DE112020001498T5 - Upsampling and cross-correlation for arrival time determinations in passive access/passive start systems - Google Patents

Abstract

An entry system for a vehicle includes a receiver and an entry module. The receiver is configured to receive a signal transmitted from a portable entry device to the vehicle. The access module is configured to: generate a differentiated signal based on the received signal; upsampling the differentiated signal to generate a first upsampled signal; obtaining or generating an expected signal; upsampling the expected signal to generate a second upsampling signal; cross-correlating the first upsampled signal and the second upsampled signal to generate a cross-correlation signal; determining, based on the cross-correlation signal, a phase difference between the first upsampled signal and the second upsampled signal; determining a round trip time of the signal received by the receiver; and allowing access to the vehicle based on the round trip time.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims priority from U.S. Patent Application No. 16/824,280 , which is a continuation-in-part of U.S. Application No. 16/598,191 which received the priority benefit of U.S. Provisional Application No. 62/744,814 , U.S. Provisional Application No. 62/801,392 and U.S. Provisional Application No. 62/826,212 claimed. This application also claims priority from US Provisional Application No. 62/823,210 and U.S. Provisional Application No. 62/826,239 .

AREA

The present disclosure relates to passive entry/passive start systems.

BACKGROUND

The background description provided herein is for the purpose of generally presenting the context of the disclosure. Work of the present inventors, to the extent described in this Background section, as well as aspects of the specification that do not otherwise qualify as prior art at the time of filing, are not admitted as prior art to the present disclosure, either express or implied .

Conventional passive entry/passive start (PEPS) systems enable keyless entry, including providing user entry/access to various vehicle functions when the user has a key fob that is connected to a vehicle-based PEPS electronic control unit (or PEPS module). was paired. As an example, the user in possession of the key fob may approach a vehicle having the PEPS module. The key fob communicates with the PEPS module and, if the key fob is authenticated, the PEPS module can unlock doors of the vehicle. The PEPS module (i) performs an authentication process to determine whether the key fob is authorized for access to the vehicle and (ii) determines a location of the key fob relative to the vehicle. The authentication process may involve the exchange of an encrypted password or an encrypted signature. If the password or signature is correct, it is then determined that the fob is authorized. A location of the key fob may be determined based on a strength of a signal received from the key fob, for example. If the key fob is authenticated and is within an authorized zone of the vehicle, then access to the interior of the vehicle is allowed without using a traditional key.

As another example, the user in possession of the key fob can activate a vehicle feature by pressing a button on the key fob. In response to a button press, the key fob communicates with the PEPS module and, if the key fob is authenticated and is within a predetermined distance of/from the vehicle, the PEPS module performs the aforesaid function associated with the button or key pressed on the key fob (e.g., starts the vehicle, opens a door, sets an alarm, etc.). The communication performed for the two examples may include the fob and PEPS module performing a one-way low frequency (LF) wake-up function and a one-way or two-way radio frequency (RF) authentication function.

A Phone-as-a-Key (PAK) vehicle access system can operate similarly to the noted PEPS system, except that the vehicle is accessed using a cellular phone instead of a key fob. As an example, the cellular phone may communicate with a PAK module or Telematics Control Unit (TCU) in the vehicle to begin an access pairing process. The mobile phone and either the PAK module or the TCU perform the access pairing process to establish a trust relationship. The pairing process may include BluetoothⓇ pairing, whereby: security information is exchanged between the mobile phone and the vehicle directly; a mobile phone address, a mobile phone identity resolution key, a reservation identifier and/or an encryption key is exchanged over a cloud-based network; and/or the mobile phone presents a certificate to the vehicle, the certificate being signed by (i) the mobile phone, (ii) a trusted security signing authority such as a manufacturer of the vehicle, and/or (iii) a trusted third party . In the case of a certificate, the certificate may include an identifier of a person authorized to access a vehicle, an identifier of a cloud-based network authorized to transmit the certificate, an identifier of a rental or lease agreement of the vehicle, an identifier of the vehicle, a date and length of time that the vehicle is authorized for use by the authorized individual and/or other restrictions and/or access/license information.

Passive entry typically requires some user action to initiate a process of waking up a key fob or cellular phone (referred to as portable entry devices). For example, this may include a user approaching the vehicle with a portable entry device and/or touching and/or pulling a door handle. When a PEPS module or a PAK module, referred to as access modules, detects this behavior, the access module performs a location process to begin searching for and waking up from the keyfob. In a one-way RF system, an LF downlink signal (e.g., a 125 kilohertz (kHz) signal) is transmitted from the access module to the fob to wake up the fob to send commands and data to the fob for authentication purposes. The fob then transmits a response signal to the access module via an RF uplink. The response signal may be an ultra high frequency (e.g. 315 megahertz (MHz) or 433 MHz). In a two-way RF system, a downlink LF signal is transmitted from the access module to the fob to wake up the fob and establish a bi-directional RF link between the access module and the fob. The bi-directional RF link can transmit signals at a UHF frequency (e.g. 315 MHz, 422 MHz, 868 MHz or 915 MHz). The bi-directional RF link is then used to authenticate the keyfob. The fob includes a microcontroller that stays in a sleep mode (or a low power listen mode) that constantly checks for a valid LF signal. Given a valid LF signal containing a correct vehicle-specific wake-up identifier, the microcontroller generates a signal to wake-up a PEPS controller to communicate with the vehicle's access module.

For example, a vehicle may have 4-6 LF antennas that generate an LF magnetic field. A controller of the key fob measures an LF signal level during communication with the access module. The control unit determines a received signal strength indicator (RSSI) and provides the RSSI to the access module. The access module then determines a location of the fob based on the RSSI. The key fob includes three discrete antenna coils or a 3D coil that are used to determine x, y, and z axis values indicative of a location of the key fob.

A smartphone, wearable, and/or other intelligent network wearable device may function as a key fob. The intelligent portable network devices can enable various vehicle functions and long-distance distance features, such as passive welcome lighting, distance binding/limiting to remote parking applications, etc.

SHORT VERSION

An access system for a vehicle is provided. The access system includes a receiver and an access module. The receiver is configured to receive a signal transmitted from a portable entry device to the vehicle. The access module is configured to: generate a differentiated signal based on the received signal; upsampling the differentiated signal to generate a first upsampled signal or a first upsampled signal; obtaining or generating an expected signal; upsampling the expected signal to produce a second upsampled signal; cross-correlating the first upsampled signal and the second upsampled signal to generate a cross-correlation signal; determining, based on the cross-correlation signal, a phase difference between the first upsampled signal and the second upsampled signal; Determining an orbital period of the signal received by the receiver; and allowing access to the vehicle based on the round trip time.

In further features, the access module is configured to: down-convert the signal to generate a down-converted signal; sampling the down-converted signal to generate a sampled signal; taking arctangents of the sampled signal to produce an arctangent signal; and differentiating the arctangent signal to generate the differentiated signal.

In further features, the access module is configured to: determine at least one of a location or a distance of the portable access device relative to the vehicle based on the round trip time; and allowing access to the vehicle based on the at least one of the location and the distance.

In further features, the access module includes: a first upsampler configured to upsample the differentiated signal to generate the first upsampled signal; and a second upsampler configured to upsample the expected signal to generate the second upsampled signal. An upsampling rate of the first upsampler is a same sampling rate as that of the second upsampler.

In further features, the access module includes: a sign module configured to determine a sign of the differentiated signal; and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.

In further features, the access module is configured to: receive the expected signal; and the expected signal is a predetermined signal obtained by the access module prior to receipt of the received signal.

In further features, the access module is configured to perform an iterative process comprising: multiplying bits of the first upsampling signal and the second upsampling signal to generate resultant products; summing the resulting products to produce a product sum value; and shifting the second upsampling signal relative to the first upsampling signal. The iterative process provides sum-of-products values. The access module is configured to determine the phase difference based on the product sum values.

In further features, the access module is configured to reconstruct the signal transmitted from the portable access device to the vehicle based on zero crossings of a portion of the cross-correlation signal associated with a maximum of the product sum values.

In further features, the access module includes: an upsampler configured to upsample the differentiated signal to generate the first upsampled signal; a sign module configured to determine a sign of the first upsampled signal; and a bit pattern module configured to generate the expected signal based on the sign of the first upsampling signal.

In further features, a portable entry device for an entry system of a vehicle is provided. The portable access device includes a receiver and a control module. The receiver is configured to receive a signal transmitted from an entry module of a vehicle to the portable entry device. The control module is configured to: generate a differentiated signal based on the received signal; upsampling the differentiated signal to generate a first upsampled signal or a first upsampled signal; obtaining or generating an expected signal; upsampling the expected signal to produce a second upsampled signal; cross-correlating the first upsampled signal and the second upsampled signal to generate a cross-correlation signal; determining, based on the cross-correlation signal, a phase difference between the first upsampled signal and the second upsampled signal; determining a round trip time of the by the receiver received signal; and either transmitting the round trip time to the vehicle to gain access to the vehicle based on the round trip time, or determining at least one of a location or a distance between the portable access device and the vehicle and transmitting at least one of the location and the distance to the vehicle to gain access to the vehicle.

In further features, the control module is configured to: down-convert the signal to generate a down-converted signal; sampling the down-converted signal to generate a sampled signal; taking arctangents of the sampled signal to produce an arctangent signal; and differentiating the arctangent signal to generate the differentiated signal.

In further features, the control module is configured to: determine at least one of a location or a distance of the portable access device relative to the vehicle based on the round trip time; and transmitting the at least one of the location or the distance to the vehicle to access the vehicle based on the at least one of the location or the distance.

In further features, the control module includes: a first upsampler configured to upsample the differentiated signal to generate the first upsampled signal; and a second upsampler configured to upsample the expected signal to generate the second upsampled signal, wherein an upsampling rate of the first upsampler is equal to a sampling rate of the second upsampler.

In further features, the control module includes: a sign module configured to determine a sign of the differentiated signal; and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.

In further features, the control module is configured to: receive the expected signal; and the expected signal is a predetermined signal obtained by the control module prior to receipt of the received signal.

In further features, the control module is configured to perform an iterative process comprising: multiplying bits of the first upsampling signal and the second upsampling signal to generate resultant products; summing the resulting products to produce a product sum value; and shifting the second upsampling signal relative to the first upsampling signal. The iterative process provides sum-of-products values. The control module is configured to determine the phase difference based on the product sum values.

In further features, the control module is configured to reconstruct the signal transmitted from the vehicle's access module to the portable access device based on zero crossings of a portion of the cross-correlation signal associated with a maximum of the product sum values.

In further features, the control module includes: an upsampler configured to upsample the differentiated signal to generate the first upsampled signal; a sign module configured to determine a sign of the first upsampled signal; and a bit pattern module configured to generate the expected signal based on the sign of the first upsampling signal.

An entry system for a vehicle is provided and includes antennas and an entry module. The antennas are configured to each receive a signal transmitted from a portable entry device to the vehicle. One of the antennas is a circularly polarized antenna. The access module is configured to: down-convert the received signal to generate an in-phase signal and a quadrature-phase signal; running a music algorithm to determine angles of arrival of the received signal as received at the antennas; determining a distance between the portable entry device and the vehicle based on the angles of arrival; and allowing access to the vehicle based on the distance.

In further features, antennas include: the circularly polarized antenna having a conductive annular body with an inner hole; a circular insulator connected to the conductive annular body connected; and a linearly polarized antenna connected to the circularly polarized antenna and the circular insulator and extending outwardly from the circular insulator. The linearly polarized antenna includes a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

In further features, the access module is configured during execution of the music algorithm to: collect analytical signal samples of the signal received at each of the antennas to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determining a number of incoming signals; splitting the MxM matrix into multiple matrices; calculating a music spectrum based on one of the matrices; and performing a peak search on the music spectrum to determine the angles of arrival.

In further features, the access module is configured to: perform a covariance smoothing process to generate a modified covariance matrix; and using the eigenvalue decomposition process to determine the MxM matrix based on the modified covariance matrix.

In further features, the access module is configured during/upon generation of the receive data matrix to: convert an in-phase and quadrature-phase sample vector to a phase angle vector; generating, based on the phase angle vector, a newly generated in-phase and quadrature phase sample vector for each of the antennas; and generating the received data matrix based on the newly generated in-phase and quadrature-phase sample vector for each of the antennas.

In further features, the access module is configured to: generate a time vector corresponding to the in-phase and quadrature-phase sample vector; discarding some of the analytical signal samples taken near antenna switching times; unwrapping each repeat portion of remaining samples with a step size π; averaging a frequency of sinusoids of the remaining samples; finding an average slope of the remaining samples; measuring a standard deviation of the mean slope; determining which of the misaligned antennas is misaligned based on the measured standard deviation; and interpolating, for each of the antennas, a straight line of points on a time vector to produce a reconstructed phase angle vector.

In further features, the access module is configured to: if the standard deviation is greater than a predetermined threshold, checking which of the antennas have an inaccurate pointing; and re-measuring the standard deviation of the average slope for the one of the antennas.

In further features, the access module is configured to perform a cleaning/cleaning method comprising: performing an iterative process comprising: removing source signals, one at a time, using a calibrated array manifold comprising the antennas; and forcing a position of a source signal to an offset location and recalculating an angle of arrival direction of a remaining signal. During/in performance of the iterative process, the access module converges to a new set of incident/incident arrival angles.

In further features, a vehicle is provided and includes: a body; and a roof, center console, floor, or at least partially enclosed metal structure. The antennas are implemented in at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.

In further features, the antennas include a multi-axis polarized RF antenna assembly, wherein the multi-axis polarized RF antenna assembly includes the circularly polarized antenna and is oriented in the roof.

In further features, a method is provided and includes: receiving a signal transmitted from a portable entry device to the vehicle at each of a plurality of antennas, one of the antennas being a circularly polarized antenna; down-converting the received signal to generate an in-phase signal and a quadrature-phase signal; Running a music algorithm to determine angles of arrival of the received signal as it appears at the antennas Will be received; determining a distance between the portable entry device and the vehicle based on the angles of arrival; and allowing access to the vehicle based on the distance.

In further features, executing the music algorithm includes: collecting analytical signal samples of the signal received at each of the antennas to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determining a number of incoming signals; splitting the MxM matrix into multiple matrices; calculating a music spectrum based on one of the matrices; and performing a peak search on the music spectrum to determine the angles of arrival.

In further features, the method additionally comprises: performing a covariance smoothing method to generate a modified covariance matrix; and using the eigenvalue decomposition process to determine the MxM matrix based on the modified covariance matrix.

In further features, the method comprises during/when generating the receive data matrix: converting an in-phase and quadrature-phase sample vector into a phase angle vector; generating, based on the phase angle vector, a newly generated in-phase and quadrature phase sample vector for each of the antennas; and generating the received data matrix based on the newly generated in-phase and quadrature-phase sample vector for each of the antennas.

In further features, the method additionally comprises: generating a time vector corresponding to the in-phase and quadrature-phase sample vectors; discarding some of the analytical signal samples taken near antenna switching times; unwrapping each repeat portion of remaining samples with a step size π; averaging a frequency of sinusoids of the remaining samples; determining an average slope of the remaining samples; measuring a standard deviation of the mean slope; determining which of the antennas is misaligned based on the measured standard deviation; and interpolating, for each of the antennas, a straight line of points on a time vector to produce a reconstructed phase angle vector.

In further features, the method additionally comprises: if the standard deviation is greater than a predetermined threshold, checking which of the antennas has an inaccurate pointing; and re-measuring the standard deviation of the average slope for the one of the antennas.

In further features, the method additionally comprises performing a cleaning/cleaning method comprising: performing an iterative process comprising removing source signals, one at a time, using a calibrated array manifold comprising the antennas, and forcing a position of a source signal an offset location and recalculating an arrival angle direction of a remaining signal; and converging to a new set of incident arrival angles during performance of the iterative process.

In other features, the vehicle includes (i) a body and (ii) a roof, center console, floor, or at least partially enclosed metal structure. The antennas are implemented in at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.

In further features, the antennas include a multi-axis polarized RF antenna array. The multi-axis polarized RF antenna assembly includes the circularly polarized antenna and is oriented in the roof.

An access system for a vehicle is provided. The access system includes antennas and an access module. The antennas are configured to each receive a signal transmitted from a portable entry device to the vehicle. The signal is transmitted on a 2.4 gigahertz frequency. The access module is configured to: down-convert the received signal to generate an in-phase signal and a quadrature-phase signal; Performing a carrier phase-based ranging, comprising implementing a music algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine angles of arrival of the received signal as received at the antennas; determining a location of the portable entry device relative to the vehicle based on the distance and the angles of arrival; and allowing access to the vehicle based on the location.

In further features, the antennas in the vehicle are configured such that the received signal has multiple corresponding bounce paths between the portable access device and the antennas.

In other features, the antennas are installed in a metal structure of the vehicle.

In further features, the antennas are positioned such that there is no line of sight between the antennas and the portable access device.

In further features, the entry system additionally includes sensors, each of the sensors including two or more of the antennas, and wherein the sensors are configured in the vehicle such that the received signal has multiple corresponding bounce paths between the portable entry device and each of the sensors.

In further features, the access module is configured to: monitor the received signal and generate a received signal strength indicator based on the received signal; determining whether the portable entry device is inside or outside the vehicle based on the received signal strength indicator; and determining the distance between the portable entry device and the vehicle when the portable entry device is outside the vehicle.

In further features, at least one of the antennas is a circularly polarized antenna.

In further features, the antennas include: a circularly polarized antenna having a conductive annular body with an inner hole; a circular insulator connected to the conductive annular body; and a linearly polarized antenna connected to the circularly polarized antenna and the circular insulator and extending outwardly from the circular insulator. The linearly polarized antenna includes a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

In further features, the access module is configured during/at implementation of the music algorithm to: collect analytical signal samples of the signal received at each of the antennas to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determining a number of incoming/arriving signals; splitting the MxM matrix into matrices; calculating a music spectrum based on one of the matrices; and performing a peak search on the music spectrum to determine the angles of arrival.

In further features, the receiver includes a phase locked loop and is phase locked to a transmitter of the portable access device. The access module is configured to perform tone exchanges with the transmitter and determine at least one of the distance and the angles of arrival based on the tone exchanges.

In further features, the receiver includes a phase locked loop and is phase locked to a transmitter of the portable access device. The access module is configured to: perform tone exchanges with the transmitter and determine a round trip time of flight information based on the tone exchanges; and determining the distance based on the round trip time of flight information.

In further features, a vehicle is provided and includes: the entry system; a body; and a roof, center console, floor, or at least partially enclosed metal structure. The antennas are implemented in at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.

In further features, a method is provided and includes: receiving at each of a plurality of antennas a signal transmitted from a portable access device to the vehicle, the signal being transmitted at a 2.4 gigahertz frequency; downconversion of the receiv gene signal for generating an in-phase signal and a quadrature-phase signal; performing a carrier phase-based ranging including implementing a music algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine angles of arrival of the received signal as received at the antennas; determining a location of the portable entry device relative to the vehicle based on the distance and the angles of arrival; and allowing access to the vehicle based on the location.

In further features, the antennas in the vehicle are configured such that the received signal has multiple corresponding bounce paths between the portable access device and the antennas.

In further features, the antennas are positioned such that there is no line of sight between the antennas and the portable access device.

In further features, the pairs of antennas are implemented as part of respective sensors. The sensors are configured in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and each of the sensors.

In further features, the method additionally comprises: monitoring the received signal and generating a received signal strength indicator based on the received signal; determining whether the portable entry device is inside or outside the vehicle based on the received signal strength indicator; and determining the distance between the portable entry device and the vehicle when the portable entry device is outside the vehicle.

In further features, at least one of the antennas is a circularly polarized antenna.

In further features, the method includes, during implementation of the music algorithm: collecting analytical signal samples of the signal received at each of the antennas to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determining a number of incoming/impinging signals; splitting the MxM matrix into multiple matrices; calculating a music spectrum based on one of the matrices; and performing a peak search on the music spectrum to determine the angles of arrival.

In further features, the method additionally comprises: performing tone exchanges with a transmitter of the portable access device; anddetermining at least one of the distance and the angles of arrival based on the tone exchanges. A receiver of the portable access device that performs the tone exchanges includes a phase locked loop and is phase-locked to a transmitter of the portable access device.

In further features, the method additionally comprises: performing tone exchanges with the transmitter and determining a round trip time of flight information based on the tone exchanges; and determining the distance based on the round trip time of flight information. A receiver of the portable access device that performs the tone exchanges includes a phase locked loop and is phase-locked to a transmitter of the portable access device.

A multi-axis polarized RF antenna assembly is provided and includes a circularly polarized antenna, a circular isolator, and a linearly polarized antenna. The circularly polarized antenna includes a conductive annular body with an inner hole. The circular insulator is connected to the conductive annular body. The linearly polarized antenna is connected to the circularly polarized antenna and the circular insulator and extends outwardly from the circular insulator. The linearly polarized antenna includes a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

In further features, the conductive element is a wire. In further features, the shell is formed from polytetrafluoroethylene. The conductive element is made of copper.

In further features, the linearly polarized antenna is configured to extend downwardly from the circularly polarized antenna in use.

In other features, the circularly polarized antenna is a 2-axis antenna. The linear polarized antenna is a single axis antenna.

In further features, the multi-axis polarized RF antenna arrangement additionally includes a ground plane. The circular insulator is installed on the ground plane, between the conductive element and the ground plane, and between the circularly polarized antenna and the ground plane.

In further features, the circularly polarized antenna includes two feed points that are quadrature and configured to receive signals that are quadrature with each other.

In further features, a vehicle is provided and includes a body and a roof. The roof includes the multi-axis polarized RF antenna array. The multi-axis polarized RF antenna assembly is oriented in the roof such that the linearly polarized antenna extends downward from the circularly polarized antenna.

In further features, a vehicle system is provided and includes the multi-axis polarized RF antenna assembly, a second multi-axis polarized RF antenna assembly, and an access module. The multi-axis polarized RF antenna assembly is a first multi-axis polarized RF antenna assembly and is configured to be implemented in a vehicle. The second multi-axis polarized RF antenna assembly is configured to be implemented in the vehicle and includes: a second circularly polarized antenna having a second conductive annular body with a second inner hole; a second circular insulator connected to the second conductive annular body; and a second linearly polarized antenna connected to the second circular insulator and extending outwardly from the second circular insulator. The second linearly polarized antenna includes a shell and a conductive element extending through the shell of the second linearly polarized antenna. The second linearly polarized antenna extends orthogonally to a radius of the second circularly polarized antenna. The access module is coupled to the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly and configured to communicate with a portable access device via the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly.

In further features, at all times, at least one of the linearly polarized antenna or the first multi-axis polarized RF antenna assembly is not cross-polarized with an antenna of the second multi-axis polarized RF antenna assembly.

In further features, the access module is configured to perform passive access/passive start operations or phone-as-a-key operations including transmitting and receiving radio frequency/radio frequency signals via the first of the multi-axis polarized RF antenna arrays and the second of the multi-axis polarized ones RF antenna arrays.

In further features, the access module is configured to allow access to the vehicle based on the radio frequency signals.

In further features, the access module is configured to execute an algorithm to determine which antenna pair of the first of the multi-axis polarized RF antenna arrays and the second of the multi-axis polarized RF antenna arrays to use for communicating with the portable access device. In other features, the portable entry device is a key fob or a cellular/mobile phone.

In further features, a method of communicating with a portable access device is provided. The method includes iteratively running an algorithm over an access module of a vehicle, the algorithm including a sequence of operations comprising: selecting a frequency from frequencies; selecting an antenna pair from possible antenna pairs; wherein antennas of the possible antenna pairs comprise antennas with different polarized axes; transmitting a packet to the portable access device over the selected pair of antennas; receiving a first received signal strength indicator (RSSI) and a response signal from the trag bare access device, wherein the first RSSI corresponds to transmission of the packet; and measuring a second RSSI of the response signal. Based on the first RSSIs and the second RSSIs, a best of the frequencies and a best antenna pair of the possible antenna pairs are selected. One or more additional packets are transmitted using the selected best frequency and antenna pair.

In further features, each selected pair of antennas includes one of the linearly polarized antennas and one of the circularly polarized antennas.

In further features, the method additionally comprises: transmitting the one or more additional packets for authorizing the portable access device; determining whether the portable entry device is authorized to access an interior of the vehicle; and permitting access to an interior of the vehicle if the portable entry device is authorized.

In further features, the method additionally comprises: measuring a flight time of the one or more additional packets, including a time to transmit the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device; and estimating a distance between the vehicle and the portable access device based on the measured flight time.

In further features, the estimated distance is used to detect whether another device is attempting a range extender type relay station attack. In further features, the method additionally includes, when the other device attempts to perform a range extender-type relay station attack, performing a countermeasure comprising preventing access to the interior of the vehicle. In further features, the countermeasure includes notifying an owner of the vehicle of the range extender-type relay station attack.

In further features, the method additionally comprises: exchanging multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, the pairs of unmodulated carrier tones including received tones and transmitted tones; measuring a phase of received tones relative to transmitted tones and acquiring frequency data; and estimating a distance between the vehicle and the portable access device based on the measured phases and the frequency data.

In further features, the method additionally includes determining whether another device is attempting a range extender-type relay station attack based on the estimated distance. In further features, each selected pair of antennas includes linearly polarized antennas.

In further features, the algorithm includes switching between the possible antenna pairs between successively transmitted packets. In further features, the algorithm includes switching between the possible antenna pairs during transmission of a portion of a packet. In other features, part of the package is a continuous wave tone.

In further features, certain of the possible antenna pairs include two antennas that are collocated.

In further features, the method additionally comprises: transmitting packets to the portable access device; measuring time-of-flight values for the packets based on response signals received from the portable access device, the response signals being transmitted based on the packets; determining whether the other device is performing a range extender-type relay station attack based on the time-of-flight values; and preventing access to an interior of the vehicle in response to detection of the range extender-type relay station attack.

In other features, the portable entry device is a key fob or a cellular/mobile phone. In further features, the method additionally includes encrypting an identifier of the best antenna pair. The transmission of the one or more additional packets includes the encrypted identifier of the best antenna pair.

In further features, a vehicle system for communicating with a portable entry device is provided. The vehicle system includes antennas with different polarized axes and an access module. The access module is configured to iteratively perform an algorithm. The algorithm comprises a sequence of operations including: selecting a frequency from a plurality of frequencies; selecting an antenna pair from the antennas with different polarized axes; transmitting a packet to the portable access device over the selected pair of antennas; receiving a first RSSI and a response signal from the portable access device, the first RSSI corresponding to transmission of the packet; and measuring a second RSSI of the response signal. The access module is configured to: select a best one of the frequencies and a best antenna pair of the antenna pairs based on the first RSSIs and the second RSSIs; and transmitting one or more additional packets using the selected best frequency and selected best antenna pair.

In further features, the access module is configured to: measure a flight time of the one or more additional packets, including a time to transmit the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device ; and estimating a distance between the vehicle and the portable access device based on the measured flight time.

In further features, the access module is configured to: exchange multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, the unmodulated carrier tones including received tones and transmitted tones; measuring the phases of the received tones relative to the transmitted tones; acquiring the measured phase and frequency data; and estimating a distance between the vehicle and the portable access device using the measured phase and frequency data.

In further features, the access module is configured to detect whether the portable access device attempts to perform a range extender-type relay station attack based on the estimated distance.

In further features, the access module is configured to detect whether a device is attempting to perform a range extender-type relay station attack based on the estimated distance.

In further features, when the portable entry device attempts to perform a range extender-type relay station attack, the entry module is configured to perform a countermeasure comprising preventing access to the interior of the vehicle.

In further features, the countermeasure includes notifying an owner of the vehicle of the range extender-type relay station attack. In other features, the portable entry device is a key fob or a cellular/mobile phone.

In further features, the portable access device is configured to encrypt a best antenna pair identifier. The transmission of the one or more additional packets includes the encrypted identifier of the best antenna pair.

In further features, a system for detecting a range-extending-type relay attack is provided. The system includes a first transmitter, a receiver, and a first module. The first transmitter is configured to transmit a first radio frequency signal from one of a vehicle and a portable access device to the other of the vehicle and the portable access device. The receiver is configured to receive a first response signal from one of the vehicle and the portable access device in response to the first radio frequency signal. The first module is configured to: monitor or generate one or more parameters associated with transmission of the first radio frequency signal and receipt of the first response signal; detecting, based on the one or more parameters, the range-extending-type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle, wherein at least one of: (i) the the first radio frequency signal is relayed from the vehicle to the portable access device via the offending device, or (ii) the first response signal is relayed from the portable access device to the vehicle via the offending device; and performing a countermeasure in response to detection of the range-extending type relay attack.

In further features, the first module is implemented on the vehicle. In further features, the first module is implemented on the portable entry device.

In further features, the first module is configured to: measure a round trip time of the first radio frequency signal; and detecting the range extension type relay attack based on the round trip time.

In further features, the first module is configured to: transmit a second radio frequency/radio frequency signal and receive a second response signal prior to transmitting the first radio frequency/radio frequency signal and receiving the first response signal; monitoring at least one of a first received signal strength indicator of the second radio frequency signal or a second received signal strength indicator of the second response signal; and determining, based on at least one of the first received signal strength indicator or the second received signal strength indicator, at least one of a path, frequency, channel, or antenna pair for transmitting the first radio frequency signal and for receiving the first response signal.

In further features, the first module is configured to: transmit a second radio frequency/radio frequency signal and receive a second response signal prior to transmitting the first radio frequency/radio frequency signal and receiving the first response signal; monitoring an antenna polarization state according to at least one of the second radio frequency signal and the second response signal; and determining, based on the antenna polarization state of the at least one of the first radio frequency/radio frequency signal or the first response signal, at least one of a path, frequency, channel, or antenna pair for transmitting the first radio frequency/radio frequency signal and for receiving the first response signal.

In further features, the first module is configured to transmit the first radio frequency/radio frequency signal while receiving the first response signal or a second radio frequency/radio frequency signal from one of the vehicle and the portable entry device.

In further features, the first module is configured to receive the first response signal while receiving a second radio frequency signal from one of the vehicle and the portable entry device.

In further features, the first module is configured to: determine a succession of randomly selected frequencies or channels; sharing the succession of randomly selected frequencies or channels with one of the vehicle and the portable access device; and transmitting the first radio frequency signal and receiving the first response signal based on the randomly selected frequencies or channels.

In further features, the first module is configured to: randomize access addresses for the vehicle or portable access device; sharing the randomized access address with the portable access device; and generating the first radio frequency signal to include one of the access addresses.

In further features, the first module is configured to: measure a length of at least one bit of the first response signal; and detecting the range extension type relay attack based on the length of the at least one bit.

In further features, the first module is configured to: monitor slopes of the rising and falling edges of the first response signal; and detecting the range extension type relay attack based on the slopes.

In further features, the first module is configured to: use a sliding correlation function to align the first response signal with an idealized Gaussian waveform for a known bit pattern and bit rate, including peak scaling and zero offset alignment ; and detecting the range-extending-type relay attack based on the alignment.

In further features, the first module is configured to: accumulate portions of the first response signal that are early after a zero crossing and before a next peak of a predetermined history shape are/are; determining an average based on the accumulated parts; and detecting the range extension type relay attack based on the average.

In further features, the first module is configured to: accumulate portions of the first response signal that are late after a peak and before a next zero crossing of a predetermined waveform; determining an average based on the accumulated parts; and detecting the range extension type relay attack based on the average.

In further features, the first module is configured to randomize a direction of propagation of the first radio frequency signal, including whether the first radio frequency signal is transmitted from the vehicle to the portable access device or from the portable access device to the vehicle.

In further features, the countermeasure includes preventing at least one of access to or operational control of the vehicle.

In further features, the system additionally includes a second transmitter configured to transmit a dummy signal while the first transmitter is transmitting the first radio frequency signal or the receiver is receiving the first response signal.

In further features, the system includes: the first module implemented on the vehicle; and the portable access device comprising a second module. The first module is configured to transmit the first radio frequency signal to the portable access device and receive the first response signal from the portable access device. The second module is configured to transmit a second radio frequency signal to the vehicle and receive a second response signal from the vehicle. At least one applies/takes place from: the first module transmits the first radio frequency/radio frequency signal while the second module transmits the first response signal or the second radio/radio frequency signal, or the first module receives the first response signal while the second module transmits the second high -/radio frequency signal transmits.

In further features, the first module and the second module are configured to: exchange at least three pairs of radio signals that include portions of unmodulated carrier tones, the unmodulated carrier tones including received tones and transmitted tones; and measuring phases of the received tones relative to the transmitted tones. One or more of the first module and the second module is configured to: acquire frequency and phase information; and estimating the distance between the first module and the second module based on the phase and frequency information.

In further features, the one or more of the first module and the second module is configured to use the estimated distance to detect a range-extending-type relay attack.

