EP1152107B1 - Anti-fraud system for hands-free access to an automobile - Google Patents

Description

The present invention relates to a so-called hand access system free for motor vehicle, i.e. a system of wireless communication allowing entry into the vehicle without key. This system can also be applied to hands-free starting of the vehicle, i.e. when starting without a key.

Such a system generally includes a device identification intended to be worn by a user and capable of establishing wireless two-way remote communication with a unit control unit on board the vehicle to authenticate the user and order locking / unlocking means door locks when the user has been recognized as authentic. Communication protocol initialization can be activated by operating the exterior door handle, to hands-free access, or by pressing a start button, in hands-free start mode. The system is able to establish said two-way communication when the identification device is located at a distance less than a predetermined limit distance from the vehicle, generally of the order of a few meters, to avoid, on the one hand, interference with other signal sources from the environment, and, on the other hand, to avoid the functioning of the system at a distance such that the user is too far from the vehicle to be aware of the operations carried out by said system.

Certain systems currently proposed use systems with Very short-range magnetic induction, for both supplying energy and transport information from the central unit of the vehicle to the identification device in the field electromagnetic generated by the vehicle's antennas. However, a such a system allows communication only at very short distance from the vehicle in the order of a few cm. Another commonly used system proposed consists in using low frequency carrier waves, around 125 kHz for communication from the vehicle to the identification device, and ultra high carrier waves frequency, for example of the order of 434 or 868 MHz, for the area Europe, and 315 or 902 MHz for the USA zone. However, in this case, the identification device must include a battery to power its own electronic circuits. To minimize consumption electric, we can provide, for example, that the device identification is dormant for 9 ms and awake 1 ms, during periods of 10 ms.

Of course, two-way communication between the vehicle and the identification device is encrypted, in order to avoid any untimely operation of the system and to secure it from malefactors. In Figure 1 of the accompanying drawings, there is shown a example of an already known encryption system. In this figure 1, we have represented a vehicle V which has in its central unit a memory 1 containing a secret key K and a number generator 2, the generated random numbers R having, for example, a length of 56 bits. This random number R is transmitted towards the identification device I, as indicated by arrow 3. Simultaneously, this same random number R is mixed with the key secret K following a complex associative function f, in a mixer 4 which is connected to its input to memory 1 and to the generator of random numbers 2. Mixer 4 outputs a signal representative of the mixture of the secret key K and the random number R, at know the signal f (R, K). This signal is stored in a memory 5 connected to the output of mixer 4. This signal is sent to the device of identification I, in the form of a signal of length by 28-bit example, as shown by arrow 6. In vehicle V, the signal f (R, K) is mixed again with the secret key K in a mixer 7, which is connected at its input to memories 1 and 5 above. This mixer 7 mixes the two signals according to a function complex associative g. Vehicle V then stores in a memory 8 connected to the mixer output 7 the signal representative of the mixture, namely the signal g (R, f, K).

On the identification device side, the same secret key K is stored in a memory 11 and a mixer 14 having the same associative function f receives as input the secret key provided by the memory 11 of the identification device I and the random number R received by the identification device from the vehicle. The identification device I stores the signal at the mixer output 14 in a memory 15 and compare this signal in a comparator 16 with the signal received according to arrow 6 from vehicle V. If the two signals are not identical, subject to the time of hardware and signal transmission delay in the area of authorized transmission, the identification device interrupts the communication as being unauthorized. On the other hand, if the two signals match, the signal is mixed in a mixer 17 with the secret key provided by the memory 11 of the device identification I, according to the same associative function g above. The mixer 17 output signal is stored in memory 18 of the identification device to then be sent to the vehicle according to arrow 9 in the form of a signal having a length by 20 bit example. Finally, the signal received by arrow 9 is compared with the signal received from the vehicle memory 8 in a comparator 10. If these two signals match, subject to delays due to hardware response time and signal transmission in the authorized zone, the rest of the communication is authorized and the unit vehicle center may, if necessary, order the condemnation or unlocking of the locks of the doors of the vehicle. Of course, another encryption protocol could be used to secure data transmission.

