EP2979255A1

EP2979255A1 - Method for performing automatic opening of a vehicle or a payment process, and associated apparatus

Info

Publication number: EP2979255A1
Application number: EP14728471.5A
Authority: EP
Inventors: Andreas Ziller
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2013-05-23
Filing date: 2014-05-19
Publication date: 2016-02-03
Also published as: CN105339989A; US20160125675A1; DE102013209612A1; US10217300B2; WO2014187767A1

Abstract

The explanation relates inter alia to a method for performing automatic opening and/or enabling of potential starting of a vehicle (12), involving: – receiving a first signal (20) or a first message (20) that is used to perform automatic opening and/or enabling of a vehicle (12), – taking the receipt of the first signal (20) or of the first message (20) as a basis for producing a second signal (28) or a second message (28) for the driver of the vehicle (12).

Description

description

A method for performing an automatic opening of a vehicle or a payment process and associated Vor ^¬ direction

The invention relates, inter alia. a method of performing automatic opening of a vehicle and / or unlocking the starting capability of a vehicle, e.g.

Activation of a start button in the vehicle. Such systems are known and widely used as keyless go systems. It is possible to use an electronic key which, for example, no longer has a key bit with cutouts that are matched to positions in a door lock. Alternatively, a mechanical key may be available as a reserve.

Similar technologies are also used in contactless electronic payment, in which, in contrast to credit card payments or debit card payments, there is no electrically conductive contact between a cash register and a payment device of the buyer. Thus, e.g. an NFC (Near Field Communication) can be used to pay. NFC can also be used in connection with an access system, in particular to a car.

Both the Keyless Go system and the payment system are safe against abuse, especially in a cost-effective and therefore simple design only to a certain extent. In particular, these systems are vulnerable to exposure of the operator's or customer's controls to signals such as occur near the car or cash register. However, these signals are abusive transmitted over a greater distance from the car or from the cash register. The operating device then erroneously assumes a proximity to the car or to a cash register.

From DE 103 39 293 AI a method for operating the locking system of a motor vehicle is known. From DE 10 2004 001 904 AI a locking system is known. From DE 44 41 988 AI a remote control is known. From EP 2 528 045 AI a method for cardless authentication is known. EP 2 584 514 A1 discloses a method for credit card transactions on the Internet (cloud).

The invention relates to a method for performing an automatic opening and / or free switching of the Startmög ^¬ friendliness of a vehicle, comprising:

Receiving a first signal or a first message with which or with which an automatic opening and / or unlocking of a vehicle is performed, and

- Depending on the receipt of the first signal or the first message generating a second signal or a second message for the driver of the vehicle.

The invention further relates to a method for performing an automatic contactless access process or contactless payment process,

- Wherein optionally depending on the occurrence or absence of an abort signal or an abort message on a mo ^¬ bile device, the process is performed if within a predetermined time after the generation of a signal or a message for a person participating in the process no abort signal or none Abort message is generated, and wherein the process is not performed when the person generates the abort signal or the abort message within a predetermined time. In addition, the invention relates to a device for performing an automatic opening and / or unlocking the starting possibility of a vehicle, comprising:

a receiving unit for receiving a first signal or a first message with which or with which an automatic opening and / or unlocking of a vehicle is carried out, a transmitting unit which transmits a second signal or a second message to the driver of the vehicle depending on the reception of the first signal or the first message. It is an object of the invention to provide simple methods for performing automatic operations, which in particular provide better protection against abuse and / or reduce the ease of use or only slightly. In addition, an associated device should be specified.

This object is achieved by a method according to claim 1. In addition, the object is achieved by a method according to the independent method claim and by a device according to the independent device claim. Further developments are specified in the subclaims.

A method for performing automatic opening and / or unlocking of a vehicle launch facility may include:

Thus, the driver may always be notified of operations for opening and / or starting his vehicle in unusual situations. This also applies in the event that an unauthorized person wants to gain access to the vehicle. An active intervention of the driver to open, however, is not required, so that the operating ^¬ comfort is maintained, ie the vehicle still opens when approaching the driver who carries an electronic key, but this does not have to operate.

The second signal gives the driver additional security ^¬ ness. The level of extra attention for the second Signal can be reduced if the second signal is generated, for example, only as a function of an unsuccessful plausibility check of the circumstances when opening and / or starting. If everything is plausible, the second signal can not be generated. However, provisions are made in the event of a negative plausibility check that the second signal or message is then generated.

The driver can be given a way to cancel the opening or unlocking. However, a simple variant of the process, even without such a possibility ar ^¬ BEITEN, ie, the driver is informed only by the second signal or the second message. The term signal emphasizes more the analogous character of a

Transmission. In contrast, message emphasizes more the digital nature of a transmission.

In the course of the process if an abort signal or an abort message is received within a predetermined time, or indicating that the Publ ^¬ nen and / or unlocking is to be aborted can be checked. Alternatively it can be checked whether within the given time no such abort signal or no abort message has been received. Furthermore, either the opening and / or the unlocking of the start possibility can be performed if the abort signal or the abort message has not been received. On the other hand, the opening and / or unlocking the starting option may be omitted if the abort signal, or the abort message has been captured emp ^¬.

The opening of the door of the vehicle can take place, for example, in combination with the gripping of the handle. Unlocking the start ability of the vehicle is effected for example. By activation of a start button in the vehicle to which the engine can be started only in ak ^¬ TiVi Erten state. The second signal or the second message can be generated for a person who should usually be involved in the process be ^¬ . The abort signal may be, for example, a button press on a button on the device performing the procedure or on a device to which the second message has been transmitted. Alternatively or additionally, other user inputs may cause the abort signal.

It can only be tested for one of the two specified conditions. The other option is available if the ge ^¬ determined condition arrives. The omission of the process can be done for example by canceling and / or blocking and / or omitting to send a third message.