In further features, a method for detecting a range-extending-type relay attack is provided. The method includes: transmitting, via a transmitter, a radio frequency signal from one of a vehicle and a portable access device to the other of the vehicle and the portable access device; receiving, via a receiver, a response signal from one of the vehicle and the portable access device in response to the radio frequency signal; monitoring or generating one or more parameters associated with transmission of the radio frequency signal and receipt of the response signal; and detecting, based on the one or more parameters, the range-extending-type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle. At least one of: (i) the radio frequency signal is relayed from the vehicle to the portable access device via the offending device, or (ii) the response signal is relayed from the portable access device to the vehicle via the offending device. The method additionally includes: performing a countermeasure in response to detection of the range-extending-type relay attack; measuring a round trip time of the radio frequency signal; monitoring at least one of a first received signal strength indicator of the radio frequency signal or a second received signal strength indicator of the response signal; and detecting the range extension type relay attack based on the round trip time.

In further features, a system for accessing or providing operational control from a vehicle is provided. The system includes a master device comprising: a first antenna module having first antennas with different polarized axes; a transmitter configured to transmit a challenge signal via the first antenna module from the vehicle to a slave device, the slave device being a portable access device; and a first receiver configured to receive a response signal in response to the challenge signal from the slave device. The system additionally includes a first sniffer device comprising: a second antenna module having second antennas with different polarized axes; and a second receiver configured to receive, via the second antenna module, the challenge signal from the transmitter and the response signal from the slave device. The first sniffer device is configured to measure when the challenge signal and the response signal arrive at the first sniffer device to provide arrival times. The master device or the first sniffer device is configured to (i) estimate at least one of a distance from the vehicle to the slave device or a location of the slave device relative to the vehicle based on the arrival times, and (ii ) Preventing at least one of access to or operational control of the vehicle based on the estimated one of distance or location.

In further features, the master device or the first sniffer device is configured to: determine a round trip time associated with transmission of the challenge signal based on the arrival times; and detecting, based on the round-trip time, a range-extending-type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle. The response signal is relayed from the slave device to the vehicle by the attacking device and modified by the attacking device. The master device is configured to perform a countermeasure in response to detection of the range extension type relay attack.

In further features and at all times at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

In further features and at all times, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

In further features, the master device or the first sniffer device is configured to: determine a first amount of time for the first sniffer device to receive the challenge signal and a second amount of time for the sniffer device to receive the response signal; and estimating the distance based on the first amount of time and the second amount of time.

In further features, the system additionally includes a second sniffer and a third sniffer. The second sniffer device includes a third antenna module having third antennas and a third receiver configured to receive, via the third antenna module, the challenge signal from the transmitter and the response signal from the slave device. The third sniffer device includes a fourth antenna module having fourth antennas and a fourth receiver configured to receive, via the fourth antenna module, the challenge signal from the transmitter and the response signal from the slave device. The second sniffer device is configured to measure when the challenge signal and the response signal arrive at the second sniffer device to provide arrival times. The third sniffer device is configured to measure when the challenge signal and the response signal arrive at the third sniffer device to provide arrival times. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the arrival times provided by the first sniffer device, the arrival times provided by the second sniffer device, and the arrival times provided by the third sniffer device.

In further features, the first sniffer device is configured to determine a first amount of time for the first sniffer device to receive the response signal. The second sniffer device is configured to determine a second amount of time for the second sniffer device to receive the response signal. The third sniffer device is configured to determine a third amount of time for the third sniffer device to receive the response signal. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the first amount of time, the second amount of time, and the third amount of time.

In further features, the master device is configured to periodically transmit the challenge signal or further challenge signals to the slave device and receive respective response signals from the slave device. The first sniffer device is configured to measure when the challenge signals and the response signals arrive at the first sniffer device to provide corresponding arrival times. The master device or the first sniffer device is configured to (i) update the at least one of the distance or the location based on the arrival times associated with the challenge signals and the response signals, and (ii) prevent at least one of the one of accessing or controlling operation of the vehicle based on the at least one of the updated distance or the updated location.

In other features, a method of accessing or providing operational control from a vehicle is provided. The method includes: transmitting a challenge signal from a master device of the vehicle to a slave device via a first antenna module, the first antenna module including first antennas with different polarized axes; receiving, at a first receiver, a response signal in response to the challenge signal from the slave device; receiving, at a first sniffer device, via a second antenna module and a second receiver, the challenge signal from the master device and the response signal from the slave device, the second antenna module comprising second antennas with different polarized axes; measuring when the challenge signal and the response signal are received at the first sniffer device to provide times of arrival across the first sniffer device; estimating at least one of a distance from the vehicle to the slave device or a location of the slave device relative to the vehicle based on the arrival times; and preventing at least one of access to or operational control of the vehicle based on the estimated one of the distance and the location.

In further features, the method includes: determining a round trip time associated with transmission of the challenge signal based on the arrival times; Detecting, based on the round-trip time, a range-extending-type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle, wherein the response signal is relayed via the attacking device from the slave device to the vehicle and is altered by the attacking device; and performing a countermeasure in response to detection of the range-extending type relay attack.

In further features and at all times at least one of the first antennas of the first antenna module is not cross polarized with at least one of the second antennas of the second antenna module.

In further features and at all times, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

In further features, the method additionally comprises: determining a first amount of time for the first sniffer device to receive the challenge signal and a second amount of time for the sniffer device to receive the response signal; and estimating the distance based on the first amount of time and the second amount of time.

In further features, the method additionally comprises: receiving, at a third receiver of a second sniffer device, via a third antenna module, the challenge signal from the transmitter and the response signal from the slave device, wherein the third antenna module comprises third antennas with different polarized axes ; and receiving, at a fourth receiver of a third sniffer device, via a fourth antenna module, the challenge signal from the transmitter and the response signal from the slave device. The fourth antenna module includes fourth antennas with different polarized axes. The method additionally includes: measuring when the challenge signal and the response signal arrive at the second sniffer device to provide arrival times via the second sniffer device; measuring when the challenge signal and the response signal arrive at the third sniffer device to provide arrival times across the third sniffer device; and estimating the location based on the arrival times provided by the first sniffer device, the arrival times provided by the second sniffer device, and the arrival times provided by the third sniffer device.

In further features, the method additionally comprises: determining a first amount of time for the first sniffer device to receive the response signal; determining a second amount of time for the second sniffer device to receive the response signal; determining a third amount of time for the third sniffer device to receive the response signal; and estimating the location based on the first amount of time, the second amount of time, and the third amount of time.

In further features, the master device periodically transmits the challenge signal or further challenge signals to the slave device and receives respective response signals from the slave device; measuring, at the first sniffer device, when the challenge signals and the response signals arrive at the first sniffer device to provide corresponding arrival times; updating the at least one of the distance and the location based on the arrival times associated with the challenge signals and the response signals; and preventing at least one of access to or operational control of the vehicle based on the at least one of the updated distance or the updated location.

In further features, a system for accessing or providing operational control from a vehicle is provided. The system includes a first network device and a control module. The first network device includes a first antenna module, a transmitter, and a receiver. The first antenna module includes antennas with different polarized axes. The transmitter is configured to transmit a sequence of tones via the first antenna module from the vehicle to a second network device and change the frequencies of the tones during the transmission of the sequence of tones. At any point in time, at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device. The receiver is configured to receive the sequence of tones from the second network device. The control module is configured to (i) determine differences in phases of the succession of tones versus differences in frequencies of the succession of tones, (ii) determine a distance between the first network device and the second network device based on the differences in the phases and the differences in the frequencies, and (iii) preventing at least one of access to or operational control of the vehicle based on distance.

In further features, the control module is configured to: change, for each of the tones, a corresponding frequency during/on transmission of that tone; generating curves, respectively for the tones, relating changes in phases of each of the tones to changes in frequencies; determining slopes of the curves; and determining the distance based on the slopes of the curves.

In further features, the control module randomizes a channel selected for transmission of the sequence of tones.

In further features, the control module randomizes a direction in which tones are transmitted between the first network device and the second network device. The tones include one or more of the tones in the sequence of tones.

In further features, the control module is configured to: transmit and receive a sequence of tones via the transmitter and the receiver; and determining the distance based on differences in phases and corresponding differences in frequencies of the succession of tones.

In further features, the system additionally includes the second network device. The first network device includes a first tone exchange responder and a first tone exchange initiator. The first tone exchange initiator includes the transmitter. The first tone exchange responder includes the receiver. The second network device includes a second tone exchange responder and a second tone exchange initiator. The second tone exchange responder responds to the burst of tones by transmitting the burst of tones or a second burst of tones back to the first tone exchange initiator. The second tone exchange initiator transmits a third sequence of tones to the first tone exchange responder.

In further features, the control module is configured to determine the distance based on at least one of (i) differences in phases of the second succession of tones versus differences in frequencies of the second succession of tones or (ii) differences in phases of the third succession of tones versus differences of frequencies of the third succession of tones.

In further features, the first network device is implemented within the vehicle. The second network device is a portable access device.

In further features, the first network device simultaneously transmits two symbols on two different frequencies to the second network device. The two symbols are each less than or equal to 1 µs in length to prevent a successful attack.

In further features, clock timings/timings of the first network device and the second network device are synchronized. The first network device transmits a first symbol to the second network device on a first frequency. The second network device transmits a second symbol to the first network device concurrently with the transmission of the first symbol by the first network device to the second network device. The first symbol and the second symbol are each less than or equal to 1 µs in length to prevent a successful attack.

In further features, a method of accessing and providing operational control from a vehicle is provided. The method comprises: transmitting a sequence of tones from a first network device via a transmitter and a first antenna module to a second network device and changing the frequencies of the tones during the transmission of the sequence of tones, wherein the first antenna module comprises antennas, and wherein to at any time at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device; receiving, at a receiver in the vehicle, the sequence of tones from the second network device; determining differences in phases of the succession of tones versus differences in frequencies of the succession of tones; determining a distance between the first network device and the second network device based on the difference in phase and the difference in frequency; and preventing at least one of access to or operational control of the vehicle based on the distance.

In further features, the method additionally comprises: changing, for each of the tones, a corresponding frequency during/on transmission of that tone; generating curves, respectively for the tones, relating changes in phases of each of the tones to changes in frequencies; determining slopes of the curves; and determining the distance based on the slopes of the curves.

In further features, the method additionally includes randomizing a channel selected for transmission of the sequence of tones.

In further features, the method additionally includes randomizing a direction in which tones are transmitted between the first network device and the second network device. The tones include one or more of the tones in the sequence of tones.

In further features, the method additionally comprises: transmitting and receiving a sequence of tones via the transmitter and the receiver; and determining the distance based on differences in phases and corresponding differences in frequencies of the succession of tones.

In further features, the method additionally comprises: responding to the sequence of tones via a second tone exchange responder of the second network device by transmitting the sequence of tones or a second sequence of tones back to a first tone exchange initiator of the first network device, the first tone exchange -Initiator includes the transmitter; and transmitting a third sequence of tones via a second tone exchange initiator of the second network device to a first tone exchange responder of the first network device, the first tone exchange responder comprising the receiver.

In further features, the method additionally comprises determining the distance based on at least one of (i) differences in phases of the second succession of tones versus differences in frequencies of the second succession of tones or (ii) differences in phases of the third succession of tones versus differences of Frequencies of the third sequence of tones.

In further features, the first network device is implemented in the vehicle. The second network device is a portable access device.

In further features, a system for accessing or providing operational control from a vehicle is provided. The system includes an initiator device and a sniffer device. The initiator device includes: a first antenna module having multiple polarized antennas; a transmitter configured to transmit a first audio signal via the first antenna module from the vehicle to a responder device, the responder device being a portable entry device; a first receiver configured to receive a second audio signal from the responder device in response to the first audio signal. The sniffer device includes: a second antenna module having multiple polarized antennas; and a second receiver configured to receive, via the second antenna module, the first audio signal from the transmitter and the second audio signal from the responder device. The sniffer device is configured to determine states of the first audio signal and the second audio signal including respective phase delays. The initiator device or the sniffer device is configured to (i) estimate at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the the first audio signal and the second audio signal comprising respective phase delays, and (ii) preventing at least one of access to or operational control of the vehicle based on the estimated one of the first distance and the second distance.

In further features, the initiator device or the sniffer device is configured to estimate the first distance and the second distance and prevent at least one of access to or operational control of the vehicle based on the first distance and the second distance.

In further features, the initiator device or the sniffer device is configured to detect, based on at least one of the first distance or the second distance, a range-extending-type relay attack performed by an attacking device to at least one of access to or operational control obtained from the vehicle. The second audio signal is relayed from the responder device to the vehicle and modified by the offending device. The initiator device is configured to perform a countermeasure in response to detection of the range extension type relay attack.

In further features and at all times, at least one of the plurality or multi-polarized antennas of the first antenna module is not cross-polarized with at least one of the plurality or multi-polarized antennas of the second antenna module.

In other features, and at all times, at least one of the multiple or multi-polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

In further features, the initiator device or the sniffer device is configured to: determine, based on the state of the first tone signal when received at the responder device, a first amount of time for the first tone signal to propagate from the initiator device to the responder device; determining, based on the state of the second tone signal when received at the sniffer device, a second amount of time for the second tone signal to propagate from the responder device to the sniffer device; and estimating the first distance and the second distance based on the first amount of time and the second amount of time.

In further features, the initiator device or the sniffer device is configured to: generate a first representation of the first audio signal when received at the responder device in the form of a natural logarithm; generating a second representation of the first audio signal as received at the sniffer device in the form of a natural logarithm; generating a third representation of the second audio signal when received at the sniffer device in the form of a natural logarithm; and estimating the first distance and the second distance based on the first representation, the second representation, and the third representation.

In further features, a method of accessing or providing operational control from a vehicle is provided. The method comprises: transmitting a first audio signal via a first antenna module from an initiator device of the vehicle to a responder device, wherein the first antenna module comprises multiple antennas and wherein the responder device is a portable entry device; receiving, at the initiator device, a second tone signal from the responder device in response to the first tone signal; Received on a Sniffer-Vor direction and via a second antenna module, the first audio signal from the transmitter and the second audio signal from the responder device, wherein the second antenna module comprises multiple or multi-polarized antennas; determining, at the sniffer device, states of the first audio signal and the second audio signal including respective phase delays; estimating at least one of a first distance from the vehicle to the responder device and a second distance from the responder device to the sniffer device based on the states of the first audio signal and the second audio signal including respective phase delays; and preventing at least one of access to or operational control of the vehicle based on the estimated at least one of the first distance and the second distance.

In further features, the method includes: estimating the first distance and the second distance; and preventing at least one of access to or operational control of the vehicle based on the first distance and the second distance.

In further features, the method additionally includes: detecting, based on at least one of the first distance and the second distance, a range-extending-type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle, wherein the second audio signal is relayed from the responder device to the vehicle and modified by the offending device; and performing a countermeasure in response to detection of the range-extending type relay attack.

In further features and for each target operating point, at least one of the multiple or multiply polarized antennas of the first antenna module is not cross-polarized with at least one of the linearly polarized antenna or the multiple or multiply polarized antennas.

In other features, and at all times, at least one of the multiple or multi-polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

In further features, the method additionally comprises: determining, based on the state of the first tone signal when received at the responder device, a first amount of time for the first tone signal to propagate from the initiator device to the responder device; determining, based on the state of the second tone signal when received at the sniffer device, a second amount of time for the second tone signal to propagate from the responder device to the sniffer device; and estimating the first distance and the second distance based on the first amount of time and the second amount of time.

In further features, a system for accessing or providing operational control from a vehicle is provided. The system includes a first network device and a control module. The first network device includes a first antenna module and a control module. The first antenna module includes multiple or multi-polarized antennas; a transmitter configured to transmit an initiator packet via the first antenna module from the vehicle to the second network device, the initiator packet comprising a synchronization access word and a first continuous wave (CW) tone, one of the first Network device and the second network device is implemented within the vehicle, and wherein the other of the first network device and the second network device is a portable access device, and wherein at any time at least one of the plurality or multi-polarized antennas of the first antenna module is not connected to an antenna of second network device is cross polarized; and a receiver configured to receive a response packet from the second network device, the response packet including the synchronization access word and the first CW tone. The control module is configured to (i) determine that a difference in round-trip time between the initiator packet and the response packet is greater than a predetermined threshold, (ii) detect, based on a time difference being greater than the predetermined threshold, a range extension type - relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle, and (iii) preventing at least one of access to or operational control of the vehicle in response to detection of the range extension type relay attack.

In further features, the control module is configured to: determine, based on the initiator packet, a start time and an end time for the synchronization gateword; and detecting the time difference based on the start time and the end time.

In further features, the control module is configured to: determine, based on the initiator packet, a start time and an end time for the synchronization access word relative to the first CW tone of the response packet; determining whether a start time and end time of the synchronization gateword of the response packet match the determined start time and end time; and detecting the time difference when the start time and end time of the synchronization entry word of the response packet do not match the determined start time and end time.

In further features, the control module is configured to: determine a first length of the synchronization gateword of the initiator packet; comparing the first length to a second length of the synchronization access word of the response packet; and detecting the range-extending-type relay attack when a difference between the first length is greater than a predetermined amount different from the second length.

In further features, the control module is configured to: determine a first length of the first CW tone of the initiator packet; comparing the first length to a second length of the first CW tone of the response packet; and detecting the range-extending-type relay attack when a difference between the first length is greater than a predetermined amount different from the second length.

In further features, the first CW tone of the initiator packet is at an end of the initiator packet; and is/is the first CW tone of the response packet at a beginning of the response packet.

In other features, the initiator packet includes a second CW tone. The response packet includes the second CW tone.

In other features, the first CW tone of the initiator packet is at a beginning of the initiator packet. The second CW tone of the initiator packet is at an end of the initiator packet. The first CW tone of the response packet is at a beginning of the response packet. The second CW tone of the response packet is at an end of the response packet.

In other features, the initiator packet and the response packet have the same format.

In further features, the response packet indicates an amount of phase difference between the second CW tone of the initiator packet and the first CW tone of the response packet. The first CW tone of the reply packet is in phase relation with a phase locked loop of the responder.

In further features, the control module is configured to determine the phase difference between the first CW tone of the response packet and the second CW tone of the initiator packet. The second CW tone of the initiator packet is in phase relationship with a phase locked loop of the initiator. The first device and the second device are configured to determine a phase difference for a second frequency and a phase difference for a third frequency. The control module is configured to determine a distance between the devices based on (i) the phase difference between the first CW tone and the second CW tone, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency .

In further features, the control module is configured to compare a frequency, power levels, bits, and amplitudes of a portion of a received signal that includes the response packet to a frequency, power levels, bits, and amplitudes of a portion of a transmitted signal that includes the initiator packet and determining whether the range extension type relay attack has occurred based on resulting differences.

In further features, a method of accessing and providing operational control from a vehicle is provided. The method includes: transmitting an initiator packet via a first antenna module of a first network device from the vehicle to a second network device, the first antenna module comprising multiple or multi-polarized antennas, the initiator packet including a synchronization access word and a first continuous wave (CW) audio, wherein one of the first network device and the second network device is implemented within the vehicle, and wherein the other of the first network device and the second network device is a portable access device, and wherein at any time at least one of the plurality of .Multiple polarized antennas of the first antenna module do not mesh with an antenna of the second movement device is cross-polarized; receiving a response packet from the second network device, the response packet including the synchronization access word and the first CW tone; determining that a time difference between the initiator packet and the response packet is greater than a predetermined threshold; detecting, based on a time difference being greater than the predetermined threshold, a range-extending-type relay attack performed by an attacking device to gain at least one of access to or operational control from the vehicle; and preventing at least one of access to or operational control of the vehicle in response to detection of the range-extending-type relay attack.

In further features, the method additionally comprises: determining, based on the initiator packet, a start time and an end time for the synchronization gateword; and detecting the time difference based on the start time and the end time.

In further features, the method additionally comprises: determining, based on the initiator packet, a start time and end time for the synchronization access word relative to the first CW tone of the response packet; determining whether a start time and end time of the synchronization entry word of the response packet match the determined start time and end time; and detecting the time difference when the start time and end time of the synchronization entry word of the response packet do not match the determined start time and end time.

In further features, the first CW tone of the initiator packet is at an end of the initiator packet; and is/is the first CW tone of the response packet at a beginning of the response packet.

In other features, the initiator packet includes a second CW tone. The response packet includes the second CW tone. The first CW tone of the initiator packet is at a beginning of the initiator packet. The second CW tone of the initiator packet is at an end of the initiator packet. The first CW tone of the response packet is at a beginning of the response packet. The second CW tone of the response packet is at an end of the response packet.

In further features, the method additionally includes determining a round trip time of the initiator packet based on an amount of phase delay. The response packet denotes the amount of phase delay between the first CW tone of the initiator packet and the first CW tone of the response packet.

In further features, a system for detecting a range-extending-type relay attack is provided. The system includes a transmitter, a receiver, and a control module. The transmitter is configured to transmit a radio frequency signal from one of a vehicle and a portable entry device to the other of the vehicle and the portable entry device. The receiver is configured to receive a response signal from one of the vehicle and the portable access device in response to the radio frequency signal. The control module is configured to: convert the response signal into an in-phase signal and a quadrature-phase signal; detecting, based on the radio frequency/radio frequency signal, the in-phase signal and the quadrature-phase signal, the range-extending-type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle, wherein at least one of: (i) the radio frequency signal is relayed from the vehicle to the portable access device via the offending device, or (ii) the response signal is relayed from the portable access device to the vehicle via the offending device; and performing a countermeasure in response to detection of the range-extending type relay attack.

In other features, the system also includes an antenna module. The antenna module is implemented on the one of the vehicle and the portable access device where the transmitter and the receiver are implemented. The antenna module includes several or multiply polarized antennas. At any point in time, at least one of the multiple polarized antennas of the antenna module is not cross-polarized with one antenna of the other of the vehicle and the portable entry device.

In other features, the control module is implemented on the vehicle. In other features, the control module is implemented on the portable entry device.

In further features, the control module is configured to: determine a phase difference based on the in-phase signal and the quadrature-phase signal; measuring a round trip time of the radio frequency signal based on the phase difference; and detecting the range extension type relay attack based on the round trip time.

In further features, the control module is configured to: sample the in-phase signal and the quadrature-phase signal; and determining received bits based on the in-phase signal and the quadrature-phase signal.

In further features, the control module is configured to: upsample the received bits on the in-phase signal and the quadrature-phase signal; upsampling another signal; cross-correlating results of upsampling the received bits based on the in-phase signal and the quadrature-phase signal with results of upsampling the other signal; and determining the phase based on the results of the cross-correlation.

In further features, the other signal includes a reference bit pattern. The control module is configured to determine a sign of the differentiated arctangent signal and generate the reference bit pattern based on the sign. In further features, the other signal comprises the radio frequency signal after being filtered via a Gaussian low-pass filter.

In further features, a method for detecting a range-extending-type relay attack is provided. The method includes: transmitting, via a transmitter, a radio frequency signal from one of a vehicle and a portable access device to the other of the vehicle and the portable access device; receiving a response signal via a receiver from one of the vehicle and the portable access device in response to the radio frequency signal; converting, via a control module, the response signal into an in-phase signal and a quadrature-phase signal; detecting, based on the radio frequency signal, the in-phase signal and the quadrature phase signal, via the control module, the range-extending-type relay attack performed by an attacking device to at least one of access to or operational control of the vehicle where at least one of: (i) the radio frequency signal is relayed via the offending device from the vehicle to the portable access device, or (ii) the response signal is relayed via the offending device from the portable access device to the Vehicle forwarded; and performing a countermeasure in response to detection of the range-extending type relay attack.

In further features, an antenna module is implemented on the one of the vehicle and the portable access device where the transmitter and the receiver are implemented. The antenna module includes several or multiply polarized antennas. At any point in time, at least one of the multiple polarized antennas of the antenna module is not cross-polarized with one antenna of the other of the vehicle and the portable entry device.

In other features, the control module is implemented on the vehicle. In other features, the control module is implemented on the portable entry device.

In further features, the method additionally includes: determining a phase difference based on the in-phase signal and the quadrature-phase signal; measuring a round trip time of the radio frequency signal based on the phase difference; and detecting the range extension type relay attack based on the round trip time.

In further features, the method additionally comprises: sampling the in-phase signal and the quadrature-phase signal; and determining received bits based on the in-phase signal and the quadrature-phase signal.

In further features, the method additionally comprises: upsampling the received bits based on the in-phase signal and the quadrature-phase signal; cross-correlating results of upsampling the received bits with results of upsampling the other signal; and determining the phase based on the results of the cross-correlation. In further features, the other signal includes a reference bit pattern. In further features, the other signal comprises the radio frequency signal after being filtered via a Gaussian low-pass filter.

Further areas of applicability of the present disclosure will become apparent from the detailed description, claims, and drawings. The detailed description and specific examples are intended for purposes of illustration only and are not intended to limit the scope of the disclosure.

character list

• 1 ist eine Seitenansicht eines Objekts, die ein primäres RF-Signal höherer Leistung veranschaulicht, das sich aufgrund einer Kreuzpolarisation von RF-Antennen entlang eines Abprallwegs ausbreitet;
• 2 ist ein funktionales Blockschaltbild eines Beispiels eines Fahrzeugzugangssystems mit einem Zugangsmodul, RF-Antennen und tragbaren Zugangsvorrichtungen gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 3 ist ein funktionales Blockschaltbild eines Beispiels eines Fahrzeugs mit dem Zugangsmodul von 2 gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 4 ist ein funktionales Blockschaltbild eines Beispiels des Zugangsmoduls von 2 gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 5 ist ein funktionales Blockschaltbild eines Beispiels eines RF-Antennenmoduls eines Fahrzeugs gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 6 ist ein funktionales Blockschaltbild eines Beispiels einer tragbaren Netzwerkvorrichtung gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 7 ist ein Beispiel eines Polarisationsachsendiagramms, das ein Beispiel einer Anordnung bzw. Ausgestaltung von/für Polarisationsdiversität gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung veranschaulicht;
• 8 ist ein Beispiel eines Polarisationsachsendiagramms, das ein weiteres Beispiel einer Anordnung bzw. Ausgestaltung von/für Polarisationsdiversität gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung veranschaulicht;
• 9 ist ein Beispiel eines elektrischen Felddiagramms und eines Polarkoordinatendiagramms, die elektrische Feldmuster und Nullen bzw. Nullstellen für eine lineare Antenne veranschaulichen;
• 10 ist ein Beispiel einer Darstellung von Spannung gegenüber elektrischem Feld für eine linear polarisierte Antenne;
• 11A ist eine perspektivische Draufsicht eines Beispiels von zumindest einem Teil einer mehrachsig polarisierten RF-Antennenanordnung mit einer linear polarisierten Antenne und einer zirkular polarisierten Antenne gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 11B ist eine perspektivische Unteransicht von dem zumindest einen Teil der mehrachsig polarisierten FR-Antennenanordnung von 11A;
• 12 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit der linear polarisierten Antenne von 11A-B;
• 13 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit der zirkular polarisierten Antenne von 11A-B;
• 14 ist ein funktionales Blockschaltbild eines Beispiels von RF-Schaltungen und eines Teils einer tragbaren Zugangsvorrichtung gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 15 ist ein Blockschaltbild eines Beispiels eines Teils eines Schlüsselanhängers mit zwei linear polarisierten Schlitzantennen, Metallverkleidung und Ersatz-/ Reserveschlüssel gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 16 ist ein Blockschaltbild eines Beispiels eines Teils des Schlüsselanhängers von 15 ohne Metallverkleidung und Ersatz-/Reserveschlüssel, der eine hinsichtlich einer x-Achse linear polarisierte Schlitzantenne und eine hinsichtlich einer y-Achse linear polarisierte Schlitzantenne aufweist;
• 17 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer x-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 16;
• 18 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer y-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 16;
• 19 ist ein Beispiel eines Rückflussdämpfung-Frequenz-Diagramms für die linear polarisierten Schlitzantennen von 16;
• 20 ist ein Blockschaltbild eines Beispiels eines Teils des Schlüsselanhängers von 15 ohne Metallverkleidung und mit Ersatz-/Reserveschlüssel;
• 21 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer x-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 20;
• 22 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer y-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 20;
• 23 ist ein Beispiel eines Rückflussdämpfung-Frequenz-Diagramms für die linear polarisierten Schlitzantennen von 20;
• 24 ist ein Blockschaltbild eines Beispiels eines Teils des Schlüsselanhängers von 15 mit einem Teil der Metallverkleidung und Ersatz-/Reserveschlüssel;
• 25 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer x-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 24;
• 26 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer y-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 24;
• 27 ist ein Beispiel eines Rückflussdämpfung-Frequenz-Diagramms für die linear polarisierten Schlitzantennen von 24;
• 28 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer x-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 15;
• 29 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer y-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 15;
• 30 ist ein Beispiel eines Rückflussdämpfung-Frequenz-Diagramms für die linear polarisierten Schlitzantennen von 15;
• 31 ist ein Blockschaltbild eines Beispiels eines Teils eines Schlüsselanhängers mit einer geschlossenen linear polarisierten Schlitzantenne, einer offenen linear polarisierten Schlitzantenne, Metallverkleidung und Ersatz-/Reserveschlüssel gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 32 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer x-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 31;
• 33 ist ein Beispiel eines Polarkoordinatendiagramms von Strahlungsleistung in Zusammenhang mit einer hinsichtlich einer y-Achse linear polarisierten Schlitzantenne des Teils des Schlüsselanhängers von 31;
• 34 ist ein Beispiel eines Rückflussdämpfung-Frequenz-Diagramms für die linear polarisierten Schlitzantennen von 31;
• 35 veranschaulicht ein Verfahren zum Bestimmen, welche Antennenkombination zum Austauschen von Paketen zwischen RF-Antennenmodulen von einem Fahrzeug und einer tragbaren Zugangsvorrichtung für Umlauf-Flugzeit-Messungen zu verwenden ist, gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 36 veranschaulicht ein weiteres Verfahren zum Bestimmen, welche Antennenkombination zum Austauschen von Pakten zwischen RF-Antennenmodulen von einem Fahrzeug und einer tragbaren Zugangsvorrichtung für Umlauf-Flugzeit-Messungen zu verwenden ist, gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 37 ist ein Diagramm für eine Flugzeitmessung;
• 38 ist ein funktionales Blockschaltbild eines Beispiels einer BLE-Funkeinheit mit einem Superheterodynempfänger und einem Sender gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 39 ist ein Beispiel eines GFSK-Parameter-Definitionsdiagramms;
• 40 ist ein funktionales Blockschaltbild eines Systems zum Übertragen von BLE-Paketen;
• 41 zeigt beispielhafte Präambeln und Zugangsadressen für BLE-Pakete unterschiedlicher Typen;
• 42 ist ein beispielhaftes Diagramm von BLE-Paketsignalen, das entsprechende Bits veranschaulicht;
• 43 ist ein weiteres beispielhaftes Diagramm von anderen BLE-Paketsignalen, das entsprechende Bits veranschaulicht;
• 44 ist ein Überlappungsdiagramm von BLE-Paketsignalen von 44, wobei eines der BLE-Paketsignale relativ zu dem anderen der BLE-Paketsignale verschoben wurde;
• 45 veranschaulicht ein beispielhaftes Verfahren zum Detektieren eines Reichweitenvergrößerungstyp-Relaisangriffs gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 46 ist ein funktionales Blockschaltbild eines Beispiels von einem Fahrzeug und einer tragbaren Zugangsvorrichtung mit jeweiligen Umlaufzeit-Initiatoren und Umlaufzeit-Respondern gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 47 ist ein funktionales Blockschaltbild von dem Fahrzeug und der tragbaren Zugangsvorrichtung von 46, das eine Hochfrequenzsignalübertragung über entsprechende Antennen veranschaulicht;
• 48 ist ein funktionales Blockschaltbild von dem Fahrzeug und der tragbaren Zugangsvorrichtung von 46, die einen Angriff durch eine angreifende Relaisvorrichtung des Reichweitenvergrößerungstyps erfahren;
• 49 ist ein funktionales Blockschaltbild von zwei Beispielen von BLE-Funkeinheiten gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 50 ist ein funktionales Blockschaltbild eines beispielhaften Orts- und Distanzbestimmungssystems mit einem Umlaufzeit-Sniffer gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 51 ist ein funktionales Blockschaltbild eines beispielhaften Orts- und Distanzbestimmungssystems mit mehreren Umlaufzeit-Sniffern gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 52 ist ein funktionales Blockschaltbild von beispielhaften Netzwerkvorrichtungen, die zum Durchführen eines Tonaustauschs zur Distanzbestimmung und Angriffsdetektion konfiguriert sind, gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 53 ist ein funktionales Blockschaltbild eines beispielhaften Ortsbestimmungssystems mit einem Tonaustausch-Sniffer gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 54 veranschaulicht ein Verfahren zum Bestimmen von Distanzen zwischen einem Initiator und einem Responder und zwischen einem Responder und einem Sniffer gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 55 ist ein funktionales Blockschaltbild eines beispielhaften passives Tonaustausch- und Phasendifferenzdetektionssystems gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 56 ist ein funktionales Blockschaltbild eines Beispiels eines aktiven Tonaustausch- und Phasendifferenzdetektionssystems gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 57 ist eine Darstellung von beispielhaften Initiator- und Responder-Paketen, die für RSSI- und Flugzeit-Messungen verwendet werden, wobei die Pakete einen Kontinuierliche-Welle-(CW-)Ton und eine Präambel umfassen, gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 58 ist eine Darstellung von beispielhaften Initiator- und Responder-Paketen, die für RSSI- und Flugzeit-Messungen verwendet werden, wobei die Pakete einen CW-Ton und keine Präambel umfassen, gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 59 ist eine Darstellung von beispielhaften Initiator- und Responder-Paketen, die für RSSI- und Flugzeit-Messungen verwendet werden, wobei die Pakete in dem gleichen Format vorliegen und mehrere CW-Töne und keine Präambel umfassen, gemäß einem Ausführungsbeispiel der vorliegenden Offenbarung;
• 60 ist eine Darstellung, die beispielhafte Initiator- und Responder-Pakete mit einem gleichen Format gemäß einem weiteren Ausführungsbeispiel der vorliegenden Offenbarung veranschaulicht;
• 61 ist ein funktionales Blockschaltbild eines Antennenweg-Bestimmungssystems für Netzwerkvorrichtungen mit jeweiligen Antennenmodulen gemäß einem weiteren Ausführungsbeispiel der vorliegenden Offenbarung;
• 62 ist beispielhaftes Funkeinheitsmodell entsprechend der Struktur, der Funktion und dem Betrieb der BLE-Funkeinheit von 38;
• 63 veranschaulicht ein Verfahren zum Austauschen von Paketen zwischen RF-Antennenmodulen von BLE-Funkeinheiten zum Detektieren eines Reichweitenvergrößerungstyp-Relaisangriffs gemäß einem weiteren Ausführungsbeispiel der vorliegenden Offenbarung;
• 64A ist ein beispielhaftes Diagramm von Signalen, die von einem Abtastungsmodul, einem Gaußschen LPF und einem Integrierer des Modells von 62 ausgegeben werden;
• 64B ist ein beispielhaftes Diagramm von Signalen, die von einem Neuabtastungsmodul des Modells von 62 ausgegeben werden;
• 64C ist ein beispielhaftes Diagramm eines Signals, das von einem Arkustangens-Modul des Modells von 62 ausgegeben wird;
• 64D ist ein beispielhaftes Diagramm eines Signals, das von einem Differenzierer ausgegeben wird, gezeigt über dem Signal, das von dem Gaußschen LPF des Modells von 62 ausgegeben wird;
• 65 veranschaulicht eine Darstellung von unterschiedlichen Paaren von Antennenachsenanordnungen, wobei jede von diesen zwei linearen Polarisationsantennen umfasst, gemäß einem weiteren Ausführungsbeispiel der vorliegenden Offenbarung;
• 66 veranschaulicht eine perspektivische Ansicht eines Paars von Antennenachsenanordnungen mit einer gleichen Anzahl von Antennen, wobei eine von diesen in einem Metallkasten und die andere von diesen außerhalb des Metallkastens angeordnet ist, gemäß einem weiteren Ausführungsbeispiel der vorliegenden Offenbarung;
• 67 veranschaulicht eine perspektivische Ansicht eines weiteren Paars von Antennenachsenanordnungen mit einer unterschiedlichen Anzahl von Antennen, wobei eine von diesen in einem Metallkasten und die andere von diesen außerhalb des Metallkastens angeordnet ist, gemäß einem weiteren Ausführungsbeispiel der vorliegenden Offenbarung;
• 68 ist eine Darstellung, die Distanzbindung/-begrenzung während/bei Durchführung eines schnellen Bitaustauschs veranschaulicht, wobei eine Beweisführersequenz kryptographisch sicher und vorbekannt, unabhängig von einer Prüfersequenz sein kann;
• 69 ist eine Darstellung, die veranschaulicht, dass/wie verhindert wird, dass ein Antwortbit während/bei Durchführung eines eines schnellen Bitaustauschs zu früh ausgesendet wird, wobei eine Beweisführersequenz kryptographisch sicher und abhängig von einer Prüfersequenz sein kann;
• 70 ist eine Seitenansicht von mehreren Antennen, die einen Ankunftswinkel veranschaulicht;
• 71 veranschaulicht ein AOA-Verfahren, umfassend Verwendung eines Music-Algorithmus, gemäß der vorliegenden Offenbarung;
• 72 ist ein Beispiel eines Diagramms von Kovarianz gemäß der vorliegenden Offenbarung;
• 73 ist ein Beispiel eines Diagramms von Eigenvektoren und Feldmannigfaltigkeitsantwort gemäß der vorliegenden Offenbarung;
• 74 ist ein weiteres Beispiel eines Diagramms von Eigenvektoren und Feldmannigfaltigkeitsantwort gemäß der vorliegenden Offenbarung;
• 75 ist ein Beispiel eines Diagramms eines Music-Leistungsspektrum gemäß der vorliegenden Offenbarung;
• 76 ist ein funktionales Blockschaltbild eines Antennenauswahlsystems gemäß der vorliegenden Offenbarung;
• 77 veranschaulicht ein beispielhaftes Rekonstruktionsverfahren gemäß der vorliegenden Offenbarung;
• 78A ist eine Draufsicht eines Fahrzeugs, die eine beispielhafte Platzierung eines Sensors gemäß der vorliegenden Offenbarung veranschaulicht;
• 78B ist eine Seitenansicht des Fahrzeugs von 78A;
• 78C ist eine Rückansicht des Fahrzeugs von 78A, die Abprallreflexionen und entsprechende Wege eines übertragenen Signals, das an dem Sensor detektiert wird, gemäß der vorliegenden Offenbarung veranschaulicht;
• 79A ist eine Draufsicht eines Fahrzeugs, das ein weiteres Beispiel einer Platzierung eines Sensors gemäß der vorliegenden Offenbarung veranschaulicht;
• 79B ist eine Seitenansicht des Fahrzeugs von 79A; und
• 79C ist eine Rückansicht des Fahrzeugs von 79A, die Abprallreflexionen und entsprechende Wege eines übertragenen Signals, das an dem Sensor detektiert wird, gemäß der vorliegenden Offenbarung veranschaulicht.