However, despite this encryption protocol, there is a way to hack the system, without knowing either the secret key or the different associative functions of the encryption protocol. This process of piracy is shown in Figure 2. According to this method, we assume that the user U who is wearing the identification device I is located at a distance from vehicle V greater than the authorized distance of communication, for example from 10 to 100 m from the vehicle. In this case, a pirate equipped with a first relay box 20 can approach vehicle V a sufficient distance to communicate with it, for example at a distance of the order of 1 to 5 m. This hacker activates the start of the communication, for example by pulling on the exterior door handle. This triggers the emission of low frequency signals by the vehicle to the relay box 20, as indicated by the zigzag arrow 21. This signal 21 sent by the vehicle is received by a coil 22 of the relay box 20, which is connected to a receiver 23 at 125 kHz. This receiver 23 is connected to a transmitter at broadband at high frequency, of the order of several MHz. The transmitter 24 transmits via its antenna 25, as represented by the arrow 26, to a second relay box 30, which is carried by another pirate which closely follows user U. The exchange of information between the two relay boxes 20 and 30 being carried out at very high frequency, it is this communication can be carried out from a long distance. The second relay box 30 includes an antenna 31 for receiving the signal 26 emitted by the relay box 20. The antenna 31 is connected to a broadband receiver at the same frequency as transmitter 24 of the first relay box 20. The signal thus received is retransmitted at low frequency at 125 kHz by a transmitter 33 which is connected to a coil 34 to send a signal 35 to the device identification I which conforms to signal 21 emitted by the vehicle. The signal 35 being the repetition of the authentic signal of the vehicle, the identification device I will recognize it and in turn issue its response signal 36, said response signal 36 being sent at high frequency and received by an antenna 37 of the second relay box 30, by example at 434 MHz. The antenna 37 is connected to a receiver 38, which goes convert the signal at 434 MHz to a signal at a different frequency, for example at 315 MHz. The signal is then emitted by a transmitter at broadband 39 via an antenna 40 to the first relay box 20, this difference in frequency being necessary for the different signals do not interfere with each other. Of course, the frequency of signal 41 sent back by the second relay box 30 is different both the frequency of signal 26 and signal 36. This signal 41 is received by an antenna 27 of the first relay box 20, said antenna 27 being connected to a broadband receiver 28 of the same frequency as the transmitter 39. The receiver 28 is connected to a transmitter 29 which transforms the 315 MHz signal into a 434 MHz signal which is sent via the antenna 42 of the first relay box 20 to the vehicle V, as represented by the zigzag arrow 43.

It is enough that the hackers use relay boxes having broadband links, for example greater than 50 MHz, which is possible because pirate systems do not have to comply with regulations; additional transit time due to distance can be of the order of a few nanoseconds, which is negligible compared to the necessary time constants for normal transmission allowed. For example, the total communication can be of the order of 20 to 40 ms, and the duration total operation of the system to trigger the unlocking or locking electric locks can be of the order of 100 ms.

To detect such hacking and interrupt communication, one solution could be to measure the propagation time of UHF radio waves, comparing this measured time with a time predetermined corresponding to a communication in an area limited allowed around the vehicle. However, to detect the time delay due to distance, compared to communication time overall, it is necessary to have broad bandwidth, which corresponds to a fast communication rate, for example of around 20 to 40 Mb / s. With such a communication rate, it is necessary to operate at very high frequency, for example at 2.4 GHz. But to measure very short times, it is necessary to have a very high bandwidth, which comes up against applicable regulations that severely limit bandwidths allowed, to avoid saturation of the environment with waves electromagnetic.

The object of the invention is to eliminate the aforementioned drawbacks and to propose a so-called hands-free access system for a motor vehicle, allowing to detect a hacking of the system, in particular by through relay boxes, taking into account the time of propagation of the signal between the vehicle and the identification device.

To this end, the invention relates to an access system called hands free for motor vehicle, comprising a device identification intended to be worn by a user and capable of establishing wireless two-way remote communication with a unit control unit on board the vehicle to authenticate the user and order locking / unlocking means door locks when the user has been recognized as authentic, said system being capable of establishing said two-way communication when the identification device is located at a distance less than a predetermined limit distance from the vehicle, characterized in that said central unit is able to generate, at a predetermined high clock rate, when communication, an anti-piracy bit stream, each bit of said train being transmitted to the identification device in the form of a signal radio frequency interrogation representative of said bit, so only after reception of said interrogation signal by the device identification, the latter transmits, with a delay at least equal to one useful bit time, a response signal to the central control unit, the latter comprising at least one mixer capable of mixing, on the one hand, the response signal received from the device identification and, on the other hand, the anti-piracy bit stream generated by the central unit and delayed by a useful bit time, to deliver in output of said mixer a signal representative of the time offsets successive of each bit of said anti-piracy train, this last signal being received at the input of an integrator to sum the times of response related to each time shift bit slot of anti-piracy, the output of said integrator being connected to at least one first comparator to compare said sum of response times with a first predetermined threshold value, beyond which is detected a hacking attempt causing said halt communication.

