receives the UWB request signal, generates a corresponding UWB response signal and transmits it back to the UWB receiver 12. In particular, the key fob 14 may reflect the signal by some suitable mechanism or it may first amplify the received signal and then send it back. In Fig. 1, these steps are labelled as step 5, "UWB measurement request" and step 6, "UWB measurement response", respective- ly.
The ultra-wideband (UWB) signal which is send from the car 13 and which is used for measuring a distance between the car 13 and the key fob 14 is also referred as "measurement request signal" and the signal that the car 13 receives from the key fob 14 in response to the measurement request signal is also referred to as measurement signal or measurement response signal .
The car electronic uses a high accuracy clock to determine a time interval between sending the UWB request signal and the UWB response signal. It derives a time of flight from the time interval taking into account antenna delays and delays of the electronics in the key fob 14 and in the UWB transceiver 12. In a next step, the car electronic derives a distance between the car 13 and the key fob 14 from the time of flight .
According to one embodiment, the car electronic and/or the electronic of the key fob 14 determine a leading edge of the received signal, which corresponds to a direct path between the car 13 and the key fob 1 . The signals that have not travelled along the direct path arrive after the leading edge of the response signal.
The car electronic of the car 13 and the key fob 14 perform an authentication procedure. Among others, the key authentication may use the LF radio link, an RF radio link or the UWB radio link or a combination thereof. The authentication may comprise only one roundtrip of signals from the car 13 to the key fob 14 and back to the car 13, as shown in Fig. 1, or more. By way of example, a key authentication may be performed in one of the following ways.
According to a uni-directional authentication, the vehicle 13 generates a random number, which is also referred to as Nonce, and transmits it as challenge to the key fob 14. The key fob 14 encrypts the challenge and sends it as response to the vehicle 13. The vehicle 13 also encrypts the Nonce. If the encrypted Nonce and the received response are identical, the key fob 14 is authenticated and the door is unlocked.
According to a bi-directional authentication, the key fob 14 authenticates the vehicle 13 before replying, and in a second step, the vehicle authenticates the fob. Both steps use different secret keys. The vehicle 13 generates a Nonce, encrypts it using a first secret key to obtain the Nonce, and sends both to the key fob 14 together with a command to indicate that bidirectional authentication is used. The key fob 14 encrypts the Nonce with the first secret key and compares it to the Nonce.
If both Nonces are identical the vehicle 13 is authenticated to the key fob 14. Then, the key fob 14 encrypts this first encryption result by using the second secret key, and sends it as response to the vehicle 13. The vehicle 13 performs the same procedure and compares its own result with the received response. If these are identical, the fob 14 also is authenticated to the vehicle 13, and the doors unlock or the vehicle 13 starts.
Fig. 2 shows a second embodiment of a passive entry system 10' which is similar to the first embodiment shown in Fig. 1. Different from the first embodiment, the passive entry system 10' comprises at least three UWB receivers for performing a distance measurement according to a time difference of arrival method.
According to the time distance of arrival method, the re- sponse signal of the key fob 14 to ' the LF request signal can be used to determine the distance of the key fob 1 4 to the car 13 and a further roundtrip of UWB signals, sueh as the signal roundtrip labelied as "5. " and " 6. " in Fig . 1, is not required .
After the key fob 14 has send out a response signal to the LF request signal, a first wavefront 4a of the response signal reaches the first UWB receiver 12 after a time t, a second wavefront 4b reaches the second UWB receiver 30 after a time t + At 1, and a third wavefront reaches the third UWB receiver 13 after a time t + At 2.
Fig. 3 shows, by way of example the locus of possible key fob locations for the given delay At 1 and At 2 of Fig. 2 in a measurement plane. For a given delay At 1 between receiving times of the first UWB receiver 12 and the second UWB receiver 30, the possible locations of the key fob 14 lie on a first hyperbola 32 or on a second hyperbola 33. Similar, for a given delay At 2 between receiving times of the first UWB receiver 12 and the second UWB receiver 30, the possible locations of the key fob 14 lie on a first hyperbola 34 or on a second hyperbola 35.
The car electronic computes the location of the key fob 14 as the intersection of one of the hyperbolae 32, 33 with one of the hyperbolae 34, 35. In the example of Fig. 3, the key fob is at the intersection of hyperbola 34 with hyperbola 32.
The time distance of arrival method also provides information about the location of the key fob 14 in addition to providing the distance of the key fob 14. The computation is similar, when the receivers are not arranged in one line or when there are more than three receivers .
Fig. 4 shows a method of determining a distance mismatch according to the embodiment of Fig. 1. The sequence of the method steps may be different from the sequence of Fig. 1 without departing from the scope of the present specification. For example, the UWB distance measurement of steps 51 to 55 may be performed before receiving the UWB response signal in step 48.
In a step 40, a LF transceiver, which is connected to the LF antenna 11, wakes up from a battery-conserving sleep mode. In a step 41, the LF transceiver transmits low frequency request signals, which comprise authentification information of the car 13, such as a NONCE, an encrypted value, an encrypted ID etc . In a step 43, a LF antenna of the key fob 14 receives the LF request signal of the car and, in a step 44, an electronic component of the key fob 14, such as an integrated circuit, measures the LF signal strength and, in a step 45, converts it into an RSSI value. In a step 45, the electronic component of the key fob 14 encodes the RSSI value in a digital signal, modulates the digital signal onto a UWB response signal and, in a step 47, sends out the UWB response signal using a broadband antenna, which is integrated in the key fob. In particular, the broadband antenna may be realized by a suitably shaped copper plating of a circuit board or other carrier substance .
In a step 48, the UWB transceiver of the car 13 receives the UWB signal from the UWB antenna or UWB receiver 12 and, in a step 49, and evaluation unit of the UWB transceiver or an evaluation unit connected to the UWB transceiver decodes the UWB signal and reads out the previously encoded RSSI value, which was determined by the key fob 14.
In a step 51, the evaluation unit causes the UWB transceiver of the car 13 to send out a UWB measurement signal for measuring a distance between the UWB receiver 12 and the key fob 14. In a step 52, the key fob receives the UWB measurement signal and retransmits the UWB measurement signal, or a response signal to the UWB measurement signal in a step 53. The step 53 may simply comprise a step of reflecting the received signal back or it may comprise steps of amplifying the response signal or of generating a response signal. For example, according to one embodiment the key fob 14 comprises electronic means to concentrate a signal, which is spread out in time due to multi path effects to generate a response sig- nal or to use the energy of the received signal to generate a response signal.
In a step 54, the UWB receiver 12 receives the UWB measurement response signal of the key fob 14, determines a time of arrival of the received signal and derives a time of flight or time of travel of the signal. In a step 55, the evaluation unit of the car 13 derives a second distance from the time of flight, and, in a step 56, the evaluation unit compares the first and the second distance and determines if there is a distance mismatch.
In a passive entry system according to the present specification, an RSSI value of a low frequency signal is compared to a distance value from a distance measurement via an UWB signal. In particular, the passive entry system can be configured such that only a valid combination of the LF RSSI value and the UWB distance value will trigger the unlocking and/or the starting of the vehicle. The LF RSSI value may be used for signal from only one LF antenna of the car, from multiple LF antennas or from all LF antennas.
The following listing summarizes the behaviour of a passive entry system according to the present specification and dif- ferent method for detecting a relay attack according to the present specification.