The present disclosure will become more fully understood from the detailed description and the accompanying drawings, wherein:

• 1 Figure 12 is a side view of an object illustrating a higher power primary RF signal propagating along a bounce path due to cross-polarization of RF antennas;
• 2 12 is a functional block diagram of an example of a vehicle access system including an access module, RF antennas, and portable access devices according to an embodiment of the present disclosure;
• 3 12 is a functional block diagram of an example vehicle having the access module of FIG 2 according to an embodiment of the present disclosure;
• 4 12 is a functional block diagram of an example of the access module of FIG 2 according to an embodiment of the present disclosure;
• 5 12 is a functional block diagram of an example of a vehicle RF antenna module according to an embodiment of the present disclosure;
• 6 12 is a functional block diagram of an example of a portable network device according to an embodiment of the present disclosure;
• 7 12 is an example polarization axis diagram illustrating an example arrangement of/for polarization diversity according to an embodiment of the present disclosure;
• 8th 12 is an example polarization axis diagram illustrating another example arrangement of/for polarization diversity according to an embodiment of the present disclosure;
• 9 Figure 12 is an example electric field diagram and polar coordinate diagram illustrating electric field patterns and nulls for a linear antenna;
• 10 Figure 12 is an example of a voltage versus electric field plot for a linearly polarized antenna;
• 11A 12 is a top perspective view of an example of at least a portion of a multi-axis polarized RF antenna assembly including a linearly polarized antenna and a circularly polarized antenna according to an embodiment of the present disclosure;
• 11B 12 is a bottom perspective view of at least a portion of the multi-axis polarized FR antenna assembly of FIG 11A ;
• 12 12 is an example of a polar coordinate diagram of radiated power associated with the linearly polarized antenna of FIG 11A-B ;
• 13 12 is an example of a polar coordinate diagram of radiant power associated with the circularly polarized antenna of FIG 11A-B ;
• 14 12 is a functional block diagram of an example of RF circuitry and a portion of a portable access device according to an embodiment of the present disclosure;
• 15 12 is a block diagram of an example of a portion of a key fob with two linearly polarized slot antennas, metal shroud, and spare/spare keys according to an embodiment of the present disclosure;
• 16 12 is a block diagram of an example of a portion of the key fob of FIG 15 without metal cladding and spare/spare key having x-axis linearly polarized slot antenna and y-axis linearly polarized slot antenna;
• 17 12 is an example of a polar coordinate plot of radiated power associated with a slot antenna linearly polarized with respect to an x-axis of the key fob portion of FIG 16 ;
• 18 12 is an example of a polar coordinate diagram of radiated power associated with a y-axis linearly polarized slot antenna of the key fob portion of FIG 16 ;
• 19 12 is an example of a return loss versus frequency plot for the linearly polarized slot antennas of FIG 16 ;
• 20 12 is a block diagram of an example of a portion of the key fob of FIG 15 without metal paneling and with spare/spare key;
• 21 12 is an example of a polar coordinate plot of radiated power associated with a slot antenna linearly polarized with respect to an x-axis of the key fob portion of FIG 20 ;
• 22 12 is an example of a polar coordinate diagram of radiated power associated with a y-axis linearly polarized slot antenna of the key fob portion of FIG 20 ;
• 23 12 is an example of a return loss versus frequency plot for the linearly polarized slot antennas of FIG 20 ;
• 24 12 is a block diagram of an example of a portion of the key fob of FIG 15 with part of the metal cladding and spare/spare key;
• 25 12 is an example of a polar coordinate plot of radiated power associated with a slot antenna linearly polarized with respect to an x-axis of the key fob portion of FIG 24 ;
• 26 12 is an example of a polar coordinate diagram of radiated power associated with a y-axis linearly polarized slot antenna of the key fob portion of FIG 24 ;
• 27 12 is an example of a return loss versus frequency plot for the linearly polarized slot antennas of FIG 24 ;
• 28 12 is an example of a polar coordinate plot of radiated power associated with a slot antenna linearly polarized with respect to an x-axis of the key fob portion of FIG 15 ;
• 29 12 is an example of a polar coordinate diagram of radiated power associated with a y-axis linearly polarized slot antenna of the key fob portion of FIG 15 ;
• 30 12 is an example of a return loss versus frequency plot for the linearly polarized slot antennas of FIG 15 ;
• 31 12 is a block diagram of an example of a portion of a key fob with a closed linearly polarized slot antenna, an open linearly polarized slot antenna, metal shroud, and spare/spare keys according to an embodiment of the present disclosure;
• 32 12 is an example of a polar coordinate plot of radiated power associated with a slot antenna linearly polarized with respect to an x-axis of the key fob portion of FIG 31 ;
• 33 12 is an example of a polar coordinate diagram of radiated power associated with a y-axis linearly polarized slot antenna of the key fob portion of FIG 31 ;
• 34 12 is an example of a return loss versus frequency plot for the linearly polarized slot antennas of FIG 31 ;
• 35 12 illustrates a method for determining which antenna combination to use for exchanging packets between RF antenna modules from a vehicle and a portable access device for round-trip time-of-flight measurements, according to an embodiment of the present disclosure;
• 36 FIG. 11 illustrates another method of determining which antenna combination to use for exchanging packets between RF antenna modules from a vehicle and a portable access device for orbital time-of-flight measurements, according to an embodiment of the present disclosure;
• 37 Fig. 12 is a flight time measurement diagram;
• 38 12 is a functional block diagram of an example of a BLE radio having a superheterodyne receiver and a transmitter according to an embodiment of the present disclosure;
• 39 Fig. 12 is an example of a GFSK parameter definition diagram;
• 40 Figure 12 is a functional block diagram of a system for transmitting BLE packets;
• 41 shows example preambles and access addresses for BLE packets of different types;
• 42 Figure 12 is an example diagram of BLE packet signals illustrating corresponding bits;
• 43 Figure 12 is another exemplary diagram of other BLE packet signals, illustrating corresponding bits;
• 44 FIG. 12 is an overlap diagram of BLE packet signals from FIG 44 , wherein one of the BLE packet signals has been shifted relative to the other of the BLE packet signals;
• 45 illustrates an exemplary method for detecting a range-extending-type relay attack, according to an embodiment of the present disclosure;
• 46 12 is a functional block diagram of an example of a vehicle and a portable access device with respective round-trip time initiators and round-trip time responders according to an embodiment of the present disclosure;
• 47 12 is a functional block diagram of the vehicle and portable entry device of FIG 46 Figure 12, which illustrates radio frequency signal transmission via respective antennas;
• 48 12 is a functional block diagram of the vehicle and portable entry device of FIG 46 who are attacked by an attacking range-extending type relay device;
• 49 12 is a functional block diagram of two example BLE radios according to an embodiment of the present disclosure;
• 50 12 is a functional block diagram of an example location and distance determination system with a round-trip time sniffer, according to an embodiment of the present disclosure;
• 51 12 is a functional block diagram of an exemplary location and distance determination system having multiple round-trip time sniffers, according to an embodiment of the present disclosure;
• 52 12 is a functional block diagram of example network devices configured to perform a tone exchange for distance determination and attack detection, according to an embodiment of the present disclosure;
• 53 12 is a functional block diagram of an example location determination system with a tone exchange sniffer, according to an embodiment of the present disclosure;
• 54 FIG. 11 illustrates a method for determining distances between an initiator and a responder and between a responder and a sniffer, according to an embodiment of the present disclosure;
• 55 12 is a functional block diagram of an exemplary passive tone exchange and phase difference detection system according to an embodiment of the present disclosure;
• 56 12 is a functional block diagram of an example of an active tone exchange and phase difference detection system according to an embodiment of the present disclosure;
• 57 12 is an illustration of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, the packets including a continuous wave (CW) tone and a preamble, according to an embodiment of the present disclosure;
• 58 12 is an illustration of example initiator and responder packets used for RSSI and time-of-flight measurements, the packets including a CW tone and no preamble, according to an embodiment of the present disclosure;
• 59 12 is an illustration of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, where the packets are in the same format and include multiple CW tones and no preamble, according to an embodiment of the present disclosure;
• 60 12 is a diagram illustrating example initiator and responder packets having a same format, according to another embodiment of the present disclosure;
• 61 12 is a functional block diagram of an antenna route determination system for network devices having respective antenna modules according to another embodiment of the present disclosure;
• 62 FIG. 12 is an example radio unit model corresponding to the structure, function and operation of the BLE radio unit of FIG 38 ;
• 63 12 illustrates a method for exchanging packets between RF antenna modules of BLE radio units for detecting a range extension type relay attack according to another embodiment of the present disclosure;
• 64A FIG. 14 is an exemplary plot of signals generated by a sampling module, a Gaussian LPF, and an integrator of the model of FIG 62 be issued;
• 64B FIG. 14 is an example diagram of signals generated by a resampling module of the model of FIG 62 be issued;
• 64C FIG. 12 is an example plot of a signal generated by an arctangent module of the model of FIG 62 is issued;
• 64D FIG. 14 is an exemplary plot of a signal output from a differentiator shown versus the signal derived from the Gaussian LPF of the model of FIG 62 is issued;
• 65 12 illustrates an illustration of different pairs of antenna axis arrays, each of which includes two linear polarization antennas, according to another embodiment of the present disclosure;
• 66 12 illustrates a perspective view of a pair of antenna axis assemblies having an equal number of antennas, one of which is placed in a metal box and the other of which is placed outside of the metal box, according to another embodiment of the present disclosure;
• 67 12 illustrates a perspective view of another pair of antenna axis assemblies having a different number of antennas, one of which is placed in a metal box and the other of which is placed outside of the metal box, according to another embodiment of the present disclosure;
• 68 Figure 12 is a diagram illustrating distance binding/limiting during/when performing a fast bit swap, where a prover sequence may be cryptographically secure and a priori known, independent of a prover sequence;
• 69 Fig. 12 is a diagram illustrating how to prevent a response bit from being sent out too early during/when performing a fast bit swap where a prover sequence may be cryptographically secure and dependent on a prover sequence;
• 70 Fig. 12 is a side view of multiple antennas illustrating an angle of arrival;
• 71 illustrates an AOA method including use of a music algorithm, in accordance with the present disclosure;
• 72 Figure 12 is an example of a plot of covariance, in accordance with the present disclosure;
• 73 Figure 12 is an example of a diagram of eigenvectors and field manifold response in accordance with the present disclosure;
• 74 Figure 13 is another example of a diagram of eigenvectors and field manifold response in accordance with the present disclosure;
• 75 Figure 12 is an example of a music power spectrum diagram, in accordance with the present disclosure;
• 76 12 is a functional block diagram of an antenna selection system according to the present disclosure;
• 77 illustrates an exemplary reconstruction method in accordance with the present disclosure;
• 78A 12 is a plan view of a vehicle illustrating an example placement of a sensor in accordance with the present disclosure;
• 78B 12 is a side view of the vehicle of FIG 78A ;
• 78C 12 is a rear view of the vehicle of FIG 78A 14, which illustrates ricochet reflections and corresponding paths of a transmitted signal detected at the sensor, in accordance with the present disclosure;
• 79A 12 is a top view of a vehicle illustrating another example of placement of a sensor according to the present disclosure;
• 79B 12 is a side view of the vehicle of FIG 79A ; and
• 79C 12 is a rear view of the vehicle of FIG 79A 10, which illustrates bounce reflections and corresponding paths of a transmitted signal detected at the sensor, in accordance with the present disclosure.

In the drawings, reference numbers may be reused to designate similar and/or identical elements.

DETAILED DESCRIPTION

RF devices can measure distances through unmodulated carrier tone exchange. For example, in U.S. Patent No. 8,644,768 B2 , which is incorporated herein by reference, provides a system and method for distance measurement between two nodes of a radio network using unmodulated carrier tone exchange.

RF devices can measure or bind/limit distances by round trip time/acceptance of fast exchange of cryptographically secure messages. For example, Brands and Chaum's "Distance-Bounding Protocols (Extended abstract)" in Workshop on the theory and application of cryptographic techniques on Advances in cryptology (EUROCRYPT '93), which is also incorporated herein by reference, describes sequences of fast bit exchanges used between a prover or verifier and a prover. The prover sequence may be cryptographically secure and prior art, independent of the verifier sequence, as required by 68 is illustrated. The prover sequence may be cryptographically secure and dependent on the verifier sequence as determined by 69 is illustrated.

RF devices that measure distance by orbital time/acquisition may be subject to early detection and later confession/deployment attacks, as described in "Attacks on Time-of-Flight Distance Bounding Channels" by Hancke and Kuhn in Proceedings of the first ACM conference on Wireless network security (WiSec '08), which is also incorporated herein by reference. RF devices that measure distance through unmodulated carrier tone exchange may be subject to signal delay extension attacks described in "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan and Capkun from IACR Cyptology ePrint Archive 2016, which is also incorporated herein by reference will.

Although traditional PEPS systems allow for keyless entry and starting of a vehicle, the traditional PEPS systems can be vulnerable to range extender-type relay station attacks. A range extender-type relay station attack may refer to an attacker using a relay device to detect, amplify, and relay signals between a key fob (or other intelligent portable network device) and a vehicle so that an access module of the vehicle operates as if the key fob has approached and is in close proximity to the vehicle. For example, if the attacker touches a door handle of the vehicle with their hand and/or with the relay device, the access module can LF-Up generate and transmit wake-up signal. As a result, the relay device is indeed detected and the access module transmits the LF wake-up signal to the key fob, which is received at the relay device. The relay device receives, amplifies, and relays (or re-broadcasts) the LF wake-up signal to the actual fob. For example, the key fob may be inside a home while the vehicle may be parked outside or in front of the home. The fob can receive the amplified wake-up signal and generate a response signal and/or begin communication on an RF link. The response signal and/or RF communication signals are amplified and relayed between antennas on the vehicle and one or more antennas on the key fob. This can be done via the relay device. As a result, the relay device is viewed by the access module as the key fob and "tricks" the access module into operating as if the key fob were at the location of the relay device, causing the access module to allow unauthorized access to the interior of the Vehicle provides.

Additionally, antenna systems of current PEPS systems may prevent the PEPS system from accurately estimating the distance between the key fob and the vehicle and from accurately estimating the location of the key fob relative to the vehicle, as further described below. The distance and location can be determined based on a flight time measurement. Flight time and corresponding received signal strengths are measured. A received signal strength indicator (RSSI) with the largest value typically corresponds to a direct or shortest distance between the key fob and the vehicle. A time-of-flight measurement associated with the largest RSSI is used to calculate the distance between the key fob and the vehicle.

The examples set forth herein include a combined LF and RF PEPS key fob that uses RF Round Trip Time (RTT) measurements to prevent range extender type relay station attacks. Other examples include RTT measurements, carrier phase-based ranging, and a combination of RTT measurements and carrier phase-based ranging in PEPS systems. The examples also demonstrate numerous other features, which are further described below.

1 Figure 12 shows an example of when/how cross polarization of antennas may cause inaccurate distance determination between a first RF antenna from a key fob and a second RF antenna from a vehicle. If the first RF antenna from the key fob is positioned relative to the second RF antenna from the vehicle such that the first RF antenna is cross-polarized with the second RF antenna, the determined distance corresponds to a bounce path rather than a direct path. path. For example, the antennas are cross-polarized when polarizations of the antennas are perpendicular to each other. An example of this is in 1 shown.

1 Figure 1 shows an object 10 and polarization axes 12, 14 of respective RF antennas. The antennas are linearly polarized antennas. The first RF antenna has a first polarization axis 12 and is located in a vehicle. The second RF antenna has the second polarization axis 14 and is located in a key fob. Due to relative positions of the first RF antenna, the second RF antenna, and the object 10, RF signals 16 transmitted by the antennas may bounce off the object 10. Signal energy (or voltage) corresponding to the ricochet path is greater than signal energy (or voltage) corresponding to a direct path 18 between the antennas. This is due to cross-polarization of RF antennas. An access module that determines a distance between the antennas based on a signal path having the most/greatest signal energy or voltage may inaccurately determine the distance between the antennas as the bounce path 16 length instead of a direct path 18 length.

Also, aligning the nulls in a co-polarized antenna array causes a ricochet path to be used. This occurs when the first and second RF antennas point in the same direction. The antennas may be positioned such that a line extends longitudinally through the antennas. This is with reference to 9 until 10 further described.

Examples set forth herein include polarization diversity for RF signal transmission between RF antennas of a vehicle and RF antennas of portable access devices (eg, key fobs, cell phones, wearables, etc.). In addition, the examples include pseudo-random bi-directional data exchanges. Polarization diversity is provided to ensure that at all times at least one transmit antenna has at least one polarization axis that is not cross-polarized but is reasonably co-polarized with a polarization axis of at least one receive antenna, co-polarized without collinear zeros or zeros. As used herein, the phrase “at all times” means all times while the respective devices are in communication with each other and/or all times while one or more signals are being transmitted between the devices and while one or more signals are being transmitted received by one or more of the devices. In addition to enabling accurate distance determinations, this also helps prevent range extender type relay station attacks. Pseudo-random bi-directional data exchanges, as described below, also help prevent range extender-type relay station attacks.

Exemplary embodiments will now be described more fully with reference to the accompanying drawings.

2 Figure 12 shows a vehicle access system 28 operating as a PEPS system and a PAK system. The vehicle access system 28 includes a vehicle 30 and may include a key fob 32, a cellular phone 34, and/or other portable access devices, such as a wearable, laptop computer, or other portable network device. The portable access devices may be, for example, a Bluetooth@ enabled communication device, such as a smartphone, smart watch, wearable electronic device, key fob, tablet device, or other device associated with a user of the vehicle 30 . The user may be an owner, driver, or passenger of the vehicle 30 and/or a vehicle 30 technician.

The vehicle 30 includes an access module 36, LF antenna modules 38, and RF antenna modules 40. The access module 36 can wirelessly transmit LF signals to the portable network devices via the LF antenna modules 38 and to the portable access devices via the RF antenna modules 40 communicate wirelessly. The RF antenna modules 40 provide polarization diversity between each of the antennas of the portable network devices and the antennas of the RF antenna modules 40 . Polarization diversity, as further described below, provides a minimum number, combination, and arrangement of polarization axes on the portable network devices and vehicle 30 to ensure that at all times at least one transmit antenna has at least one polarization axis that is not compatible with a polarization axis of at least a receiving antenna is cross-polarized. In other words, at all times, at least one RF antenna of the vehicle has at least one polarization axis that is not cross-polarized with a polarization axis of at least one RF antenna of each of the portable access devices. Although specific numbers of LF antenna modules and RF antenna modules are shown, any number of any of these can be used.

The access module 36 can communicate with the LF antenna modules 38 and the RF antenna modules 40 wirelessly and/or via a vehicle interface 45 . As an example, the vehicle interface 45 may include a Controller Area Network (CAN) bus, a Local Interconnect Network (LIN) for lower data rate communication, a Clock Extension Peripheral Interface (CXPI) bus, and /or include one or more other vehicle interfaces.

The LF antenna modules 38 can be located at various locations on the vehicle and transmit low frequency signals (eg, 125 kHz signals). Each of the LF antenna modules includes an LF antenna and may include a control module and/or other circuitry for LF signal transmission. The RF antenna modules 40 can also be located at various locations on the vehicle and transmit RF signals, such as Bluetooth Low Energy (BLE) signals according to BLE communication protocols. Alternatively, the RF antenna modules 40 may communicate according to other wireless communication protocols, such as Wireless Fidelity (Wi-Fi). An example of the antennas is in 11 (the collective on 11A and 11B reference) shown.

In one embodiment, and to improve signal coverage relative to the vehicle and improve transmission and reception characteristics, the RF antenna modules 40 are located in a roof 46 of the vehicle 30. As an example, each of the RF antenna modules 40 can be a pair of RF antennas , a linearly polarized antenna and a circularly polarized antenna. The number and locations of the RF antenna modules may be preselected based on the size and shape of the vehicle 30 . In one embodiment, two RF antenna modules are included and spaced apart as shown in FIG 2 is shown such that the respective electric fields overlap each other to extend in a 360° pattern around the vehicle and beyond an outer perimeter of the vehicle. The electric fields represent a resultant electric box ready as is in 1 what is represented by dashed circles 48 is shown. The dashed circles provide an overall shape that is "rectangular". In larger vehicles, more antenna modules 40 can be added to make the shape more "rectangular". In a small vehicle, only one of the RF antenna modules 40 may be included.

A different number of antennas with a different number of antenna polarizations can be used. 65 until 67 illustrate some other example antenna implementations. 65 until 67 include fewer antennas and antenna polarizations used to measure or limit distances when a diverse set of frequencies and/or RF channels are used to measure or limit distances and/or reflections from metal in a vehicle. This is done to create virtual polarization diversity. The antenna systems are able to tolerate a certain rate or degree of false measurement due to cross-polarization and/or alignment of nulls. In 65 until 67 7100A-J refer to antenna axis arrangements, 7100A-7100I refer to antenna axis arrangements with two polarized axes, and 7100J refers to antenna axis arrangement of/with one polarized axis. The numerical designators 7101A-7101I and 7102A-7102I refer to polarized antenna axes of dual polarized antenna axis arrays. The numeric designator 7101J refers to a single or single polarized axis of 7100J. Numerical designators 7103AB, 7103CD, 7103EF, 7103GH, and 7103JI refer to RF paths between a pair of antenna arrays. Many RF paths exist between antenna axes, some with more link margin, some with less, some with more phase rotation time delay, and some with less. Various round trip time and unmodulated carrier tone exchange ranging algorithms disclosed, described and/or referenced herein have the ability to find or measure shortest paths that are a few decibels (dB) higher or lower in path margin compared to the path with the highest range reserve, which cannot be the shortest. The larger the number of round-trip time or tone exchange measurements that are performed, across more frequencies (or channels), and the more mathematically complex and time-consuming the algorithm, the smaller the margin margin can be on the shortest indirect path found .

The additional antenna axes provide polarization diversity on RF paths between the antenna axis arrays that provide path diversity. Numerical identifier 7200 refers to an open three-sided metal box and/or simplified representation of a vehicle body for RF radio waves in a gigahertz or multi-gigahertz range. Numerical designator 7201 refers to a metal plate and/or lid for the container and/or a simplified representation of the roof of a vehicle for RF radio waves in a gigahertz or multi-gigahertz range. 66 and 67 can also be viewed upside down, where 7200 is a simplified representation of the open concave shape of the roof of a vehicle and 7201 is a simplified representation of the bottom of a vehicle.

The RF link along RF path 7101AB, between 7100A and 7100B, is strong because both pairs of antenna axes are co-polarized between the antenna axis assemblies. For arbitrarily oriented dual axis antenna pairs, this condition is rare, even when the co-polarized zones are wide, about 5 degrees outside of 90 degrees of rotation, at about 6 dB higher in range margin from median range margin. This is because it takes three angular rotations to manipulate/bring an arbitrarily oriented antenna axis array pair into this configuration, and because the antenna axes are symmetrical every 90 degrees, resulting in a time fraction of about (5/90)*(5/ 90)*(5/90) or 1.71E-4 will occur randomly. The RF link along RF path 7101CD, between 7100C and 7100D, is not as strong as 7101AB, but is good as no antenna path/path is co-polarized or cross-polarized and the nulls are not aligned. The RF link along RF path 7101EF, between 7100E and 7100F, is weak because each antenna path/path between individual antenna axes is either cross polarized or involves the null of at least one antenna. This condition is rare because again it takes 3 angular rotations to manipulate/bring a pair of arbitrarily oriented pairs of antenna axes into this configuration. Again, for arbitrarily oriented antenna pairs of dual axis antenna pairs, with for example zones of 5 degrees for cross polarization and null alignment, at for example 20 dB or pow2db(sin(pi*5/180)^2) lower in the Range reserve, three angular rotations to manipulate/bring an arbitrarily oriented pair of antennas into this configuration, and the antenna axes are symmetrical every 90 degrees, resulting in a time fraction of approximately (5/90)*(5/90)*(5/90 ) or 1.71E-4 will occur randomly.

When viewing from 7-8 it is clear that, with three mostly orthogonal axes of polarizations on one side and two mostly orthogonal axes of polarizations on the other side, it is impossible for the nulls to be aligned when/while cross-polarized. With three largely orthogonal axes of polarizations on one side and one polarized axis on the other, nulls can be aligned over two rotations, making this happen arbitrarily.

In general, the more antenna axes there are on each side of a link, the less likely it is that a direct path with low link margin will occur. Preventing or reducing the likelihood of direct paths with lower path margin is advantageous because round-trip time ranging and unmodulated carrier exchange ranging will tend to measure the direct path the greater the path margin on the direct path relative to reflected paths. Conversely, the lower the path margin on the direct path relative to the reflected paths, the more likely it is that the ranging techniques will measure distance along the reflected path.

In 66 applies when: the size of the metal box is sufficiently large relative to the decision limit on the measured distances; measuring the change of distances based on the different reflected paths inside the metal box; and one side of the distance measuring connection is placed inside the metal box, planning of few direct paths can reduce the number of polarized axes needed to get reasonable measurement results. If one of the antenna axes of 7100G is oriented such that the null points along the strongest and/or shortest reflected path in the direction of 7100H, the other antenna axis in 7100G will find a bounce path, which has a strong margin, to one of the antenna axes 7101H or 7102H. This applies in particular when averaging over several channels such as the 37 data channels within a BLE data path. Some of the channel and antenna axis path combinations can quickly fade due to multipath/propagation, but not the majority of these. In any orientation of antenna axis pair 7100G, the range margin to antenna axis pair 7100H is approximately equal, and distances measured along reflected paths 7103IJ will be approximately equal. How the reflected paths 7103GH bounce off the roof 7201 or sidewalls of 7200 will vary, but the overall path variation will be limited by the size and location of components 7200 and 7201. This path change limit will change when 7100G is raised to an altitude where there is a direct path that will shorten the measured distance by eliminating the reflections from path 7103GH. The distance measured between 7100G and 7100H along the reflected paths or shorter direct paths will set a comparison limit denoting that 7100G, which may be part of the portable device, is within a distance threshold of 7100H. 7100H may be part of the PEPS module 211 or the PAKM module 212. These distance measurements between a pair of 7100 modules can be made and compared to be less than a limit. The measurements, distance, and/or results of the comparisons may be used as part of "if-then-else" comparisons in a software decision tree to indicate that the portable entry device 400 is within an approach zone, an unlock zone, and/or a mobilization zone of a vehicle.