"Optionally" can mean here that in a particular case only one specified possibility applies, but in another Konstella ^¬ tion but the other possibility can occur, so that appropriate precautions have to be taken.

The technical effect of the method can be seen in the fact that the inclusion or use of a person is reduced to a minimum, which is particularly advantageous in technical ^¬ devices that serve just this purpose, such as opening a vehicle without introducing a Key in a door lock and / or starting a vehicle without inserting a key into an ignition lock.

Due to the second signal or the second message, the driver always or in critical situations is informed about events on or in his vehicle. In particular, the driver is informed when Others want to gain access to the vehicle unberechtig ^¬ te way, for example with a so-called relay (relay or forwarding) method. Even if the driver misses the abort option, he is at least forewarned and can, for example, immediately go to his vehicle or take another measure.

The predetermined time may be in the range of one second to 10 seconds, preferably in the range of 1 to 2 seconds or in the range of 1 to 3 seconds. The first signal or message may include a datum to which the receiver of the first signal or message is to generate a response date, particularly as part of a challenge-response procedure for determining the identity of the recipient of the first Signal or the first message.

Even if a time of, for example, less than 3 seconds is too short in an individual case to react immediately, the driver may take other measures. On the other hand, a short delay time allows a quick opening / starting of the vehicle, when the driver quickly goes to his car or wants to quickly press the start button after boarding.

So-called challenge response methods enable the identification of a recipient device in a simple but secure manner, which is also referred to as authentication.

The challenge date and the response date may or should be transmitted in encrypted form, for example with a symmetric, such as AES (advanced encryption standard), DES (data encryption standard), or an asymmetric method, such as RSA (Rivest, Shamir and Adleman) or Diffie Hellmann (DH / DSS - digital signing standard). Also, hybrid methods from the mentioned encryption methods can be used. From the challenge date, the response date can be determined according to a predetermined calculation method. This calculation method may be a well-known method or a method known only to the sender and the receiver. For example. However, a parameter required for the execution of the method or a required date may be known only to the transmitter and the receiver. It can also be a plurality of parameters or data to be used according to a predetermined scheme, in particular according to a selection scheme.

The first message can be transmitted in the long-wave range (LF - low frequency). e.g. in the range from 120 KHz (kilohertz) to 135 KHz.

The message for transmitting the response date, e.g. a third message or a third signal may be transmitted in the UHF (ultra high frequency) range, e.g. in the range of 200 MHz (megahertz) to 500 MHz, in particular with the simultaneous use of a remote control function for opening and closing the vehicle.

In one embodiment, however, the first signal or the first message (check, wake up) does not contain a challenge date from which a response date is to be calculated. For example, the first signal or the first message should only determine whether an electronic "key" or a device with the function of an electronic key is in the vicinity. The electronic key can then with a third message / signal to the first message / signal ant ^¬ words, the third message containing no reply date as part of a challenge-response method. Only when the key answers are longer messages generated, eg messages which also contain a challenge date. In either case, the signal or message with the challenge date may include a tag date for the vehicle. The second signal may be a sound signal and / or a vibration ^¬ signal and / or a light signal. The sound signal has, for example, a frequency in the range of 200 Hz (Hertz) to 20 KHz (kilohertz). The vibration signal may have a frequency less than 200 Hz. Alternatively or additionally, a visually detectable signal can also be used, for example a signal generated with an LED (light-emitting device).

The electronic key can ever ^¬ but housed in one configuration, even in a device that has other functions, ie for example (in a mobile phone handset,

Smartphone) or in a clock, which is optionally equipped with further func ^¬ NEN.

The second signal or the second message can be sent to a telephone or to a clock. The inclusion of additional devices can ensure that the authorized person can not overlook or miss the second signal or the second message or for other reasons can not perceive. The additional devices may have a larger energy store than an electronic key and / or more powerful functions to get the person's attention and / or to check for plausibility. The transmission of the second signal / message can be done, for example, via Bluetooth or another suitable method.

A plausibility check may be performed in which it is checked whether the same conditions or conditions in a same range are met for a vehicle and a device for opening and / or starting the vehicle. The conditions may be linked to physical parameters, eg data describing the location, temperature, air pressure or other environmental conditions. The description of the location can be made using GPS (Global Positioning System), GLONASS or other satellite based systems. Additionally or alternatively, when determining the location, for example, existing WLANs (Wireless Area Network) may also be included, for example a list of these WLANs or an evaluation of the position of the transmission antennas of the WLANs or other radio networks.

The plausibility check may be performed before a time when the second signal or the second message is generated. Optionally, the second signal or the second message can be generated, depending on the result of the plausibility check, if the plausibility check was negative. With a positive plausibility check, the second signal can not be generated.

Thus, an attempt is not made to get the attention of a person if the opening or starting is plausible. This leads to a discharge of the person. Also a "dulling" of the attention of the person can be avoided in this way.

In one embodiment, only the second signal or the second message is generated. Only after that Plausibili ^¬ tätsprüfung is performed. The result of the plausibility check can then, for example, be used independently of the response signal in order to abort the process.

In a simple method, no plausibility ^¬ test is performed.

A first environmental date may be determined in or on the vehicle, in particular at a distance less than ten meters or less than three meters. In order to carry out the method, the device can determine a second environment date, preferably in its own environment. The two environmental data may or in the absence of an environmental date may indicate this fact and the other environmental date for the Plausibility check can be used. For example, a distance can be determined from two location data.

The first environmental date can be determined, for example, by a device that is permanently connected to the vehicle. An ^¬ closing the first environment date then can the apparatus for performing the method, to be an electronic key, transmitted to say for example. Alternatively, the first environmental date can be determined by the device for carrying out the method, ie, for example, by an electronic key when locking the vehicle, ie in the vicinity of the vehicle.

