AU783132B2 - A security system - Google Patents

Description

P \OPER\DBW\pq9682-O0 spe doc-I March, 2001 c -1- A Security System The present invention relates to a security system, and in particular to a passive security system for vehicles.

Current passive security systems for entry or activation of vehicles use a remote electronic key that incorporates a transmitter that transmits authentication data to a receiver located in the vehicle, when a transponder of the key is excited when the key is within a predetermined range from the receiver. The communications protocol executed between the transmitter and the receiver uses a radio frequency interface to carry the transmitted data, and any data sent from the vehicle to the key. The radio frequency (RF) interface has a limited range, to ensure the communication link is broken when the holder of the key moves away from the immediate vicinity of the vehicle.

Passive security systems are susceptible to attack from unauthorised persons using intercepting equipment, placed in the vicinity of the vehicle and the key. The equipment is used to excite the key, receive the transmissions sent by the key and relay the transmissions to the vehicle. The intercepting equipment, which is often referred to as a relay station, normally incorporates a receiver and an amplifier placed within range of the key to transmit the intercepted signal to a receiver and amplifier near the vehicle, in order to gain access to the vehicle.

The specifications of Australian Patent Applications 33933/99 and 42419/99, hereinafter referred to as "the two tone security system specifications" and incorporated by reference, describe security systems that can be used to circumvent or detect a relay station attack when the relay station uses a wide band amplifier to intercept signals transmitted between the key and the vehicle using a number of different RF frequency transmission channels.

The relay station is susceptible to detection by using a two tone test described in the two tone security system specifications.

P .\PERDBW 76313-01 z doc-29)06S -2- It is possible however that a relay station could use equipment which does not involve a wide band amplifier, but instead utilises separate receivers, filters and amplifiers for each transmission channel. The relay station may have separate transceiver stations each with a receiver and transmitter dedicated to each radio frequency channel in the frequency band that the passive security system operates in. The relay station would then not need to scan the frequency band of the security system to locate channels that are both being used for data and transponder spectral authentication. In this scenario, the two tone test cannot be used to detect the side band intermodulation produced by the intercepting wide band amplifier on mixing of the transmission channels. Accordingly, it is desired to provide a security system which can be used to circumvent this type of attack or at least provide a useful alternative.

In accordance with the present invention there is provided a security system including an electronic key having a transmitter and a secure object with a base station having a receiver, said transmitter and receiver being adapted to communicate to transmit authentication data, wherein: said key transmits said data in a message comprising parts having predetermined respective periods with transmission signal variations; and said base station detects distortion of said transmission signal variations by a relay S oo¢ station.

The present invention also provides a communication method executed by a security system including an electronic key having a transmitter and a secure object with a base station having a receiver, the method including: transmitting authentication data from the transmitter to the receiver, said data being ooo# transmitted in a message comprising parts having predetermined respective periods with transmission signal variations; and detecting at said base station distortion of said transmission signal variations by a relay station.

P:\OPER\DBW\pq96S2-00 spe doc-I March 2001 -3- A preferred embodiment of the present invention is hereinafter described, by way of example only, with reference to the accompanying drawings, wherein: Figure 1 is a schematic diagram of a preferred embodiment of a security system, with a relay station; Figure 2 is a block diagram of the security system; Figure 3 is a timing diagram for signals transmitted by the security system; Figure 4 is a diagram of a corrupted data signal; Figure 5 is a diagram of a frequency spectrum for two tone transmission of the system; and Figure 6 is a diagram of a frequency spectrum for data transmission of the system.

A passive security system, as shown in Figures 1 and 2, includes an electronic key 4 with a transmitter 6 and transmission antenna 7, a base station 8 with a receiver 10 and receiving antenna 12. The base station 8 is located in a secure area, such as a vehicle, and controls access to the secure area and/or starting of the vehicle. When the key 4 is brought within a predetermined range from the antenna 12 of the receiver 10, the receiver 10 excites a transponder of the key 4, so as to cause the transmitter 6 to begin transmission to the receiver 10. Data is transmitted using RF signals which establish a communications link between the key 4 and the base station 8. The data transmitted between the key 4 and the base station 8 is determined by a communications protocol which the key 4 and base station 8 adhere to, and which involves the transmission of authentication data from the key 4 to the receiver 10. Access to the secure area and/or starting of the vehicle is only allowed by the base station 8 if the transmitted authentication data corresponds with authentication data stored by the base station 8.