67 is similar to 66 , except that antenna axis assembly 7100J includes a single polarized antenna axis 7101J. In one embodiment, the antenna axis assembly 7100J includes only a single or single polarized antenna axis. It is possible to orient 7101J so that the null is oriented towards 7100H along the strongest and/or shortest reflected path. In this case, the round-trip time and unmodulated carrier tone exchange techniques would tend to measure a distance along a path (not shown) that lies off the box 7200 and then bounces back towards the box. It takes two rotations to orient an arbitrarily oriented antenna axis into this orientation, with for example a zone for null alignment with a width of 5 degrees, at for example 20 dB or pow2db(sin(pi*5/180) ^2) lower in range margin since it takes two angular rotations to manipulate/bring an arbitrarily oriented pair of antennas into this configuration and since the antennas are all 90 degrees symmetrical. The orientation occurs randomly at a time fraction of about (5/90)*(5/90) or 3E-3. Apart from an increased proportion of time when a completely different indirect path is measured due to a higher power path reflected off a distant object, this configuration can be used to make and compare distance measurements between a pair of 7100 modules that a measurement is less than a limit. the mes Solutions, the distance, and/or the results of the comparison may be used as part of one or more "if-then-else" comparisons in a software decision tree to denote that the portable entry device 400 is within the proximity zone, the unlocking zone, and/or or the mobilization zone of a vehicle.

Different polarizations of antennas can be used to create polarization diversity. Multiple polarized antennas (or antenna axes) create polarization diversity. One linear axis and another linear axis, one linear axis and two linear axes comprising a circularly polarized antenna, or three independent linear axes (linearly polarized antennas) are all possible. Especially when there is nearby metal to create virtual polarization diversity.

The antenna axis pair 7101H or 7101J can be placed low in a metal box that is the vehicle body or high in the metal box that is the roof of the vehicle to achieve these virtual antenna axis array effects.

3 12 shows a vehicle 200, which is an example of the vehicles 108 of FIG 1 is. The vehicle 200 includes a PAK system 202 that includes a vehicle control module 204, an infotainment module 206, and other control modules 208 (eg, a body control module). The modules 204, 206, 208 can be connected via a controller area network (CAN) bus 209 and/or another vehicle interface (e.g. the vehicle interface 45 of 2 ) communicate with each other. The vehicle control module 204 may control operation of vehicle systems. The vehicle control module 204 may include a PEPS module 211, a PAK module 212, and a parameter adjustment module 213, as well as other modules described in 4 are not shown include. The vehicle control module 204 may also include one or more processors configured to execute instructions stored in/on a non-transitory computer-readable medium, such as the memory 218, which may be read-only memory (ROM) and/or random access memory (RAM). may include.

The PEPS module 211 may perform PEPS operations to provide access to an interior of the vehicle and allow vehicle launch and/or operation. The PAK module 212 works in cooperation with the PEPS module 211 and performs PAK operations as described herein. The PEPS module 211 may include the PAK module 212, or the modules 211, 212 may be implemented as a single module. The parameter adjustment module 213 may be used to adjust vehicle 200 parameters.

The PAK system 202 may additionally include: a memory 218; a display 220; an audio system 221; and one or more transceivers 222 comprising LF antenna modules 38 and RF antenna modules 40. The RF antenna modules 40 may include and/or be connected to RF circuitry 223 . The PAK system 202 may additionally include: a telematics module 225; sensors 226; and a navigation system 227 including a global positioning system (GPS) receiver 228 . RF circuitry 223 may be used to communicate with a mobile device (e.g., mobile device 102 of 1 ) comprising transmission of Bluetooth® signals at 2.4 gigahertz (GHz). The RF circuitry 223 may include BLE radios, transmitters, receivers, etc. for transmitting and receiving RF signals.

The one or more transceivers 222 may comprise an RF transceiver comprising the RF circuitry 223 and implement an access application having code for verifying time-stamped data received and transmitted by the RF antenna modules 40 . The gateway application can confirm or verify whether the RF antenna modules received correct data at the correct time, for example. The access application may be stored in memory 218 and implemented by PEPS module 211 and/or PAK module 212 . Other example operations of the gateway application are described further below.

The access application may implement a Bluetooth® protocol stack configured to provide a channel map, an access identifier, a next channel, and a time for a next channel. The gateway application is configured to output time signals for time stamps for signals transmitted and received via the RF antenna modules 40. The access application can obtain channel map information and time information and share this information with other modules in the vehicle.

The telematics module 225 may communicate with a server via a cellular/mobile tower station. This can include the transmission of certificates, license information and/or time information, including global clock time information. The telematics module 225 is configured to generate location information and/or an error of location information associated with the vehicle 200 . The telematics module 225 may be implemented by a navigation system 227 .

Sensors 226 may include sensors used for PEPS and PAK operations, cameras, object detection sensors, temperature sensors, acceleration sensors, vehicle speed sensors, and/or other sensors. Sensors 226 may include a touch sensor to detect, for example, a person touching a door handle to initiate a process of waking up a portable entry device. The sensors 226 may be connected to the other control modules 208, such as the body control module, which may be in communication with LF and RF antenna circuits and/or modules disclosed herein. The GPS receiver 228 may provide vehicle speed and/or vehicle direction (or heading) and/or global clock time information.

The memory 218 can store sensor data and/or parameters 230, certificates 232, connection information 234, time information 236, tokens 237, keys 238 and applications 239. Applications 239 may include applications executed by modules 38, 40, 204, 206, 208, 210, 211, 212, 223 and/or transceiver 222. As an example, the applications may include the gateway application, a PEPS application, and/or a PAK application executed by transceivers 222 and modules 210, 211, and/or 212. Although memory 218 and vehicle control module 204 are shown as separate devices, memory 218 and vehicle control module 204 may be implemented as a single device. The single device may include one or more other devices listed in 2 are shown.

The vehicle control module 204 may enable operation of an engine 240, a converter/generator 242, a transmission 244, a window/door system 250, a lighting system 252, a seating system 254, a mirror system 256, a braking system 258, electric motors 260, and /or a steering system 262 according to parameters set by the modules 204, 206, 208, 210, 211, 212, 213. The vehicle control module 204 may perform PEPS and/or PAK operations, which may include adjusting some of the parameters. The PEPS and PAK operations may be based on signals received from the sensors 226 and/or the transceivers 222. The vehicle control module 204 may receive power from a power source 264 that is coupled to the engine 240, the converter/generator 242, the transmission 244, the window/door system 250, the lighting system 252, the seating system 254, the mirror system 256, the braking system 258, the electric motors 260 and/or the steering system 262, etc. can be provided. Some of the PEPS and PAK operations may include unlocking doors of the window/door system 250, enabling engine 240 fueling and ignition, starting the electric motors 260, powering any of the systems 250, 252, 254, 256, 258, 262 and/or performing other operations as further described herein.

The engine 240, the converter/generator 242, the transmission 244, the window/door system 250, the lighting system 252, the seating system 254, the mirror system 256, the braking system 258, the electric motors 260 and/or the steering system 262 Include actuators controlled by the vehicle control module 204 to adjust, for example, fueling, ignition, air flow, steering wheel angle, throttle position, pedal position, door locks, window position, seat angle, etc. This control may be based on the outputs of sensors 226, navigation system 227, GPS 228, and the aforementioned data and information stored in memory 218.

4 shows the access module 210. The access module 210 comprises the PEPS module 211, the PAK module 212, the parameter adaptation module 213 and can additionally include a route or link authentication module 300, a connection information distribution module 302, a timing module 304, a sensor processing and localization module 306, a data management module 308 and a security filtering module 310 . The PAK module 212 may include an RTC 312 that maintains a local clock time.

The route authentication module 300 can use the portable access devices of FIG 2 authenticate and establish the secure communication path. For example, the route authentici Configuration module 300 may be configured to implement challenge-response authentication or other cryptographic verification algorithms to authenticate the portable access devices.

The connection information distribution module 302 is configured to communicate with some of the sensors 226 of FIG 3 and for providing the sensors with communications information necessary for the sensors to find and then track or eavesdrop on the secure communications route. This may occur once the sensors are synchronized with a communication gateway, which may be included in or implemented by one of the transceivers 222 . As an example, vehicle 200 and/or PAK system 202 may include any number of sensors installed anywhere on vehicle 200 for detecting and monitoring mobile devices. The connection information distribution module 302 is configured to obtain information corresponding to communication channels and channel switching parameters of a communication route and to transmit the information to the sensors 226. In response to the sensors 226 receiving the information from the connection information distribution module 302 via the vehicle interface 45 and the sensors 226 with the Communication gateway synchronized, the sensors 226 can locate and track or eavesdrop on the communication link.

The timing module 304 may: hold the RTC and/or a currently stored date or time when not handled by the PAK module 212; disseminate current time information with the sensors; generate timestamps for incoming and outgoing messages, requests, signals, certificates and/or other items; calculate turnaround times; etc. A round trip time may refer to the amount or duration between a time a request is generated and/or transmitted and a time a response to the request is received. The timing control module 304 may obtain timing information corresponding to a communication route when the route authentication module 300 performs challenge-response authentication. The timing module 302 is also configured to provide the timing information to the sensors 226 via the vehicle interface 209.

After route authentication is established, the data management module 308 collects the current location of the vehicle 108 from the telematics module 225, and shares the location with the portable entry devices. The portable entry devices optionally include GPS modules and application software that, when executed, compares the estimated relative locations of the portable entry devices to the vehicle 108 . Based on the estimated positions of the portable access devices relative to the vehicle 108, the portable access devices may send signals to one of the transceivers 222 to request that the vehicle perform certain actions. As an example, the data management layer 308 is configured to receive vehicle information obtained by one of the modules (e.g., location information obtained by a telematics module 225) and transmit the vehicle information to the portable access devices.

The security filtering module 310 detects physical layer and protocol violations and filters data accordingly before providing information to the sensor processing and location module 306. The security filtering module 310 marks data as injected so that the sensor processing and Locating module 306 is able to discard data and alert the PEPS module 211. The data from the sensor processing and location module 306 is passed further/together to the PEPS module 211 whereby the PEPS module 211 is configured to read vehicle status information from the sensors to detect a user's intent to access a feature and location of the mobile device 102 to a set of locations that authorize certain vehicle features, such as unlocking a door or trunk of the vehicle and/or starting the vehicle.

5 FIG. 3 is a functional block diagram of the RF antenna module 40, which includes a control module 350 connected to a multi-axis polarized RF antenna assembly 352. FIG. The multi-axis polarized RF antenna assembly 352 may include a linearly polarized antenna, other linearly polarized antennas, and/or a circularly polarized antenna (eg, a right-hand/side circularly polarized antenna or a left-hand/side circularly polarized antenna). An example of the multi-axis polarized RF antennas is in 11 shown. The control module 350 may include or be part of a BLE communication chipset. Alternatively, the control module 350 may include, or be a part of, a Wi-Fi or Wi-Fi Direct communication chipset being. The multi-axis polarized RF antenna assembly 352 may be included as part of the RF antenna module 40 or may be remote from the control module 350 . Some or all of the operations of control module 350 may be performed by one or more of modules 204, 210, 211, 212 of 3 to be implemented.

The control module 350 (or one or more of the modules 204, 210, 211, 212 of 3 ) may establish a secure communications link with a portable access device (e.g., any of portable access devices 32, 34 of 2 ) produce. For example, the control module 350 may establish a secure communication link using the BLE communication protocol, which may include transmitting and/or receiving timing and synchronization information. The timing and synchronization information may include information directed to the secure communications link, such as time of next communications link events, time intervals between communications link events, communications channels for next communications link events, a channel map, a channel hop interval or offset, communications latency information, communications fluctuation information, etc. The Control module 350 may detect (or “listen to”) packets sent by the portable entry device to the vehicle control module 204 and measure signal information of the signals received by the portable entry device. The channel hop interval or offset can be used to calculate a channel for a subsequent communication link event.

The control module 350 can measure a received signal strength of a signal received by the portable access device and generate a corresponding RSSI value. Additionally or alternatively, the control module 350 may perform other measurements of received signals from the portable access device, such as angle of arrival, time of arrival, delta of arrival, etc. The control module 350 may then transmit the measured information to the Vehicle control module 204, which can then determine a location of and/or a distance to the portable access device relative to the vehicle 30 based on the measured information. The location and distance information may be based on similar information received from one or more other RF antenna modules and/or other sensors.

As an example, the vehicle control module 204 may determine the location of the portable entry device based, for example, on the patterns of RSSI values corresponding to signals received by the RF antenna modules 40 from the portable entry device. A strong (or high) RSSI value indicates that the portable entry device is close to the vehicle 30 and a weak (or low) RSSI value indicates that the portable entry device is farther from the vehicle 30 . By analyzing the RSSI values, the control module 204 can determine a location of and/or a distance to the portable entry device relative to the vehicle 30 . Additionally or alternatively, angles of arrival, angles of exit, round trip time, unmodulated carrier tone exchange, or time difference of arrival measurements for the signals sent between the portable access device and the control module 204 may also be used by the control module 204 or the portable access device be used to determine the location of the portable access device. Additionally or alternatively, the RF antenna modules 40 may determine the location of and/or distance to the portable access device based on the measured information and communicate the location or distance to the control module 204 .

Based on the determined location of or distance to the portable entry device relative to the vehicle 30, the modules 211, 212 of 3 then authorize and/or perform a vehicle function, such as unlocking a door of the vehicle 30, unlocking a trunk of the vehicle 30, starting the vehicle 30, and/or allowing the vehicle 30 to start. As another example, when the portable entry device is less than a first predetermined distance from the vehicle 30 , the modules 211 , 212 may activate interior or exterior lights of the vehicle 30 . When the portable entry device is less than a second predetermined distance from the vehicle 30, the modules 211, 212 can unlock doors or a trunk of the vehicle 30. When the portable entry device is within the vehicle 30, the modules 211, 212 may allow the vehicle 30 to be started.

Referring again to 5 For example, the control module 350 may include a physical layer (PHY) module 356, a media access control (MAC) module 358, a time synchronization module 360, and a channel map reconstruction module 362. The PHY module 356 receives BLE signals via the multi-axis polarized RF antenna array 352. The control module 350 may receive BLE messages of the phy physical layer and obtain measurements of physical properties of the corresponding signals, including, for example, received signal strengths, using a channel map generated by channel map reconstruction module 362 . The control module 350 can communicate with the control modules of other RF antenna modules and/or the modules 204, 210, 211, 212 via the vehicle interface 45 to calculate arrival or arrival time differences, arrival or arrival time, arrival or arrival angle and/or or to determine other time information. In one embodiment, the control module 350 includes a portion of the RF circuitry 223 of FIG 3 .

A time synchronization module 360 is configured to accurately measure the reception times of signals/messages at the vehicle interface 45. The control module 350 may direct the PHY module 356 to a particular channel at a particular time based on the channel map information and the reception times and/or other timing information. / tune in. In addition, the control module may monitor received PHY messages and data that conform to a Bluetooth® physical layer specification, such as Bluetooth® Specification Version 5.1. The data, time stamp, and measured signal strengths may be reported by the control module 350 to the control module 204 via the vehicle interface 45 .

6 FIG. 12 shows an example of a portable access device 400, which is an example of one of the portable access devices 32, 34 of FIG 2 is. Portable access device 400 may include control module 402 , user interface 404 , memory 406 , sensors 407 , and transceiver 408 . The transceiver 408 may include a MAC module 410, a PHY module 412, and a plurality of linearly polarized antennas 414.

The control module 402 may include or be part of a BLE communication chipset. Alternatively, the control module 402 may include or be part of a Wi-Fi or Wi-Fi Direct communication chipset. Memory 406 may store application code executable by control module 402 . Memory 406 may be a non-transitory computer-readable medium including read-only memory (ROM) and/or random access memory (RAM).

The control module 402 communicates with the vehicle's modules 204 and 350 and performs authentication and other operations as further described below. The control module 402 may transmit information regarding the portable access device 400, such as location and/or speed information obtained from one or more of the sensors 407 (e.g., a global navigation satellite system (e.g., GPS) sensor, an acceleration sensor, and/or an angular rate sensor ). User interface 404 may include a keypad, touch screen, voice-activated interface, and/or other user interface.

7 12 shows a polarization axis diagram illustrating an example of an arrangement of/for polarization diversity. In the example shown, two 3-axis antennas located within a vehicle are in communication with a 2-axis antenna located in a portable access device (or a mobile access network device). With sufficient antenna axes, this antenna topology can prevent a situation that there is cross-polarization between one of the 3-axis antennas and the 2-axis antenna. Also, with sufficient antenna axes, the system can be configured such that there is at least one pair of antennas where a null does not exist in (or is not directed to) a direct signal path. Heuristic measurements of RSSI on continuous wave (CW) audio portions of packets can be performed while measuring round trip time and phase delays of the packets. This can be repeated over multiple frequencies. This can be done at a vehicle entry module and/or at the portable entry device. Round trip time and/or unmodulated carrier tone exchange can be used to ensure distance measurement. RSSI and change (or delta) phase per frequency can be used.

8th Figure 12 shows a polarization axis diagram illustrating another example of an arrangement of/for polarization diversity. In the example shown, two single-axis antennas located within a vehicle are in communication with a 3-axis antenna located in a portable access device (or a mobile access network device). With sufficient antenna axes, this antenna topology can also prevent a situation from occurring that there is cross-polarization between one of the single-axis antennas and the 3-axis antenna. Also, with sufficient antenna axes, the system can be configured to have at least one pair of antennas where a null does not exist in (or is not directed towards) a direct signal path. Heuristic measurements of RSSI on continuous wave (CW) audio portions of packets can be performed while measuring round trip time and phase delays of the packets. This can be repeated over multiple frequencies. This can be done at a vehicle entry module and/or at the portable entry device. Round trip time is used to ensure or ensure a distance measurement. RSSI and change (or delta) phase per frequency can be used. The example of 7 may be more workable than the example of 8th . This is because it can be difficult to incorporate a 3-axis antenna into certain portable access devices, such as a key fob.

9 Fig. 9 shows an electric field diagram 900 and a polar coordinate diagram 902 illustrating electric field patterns and nulls 906 for a linear antenna. The linear antenna is positioned along vertical axis 908 . The linear antenna has a “donut” or ring shaped radiation pattern. When nulls are aligned or in line between the transmit and receive antennas (co-polarized antennas with collinear or nearly collinear nulls), the bounce path of a transmitted signal is measured. The examples set forth herein prevent this situation from existing between at least one transmit antenna and at least one receive antenna at all times. Set forth herein is an algorithm for determining which transmit and receive antennas to use at any point in time to prevent use of antennas that are cross-polarized and/or co-polarized. Once the appropriate antenna pair is selected, a time-of-flight measurement is performed to determine a distance between the transmitter and the receiver and/or between the vehicle and the portable access device. 10 Figure 1000 shows a voltage versus electric field plot 1000 for a linearly polarized antenna 1002.

11A-B 12 shows at least a portion of an example of a multi-axis polarized RF antenna assembly 1100 having a linearly polarized antenna 1102 and a circularly polarized antenna 1104. The antennas 1102, 1104 are collocated. The linearly polarized antenna 1102 extends linearly from a center of the circularly polarized antenna 1104 axially outwardly away from the circularly polarized antenna 1104 . The antennas 1102, 1104 can transmit 90° out of phase with one another. The linearly polarized antenna 1102 may include a conductive element (eg, a straight wire or coil) 1110 extending within a sheath 1112 . The circularly polarized antenna 1104 may be annular.

The linearly polarized antenna 1102 is a monopole antenna. Shell 1112 is formed from a dielectric material, such as Teflon. Both antennas 1102, 1104 are concentric with a disk-shaped dielectric (or insulator) 1106 and a disk-shaped base plate 1108. The ring-shaped insulator 1106 is stacked as the top layer on the base plate 1108 (or bottom layer). The circularly polarized antenna 1104 is installed on the ground plane 1108 inside an inner recessed area 1114 of the insulator 1106 . The inner recessed area 1114 of the insulator is located between the circularly polarized antenna 1104 and the ground plane 1108 .

The circularly polarized antenna has two feed points 1120,1122 and the linear polarized antenna 1102 has a single feed point 1124. The RF signals are transmitted and/or received via the feed points 1120,1122,1124. The RF signals are communicated between the antennas 1102, 1104 and the RF circuitry 1114 via coax cables. The coax cables include inner conductors 1130, 1132, 1134 and outer ground shields (not shown). The ground shields are connected to the ground plane 1108. Conductors 1130,1132,1134 are connected to feed points 1120,1122,1124.

During transmission, a signal or voltage is provided between the ground plane 1108 and the conductive element 1110 via the feeding point 1124 which is connected to the conductive element 1110 and via another conductive element 1140 to the ground plane 1108 . One or more RF signals or voltages are also applied between the ground plane 1108 and the feed points 1120, 1122 for the circularly polarized antenna 1104. The feed points 1120, 1122 are offset by 90° on a surface of the antenna 1104 and are 90° out of phase with one another. The electrical phase shift of 90° combined with the geometric phase shift of 90° causes the circularly polarized antenna 1104 to radiate circularly polarized signals. The feed points 1120, 1122 are connected to the circularly polarized antenna 1104 from the ground plane 1108 via the insulator 1106. A hole 1142 in the middle of the base plate 1108 and a hole 1144 at a center of circularly polarized antenna 1104 are large enough to allow linearly polarized antenna 1102 to radiate without shorting to ground plane 1108 .

The antennas 1102, 1104 may be formed from a conductive material, while the circular insulator 1106 may be formed from a non-conductive (or electrically insulating) material. In one embodiment, the linearly polarized antenna 1102 may be implemented as a straight wire, while the sheath 1112 may be formed from polytetrafluoroethylene (PTFE) and the conductive element 1110 may be formed from copper. In another embodiment, the linearly polarized antenna 1102 is implemented as a helix while the wire is wrapped around a cylindrically shaped object formed of PTFE. 12 FIG. 12 shows a polar coordinate diagram 1200 of radiated power associated with the linearly polarized antenna 1102 of FIG 11 . 13 FIG. 12 shows a polar coordinate diagram of radiated power associated with the circularly polarized antenna 1104 of FIG 11 . The antennas 1102, 1104 can be connected to an RF circuit 1114, such as one of the RF circuits 223 of FIG 3 , connected and may be configured to be installed in a roof of a vehicle. The antennas 1102, 1104 can be used for time-of-flight measurements between a vehicle and a portable access device, while other LF antennas can be used in a vehicle for authentication of portable access devices.

Although antenna assemblies are primarily described as having a circularly polarized antenna and a linearly polarized antenna, which may be installed in a roof of a vehicle, for example, two linearly polarized antennas may be used instead. This applies to each of the examples disclosed herein. The two linearly polarized antennas may be located deeper in the vehicle, such as in the floor, dashboard, or center console of the vehicle.

14 Figure 14 shows a first RF circuit 1400, a second RF circuit 1401 and a portion 1403 of a portable access device (eg one of the portable access devices described above). Although a specific number of RF circuits are shown, any number of RF circuits may be included and communicate with the portable access device. The first RF circuitry 1400 includes a serial transmission module 1402, an RF transceiver module 1404, a switch 1406, a splitter 1408, a uniaxially polarized (or monopole) antenna 1410, a delay module 1412, and a circularly polarized antenna array 1414. The antennas 1410, 1414 can be configured as the multi-axis polarized RF antenna array of FIG 11 be implemented. Although the RF circuits are each shown as having a single axis antenna and a circularly polarized antenna to provide 3 polarization axes, the RF circuits may each include only two single axis polarized antennas. Many permutations of linearly and circularly polarized antenna axes are possible to achieve polarization diversity in a module, preventing cross polarization and/or collinear alignment of nulls. If the RF circuitry includes two single-axis antennas, then the portable access device includes a three-axis antenna or three single-axis antennas that are orthogonal relative to each other so that they correspond to x, y, and z axes.

The serial communications module 1402 may communicate with one or more vehicle modules (eg, the vehicle control module or the access module disclosed above) over a serial bus according to a Serial Peripheral Interconnect (SPI) protocol. Discrete signals (or general purpose I/O or I/O signals) can be transmitted between the modules 1402, 1404 and between the RF transceiver module 1404 and the switch or switch 1406. The RF transceiver module 1404 can be combined with the PEPS module 211 (from 3 ) communicate. The switch 1406 toggles between the antennas 1410,1414. Splitter 1408 may split a signal received from RF transceiver module 1404 and provide the signal to antenna 1410 and antenna 1414 and/or combine signals received from antenna 1410 and antenna 1414 . The splitter 1408 can be a 90° splitter and can split a single signal into two signals that are 90° out of phase and feed the signals to two feed points (e.g. feed points 1120, 1122 of 11 ) at the circularly polarized antenna. The splitter 1408 may provide signals to or receive signals from the antenna 1414 via the delay module 1412 .

The second RF circuit 1401 includes a switch 1420, a splitter 1422, a uniaxially polarized (or monopole) antenna 1424, a delay module 1426 and a circularly polarized antenna 1428. The antennas 1424, 1428 can more than that sig polarized RF antenna array from 11 be implemented. Devices 1420, 1422, 1424, 1426, 1428 may operate similarly to devices 1406, 1408, 1410, 1412, 1414. Switch 1420 may communicate with RF transceiver module 1404. Switch 1406 may also connect splitter 1408, uniaxially polarized antenna 1410, and/or switch 1420 to RF transceiver module 1404. Switch 1420 may connect uniaxially polarized antenna 1424 or splitter to switch 1406 or RF transceiver module 1404 .

Part 1403 includes a 3-axis LF antenna 1430, an LF module 1432, an RF module 1434, a user interface 1436, a first uniaxially polarized antenna 1438, a second uniaxially polarized antenna 1440 and a switch 1442 LF module 1432 transmits and receives LF signals via 3-axis LF antenna 1430. RF module 1434 transmits and receives RF signals via switch 1442 and antennas 1438, 1440. Switch 1442 connects a or more of the antennas 1438, 1440 with the RF module 1434. Discrete signals and Serial Peripheral Interconnect (SPI) signals can be transmitted between the LF module 1432 and the RF module 1434. Discrete signals can be transmitted between the RF module 1434 and the switch 1442.

RF signals are transmitted between (i) antennas 1410,1414,1424,1428 and (ii) antennas 1438,1440. As an example, antennas 1410, 1424 may be associated with a z-axis, while antennas 1414, 1428 may be associated with x- and y-axes, respectively. The antennas 1438, 1440 may be, for example, slot antennas associated with x and y axes. The 3-axis LF antenna 1430 can communicate with the LF antennas on the corresponding vehicle as described above. The LF antennas can be used for wake-up downlink purposes. The RF antennas can be used for authentication and communication.

Antennas 1410,1414 can be used to communicate with antennas 1438,1440, or antennas 1424,1428 can be used to communicate with antennas 1438,1440. Alternatively, one of antennas 1410,1424 and/or one of antennas 1414,1428 can be used to communicate with antennas 1438,1440. One or more of the antennas in circuit 1400 may be used while one or more of the antennas in circuit 1401 are used. By using a monopole (or linearly polarized) RF antenna and a dipole (or multiaxially polarized) RF antenna, such as a circularly polarized antenna, the number of RF switching lanes for interrogation is reduced from 3 down to 2. Heuristic measurements of RSSI on continuous-wave tones of packets can be performed while measuring packet round-trip times and phase delays. This can be repeated over multiple frequencies.

15 Figure 15 shows a portion 1500 of a key fob with two linearly polarized slot antennas 1502, 1504, a metal shroud 1506, and a spare/spare key 1508. The metal in a key fob can short out fields that would otherwise stabilize along a longitudinal (or Y) dimension of the key fob would. As a result, it can be difficult to design an efficient radiator with structures that would otherwise include properly working antennas. The antenna 1502 is a slot antenna linearly polarized with respect to an x-axis. The antenna 1504 is a y-axis linearly polarized slot antenna. The metal panel 1506 may be a cast decorative panel. The key fob may also include an LF coil antenna 1510, a processor (not shown), a battery 1512, and a metal plate (or conductive layer) 1514. An RF signal is supplied to the metal plate 1514, and the openings of the slot antennas 1502, 1504 radiate electromagnetic waves.

16 1600 shows part 1600 of the key fob of FIG 15 without the metal shroud 1506 and spare/spare key 1508. Part 1600 includes slot antenna 1502 linearly polarized with respect to an x-axis and slot antenna 1504 linearly polarized with respect to a y-axis. encourages radiation from the slot antennas 1502, 1504. Although this embodiment is configured to work with nearby metal, such as the metal trim and spare key, the diagrams of FIG 17 and 18 shown skewed from the diagrams when the metal shroud and spare/spare key are included. 17 FIG. 14 shows a polar coordinate diagram of radiated power associated with the slot antenna 1502 linearly polarized with respect to an x-axis of the part 1600 of the key fob of FIG 16 . 18 14 shows an exemplary polar coordinate plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion 1600 of FIG 16 . 19 indicates FIG. 14 shows a plot of return loss (in decibels (dB)) versus frequency for the linearly polarized slot antennas 1502, 1504 of FIG 16 , where the curve S1,1 is reflective power for the first port or antenna 1502 of a first radio unit (or a first transmitter) and S2,2 is reflective power for the second port or second antenna 1504 of a second radio unit (or a second transmitter). The structure of a key fob can be provided to provide S1,1 or S2,2 plots, where the "dip" or minimum return loss for the S1,1 and S2,2 plots is at an equal frequency or within a predetermined range from/to each other to provide improved performance.

Return loss is a way of measuring how well an antenna converts an electrical voltage at terminals of the antenna into an electric field in space, or how well the antenna converts the electric field in space into an electrical voltage at the terminals. Return loss is a decibel measure of how much power is reflected at the ports. For example, if the return loss is 0 dB, all power is reflected and no power is transmitted to the ports. As another example, a return loss of -10 dB means that approximately 10% of the power is reflected and 90% of the power is transmitted. If a return loss plot includes a curve that drops to a reasonable or acceptable level (e.g. -6 dB) at an operating frequency, the corresponding antenna is performing well. If the return loss drops to -10 dB, then the antenna is considered a good working antenna. Return loss is measured as an S-parameter. S1,1 is the return loss of port 1. S2,2 is the return loss of port 2.

20 shows part 2000 of the key fob from 15 without the metal cover 1506 and with the spare/spare key 1508. 21 FIG. 14 shows a polar coordinate diagram of radiated power associated with the slot antenna 1502 linearly polarized with respect to an x-axis of the part 2000 of the key fob of FIG 20 . 22 FIG. 14 shows a polar coordinate diagram of radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion 2000 of FIG 20 . Adding the spare key can negatively affect the y-polarization, but is acceptable for operation. 23 FIG. 12 shows a plot of return loss versus frequency for the linearly polarized slot antennas 1502, 1504 of FIG 20 , where S1,1 stands for antenna 1502 and S2,2 stands for antenna 1504.

24 shows a part 2400 of the key fob of FIG 15 with a portion of the metal shroud 2402 and the spare/spare key 1508. Adding the metal shroud 2402 near the spare key 1508 can adversely affect operation as illustrated by the graphs and curves of FIG 25 until 27 is shown. 25 FIG. 12 shows a polar coordinate diagram of radiated power associated with the slot antenna 1502 linearly polarized with respect to an x-axis of the part 2400 of the key fob of FIG 24 . 26 FIG. 14 shows a polar coordinate diagram of radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion of FIG 24 . 27 FIG. 12 shows a plot of return loss versus frequency for the linearly polarized slot antennas of FIG 24 , where S1,1 stands for antenna 1502 and S2,2 stands for antenna 1504. 19 , 23 and 27 show that the antennas work reasonably well in the frequency range of interest (e.g. 2.4-2.8 GHz).

Referring to part 1500 of 15 , in which the full metal cladding 1506 is present, the operation of the antennas is additionally adversely affected, as shown in the figures, diagrams and curves of FIG 28 until 30 is shown. 28 Figure 12 shows a polar coordinate diagram of radiated power associated with the x-axis linearly polarized slot antenna 1502 of part 1500. 29 Figure 12 shows a polar coordinate diagram of radiated power associated with the y-axis linearly polarized slot antenna 1504 of part 1500. 30 FIG. 14 is a plot of return loss versus frequency for linearly polarized antennas 1502, 1504, where S1,1 represents antenna 1502 and S2,2 represents antenna 1504. FIG.

The y-axis linearly polarized slot antennas 1502, 1504 are open slot antennas since each of the antennas 1502, 1504 has an open end. 31 Figure 12 shows a portion 3100 of a key fob with an open linearly polarized slot antenna 3102, a closed linearly polarized slot antenna 3104, a metal shroud 3106, and a spare/spare key 3108. 32 Figure 12 shows a polar coordinate diagram of radiated power associated with slot antenna 3102 linearly polarized with respect to an x-axis of part 3100. 33 Fig. 12 shows a polar coordinate diagram of radiant power in relation to that linearly polarized with respect to a y-axis Part 3100 slot antenna 3104. 34 12 shows a plot of return loss versus frequency for the linearly polarized slot antennas 3102, 3104 of FIG 31 . 34 shows that the antenna measured at port S2,2 is working poorly.

