Classifications

• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B60—VEHICLES IN GENERAL
  • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
  • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
  • B60R25/20—Means to switch the anti-theft system on or off
  • B60R25/24—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
  • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
  • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
  • G07C2009/00317—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks keyless data carrier having only one limited data transmission range
  • G07C2009/00333—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks keyless data carrier having only one limited data transmission range and the lock having more than one limited data transmission ranges
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C2209/00—Indexing scheme relating to groups G07C9/00 - G07C9/38
  • G07C2209/60—Indexing scheme relating to groups G07C9/00174 - G07C9/00944
  • G07C2209/63—Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle

Definitions

• the present invention relates to the control of the functionality of a vehicle subject to the presence of an identifier near the vehicle.
• It relates more particularly to a method and a control system of a vehicle functionality.
• the invention applies particularly advantageously in the case where it is desired to quickly have a reliable and accurate measurement of the distance separating the identifier of the vehicle, while countering the relay attacks.
• Passive Entry systems are known in which the implementation of a feature (such as unlocking the doors of a vehicle or starting such a vehicle) is conditioned by the presence near the vehicle of an identifier (usually worn by the user of the vehicle).
• the document EP 2 800 068 describes such a system in which the distance separating the vehicle and the identifier is estimated as a function of a propagation time of electromagnetic signals exchanged between the identifier and the vehicle.
• the present invention proposes a method of controlling a functionality of a vehicle equipped with a first communication module, comprising the following steps:
• This solution makes it possible to quickly obtain an estimate of the distance between the vehicle and the protected identifier against relay attacks, and thus to securely control the functionality without perceptible delay compared to the user's command.
• said estimation is triggered as soon as a wireless link is established between the first communication module and the second communication module;
• the method comprises a step of transmitting an authentication datum of the second communication module to the first communication module;
• said authentication datum is determined according to a challenge previously transmitted from the first communication module to the second communication module;
• the method comprises steps of measurement, at the level of the identifier, of a power of a signal generated by a low-frequency emission module of the vehicle and of transmission of the second communication module to the first communication module; information determined as a function of the measured power (this information being for example another estimate of said distance, but which may alternatively be an information representative of the measured power, on the basis of which an electronic unit of the vehicle can determine this other estimating said distance);
• said information is transmitted with the authentication data
• the signal transmitted in order to initiate the establishment of the wireless link is produced by the low-frequency transmission module
• the estimated distance verifies the predefined condition if the estimated distance is less than a predetermined threshold
• said detection is carried out by a sensor associated with a door of the vehicle;
• said functionality is the unlocking of the vehicle doors; said detection is carried out by actuation of a button;
• said functionality is the starting of a vehicle engine
• the estimation step comprises a substep of measuring said reception phases by the first communication module or by the second communication module and a sub-step of determining the estimated distance as a function of the measured reception phases.
• the invention also proposes a system for controlling a functionality of a vehicle equipped with a first communication module, comprising:
• a module designed for detecting a command from the user transmitting a signal to an identifier equipped with a second communication module so as to initiate an exchange of electromagnetic signals between the first communication module and the second communication module, said electromagnetic signals comprising at least two electromagnetic signals having distinct frequencies;
• a module designed to estimate a distance separating the vehicle and the identifier as a function of respective reception phases of said at least two electromagnetic signals
• a module designed to control the functionality if the estimated distance verifies a predefined condition.
• FIG. 1 schematically shows the main elements of a system in which the invention can be implemented.
• FIG. 2 is a logic diagram showing an exemplary method of controlling a functionality according to the invention.
• Figure 1 shows schematically the main elements of a system in which the invention can be implemented.
• Such a system comprises a vehicle 10 (for example a vehicle automobile) and an identifier 20 (for example a vehicle access key or badge 10, or, alternatively, a user terminal, such as a mobile telephone, provided with rights of access to the vehicle 10).
• a vehicle 10 for example a vehicle automobile
• an identifier 20 for example a vehicle access key or badge 10
• a user terminal such as a mobile telephone
• the vehicle 10 comprises several electronic control units each dedicated to the management of certain functionalities of the vehicle.
• the vehicle 10 comprises an access and start management unit 11 and an exchange management unit 12.
• the vehicle 10 also comprises a communication module 13 designed to establish a wireless link with other electronic devices, here a "Bluetooth Low Energy” (or “BLE”) type link.
• the communication module 13 is connected for this purpose. to a first antenna 135 (made for example in the form of a conductive track) designed to transmit and receive high-frequency electromagnetic signals (typically with a frequency greater than 1 MHz or even 500 MHz), here in the band at 2.4 GHz.