The key 4 and the base station 8 include a number of security features, such as those described in the two tone security system specifications. The components of the key 4 and the base station 8 are the same as that described in the two tone security system specifications, except the transmitter 6 of the key 4 and the receiver 10 of the base station 8 include additional filters with wider bandwidths, as described below, or programmable filters whose bandwidths can be adjusted. Also the control software in the key 4 and the base station 8 is adjusted so that the communications protocol is executed as described below with reference to Figure 3.

P:\OPER\DBW\pq9682-00 spe doc-l ach. 2001 -4- The key 4 includes a microcontroller 35 having control software to control operation of the keys components as part of the communications protocol. The microcontroller 35 controls the transmitter 6, which includes a first oscillator 30 for generating the first fundamental tone 60 and a second oscillator 32 for generating the second fundamental tone 62. The frequency signals generated are combined by a combiner or summing amplifier 34 for transmission on the UHF transmission antenna 7. The microcontroller 35 is also connected to control the oscillators 30 and 32 so as to apply a frequency shift or deviation based on data to be transmitted, as described below. The microcontroller 35 is also able to receive control data from the base station 8 via a low frequency receiver 9 and antenna 31. The key 4 includes a transponder circuitry (not shown) to excite or trigger the key 4 when within a predetermined range of the base station 8. Within this range, an excitation signal may be generated by the vehicle when a certain event occurs, such as lifting a door handle or similar. Once the key 4 is excited or activated, the communications protocol 4 for entry authorisation to the vehicle begins execution.

The base station 8 includes a microcontroller 40 having control software and which controls operation of the components of the base station 8. The components include a UHF receiver 36 connected to the receiving antenna 12 to provide an output of the data received for the microcontroller 40. An a/d converter 38 is used to convert analogue output signals of the receiver 36 into digital form for the microcontroller 40. These signals include and RSSI output which provides spectral signature data for the microcontroller Intermediate frequency signals produced by the receiver 36 are passed to filters 43 for filtering and then return to the receiver 36 to extract data carried by the signals. The filters 43 are switched intermediate frequency filters having bandwidths which are set by the microcontroller 40, in accordance with the protocol. The base station 8 also has a low frequency transmitter 37 and antenna 39 for transmitting data from the microcontroller to the key 4. The low frequency transmitter 37, antennas 31 and 39 and receiver 9 of the key 4 are configured so that a low frequency communications link is only established when the key 4 and the base station 8 are co-located within the secure area, ie within the vehicle.

For instance, the transmitting antenna 39 may constitute a coil placed in the ignition barrel 39 so that a link is only established with the antenna 31 when the key 4 is placed in the P:\OPER\DBWpq9682-00 spe.doc-l March. 2001 ignition switch of the barrel. The low frequency channel link is used to send synchronisation control data from the base station to the key 4 for use the next time the key 4 is excited. The synchronisation control data is used to set the timing TO, T1, T2, T3 and T4 for the different parts or components of the messages transmitted in the entry authorisation protocol.

The protocol, as shown in Figure 3, initially at steps and involves the fundamental two tones being sent by the key 4 with 100 kHz spacing firstly at low power and then at high power, and the two tone test executed, as described in the two tone security system specifications. An example of the frequency spectrum of the signals received by the receiver 10 during two tone transmission is shown in Figure 5. For instance if the fundamental tone oscillators 30 and 32 are set to transmit 433.9 MHz and 434.1 MHz, respectively, then any third order intermodulation distortion products will appear at the frequencies 433.7 MHz and 434.3 MHz, 64 and 66 respectively. The microcontroller sets the filters 43 so as to provide respective bandwidth filters of 100 kHz in width for each of the frequencies 60, 62, 64 and 66. The spectral information within these bands is converted to a spectral signature for the microcontroller 40 and compared with stored spectral mask in order to detect the interference of any relay station 16 according to the two tone test.

The ability to detect a relay station using the two tone test is maximised by the synchronised switching of the low and high power transmission parts and of the transmitted message. The distortion products introduced by a relay station 16 in the intermodulation bands increase in magnitude three fold for every single increase in power.