When a portable entry device has multiple orthogonal antennas as described above, elimination of decorative metal trim provides improved round-trip time performance the larger the portable entry device is compared to a corresponding physical metal key and the larger the portable entry device compared to a palm of a hand. Improved round trip time performance improves accuracy of distance determinations.

The systems disclosed herein may be operated using numerous methods described herein. A few example methods for determining which antenna combination to use are given in 35 and 36 illustrated. 35 and 36 illustrate methods for determining which antenna combination to use to exchange packets between RF antenna modules (or RF circuitry) of a vehicle and a portable access device for round-trip time-of-flight measurements. 35 and 37 Figure 12 illustrates the process from the point of view of the initiator or initiating device of the orbital time-of-flight measurements. In one embodiment, this is the vehicle. In another embodiment, this is the portable access device. The reflector/responder or reflective/responsive device would perform the obvious steps that correspond to initiator steps in the process. Round-trip time-of-flight measurements can be used to prevent range extender-type relay station attacks, as further described below. 35 illustrates an approach to switching antennas between packets. 36 FIG. 11 illustrates an approach for switching antennas during transmission of packets and/or continuous wave (CW) tones.

Although the following operations mainly refer to the implementations of 2-6 , 11 and 14 are described, the operations may be easily modified to apply to other implementations of the present disclosure. The operations can be performed iteratively.

The procedure can start at 3500. The following operations may generally be performed by the control module 402 in a portable entry device 400 and by on-vehicle modules, such as the entry module 210, the PEPS module 211, and/or the PAK module 212 of FIG 4 , to be carried out simultaneously. There can be many ways in which the frequencies and antenna combinations to be tried can be selected, and then to identify the best frequencies (or channels) and antenna axes. Optionally, at 3501, the modules negotiate the initial frequencies (or channels) and antenna combinations to be used for frequency and antenna probing. This step may be based on an a priori agreement, negotiated between the modules based on a posteriori data, and/or instructed by a module based on a posteriori data. At 3502, a frequency (or channel) is selected on which (or) a first (or next) packet is to be transmitted.

At 3504, an antenna pair is selected on which to transmit and receive the packet. Such as two of the antennas of the vehicle's RF circuits from 11 . At 3506, the packet is transmitted from a first (or transmit) antenna to a portable access device on the selected frequency. The portable access device measures the RSSI of the transmission and retransmits the packet and a first RSSI to the second (or receiving) antenna of the selected antenna pair.

At 3508, the second antenna receives the packet and/or a response to transmission of the packet and the first RSSI. At 3512, a second RSSI is measured for the second transmission of the packet. At 3514, the first RSSI and the second RSSI are stored in memory associated with the packet, the selected frequency, and the selected antenna pair.

At 3516, if another antenna pair is to be selected, operation 3504 is performed, and otherwise operation 3518 is performed. This allows each antenna pair permutation to be cycled through for each selected frequency. The antenna pair permutations may be cycled through in a pseudo-random and/or predefined order.

At 3518, if another frequency (or channel) is to be selected, operation 3502 is performed, and operation 3520 is otherwise performed. This allows each frequency (or channel) to be cycled through. This allows the RSSIs of each of the frequencies (or each of the channels) to be determined. Fast multipath fading can cause some frequencies to have lower power levels (or RSSI values). As an example, the frequencies of 37 BLE data channels may be cycled in a pseudo-random and/or predefined order to determine the best frequency and/or channel and antenna pair for transmission of further packets.

Optionally, at 3519, after cycling through a predetermined, negotiated, and/or agreed upon set of the frequencies and the antenna axis pairs, the algorithm may include the nodes (control modules) optionally exchanging antenna and/or channel RSSI results. Due to RF channel reciprocity, the modules can use a heuristic that selects the antenna axes used by the modules without sharing antenna RSSI measurements performed by the modules. Due to RF channel reciprocity, the modules can use a heuristic to select the channels (frequencies) without results from the other channels, but the modules can use an algorithm that selects the channels based on results from the channel. In this case the algorithm and system are less sensitive to interference from other nearby transmitters.

At 3520, after cycling a predetermined number of the frequencies and the antenna pairs, the antenna axis combination and/or the frequencies (channels) with the best RSSIs are selected for transmission of remaining packets. The antenna axis combinations with the highest RSSI are best. The best frequencies (or channels) are those that do not have low RSSIs and/or do not have high RSSIs. At 3522, an identifier of the selected antenna pair and/or selected frequencies (channels) may be encrypted. At 3524, the selected antenna axis pair and/or frequencies (channels) that are scrambled may be transmitted to the other node. At 3526, using the selected frequencies (channels) and antenna pair, the packets are transmitted and responses are received. The method may end at 3528.

Although the following operations of 36 mainly referring to the implementations of 2-6 , 11 and 14 are described, the operations may be easily modified to apply to other implementations of the present disclosure. The operations can be performed iteratively.

The procedure can start at 3700. The following operations can generally be performed by the control module 402 in a portable entry device 400 and by on-vehicle modules, for example the PEPS module 211 and/or the PAK module 212 of FIG 4 , to be carried out simultaneously. Several different techniques can be used to select the frequencies and antenna combinations to try and then identify the best frequencies (or channels) and antenna axes. Optionally, at 3701, the modules negotiate the initial frequencies (or initial channel) and antenna combinations to use for frequency and antenna probing. This step can be based on an a priori agreement or negotiated between the modules based on a posteriori data or instructed by a module based on a posteriori data. At 3702, a frequency (or channel) is selected on which (or) a first (or next) packet is to be transmitted.

At 3704, an antenna pair is selected on which to transmit and receive the packet. Such as two of the antennas of the vehicle's RF circuits from 11 . At 3706, the packet is transmitted from a first (or transmit) antenna to a portable access device on the selected frequency. The vehicle switches between a negotiated set of antenna axes with dwell/hold times during the CW audio portion of the packet. The portable access device switches between a negotiated set of antenna axes with dwell/hold times within each of "Switching and dwell/hold times" of a vehicle antenna axis for periods within the CW tone, measures the RSSIs of a transmit and receive antenna axis permutation during the Receive, and transmits the packet and a first set of measured RSSIs back to the vehicle, and then switches a selected pair of antennas between a negotiated set of antenna axes with dwell/hold times during the CW audio portion of the packet.

At 3708, the vehicle receives the packet and/or a response to transmission of the packet and the first set of RSSIs. At 3712, a second RSSI is measured for the second transmission of the packet. At 3714, the first RSSI and the second RSSI are stored in memory associated with the packet, the selected frequency, and the selected antenna pair.

At 3716, if there is another packet to transmit, operation 3718 is performed, and otherwise operation 3726 may be performed. At 3718, if another antenna pair is to be selected, operation 3720 is performed, and otherwise operation 3724 is performed. This allows each antenna pair permutation to be cycled through for each selected frequency. The antenna pair permutations may be cycled through in a pseudo-random and/or predefined order.

At 3720, a first transmission of a next packet is started using the previous transmit antenna of the previously selected antenna pair.

At 3722 a switch occurs between the previous antenna pair and a next selected antenna pair. This can be done during a CW tone of the packet currently being transmitted or during another portion of the packet currently being transmitted so that a remainder of the packet is transmitted over the transmit antenna of the next selected antenna pair. Operation 3708 may be performed subsequent to operation 3722.

At 3724, if another frequency (or channel) is to be selected, operation 3704 is performed, and otherwise operation 3718 is performed. This allows each frequency (or channel) to be cycled through. This allows the RSSIs of each of the frequencies (or each of the channels) to be determined. Fast multipath fading can cause some frequencies to have lower power levels (or RSSI values). As an example, frequencies of 37 BLE data channels may be cycled through in a pseudo-random and/or predefined order to determine the best frequency and/or channel and antenna pair to transmit further packets. At 3725, antenna and RSSI result values may be exchanged as described at 3519 above.

At 3726, after cycling a predetermined number of the frequencies and the antenna pairs, the antenna combination and the frequency and/or channel with the best RSSIs are selected for transmission of remaining packets.

At 3728, an identifier of the selected antenna pair may be encrypted. At 3730, each remaining packet may be encapsulated to include the encrypted identifier or modified to include the encrypted identifier. At 3732, the encapsulated or modified packets are transmitted and replies are received using the selected frequency, channel, and antenna pair. The method may end at 3734.

In the methods described above, the packets transmitted to determine the best frequency, channel and antenna pair can be discarded. The dropped packets are only used to measure the RSSI values. In another embodiment, CW tones are/are picked up at the end of packets and antenna switching occurs during these tones. In another embodiment, a predetermined amount of time (eg, 4 µs) is allocated for each antenna permutation, CW tones are/are picked up at the ends of packets, and the antenna pair with the best RSSI (or best performance values) is selected. The selected frequency, channel, and/or antenna pair may be changed if another nearby network device is transmitting and/or receiving data in a same frequency range. In one embodiment, the pattern in which frequencies during the processes of 35 and 36 are previously known and shared between the vehicle's entry module and the portable entry device.

Operations 3526 and 3732 may be performed to authorize a portable entry device, detect range extender-type relay station attacks by the portable entry device, provide access to an interior of a vehicle, and/or perform other PEPS system and/or PAK system operations . As an example, the packets can be transmitted to authorize the portable access device and can access the inside space of the vehicle if the portable entry device and/or a corresponding user is determined to be authorized to access the vehicle. This may include allowing operation of the vehicle. The packets may be transmitted to perform time-of-flight measurements, including a time to transmit the packets to the portable access device and a time to respond and receive corresponding responses from the portable access device. Based on the measured time-of-flight values, the vehicle's access module (eg, the PEPS module or the PAK module) may determine whether the portable access device is attempting to perform a range extender-type relay station attack. When the portable entry device attempts to perform a range extender-type relay station attack, the entry module performs one or more countermeasures including preventing access to the interior of the vehicle. The countermeasures may include notifying an owner of the vehicle of the range extender type relay station attack. This can be done, for example, via a text message or email transmitted from the access module to one or more of the owner's network devices. One or more alerts can be generated and a central monitoring station and/or government agencies can be notified of the attack.

$$Durchschnittsflugzeit=\frac{\left(T_4-T_1\right)+\left(T_3-T_2\right)}{2}$$

$$Distanz=\left(Rate\right)\left(Zeit\right)$$

$$Distanz=\left(c\right)\frac{\left(T_4-T_1\right)+\left(T_3-T_2\right)}{2}$$

37 FIG. 38 shows a diagram 3800 of a time-of-flight measurement comprising an initiating and measuring device 3802 and a reflecting (or responding) device 3804 . The initiating and measuring device 3802 transmits a radio message (eg, a packet) to the reflecting device 3804, which then responds and retransmits the radio message to the initiating and measuring device 3802. The flight time (or total time to transmit and receive these signals) is equal to a sum of (T ₂ -T ₁ ), (T ₃ -T ₂ ) and (T ₄ -T ₃ ), where: T ₂ - T ₁ is the amount of time for the radio message to propagate from the initiating and measuring device 3802 to the reflecting device 3804; T ₃ -T ₂ is the amount of time for reflective device 3804 to respond; and T ₄ -T ₃ is the amount of time for the radio message to propagate from the reflecting device 3804 to the initiating and measuring device 3802. Exemplary average flight time and distance calculations can be made according to Equations 1-4, where the Distance refers to the distance between the initiating and measuring device 3802 and the reflecting device 3804. $$D\mathrm{and}\mathrm{right}cHscHnittsfl\mathrm{and}G\mathrm{e.g}eit=\frac{\left(Gesamt\mathrm{e.g}eit-AntwO\mathrm{right}t\mathrm{e.g}eit\right)}{2}$$

$$D\mathrm{and}\mathrm{right}cHscHnittsfl\mathrm{and}G\mathrm{e.g}eit=\frac{\left({\mathrm{<figure-callout\; id="4"\; label="T"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">T</figure-callout>}}_4-T_1\right)+\left({\mathrm{<figure-callout\; id="3"\; label="T"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">T</figure-callout>}}_3-T_2\right)}{2}$$

$$Distan\mathrm{e.g}=\left(Rate\right)\left(Zeit\right)$$

$$Distan\mathrm{e.g}=\left(c\right)\frac{\left({\mathrm{<figure-callout\; id="4"\; label="T"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">T</figure-callout>}}_4-T_1\right)+\left({\mathrm{<figure-callout\; id="3"\; label="T"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">T</figure-callout>}}_3-T_2\right)}{2}$$

If a timer is used to time the response time T ₃ -T ₂ , the amount of timing information can be reduced to accommodate fine-tuning information that is/is measured and is related to the response time. The time T ₃ -T ₂ can be reported back to an initiator if the initiator has no knowledge of this amount of time.

38 12 shows an example of a BLE radio 3900 having a superheterodyne receiver 3902 and a transmitter 3904. The BLE radio 3900 can be used, for example, as one of the transceivers 222 of FIG 3 are used and comprise or be part of one of the RF antenna modules 40 and the RF circuitry 223 . In another embodiment, BLE radio unit 3900 is used as a transceiver in a portable access device, such as transceiver 410 of portable access device 400 of FIG 6 . The 3902 superheterodyne receiver uses frequency mixing to convert a received signal to a fixed Intermediate Frequency (IF). Superheterodyne receiver 3902 includes RF (e.g. bandpass) filter 3906, switch and balun 3908, low noise amplifier 3910, downconverter 3912, bandpass filter and amplifier 3914, analog to digital converter 3916, demodulator 3918 and a correlation and protocol module 3920. The transmitter 3904 includes a processing module 3922, a protocol module 3924, a Gaussian Frequency Shift Keying (GFSK) modulator 3926, a digital to analog converter and low pass filter 3928, an upconverter 3930 and a power ver stronger 3932. One or more crystal oscillators 3934 can generate one or more clock signals that can be distributed to devices 3914, 3916, 3918, 3920, 3922, 3924, 3936, 3938 and phase locked loops 3940, 3942. As an example, the processing module 3922 and the correlation and logging module 3920 may be implemented as a single module or as part of one or more of the modules 204, 210, 211, 212 of 3 to be implemented. Operations performed by modules 3922 and 3920 may be performed by any one of modules 204, 210, 211, 212 of 3-4 to be implemented. One or more of devices 3906, 3908, 3910, 3912, 3914, 3916, 3918, 3920, 3924, 3926, 3928, 3930, 3932, 3934, 3936, 3938, 3940 and 3942 may be part of RF circuitry 223 and/or or implemented as part of one or more of the modules 204, 210, 211, 212.

Bandpass filter 3906 may be connected to a linearly polarized antenna and/or a circularly polarized antenna (designated 3907). Downconverter 3912 downconverts received signals from an RF frequency to an IF frequency based on a signal from phase locked loop 3942. Upconverter 3930 upconverts IF signals to RF signals based on a signal from phase locked loop 3940.

GFSK modulator 3926 and demodulator 3918 can modulate and demodulate bits of signals according to GFSK protocols. 39 shows an exemplary GFSK-parameter definition diagram showing a diagram of a transmission carrier frequency F _c, the zero-crossing points and errors are illustrated. As an example, the transmit carrier frequency F _{c may be} equal to ± 250 kHz or ± 500 kHz with a symbol time of 1 µs or 0.5 µs and a zero crossing error of 1/8th 1 µs (1 Mbps) or 1/8th 0, 5 µs (2 Mbps).

40 FIG. 4 shows a functional block diagram of a system 4100 for transmitting BLE packets. An example format of the BLE packets 4101 is shown, which includes a preamble, an access address, a protocol data unit (PDU), and a cyclic redundancy check (CRC) bit field. This is an example of packets processed by the Correlation and Logging Module 3940 from 38 received and/or generated by processing module 3922 and/or protocol module 3924.

The preambles of the packets are AA or 55, so the last bit of the preamble is different from the first bit of the port address. The access addresses for the peripheral and central devices 4102, 4104 are the same. Sensors 4106 can be used to monitor packets. The access addresses are the same for every packet and connection interval. The access address follows BLE access address rules. The packets within the same connection interval are within the same RF channel. 41 shows example preambles and access addresses for BLE-1M packets and BLE-2M packets. The preambles are A's and 5's (AA or 55 at 1 Mbit/s, AAAA or 5555 at 2 Mbit/s), so the last bit of the preamble is different from the first bit of the port address. This is illustrated by the bits in circles 4200.

Access addresses for advertising channel packets can be 10001110100010011011111011010110b (0x8E89BED6). Each link layer connection between any two devices and each periodic advertisement has a different gateway address. The access addresses can be 32-bit values. Each time a new access address is required, the link or data link layer can generate a new random value that satisfies the following rules. The access address is not an address for an existing link layer connection at the corresponding network device.

The gateway address: is not an address for an enabled periodic announcement; does not have six consecutive zeros or ones; is not an advertisement channel packet access address; is not a sequence that differs from an advertisement channel packet access address by only one bit; and does not include four equal octets. The access address has no more than 24 transitions or changes. The seed for the random number generator comes from a physical source of entropy and has at least 20 bits of entropy. If the random number of the gateway address does not satisfy the above rules, new random numbers are generated until the rules are satisfied. For an implementation that also supports a BLE encoded physical layer (PHY), the access address can also have at least three ones in the least significant 8 bits and no more than eleven transitions in the least significant 16 bits. In normal BLE packets, the preamble reveals the first bit of the access address, and then the access rules sometimes reveal the next bit of the access address (e.g. no more than 6 consecutive 0s or 1s). This can measure distance cause security security issues because an attacker can predict the bits, which is mitigated or eliminated by the implementations disclosed herein.

42 FIG. 12 shows an example diagram of BLE packet signals illustrating corresponding bits. A first BLE signal 4300 represents a bit stream from the protocol module 3924 of 38 Normal BLE packets will not return to a carrier (or mid-point level) if the bits remain at the same value. This is referred to as non-return-to-zero recording/logging. The corresponding bits for the first curve are shown above the diagram. A second BLE signal 4302 represents a bit stream from the GFSK modulator (or a Gaussian filter) 3926. The Gaussian filter adds a 1/2 bit time delay/shift and squanders some time during transitions. The corresponding bits for the second BLE curve are shown below the second BLE curve. As an example, the carrier frequency may be 2.402 GHz and the BLE packet signals may vary in frequency between 2.402250 GHz and 2.401750 GHz.

43 FIG. 12 shows an example diagram of BLE packet signals illustrating corresponding bits of a stronger BLE packet signal (eg, a BLE packet signal with larger RSSI) after rising edge detection and transmission with faster edges. A first BLE signal 4400 represents a bit stream from the protocol module 3924 of 38 A second BLE signal 4402 represents a bit stream from the GFSK modulator (or a Gaussian filter) 3926. A third BLE signal 4404 represents the stronger BLE packet signal after rising edge detection of Gaussian bits and then transmitting with faster edges. The third BLE signal 4404 may be generated by an attacking device. As can be seen, the edges are slanted and the transition is faster than the transitions of the second BLE curve 4402. This causes the corresponding bits to be earlier/occur than the bits of the second curve (or an output of the GFSK modulator 3924). Areas where differences can be detected are indicated by ovals 4406. The corresponding bits for the first BLE curve 4400 are shown above the first BLE curve 4400. FIG. The corresponding bits for the second BLE curve 4402 are shown below the second BLE curve 4402 . The corresponding bits for the third BLE curve 4404 are shown below the bits for the second BLE curve 4402 and shifted to the left relative to the bits of the second BLE curve 4402.

44 shows the second and third BLE curves 4402, 4404 of FIG 43 , where the third BLE curve 4404 has been shifted relative to the second BLE curve 4402. The following operations can be performed to defend against a bit acceleration attack. A bit acceleration attack may refer to when an attacking device accelerates or prefers transmission of a BLE signal to account for delays associated with the attacking device transmitting the BLE signal, such as a BLE Receives, processes and/or modifies and forwards signal transmitted by a key fob and/or other portable access device. 45 FIG. 12 shows an exemplary method for detecting a range-extending-type relay attack. Although the following operations of 45 mainly referring to the implementations of 2-6 , 11 and 14 are described, the operations may be easily modified to apply to other implementations of the present disclosure. The operations can be performed iteratively. The following operations may be performed by one or more of the modules 210, 211, 212, for example.

The procedure can start at 4600. At 4602, a sliding correlation function is used to align a received input waveform with an idealized Gaussian waveform (or other suitable predetermined waveform) for a known bit pattern and bit rate, resulting in peak scaling and aligning -/aligning zero offsets of the received input waveform and the predetermined waveform. This can be done by the Correlation and Logging Module 3920 of 38 be made. This can be done, for example, to identify or determine/recognize a synchronization access word. An example of this is in 44 shown.

At 4604, portions (or portions) 4605 of the received waveform that occur early in time, after a zero crossing, and before a next peak of the predetermined waveform are integrated and accumulated (or summed). This is called positive accumulation.

At 4606, portions (or portions) 4607 of the received waveform that occur late in time, after a peak, and before a next zero crossing are integrated and accumulated. This is also known as positive accumulation.

At 4608, the resulting accumulation values determined at 4604 and 4606 are averaged over the number of transitions used to provide an indication of a level of bit acceleration attack. The accumulated values can be averaged separately to provide two averages, or summed and then averaged to provide a single average.

At 4610, it is determined whether an attack has occurred and/or is likely to have occurred based on the one or more average values and one or more predetermined threshold values. At 4612, if an attack has occurred and/or is likely to have occurred, operation 4614 is performed, and otherwise operation 4616 is performed. At 4614, a countermeasure is performed, such as any of the foregoing countermeasures, including preventing access to and/or operation of the corresponding vehicle. One or more alarms can be generated. As another example countermeasure, data related to the attack may be stored in memory and/or transmitted to a vehicle owner's network device and/or a central monitoring station. At 4616, access to and/or operational control of the vehicle is permitted if an attack has not occurred and/or is unlikely to have occurred. Operational control may include, for example, unlocking or locking doors of the vehicle, remote starting an engine of the vehicle, interior air conditioning adjustment of the vehicle, and so on. At 4618, the one or more averages may be discarded and/or old integrated and accumulated data may be discarded. When a sliding window is used to monitor received signals, old parts of the data can be discarded while more recent/younger parts can be retained for purposes of subsequent integration, accumulation, and averaging with newly received data.

46 12 shows a vehicle 5200 that includes a round trip time (RTT) responder 5202 and an RTT initiator 5204, and a portable access device 5206 that includes an RTT initiator 5208 and an RTT responder 5210. As used herein, an “initiator” may refer to a network device that includes a BLE radio, a transmitter, and/or a receiver, and initiates a signal or tone exchange. As used herein, a “responder” may refer to a network device, including a BLE radio, a transmitter, and/or a receiver, that responds to a signal and/or tone received from an initiator will. The RTT Responders 5202, 5210 and the RTT Initiators 5204, 5208 can be implemented, for example, by the RF antenna modules 40, the RF circuits 223 and/or the modules 210, 211, 212 of 3 be implemented and include corresponding transmit and receive circuitry. The vehicle 5200 may include antenna modules with single and circular polarized antennas as described above. The RTT responder 5202 and the RTT initiator 5204 can transmit and receive using the antennas. The antennas provide polarization diversity with antennas (e.g. single polarized antennas) used by the RTT initiator 5208 and the RTT responder 5210 such that at any time at least one of said vehicle antennas 5200 has at least one polarization axis aligned with a polarization axis of at least one of the antennas of the portable access device 5206 is non-cross-polarized and non-co-polarized.

Devices 5202, 5204, 5208, 5210 may each include a control module as described above to perform any of the described operations. The devices 5202, 5204, 5208, 5210 can transmit and receive RF signals on random channels (e.g. 40 BLE channels over an 80 MHz spectrum). Devices 5202, 5208 can communicate with each other, including transmitting and receiving signals, while devices 5204, 5210 can communicate with each other, including transmitting and receiving signals. Communication between devices 5202, 5208 may be concurrent with communication between devices 5204, 5210. Transmission of signals for determining RTTs can be transmitted simultaneously and in a bi-directional manner for security reasons and for detecting an attack. Devices 5202, 5204 may share with portable access device 5206 the frequencies on which to communicate. The frequencies may be designated and followed by devices 5202, 5204, 5208, 5210 in a predetermined order. When a bandpass filter is used to monitor two channels simultaneously, the filter introduces a propagation delay.

A typical bandpass filter delay is 0.5 per bandwidth (or 0.5/bandwidth). The channel spacing of a protocol, randomness in channel selection, randomness in transmit direction over time, and simultaneous transmissions force bandpass filters to detect bits that have group delays that are large compared to the round trip delay that can be measured. This further increases difficulty for an attacking device to perform a range-extending-type relay attack. The vehicle 5200 and the portable access device 5206 may each adjust transmit power levels and transmit channel spacing such that it is impractical or impossible, for example, for an attacking device to have a filter that is wide/wide enough to transmit the signals with a short enough delay for transmission, but narrow enough to analyze the signals.

In one embodiment, signals are transmitted to measure direct time-of-flight times and to determine whether a predetermined amount of delay (e.g., 10-500 nanoseconds (ns)) is present, which is often associated with an attacking range-extending type device. A range-extending-type attacking device, when relaying signals between the vehicle 5200 and the portable access device 5206, may delay transmitted signals by the predetermined amount. Said bi-directional and simultaneous transmission and reception makes it difficult for an attacking device to determine the frequency, channel and direction of signals being transmitted at any given time. It is also difficult for the offending device to avoid relaying signals without the predetermined amount of delay.

47 Figure 5 shows vehicle 5200, comprising RTT Responder 5202 and RTT Initiator 5204, and portable access device 5206, comprising RTT Initiator 5208 and RTT Responder 5210. 47 12 shows signal paths through respective antennas 5300, 5302, 5304, 5306. In one embodiment, antennas 5300, 5302 have a total of three polarizations and antennas 5304, 5306 have a total of two polarizations. In another embodiment, antennas 5300, 5302 have a total of two polarizations and antennas 5304, 5306 have a total of three polarizations.

48 12 shows vehicle 5200 comprising RTT responder 5202 and RTT initiator 5204, portable entry device 5206 comprising RTT initiator 5208 and RTT responder 5210, and a range-extending-type attacking device 5400. The range-extending attacking device 5400 includes a control module 5402, which includes a bandpass filter 5404, a bit signal direction detector 5406, and a bit acceleration attack module 5408. Bandpass filter 5404 is used to detect incoming bits, but has a corresponding delay time. The bit signal direction detector 5406 determines a direction in which the bits are propagating (eg, from a vehicle to a portable access device or from the portable access device to the vehicle). The bit acceleration attack module 5408 is unable to accelerate the bits without introducing a delay time in parts of symbols (or bits) obtained by using a sliding correlation function aligned with an ideal waveform and averaging symbol -(or bit) forms can be detected over multiple symbols (or bits). Said delay time can be detected by an access module of a vehicle when determining whether an attack is occurring.

As shown, the range extension attack device 5400 includes amplifiers 5410, such as low noise amplifiers (LNA) and power amplifiers, for reception and transmission purposes. The range extension attack device 5400 may also include mixers for down-conversion and up-conversion purposes. The amplifiers 5410 are connected to antennas 5412 .

In addition to performing said communication simultaneously, channels can be selected pseudo-randomly, and access addresses can also be selected pseudo-randomly. This random selection can be made at the vehicle and shared with the portable entry device in advance. Conversely, the selection can be made at the portable access device. Conversely, the selection can be made via secure cryptographic techniques using key material from either or both of the devices contributing to the pseudo-randomly selected channel sequence and/or access address sequence. In this case, the pseudo-random sequences of access addresses serve as the cryptographically secure sequence of bits exchanged for round trip time measurements. By performing simultaneous transmit and receive operations on random channels with randomly selected access addresses, where replies are on a same channel as an initiator and the reply access address is not the same as the initiator access address, range is increased Attacking Attack Devices Difficulty performing an attack without being detected by an access module of the vehicle and/or control modules of one or more portable access devices. The range-extending attack devices must: listen on all channels in both directions simultaneously; determine in which direction the messages are traveling via the range-extending attack device; and detect the bits early and send the bits in both directions early with the correct amount of time to convince the initiators of the vehicle and the one or more portable entry devices. The range-extending attack devices must convince the initiators of the vehicle and the one or more portable entry devices that the portable entry devices are closer than the portable entry devices actually are and are at the proper distances from the vehicle to access and/or allow operational control of the vehicle. Also, with a Gaussian filter on BLE bits, the attack device has a small window of less than about 10-100 ns of early bit detection time available to detect the bits and transmit the bit early.

In one embodiment, the RF signals associated with the simultaneous communication described above are processed by modules 210, 211, 212 of 3 monitors, and monitors and/or determines said initiators and responders RSSI values and antenna polarization states (eg, degrees of polarization between transmit and receive antennas) of the signals. One or more of the modules 210, 211, 212 determine, based on the RSSI values and the polarizations, the path, frequency, channel and antenna pairs that are best for communication. The signals associated with shortest path (or least interference), best RSSI values, most/largest polarization, etc. are used to denote which path, which frequency, which channel, and which pair of antennas is to be used. This information can also be used to determine which device is transmitting and which device is receiving for each point in time. A selection of transceiver chips and channels on each device can be randomized. In one embodiment, one device (vehicle or portable access device) may be transmitting while the other of the devices is not transmitting, but rather receiving. This role can then be swapped so that the first device receives while the second device transmits and does not receive.

Although many of the techniques described above and below involve monitoring, generating, receiving, transmitting and/or measuring various parameters at a vehicle access module and detecting a range-extending-type relay attack based on that information, the techniques may be modified such that some or all of these operations performed on a control module (or other module) of a portable entry device, such as any of the portable entry devices disclosed herein. Likewise, various operations are described as being performed on a portable access device; these operations can be performed on an access module of a vehicle.

Examples of different BLE RF transmit frequencies are 2.410 gigahertz (GHz), 2.412 GHz, 2.408 GHz, and 2.414 GHz. These and other frequencies can be used by the RTT initiators and responders and/or corresponding transmitters and receivers.

In one embodiment, other transmitters of a vehicle and/or portable access device are used to lightly load one or more channels to force an attacking device to have a narrow low-pass filter to filter the RF transmitted by the initiators and responders -Detect signals. The one or more channels may include or be proximate to channels used by the initiators and responders. The signals transmitted on the one or more channels can be dummy or dummy/pseudo signals.

49 Figure 12 shows two of the BLE radios 3900 (designated 3900A and 3900B). The first BLE radio unit 3900A operates as an initiating and measuring device or an initiating and measuring device. The second BLE radio unit 3900B operates as a reflecting (or responding) device. The initiating and measuring device 3900A can set an RTT for a packet to be transmitted from the first BLE radio 3900A to the second BLE radio 3900B, a time for the second BLE radio to respond, and a time for the packet, to be transmitted from the second BLE radio 3900B to the first BLE radio 3900A. In another embodiment, the RTT includes the time to transmit the packet from the processing module 3922A of the first BLE radio 3900A to the correlation and protocol module 3920B of the second BLE radio unit and back from the processing module 3922B or the protocol module 3924B to the demodulator 3918a or the correlation and protocol module 3920A. This may include measuring propagation time: from processing module 3922A; via Protocol Module 3924A, GFSK Modulator 3926A, D/A and Low Pass Filter 3928A, Upconverter 3920A, Power Amplifier 3932A, Switch and Balun 3908A and Band Pass Filter 3906A; to the BLE radio unit 3900B; via Bandpass Filter 3906B, Switch and Balun 3908B, Low Noise Amplifier 3910B, Down Converter 3912B, Bandpass Filter and Amplifier 3914B, A/D 3916B and Demodulator 3918B, to Correlation and Protocol Module 3920B. The time to propagate from the demodulator 3918B or the correlation and protocol module 3920B to the protocol module 3924B or the processing module 3922B can also be determined. The time from the protocol module 3924B or the processing module 3922B via the GFSK modulator 3926B, the D/A and the low-pass filter 3928B, the up-converter 3930B, the power amplifier 3932B, the switch and the balun 3908B, the band-pass filters 3906B and 3906A, the switch and balun 3908A, low noise amplifier 3910A, downconverter 3912A, bandpass filter and amplifier 3914A, A/D 3916A and demodulator 3918A, or correlation and protocol module 3920A may also be specified. Although BLE radio 3900A is described as the initiator and BLE radio 3900B is described as the responder, operational roles can be switched such that BLE radio 3900B is the initiator and BLE radio 3900A is the responder.