"Useful transmission time" means the transmission time of the binary information of said bit with respect to the total time of the cell at which is associated with said bit which generally includes said time useful and a time of silence to allow reception of the signal retransmitted by the identification device during said time of silence.

Advantageously, the sum of the response times performed by the integrator, is stopped when the central control unit detects receiving the last bit of the anti-piracy train.

According to another characteristic, the output of the integrator is linked to at least a second comparator to compare said sum response time with another predetermined threshold value lower than said first predetermined threshold value, beyond which communication is detected beyond said distance predetermined limit.

According to yet another characteristic, the device identification includes a digital signal timer capable of delay the interrogation signal received by a useful bit time from the vehicle, a carrier wave oscillator in radio frequency, connected at output to a phase modulator or amplitude, which is controlled by the signal at the output of said retarder, for outputting said response signal at the output of said modulator to be issued to the vehicle. In this case, the identification device may have a falling edge detector to detect the edge descending from the interrogation signal received from the vehicle, said detector being able to tilt said oscillator of the device of identification between a stop state corresponding to the reception mode of the identification device and a corresponding operating state to its mode of transmission.

According to yet another characteristic, the anti-piracy bit stream is generated by the central processing unit after sending the data authentication methods encrypted to the identification device. In this case, the identification device may include a mixer for mix the signal at the output of said self-timer with a digital signal of encrypted authentication in response to the identification device, to a slower than the anti-piracy bitstream, the signal output of this mixer being able to control the aforementioned modulator of the identification device.

It can then be foreseen that the central unit of the vehicle comprises a phase or amplitude demodulator to demodulate the signal received by the vehicle from the identification device, a exclusive OR logic gate whose inputs are connected respectively said phase demodulator and a digital signal retarder, said retarder being capable of delaying by bit useful time each bit of the anti-piracy train generated by the central unit, said logic gate being able to output a digital signal representative of the encrypted identification device response signal.

In a first embodiment, the signal delivered in output of the aforementioned exclusive OR logic gate is compared by the unit central to an encrypted digital authentication signal generated by the central unit, in order to authenticate the identification device.

In another embodiment, the exit from said door exclusive OR logic is connected to an input of a second door exclusive OR logic whose other input receives a digital signal encrypted authentication generated by the central unit, in order to deliver at output said signal representative of successive time offsets of every bit of the anti-piracy train.

It can also be provided that the central unit is able to alternately control the stop and start of the oscillator the central unit according to said predetermined high clock rate to switch the central unit respectively to reception mode and program. Since a very high oscillator is used frequency, for example around 2.4 GHz, it is possible to stop and restart the oscillator for each bit of the anti-piracy train, because the relaxation time of this type of oscillator is short.

According to another characteristic, the central control unit has a radio carrier wave oscillator frequency, connected to a phase or amplitude modulator, which is controlled by the anti-piracy bit stream generated by the unit vehicle center.

Alternatively, the identification device may include a unit of measurement of average length of the bits received, for measure, after demodulation of the interrogation signal received in source of the vehicle, the average length of the anti-piracy bits received, said measurement unit being capable of causing the interruption of the communication when said average length is less than one predetermined value, for example 90% of the useful bit length emitted by the vehicle. The purpose of this unit is to prevent a pirate bypasses the anti-piracy device constituted by the integrator, by shortening the reception of the signal sent from the vehicle, so cause an early response signal from the device of identification, this anticipated response intended to compensate for the duration of signal propagation due to distance.

According to yet another characteristic, the central unit is able to control the stop or operation of a receiver at said high clock rate, so that said receiver delivers to the mixer from the central unit a digital signal representative of the interpretation the start of the response signal received from the vehicle. In Indeed, the end of the response signal is not processed by the central unit, because said end overlaps with the emission of the anti-piracy bit next, due to the delay due to signal propagation.

For example, the useful bit time can be between 50 ns and 1µs, for example of the order of 200 ns.