Because, for example. A GPS signal is often not available inside buildings, the fact that no location signal is EXISTING ^¬ to be used for a plausibility check. If, for example, an environmental date, eg local date, can be determined and the other is not, then this can already be rated such that the data is not plausible. So the vehicle could be in an underground car park and the person or the driver outdoors. Conversely, the vehicle could stand outdoors and the person in a building. Both cases are possible, for example, only in the case of abuse or malfunction, so that the opening or starting of the vehicle should be prevented automatically or involving an automatically notified person.

The first environmental date may be a city date or a temperature date or an air pressure date. For a meaningful comparison to be possible, the second environment datum may also be of the same type, i. Location date, temperature date or an air pressure date. Other environmental data can also be used for the plausibility check.

The location data or the location data can be determined with the aid of a satellite system and / or with the aid of a mobile radio network and / or with the aid of at least one WLAN. Such methods are, for example, under the name GPS (global Positioning System) or "Assisted" or supported GPS known.

The plausibility check may be performed after generating the second signal or the second message. Thus, the driver gets the second signal in any case. The time for the plausibility check can then be attributed to the time remaining for the driver to react. The plausibility check can also be carried out in the absence of the abort signal or the abort message. This results in additional safety in the event that the driver does not hear the signal or not reacts too late or rea ^¬ giert. The opening or starting of the vehicle can be omitted if no plausibility of the environmental data on the vehicle and the electronic key is detected.

In one embodiment, the method of protection against theft using so-called relay attacks is used. So far, a protection against such attacks can be achieved only relatively expensive, eg. By detection of signal propagation times (signal bouncing) or Nachrichtenübertragungszei ^¬ th or otherwise. In a further embodiment, the method is combined with a method for detecting signal propagation times in order to increase the protection. The detection of signal propagation times can be carried out in particular in the context of the plausibility check. Preferably, the signal propagation time over the duration between a sent and a subsequently received

Signal / message (round trip - circulation) are determined, in particular, the above-mentioned delay should not lead to an extension of the detected time. The method of opening and / or starting can be performed without the detection of signal bouncing times or message transmission times. In a simple way and yet comparatively safe, rectification of the driver, which can not be easily suppressed in the context of a relay

Protection against abuse.

In a method for performing a non-contact automatic access operation or a contactless Bezahl- operation, in particular according to one of the methods explained above, the process can be selectively performed depending on the presence or absence of a termination signal or termination message at a mo ^¬ bilen device when no abort signal or abort message is generated within a predetermined time after the generation of a signal or message for a person involved in the process. The process is not carried out if the person generates the abort signal or the abort message within a pre ^¬ given time.

Many of the considerations and technical effects for opening and / or starting vehicles also apply to payment transactions. Relay attacks are also possible there. A notification of the owner of an electronic payment device, such as electronic purse (e-wallet), particularly a NFC (near field communication) equipped mobile ^¬ phone can prevent such abuse, when the owner is notified of a transfer and possibly a response his device by an input action can prevent, eg voice input such as "no" or a push of a button or a gesture. Even if the input action is late, he has become attentive, which possibly still allows him to intervene, for example. Prospecting a nearby Kassenbe ^¬ rich or ATMs and immediate notification of the cashier or other responsible persons.

In one embodiment, the method for performing the payment process is also performed without checking for an abort signal or abort message, as discussed above for the method of opening and / or starting a vehicle. In further developments of the payment method, the features or method steps explained above for the vehicle are used, the same or similar technical effects being valid.

An apparatus for performing automatic opening and / or unlocking of a vehicle launch facility may include:

a receiving unit for receiving a first signal or a first message, with which or with which an automatic opening and / or unlocking of a vehicle is carried out, and

a transmitting unit which transmits a second signal or a second message to the driver of the vehicle depending on the reception of the first signal or the first message.

In one embodiment, the device also includes:

- a checking unit that checks whether a termination signal or termination message will catch emp ^¬ within a predetermined time, or indicating that the opening and / or unlocking is to be aborted, or whether no such abort signal within the given time or no such abort message has been received, and / or a control unit which selectively performs the opening and / or unlocking if the abort signal or the abort message has not been received, or which omits the opening and / or unlocking if Abort signal or the abort message has been received.

The control unit may include a processor, eg a microprocessor or a microcontroller, which executes instructions stored in an electronic memory. ^{Alternatively} , an electronic circuit without a processor can be used. The device may be further units for

Performing the above-mentioned methods included, so that the above-mentioned technical effects also apply to the device. In other words, a relay attacks recognizing Keyless-Go system will be explained. Automobile manufacturers offer automatic driving authorization systems for their top-of-the-range, upper-middle and, increasingly, lower-class cars. These are also known under the name "Keyless Go". This is a functionality that enables customers as light evolutionary step from the radio remote control for the Fahrzeugentriegelung, by carrying a device that acts as a vehicle ^¬ key, aufzu a vehicle without active action include ^¬ and start. Via a relay attack, in which the radio link between key and vehicle is artificially erwei ^¬ tert, it is possible for attackers to open a vehicle without the knowledge of the driver and start. For this purpose, no physical action on the driver or on the vehicle is necessary, for example. Also, no theft of the key or no manipulation of the castle. In a Keyless Go system, the vehicle is unlocked automatically as soon as the vehicle key is near the vehicle and, if necessary, the driver closes his hand around the handle. Then, when he gets in and the key is in the car with him, he can start the car with a start button and start his journey. The authorization is checked by the vehicle key, which uses radio-frequency cryptographic procedures that can only be successfully performed by certain keys that are permanently paired with the vehicle. The guided by the user actions, namely the closing of the hand to the handle or pressing the start button, only serve to determine the moment of Ent ^¬ riegeins or starting the vehicle and bring no additional security.

It is essential for the safety of the driving authorization check that the cryptographic method between Authenti ^¬ rule partners takes place, that is, between the key and the vehicle. The additional presence of the key in the interior for starting the vehicle, secured by technical measures, is only based on product safety, which is referred to as "safety" in English.