1. Detection with a first check only
1.1 No relay attack
i) LF power from vehicle: normal
ii) RSSI response from fob: normal
iii) UWB flight time: normal
iv) detection of relay attack: no attack detected 1.2 relay attack using a transceiver with fixed/variable LF power transmit
i) LF power from vehicle: normal
ii) RSSI response from fob:
Depending on the sending power of the intruders' second transceiver, the LF power may be a) higher than expected or b) normal or c) lower than expected.
iii) UWB flight time: will in general be higher than expect and, furthermore, it will in general not match to the RSSI value .
iv) detection of relay attack:
a) based on pre-defined thresholds for RSSI (LF) vs. UWB flight time matching, a relay attack can be detected.
2. Detection using an optional second check
2.1 no relay attack
i) LF power from vehicle: normal
ii) RSSI response from fob: will in general differ from the first check because the car owner is moving around and the distance and orientation of the key fob antenna changes iii) UWB flight time: normal
iv) detection of relay attack: no attack detected
2.2 relay attack using a transceiver with fixed/variable LF power transmit
i) LF power from vehicle: normal
ii) RSSI response from fob:
Depending on the sending power of the intruders' second transceiver, the LF power may be a) higher than expected or b) normal or c) lower than expected. iii) UWB flight time: will in general be higher than expected and, furthermore, it will in general not match to the RSSI value .
iv) detection of relay attack:
a) based on pre-defined thresholds for RSSI (LF) vs. UWB flight time matching, a relay attack can be detected.
b) In addition, the RSSI values of the first and second check can be compared. The coil of the intruders' first transceiver of the intruders is typically larger and is not moved around. Therefore, it is a further indication of a relay attack if the RSSI values do not change or change only very little.
The second check needs a further signal round trip. Thus, the signal round trip, which is indicated by the numbers 1, 2, 3 and 4 next to the arrows of Fig. 1, needs to be repeated after a pre-determined time.
The embodiments of the present specification can also be described with the following lists of elements being organized into items. The respective combinations of features which ar disclosed in the item list are regarded as independent subject matter, respectively, that can also be combined with other features of the application.
An evaluation unit for a passive entry system of a car, the evaluation unit comprising
a connection port for receiving signals from an ultra- wideband transceiver and for transmitting signals to the ultra-wideband transceiver,
a computation unit, the computation unit being operative to receive an encoded ultra-wideband signal from the connection port, to decode the encoded ultra-wideband signal, to derive a first signal strength value of a first low frequency signal from the encoded ultra- wideband signal and to derive a first key fob distance measure from the first signal strength value,
the computation unit being operative to receive an ultra-wideband measurement signal from the connection port, to derive a time of arrival of the ultra-wideband measurement signal, and to derive a second key fob distance measure from the time of arrival,
and the computation unit being operative to compare the first key fob distance measure with the second key fob distance measure and to determine a distance mismatch between the first key fob distance measure and the second key fob distance measure.
The evaluation unit according to item 1, wherein the computation unit is operative to derive the time of arrival of the ultra-wideband measurement signal from a signal shape of the ultra-wideband measurement signal.
The evaluation unit according to item 1 or item 2, the evaluation unit being operative to send an ultra- wideband measurement request signal,
to compute a time difference between a time of sending the ultra-wideband measurement request signal and a time of arrival of the ultra-wideband measurement signal and to derive a time of flight from the time difference.
The evaluation unit according to one of the items 1 to 3, wherein the computation unit is operative to receive a second encoded ultra-wideband signal, to decode the second encoded ultra-wideband signal, to derive a second signal strength value of a second low frequency signal from the second encoded ultra-wideband signal and to de- rive a third key fob distance measure from the second signal strength value,
wherein the second encoded ultra-wideband signal is received at a later time than the first encoded ultra- wideband signal and wherein the second low frequency signal is send at a later time than the first low frequency signal,
the computation unit being further operative to
compare the first key fob distance measure with the third distance measure and to determine if there is a distance mismatch between the third key fob distance measure and the first key fob distance measure.
The evaluation unit according to one of the preceding items, wherein the computation unit is operative to receive a first measurement signal from a first ultra- wideband antenna to receive a second measurement signal from a second ultra-wideband antenna, and to receive a third measurement signal from a third ultra-wideband an tenna, wherein the first, second and third measurement signals correspond to wave fronts of the same electromagnetic signal, the computation unit further being operative to compute a key fob distance measure from time differences of arrival between the first, second and third measurement signals.
A passive entry system for a passenger car comprising a low frequency transceiver for transmitting a low frequency signal,
an ultra-wideband transceiver, the ultra-wideband transceiver being connected to the connection port of the evaluation unit according to one of the preceding items . The passive entry system according to item 6, the passive entry system comprising a key fob, the key fob comprising
- a low frequency transceiver,
- an ultra-wideband transceiver,
- evaluation means for determining a signal strength value of a received LF signal,
- encoding means for encoding the signal strength value in a digital signal,
- modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver.
A car with a passive entry system according to item 6 o item 7, the car comprising a low frequency transceiver with a low frequency antenna, the low frequency antenna being provided at a door of the car, and wherein a command line of the passive entry system is connected to a lock of the door, and wherein the passive key entry sys tern is operative to unlock the lock if the computation unit in response to an unlock signal of the evaluation unit .
The car according to item 8, wherein the evaluation unit sends the unlock signal if the evaluation unit determines that there is no mismatch between the first key fob distance measure and the second key fob distance measure .
The car according to item 8 or item 9, wherein the low frequency antenna is provided at a driver door, and wherein the low frequency transceiver comprises a secori' low frequency antenna and a third low frequency antenna, wherein the second low frequency antenna is provided at a second door and wherein the third low frequency antenna is provided at a boot door of the car.
A key fob for a passive entry system of a car, the key fob comprising
- a low frequency transceiver,
- an ultra-wideband transceiver,
- evaluation means for determining a signal strength value of a received LF signal,
- encoding means for encoding the signal strength value in a digital signal,
- modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver. The key fob of item 9, comprising
means for receiving and retransmitting a UWB distance measurement signal.
The key fob of item 9 or item 10, the key fob being configured to transfer energy from a received low frequency signal to the evaluation means and to the encoding means . A method for determining the presence of a relay attack in a passive entry system, comprising
receiving an encoded ultra-wideband signal,
decoding the encoded ultra-wideband signal,
deriving a first signal strength value of a first low frequency signal from the encoded ultra-wideband signal, deriving a first key fob distance measure from the first signal strength value,
receiving an ultra-wideband measurement signal,
deriving a time of arrival of the ultra-wideband measurement signal,
deriving a second key fob distance measure from the time of arrival,
comparing the first key fob distance measure with the second key fob distance measure, and
determining a distance mismatch between the first key fob distance measure and the second key fob distance measure . A computer program for executing the method according to item 14. An electronic component which is operative to execute the method according to item 1 .