During the initial low power transmission part a relay station 16 would have to apply a significant increase in gain or power to its amplifiers in order to bridge the distance between the key 4 and the base station 8 of the vehicle. When the key 4 begins transmitting the high power component by increasing the gain of the amplifier 34 at a synchronisation time dictated by the base station 8, the relay station 16 is unable to adjust the gain of its amplifiers immediately and will transmit an excessively amplified signal to the receiver 10. For instance, if the key 4 introduces a step in power of 30dB at the end of the period TO, then the distortion products in the intermodulation bands will increase by P:\OPER\DBWVApq9682-00 spe.doc- I March. 2001 -6- This ensures that in disadvantageous circumstances when the intermodulation products might otherwise be within the noise floor of the receiver 10, these products are elevated to a power level to ensure they are within the measuring capability of the receiver At step the authentication data to be transmitted between the base station and the key is sent in a first part. It is sent however using frequency shift keying (fsk) and applying a frequency deviation, for example of 200 kHz, from the transmission channel chosen. In other words a low signal 70 will be sent with a +200 kHz deviation, and a high signal 72 will be sent with a -200 kHz deviation. The frequency spectrum of signals received by the receiver 10 during the fsk data transmission is shown in Figure 6. As the filters 43 of the receiver 10 are previously set to a bandwidth of 100 kHz, they need to be adjusted to avoid any data corruption. Accordingly, during an initial transmission, such as before or during the two tone test, the key is instructed by the base station to transmit a certain number of bits at a set frequency deviation after steps and Accordingly the filter circuit 43 is changed in the receiver 10 to cater for the new bandwidth of 400 kHz required at the correct time. The number of bits and frequency deviation to transmit can be sent to the key using an initial message in response to detection and validation of the key by the base station. This initial message is encrypted and sent using the low frequency link. The timing of the communication is such that the relay station is unable to adjust or change filters at the correct time. Accordingly, when the data is sent with the wide frequency deviation, interception by a relay station using narrow bandwidth 100 kHz filters to circumvent the two tone test can be detected at the base station 8, as use of the narrow bandwidth filters would introduce data corruption as shown in Figure 4. The corruption illustrated in Figure 4 is introduced by a 150 kHz bandwidth filter when a frequency deviation of I150 kHz is applied to the transmitted data.

At step the two fundamental tones are again transmitted are again transmitted with 100 kHz channel spacing. This is done to again execute the two tone test to detect whether the relay station has now widened the bandwidth of any intermediate (IF) filters used at the relay station. For example, if the bandwidth has now been increased to 400 kHz, the two tone test used at this step will be able to detect the presence of the wider bandwidth filter P:\OPER\DBW\ q9682-O0 spe doc-I Mrch, 2001 -7as this will result in mixing of the tones and the detectable intermodulation. The duration 73 of the tones sent during this message is advised again during transmission of the initial message to the key 4. Again, this will prevent the relay station from adjusting filters at the correct time during the communications protocol.

At step the second part of the authentication data is transmitted at a frequency deviation of +/-200 kHz. Again this has previously been advised by the base station to the key so as to adjust or switch the security system filters, accordingly.

The timings for each of the parts of the message transmitted by the key 4, TO, T1, T2, T3, and T4, and if desired the frequency deviations used to transmit the data in the data parts and are changed by the base station after each valid detection of the key 4. This timing or synchronisation data is provided to the key 4 with the initial message, parts of which may be transmitted, as described above during transmission of parts of the message by the key, but is preferably sent when the key 4 and base station 8 are co-located within the secure area, such as after the vehicle has been started. The new synchronisation times and deviations are then used for the next communication over the RF interface. Random selections are made to avoid the relay station 16 learning the timings and deviations. The frequency deviations for transmission of the high and low bits of the data may be varied according to the capabilities of the transmitter 6 and receiver 10 employed. For example, the deviation may be as low as 25 kHz. The bandwidth of the filters employed by the receiver 10 and the deviation used simply needs to be changed during transmission of the key message to detect the presence of any filters used by a relay station 16. If the frequency deviation during transmission of the data parts extends beyond the bandwidth of the filters of a relay station 16 then the data is corrupted by the relay station 16 and detected by the base station 8. If the filters of the relay station are sufficiently wide enough to allow the data not to be corrupted then the two tones will be passed by the filters and the detectable intermodulation products are produced. Even if the relay station is sufficiently sophisticated to switch intermediate frequency filters to accommodate the P.OPER\DBW\76313-01 pe dw-29)0005 -8change in bandwidth the station 16 is unable to determine when to change the filter bandwidth. To succeed, the relay station would have to change the filter bandwidths at exactly the correct time, otherwise the two tone test will reveal its presence or the data will be corrupted.