To understand the vulnerability of the system to relay attacks, the security mechanism is simplified here. It is assumed that does not distinguish between key indoor and outdoor space, since, as mentioned above, this is not an essential necessity for Si ^¬ reliability in terms of security.

The basic principle is that the vehicle is unlocked whenever the key is in the vicinity of the vehicle and the handle is covered. It is crucial if and when the unlocking takes place. In order for the vehicle to decide whether a key is nearby, communication must take place between the vehicle and the key. For this purpose, both devices are constantly in standby and can detect the mutual presence via radio beacons or synchronization messages and start the authentication with a cryptographic challenge-response method. Here, the key is authenticated to the vehicle. Either a symmetric or asymmetrical cryptography method is used, in which the key proves to the car that it is in possession of a secret that only the real key can have and that can not be obtained in other ways.

The security is because the cryptographic Ver ^¬ ride is safe and that the key and the driver in the vicinity of the vehicle and thus prevents a possible Angrei ^¬ fer to the vehicle by the physical presence. This means that the distance in the process, the authentication does not expire is too large for the driver to prevent a possible rise present unauthorized person before a ^¬. Any considered safe cryptographic methods with any key lengths can be used for this challenge-response method without this Auswirkun- gen hät to the successful use of a relay attack ^¬ te.

The relay attack now falsely suggests to the vehicle and the key that they are in absolute physical presence with each other. This certainty ent ^¬ stands for both only in that they are in mutual radio range and this is possible due to the physical parameters of the radio transmission only in actual physical proximity. The radio range is therefore limited to only a few meters under normal conditions. An actual perception of the real distance is not possible for such systems, since no method is applicable that makes the physical distance estimable due to runtime or field strength. The former is not or only very difficult to measure due to the speed of light of a transmission and the latter is impractical because it depends on too many physical factors.

The relay attack is started when the driver, together with the key, is at a certain minimum distance from the vehicle and therefore has no sight of the vehicle. For this purpose, the transmission from the vehicle, which serves, for example, the presence detection, by means of relays (re-transmission stations, eg antennas) correspondingly processed by radio, so that it comes to the point where the key is actually and can be received by this. The transmission data of the key may be transmitted in a similar manner to the location of the vehicle. There are al so ^¬ optionally uses two relays, the thus producing quasi egg NEN tunnel. For example, two cooperating attackers could deposit a relay near the key and the vehicle, respectively. The transfer from the car would go from the relay near the car to the second relay in the car Be forwarded near the key, which forwards this re ^¬ rum to the key. The communication in the Ge ^¬ genrichtung is possibly analogous or according weitergelei tet ^¬. There is no modification of the content and no attacks on cryptographic security. Since this channel is transparent to key and vehicle, this attack is successful.

In Erica Naone, "Car Radio via Antenna", Technology Review, 10.1.2011, http://www.heise.de/tr/artikel/Autoklau-per-

Antenne-1165992.html, the susceptibility of almost all currently on the market driving authorization systems has been shown. Aurelien Francillon, Boris Danev, Srdjan Capkun, "Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars", NDDS (Network and Distributed System Security Symposium) 2011,

http://eprint.iacr.org/2010/332.pdf, is the attack

presented scientifically prepared. The attack is re ^{¬ producible} with generally accessible knowledge of the process, with widespread electrical and telecommunications expertise and low cost of materials.

For this problem, there are few viable solutions Lö ^¬ so far. Although it could be dispensed with the use of a Keyless Go system. In this way, an active action of a driver would be necessary, which would be more expensive to compromise. Alternatively, the radio link between the vehicle and key could be interrupted, for example, in which the key is transported in a radio-shielded container. However, this would have the disadvantage that the functional gain would be destroyed by avoiding an active action. There is now a great demand for such systems because, on the one hand, they are the logical evolutionary step of a traditional radio remote control and can therefore be well marketed by automobile companies. Last but not least, this functionality is very well received by the market. The latter is certainly also very strong due to the fact that the exact procedure and the danger of the procedure of the broad mass of the users is not known.

The mechanism underlying this invention, can the basic applicability of a relay attack not be ^¬ harmonious. However, this presents a method that makes a driver's attention to an in-progress to relay attack, allowing him to these un ^¬ terbrechen. For this purpose, the unlocking mechanism is extended by additional steps.

1. The vehicle sends a challenge or another ^¬ After reporting to the key. 2. The key receives the Challenge or the other ^¬ After directing and delayed processing first by a fixed but arbitrary period of time. For example, in the meantime, the driver is, for example, via acoustic, optical and / or vibrational Vib ^¬ rationssignale about one in progress

Authentication informed. He now has the opportunity to actively Actuate the ^¬ cancel in ^¬ nerhalb a defined period of time by the gen a key at the end of the authentication, it should be unexpected, because he play as not located at ^¬ near his vehicle or he his vehicle do not want to unlock.

3. a) The driver has his head pressed: The process stops. 3. b) The driver does not press the button: The key carries over ^¬ the calculated response to the vehicle and the Fahr ^¬ zeug is ready for unlocking.

A keyless go system would still work against the background of this invention because the driver who actually wants to open his car could ignore the message by the key and the car will still automatically unlock without any active action would. The invented dung proper procedure would possibly only a longer time span ^¬ need for the operation. During this period, key and car must be in mutual reach. This should be sufficiently large so that a delay for the driver is avoided because this, for example, reaches the car before the authentication process is completed. Accordingly, depending on the typical Gehge ^¬ speed of a person should be a potentially higher

Range can be realized.

The modification of the procedure may, for example, also a control button or other input means on the key device erfor ^¬ countries. The system would, for example, then no additional security he rich ^¬ if the driver does not perceive the signal through his key. For example, it may be in noisy environments or may not store the key in its immediate vicinity. The driver's perceptibility could be improved if the key is possibly worn directly on the body or additional devices, such as a vibrating wristwatch, are also activated.