Claims

1. An evaluation unit for a passive entry system of a car, the evaluation unit comprising
a connection port for receiving signals from an ultra- wideband transceiver and for transmitting signals to the ultra-wideband transceiver,
a computation unit, the computation unit being operative to receive an encoded ultra-wideband signal from the connection port, to decode the encoded ultra-wideband signal, to derive a first signal strength value of a first low frequency signal from the encoded ultra- wideband signal and to derive a first key fob distance measure from the first signal strength value,
the computation unit being operative to receive an ultra-wideband measurement signal from the connection port, to derive a time of arrival of the ultra-wideband measurement signal, and to derive a second key fob distance measure from the time of arrival,
and the computation unit being operative to compare the first key fob distance measure with the second key fob distance measure and to determine a distance mismatch between the first key fob distance measure and the second key fob distance measure.
2. The evaluation unit according to claim 1, wherein the computation unit is operative to derive the time of arrival of the ultra-wideband measurement signal from a signal shape of the ultra-wideband measurement signal.
3. The evaluation unit according to claim 1, the evaluation unit being operative to send an ultra-wideband measurement request signal, to compute a time difference between a time of sending the ultra-wideband measurement request signal and a time of arrival of the ultra-wideband measurement signal and to derive a time of flight from the time difference.
The evaluation unit according to claim 1, wherein the computation unit is operative to receive a second encod ed ultra-wideband signal, to decode the second encoded ultra-wideband signal, to derive a second signal strength value of a second low frequency signal from th second encoded ultra-wideband signal and to derive a third key fob distance measure from the second signal strength value,
wherein the second encoded ultra-wideband signal is received at a later time than the first encoded ultra- wideband signal and wherein the second low frequency signal is send at a later time than the first low frequency signal,
the computation unit being further operative to
compare the first key fob distance measure with the third distance measure and to determine if there is a distance mismatch between the third key fob distance measure and the first key fob distance measure. The evaluation unit according to claim 1, wherein the computation unit is operative to receive a first measurement signal from a first ultra-wideband antenna to receive a second measurement signal from a second ultra- wideband antenna, and to receive a third measurement signal from a third ultra-wideband antenna, wherein the first, second and third measurement signals correspond to wave fronts of the same electromagnetic signal, the computation unit further being operative to compute a key fob distance measure from time differences of arrival between the first, second and third measurement signals .
A passive entry system for a passenger car comprising a low frequency transceiver for transmitting a low frequency signal,
an ultra-wideband transceiver, the ultra-wideband transceiver being connected to the connection port of the evaluation unit of claim 1.
The passive entry system according to claim 6, the passive entry system comprising a key fob, the key fob comprising
- a low frequency transceiver,
- an ultra-wideband transceiver,
- evaluation means for determining a signal strength value of a received LF signal,
- encoding means for encoding the signal strength value in a digital signal,
- modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver.
A car with a passive entry system according to claim 6, the car comprising a low frequency transceiver with a low frequency antenna, the low frequency antenna being provided at a door of the car, and wherein a command line of the passive entry system is connected to a lock of the door, and wherein the passive key entry system i operative to unlock the lock if the computation unit in response to an unlock signal of the evaluation unit. The car according to claim 8, wherein the evaluation unit sends the unlock signal if the evaluation unit determines that there is no mismatch between the first key fob distance measure and the second key fob distance measure .
The car according to claim 8, wherein the low frequency antenna is provided at a driver door, and wherein the low frequency transceiver comprises a second low frequency antenna and a third low frequency antenna, wherein the second low frequency antenna is provided at a second door and wherein the third low frequency antenna is provided at a boot door of the car.
A key fob for a passive entry system of a car, the key fob comprising
- a low frequency transceiver,
- an ultra-wideband transceiver,
- evaluation means for determining a signal strength value of a received LF signal,
- encoding means for encoding the signal strength value in a digital signal,
- modulation means for modulating the digital signal onto an UWB signal and for transmitting the UWB signal via the UWB transceiver.
The key fob of claim 9, comprising
means for receiving and retransmitting a UWB distance measurement signal.
The key fob of claim 9, the key fob being configured to transfer energy from a received low frequency signal to the evaluation means and to the encoding means. A method for determining the presence of a relay attack in a passive entry system, comprising
receiving an encoded ultra-wideband signal,
decoding the encoded ultra-wideband signal,
deriving a first signal strength value of a first low frequency signal from the encoded ultra-wideband signal, deriving a first key fob distance measure from the first signal strength value,
receiving an ultra-wideband measurement signal,
deriving a time of arrival of the ultra-wideband measurement signal,
deriving a second key fob distance measure from the time of arrival,
comparing the first key fob distance measure with the second key fob distance measure, and
determining a distance mismatch between the first key fob distance measure and the second key fob distance measure .
A computer program for executing the method according to claim 14.
An electronic component which is operative to execute the method according to claim 14.
PCT/IB2014/065327 2014-10-15 2014-10-15 Method and system for detecting relay attack for pase system WO2016059451A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/IB2014/065327 WO2016059451A1 (en) 2014-10-15 2014-10-15 Method and system for detecting relay attack for pase system
DE112014006819.5T DE112014006819B4 (en) 2014-10-15 2014-10-15 METHOD AND SYSTEM FOR DETECTING RAILWAY ATTACKS FOR A PASSIVE ACCESS SYSTEM

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/IB2014/065327 WO2016059451A1 (en) 2014-10-15 2014-10-15 Method and system for detecting relay attack for pase system

Publications (1)

Publication Number Publication Date
WO2016059451A1 true WO2016059451A1 (en) 2016-04-21

Family

ID=55746182

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/IB2014/065327 WO2016059451A1 (en) 2014-10-15 2014-10-15 Method and system for detecting relay attack for pase system

Country Status (2)

Country Link
DE (1) DE112014006819B4 (en)
WO (1) WO2016059451A1 (en)