The following operations can be performed to establish an RTT between two BLE radios (e.g. the BLE radios 3900A, 3900B of 49 ) of a vehicle and/or between a BLE radio unit of a vehicle and a BLE radio unit of a portable access device. The operations are performed to prevent an attack and/or simply to detect when/if an attack is being performed and/or has occurred. The following operations can be performed separately or in any combination. In one embodiment, a large predetermined number of packets are exchanged back and forth between the BLE radios. The initiator may measure and/or have estimates of an RTT for a signal transmitted between the BLE radios. This may be time T1 when the packet is transmitted from the first BLE radio to the second BLE radio, time T2 for the second BLE radio to respond, time T3 when the second BLE radio transmits the packet to the first BLE radio radio unit transmits back, and time T4 when the first BLE radio unit receives the packet from the second BLE radio unit.

In one embodiment, A/D and D/A clocks of the BLE radios and/or phase locked loops are dithered between packets. In addition to the dithering of the clocks, a cryptographically random variation known to the BLE radio units can be added for when transmitting least significant bits (LSBs) generated by a digital clock, where possible. Cryptographic randomization is used in such a way that an attacking device is unable to predict a precise time when a transmission will occur.

In one embodiment, each of the packets includes a large pre-agreed to Cryptographically Random Multiple Bit Identifier (PACRMBI) of, for example, 16 to 256 bits. In another embodiment, the packet bit contents are indistinguishable from the initiator and the responder to an attacking device. Based on the bit contents of the packet, the attacking device is unable to identify which direction a packet is coming from, or whether the packet is an initiator or a responder packet.

In one embodiment, channels of the BLE radios are cryptographically randomized. In one embodiment, a determination as to which of the BLE radios is the initiator or the responder is cryptographically randomized. In one embodiment, one or both of the BLE radios transmit dummy packets that are indistinguishable to the offending device from other packets transmitted by the BLE radios. A selection as to whether the BLE radios transmit the dummy packets is cryptographically randomized and can be randomly toggled. This makes it difficult for the attacking device to determine which are valid packets and in which direction the packets are being transmitted between the BLE radio units.

In one embodiment, polarization of the antenna sets used by the BLE radios is initially cryptographically randomized. It will be a hay ristics are used to select which antenna permutations between the BLE radio units provide the best "antenna channel" (combination) across the set of channels. This may include: using a heuristic that selects a higher received signal strength; Compensating antenna gain over frequency, monitoring over multiple channels; Using an antenna combination with a highest average or median power; and/or using a Rayleigh fading estimator or a Kalman filter estimator. This can reduce the cryptographically random antenna patterns and bring a focus on the "antenna-channels" (combination) that have the most/biggest power and the least cross-polarization.

In one embodiment, the in-phase and quadrature phase (IQ) stream at the receiver is prior to sending the IQ stream with an idealized upsampled IQ stream corresponding to a PACRMBI into the correlation and protocol module of the corresponding one of the BLE -Radio units upsampled (or interpolated). As an alternative to using PACKRMBIs, the transmitted messages can be encrypted and, upon receipt, bit decoded and then converted into an idealized upsampled IQ stream. The two upsampled streams can be sent via the correlation and protocol module 3920, which can check for an upsampled clock edge with sufficient correlation to match PACRMBIs. The correlation and logging module 3920 selects a maximum edge of the clock edges that represents a hit. Other clock recovery techniques can be used to interpolate subbit time to round trip time of bit streams on communication channels. This can be done in combination with upsampling correlation or in combination with normal clock sampling.

In one embodiment, amplifier settings are communicated between the BLE radios. The amplifier settings are sufficient to compensate for any frequency and amplifier gain changes in the propagation or propagation delay between the BLE radios.

In another embodiment, measured chip temperatures within the BLE radios are communicated (or shared) between the BLE radios to compensate for any temperature-based frequency and amplifier gain changes in the propagation delay between the BLE radios.

Another operation that can be performed is to communicate balun changes/variances between the BLE radios. Another operation is to add a short (e.g. 6 µs) but cryptographically random length (e.g. 4 to 8 µs) continuous wave tone to packet pairs to make a simultaneous tone exchange distance measurement while round-trip time measurements are being made.

50 shows a location and distance determination system 5600 with an RTT initiator 5602, an RTT responder 5604 and an RTT sniffer 5606. The RTT initiator 5602 and the RTT responder 5604 can be like any initiator, responder, BLE radio units, RF Circuits disclosed herein operate. The RTT sniffer 5606 may be co-located with one of the RTT devices 5602, 5604 on a vehicle and one of the antenna modules 40 of FIG 2 while the RTT device in the vehicle includes the other of the antenna modules 40 . Devices 5602, 5604, 5606 may each include a control module as described above to perform any of the described operations. Polarization diversity as described above is provided: between the antennas of the RTT devices 5602, 5604; and between the antennas of one of the RTT devices 5602, 5604 located in the vehicle and the RTT sniffer 5606. Polarization diversity is particularly exploited when performing round trip time measurements. Each of the RTT devices 5602, 5604 may include single or circularly polarized antennas.

The one of the RTT devices 5602, 5604 that is in the vehicle may be referred to as the master device, while the other of the RTT devices 5602, 5604 is referred to as the slave device. When the master device transmits a challenge signal to the slave device, the RTT Sniffer 5606 acts as a listener and detects (i) when the challenge signal is transmitted to and/or received at the RTT Sniffer 5606, and (ii) when the slave device transmits a response signal to the challenge signal, and/or (iii) when the RTT sniffer 5606 receives the response signal. The RTT sniffer 5606 may then use triangulation based on the challenge signal transmit and/or receive times and the response signal transmit and/or receive times to determine a location of the slave device. The master device can also measure the round-trip time associated with the challenge signal and the response signal to measure direct paths between antennas instead of a ricochet path. This prevents antenna alignment nulls and cross-polarization.

$${\text{T}}_{\text{MS}}={\text{T}}_{\text{SM}}$$

$$T_{MS}=\frac{T_{RX}-T_{TX}-T_{SDELAY}+FixedOffse{t}_1}{2}$$

The master device and the RTT sniffer 5606 cooperate to estimate the distance to the slave device. The following Equations 5-7 can be implemented by the master device _{to determine the amount of time T MS} for the challenge signal to be transmitted from the master device to the slave device, where: T _SM is the amount of time for the response signal to be transmitted from the slave device to the master device; T _RX is the time when the response signal is received at the master device; T _TX is the time when the challenge signal is transmitted from the master device; TSDELAY is the amount of time delay for the slave device to respond with the response signal after receiving the challenge signal; and FixedOffset ₁ is a first offset time amount that may be greater than or equal to zero. $${\text{T}}_{\text{MS}}+{\text{T}}_{\text{SM}}={\text{T}}_{\text{RX}}-{\text{T}}_{\text{TX}}-{\text{T}}_{\text{SDELAY}}+{\text{<figure-callout id="1" label="FixedOffset" filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png" state="{{state}}">FixedOffset</figure-callout>}}_1$$

$${\text{T}}_{\text{MS}}={\text{T}}_{\text{SM}}$$

$$T_{MS}=\frac{T_{RX}-T_{TX}-T_{SDELAY}+fixe\mathrm{i.e}Offse{\mathrm{<figure-callout\; id="1"\; label="t"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png"\; state="\{\{state\}\}">t</figure-callout>}}_1}{2}$$

The RTT Sniffer 5606 knows: when the challenge signal is received at the RTT Sniffer 5606; when the response signal is received at the RTT sniffer 5606; and a number of slave clock cycles between a time when the slave device received the challenge signal and a time when the slave device transmitted the response signal. The RTT sniffer 5606 (or listener) can _see a difference between the time T SLRX at which the RTT sniffer 5606 receives the response signal and a time T _MLRX at which the RTT sniffer 5606 receives the challenge signal Determine using Equation 8, where: T _SL is the amount of time for the RTT Sniffer 5606 to receive the response signal; FixedOffset ₂ is a second offset time amount that can be greater than or equal to 0; T _ML is the amount of time for the RTT Sniffer 5606 to receive the challenge signal; T _SLRX is the time when the RTT Sniffer 5606 receives the response signal; and T _MLRX is the time at which the RTT sniffer 5606 receives the challenge signal. $${\text{T}}_{\text{MS}}+{\text{T}}_{\text{SDELAY}}+{\text{T}}_{\text{SL}}+{\text{<figure-callout id="2" label="FixedOffset" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">FixedOffset</figure-callout>}}_2-{\text{T}}_{\text{ML}}={\text{T}}_{\text{SLRX}}-{\text{T}}_{\text{MLRX}}$$

$$\frac{T_{RX}-T_{TX}-T_{SDELAY}+FixedOffse{t}_1}{2}+T_{SL}+FixedOffse{t}_2-T_{ML}=T_{SLRX}-T_{MLRX}$$

$$T_{SL}=T_{SLRX}-T_{MLRX}-\frac{T_{RX}-T_{TX}+T_{SDELAY}+FixedOffse{t}_1}{2}-T_{SL}-FixedOffse{t}_2-T_{ML}$$

As the master device and the RTT Sniffer 5606 cooperate, information is shared such that one or more of these devices can estimate the distance to the slave device based on Equations 9-11. The sum of T _MS and T _SL can be substituted to provide Equations 9-11. $$\frac{T_{RX}-T_{TX}-T_{SDELAY}+fixe\mathrm{i.e}Offse{\mathrm{<figure-callout\; id="1"\; label="t"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png"\; state="\{\{state\}\}">t</figure-callout>}}_1}{2}+T_{SDELAY}+T_{SL}+fixe\mathrm{i.e}Offse{\mathrm{<figure-callout\; id="2"\; label="t"\; filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">t</figure-callout>}}_2-T_{ML}=T_{SLRX}-T_{MLRX}$$

$$\frac{T_{RX}-T_{TX}-T_{SDELAY}+fixe\mathrm{i.e}Offse{\mathrm{<figure-callout\; id="1"\; label="t"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png"\; state="\{\{state\}\}">t</figure-callout>}}_1}{2}+T_{SL}+fixe\mathrm{i.e}Offse{\mathrm{<figure-callout\; id="2"\; label="t"\; filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">t</figure-callout>}}_2-T_{ML}=T_{SLRX}-T_{MLRX}$$

$$T_{SL}=T_{SLRX}-T_{MLRX}-\frac{T_{RX}-T_{TX}+T_{SDELAY}+fixe\mathrm{i.e}Offse{\mathrm{<figure-callout\; id="1"\; label="t"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png"\; state="\{\{state\}\}">t</figure-callout>}}_1}{2}-T_{SL}-fixe\mathrm{i.e}Offse{\mathrm{<figure-callout\; id="2"\; label="t"\; filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">t</figure-callout>}}_2-T_{ML}$$

By measuring the arrival times of the challenge and response signals at the RTT sniffer 5606 and sharing this information between the RTT sniffer 5606 and the master device, the distance between the vehicle and the slave device can be estimated. For example, the distance can be estimated by the master device using the arrival times and the known time T _MS and corresponding known signal transmission rates. The RTT of the challenge signal can be determined based on the measured arrival times. The distance can then be determined based on the RTT and known signal transmission rates.

51 Figure 12 shows another location and distance determination system 5700 with an RTT initiator 5702, an RTT responder 5704 and multiple RTT sniffers 5706. The RTT initiator 5702 and the RTT responder 5704 can be any of initiators, responders, BLE radio units , RF circuits disclosed herein operate. The RTT Sniffer 5706 can be paired with any of the RTT devices 5702, 5704 are located on a vehicle and an antenna module (similar to the antenna modules 40 of 2 ) include. Devices 5702, 5704, 5706 may each include a control module as described above to perform any of the described operations. The RTT device in the vehicle may also include an antenna module similar to the antenna modules 40 of FIG 2 is. Polarization diversity is provided: between the antennas of the RTT devices 5702, 5704; and between the antennas of one of the RTT devices 5702, 5704 located in the vehicle and the RTT sniffers 5706. Polarization diversity is particularly exploited when making round trip measurements to measure direct paths between antennas rather than a ricochet path. This prevents antenna nulls from being aligned and cross-polarization.

The one of the RTT devices 5702, 5704 that is in the vehicle may be referred to as the master device, while the other of the RTT devices 5702, 5704 is referred to as the slave device. When the master device transmits a challenge signal to the slave device, the RTT sniffers 5706 operate as listeners and detect when the challenge signal is transmitted and detect when the slave device sends a response signal to the challenge signal transmits. The RTT devices 5702, 5704 may be similar to the RTT devices 5602, 5604 of FIG 50 work. Each of the RTT Sniffers 5706 can operate similarly to the RTT Sniffers 5606.

A time TAB is the amount of time for the challenge signal to be transmitted from the RTT initiator 5702 to the RTT responder 5704 . A time TBA is the amount of time for the corresponding response signal to be transmitted from the RTT responder to the RTT initiator. A time TAC is the amount of time for the first RTT sniffer to receive the challenge signal. A time TBC is the amount of time for the first RTT sniffer to receive the response signal. A time TAD is the amount of time for the second RTT sniffer to receive the challenge signal. A time TBD is the amount of time for the second RTT sniffer to receive the response signal. A time TAE is the amount of time for the third RTT sniffer to receive the challenge signal. A time TBE is the amount of time for the third RTT sniffer to receive the response signal. If TAB and TAC are known, TBC can be calculated. If TAB and TAD are known, TBD can be calculated. If TAB and TAE are known, TBE can be calculated.

$$\text{TAB}+\text{TBD}-\text{TAD}=\text{TR}\times \text{BD}-\text{TR}\times \text{AD}=\text{deltaR}\times \text{AtD}$$

$$\text{TAB}+\text{TBE}-\text{TAE}=\text{TR}\times \text{BE}-\text{TR}\times \text{AE}=\text{deltaR}\times \text{AtE}$$

$$\text{TBC}=\text{deltaR}\times \text{AtC}+\text{TAC}-\text{TAB}$$

$$\text{TBD}=\text{deltaR}\times \text{AtD}+\text{TAD}-\text{TAB}$$

$$\text{TBE}=\text{deltaR}\times \text{AtE}+\text{TAE}-\text{TAB}$$

If there are enough RTT sniffers, time TAB can be calculated. For example, if three RTT initiators know the locations of the RTT initiators relative to the master device (or initiator), the time TAB can be calculated. This can be accomplished using Equations 12-17 with the assumption that all reflections are instantaneous, where: TRxAC is the time the first RTT sniffer receives the challenge signal; TRxBC is the time when the first RTT sniffer receives the response signal; TRxAD is the time when the second RTT sniffer receives the challenge signal; TRxBD is the time when the second RTT sniffer receives the response signal; TRxAE is the time when the third RTT sniffer received the challenge signal; TRxBE is the time when the third RTT sniffer receives the response signal; deltaRxAtC is the time difference between a time when the first RTT sniffer receives the response signal and a time when the first RTT sniffer receives the challenge signal; deltaRxAtD is the time difference between a time when the second RTT sniffer receives the response signal and a time when the second RTT sniffer receives the challenge signal; deltaRxAtE is the time difference between a time when the third RTT sniffer receives the response signal and a time when the third RTT sniffer receives the challenge signal. The location of the slave device (or responder) can also be determined using Equations 18-25, where: xa is the x-coordinate of the master device; ya is the y coordinate of the master device; za is the z-coordinate of the master device; xb is the x coordinate of the slave device; yb is the y coordinate of the slave device; zb is the z coordinate of the slave device; xc is the x-coordinate of the first RTT sniffer; yc is the y-coordinate of the first RTT sniffer; zc is the z-coordinate of the first RTT sniffer; xd is the x-coordinate of the second RTT sniffer; yd is the y-coordinate of the second RTT sniffer; zd is the z-coordinate of the second RTT sniffer; xe is the x-coordinate of the third RTT sniffer; ye is the y-coordinate of the third RTT sniffer; ze is the z coordinate of the third RTT sniffer. The x,y,z coordinates of the master device and the slave device are known and the x,y,z coordinates of the slave device are determined. TBC, TBD and TBE can be determined in a manner similar to that described above. $$\text{TAB}+\text{TB}-\text{TAC}=\text{TR}\times \text{B.C}-\text{TR}\times \text{AC}=\text{deltaR}\times \text{AtC}$$

$$\text{TAB}+\text{TBD}-\text{TAD}=\text{TR}\times \text{BD}-\text{TR}\times \text{AD}=\text{deltaR}\times \text{AtD}$$

$$\text{TAB}+\text{TBE}-\text{TAE}=\text{TR}\times \text{BE}-\text{TR}\times \text{AE}=\text{deltaR}\times \text{AtE}$$

$$\text{TB}=\text{deltaR}\times \text{AtC}+\text{TAC}-\text{TAB}$$

$$\text{TBD}=\text{deltaR}\times \text{AtD}+\text{TAD}-\text{TAB}$$

$$\text{TBE}=\text{deltaR}\times \text{AtE}+\text{TAE}-\text{TAB}$$

$${\left(\text{xb}-\text{xc}\right)}^2+{\left(\text{yb}-\text{yc}\right)}^2+{\left(\text{zb}-\text{zc}\right)}^2={\text{TBC}}^2$$

$${\left(\text{xb}-\text{xd}\right)}^2+{\left(\text{yb}-\text{yd}\right)}^2+{\left(\text{zb}-\text{zd}\right)}^2={\text{TBD}}^2$$

$${\left(\text{xb}-\text{xe}\right)}^2+{\left(\text{yb}-\text{ye}\right)}^2+{\left(\text{zb}-\text{ze}\right)}^2={\text{TBE}}^2$$

Equations 18-21 are trilateration equations. $${\left(\text{xb}-\text{xa}\right)}^2+{\left(\text{yb}-\text{yeah}\right)}^2+{\left(\text{eg}-\text{za}\right)}^2={\text{<figure-callout id="2" label="TAB" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">TAB</figure-callout>}}^2$$

$${\left(\text{xb}-\text{xc}\right)}^2+{\left(\text{yb}-\text{yc}\right)}^2+{\left(\text{eg}-\text{eg}\right)}^2={\text{<figure-callout id="2" label="TB" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">TB</figure-callout>}}^2$$

$${\left(\text{xb}-\text{xd}\right)}^2+{\left(\text{yb}-\text{yd}\right)}^2+{\left(\text{eg}-\text{zd}\right)}^2={\text{<figure-callout id="2" label="TBD" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">TBD</figure-callout>}}^2$$

$${\left(\text{xb}-\text{xe}\right)}^2+{\left(\text{yb}-\text{ye}\right)}^2+{\left(\text{eg}-\text{ze}\right)}^2={\text{<figure-callout id="2" label="TBE" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">TBE</figure-callout>}}^2$$

$${\left(\text{xb}-\text{xc}\right)}^2+{\left(\text{yb}-\text{yc}\right)}^2+{\left(\text{zb}-\text{zc}\right)}^2={\left(\text{deltaR}\times \text{AtC}+\text{TAC}-\text{TAB}\right)}^2$$

$${\left(\text{xb}-\text{xd}\right)}^2+{\left(\text{yb}-\text{yd}\right)}^2+{\left(\text{zb}-\text{zd}\right)}^2={\left(\text{deltaR}\times \text{AtD}+\text{TAD}-\text{TAB}\right)}^2$$

$${\left(\text{xb}-\text{xe}\right)}^2+{\left(\text{yb}-\text{ye}\right)}^2+{\left(\text{zb}-\text{ze}\right)}^2={\left(\text{deltaR}\times \text{AtD}+\text{TAD}-\text{TAB}\right)}^2$$

Equations 22-25 are provided by substituting 4 equations with 4 variables. $${\left(\text{xb}-\text{xa}\right)}^2+{\left(\text{yb}-\text{yeah}\right)}^2+{\left(\text{eg}-\text{za}\right)}^2={\text{<figure-callout id="2" label="TAB" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">TAB</figure-callout>}}^2$$

$${\left(\text{xb}-\text{xc}\right)}^2+{\left(\text{yb}-\text{yc}\right)}^2+{\left(\text{eg}-\text{eg}\right)}^2={\left(\text{deltaR}\times \text{AtC}+\text{TAC}-\text{TAB}\right)}^2$$

$${\left(\text{xb}-\text{xd}\right)}^2+{\left(\text{yb}-\text{yd}\right)}^2+{\left(\text{eg}-\text{zd}\right)}^2={\left(\text{deltaR}\times \text{AtD}+\text{TAD}-\text{TAB}\right)}^2$$

$${\left(\text{xb}-\text{xe}\right)}^2+{\left(\text{yb}-\text{ye}\right)}^2+{\left(\text{eg}-\text{ze}\right)}^2={\left(\text{deltaR}\times \text{AtD}+\text{TAD}-\text{TAB}\right)}^2$$

If three RTT sniffers (e.g. RTT sniffers 5706 shown) are used, trilateration can be performed using three circles to measure distances and the location of the slave device relative to one of the RTT devices 5702, 5704 and/or or to determine the corresponding vehicle. This can be done at the master device and/or at one or more of the RTT sniffers. The information determined at the master device and the RTT sniffers can be shared with each other. The times, the distances and/or the locations can be determined periodically and thus updated.

In the vehicle, if an object (e.g., a vehicle occupant's head) is present near and/or between the antenna modules of the master device and one or more of the RTT sniffers, such that the object is detected by the master device transmitted signals, the round trip time dimensions or measured values can then be periodically updated. This can be done to measure the distance between the master device and the RTT sniffer to detect when the corresponding physical environment/system has changed.

52 Figure 12 shows a first network device (or vehicle) 5800 and a second network device (or portable network device) 5802. The first network device 5800 includes a tone exchange responder 5804 and a tone exchange initiator 5806. A tone exchange is also referred to as an unmodulated carrier tone exchange or a Exchange of an unmodulated carrier called. The second network device 5802 comprises a tone exchange initiator 5808 and a tone exchange responder 5810. The devices 5804, 5806, 5808, 5810 can be implemented as any of the other BLE radio units, RF circuits, initiators, responders, etc. that are disclosed herein. At least one of the devices 5804, 5808 and at least one of the devices 5806, 5808 may include or be connected to a singly polarized antenna and a circularly polarized antenna. The devices 5804, 5806, 5808, 5810 can each use the antenna module 40 of 2 and/or the in 11 include antennas shown.

Tone exchange can be performed between the 5804 responder and the 5808 initiator and the 5806 initiator and the 5810 responder. RTT measurements can be transmitted in the same packets as the tones exchanged. The devices 5804, 5806, 5808, 5810 can randomly select the channels used to transmit the packets. The transmission of packets can occur simultaneously with the receipt of packets. For example, initiator 5808 may transmit tone to responder 5804 on a first channel, while initiator 5808 receives tone from responder 5804 on a second channel. Initiator 5806 may transmit and/or receive tones while initiator 5804 transmits and/or receives tones.

The network devices 5800, 5802 may be synchronized in advance, for example, by a sequence signal exchange (or handshake) to synchronize clocks of the network devices 5800, 5802. This synchronization can be performed to allow the network devices to transmit signals to each other simultaneously. As an example, two 1MHz signals each carrying data at 1Mbps may be transmitted. The signals can be 2MHz apart. This prevents an attacking device from being able to perform an attack, such as a range extension attack or an attack with active manipulation of sounds. If the attacker used a bandpass filter that was 1MHz wide, the bandpass filter would have a large delay time, and thus would not respond fast enough to allow an attack to occur. If the attacker uses a broadband bandpass filter, such as a 4MHz bandpass filter, then the corresponding signal eye diagram would have too much noise to discern the signals transmitted by network devices 5800, 5802, respectively. As another example, the signals may be transmitted by the network devices at a symbol transmission rate less than or equal to a predetermined amount of time (e.g., 1 µs per symbol). This provides fast transmission that prevents attack. The simultaneity of dual signals also prevents an attacker from being successful, since the attacker would have to detect and influence both signals. Both signals can be transmitted on different frequencies, through the same network device or through different network devices, as described above.

The devices 5804, 5806, 5808, 5810 can change the frequencies of the transmitted tones, monitor phase changes due to changes in frequencies, and determine a distance between the network devices 5800, 5802 based on the phase changes. This can be referred to as carrier phase based ranging. Alternatively, when a signal is transmitted and received as a result of the signal being reflected back to the source, a phase difference between the transmitted signal and the received signal can be used to calculate a modulus of a distance between the source and to determine the reflector. Likewise, an initiator can determine a modulo of a distance between the initiator and a responder based on a phase difference between (i) a signal transmitted from the initiator to the responder and (ii) a corresponding response signal transmitted by transmitted back to the initiator by the responder. A slope of a phase difference for a frequency change amount is equal to or equal to a distance with a frequency step size limitation. The smaller the frequency steps, the greater the modulus extension distance (see "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan, and Capkun, which is incorporated herein by reference).

As another example, a received signal strength indicator (RSSI) parameter can be monitored to determine whether a network device is in the vicinity of a vehicle and then perform a series of tone exchanges to measure a distance. Based on a user's door handle touch, tone exchanges can be made to ensure there is no attack. Multiple round trip time measurements may be performed to determine a distance of the network device relative to the vehicle.

The foregoing distance determination techniques may be used in combination with other techniques disclosed herein for determining RTT values. The direction of propagation of the tones between the devices 5804, 5806, 5808, 5810 can be randomized.

In one embodiment, a control module of the first network device 5800 plots phase changes versus frequency changes for each of multiple tones that are exchanged to generate multiple linear curves. The control module determines the slopes of the curves that behave provide metrics of phase changes versus frequency changes. The slopes are then used to determine the distances between adjacent ones of the curves that are related to the distance between the first and second network devices 5800, 5802.

53 Figure 12 shows a location determination system 5900 with a tone exchange initiator 5902, a tone exchange responder 5904 and a tone exchange sniffer 5906. The tone exchange initiator 5902 and the tone exchange responder 5904 can be any of the initiators, responders, BLE radio units, RF circuits disclosed herein work. The Tone Exchange Sniffer 5906 can be used similar to the RTT Sniffer 5606 from 50 work and are on a vehicle together with one of the sound exchange devices 5902, 5904 and one of the antenna modules 40 of FIG 2 include while the in-vehicle sound exchange device includes the other of the antenna modules 40 . Devices 5902, 5904, 5906 may each include a control module as described above to perform any of the described operations. Polarization diversity is provided: between the antennas of the tone exchange devices 5902, 5904; and between the antennas of one of the tone exchange devices 5902, 5904 located in the vehicle and the tone exchange sniffer 5906. Polarization diversity is particularly exploited when making round trip time measurements.

The one of the tone exchange devices 5902, 5904 located in the vehicle may be referred to as the master device, while the other of the tone exchange devices 5902, 5904 is referred to as the slave device. When the master device transmits tones to the slave device and vice versa, the tone exchange sniffer 5906 acts as a listener and detects (i) when the tones are transmitted to and/or received by the tone exchange sniffer 5906 (ii) when the slave device transmits tones to the master device, and/or (iii) when tone exchange sniffer 5906 receives tones transmitted by the slave device. The slave device can act as a reflector and transmit sounds received from the master device back to the master device. The master device and/or the sniffer device may prevent at least one of access to or operational control of the vehicle based on the arrival times of the tones, round-trip time measurements, and/or estimated distances between the devices.

54 shows a method for determining distances between an initiator and a responder and between a responder and a sniffer. Although the following operations of 54 mainly referring to the implementations of 50 and 53 are described, the operations can be easily modified to apply to other implementations of the present disclosure, such as the implementations of FIG 2-6 , 11 , 14 , 39 and 46-49 . The operations can be performed iteratively. Although the method mainly refers to the embodiment of FIG 53 is described, the method can be applied to other embodiments of the present invention.

The procedure can start at 6000. At 6002, tone exchange initiator 5902 transmits a tone signal having a tone to tone exchange responder 5904. The tone can be expressed as e ^{(jωt+ϕ A )-τ AWAY} , where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, τ _{AB is} a propagation time from A to B and is directly related to the distance between the tone exchange initiator 5902 and the tone exchange responder 5904, ω a is frequency, φ _{A is} the phase of the tone at tone exchange initiator 5902, t is time.

At 6004, the tone is received at tone exchange responder 5904 with delay φ _B and tone exchange sniffer 5906 with delay φ _C . At the Tone Exchange Responder 5904, the received tone signal is downconverted to baseband, which can be expressed by Equation 26. $$e^{\left(j\left(\mathrm{\omega }t+{\mathrm{\varphi }}_A\right)\right)}{e}^{\left(j\mathrm{\omega }{\mathrm{\tau }}_{AB}\right)}{e}^{\left(-j\left(\mathrm{\omega }t+{\mathrm{\varphi }}_B\right)\right)}=e^{\left(j\mathrm{\omega }{\mathrm{\tau }}_{AB}+{\mathrm{\varphi }}_A-{\mathrm{\varphi }}_B\right)}$$

At the Tone Exchange Sniffer 5906, the received tone signal is downconverted to baseband, which can be expressed by Equation 27. $$e^{\left(j\left(\mathrm{\omega }t+{\mathrm{\varphi }}_A\right)\right)}{e}^{\left(j\mathrm{\omega }{\mathrm{\tau }}_{AC}\right)}{e}^{\left(-j\left(\mathrm{\omega }t+{\mathrm{\varphi }}_C\right)\right)}=e^{\left(j\mathrm{\omega }{\mathrm{\tau }}_{AC}+{\mathrm{\varphi }}_A-{\mathrm{\varphi }}_C\right)}$$

$$e^{\left(j\left(\mathrm{\omega }\text{t+}{\mathrm{\varphi }}_{\text{B}}\right)\right)}{e}^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{BC}}\right)}{e}^{\left(-\text{j}\left(\mathrm{\omega \tau +}{\mathrm{\varphi }}_{\text{C}}\right)\right)}=e^{\left(-\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{BC}}+{\mathrm{\varphi }}_{\text{B}}-{\mathrm{\varphi }}_{\text{C}}\right)}$$

At 6006, the tone exchange initiator 5902 receives the tone from the tone exchange responder 5904, which retransmits the tone signal back to the tone exchange initiator 5902 as a second tone signal. The tone can be expressed as e ^{(jωt+ϕ A ) τ AWAY} . The received second audio signal can through Equation 28 can be presented. The tone exchange sniffer 5906 also receives the second tone signal, which can be represented by equation 29. $$e^{\left(j\left(\mathrm{\omega }t+{\mathrm{\varphi }}_B\right)\right)}{e}^{\left(j\mathrm{\omega }{\mathrm{\tau }}_{BA}\right)}{e}^{\left(-j\left(\mathrm{\omega }t+{\mathrm{\varphi }}_A\right)\right)}=e^{\left(-j\left(\mathrm{\omega }t+{\mathrm{\varphi }}_A\right)\right)}$$

$$e^{\left(j\left(\mathrm{\omega }\text{t+}{\mathrm{\varphi }}_{\text{B}}\right)\right)}{e}^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{B.C}}\right)}{e}^{\left(-\text{j}\left(\mathrm{\omega \tau +}{\mathrm{\varphi }}_{\text{C}}\right)\right)}=e^{\left(-\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{B.C}}+{\mathrm{\varphi }}_{\text{B}}-{\mathrm{\varphi }}_{\text{C}}\right)}$$

At 6008 , the tone exchange initiator 5902 receives a phase signal from the tone exchange responder 5904 indicating a tone value of a natural logarithm with a phase difference of the tone when received at the tone exchange responder 5904 . The Tone Exchange Responder 5904 thus sends a measured phase to the Tone Exchange Initiator 5902 where values are/are multiplied as represented by Equation 30. $$e^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{AWAY}}+{\mathrm{\varphi }}_{\text{A}}-{\mathrm{\varphi }}_{\text{B}}\right)}{e}^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{B.A}}+{\mathrm{\varphi }}_{\text{B}}-{\mathrm{\varphi }}_{\text{A}}\right)}=e^{\left(2\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{AWAY}}\right)}$$

At 6010, based on the received tone signals, the tone exchange sniffer 5906 determines tone values associated with: a phase difference of the tone between a time when it is transmitted from the tone exchange initiator and a time when it is on the tone exchange sniffer is received; and a phase difference of the tone between a time when it is transmitted from the tone exchange responder and a time when it is received at the tone exchange sniffer. The tonal values can be represented e ^{(jωτ B.C +θ B -θ C )} and e ^{(jωτ AC +θ A -θ C )} .