• la figure 1 est un schéma synoptique fonctionnel représentant le protocole d'encryptage pour sécuriser la transmission bidirectionnelle de données entre un véhicule et un dispositif d'identification ;
• la figure 2 est un schéma synoptique fonctionnel illustrant un moyen de piratage du système d'encryptage par l'intermédiaire de deux boítiers relais ;
• la figure 3 est un schéma synoptique fonctionnel simplifié d'un système d'accès mains libres conforme à l'invention ;
• la figure 4 est un schéma synoptique fonctionnel plus détaillé correspondant au schéma de la figure 3 ;
• la figure 5 représente plusieurs chronogrammes illustrant les trames complètes d'interrogation émises par le véhicule et reçues en réponse par le véhicule ;
• la figure 6 est une vue partielle et agrandie d'une portion des chronogrammes de la figure 5, indiquée par la flèche VI, correspondant au début de la séquence d'anti-piratage ;
• la figure 7 reprend les deux premiers chronogrammes de la figure 5 ; et
• la figure 8 est une vue partielle et agrandie d'une portion des chronogrammes de la figure 7, indiquée par la flèche VIII, au cours de la séquence d' anti-piratage.

The invention will be better understood, and other objects, details, characteristics and advantages thereof will appear more clearly during the detailed explanatory description which follows of a particular embodiment of the invention, given only to Illustrative and non-limiting title, with reference to the attached schematic drawing, in which:

• FIG. 1 is a functional block diagram representing the encryption protocol for securing the bidirectional transmission of data between a vehicle and an identification device;
• Figure 2 is a functional block diagram illustrating a means of hacking the encryption system via two relay boxes;
• FIG. 3 is a simplified functional block diagram of a hands-free access system according to the invention;
• Figure 4 is a more detailed block diagram corresponding to the diagram of Figure 3;
• FIG. 5 represents several timing diagrams illustrating the complete interrogation frames sent by the vehicle and received in response by the vehicle;
• FIG. 6 is a partial and enlarged view of a portion of the timing diagrams of FIG. 5, indicated by the arrow VI, corresponding to the start of the anti-piracy sequence;
• Figure 7 shows the first two timing diagrams of Figure 5; and
• Figure 8 is a partial and enlarged view of a portion of the timing diagrams of Figure 7, indicated by arrow VIII, during the anti-piracy sequence.

We will now refer to Figures 3 and 4, which represent the hands-free access system according to the invention respectively under simplified and more detailed form.

The motor vehicle V has in its central unit a microcontroller 50, which is usually in a semi-sleep state or waiting for an alarm clock. When the user activates the external door handle, an activation signal is sent to the micro-controller 50, as indicated by arrow 51. In response, the microcontroller sends a general power signal, as shown by arrow 52, to supply the various electronic components of the central unit. Then, the microcontroller 50 generates a series of low rate signals sk, for example of the order of 2 to 100 Kb / s on line V5. The data carried on line V5 is successively an awakening signal, a signal representative of a number random R with a length for example of 56 bits, a signal representative of the function f (R, K) with a length for example of 28 bits, and of a signal representative of service data s, for example with a length of 100 to 5,000 bits, for example data on the maintenance, vehicle adjustment, etc. (see Figure 5). Line V5 is connected to a transmitter 53 to transmit signals via an antenna 54 towards the identification device I as represented by the arrow E. The transmitter 53 includes, as best seen in FIG. 4, a oscillator 55 to generate an ultra high carrier wave frequency, for example at 2.4 GHz, said oscillator being powered by line 52. The oscillator 55 is connected to a phase modulator 56 or an amplitude modulator of the 50% and 100% modulation type depending on whether the value of the transmitted bit is 0 or 1, the output of which is linked to the above-mentioned antenna 54.

The signal emitted E, for example with an amplitude of the order of 2V efficient, is received by an antenna 100 of the identification device I with an attenuation of the order of -40 dBm, which represents a attenuation coefficient of 100 times, i.e. the signal received by the identification device has an amplitude of the order of 20 mV. The antenna 100 is connected to a radio frequency filter 101 (only shown in Figure 4) to eliminate frequencies parasites. The output of the filter 101 is connected to a branch, of a hand, to a low-speed, low-consumption receiver 102 and, on the other hand, to a logarithmic amplifier 103 which allows output an effective signal of the order of 2V, and serves as high frequency receiver. Signals at low cadence sk are not transmitted by the amplifier 103, but pass essentially via the receiver 102. As best seen in FIG. 4, the receiver 102 successively includes a radio frequency envelope detector 104 to reconstruct the low cadence signals on line I5, which correspond to those of line V5. Detector output envelope 104 is connected to a low frequency amplifier 105, of which the output is connected in parallel, on the one hand, to a sequence decoder awakening 106 and, on the other hand, to a microcontroller 107 of the device identification I via line 108. When communication starts with the vehicle, only the decoder 106 is permanently supplied by the battery of the identification device. In other words, the awakening data e are decoded by the decoder 106, in order to send an awakening command to the micro-controller 107, at the output of decoder 106. The micro-controller 107 then awakens all the other electronic components of the device Identification. Thus, the following data, namely the signals R, f and s, are transmitted directly to the microcontroller 107 via the line in parallel 108.