Cited By (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018006096A1 (en) * 2016-07-01 2018-01-04 Texas Instruments Incorporated Relay-attack resistant communications
WO2018066337A1 (en) * 2016-10-04 2018-04-12 株式会社東海理化電機製作所 Wireless communication normality determination system
CN108016401A (en) * 2016-10-28 2018-05-11 丰田自动车株式会社 Vehicle control system and controller of vehicle
DE102016223788A1 (en) * 2016-11-30 2018-05-30 Bayerische Motoren Werke Aktiengesellschaft System and method for remote control of a vehicle
EP3335942A1 (en) * 2016-12-14 2018-06-20 Nxp B.V. Secure vehicle access system, key, vehicle and method therefor
DE102017201960A1 (en) 2017-02-08 2018-08-09 Bayerische Motoren Werke Aktiengesellschaft Method and device for securing a vehicle access system for a motor vehicle
DE102017206008A1 (en) * 2017-04-07 2018-10-11 Bayerische Motoren Werke Aktiengesellschaft Key device, authentication device, authentication system, method for releasing a vehicle and computer-readable storage medium
EP3396640A1 (en) * 2017-04-28 2018-10-31 HUF Hülsbeck & Fürst GmbH & Co. KG Portable id transmitter for an authentication system and method for operating an authentication system
CN109478353A (en) * 2016-07-29 2019-03-15 法国大陆汽车公司 The method for defending the attack relaying movement in relation to function present in long-range activation motor vehicles
CN109466506A (en) * 2018-09-18 2019-03-15 广东远峰汽车电子有限公司 Vehicle key-free control system and method based on more bluetooth signal intensities
CN109690636A (en) * 2016-08-24 2019-04-26 奥迪股份公司 For remote-control key-interlock of motor vehicle, motor vehicle and the method for running interlock
US10275964B2 (en) 2017-04-28 2019-04-30 Huf Huelsbeck & Fuerst Gmbh & Co. Kg Portable ID-transmitter for an authentication system and an authentication operating system for use therewith
GB2572674A (en) * 2018-02-08 2019-10-09 Ford Global Tech Llc Mobile device relay attack detection and power management for vehicles
WO2019238789A1 (en) * 2018-06-14 2019-12-19 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. Method for determining a relay attack, relay attack detecting device, and computer program
EP3605476A1 (en) * 2018-08-01 2020-02-05 Nxp B.V. Wireless receiver and method for detecting an attack on a keyless entry system for a vehicle
US10573104B2 (en) 2018-06-29 2020-02-25 Robert Bosch Gmbh Ultra-wideband based vehicle access system and communication protocol for localization of a target device
JP2020063022A (en) * 2018-10-19 2020-04-23 住友電装株式会社 On-vehicle control device, on-vehicle control method and computer program
JP2020118030A (en) * 2020-04-13 2020-08-06 株式会社東海理化電機製作所 Electronic key system
RU2730683C1 (en) * 2019-04-10 2020-08-25 Тойота Дзидося Кабусики Кайся Communication device, communication system and method of communication
WO2021002647A1 (en) * 2019-07-01 2021-01-07 Samsung Electronics Co., Ltd. Electronic device for performing ranging and method thereof
WO2021010659A1 (en) * 2019-07-12 2021-01-21 Samsung Electronics Co., Ltd. Electronic device for performing ranging by using ultra-wideband in wireless communication system, and method of operating the electronic device
KR20210020118A (en) * 2018-06-21 2021-02-23 폭스바겐 악티엔게젤샤프트 Method for calibrating a wireless-based keyless access system in an automobile, access system and automobile
GB2587323A (en) * 2019-08-22 2021-03-31 Ncc Group Security Services Ltd Computer-Implemented system and method
JP2021516347A (en) * 2018-03-28 2021-07-01 デンソー インターナショナル アメリカ インコーポレーテッド Reflective environment detection system and method
US11055941B1 (en) 2020-03-31 2021-07-06 Nxp B.V. System and method of improving security during backup functionality of electronic control key
WO2021148377A1 (en) * 2020-01-24 2021-07-29 Bundesdruckerei Gmbh Security against manipulation using device-specific tolerances
JP2021123202A (en) * 2020-02-04 2021-08-30 トヨタ自動車株式会社 Vehicle control device, vehicle control system, and vehicle control program
US11164409B2 (en) 2017-02-13 2021-11-02 Samsung Electronics Co., Ltd. Method and device for authenticating vehicle smart key
CN114026901A (en) * 2019-07-30 2022-02-08 ams传感器新加坡私人有限公司 Authenticating proximity by time-of-flight
US11277742B2 (en) 2017-04-28 2022-03-15 Huf Hülsbeck & Fürst Gmbh & Co. Kg Method for operating authentication system and authentication system
US11405784B2 (en) 2019-03-25 2022-08-02 Assa Abloy Ab Physical access control systems with localization-based intent detection
US11875209B2 (en) 2019-10-01 2024-01-16 Assa Abloy Ab Connection and service discovery for fine ranging applications
US11887416B2 (en) 2018-11-02 2024-01-30 Assa Abloy Ab Systems, methods, and devices for access control
US11900750B2 (en) 2019-03-25 2024-02-13 Assa Abloy Ab Ultra-wide band device for access control reader system
US11955723B2 (en) 2019-09-26 2024-04-09 Assa Abloy Ab Ultra-wide band antenna configuration for physical access control system
US11993226B2 (en) 2018-10-19 2024-05-28 Sumitomo Wiring Systems, Ltd. On-vehicle control device, on-vehicle control method and computer program