For example, an upgraded key could recognize the ambient conditions and thus recognize the plausibility of an initiated door opening. It is also conceivable that the key, for example, via Bluetooth Low Energy or a similar technology with the smartphone (eg iPhone, for example, from version 4S) of the driver is in communication. This has more computing power, energy storage and sensors, so that the plausibility could be detected more secure.

Regardless of whether the key or the smartphone recognizes the plausibility, the following additional plausibility checks would be possible:

Detection by position: - The Abstellort the vehicle is known, the own Posi ^¬ tion could, for example, be determined by GPS and compared with the Po ^¬ position of the vehicle. In the event of a deviation, the process would be aborted and the user would be notified.

- Positioning through smartphones is very powerful and very fast nowadays. This works only outdoors. Should therefore no GPS over a longer period are available, which typically does not occur outdoors, this could be the clue for the residence of the key in a closed building and thus for a non plausible Fahrzeugentriege ^¬ ment, if, for example, for the vehicle GPS In this case, the driver is alerted and asked to decide whether the door unlocking is actually intended or not. It should be noted that although "assisted" GPS can be used to detect positions through the presence of WLAN beacons (periodic synchronization signals), they could also be tunneled.

While providing a plausibility by more harmful signals could ^¬ te additional security, this could be al-lerdings also tunneled from an attacker.

Here, however, a greater technical effort is not ^¬ agile, since, for example must be covered by the necessity of the presence of a high frequency signal for the plausibility check, a larger bandwidth..

A plausibility check could be supported by additional sensors. For example, by temperature or air pressure, a statement about the stay in rooms could be possible.

One step is that an existing procedure be extended by additional steps, so that the security of keyless go systems is increased, without the comfort (Open without active action) or to fundamentally question the system. In addition, the extension of the mechanism to a more automatic ^¬ cal plausibility check of the vehicle opening was conceptually ben described.

The above-described characteristics, features, and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments. Unless this application, the term "may" is used, it is both the technical possible ^¬ ness and the actual technical implementation. Is used as ^¬ away in this application, the term "about", it means that the exact value is disclosed. The figures are not drawn to scale, in particular, the aspect ratios of the elements can be chosen differently.

In the following, embodiments of the invention will be explained with reference to the accompanying drawings. 1 shows messages transmitted between a vehicle and an electronic key according to a first exemplary embodiment,

FIG. 2 shows messages transmitted between a vehicle and an electronic key according to a second exemplary embodiment,

Method steps according to a first method,

Method steps according to a second method,

Method steps for checking the plausibility of location data, and

Figure 6 units in an electronic key. 1 shows messages 10 that are transferred between a vehicle 12 and an electronic key 14 according to a first embodiment, which works very ^¬ more energy-cient. The vehicle 12 is, for example, a car (car passenger car), a motorcycle or a truck. In place of a vehicle, a boat or airplane can be used. Alternatively, another access control or a payment process in the same way can realize the ^¬.

The electronic key 14 is explained in more detail below with reference to FIG. 6 and contains, for example, an electronic ^circuit with a processor or without a processor. The vehicle 12 periodically sends wake-up messages 20 containing short bursts to place the key 14 from a sleep mode to an active mode, see eg, time t2. It is believed that the Keyring ^¬ sel 14 is within a radius R around the vehicle 12 in which it can receive the message 20, for example. In a radius R smaller than 10 meters. The message 20 can be sent, for example, in the LF (low frequency) frequency range.

The key 14 confirms the message 20 in the active mode with a confirmation message 22 (acknowledgment or Ack), see time t4, which is after the time t2.

In addition, the key 14 generates a signal 28 for the driver of the vehicle 12 at a time t6, which will be explained in more detail below with reference to FIGS. 3 and 4, e.g. a sound signal. The signal 28 may alert the driver to misuse of his key, which will be explained in more detail below. Instead of the signal 28, a signal or a message for a device of the driver can be generated, for example for a mobile device or for a clock.

Optionally, it can be checked whether the driver generates an abort signal 29, see eg t8. With the signal 29, the driver prevent abuse, as will be explained in more detail below. The abuse can be prevented, for example, by the fact that, when the signal 29 occurs, the message 22 or a message 26 explained below is not generated. The message 22 may, for example, in UHF (ultra high

frequency) frequency range are sent. The signal 29 may come directly from the driver or from a device of the driver, to which the signal or the message 28 has been sent.

At a time tlo, the vehicle 12 sends a in comparison ^¬ equal to the message 20 longer message 24, for example. A flag date ID (identification) for the vehicle 12 and a so-called Challenge date (challenge) contains. The message 24 can be sent ^¬ rich example. In LF (low frequency) Frequency Ranges.

The key 14 receives the message 24 and generates thereupon ^¬ at a time tl2 a response message 26 containing a response date (response date), the example. Under

Using the previously received challenge date has been calculated. In this way, the key 14 can prove its identity. The key 14 checks before Sen ^¬ the message 26, for example., The ID of the vehicle so that it responds only to messages 24 'his' associated vehicle. The message 26 can be sent, for example, in the UHF (ultra high frequency) frequency range.

The vehicle 12 receives the message 26, checks the correctness of the response date and if necessary opens the door, for example if another person, preferably the driver, touches the door, or releases an engine start button, for example if the key 14 or a propagated from it Sig nal ^¬ already located in the interior of the vehicle 12th

The messages 20 to 26 can be transmitted encrypted using, for example, an electronic encryption method mentioned in the introduction. Are unauthorized access Runaway ^¬ leads to the key 14, the radius R may be also a multiple of the above ge ^¬ called value. Thus, the messages 20, 24 coming from the vehicle 10 can, for example, be forwarded via a cable. Alternatively or additionally, the messages 20, 24 can also be received with an antenna and forwarded with or without amplification to a further remote key 14. Thus, positions PI (vehicle), P2 (key), for example, more than 30 meters or even more than 50

Meter apart, although the signals from the vehicle 12 actually have only the above-mentioned comparatively short range of, for example, less than 10 meters. For the return channel, ie messages 22 and 26 can also be made an unauthorized forwarding. However, the UHF signals can have a greater range than the LF signals ha ^¬ ben, so that an additional forwarding the UHF signals in case of misuse of the key 14 by non-authorized persons is not necessary if necessary.