After transmission of the service data s, the microcontroller 50 of vehicle V generates anti-piracy bits h at slow rate sk of the microprocessor, said anti-piracy bits being received by a 58 random binary sequence generator buffer output the high-speed anti-piracy bits fk, on a line V7. The output of buffer memory 58 is connected to a branch, on the one hand, with the phase modulator or amplitude 56 to phase-modulate the carrier wave generated by oscillator 55, and on the other hand, with a digital self-timer useful bit time 59, the function of which will be explained later. Every bit anti-piracy is transmitted as a radio frequency signal via antenna 54 towards the identification device I. The frame overall emission V2 of the signals by the antenna 54 is illustrated on the Figures 5 and 7. With particular reference to Figure 6, we have shown the start of the anti-piracy bit interrogation frame h on line V2. On line V2 in Figure 6, we see that each anti-piracy bit is carried by a very high oscillating wave frequency having a bit time Ta for example of the order of 200 ns. The transmission of the anti-piracy bits h1, h2 ... hn is authorized or prohibited, as a function of a control signal V1 which is emitted by a vehicle V time base management unit 60, which unit 60 is capable of delivering clock signals at low cad rate sk, at medium cadence mk and high cadence fk. Of course, the unit 60 is connected to the microcontroller 50, as indicated by the double arrow 61. The signal V1 is generated at the predetermined high rate fk and controls alternatively, on the one hand, stopping and starting the oscillator 55 and, on the other hand, a receiver 62 of the central unit.

The identification device I receives via its antenna 100 on the line I1 (see figure 6) a signal which corresponds to the anti-piracy bit h1 emitted by vehicle V, with a delay time δ which corresponds to signal propagation time between vehicle and device Identification. The signal then passes through the amplifier 103, the output is connected to a branch between, on the one hand, a unit of measurement of average bit length 124 and, on the other hand, a timer digital 125 to delay the signal by a useful bit time Tb, at the frequency fk. FIG. 8 shows the signal I2 which corresponds to the digital signal at the output of the self-timer 125, said signal being delayed by a useful bit time Tb, Tb possibly being equal or different from Ta. The output of the self-timer 125 is connected to an input an exclusive OR logic gate 109, the other input of which receives a encrypted authentication control signal g, the frame of which is shown on line I6. As visible on line I6 shown in FIG. 8, the bit rate of the signals g is at medium rate mk, lower than the high rate fk of the anti-piracy bits h. In this indeed, it is expected that the microcontroller 107 of the device identification transmits signal g at low speed sk to a memory buffer 110 which outputs the signal g at the average rate mk to mixer 109.

The mixer 109 outputs a digital signal of control shown in 17. The output of the mixer 109 is connected to a transmitter 111 for transmitting a response signal R via an antenna 112, at an amplitude on the order of 2V effective, towards vehicle V, as represented by arrow R.

When receiving each signal representative of a bit anti-piracy, the identification device is able to detect the front descending F of the signal at the output of amplifier 103, in a Falling edge detector 113, as visible in FIG. 4. This last one is able to command a scale 114 with a slight delay of safety ε to avoid any overlap between reception and the emission of the signal at the identification device. This flip-flop 114 controls the start of a high frequency oscillator 115 of the transmitter 111, after the slight delay ε, which oscillator 115 is connected at output to a phase or amplitude modulator 118 of said transmitter 111, said modulator 118 being controlled by signal 17 in mixer 109 output. Simultaneously with edge detection downlink, detector 113 sends a bit synchronization signal via line 119 to a time base management unit 116 which delivers the aforementioned clock signals sk, mk and fk, said unit 116 being connected to microcontroller 107 via line 117. Said unit 116 is suitable for command rocker 114 to switch it to its stop state of oscillator 115, at the end of time bit Tb, as visible on the Figure 4. Of course, we could predict the slight delay ε close from 0 s.