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102017215014B4 (en) 2017-06-23 2019-10-17 Volkswagen Aktiengesellschaft Activation of a vehicle action secured against relay station attack
EP3501916B1 (en) 2017-12-21 2021-05-05 Volkswagen Aktiengesellschaft Method for operating a radio monitoring system of a motor vehicle and monitoring system and tag unit for monitoring system
DE102019104096A1 (en) * 2019-02-19 2020-08-20 Huf Hülsbeck & Fürst Gmbh & Co. Kg Procedure for securing an authentication
DE102023205820B3 (en) 2023-06-21 2024-05-16 Continental Automotive Technologies GmbH Methods and devices for controlling access to a vehicle

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050024181A1 (en) * 2003-07-29 2005-02-03 Siemens Aktiengesellschaft Method and security apparatus for validating an authorization for locking and unlocking and/or using an object
US20080143500A1 (en) * 2006-12-15 2008-06-19 Riad Ghabra Method and apparatus for an anti-theft system against radio relay attack in passive keyless entry/start systems
US20100076622A1 (en) * 2008-09-23 2010-03-25 Lear Corporation System and method for detecting radio frequency signals and controlling vehicle operations in response thereto
JP2012062651A (en) * 2010-09-15 2012-03-29 Denso Corp Control system
US8587403B2 (en) * 2009-06-18 2013-11-19 Lear Corporation Method and system of determining and preventing relay attack for passive entry system

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE10212648B4 (en) 2002-03-21 2006-04-13 Siemens Ag Identification system for proving authorization for access to an object or the use of an object, in particular a motor vehicle
DE102005062455A1 (en) 2005-12-27 2007-07-05 Robert Bosch Gmbh Wireless authentication system for use of vehicle has wireless connection in ultra-broadband region of spectrum
US9679430B2 (en) 2013-03-08 2017-06-13 Lear Corporation Vehicle remote function system and method for determining vehicle FOB locations using adaptive filtering

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050024181A1 (en) * 2003-07-29 2005-02-03 Siemens Aktiengesellschaft Method and security apparatus for validating an authorization for locking and unlocking and/or using an object
US20080143500A1 (en) * 2006-12-15 2008-06-19 Riad Ghabra Method and apparatus for an anti-theft system against radio relay attack in passive keyless entry/start systems
US20100076622A1 (en) * 2008-09-23 2010-03-25 Lear Corporation System and method for detecting radio frequency signals and controlling vehicle operations in response thereto
US8587403B2 (en) * 2009-06-18 2013-11-19 Lear Corporation Method and system of determining and preventing relay attack for passive entry system
JP2012062651A (en) * 2010-09-15 2012-03-29 Denso Corp Control system