Depending on the security requirements for the secured area, the protocol may be varied.

For example, the power variation between the parts and may be omitted and simply a uniform power two tone test utilised. Also it may be decided that the segregation of the authentication data into two parts is not required, and all of the data may be sent in the period following the first two tone tests, obviating the need for part If the data is combined into one part, it may be sent with the low power and high power two tone test parts or the singular uniform power two tone test.

Synchronisation occurs from the point at which the key 4 is excited and initiates valid communication with the base station 8. This valid communication may be initiated by a user of the key, as described previously.

i Many modifications will be apparent to those skilled in the art without departing from the scope of the present invention as herein described with reference to the accompanying drawings.

Throughout this specification and the claims which follow, unless the context requires otherwise, the word "comprise", and variations such as "comprises" and "comprising", will be understood to imply the inclusion of a stated integer or step or group of integers or 25 steps but not the exclusion of any other integer or step or group of integers or steps.

C

The reference to any prior art in this specification is not, and should not be taken as, an acknowledgment or any form of suggestion that that prior art forms part of the common general knowledge in Australia.

Claims (39)

1. 'A security system including an electronic key having a transmitter and a secure object with a base station having a receiver, said transmitter and receiver being adapted to communicate to transmit authentication data, wherein: said key transmits said data in a message comprising parts having predetermined respective periods with transmission signal variations; and said base station detects distortion of said transmission signal variations by a relay station.

2. A security system as claimed in claim 1, wherein said message has at least one of said parts transmitting data with a frequency deviation from a transmission channel frequency to detect corruption of the data by a filter of a relay station.

3. A security system as claimed in claim 2, wherein the frequency deviation is adjusted together with bandwidth of the filter circuit.

4. A security system as claimed in claim 1, wherein a filter circuit of said receiver is controlled by said base station to synchronously adjust for said transmission signal variations for said predetermined periods.

A security system as claimed in claim 4, wherein said message has a first part with a first period, and said filter circuit uses a first bandwidth setting for said first period; said message has a second part with a second period to transmit at least part of said 25 data with a frequency deviation from a transmission channel frequency, and said filter circuit uses a second bandwidth setting for said second period; and said base station detects corruption of said data by a filter of said relay station.

6. A security system as claimed in claim 5, wherein a number of said second part, interleaved by said first part, are used to transmit said data. P \OPER\DBWpq9682-00 spedoc-l Much. 2001

7. A security system as claimed in claim 5, wherein said first bandwidth setting has a bandwidth narrower than a bandwidth for said frequency deviation of said second bandwidth setting.

8. A security system as claimed in claim 7, wherein said first bandwidth setting has first bandwidths for two tones and intermodulation products of said tones, respectively, and said base station executes a spectral signature test on signals received in said bandwidths to detect a relay station.

9. A security system as claimed in claim 8, wherein said first period includes an initial period with a first transmission signal power and a subsequent period with a second transmission signal power different than said first power.

A security system as claimed in claim 8, wherein a number of a said second part, interleaved by said first part, are used to transmit said data.

11. A security system as claimed in claim 9, wherein a number of a said second part, interleaved by said first part, are used to transmit said data.

12. A security system as claimed in claim 11, wherein only the first of said first part includes said initial period and said subsequent period.

13. A security system as claimed in claim 1, wherein said message has a first part with a first period, and said filter circuit uses a first bandwidth setting for said first period and said first period includes an initial period with a first transmission signal power and a subsequenfit period with-a second transmission signal power diffeirent than said first power.

14. A security system as claimed in claim 13, wherein said message has a first part with a first period, and said filter circuit uses a first bandwidth setting for said first period and said first bandwidth setting has first bandwidths for two tones and intermodulation products of said tones, respectively, and said base station executes a spectral signature test on signals received in said bandwidths to detect a relay station.