On the assumption that the electromagnetic signals transmitted propagate at the speed of light, namely 3.10 ⁸ m / s, we can consider that the duration of transmission of the signals is of the order of 3 ns per meter of distance between the vehicle and the identification device I. In other words, for a round trip between the vehicle V and the identification device I, spaced a distance of about 5 meters, the propagation time δ would be around 30 ns. To this propagation time δ, one could add the response time of the electronic circuits, which could be of the order of a few ns, or tens of ns, depending on the bandwidth allocated to the carrier.

The signal retransmitted by the identification device is received by a receiver 62 via an antenna 63, with an attenuation of the order of - 40 dBm, which represents an attenuation coefficient of 100 times, that is, the signal received by the vehicle has an amplitude of around 20 mV. As best shown in Figure 4, the receiver 62 includes a radio frequency filter 64 connected to the antenna 63, whose output signal is represented by line V3, this signal being delivered to the input of a logarithmic amplifier 65 which has a gain of 80 dB, which achieves a coefficient of multiplication of up to 10,000 times, and in particular to deliver in output of said amplifier 65 a signal of the order of 2V effective. Amplifier 65 is controlled by signal V1 and is connected at output to a phase or amplitude demodulator 67.

Since the amplifier 65 is controlled by the signal V1, said amplifier switches to its inactive state when it starts the transmission of the second bit of anti-piracy h2, as indicated on the line V1 in figure 6. However, as the central unit receives the response signal from the identification device I with a delay equal to 2 δ + ε, only the start of the response signal is processed by the receiver 65 and therefore demodulated by demodulator 67, as indicated on line V9, whose demodulated signal has a duration Tc which is less than the duration Ta of the transmission bit and the duration Tb of the transmission bit reply. For example, for a bit time Ta and Tb of the order of 200 ns, and a normal offset duration of the order of 50 ns, the duration Tc of the bit analyzed in response by the central unit is of the order of 150 ns, which corresponds to 75% of the initial signal.

The phase demodulator 67 delivers a signal representative of the hog function on line V9 which is connected to an input of a door exclusive OR logic 70. This logic gate 70 receives on its other input a signal V8 representative of the function h, delivered at the output of the digital self-timer 59. Logic gate 70 could be replaced by another type of mixer, as shown in Figure 3. The signal V8 corresponds to signal V7 with a delay corresponding to Tb offset of digital self-timer 125 of the identification device I. The logic gate 70 outputs a signal V10, which is representative of the offset between the V8 and V9 signals, i.e. a signal representative of the encrypted authentication signal g emitted by the identification device I, with a small offset corresponding to the signal propagation time which is equal to 2δ, as visible on the figure 8.

The output of logic gate 70 is connected to a branch between, on the one hand, a low-pass filter 71 at the average rate mk which is the cadence corresponding to the signal g and, on the other hand, another exclusive OR logic gate 73. The low-pass filter 71 is connected to a buffer 72, which transforms said signal from cadence mk to cadence sk before sending it to the microcontroller 50 which will compare the signal g received from the authentication device with the g signal generated at vehicle level, for authentication of communication, which corresponds to the last step 10 illustrated on the diagram in Figure 1. Note that this comparison between the two functions g are performed by auto-correlation between the signals, the acceptable auto-correlation threshold being for example set at 90%, knowing that a level of autocorrelation of 50% corresponds to the comparison of two random signals.

The microcontroller 50 delivers the signal g specific to the vehicle to a buffer memory 74 at the rate sk, so that it sends it back to the cadence mk at the other input of the above logic gate 73. We have represented on line V11 the signal g which corresponds exactly to the signal g generated by the identification device and issued on the line I6, as shown in FIG. 8. The logic gate 73 mixes the V10 and V11 signals in order to output only the offsets due at the signal propagation time between vehicle V and the device identification I, as shown on line V12. Leaving the logic gate 73 is connected to the input of an integrator 75, which goes output a V13 signal which will go up by stairs in function of time, for each slot C representative of the propagation time of the signal. Line V13 is connected to a branch line between, share, a first comparator 76 receiving on another input a threshold limit value 76a which corresponds to the propagation time maximum acceptable, for example 50 ns x n, n being the number of bits anti-piracy, and, on the other hand, a second comparator 77 receiving on another entry another threshold limit value 77a lower than the value 76a and which corresponds to the propagation time over the distance authorized. Depending on whether the amplitude of the output signal on line V13 is or not greater than this limit value 76a, an attempt to hack will be sent or not via line 78 by the first comparator 76 to the microcontroller 50. Similarly, if the amplitude of the output signal on line V13 is greater than the value 77a, but lower than the value 76a, the second comparator 77 will send to the microcontroller 50 via line 79, a signal indicating that communication is done outside the authorized distance, without however constituting a hacking attempt. The integrator 75 will sum the elementary time shifts until the end of the anti-piracy frame, as indicated by arrow 75a, unless the communication is interrupted beforehand by the first and second comparators 76 and 77 above.