Cited By (63)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10897477B2 (en) 2016-07-01 2021-01-19 Texas Instruments Incorporated Relay-attack resistant communications
CN109641570A (en) * 2016-07-01 2019-04-16 德克萨斯仪器股份有限公司 Anti- relay attack communication
US11743283B2 (en) 2016-07-01 2023-08-29 Texas Instruments Incorporated Relay-attack resistant communications
EP3478542A4 (en) * 2016-07-01 2019-06-26 Texas Instruments Incorporated Relay-attack resistant communications
WO2018006096A1 (en) * 2016-07-01 2018-01-04 Texas Instruments Incorporated Relay-attack resistant communications
CN109478353A (en) * 2016-07-29 2019-03-15 法国大陆汽车公司 The method for defending the attack relaying movement in relation to function present in long-range activation motor vehicles
CN109690636A (en) * 2016-08-24 2019-04-26 奥迪股份公司 For remote-control key-interlock of motor vehicle, motor vehicle and the method for running interlock
JP2018059308A (en) * 2016-10-04 2018-04-12 株式会社東海理化電機製作所 Wireless communication authenticity determination system
WO2018066337A1 (en) * 2016-10-04 2018-04-12 株式会社東海理化電機製作所 Wireless communication normality determination system
CN108016401B (en) * 2016-10-28 2020-12-22 丰田自动车株式会社 Vehicle control system and vehicle control device
CN108016401A (en) * 2016-10-28 2018-05-11 丰田自动车株式会社 Vehicle control system and controller of vehicle
DE102016223788A1 (en) * 2016-11-30 2018-05-30 Bayerische Motoren Werke Aktiengesellschaft System and method for remote control of a vehicle
EP3335942A1 (en) * 2016-12-14 2018-06-20 Nxp B.V. Secure vehicle access system, key, vehicle and method therefor
US10239494B2 (en) 2016-12-14 2019-03-26 Nxp B.V. Secure vehicle access system, key, vehicle and method therefor
DE102017201960A1 (en) 2017-02-08 2018-08-09 Bayerische Motoren Werke Aktiengesellschaft Method and device for securing a vehicle access system for a motor vehicle
US11164409B2 (en) 2017-02-13 2021-11-02 Samsung Electronics Co., Ltd. Method and device for authenticating vehicle smart key
DE102017206008A1 (en) * 2017-04-07 2018-10-11 Bayerische Motoren Werke Aktiengesellschaft Key device, authentication device, authentication system, method for releasing a vehicle and computer-readable storage medium
US10275964B2 (en) 2017-04-28 2019-04-30 Huf Huelsbeck & Fuerst Gmbh & Co. Kg Portable ID-transmitter for an authentication system and an authentication operating system for use therewith
US11277742B2 (en) 2017-04-28 2022-03-15 Huf Hülsbeck & Fürst Gmbh & Co. Kg Method for operating authentication system and authentication system
EP3396640A1 (en) * 2017-04-28 2018-10-31 HUF Hülsbeck & Fürst GmbH & Co. KG Portable id transmitter for an authentication system and method for operating an authentication system
GB2572674A (en) * 2018-02-08 2019-10-09 Ford Global Tech Llc Mobile device relay attack detection and power management for vehicles
JP2021516347A (en) * 2018-03-28 2021-07-01 デンソー インターナショナル アメリカ インコーポレーテッド Reflective environment detection system and method
WO2019238789A1 (en) * 2018-06-14 2019-12-19 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. Method for determining a relay attack, relay attack detecting device, and computer program
JP7142728B2 (en) 2018-06-14 2022-09-27 フラウンホーファー－ゲゼルシャフト・ツール・フェルデルング・デル・アンゲヴァンテン・フォルシュング・アインゲトラーゲネル・フェライン METHOD FOR DETERMINING RELAY ATTACK, RELAY ATTACK DETECTION DEVICE AND COMPUTER PROGRAM
US11348388B2 (en) 2018-06-14 2022-05-31 Fraunhofer-Gesellschaft Zur Foerderung Der Angewandten Forschung E.V. Method for determining a relay attack, relay attack detecting device, and computer program
JP2021528301A (en) * 2018-06-14 2021-10-21 フラウンホーファー−ゲゼルシャフト・ツール・フェルデルング・デル・アンゲヴァンテン・フォルシュング・アインゲトラーゲネル・フェライン How to determine relay attack, relay attack detector and computer program
US20210150836A1 (en) * 2018-06-21 2021-05-20 Volkswagen Aktiengesellschaft Method for calibrating a radio-based keyless access system of a motor vehicle, access system, and motor vehicle
KR102525825B1 (en) 2018-06-21 2023-04-25 폭스바겐 악티엔게젤샤프트 Method for calibrating radio-based keyless access system in automobile, access system and automobile
KR20210020118A (en) * 2018-06-21 2021-02-23 폭스바겐 악티엔게젤샤프트 Method for calibrating a wireless-based keyless access system in an automobile, access system and automobile
US11455853B2 (en) 2018-06-21 2022-09-27 Volkswagen Aktiengesellschaft Method for calibrating a radio-based keyless access system of a motor vehicle, access system, and motor vehicle