At 6012, the initiator 5902 and/or the sniffer 5906 determine the distances between the initiator 5902 and the responder 5904 and between the initiator 5902 and the sniffer 5906. The distance values may be determined in a manner similar to that set forth above when a round trip time is detected, see for example equations 12 and 15 and corresponding description. A phase is used instead of an orbital period. This calculation may involve using Equation 31, where the tone values e ^{(jωτ B.C +ϕ B -ϕ C )} and e ^{(-jωτ AC -ϕ A +ϕ C ) are} measured or determined at the sniffer 5906, e ^{(jωτAC) is known} a priori, and tone value e ^{(jωτ AWAY +ϕ A -ϕ B )} at the responder 5904 is determined. $$\begin{array}{l}{e}^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{B.C}}+{\mathrm{\theta }}_{\text{B}}-{\mathrm{\theta }}_{\text{C}}\right)}{e}^{\left(-\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{AC}}-{\mathrm{\theta }}_{\text{A}}+{\mathrm{\theta }}_{\text{C}}\right)}{e}^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{AC}}\right)}{e}^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{AWAY}}+{\mathrm{\theta }}_{\text{A}}-{\mathrm{\theta }}_{\text{B}}\right)}=e^{\left(\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{B.C}}+\text{j}\mathrm{\omega }{\mathrm{\tau }}_{\text{AWAY}}\right)}=\\ e^{\text{j}\mathrm{\omega }\left({\mathrm{\tau }}_{\text{B.C}}+{\mathrm{\tau }}_{\text{AWAY}}\right)}\end{array}$$

The initiator 5902 and/or the sniffer 5906 may take the inverse logarithm of the result of Equation 31 to provide the times τ _BC and τ _AB . The distances between the responder 5904 and the sniffer 5906 and between the initiator 5902 and the responder 5904 can then be determined based on these times and the known transmission rates of the audio signals. The method may end at 6014. The initiator 5902 or the sniffer 5906 may prevent access to or operational control of the vehicle based on the at least one of the estimated distances.

55 12 shows an example of a passive tone exchange and phase difference detection system 6100. The system 6100 includes a phase locked loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and antenna modules 6110. The antenna modules 6110 can be similar to the antenna modules 40 of FIG 2 being. The transmitter 6106 transmits a first tone, which may be an output from the PLL 6102 and is reflected back to the receiver 6108 by a reflector 6112 . The output from the PLL and the reflected audio signal are provided to phase module 6104 . The phase module 6104 determines a phase difference between the output from the PLL and the reflected audio signal. The phase module 6104 or other module disclosed herein determines a distance between the transmitter 6106 and the reflector 6112 based on the phase difference. The phasing module 6104 or other module disclosed herein may prevent access to an interior of and/or operational control of a vehicle based on the determined distance.

56 12 shows an example of an active tone exchange and phase difference detection system 6200. The system 6200 operates similarly to the system 6100 of FIG 55 . The sender and receiver 6106, 6108 are represented by box 6202. The reflector 6112 from 55 can be replaced with responder device 6204 for an active exchange of tones. Responder device 6204 may receive a first audio signal having first one or more tones from transmitter 6106 and respond with a second audio signal. The second tone signal may include the one or more tones and/or one or more other tones. The second tone signal is transmitted back to the 6108 receiver.

57 shows an initiator packet 6300 and a response packet 6302 used for RSSI and time-of-flight measurements. The initiator packet 6300 may include several fields, such as a preamble, a synchronization gateword (e.g., a pseudo-random synchronization gateword), a data field containing data, a cyclic redundancy check (CRC) field containing CRC bits, and a continuous wave ( CW) tone field with a CW tone. Response packet 6302 may include a CW tone field, a preamble, a synchronization access word, a data field, and a CRC field.

An initiator device may transmit the initiator packet 6300, which may be received at a responder device. The responder device can then generate the response packet 6302 and transmit the response packet back to the initiator device. This can be done for tone exchange, phase difference determination, round trip time measurements, etc. A distance between the devices can then be determined. These measurements and calculations can be performed to detect a range extender type relay station attack. In one embodiment, the initiator and the responder negotiate in advance what the synchronization gate words will be based on a predetermined list. The synchronization gate words include gate addresses. For example, the initiator may measure the amount of time to receive (i) the response packet after transmitting the initiator packet and/or (ii) the synchronization gateword. The amount of time and the synchronization gateword may be compared to predetermined amounts of time and a predetermined synchronization gateword. If the comparisons made result in matches, then a range extender type relay station attack has not occurred. However, if the received synchronization access word does not match and/or the time amounts are more than a predetermined amount different than expected, then a range extender type relay station attack may have occurred.

In one embodiment, the initiator and the responder exchange a predetermined key, a list of synchronization access words, and times at which each of the synchronization access words is to be transmitted. The synchronization gatewords can be randomly selected when they are/are initially generated. This allows the responder to know the correct key and/or synchronization gateword to respond with when receiving an initiator packet. The key can be included in the response packet. In another embodiment, the initiator and response packets do not include the preambles as described in 58 is shown. In one embodiment, the CW tones are 4-10 µs in length.

In another embodiment, the initiator packet and the responder packet have the same format as defined in 59 is shown. Each of the packets includes: as a first field, a first CW tone; a synchronization gateword; a data field; a CRC field; and as a final field, a second CW tone. Another example of initiator and response packets with the same format is in 60 as shown, each packet comprising: as a first field, a CW tone; a synchronization word with PACRMBI; a PDU field with a PDU; a media access control (MAC) field; a CRC field; and as a final field, a second CW tone. The CW tones of 57-60 may be tones of cryptographically random length and, when received, may be examined by the initiator. For example, if CW tones received from a responder are incorrect, then a range extender type relay station attack may have occurred. With the examples of 59-60 Sync word round-trip time/delivery prevents CW tone exchange wraps beyond an ambiguous range (e.g., 75 meters) at 2 MHz channel tone steps. The initiator and responder packets referred to above may be transmitted on a same frequency. By having the initiator and responder packets in the same format, an attacking device is unable to distinguish which packet is the initiator packet and which packet is the responder packet. In one embodiment, the CW tones at the end of the packets are not included.

In one embodiment, the timing, frequencies, lengths, power levels, amplitudes, and contents of the CW tones and synchronization access words of the initiator and responder packets are examined at the initiator and responder, respectively. to determine if they are accurate and/or consistent and to identify or detect/detect if an attack has occurred. In one embodiment, a pseudo-random number of packets are exchanged on a first frequency before switching to a next frequency and another pseudo-random number of packets are exchanged.

Since an attacking device typically includes filters (eg, low-pass and band-pass filters) and mixers (eg, a down-converter and an up-converter), an attacking device introduces delays in forwarding a signal. In order for an attack by an attacking device not to be detected, the attacking device must retransmit a received signal without a detectable delay. This makes it difficult for the offending device to go undetected. An attacking device can delay a signal 500 ns, which can delay the signal in space 500 feet (ft). In order for an attacking device to prioritize transmission of a tone or start transmission of a tone at a correct time, the attacking device must know in advance what is being transmitted. This is unlikely. This is especially true when a heterodyne receiver is used to receive the relayed signal. The heterodyne receiver translates packets/tones into an in-phase (I) - quadrature-phase (Q) domain and detects in the IQ domain. Phase differences are detected in the IQ domain. When there is an attack, the delay in the IQ domain resulting from the attack can be detected based on phase differences. If a tone is/is shortened/truncated by an attacking device so that the corresponding synchronization gateword arrives at the correct time, then the timing and length of the CW tone is incorrect and this is detected by the initiator .

In one embodiment, the initiator examines the CW tones transmitted by the responder for (i) length relative to a start of a transmitted synchronization access word, (ii) consistent power (or amplitude) before and relative to the synchronization access word, and (iii) consistent tone across the synchronization gateword. Consistent tone can refer to consistent frequency, consistent power level, consistent amplitude, etc. In another embodiment, the start and end times of the synchronization access word relative to a beginning of a first CW tone of a transmitted packet may be known within a predetermined amount of time (e.g., a ±10 ns range). Thus, if the start and end times are within predetermined ranges of a beginning of a first CW tone of the packet, then there has been no attack, and otherwise an attack has occurred.

As another example, from an initiator transmitting a tone, a PLL may have 3 different tones on a particular channel that the PLL can generate; a medium tone, a high tone at a first frequency (e.g. 250 kHz) and a low tone at a second predetermined frequency (e.g. -250 kHz). The transmitted tones can be selected and transmitted according to a predetermined agreed random sequence and/or a predetermined agreed tone pattern. This can be agreed between the initiator and the responder. The PLLs of the initiator and an attacking device may not be consistent with each other. If there is a frequency difference greater than a predetermined threshold between the signal transmitted by the initiator and the signal received in response thereto, the initiator can determine that an attack has occurred.

In one embodiment, the responder is able to measure, for a received signal, with what phase delay the responder detects and reply this back in data. This may be based on a time when the responder receives a CW tone of a trailing end of a packet from an initiator. The responder can measure a phase delay between (i) the CW tone of a trailing end (or trailing) of the packet received from the initiator and (ii) a leading end (or a first leading/leading CW tone) of a packet transmitted by the responder in response to the packet received from the initiator. The initiator can calculate the total round trip time of the packet from the initiator to the responder and then from the responder back to the initiator.

In addition to detecting a delay in a signal, an initiator can also detect when an offending device amplifies the signal (or tone). Amplifying a signal/sound can also delay transmission, which can be detected. During the relaying of tones at an offending device, a tone may be distorted and/or a different tone may be transmitted in place of the tone originally transmitted.

The above examples allow for more accurate distance measurements with a smaller number of packets, each containing both a sync access word and a CW tone. The synchronization gateword protects the CW tone from being modified without detection by an offending device and vice versa. Two-way randomization communication is performed, protecting both the sync access words and the CW tones.

A PLL as disclosed herein by an initiator may be a phase predictable PLL that allows the initiator to predict a phase of a signal when a frequency of the signal is changed. This can eliminate a need for checking whether a time of a CW tone transmitted by the initiator and a CW tone transmitted by a responder are correct. A responder may measure when, for example, a back-end CW tone is received from an initiator, determine the corresponding phase delay of the back-end CW tone relative to a generation of a front-end CW tone by the responder for a response signal, and transmit this information to the initiator with the CW tone of a front end. The initiator can then calculate a total round-trip time based on the information received.

In one embodiment, an initiator is one of a vehicle or a portable entry device, and a responder is the other of the vehicle and the portable entry device. The order in which the vehicle and the portable entry device transmit and respond is changed pseudo-randomly. Also, a packet and/or tone can be sent as a response and then used as an initiator packet and/or initiator tone. In one embodiment, the order in which the vehicle and portable access device transmit and respond is not changed for short periods of time (e.g., exchange periods less than a predetermined amount of time) and is changed for long exchange periods (e.g., exchange periods greater than or equal to the predetermined amount of time). The order can be changed periodically. In these examples, bi-directional data is exchanged using antenna polarization diversity to provide correct timing measurements.

Processing is implemented to provide accurate measurements of start and end points of CW tones and sync gatewords. Correlation and logging module 3920 may maintain and lock a circular queue of bits for comparison between start and end times and lengths of CW tones and synchronization access words of transmitted (initiator) packets and start and end times and to perform lengths of CW tones and synchronization access words of received (responder) packets. The correlation and logging module 3920 may interpolate where zero crossing points are located. Post-processing on I and Q data associated with a synchronization gateword can be performed for clock recovery to interpolate when the synchronization gateword arrived. I and Q data can have different rates of change/rotation. Interpolation can be performed to determine where midpoints of transitions are to get precise timing for clock recovery. Multiple zero crossing points can be detected and aligned for dialing in timing. Also, as further described below, I and Q data may be oversampled to best align one or more bits.

61 FIG. 6 shows an antenna routing system 6700 for network devices with respective antenna modules. The antenna modules show polarization diversity. In this example, two polarization axes are shown for each antenna module. Each antenna module includes a vertically oriented antenna and a horizontally oriented antenna. Possible channel vectors h _VV , h _VH , h _HV and h _HH are shown. Distance measurement modules 6710 are shown. The ranging modules 6710 determine a range (or distance) between the corresponding antennas of the network devices based on a respective one of the channel vectors h _VV , h _VH , h _{HV ,} and h _{HH .} The ranging modules can execute ranging algorithms to determine distances r̂ _VV , r̂ _VH , r̂ _HV and r̂ _HH . The determined distances r̂ _VV , r̂ _VH , r̂ _HV and r̂ _HH are provided to a minimum module 6712 which determines which of the distances r̂ _VV , r̂ _VH , r̂ _HV and r̂ _{HH is} the shortest. The path that is the shortest can be selected.

Each of the channel vectors can be generated for one or more selected frequencies. When compared, the distances for channel vectors of the same frequency or different frequencies can be generated. As an example, vectors can be generated for at least some of 80 different tones that have a 1 MHz frequency step between adjacent tones and are within a 2.4 GHz ISM band (ISM: "Industrial, Scientific and Medical"). A frequency related to the shortest distance can be selected. Other factors may also be considered when making the selection, such as signal strength, amplitude, voltage, parameter consistency, etc. This path selection may be performed by any of the initiators, the responders, the modules, the network devices, etc are disclosed and used for round trip time measurements. This allows a best antenna path to be selected for bi-directional packet and/or tone signal exchange for determining a round trip time.

Now reference is made to 38 and 62 , which shows an exemplary radio unit model 6800 consistent with the structure, functionality, and operations of the BLE radio unit 3900 (and/or a modified version of the BLE radio unit 3900) of FIG 38 and corresponds to an RF channel and a corresponding RF circuit. The radio unit model 6800 may include: a first sampling module 6802, a time offset module 6804, a Gaussian low-pass filter 6806, an integrator 6808, a first upsampler 6810, an amplifier 6812, a summer 6814, a modulator 6816, a second sampling module 6818, a phase and Frequency offset module 6820, a first mixer 6822, a phase delay device 6823, a second mixer 6824, a phase delay module 6826, a second low-pass filter 6828, a resampling module 6830, an arctangent module 6832, a differentiator 6834, a sign determination module 6836, a bit pattern module 6838, a second upsampler 6840, a third upsampler 6842, a cross-correlation module 6844, and a peak detector 6846. Devices 6802, 6804, 6806, 6808, 6810, 6812 may represent an example of the transmitter portion of BLE radio 3900 and another BLE radio . The summer 6814 represents the channel between (i) the other BLE radio and (ii) the BLE radio 3900 with the devices 3907, 3906, 3908, 3932 and 3910. Phase and frequency offset can occur between the received BLE radio and of the transmitting BLE radio exist since the receiving BLE radio cannot be phase-locked to the transmitting BLE radio. Devices 6816, 6818, 6820, 6822, 6824, 6828, 6830 correspond to the receiver portion of the BLE radio unit and are associated with an RF sampling rate. The devices 6830, 6832, 6834, 6836, 6838 correspond to the receiver section and perform operations on baseband signals. The 6830 resampling module operates as an analog to digital converter. Devices 6840, 6842, 6844 and 6846 also correspond to the receiver section and are associated with interpolation to determine phase.

When reconstructing a bit stream, zero crossings of a reconstructed signal from the differentiator 6834 can be determined. There can be a significant amount of jitter at the zero crossings, adversely affecting time-of-flight determinations based on a time of zero crossings. A small amount of jitter adversely affects transmit and receive time determinations.

The upsamplers 6840, 6842 and the cross-correlation module 6844 are implemented to reduce jitter associated with sampling and zero-crossing determinations. The upsamplers 6840, 6842 perform signal processing to interpolate and insert data points between existing receive data points to provide finer time resolution.

In one embodiment, the transmitted bit stream is a priori known by the BLE receiver and is provided to the upsampler 6842 as shown by arrow 6843 . In this example, the sign determination module 6836 and the bit pattern module 6838 are not included. In another embodiment, the transmitted bit stream is not known and the sign determination module 6836 and the bit pattern module 6838 are included and provide an estimated bit stream to the upsampler 6842 . As an example, the transmitted bit stream may be a port address identifying which device is transmitting. The estimated bit stream can be determined based on a reference. For example, the reference can be a preamble from the estimated bit stream and/or a bit sequence received before the estimated bit stream. The preamble and/or the bit sequence provide a temporal reference based on which the estimated bit stream can be generated. The estimated bit stream is generated based on a known clock frequency of the transmitter and in relation to the transmitted signal and a clock frequency of the receiver.

The cross-correlation module 6844 cross-correlates between upsampler 6840, 6842 outputs and/or cross-correlates between the upsampler 6840 and bitmap module 6838 outputs. The cross-correlation is performed to match envelopes of signals provided to the cross-correlator and to determine a phase difference. The cross-correlation may include performing a product of the output signals, comprising taking products of corresponding data points of the two output signals and summing the products. This product-and-sum process is iterated while incrementally shifting one of the outputs in time relative to the other of the outputs by one data point for each iteration to provide multiple resulting product-sum values. A maximum of the product sum values refers to a point in time when the two outputs are in synchronization (or aligned) so that the waveforms or progression forms match and are time-aligned or coordinated. Based on this information, the phase offset (or difference) between the two outputs is determined.

The cross-correlation has improved resolution due to the upsampling performed by the upsamplers 6840,6842. The cross-correlation module 6846 performs a correlation with signals of finer resolution than those originally received in order to obtain a finer interpolation of a received packet arrival time in the received signal. The higher correlation resolution reduces signal-to-noise ratios and bit lengths of messages and may include interpolating with a finer resolution. The phase offset can be used for time of flight determinations as described herein. The peak detection module 6846 evaluates cross-correlation results and designates (i) when the timed peak occurred and/or (ii) the phase offset. In one embodiment, the cross-correlation module 6844 receives digital values, and the peak detection module 6846 determines whether the cross-correlation output (or product sum value) has reached a predetermined threshold. When the predetermined threshold has been reached, the peak detection module then designates "signal found" and determines a phase.

In one embodiment, the output of upsampler 6840 is provided to sign determination module 6836 and cross-correlation module 6844, and upsampler 6842 is not included. In this example, the output of the Bit Pattern Module 6838 is provided directly to the Cross Correlation Module 6844.

The devices of 38 and 62 are related to the procedure of 63 further described. Although the following operations of 63 mainly related to the implementations of 2-6 , 11 , 14 and 38 are described, the operations may be easily modified to apply to other implementations of the present disclosure. The operations can be performed iteratively.

The procedure can begin at 6900. At 6902 , the scanning module 6802 of a first network device (e.g., a network device implemented in a vehicle as part of an onboard vehicle system or in a portable access device) receives a bit stream to be transmitted by the processing module 3922 . The sampling module 6802 samples the bit stream.

At 6904, the skew module 6804 receives an output of the sampling module 6802 and may introduce a skew (or delay). The sampling module 6802 and the time offset module 6804 can be implemented by the protocol module 3924 . At 6906, the Gaussian Low Pass Filter (LPF) 6806 receives an output of the time shift module 6804, which may include a bit stream that is filtered, and converts it from a square wave to a sinusoidal wave. Operation of the Gaussian LPF 6806 can be implemented by the GFSK modulator 3926 . At 6908, the integrator 6808 integrates an output of the Gaussian LPF 6806, and this can be implemented by the D/A and low-pass filter 3928. Exemplary signals 7000, 7002, 7004 output from sampling module 6802, Gaussian LPF 6806, and integrator 6808 are in FIG 64A shown.

At 6910, upsampler 6810 upsamples an output of integrator 6808 to include additional points per sample. Upsampler 6810 may be implemented by upconverter 3930. At 6912, the amplifier 6812 provides a frequency deviation gain. At 6914 , sampling module 6818 receives an RF tone that may be provided by PLL 3940 . An output of sampling module 6818 is provided to both modulator 6816 and phase and frequency offset module 6820 . At 6916, modulator 6816 modulates an output of sampling module 6818 based on an output of amplifier 6812 to provide an initiator signal. Modulator 6816 may be implemented at least in part by upconverter 3930 .

At 6918, the initiator signal from the modulator 6816 may be provided to the power amplifier 3932 and transmitted to a second network device. The second network device may be a network device implemented in a vehicle as part of an onboard vehicle system or in a portable access device. The initiator signal may be any of the initiator signals, initiated audio signals, signals transmitted by a master device, and/or the like disclosed herein.

At 6920, the low noise receiver 3910 amplifies a response signal in response to the initiator signal. The response signal may include Gaussian noise included in the received response signal as represented by summer 6814 . At 6922, mixers 6822, 6824 receive the response signal from low noise amplifier 3910 and downconvert the response signal to in-phase (I) and quadrature-phase (Q) baseband signals. The quadrature phase baseband signal may be phase delayed by 90° via the phase delay device 6823 . This can be implemented on the 3912 buck converter.

At 6924, the LPF 6828 filters the baseband signals, removing high frequency content. LPF 6828 may include multiple LPFs; one for each down-converted signal. The LPF 6828 may replace and/or be implemented by the bandpass filter and amplifier 3914. At 6926, the resampling module 6830 samples the filtered baseband signals with sample jitter. The resampling module 6830 can be implemented by the A/D converter 3916 . Example signals 7006, 7008 from the resampling module 6830 are in 64B shown.

At 6928, the arctangent module 6832 determines an arctangent of the baseband signals to generate an arctangent signal. An example signal 7010 from the arctangent module 6832 is in 64C shown. At 6930, the differentiator 6834 differentiates the arctangent signal from the arctangent module 6832. An exemplary signal 7012 from the differentiator 6834 shown over the original Gaussian filtered signal 7002 is in FIG 64D shown.

At 6932, the sign module 6836 performs a sign function and determines a sign of the output of the differentiator 6834. At 6934, the bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of the sign module 6836. The idealized bit pattern is obtained to match the bit pattern from the Gaussian LPF 6806 or other bit pattern to the received bit pattern after applying the operations of the low pass filter 6828 and the arctangent module 6832. This is done so that upsampled values are similar to noise-free resampled data.

At 6936, upsamplers 6840, 6842 upsample the outputs of differentiator 6834 and bit pattern module 6838. At 6938, outputs of upsamplers 6840, 6842 are correlated by cross-correlation module 6844 to generate a correlation signal. Devices 6832, 6834, 6836, 6838, 6840, 6842 may be implemented by demodulator 3918. At 6940 , the peak detector 6846 determines a phase of the resulting correlated signal from the cross correlation module 6844 . In one embodiment, peak detector 6846 is implemented as a 3-point parabolic peak interpolator on top of upsampled cross-correlation module 6844 . Two points close to (within a predetermined distance from) the detected peak are selected and a 3-point parabolic interpolation of the upsampled result is obtained.

At 6942, a distance, location, round trip time, and/or other parameters are determined based on the phase (or a 3-point parabolic interpolation of the upsampled result). The distance may be a distance between the first network device and the second network device. The location may be of the second network device relative to the first network device. The round trip time may be the time for the initiator signal to propagate to the second network device and for the first network device to receive the response signal, including a time for the second network device to generate the response signal after receiving the initiator signal.

At 6944, the processing module 3922 may determine whether a range-extending-type relay attack has occurred based on the phase, distance, location, round trip time, and/or other parameters determined at 6942. If a range extension type relay attack has occurred, then operation 6946 may be performed, and otherwise the method may end at 6948. At 6946, the processing module 3922 performs a countermeasure, such as any of the countermeasures disclosed herein.

The above operations of 35 , 36 , 45 , 54 and 63 are intended/intended as illustrative examples. The operations can be sequential, synchronous, concurrent, continuous, during overlapping time periods, or in be performed in a different order. Also, one of the operations may not be performed or may be skipped depending on the implementation and/or sequence of events.

There are deviations of a transmission time between (i) the time at which a waveform generated reaches antennas to be transmitted and (ii) the corresponding time measured by a timer. Contributing factors include clock domain crossing(s), clock period changes, power amplifier propagation delay through amplifier gain adjustment, temperature and process propagation delay. Process, temperature, and amplifier gain setting variations can be calibrated out of the time measurement.

A second BLE device (e.g., BLE device (or radio) 3900B) that is similar or identical to a first BLE device (e.g., BLE device (or radio) 3900A of 38 ) can be added and implemented in a vehicle to represent a reflective (or responder) device as described in 49 is shown. Each of the BLE radios 3900 may be implemented on a separate system-on-chip (SoC). The first BLE radio unit 3900A can transmit an initiator signal that can be received by the receiver portion of the second BLE device.

A time T1 may be generated for a time when a first bit stream is generated and/or provided to the protocol module 3924A of the first BLE radio 3900A to generate an initiator signal to be transmitted by the first BLE radio 3900A is as determined by timers 3938A. A time T2 may be a point in time when the correlation and protocol module 3920B of the second BLE radio unit 3900B receives the first bit stream as determined by the timers 3938B. A first calibration constant CAL1 may be set equal to or determined based on a difference between a time when the timers 3938A detect generation of the first bit stream and a time when the corresponding initiator signal is transmitted by the antenna 3907A. A second calibration constant CAL2 may be set equal to or determined based on a difference between a time when the timers 3938B detect receipt of the first bitstream at the correlation and logging module 3920B. The time of flight for the first bit stream from protocol module 3924A to correlation and protocol module 3920B is (T2-CAL2)-(T1-CAL1).

Likewise, a time T3 can be generated for a point in time at which a second bit stream corresponding to the first bit stream is generated and/or provided to the protocol module 3924B for generating a response signal to be transmitted by the second BLE radio unit 3900B. as determined by timers 3938B. The response signal is generated in response to the initiator signal. A time T4 may be a time when the correlation and logging module 3920A receives the second bit stream as determined by the timers 3938A. The third calibration constant CAL3 may be set equal to or determined based on a difference between a time when the timers 3938B detect generation of the second bit stream and a time when the corresponding response signal is transmitted from the antenna 3907B. A fourth calibration constant CAL4 may be set equal to or determined based on a difference between a time when the timers 3938A detect receipt of the second bitstream at the correlation and logging module 3920A. The time of flight for the second bit stream from protocol module 3924B to correlation and protocol module 3920A is (T4-CAL4)-(T3-CAL3). An average time of flight, a distance between the first and second BLE radio units 3900 can be determined using Equations 33-35, where Equation 33 is based on Equation 32 and accounts for the mentioned time deviations and therefore includes the corresponding calibration values. $$D\mathrm{and}\mathrm{right}cHscHnittsfl\mathrm{and}G\mathrm{e.g}eit=\frac{\left({\mathrm{<figure-callout\; id="2"\; label="T"\; filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">T</figure-callout>}}_2-T_1\right)+\left({\mathrm{<figure-callout\; id="4"\; label="T"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">T</figure-callout>}}_4-T_3\right)}{2}$$

$$Distanz=\left(c\right)\frac{\left(T_4-CA{L}_4-T_1+CA{L}_1\right)+\left(T_3-CA{L}_3-T_2+CA{L}_2\right)}{2}$$

By collecting the same information and adding calibration values: $$\text{average flight time}=\frac{\left({\text{<figure-callout id="2" label="T" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">T</figure-callout>}}_2-{\text{<figure-callout id="2" label="CAL" filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png" state="{{state}}">CAL</figure-callout>}}_2-{\text{<figure-callout id="1" label="T" filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png" state="{{state}}">T</figure-callout>}}_1+{\text{CAL}}_1\right)+\left({\text{<figure-callout id="4" label="T" filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png" state="{{state}}">T</figure-callout>}}_4-{\text{<figure-callout id="4" label="CAL" filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png" state="{{state}}">CAL</figure-callout>}}_4-{\text{<figure-callout id="3" label="T" filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0063.png" state="{{state}}">T</figure-callout>}}_3+{\text{CAL}}_3\right)}{2}$$

$$Distan\mathrm{e.g}=\left(c\right)\frac{\left({\mathrm{<figure-callout\; id="4"\; label="T"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">T</figure-callout>}}_4-\mathrm{<figure-callout\; id="4"\; label="C\; A\; L"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">C</figure-callout>}A{L}_{}{}_4-{\mathrm{<figure-callout\; id="1"\; label="T"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png"\; state="\{\{state\}\}">T</figure-callout>}}_1+CA{L}_1\right)+\left({\mathrm{<figure-callout\; id="3"\; label="T"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">T</figure-callout>}}_3-\mathrm{<figure-callout\; id="3"\; label="C\; A\; L"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">C</figure-callout>}A{L}_{}{}_3-{\mathrm{<figure-callout\; id="2"\; label="T"\; filenames="DE112020001498T5\_0059.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">T</figure-callout>}}_2+CA{L}_2\right)}{2}$$

Cut the calibration of time values: $$Distan\mathrm{e.g}=\left(c\right)\frac{\left({\mathrm{<figure-callout\; id="4"\; label="T"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">T</figure-callout>}}_4-T_1\right)-\left({\mathrm{<figure-callout\; id="3"\; label="T"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">T</figure-callout>}}_3-T_2\right)+\left(\mathrm{<figure-callout\; id="1"\; label="C\; A\; L"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0068.png"\; state="\{\{state\}\}">C</figure-callout>}A{L}_{}{}_1-\mathrm{<figure-callout\; id="4"\; label="C\; A\; L"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">C</figure-callout>}A{L}_{}{}_4+\mathrm{<figure-callout\; id="4"\; label="C\; A\; L"\; filenames="DE112020001498T5\_0079.png,DE112020001498T5\_0085.png"\; state="\{\{state\}\}">C</figure-callout>}A{L}_{}{}_4+CA{L}_3\right)}{2}$$

The timers 3938B may start with a processor agreement and/or fine-tune the transmission time at the second BLE radio 3900B to minimize reporting on/around T2-T3.

The PLLs 3940A, 3942A of the first BLE radio unit 3900A can be implemented as a single PLL. Likewise, the PLLs 3940B, 3942B of the second radio unit 3900B can be implemented as a single PLL. Two PLLs enable hardware of the transmission part and the reception part to be implemented on a same SoC while enabling detection of a transmission time of the initiator signal using a same BLE circuit used to to detect a reception time of a response signal.

According to the present teachings, a multi-axis polarized RF antenna assembly includes a circularly polarized antenna having a conductive annular body with an inner hole, a circular insulator connected to the conductive annular body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular insulator and extends outwardly from the circular insulator. The linearly polarized antenna includes a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

According to the present teachings, the multi-axis polarized RF antenna may include the conductive element as a wire.

In accordance with the present teachings, the sheath may be formed from polytetrafluoroethylene and the conductive element may be formed from copper.

In accordance with the present teachings, the linearly polarized antenna may be configured to extend downwardly from the circularly polarized antenna in/in use.

In accordance with the present teachings, the circularly polarized antenna can be a 2-axis antenna and the linearly polarized antenna can be a single-axis antenna.

In accordance with the present teachings, the multi-axis polarized RF antenna may additionally include a ground plane, and the circular insulator may be on the ground plane, between the conductive element and the ground plane, and between the circularly polarized antenna and the base plate or plane.

In accordance with the present teachings, the circularly polarized antenna may include two feed points that are quadrature and configured to receive signals that are quadrature with each other.

According to the present teachings, a vehicle may include a body and a roof including the multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly may be oriented in the roof such that the linearly polarized antenna extends downward from the circularly polarized antenna.

According to the present teachings, a vehicle may include the multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly may be a first multi-axis polarized RF antenna assembly configured to be implemented in a vehicle and a second multi-axis polarized RF antenna assembly configured to be implemented in the vehicle. and a second circularly polarized antenna having a second conductive annular body with a second inner hole, a second circular insulator connected to the second conductive annular body, and a second linearly polarized antenna connected to the second circular insulator and extending outwardly from the second circular insulator. The second linearly polarized antenna may include an envelope and a conductive element extending through the envelope of the second linearly polarized antenna. The second linearly polarized antenna can extend orthogonally to a radius of the second circularly polarized antenna, and there may be an access module connected to the first multi-axis polarized RF antenna array and the second multi-axis polarized RF antenna array and configured to communicate with a portable access device via the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly.

In accordance with the present teachings, at all times at least one of the linearly polarized antenna or the first multi-axis polarized RF antenna assembly is not cross-polarized with an antenna of the second multi-axis polarized RF antenna assembly.

According to the present teachings, the access module may be configured to perform passive access/passive start operations or phone-as-a-key operations including transmitting and receiving radio frequency/radio frequency signals via the first of the multi-axis polarized RF antenna arrays and the second of the multi-axis polarized RF antenna arrays.

According to the present teachings, the access module may be configured to allow access to the vehicle based on the radio frequency signals.

In accordance with the present teachings, the access module may be configured to execute an algorithm to determine which antenna pair of the first of the multi-axis polarized RF antenna arrays and the second of the multi-axis polarized RF antenna arrays to use for communicating with the portable access device.

In accordance with the present teachings, the portable entry device may be a key fob or a cellular phone.

In one embodiment, a phone-as-a-key system as disclosed herein uses a cell phone's BLE radio to micro-locate a position of the phone relative to a set of receiving sensors. The sensors are inside a vehicle. The sensors are used to detect whether the phone is close enough to the vehicle to allow access to the vehicle (e.g., unlocking a door and/or starting the vehicle). The vehicle's access module uses an angle of arrival (AOA) principle. By knowing the angles of arrival of the signal transmitted from the BLE radio to at least two separate sensors in the vehicle, the source (i.e. the BLE radio) can be biangulated on a 2D plane. In this case, a phased array antenna can be used to measure the angles of arrival of the incoming signal. The phased array antenna includes multiple antennas that receive the transmitted signals. Each of the sensors in the vehicle includes one or more antennas. Each of the sensors may be a phased array sensor comprising: a 3-antenna interleaved circulating polarization (CP) receiver with a single radio receiver, a 6-antenna interleaved linear polarization (LP) receiver with a single radio receiver, a 3-antenna interleaved CP receiver with a single radio receiver; and a 3-antenna interleaved printed antenna CP receiver with a single radio receiver.