The signals 28 and the optional signal 29 to the times and TLO are Zwi ^¬ rule tl2. Alternatively, for example, the signal 28 lies between the times t4 and t10 and the optional signal 29 between the times t10 and t12. The radius Rl can be considered for opening and different from a radius for starting.

FIG. 2 shows messages 10b transmitted between a vehicle 12b and an electronic key 14b according to a second exemplary embodiment, in which the car periodically transmits longer messages which already contain a challenging date (challenge date). The above statements also apply:

for a vehicle 12b corresponding to the vehicle 12b, and

for a key 14b corresponding to the key 14. The vehicle 12b periodically transmits messages 30 containing, for example, a license plate tag ID for the vehicle 12b and a so-called challenge date (challenge), for example, see time t20. The message 30 can be sent, for example, in the LF (low frequency) frequency range.

The key 14b receives the message 30, and generated at a time t22, a signal 40, which speaks ent ^¬ the signal 28th The signal 40 can also alert the driver to a misuse of his key, which will be explained in more detail below. Instead of the signal 40, a signal or a message for a device of the driver can be generated, for example for a mobile device or for a clock. Optionally, whether the driver generates a response signal 41 which corresponds to the signal 29, for example, time t24 see ^¬ point can be checked. With the signal 41, the driver can prevent misuse, as will also be explained in more detail below. The abuse can be prevented, for example, by the fact that, when the signal 41 occurs, a message 32 explained below is not generated. The signal 41 may come directly from the driver or from a device of the driver, to which the signal or the message 40 has been sent. At a time t26, the key generates, for example, a reply message 32 that contains a response date that has been calculated, for example, using the challenge date previously received. In this way the Keyring ^¬ sel 14b can prove his identity. The key 14b may also check the ID of the vehicle prior to sending the message 32 so that it responds only to messages 24 of its associated vehicle 12b. The message 32 may, for example, in the UHF

(ultra high frequency) frequency range are sent. The vehicle 12b receives the message 32, checks the ^¬ propriety of response date and opens the door, if necessary, for example,

if another person, preferably the driver, touches the door, or unlocks an engine start button, eg. if the key 14b or a signal originating from it and improperly forwarded, is already in the interior of the vehicle 12. The messages 30 and 32 may be transmitted in encrypted form using, for example, an electronic encryption method mentioned in the introduction.

With regard to the misuse of the key 14b, what has been said with reference to FIG. 1 for the misuse of the key 14 applies. The positions PI and P2 correspond to the positions Plb and P2b in FIG. The radius Rl corresponds to a radius Rlb. The Ra ^¬ dius RLB can apply to the opening and different from a radius for starting.

FIG. 3 shows method ^steps according to a first method. The method begins in a method step 100. In the following, the method steps are also referred to as a step for short. In a step 102 executed after step 100, the message 20 or the challenge message 24 or 30 is transmitted from the vehicle 12, 12b to the key 14, 14b.

After receiving the message 20, 24 and 30 respectively, the key 14, 14b generates the signal 28 or 40 for the driver, see step 104. Thereafter, in a delay step 106, the driver is given time to signal 28 or 40, respectively react, for example, to prevent misuse of the key 14, 14b.

After step 106, a step 110 may immediately follow, in which it is checked whether the driver has generated the signal 29 or 41 in order to interrupt the opening or starting. If this is the case, immediately after step 110, a step 112 is executed, which leads to a lock of the key 14 or 14b. Alternatively, for example, the transmission of response messages based on a response message, on multiple response messages or related to a further period of time prevented. Thus, the method has reached a first end, see step 114.

If it is determined in step 110 that the driver does not signal 29, 41 has generated within a specified period of time, it may be followed by a step 118 to step 110 directly, in which the message is 26 or 32 übertra ^¬ gen. After the step 118, a step 120 may take place, wherein the vehicle 12 or 12b opens the door or an engine start ^¬ button is free. Thus, the method is terminated at a second end, see step 122. The method explained with reference to FIG. 3 can also be used in other exemplary embodiments, as explained above with reference to FIGS. 1 and 2.

Between steps 106 and 110 or between steps 110 and 118, a plausibility check may be performed, e.g. is explained in more detail below with reference to FIG 5 or wherein in addition or alternatively other test variables are used, for example. The sizes mentioned in the introduction ambient temperature and / or ambient pressure.

For the plausibility check 108, it may be stated that if plausibility is present, step 110 immediately follows, i. the driver still has the possibility of generating the signals 29 and 41 to prevent the opening / starting. If, on the other hand, it is determined in the plausibility check 108 that no plausibility is given, step 112 can follow directly. Thus, the key 14, 14b is locked without relying on the driver's response, i. the signal 29 or 41.

For the plausibility check 116, it may be the case that, if the plausibility is present, step 118 immediately follows, ie the next message to the vehicle 12 or 12b becomes transfer. If, on the other hand, it is determined in the plausibility check 116 that no plausibility is given, step 112 can follow directly. Thus, the key 14, 14b is disabled even if the driver has not reacted, ie the signal 29 or 41 has not been sent.

Alternatively, the plausibility check could also be started before step 106 or before step 104. If the plausibility check is also completed before these steps 106 and 104, a method results which corresponds to the method explained below with reference to FIG.

4 shows method steps according to a second drive Ver ^¬, wherein the signal 28, 40 or another signal for the driver is generated only when an implausible fact is detected, the hindeu ^¬ tet an abuse. The method begins in a method step 200. In the following, the method steps are also referred to as a step for a short time. In an executed after the step 200

Step 202, the message 20 or the challenge

Message 24 or 30 transmitted from the vehicle 12, 12b to the key 14, 14b.