US10573104B2 (en) 2018-06-29 2020-02-25 Robert Bosch Gmbh Ultra-wideband based vehicle access system and communication protocol for localization of a target device
EP3605476A1 (en) * 2018-08-01 2020-02-05 Nxp B.V. Wireless receiver and method for detecting an attack on a keyless entry system for a vehicle
US10629011B2 (en) 2018-08-01 2020-04-21 Nxp B.V. Wireless receiver and method for detecting an attack on a keyless entry system for a vehicle
CN109466506A (en) * 2018-09-18 2019-03-15 广东远峰汽车电子有限公司 Vehicle key-free control system and method based on more bluetooth signal intensities
CN109466506B (en) * 2018-09-18 2021-06-22 远峰科技股份有限公司 Vehicle keyless control system and method based on multiple Bluetooth signal strengths
WO2020080076A1 (en) * 2018-10-19 2020-04-23 住友電装株式会社 Vehicle-mounted control device, vehicle-mounted control method, and computer program
JP7125323B2 (en) 2018-10-19 2022-08-24 住友電装株式会社 VEHICLE CONTROL DEVICE, VEHICLE CONTROL METHOD AND COMPUTER PROGRAM
US11993226B2 (en) 2018-10-19 2024-05-28 Sumitomo Wiring Systems, Ltd. On-vehicle control device, on-vehicle control method and computer program
JP2020063022A (en) * 2018-10-19 2020-04-23 住友電装株式会社 On-vehicle control device, on-vehicle control method and computer program
US11887416B2 (en) 2018-11-02 2024-01-30 Assa Abloy Ab Systems, methods, and devices for access control
US11405784B2 (en) 2019-03-25 2022-08-02 Assa Abloy Ab Physical access control systems with localization-based intent detection
US11825292B2 (en) 2019-03-25 2023-11-21 Assa Abloy Ab Physical access control systems with localization-based intent detection
US11902784B2 (en) 2019-03-25 2024-02-13 Assa Abloy Ab Reader coordination for access control
US11928906B2 (en) 2019-03-25 2024-03-12 Assa Abloy Ab Ultra-wide band device for access control reader system
US11765588B2 (en) 2019-03-25 2023-09-19 Assa Abloy Ab Physical access control systems with localization-based intent detection
US11900750B2 (en) 2019-03-25 2024-02-13 Assa Abloy Ab Ultra-wide band device for access control reader system
US11770708B2 (en) 2019-03-25 2023-09-26 Assa Abloy Ab Physical access control systems with localization-based intent detection
RU2730683C1 (en) * 2019-04-10 2020-08-25 Тойота Дзидося Кабусики Кайся Communication device, communication system and method of communication
US11435462B2 (en) 2019-07-01 2022-09-06 Samsung Electronics Co., Ltd Electronic device for performing ranging and method thereof
WO2021002647A1 (en) * 2019-07-01 2021-01-07 Samsung Electronics Co., Ltd. Electronic device for performing ranging and method thereof
US11933874B2 (en) 2019-07-12 2024-03-19 Samsung Electronics Co., Ltd. Electronic device for performing ranging by using ultra-wideband in wireless communication system, and method of operating the electronic device
US11454714B2 (en) 2019-07-12 2022-09-27 Samsung Electronics Co., Ltd. Electronic device for performing ranging by using ultra-wideband in wireless communication system, and method of operating the electronic device
WO2021010659A1 (en) * 2019-07-12 2021-01-21 Samsung Electronics Co., Ltd. Electronic device for performing ranging by using ultra-wideband in wireless communication system, and method of operating the electronic device
CN114026901B (en) * 2019-07-30 2023-12-19 艾迈斯-欧司朗亚太私人有限公司 Authenticating proximity by time of flight
CN114026901A (en) * 2019-07-30 2022-02-08 ams传感器新加坡私人有限公司 Authenticating proximity by time-of-flight
GB2587323A (en) * 2019-08-22 2021-03-31 Ncc Group Security Services Ltd Computer-Implemented system and method
US11955723B2 (en) 2019-09-26 2024-04-09 Assa Abloy Ab Ultra-wide band antenna configuration for physical access control system
US11875209B2 (en) 2019-10-01 2024-01-16 Assa Abloy Ab Connection and service discovery for fine ranging applications
WO2021148377A1 (en) * 2020-01-24 2021-07-29 Bundesdruckerei Gmbh Security against manipulation using device-specific tolerances
JP7252150B2 (en) 2020-02-04 2023-04-04 トヨタ自動車株式会社 VEHICLE CONTROL DEVICE, VEHICLE CONTROL SYSTEM, AND VEHICLE CONTROL PROGRAM
JP2021123202A (en) * 2020-02-04 2021-08-30 トヨタ自動車株式会社 Vehicle control device, vehicle control system, and vehicle control program
US11055941B1 (en) 2020-03-31 2021-07-06 Nxp B.V. System and method of improving security during backup functionality of electronic control key
JP2020118030A (en) * 2020-04-13 2020-08-06 株式会社東海理化電機製作所 Electronic key system