Finally, the microcontroller 50 can deliver different signals from output to other vehicle components via track 80 shown on Figures 3 and 4.

However, a hacker could try to trap the system. the invention by shortening the reception of the signal emitted by the vehicle. AT as an example, as soon as the hacker detects with a relay box the vehicle transmitting an anti-piracy bit, it can re-issue to the other relay box only the start of said signal, in order to cause the device to send the response signal early Identification. Advantageously, the signal is shortened by a duration which would correspond to the duration of propagation of the signal over the distance between the identification device and the vehicle, for example compared to the maximum distance allowed. So like the detector 113 of the identification device I is able to detect the front descending from the signal received from the vehicle, shortening the signal emitted by the vehicle makes it possible to anticipate the emission by the response signal identification device, thereby removing any unauthorized delay between sending and receiving the signal anti-piracy by the vehicle, which can thus trap the system.

To prevent a hacker from trapping the system, the measurement of average bit length 124 of the identification device I allows to measure the average length of the bits received by the device identification from the vehicle. For example if the average length thus measured is less than 90% of the length expected from the bit sent by the vehicle, the unit 124 will then send a hacking attempt signal via line 131 to the microcontroller 107 and a stop signal via line 130 to the basic management unit of time 116. In other words, the unit 124 makes it possible to verify the integrity of the bit received by the identification device and thus makes it possible to detect a hacking attempt, even if the hacker shortens the re-transmission of the signal to the identification device. Indeed, if this shortened signal can trap the integrator 75 of the central processing unit vehicle control, however unit 124 will interpret this signal shortened as an erroneous signal and will thus interrupt the communication.

For example, the intermediate clock rate mk is between 20 and 60 times lower than the rate fk.

Alternatively, the antennas 54 and 63 of the vehicle V by a single antenna 82 shown in broken lines in FIG. 4, which antenna 82 would be connected to a diplexer 81 shown in broken lines in Figure 4, to switch between the reception mode and the transmission mode as appropriate. So analogous, we could replace the antennas 100 and 112 of the device identification by a single antenna 121 connected to a diplexer 120, shown in broken lines in FIG. 4. The diplexers 81 and 120 could thus communicate with each other, as indicated by the double arrow T.

As shown in Figure 5, on line V3, after receipt of the hog signal, the vehicle V receives from the device identifying a hos signal where s represents service data which come to modulate the signal h by phase inversion, as it was the case for signal g whose length is less than that of signal h.

Although the invention has been described in connection with an example particular achievement, it is obvious that it is not at all limited and that it includes all the technical equivalents of the means described as well as their combinations if these fall within the scope of the invention.

Claims (14)