The access module detects the direction of an incoming/arriving AOA signal considering multipath propagation effects. As an example, two sinusoidal RF signals transmitted and arriving at a sensor array are added together in the sensor array's antennas. The sum of two sinusoidal RF signals is a sinusoid with a different phase and amplitude depending on the phase angles and amplitudes of the two source sinusoids. A mathematical model used to predict an AOA direction can denote an error. This error can be very large and erratic in any dynamic multipath propagation environment. To avoid this error, a music algorithm as disclosed herein can be used to identify a source signal associated with a potentially strong multipath reflection signal. The direct path signal is closely tracked by the mobile phone. This tracking identifies any additional reflection signal(s). Reflection signals can be identified and discarded.

The access modules and control modules disclosed herein may implement any of the music algorithms referenced and/or disclosed herein. Direction finding methods can generally be grouped into two categories, sometimes referred to as classical and modern methods. Classic methods include a variety of beamforming methods. Modern methods are generally referred to as subspace methods. A Music algorithm is categorized as a super/high resolution parameter estimation algorithm using a subspace partitioning method. A subspace method may require a specific array geometry of two identical but physically shifted arrays. Other methods include maximum likelihood estimation and beamforming.

70 Figure 12 shows a side view of multiple antennas 7000 in an array, illustrating a 0 angle of incidence. The array of antennas may be referred to as an array manifold. Each of the antennas 7000 may be the same and/or structured like any of the antennas disclosed herein. In one embodiment, one or more of the antennas are quadrifilar helix antennas.

The Music algorithm uses an array manifold model that describes a response of the array manifold to one or more incoming AOA signals. A Uniform Linear Array (ULA) of antennas can be defined as shown in 70 where m is the antenna index in the array starting at 1, M is the total number of antennas, d is the distance between antenna elements, and 0 is the angle of an incident/impacting signal. The response of an array element m to an incident signal s can be represented by Equation 37, where r is the received signal, a is the complex array manifold response, s is the source signal, m as stated is the index number of the antenna element of interest, 0 is the physical angle of the incoming/incident source signal as said, λ is the wavelength of the signal, and n(t) represents noise in the receiver channel. This shows the effect of phase lag as a function of physical position of the elements of the receive sensor array, with a full 180° phase shift at d=λ/2. The phase shift as a function of an angle of incidence 0 is also shown. $$\text{right}\left(\text{t}\right)=\text{a}\cdot \text{s}\left(\text{t}\right)\cdot {\text{e}}^{\text{j}\mathrm{\pi }\left[\text{i.e}\cdot \left(\text{m-1}\right)\cdot \frac{\text{2}}{\mathrm{\lambda }}\right]}\text{sin}\left(0\right)+\text{n}\left(\text{t}\right)$$

The array steering/array control vector am is/is defined by Equation 38 for a given source signal n at angle of incidence Θ _n at antenna element m for 1 ≤ m ≤ M antennas. This assumes an amplitude response of 1 at each antenna and an ideal phase response for a ULA relative to antenna 1. $${\text{a}}_{\text{m}}\left(0_{\text{n}}\right)=e^{\text{j}\mathrm{\pi }}\left[\text{d*}\left(\text{m-1}\right)*2/\mathrm{\lambda }\right]\text{sin}\left(0_{\text{n}}\right)$$

For N incoming signals, the received signal r(t) results in a sum of the source signals over the array manifold, and it can be represented by Equation 39. $$\text{right}\left(\text{t}\right)={\displaystyle \sum _{\text{n=1}}^{\text{N}}\text{a}\left({\mathrm{\theta }}_{\text{n}}\right){\text{s}}_{\text{n}}\left(\text{t}\right)+\text{n}\left(\text{t}\right)}$$

$$\text{A}=\left[\text{a}\left({\mathrm{\Theta }}_1\right),\text{a}\left({\mathrm{\Theta }}_2\right),\dots \text{a}\left({\mathrm{\Theta }}_{\text{N}}\right)\right]$$

$$\text{S}\left(\text{t}\right)={\left[{\text{s}}_1\left(\text{t}\right),{\text{s}}_2\left(\text{t}\right),\dots {\text{s}}_{\text{N}}\left(\text{t}\right)\right]}^{\text{T}}$$

In vector notation, the field manifold response parameters a and A are defined by Equations 40 and 41, respectively. Vector a describes the array response of each element to a single source signal n, and A describes the response of all M array elements to all N source signals and is an MxN matrix, where M and N are integers greater than or equal to 2, respectively. The N source signals sampled at time t are represented as an Nx1 vector S(t) as represented by Equation 42. $$\text{a}\left({\mathrm{\theta }}_{\text{n}}\right)={\left[{\text{a}}_1\left({\mathrm{\theta }}_{\text{n}}\right),{\text{a}}_2\left({\mathrm{\theta }}_n\right),...{\text{a}}_{\text{M}}\left({\mathrm{\theta }}_{\text{n}}\right)\right]}^{\text{T}}$$

$$\text{A}=\left[\text{a}\left({\mathrm{\theta }}_1\right),\text{a}\left({\mathrm{\theta }}_2\right),...\text{a}\left({\mathrm{\theta }}_{\text{N}}\right)\right]$$

$$\text{S}\left(\text{t}\right)={\left[{\text{s}}_1\left(\text{t}\right),{\text{s}}_2\left(\text{t}\right),...{\text{s}}_{\text{N}}\left(\text{t}\right)\right]}^{\text{T}}$$

Equation 43 can be used to convert N source tones, at/with different source angles of arrival, represented in signal S(t) at a given time t, via an antenna array response manifold model A to received (measured) data vector r(t) with channel noise n( t) where r(t) is an Mx1 vector of the received data at each antenna element. $$\text{right}\left(\text{t}\right)=\text{AS}\left(\text{t}\right)+\text{n}\left(\text{t}\right)$$

This mathematical structure of the field manifold model is used to derive the Music algorithm and can also be used to simulate and model a test environment.

71 Figure 12 shows an example AOA method that includes use of the Music algorithm. Although operations are described primarily as being performed by an entry module of a vehicle, such as any of the entry modules disclosed herein, the operations may be performed by a control module of a portable entry device. Note that the H operator denotes the Hermitian transposition or conjugation-transposition operation. The procedure can begin at 7400. At 7402, the access module T collects analytic signal samples simultaneously from each antenna as illustrated by FIG ${{\displaystyle \{\mathrm{right}\left(t\right)\}}}_{t=1}^T.$

At 7404 the access module estimates the data covariance matrix R̂ as represented by equation 44. $$\widehat{\text{R}}={\displaystyle \sum _{\text{t=1}}^{\text{T}}\text{right}\left(\text{t}\right)\text{right}{\left(\text{t}\right)}^{\text{H}}={\text{RR}}^{\text{H}}}$$

The covariance matrix estimate is calculated via Equation 44 and an example of the covariance matrix is in 72 shown. For interpretation, each arrow represents a covariance between the antenna numbers listed on the X and Y axes at the foot of the arrow. The top center arrow represents the covariance (c ₁₂ ) of antenna number 1 relative to antenna number 2, while the center left arrow represents the covariance (c ₂₁ ) of antenna number 2 relative to antenna number 1, which is the complex conjugate of C ₁₂ . The direction of the arrow is the complex plane representation of magnitude and direction (where the x-axis is the real axis and the y-axis is the imaginary axis).

Note that the diagonal (top left to bottom right) represents an autocovariance that is unity and has an imaginary value of 0. Also note that the matrix is Hermitian, which means that C _ij = c* for all i and j, where * is the complex conjugate. So all useful information is contained in (i) C ₁₂ , C ₂₃ and C ₁₃ or (ii) C ₂₁ , C ₃₂ and C ₃₁ (the top right or bottom left corner without the top left to bottom right diagonal). This leads to potential savings in data storage and reduced transmission size.

At 7406, the access module uses a singular value decomposition (SVD) or other eigenvalue decomposition technique and computes the MxM matrix U as represented by equation 45. $$\widehat{\text{R}}=\text{u}{\displaystyle \sum {\text{u}}^{\text{H}}}$$

After an eigenvalue decomposition of the covariance matrix estimate R̂, resulting complex eigenvectors are provided, examples of which are given in 73 are shown. 73 shows an eigenvector visualization with a field manifold response at 35°. 74 shows an eigenvector visualization with a field manifold response at 0°.

As in 72 the magnitude and direction of the arrows denote the real and imaginary components of each point, corresponding to a real part on the x-axis and an imaginary part on the y-axis. The solid and short-dashed arrows represent the 3x3 array of eigenvectors. The vector columns (X-axis) are sorted by the eigenvalues of the eigenvectors from large (on the left) to small (on the right). Thus, the leftmost column numbered 1 represents the signal subspace, while columns 2 and 3 represent the noise subspace.

At 7408, the access module estimates or otherwise determines the number of incoming/arriving signals N. At 7410, the access module splits matrix U into MxN signal subspace matrix Û _s and noise subspace estimate Mx(MN) matrix Û _e , such that equation 46 is satisfied . $$\text{u}=\left[{\widehat{\text{u}}}_{\text{s}},{\widehat{\text{u}}}_{\text{e}}\right]$$

Along with the eigenvectors, the field manifold response at the angle of interest (35°) is shown by the long-dash arrows. This follows from Equation 40.

At 7412 the access module computes the music spectrum P(θ) for an area θ of interest at a predetermined resolution as represented by equation 47. $$\text{P}\left(\mathrm{\theta }\right)=\frac{1}{{\Vert \text{a}{\left(\mathrm{\theta }\right)}^{\text{H}}{\text{u}}_{\text{e}}\Vert }^2}$$

At this point, the noise subspace eigenvectors of the covariance matrix estimate should be perfectly orthogonal to the field manifold response. The result of the denominator of Equation 47 is a small number relative to results at other test angles θ.

74 provides the same information as 73 , except that the field manifold response is shown at 0° AOA. Note that since the eigenvectors are derived from the measured data, the eigenvectors remain the same. The field manifold response is rotated and shows the expected response to a directly incident signal, meaning that there is no phase shift at any antenna element. In this case, the result of the denominator of Equation 47 is a much larger value than that obtained in the case of 73 is reached.

At 7414, the access module performs a peak search on P(θ) to determine angles of arrival. The values of Θ at the maxima of P(Θ) are the angles of arrival of the incoming N signals.

After processing Equation 47 for/after Θ over a range from -90° to +90°, the resulting music power spectrum is P(Θ) in 76 shown for a source signal AOA of 35°. Note that there is a clear peak at the 35° test AOA. The actual angle is denoted by the vertical dashed line. The resolution of Θ̂ is 1°.

$$\text{J=}\left[\begin{array}{ccc}0& & 1\\ & ⋰& \\ 1& & 0\end{array}\right]$$

Covariance smoothing methods can be used. As an example, a forward-backward method can be used. The forward-backward approach is implemented using Equations 48 and 49, where R is the modified covariance matrix estimate and J is an inverse MxM identity matrix (transfer matrix). $$\tilde{\text{R}}={\widehat{\text{R}}\text{+J}\widehat{\text{R}}}^{\text{H}}\text{J}$$

$$\text{J=}\left[\begin{array}{ccc}0& & 1\\ & ⋰& \\ 1& & 0\end{array}\right]$$

Quellen. Für ein 3-Antennen-Feld können bis zu 2 kohärente Töne aufgelöst werden. Dieses Verfahren kann für ein phasengesteuertes Feld mit 3 Antennen von einer Empfängerbaugruppe eines phasengesteuerten Antennenfelds verwendet werden. Das Verfahren kann bei 7416 enden.The effective number of coherent tones that can be resolved is $N\le \frac{2\mathrm{<figure-callout\; id="3"\; label="M"\; filenames="DE112020001498T5\_0060.png,DE112020001498T5\_0063.png"\; state="\{\{state\}\}">M</figure-callout>}}{3}$

Sources. Up to 2 coherent tones can be resolved for a 3-antenna field. This method can be used for a phased array with 3 antennas by a phased array antenna receiver assembly. The method may end at 7416.

As another example, a spatial smoothing method can be used. The spatial smoothing method is a technique that involves dividing a field into multiple sub/subfields and averaging the covariance matrix results of the sub/subfields. This leads to an effectively reduced number of antenna array elements.

A Forward-Backward Spatial Smooting (FBSS) method can be used and combines spatial smoothing with the forward-backward approach. This also reduces the number of antenna elements required. As yet another example, a Toeplitz completion method can be used, and is this appropriate for NLAs.

Variations on the Music algorithm can be implemented. A derivation of the Music algorithm, referred to as Root-MUSIC, can be used on ULAs to calculate the AOA of the incoming signal without the need to calculate results at every potential angle. This reduces the computing power required. The reduction in computational complexity comes from not having to perform operations 7412, 7414 of the music algorithm, comprising computing the music spectrum over a large set of Θ̂ values and finding the peak(s) of the result.

Another example derivation, called Spectral-MUSIC, is a generalized version of Root-MUSIC that can be applied to any field geometries, but is generally valid for broadband non-coherent sources. Yet another derivation, referred to as Smooth-MUSIC, relates to a variety of methods for smoothing the covariance matrix in the Music algorithm and is between operations 7404 and 7406 of FIG 71 applicable.

Another exemplary derivation, referred to as the CLEAN method, involves once a source signal is identified in a given direction, reconstructing a model of the source signal from the known array manifold. This reconstructed signal model is subtracted from the measured incident/incident signal to remove the incident signal, thereby “cleaning” the measured data of the undesired source signal and allowing observation/assessment of other sources.

A problem encountered with a non-ideal antenna array implementation of the Music algorithm is that two coherent sources with forward-backward covariance smoothing can lead to erroneous position measurements. Standard field calibration techniques do not solve this because the covariance matrix itself leads to an erroneous subspace split. To combat this, a variation of the CLEAN method is performed for multiple coherent sources and includes: identifying source signals using the Music algorithm; using the CLEAN method to remove the source signals one by one using the calibrated array manifold; forcing the source signal position to an offset (not the originally measured location) and recalculating the AOA direction of the remaining signal; repeating operations 7404 and 7406 of 71 to verify convergence to a new set of incident arrival angles if they are not equal to the original arrival angles; and optionally replacing operation 7402 of 71 with a priori knowledge of the system. For example, while tracking the position of the source signal, it can be assumed that the AOA does not change much between successive readings.

76 12 shows an antenna selection system 7600 that includes antennas 7602, a switch 7604, and a radio receiver 7606. FIG. The radio receiver 7606 selects one of the antennas from which a signal is to be received via the switch 7604. The antenna selection system 7600 can be implemented in any of the systems disclosed herein. In one embodiment, antenna selection system 7600 is implemented in a vehicle, and an access module disclosed herein controls operation of radio receiver 7606.

The antenna selection system 7600 is/is implemented in a PAK-AOA system and implements BLE-AOA data reception. A portion of a BLE radio packet received by one of the antennas 7602 includes a CW tone. The 7606 radio receiver samples the CW tone to provide an analytic quadrature signal, namely two sinusoids with a 90° phase difference, referred to as the in-phase and quadrature-phase (I and Q) signals. The I and Q signals are sampled simultaneously and can be combined to form a complex analytic sample r, where r = iI + Q and i is the imaginary constant, i = V2. The data that is received is thus sliced into interleaved samples from each of the antennas with multiple repetitions.

77 Figure 12 illustrates an example of a reconstruction method for reconstructing the IQ data. The interleaved data is interpolated to form a receive data matrix r(t) for use in the music algorithm. The reconstruction method can be performed on any of the access modules disclosed herein. The signal reconstruction process can begin at 7700.

At 7702, the access module converts an analytic IQ sample vector r to a phase angle vector Φ using the arctangent function. At 7704, the access module generates a time vector t corresponding to sample vector r based on the data sample rate.

At 7706, the access module discards samples taken near antenna switching times. At 7708, the access module unwraps each repeat portion of data points with a step size π. At 7710, the access module measures the average gradient. This is the average frequency of the sine waves.

At 7712, for each antenna, the access module: a) finds the intersection of the first repetition of sampled data; b) projecting the positions of the next repetition of sampled data; c) determining an average difference between expected and measured actual positions; d) adding or subtracting 2π; e) repeating operations c and d comprising repeating determining the average difference and adding or subtracting 2π until the average difference is less than π; f) finding the average slope of all points already aligned; and g) repeating operations b-g using the new slope for the next signal repetition.

At 7714, the access module measures the standard deviation of the average slope of each antenna.

At 7716, the access module checks which antenna may have misalignment by selecting antenna i based on equation 50 if the standard deviation is above a threshold. $$\left|\text{f}\left(\text{i}\right)-\text{Average}\left(\text{f}\right)\right|>\frac{\text{Max}\left(ƒ\right)\text{at least}\left(ƒ\right)}{2}$$

At 7718, the access module repeats operations 7712-7718 for the antenna selected at 7716 until there is a low standard deviation or a maximum retry counter expires.

At 7720, for each antenna m, the access module interpolates a straight line of points on the original time vector t to obtain the reconstructed phase angle vector Φ _m . This may be based on the phase angle vector Φ determined at 7702 .

At 7722, the access module regenerates an IQ sample vector r̂ _m for each antenna m using equation (51), where g is the average magnitude of the valid subset of original sample vector r. After operation 7722, the method may end at 7724. $${\widehat{\text{right}}}_{\text{m}}={\text{G}}_{\text{m}}{\text{e}}^{\text{j}{\mathrm{\Phi }}_{\text{m}}}$$

In one embodiment, the method set forth above is/is implemented in a vehicle access system and/or a PAK system as disclosed herein having circularly polarized antennas. Signals are received at the circularly polarized antennas. As described above, IQ data is determined based on the received signals, and arrival angles are determined using the Music algorithm.

78A-C 12 show a vehicle 7800 illustrating an example placement of a sensor 7802 that may be implemented as part of any PAK system disclosed herein and connected to any access module disclosed herein. 78C 12 shows example bounce reflections and corresponding paths of a signal transmitted from a key fob 7804 or other portable access device and detected at the sensor 7802. In this example, sensor 7802 is located high/up and in a center of vehicle 7800.

The sensor 7802 can be located in a sky 7803 of the vehicle 7800, for example. The sensor 7802 is/is placed such that multiple bounce paths of the transmitted signal are caused before it is received at the sensor 7802. The key fob 7804 is shown low/low relative to the vehicle for illustrative purposes, but may be at a higher position.

79A-C 12 show a vehicle 7900, with an example placement of a sensor 7902 being illustrated. 79C 12 shows example bounce reflections and corresponding paths of a signal transmitted from a key fob 7904 or other portable access device and detected at the sensor 7902. In this example, the sensor 7902 is at the bottom and in a middle of the vehicle 7900. The sensor 7902 can be in a floor 7903 or a center console 7905 of the vehicle. The sensor 7902 is/is placed such that multiple bounce paths of the transmitted signal are caused before it is received at the sensor 7902. The key fob 7904 is shown at the bottom relative to the vehicle for illustrative purposes, but may be at a higher position.

The sensors 7802, 7902 may be located in metal structures of the vehicles with few possible direct routes out of the vehicle (ie, a low probability that line of sight between the fobs 7804, 7904 and the sensors 7802, 7902 will exist). The metal structures may include frames, metal housings, partially enclosed/enclosed metal structures, unibody structures, etc., which may be at least partially represented by dashed line 7903 as the floor may include at least part of a metal structure. Although in each of 78A-C and 79A-C where a single sensor is shown, two or more sensors may be included in each vehicle. In one embodiment, each sensor includes two or more antennas, such as two or more of the antennas disclosed and/or referenced herein. In one embodiment, two sensors are included and each sensor includes two antennas such that there are four antenna paths. In another embodiment, a single sensor is included, and the sensor includes three or more antennas. Although there may not be a direct line of sight between the fobs and the sensors since there are multiple to many signal paths between the fobs and the sensors, short consistent distances between the fobs and the vehicle can be determined using the techniques disclosed herein. The distance information is used to determine whether to allow access to the vehicle.

In one embodiment, a carrier phase based ranging is implemented using the Music algorithm or the like to determine angles of arrival of signals transmitted by the fobs 7804,7904. This may include eigenvalue decomposition. Distances between the key fobs 7804, 7904 and the vehicles 7800, 7900 are determined based on the angles of arrival. When the key fobs 7804, 7904 are within predetermined distances from the vehicles 7800, 7900, access is permitted. Although there is a low probability of line of sight, there is a high probability that the transmitted signals will bounce multiple times and follow multiple paths to each of the sensors 7802,7902. This allows the respective access modules to determine if the key fobs 7804,7904 are close to the vehicles 7800,7900. Multipath propagation signal processing is performed on or in addition to carrier phase based ranging. This may include time-of-flight signal processing such as that described above with reference to FIG 37 , 52-56 and 62 is described. As an example, when the key fobs 7804, 7904 are within predetermined distances from the vehicles 7800, 7900, the entry modules of the vehicles 7800, 7900 can unlock doors of the vehicles 7800, 7900.

By forcing indirect signal transmission paths and exchanging a predetermined number of closely/densely transmitted tones and finding eigenvalues, it is possible to perform ranging via indirect and reflected paths using carrier phase-based BLE ranging. Systems with fewer sensors (referred to as anchors) can be used by placing the anchors such that signals follow primarily indirect paths rather than direct line-of-sight paths.

In one embodiment, RSSI of the transmitted signals is determined to determine whether the key fobs 7804,7904 are inside or outside the vehicles 7800,7900. If the key fobs 7804, 7904 are outside of the vehicles, then a carrier phase-based ranging with eigenvalue decomposition is performed to determine whether the key fobs 7804, 7904 are within predetermined distances of the vehicles 7800, 7900.

The foregoing description is merely illustrative in nature and is in no way intended to limit the disclosure, its application, or uses. The broad teachings of the disclosure can be implemented in a variety of forms. Therefore, while this disclosure includes particular examples, the true scope of the disclosure should not be so limited since other modifications will become apparent upon a study of the drawings, the specification, and the following claims. It should be understood that one or more steps in a method may be performed in a different order (or simultaneously) without altering the principles of the present disclosure. Furthermore, may or may, albeit each of the embodiments described above as having certain features, any one more of those features described with reference to any embodiment of the disclosure may be implemented in and/or combined with features of any of the other embodiments, even if that combination is not explicitly described is. In other words, the described embodiments are not mutually exclusive, and permutations of one or more embodiments with one another remain within the scope of this disclosure.

Spatial and functional relationships between elements (e.g. between modules, circuit elements, semiconductor layers, etc.) are described using terms such as "connected", "engaged", "coupled", "adjacent", "adjacent", "on" , "above," "below," and "furnished." Unless expressly described as "direct," when a relationship between a first and second element is described in the foregoing disclosure, that relationship may be a direct relationship in which there are no intervening elements between the first and second elements , but it can also be an indirect relationship in which there are one or more intervening elements (either spatially or functionally) between the first and second elements. As used herein, the phrase at least one of A, B, and C shall be construed to mean a logical (A OR B OR C) using a non-exclusive logical OR, and shall not be construed to mean " at least one from A, at least one from B and at least one from C”.

In the figures, the direction of an arrow, as indicated by the arrowhead, generally indicates the flow of information (such as data or instructions) of interest to the illustration. For example, if item A and item B exchange different information, but information transmitted from item A to item B is relevant to the illustration, the arrow may point from item A to item B. This unidirectional arrow does not imply that no other information is transmitted from element B to element A. Furthermore, for information sent from element A to element B, element B may send requests for or acknowledgments of receipt of the information to element A.

In this application, including the definitions below, the term "module" or the term "controller" may be replaced with the term "circuit". The term "module" may refer to, be part of, or include: an Application Specific Integrated Circuit (ASIC); a digital, analog, or mixed analog/digital discrete circuit; a digital, analog, or mixed analog/digital integrated circuit; a combinatorial logic circuit, a Field Programmable Gate Array (FPGA); a (shared, dedicated or group) processor circuit that executes code; a memory circuit (shared dedicated or group) storing code executed by the processor circuit; other suitable hardware components that provide the described functionality; or a combination of some or all of the foregoing, such as in a system-on-chip.

The module may include one or more interface circuits. In some examples, the interface circuitry may include wired or wireless interfaces that connect to a local area network (LAN), the Internet, a wide area network (WAN), or combinations thereof. The functionality of any given module of the present disclosure may be distributed between/among multiple modules that are connected via interface circuits. For example, multiple modules can enable load balancing. In another example, a server (also known as a remote or cloud) module may perform some functionality on behalf of a client module.

The term code, as used above, may include software, firmware, and/or microcode, and may refer to programs, routines, functions, classes, data structures, and/or objects. The term shared processor circuit encompasses a single processor circuit that executes some or all code from multiple modules. The term group processor circuit encompasses a processor circuit that, in combination with additional processor circuits, executes some or all code from one or more modules. References to multiple processor circuits include multiple processor circuits on discrete dies or dies, multiple processor circuits on a single die or die, multiple cores of a single processor circuit, multiple threads of a single processor circuit, or a combination of the foregoing. The term shared memory circuit encompasses a single memory circuit containing some or all of the code from multiple ren modules. The term group memory circuit encompasses a memory circuit that, in combination with additional memories, stores some or all code from one or more modules.

The term memory circuit is a subset of the term computer-readable medium. The term computer-readable medium, as used herein, does not include transient electrical or electromagnetic signals propagated over a medium (such as on a carrier wave); the term computer-readable medium can therefore be considered tangible and non-transitory. Non-limiting examples of a non-transitory, tangible computer-readable medium are non-volatile memory circuits (such as a flash memory circuit, an erasable programmable read-only memory circuit, or a mask read-only memory circuit), volatile memory circuits (such as a static random access memory circuit or a dynamic random access memory circuit), magnetic storage media (such as an analog or digital magnetic tape or hard disk drive) and optical storage media (such as a CD, a DVD, or a Blu-ray Disc).

The apparatus and methods described in this application may be implemented in part or in whole by a special purpose computer created by configuring a general purpose computer to perform one or more specific functions embodied in computer programs. The functional blocks and flow chart elements described above serve as software specifications that can be translated into the computer programs through the routine work of a skilled technician or programmer.

The computer programs include processor-executable instructions stored on at least one non-transitory tangible computer-readable medium. The computer programs can also record or be based on stored data. The computer programs may include a basic input/output system (BIOS) that interacts with hardware of the special purpose computer, device drivers that interact with specific devices of the special purpose computer, one or more operating systems, user applications, background services, background applications, etc.

The computer programs may include: (i) descriptive text to be parsed, such as Hypertext Markup Language (HTML), Extensible Markup Language (XML), or JavaScript Object Notation (JSON), (ii) assembly code, (iii) object code produced by a compiler from source code, (iv) source code for execution by an interpreter, (v) source code for compilation and execution by a just-in-time compiler, etc. Source code may be written as examples only using syntax from/from languages including C, C++, C#, Objective-C, Swift, Haskell, Go, SQL, R, Lisp, Java®, Fortran, Perl, Pascal, Curl, OCaml, Javascript®, HTML5 (hypertext Markup Language 5th edition), Ada, ASP (Active Server Pages), PHP (PHP: Hypertext Preprocessor), Scala, Eiffel, Smalltalk, Erlang, Ruby, Flash®, Visual Basic®, Lua, MATLAB, SIMULINK and Python®.

None of the elements recited in the claims are intended to constitute a means-plus-function element within the meaning of 35 U.S.C. §112(f), unless an element is expressly formulated using the phrase "means/means for" or, in the case of a method claim, using the phrases "operation/act for" or "step for."

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• US 16/824280 [0001]
• US 16/598191 [0001]
• US62/744814 [0001]
• US62/801392 [0001]
• US62/826212 [0001]
• US62/823210 [0001]
• US62/826239 [0001]
• US8644768B2[0201]

Claims (18)

Access system for a vehicle, the access system comprising: a receiver configured to receive a signal transmitted from a portable access device to the vehicle; and an access module configured to generating a differentiated signal based on the received signal, upsampling the differentiated signal to generate a first upsampled signal, receiving or generating an expected signal, upsampling the expected signal to generate a second upsampling signal, cross-correlating the first upsampled signal and the second upsampled signal to generate a cross-correlation signal, determining, based on the cross-correlation signal, a phase difference between the first upsampled signal and the second upsampled signal, determining a round trip time of the signal received by the receiver, and Allowing access to the vehicle based on round trip time. Access system according to claim 1 , wherein the access module is configured to: down-convert the signal to generate a down-converted signal; sampling the down-converted signal to generate a sampled signal; performing arctangent of the sampled signal to generate an arctangent signal; and differentiating the arctangent signal to generate the differentiated signal. Access system according to claim 1 wherein the access module is configured to: determine at least one of a location or a distance of the portable access device relative to the vehicle based on the round-trip time; and allowing access to the vehicle based on the at least one of the location and the distance. Access system according to claim 1 wherein the access module comprises: a first upsampler configured to upsample the differentiated signal to generate the first upsampled signal; and a second upsampler configured to upsample the expected signal to generate the second upsampler signal, wherein an upsampling rate of the first upsampler is a same sampling rate as the second upsampler. Access system according to claim 1 , wherein the access module comprises: a sign module configured to determine a sign of the differentiated signal; and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal. Access system according to claim 1 , wherein: the access module is configured to receive the expected signal; and the expected signal is a predetermined signal obtained by the access module prior to receipt of the received signal. Access system according to claim 1 wherein: the access module is configured to perform an iterative process comprising: multiplying bits of the first upsampling signal and the second upsampling signal to produce resultant products, summing the resultant products to produce a product sum value, and shifting the second upsampling signal relative to the first upsampling signal ; the iterative process provides a plurality of sum-of-products values; and the access module is configured to determine the phase difference based on the plurality of product sum values. Access system according to claim 7 , wherein the entry module is configured to reconstruct the signal transmitted from the portable entry device to the vehicle based on zero crossings of a portion of the cross-correlation signal associated with a maximum of the plurality of product sum values. Access system according to claim 1 wherein the access module comprises: an upsampler configured to upsample the differentiated signal to generate the first upsampled signal; a sign module configured to determine a sign of the first upsampled signal; and a bit pattern module configured to generate the expected signal based on the sign of the first upsampling signal. A portable entry device for an entry system of a vehicle, the portable entry device comprising: a receiver configured to receive a signal transmitted from an entry module of a vehicle to the portable entry device; and a control module configured to: generating a differentiated signal based on the received signal, upsampling the differentiated signal to generate a first upsampled signal, receiving or generating an expected signal, upsampling the expected signal to generate a second upsampling signal, cross-correlating the first upsampled signal and the second upsampled signal to generate a cross-correlation signal, determining, based on the cross-correlation signal, a phase difference between the first upsampled signal and the second upsampled signal, determining a round trip time of the signal received by the receiver, and either transmitting the round trip time to the vehicle to access the vehicle based on the round trip time, or determining at least one of a location or a distance between the portable access device and the vehicle and transmitting at least one of the location or the distance to the vehicle to gain access to the vehicle. Portable access device according to claim 10 , wherein the control module is configured to: down-convert the signal to generate a down-converted signal; sampling the down-converted signal to generate a sampled signal; performing arctangent of the sampled signal to generate an arctangent signal; and differentiating the arctangent signal to generate the differentiated signal. Portable access device according to claim 10 , wherein the control module is configured to: determine at least one of a location or a distance of the portable access device relative to the vehicle based on the round-trip time; and transmitting the at least one of the location or the distance to the vehicle to access the vehicle based on the at least one of the location or the distance. Portable access device according to claim 10 wherein the control module comprises: a first upsampler configured to upsample the differentiated signal to generate the first upsampled signal; and a second upsampler configured to upsample the expected signal to generate the second upsampler signal, wherein an upsampling rate of the first upsampler is a same sampling rate as the second upsampler. Portable access device according to claim 10 , wherein the control module comprises: a sign module configured to determine a sign of the differentiated signal; and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal. Portable access device according to claim 10 , wherein: the control module is configured to receive the expected signal; and the expected signal is a predetermined signal obtained by the control module prior to receipt of the received signal. Portable access device according to claim 10 wherein: the control module is configured to perform an iterative process comprising: multiplying bits of the first upsampling signal and the second upsampling signal to produce resultant products, summing the resultant products to produce a product sum value, and shifting the second upsampling signal relative to the first upsampling signal ; the iterative process provides a plurality of sum-of-products values; and the control module is configured to determine the phase difference based on the plurality of product sum values. Portable access device according to Claim 17 wherein the control module is configured to reconstruct the signal transmitted from the vehicle's access module to the portable access device based on zero crossings of a portion of the cross-correlation signal associated with a maximum of the plurality of sum-of-products values. Portable access device according to claim 10 wherein the control module comprises: an upsampler configured to upsample the differentiated signal to generate the first upsampled signal; a sign module configured to determine a sign of the first upsampled signal; and a bit pattern module configured to generate the expected signal based on the sign of the first upsampling signal.

Images