• the exchange management unit 12 and the communication module 13 are separate circuits or modules. Alternatively, these two elements could be physically integrated in the same module.
• the vehicle 10 furthermore comprises a low-frequency transmission module 14 designed to emit, by means of a second antenna 145 (made for example in the form of a wound ferrite), a low-frequency electromagnetic signal S (typically below 150 kHz).
• a second antenna 145 made for example in the form of a wound ferrite
• S typically below 150 kHz
• the vehicle 10 further comprises actuators for implementing some of the aforementioned functionalities, and in particular an unlocking actuator 1 6 designed to unlock the vehicle doors (on order of one of the electronic control units) and a starter actuator 18 designed to start the vehicle engine 10 (again, on command of one of the electronic control units).
• an unlocking actuator 1 6 designed to unlock the vehicle doors (on order of one of the electronic control units)
• a starter actuator 18 designed to start the vehicle engine 10 (again, on command of one of the electronic control units).
• the access and start management unit 11, the exchange management unit 12, the low frequency transmission module 14, the unlocking actuator 16 and the The starting actuator 18 are each connected to a data network 15 internal to the vehicle 10 and can thus exchange data with each other as described below.
• the vehicle 10 finally comprises a sensor 1 10 (for example a capacitive sensor) located at a door handle of the vehicle 10 and a button of 15.
• a sensor 1 10 for example a capacitive sensor located at a door handle of the vehicle 10 and a button of 15.
• the sensor 1 10 detects the presence of a person, it transmits a corresponding detection information DT to the management unit access and start 1 1.
• the start button 1 15 is actuated by a user, a corresponding start information DM is received by the access and start management unit 11.
• the identifier 20 comprises a control unit 21, a communication module 23, to which is connected an antenna 235, and a measurement circuit 26.
• the measurement circuit 26 is directly connected to the control unit 21; the control unit and the communication module 23 are connected by a wire link 25, for example a serial link such as a SPI type link (for "Serial Peripheral Interface").
• the communication module 23 is designed to establish a wireless link (here of "Bluetooth Low Energy” or “BLE”) type with other electronic devices, in particular with the exchange management unit 12 of the vehicle 10 via the communication module 13 mentioned above.
• a wireless link here of "Bluetooth Low Energy” or “BLE”
• the measurement circuit 26 is itself designed to measure the power, at the level of the identifier 20, of the electromagnetic signal S emitted by the antenna 145 connected to the low-frequency transmission module 14 (in accordance with a technique called RSSI for "Received Signal Strength Indication") and for communicating information indicative of the measured power to the control unit 21.
• the control unit 21 can deduce from this information an estimate of the distance separating the vehicle 10 and the identifier 20.
• the user approaches the vehicle 10 provided with the identifier 20 and comes to touch the door handle mentioned above.
• the method thus begins at step E2 when the sensor 1 10 detects the presence of a person and thus transmits a corresponding detection information DT to the access management unit and start 1 1.
• the start button transmits DM start information to the access management and start-up unit 1 1.
• the access and start management unit 11 receives the detection information DT (or, alternatively, the start-up information DM) at the step E4 and consequently sends a wake-up command to the module d. low-frequency transmission 14 (step E6) and a wake-up command to the unlocking actuator 16, or, in the aforementioned variant, the starting actuator 18 (step E10).
• the aforementioned wakeup commands are transmitted from one element to another on the internal data network 15.
• the wake up command is for example sent to the low-frequency transmission module 14 after a duration Ti (with Ti less than 20 ms, and preferably T1 less than 15 ms) with respect to the first detection of the user. by the sensor 1 10.
• the low frequency transmission module 14 and the unlocking actuator 166 (or, if applicable, the starter actuator 18) then switch each of their standby mode to their normal operating mode (respectively to the steps E8 and E12).
• the low-frequency transmission module 14 Upon awakening, the low-frequency transmission module 14 generates (via the antenna 145) a low-frequency electromagnetic signal (step E14), for example modulated successively by a synchronization pattern and by a wake-up code.
• the control unit 21 of the identifier 20 is in turn awakened (step E1 6) by this signal, transmitted via the measurement circuit 26.
• the control unit 21 sends in step E18 an activation command to the communication module 23.
• the transmission of the activation command to the communication module 23 occurs after a duration T 2 (with T 2 less than 20 ms, preferably less than 14 ms) with respect to the reception of the wake up command by the low-frequency emission module 14.
• the communication module 23 of the identifier 20 enters a phase of establishment of a wireless link with the communication module 13 of the vehicle 10 (this phase of establishing the wireless link being represented by steps E21 and E22 respectively at the level of the communication module 23 and at the level of the communication module 13).
• this phase of establishing the wireless link being represented by steps E21 and E22 respectively at the level of the communication module 23 and at the level of the communication module 13).