1. System for so-called hands-free access for a motor vehicle (V), including an identification device (I) intended to be carried by a user (U) and able to establish bidirectional remote and wireless communication with a central control unit on board the vehicle, to authenticate the user and the control means for locking/unlocking the locks of the opening leaves when the user had been recognised as authentic, the said system being able to establish the said bidirectional communication when the identification device is situated at a distance less then a predetermined limit distance from the vehicle, characterised by the fact that the said central unit is able to generate, at a predetermined high clock speed (fk), upon the communication, a string of anti-hacking bits (h), each bit (h1, h2, h3) of the said string being transmitted to the identification device (I) in the form of a radio-frequency interrogation signal (E) representing the said bit, in such a manner that after reception of the said interrogation signal by the identification device, the latter transmits, with a delay at least equal to one useful bit time (Tb), a response signal to the central control unit, the latter including at least one mixer (70) able to mix, on the one hand, the response signal (R) received from the identification device and, on the other, the string of anti-hacking bits (h) generated by the central unit and delayed by one useful bit time (Tb), to deliver at the output of the said mixer a signal (V12) representing the successive time shifts of each bit of the said anti-hacking string, this latter signal being received at the input of an integrator (75) to sum the response times linked to each anti-hacking bit time shift crenulation (C), the output of the said integrator being connected to at least a first comparator (76) to compare the said sum of response times with a first predetermined threshold value (76a), beyond which a hacking attempt is detected, causing stoppage of the said communication.
2. System as described in claim 1, characterised by the fact that the summing of the response times performed by the integrator (75), is stopped when the central control unit detects reception of the last bit of the anti-hacking string (75a).
3. System as described in claim 1 or 2, characterised by the fact that the output of the integrator (75) is connected to at least a second comparator (77) to compare the said sum of response times with another predetermined threshold value (77a) lower than the said first predetermined threshold value (76a), beyond which a communication beyond the said predetermined limit distance is detected.
4. System as described in one of claims 1 to 3, characterised by the fact that the identification device (I) includes a digital signal delayer (125) able to delay by one useful bit time (Tb) the interrogation signal received from the vehicle (V), and an oscillator (115) generating radio frequency carrier waves, connected at its output to a phase or amplitude modulator (118), which is controlled by the output signal of the said delayer, to deliver at the output of the said modulator the said response signal (I4) intended to be transmitted to the vehicle.
5. System as described in claim 4, characterised by the fact that the identification device (I) includes a falling edge detector (113) to detect the falling edge (F) of the interrogation signal received from the vehicle (V), the said detector being able to toggle the said oscillator (115) of the identification device between a stop state corresponding to the reception mode of the identification device and an operating state corresponding to its transmission mode.
6. System as described in claim 4 or 5, characterised by the fact that the string of anti-hacking bits (h) is generated by the central unit after transmission of the encrypted authentication data (R, f) to the identification device (I).
7. System as described in claim 6, characterised by the fact that the identification device includes a mixer (109) to mix the output signal of the said delayer (125) with an encrypted digital authentication response signal (g) from the identification device, at a speed (mk) slower than that of the string of anti-hacking bits (h), the output signal (17) of this mixer being able to control the above-mentioned modulator (118) of the identification device.
8. System as described in claim 7, characterised by the fact that the central unit of the vehicle (V) includes a phase or amplitude demodulator (67) to demodulate the signal received by the vehicle from the identification device (I), and an XOR logic gate (70) the inputs of which are connected respectively to the said phase demodulator and to a digital signal delayer (59), the said delayer being able to delay by one useful bit time (Tb) each bit of the anti-hacking string (h) generated by the central unit, the said logic gate (70) being able to output a digital signal (V10) representing the encrypted response signal from the identification device.
9. System as described in claim 8, characterised by the fact that the signal (V10) output by the above-mentioned XOR logic gate (70) is compared by the central unit with an encrypted digital authentication signal generated by the central unit, in order to authenticate the identification device.
10. System as described in claim 8 or 9, characterised by the fact that the output of the said XOR logic gate (70) is connected to one input of a second XOR logic gate (73) the other input of which receives an encrypted digital authentication signal (g) generated by the central unit, in order to output the said signal (V12) representing the successive time shifts of each bit of the anti-hacking string.
11. System as described in one of claims 1 to 10, characterised by the fact that the central control unit includes an oscillator (55) generating radio frequency carrier waves, connected to a phase or amplitude modulator (56), which is controlled by the string of anti-hacking bits (h) generated by the central unit of the vehicle (V).
12. System as described in claim 11, characterised by the fact that the central unit is able to command alternatively the stopping and the starting of the oscillator (55) of the central unit at the said predetermined high clock speed (fk) to toggle the central unit into reception and transmission mode respectively.
13. System as described in claim 12, characterised by the fact that the central unit is able to command the stopping or the operation of a receiver (62) at the said high clock speed (hk), so that the said receiver (62) delivers to the mixer (70) of the central unit a digital signal (V9) representing the interpretation of the start of the response signal received from the vehicle.
14. System as described in one of claims 1 to 13, characterised by the fact that the identification device (I) includes a unit (124) for measuring the mean length of the bits received, to measure, after demodulation of the interrogation signal (E) received from the vehicle (V), the mean length of the anti-hacking bits received, the said measurement unit being able to cause the interruption of the communication when the said mean length is less than a predetermined value, for example 90% of the useful length Ta of the bit transmitted by the vehicle.

Images