After receiving the message 20, 24 and 30 leads the

Key through a plausibility check, which is, for example, in the introduction or explained below. For example. the positions PI (vehicle), P2 (key) and Plb (driving ^¬ imaging) and P2b are thereby (key) is detected, see step 204. If the distance between the positions is too large or there are other variations in the positions, e.g. If one position can be determined and the other position can not be determined, then there is no plausibility. If, for example, both positions PI, P2 or Plb and P2b agree or if they are not too far apart, plausibility is present.

If it is determined in a checking step 206 that there is no plausibility, then immediately after the step 206 performs a step 208 in which, for example, a signal for the driver is generated, see, for example, signals 28 and 40, respectively.

This is followed, in a step 210, by a delay in the range of, for example, 1 to 2 seconds or in the range of 1 to 3 seconds.

Thereafter, in a step 212, it is checked whether the driver has made an input, that is, whether the key 14, 14b has received the signal 29 or 41, for example. If this is the case, then 212 214. follows the step immediately one step in step 214, the key is locked or the opening and / or starting of the vehicle 14, 14b in another way connected under ^¬. The method is thus at a first end, see step 216.

If, on the other hand, it is determined in step 212 that the driver does not receive an abort signal, e.g. 29, 41 has generated in the predetermined time, so after step 212 directly

Follow step 220 corresponding to step 118, i.

Transmitting a message from the key 14, 14b to the vehicle 12, 12b. After step 220, a step 222, corresponding to step 120, follows, for example, the opening or starting of the vehicle. Subsequently, the method is ended in a step 224.

FIG. 5 shows method steps 300 to 310 for checking the plausibility of location data. The checking of the plausibility begins after acquiring all relevant data, for example in method step 300, in short step 300.

In a step 302 following step 300, it is checked, for example, whether GPS coordinates GPS1 or GPS2 could be determined for the two positions PI, P2 or Plb, P2b. Specifically, it is first checked whether the GPS coordinates GPS1 for the

Position PI or Plb are present and the coordinates GPS2 could not be determined for the position P2 or P2b. If this is true, then there is no plausibility and drive is terminated in a step 310. Meets the Bedin ^¬ supply on the other hand does not apply, after the step 302 is a step 304 in step 304 will be concretely checked whether the GPS coordinates GPS1 are not available for the position PI and Plb, and the coordinates for the position P2 or GPS2 . P2b could be detected. If this is true, again there is no plausibility, and the method is ended again in step 310. On the other hand, if the condition does not apply, a step 306 follows after the step 304.

In step 306 it is checked whether the GPS coordinates GPS1 for the position PI or Plb are not present and whether the coordinates GPS2 for the position P2 or P2b could also not be determined. If so, then there is plausibility and the process is completed ^¬ det in a step 308, it is noted in which plausibility. However, does not apply to the Be ^¬ dingung, step 310 follows the step 306, ie it is not detected any plausibility.

Alternatively or additionally, as part of the plausibility check, a distance between the GPS coordinates GPS1 and GPS2 can also be determined. Subsequently, it can be checked whether the calculated distance is less than a predetermined rate from ^¬ stand. If this is the case plausibility is present. On the other hand, if the calculated distance is greater than the specified distance, this can be considered implausible. For example. For example, the same predetermined distances or different predetermined distances can be used for opening and for enabling the starting.

The explained with reference to Figure 5 of the examination Plausibili ^¬ ty (s) may, for example, in Figure 3, in step 108 or 116, or be carried out in Figure 4, steps 204 and 206.

The order of steps 100 to 310 is exemplary and may be changed. There may be additional steps between the mentioned steps. Also, not all the steps shown in a figure 3-5 need to be performed. FIG. 6 shows units in an electronic key 350 which, for example, can be used as keys 14 and 14b. The electronic key 350 includes:

a transmitting unit S for transmitting the message 22, 26 or

32

a receiving unit E for receiving the message 20, 24 or 30,

a processor P, in particular a microcontroller,

an electronic memory M which contains, for example, a volatile-storing part (for example random access memory RAM) and a non-volatile-storing part (for example ROM-read only memory) for storing program instructions and data.

For example, optionally a button or switch 352 or other input device with which the driver can prevent the opening process or the activation of the start button,

For example, a speaker 354 or other output device with which the driver can be made aware of an opening operation or starting, and

a test unit 356 which, for example, contains the processor P and which carries out, for example, the test steps explained above with reference to FIGS. 1 to 5.

The key 350 may also include other units for realizing a remote control function to open the vehicle 12, 12b.

The unit 350 could also be an electronic wallet based, for example, on NFC (near field communication) when paying. The reference to FIGS erläu ^¬ screened method above 1 to 5 may then be carried out to prevent the misuse in payment transactions. In other embodiments, the unit 350 is implemented without processor P, ie, without executing a program to perform the functions of the unit 350. Thus, a state machine can be realized with an integrated circuit, eg with a FPGA (Field Programmable Gate Array).

The unit 450 may have a largest dimension (for example, length) klei ^¬ ner than 15 centimeters, or less than 5 centimeters or less than 3 centimeters.

The unit 350 may be implemented as part of a mobile phone (cell phone, smart phone), which may apply to the opening ^¬ or enabling function or even for the payment function. Also, both or all three mentioned functions can be realized in a mobile phone / smartphone.

The embodiments are not to scale and are not restrictive. Modifications in the context of expert action are possible. Although the invention in detail further illustrated by the preferred embodiment and has been be ^¬ enrolled, the invention is not limited by the disclosed examples and other variations Kgs ^¬ NEN be derived by those skilled thereof, without departing from the scope of the invention. The further developments and configurations mentioned in the introduction can be combined with one another. The embodiments mentioned in the figure description can also be combined with each other. Furthermore, the developments and refinements mentioned in the introduction can be combined with the exemplary embodiments mentioned in the description of the figures.