Also Published As

Publication number Publication date
DE112014006819B4 (en) 2023-06-29
DE112014006819T5 (en) 2017-03-30

Similar Documents

Publication Publication Date Title
WO2016059451A1 (en) Method and system for detecting relay attack for pase system
US10906508B2 (en) Method for activating at least one security function of a security system of a vehicle
US11084460B2 (en) Method for activation of at least one security function of a security system of a vehicle
US11208074B2 (en) Vehicle electronic key system
US10902690B2 (en) Method for activating of at least one security function of a security system of a vehicle
US8930045B2 (en) Relay attack prevention for passive entry passive start (PEPS) vehicle security systems
WO2018079600A1 (en) Electronic key system
CN110719591B (en) Passive keyless entry system
Ranganathan et al. Are we really close? Verifying proximity in wireless systems
JP7009328B2 (en) Distance measurement system
EP2498226B1 (en) Field superposition system and method therefor
US7646283B2 (en) Wireless activation system, method and device
US20120139691A1 (en) System for preventing establishment of unauthorized communication
US20090206989A1 (en) Electronic communication system, in particular access control system for p(assive)k(eyless)e(ntry), as well as method for detecting a relay attack thereon
CN107920056B (en) Method and system for secure access to a determined space by means of a wearable object
WO2005114593A1 (en) Method and apparatus for determining distance to a radio transponder
JP2007335961A (en) Authentication system
CN109641570A (en) Anti- relay attack communication
JP2012144905A (en) Electronic key system
JP2014017603A (en) Propagation time measuring device
JP6396855B2 (en) Communication fraud prevention system
US6873248B2 (en) Identification system for confirming authorization for access to an object or the use of an object, in particular of a motor vehicle
US20210204136A1 (en) Relay station attack prevention
JP2016056667A (en) Electronic key system
JP2017007366A (en) Communication dishonest establishment prevention system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14903984

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 112014006819

Country of ref document: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14903984

Country of ref document: EP

Kind code of ref document: A1