PAOPERDBW176313-01 sp doc-29M -11- A security system as claimed in any one of the preceding claims, wherein said periods are set by said base station and communicated to said key.

16. A security system as claimed in claim 15, wherein said periods are randomly selected.

17. A security system as claimed in claim 15, wherein said periods are changed and communicated when said key has been validated.

18. A security system as claimed in claim 15 or 17, wherein said periods are communicated when said key is in said secure object.

19. A vehicle including a security system as claimed in any one of the preceding claims.

A communication method executed by a security system including an electronic i ikey having a transmitter and a secure object with a base station having a receiver, the method including: transmitting authentication data from the transmitter to the receiver, said data being 20 transmitted in a message comprising parts having predetermined respective periods with Sotransmission signal variations; and detecting at said base station distortion of said transmission signal variations by a relay station. 25

21. A communication method as claimed in claim 20, wherein said message has at least one of said parts transmitting data with a frequency deviation from a transmission channel frequency to detect corruption of the data by a filter ofa relay station.

22. A communication method as claimed in claim 21, wherein the frequency deviation is adjusted together with bandwidth of the filter circuit. P.%OPERDBM76313-01 sp.~dx-290~m5 -12-

23. A communication method as claimed in claim 20, including controlling a filter circuit of said receiver to synchronously adjust for said transmission signal variations for said predetermined periods.

24. A communication method as claimed in claim 23, wherein said message has a first part with a first period, and said filter circuit uses a first bandwidth setting for said first period; said message has a second part with a second period to transmit at least part of said data with a frequency deviation from a transmission channel frequency, and said filter circuit uses a second bandwidth setting for said second period; and said base station detects corruption of said data by a filter of said relay station.

A communication method as claimed in claim 24, wherein a number of said second part, interleaved by said first part, are used to transmit said data.

26. A communication method as claimed in claim 24, wherein said first bandwidth setting has a bandwidth narrower than a bandwidth for said frequency deviation of said 9.9.99 second bandwidth setting. 20

27. A communication method as claimed in claim 26, wherein said first bandwidth setting has first bandwidths for two tones and intermodulation products of said tones, respectively, and said base station executes a spectral signature test on signals received in said bandwidths to detect a relay station. 9 i* 9 25

28. A communication method as claimed in claim 27, wherein said first period includes an initial period with a first transmission signal power and a subsequent period with a 0 second transmission signal power different than said first power.

29. A communication method as claimed in claim 27, wherein a number of a said second part, interleaved by said first part, are used to transmit said data.

A communication method as claimed in claim 28, wherein a number of a said P\OPER\DBWIpq9682-0 spe doc-I March. 2001 13 second part, interleaved by said first part, are used to transmit said data.

31. A communication method as claimed in claim 30, wherein only the first of said first part includes said initial period and said subsequent period.

32. A communication method as claimed in claim 20, wherein said message has a first part with a first period, and said filter circuit uses a first bandwidth setting for said first period and said first period includes an initial period with a first transmission signal power and a sub sequent period with a second transmission signal power different than said first power.

33. A communication method as claimed in claim 32, wherein said message has a first part with a first period, and said filter circuit uses a first bandwidth setting for said first period and said first bandwidth setting has first bandwidths for two tones and intermodulation products of said tones, respectively, and said base station executes a spectral signature test on signals received in said bandwidths to detect a relay station.

34. A communication method as claimed in any one of claims 20 to 33 wherein said periods are set by said base station and communicated to said key.

A communication method as claimed in claim 34, wherein said periods are randomly selected.

36. A communication method as claimed in claim 34, wherein said periods are changed and communicated when said key has been validated.

37. A communication method as claimed in claim 34 or 36, wherein said periods are communicated when said key is in said secure object. PAOPERIDBVA763 13.01 sedm.Z9AMM 14

38. A security system substantially as hereinbefore described with reference to the accompanying drawings.

39. A communication method executed by a security system substantially as hereinbefore described with reference to the accompanying drawings. DATED this 29th day of June 2005 ROBERT BOSCH GMBH By its Patent Attorneys DAVIES COLLISON CAVE 9 9 9 9 9 9. 9 9 9 9 9 9 9 9999 *99 9. 9 9 9 9 999 9 9.9. 9 9 9 9 9 9 999 9 9 eQ*e 9 9 9. *9