Claims

claims

1. A method for performing an automatic contactless access transaction or contactless payment transaction,

wherein selectively, depending on the occurrence or absence of an abort signal or an abort message on a mobile device, the process is performed if within ei ^¬ ner predetermined time (t) after the generation of a signal or a message for a person involved in the process no abort signal (29, 41) or no abort message

(29, 41) is generated, and wherein the process is not performed when the person generates the abort signal (29, 41) or the Ab ^¬ break message (29, 41) within the predetermined time (t).

2. The method according to claim 1, wherein the method is used for performing an automatic opening and / or unlocking of the starting possibility of a vehicle (12, 12b), comprising

Receiving a first signal (20, 30) or a first message (20, 30), with which or with which an automatic opening and / or unlocking of a vehicle (12, 12b) is performed, and

depending on the receipt of the first signal (20, 30) or the first message (20, 30), generating a second signal (28, 40) or a second message (28, 40) for the driver of the vehicle (12, 12b).

3. The method of claim 2, comprising

Checking (110, 212) whether within a predetermined time an abort signal (29, 41) or an abort message (29, 41) is received indicating that the opening and / or unlocking is to be aborted, or within no such abort signal (29, 41) or no abort message (29, 41) has been received during the predetermined time, optionally performing the opening and / or unlocking when the abort signal (29, 41) or the abort message (29, 41) has not been received,

or omitting the opening and / or enabling when the abort signal (29, 41) or the abort message (29, 41) has been received.

4. The method of claim 2 or 3, wherein the predetermined time (t) is in the range of one second to 10 seconds, preferably in the range of 1 to 2 seconds or in the range of 1 to 3 seconds,

and / or wherein the first signal (20, 30) or the first After ^¬ directing (20, 30) contains a date at which the receiver (14, 14b) of the first signal (20, 30) or of the first message (20 , 30) is to generate a reply date.

The method of claim 4, wherein the response date is generated as part of a challenge-response method for determining the identity of the receiver (14, 14b) of the first signal (20, 30) or the first message (20, 30).

6. The method according to any one of claims 2 to 5, wherein the second signal (28, 40) is a sound signal and / or a vibration ^¬ signal and / or a light signal,

and / or wherein the second signal (28, 40) or the second

Message (28, 40) is sent to a telephone or to a clock.

7. The method according to any one of claims 2 to 6, wherein a plausibility check (108, 116, 206) is carried out, in which it is checked whether for a vehicle (12, 12b) and a Vor ^¬ direction (14, 14b) for opening and / or starting the vehicle (12, 12b) the same conditions or conditions are met in a same area.

8. The method of claim 7, wherein the plausibility check (206) is performed before a time (t6, t22) to which the second signal (28, 40) or the second message (28, 40) is generated,

and optionally wherein the second signal (28, 40) or the two ^¬ th message (28, 40) depending on the result of the plausibility check (206) is generated when the plausibility check (206) was negative, or wherein at positive Plausibility check (206) the second signal (28, 40) or the second message (28, 40) is not generated.

9. Method according to one of claims 2 to 8, wherein a first ambient data ^item (PI) in or on the vehicle (12, 12b) is determined,

wherein a second environment datum (P2) is determined in a device (14, 14b) for carrying out the method, and wherein the two environmental data (PI, P2) or in the absence of an environmental datum (PI, P2) indicate that fact and the other environmental datum (PI , P2) are used for the plausibility check (302 to 306).

10. The method of claim 9, wherein the first environmental data (PI) is determined in or on the vehicle (12, 12b) at a distance (Rl, Rlb) less than three meters,

and / or wherein the first environmental date is a local date (PI) or a temperature date or an air pressure date.

11. The method of claim 10, wherein a local date (PI, P2) is determined using a satellite system and / or with the aid of a mobile network and / or with the aid of at least one he WLAN ^¬ averages.

12. The method of claim 7, wherein the plausibility check is performed after generating the second signal or the second message.

13. The method according to any one of claims 2 to 12, wherein the plausibility check (116) in the absence of Abbruchsig- nals (29, 41) or the abort message (29, 41) is performed.

14. The method according to any one of claims 2 to 13, wherein the method for opening and / or starting without the detection of signal transit times or message transmission times is performed.

15. Device (14, 14b, 350) for performing an automatic opening and / or unlocking of the starting possibility of a vehicle (12, 12b), comprising,

a receiving unit for receiving a first signal (20, 30) or a first message (20, 30), with which or with which an automatic opening and / or unlocking of a vehicle (12, 12b) is performed, and

a transmitting unit (S) which depends on the receipt of the ers ^¬ th signal (20, 30) or of the first message (20, 30) a second signal (28, 40) or a second message (28, 40) for the driver the vehicle (12, 12b) sends,

characterized by a checking unit (356) which checks whether within a predetermined time (t) an abort signal or an abort message is received indicating that the opening and / or unlocking should be aborted, or within the predetermined time (t) no sol-ches termination signal or termination message are received, no such ^¬ gene has been, and / or

a control unit (P) which selectively performs the opening and / or unlocking when the abort signal or the Ab ^¬ break message has not been received, or the opening nen and / or unlocking omits when the abort signal or the abort message received has been.

16. Device (14, 14b, 350) according to claim 15, wherein the predetermined time (t) is in the range of one second to 10 seconds, preferably in the range of 1 to 2 seconds or in the range of 1 to 3 seconds,

and / or wherein the first signal (20, 30) or the first ^¬ After directing (20, 30) includes a date on which the receiver (14, 14b) of the first signal (20, 30) or the first message (20, 30) is to generate a response date.

17. The device (14, 14b, 350) according to claim 15, wherein the response date in the context of a challenge-response method for determining the identity of the receiver (14, 14b) of the first signal (20, 30) or the first message (20 , 30) is generated.

18. Device (14, 14b, 350) according to any one of claims 15 to 17, wherein the device (14, 14b, 350) further Einhei ^¬ th for carrying out a method according to one of claims 1 to 14 contains.