• the communication module 23 of the identifier 20 will transmit advertisement frames (or "advertising packets" according to the English terminology) and that the communication module 13 of the vehicle 10 will be placed in position.
• scanning mode or “scanning” according to the English terminology
• the exchange management unit 12 informed by the access management unit and startup 1 1 that an alarm clock of the identifier 20 was started at step E6, and thus responds to an announcement frame to establish the wireless link.
• the announcement frames could be transmitted by the communication module 13 of the vehicle 10 and the communication module 23 of the identifier could be placed in scanning mode in step E21, which would also make it possible to establish the aforementioned wireless link.
• the establishment phase of the wireless link has a duration T 3 (with T 3 less than 10 ms, preferably less than 5 ms).
• the communication module 13 of the vehicle 10 which participates in the establishment of the wireless link L as just indicated (step E22), informs the exchange management unit 12 of the establishment of the link without wire L (establishment information received in step E23 by the exchange management unit).
• these communication modules 13, 23 trigger a process for estimating the distance separating the vehicle 10 and the identifier 20 as a function of the propagation time of electromagnetic signals involved in the established wireless link L (the triggering of this process is indicated in steps E24 and E26 respectively for the communication module 23 and for the communication module 13). It can be provided for this purpose that the communication modules 13, 23 are programmed to automatically trigger such an estimation process as soon as the link is established. As a variant, the estimation process can be triggered respectively by the exchange management unit 12 and by the control unit 21.
• the process of estimating the distance separating the vehicle 10 and the identifier 20 comprises here:
• d ⁇ [ ⁇ 2 - ⁇ - ⁇ ] / [2 ⁇ . ( ⁇ 2 - f- ⁇ )], where c is the celerity of light.
• the estimation process just described could be implemented without prior establishment of a wireless link between the communication modules 13, 23 (that is to say by the simple exchange of electromagnetic signals at distinct frequencies f- ⁇ ,) -
• the control unit 21 controls, as from the aforementioned step E18, the transmission by the communication module 23 of the electromagnetic signals. at distinct frequencies f- ⁇ , (corresponding to step E24 mentioned above), the exchange management unit 12 having, for example, placed the communication module 23 waiting for such signals (to measure their reception phases respective ⁇ - ⁇ , ⁇ 2 ) after being informed by the management unit access and start 1 1 that an alarm of the identifier 20 was started in step E6.
• the low-frequency transmission module 14 emits a low-frequency electromagnetic signal S (step E27) whose power is measured by the measurement circuit 26 so that the The control unit 21 determines, as a function of the measured power, a first estimate d1 of the distance separating the vehicle 10 and the identifier 20 (step E28), according to the technique already mentioned known as RSSI.
• the exchange management unit 12 After having received the wireless link establishment information (step E23), the exchange management unit 12 prepares in step E30 a challenge CHL (or "challenge” according to the name of Anglo-Saxon origin commonly used), for example by random draw, and controls the issuance of this challenge by the communication module 13, via the established wireless link L and therefore to the identifier 20 (step E32).
• a challenge CHL or "challenge” according to the name of Anglo-Saxon origin commonly used
• the CHL challenge is for example sent by the communication module 13 within a frame which also contains a MAC message authentication code.
• a MAC message authentication code is obtained by application to the CHL challenge of a cryptographic algorithm using a cryptographic key (secret key) associated with the vehicle 10.
• the communication module 23 of the identifier 20 receives this frame in step E34 and can thus transmit it (with the CHL challenge and the MAC message authentication code) to the control unit 21 in step E36 .
• the management unit of access and start 1 1 checks the continuous presence of a person at the sensor 1 10 (which allows for example to ensure that the initial detection of step E2 was not fortuitous): the new DT 'detection of a person at the sensor 1 10 is transmitted to the access management unit and startup 1 1 in step E38 and the access management unit and startup 1 1 can therefore confirm to the unlocking actuator 1 6 that an unlock is imminent.
• the unlocking actuator 166 receives this confirmation in step E42, but remains waiting for an authentication confirmation (as described further in step E60) before unlocking the vehicle doors 10.
• control unit 21 of the identifier 20 receives the CHL challenge and the MAC message authentication code in step E36.
• the control unit 21 After checking the MAC message authentication code (which ensures that the CHL challenge has been generated by the vehicle 10 and not by an attacker who seeks to know, for all possible challenges, the answers of the identifying these challenges), the control unit 21 determines in step E44 a REP response to the CHL challenge, for example by applying to the CHL challenge a cryptographic algorithm (such as an encryption algorithm) using a memorized secret key in the identifier 20.
• a cryptographic algorithm such as an encryption algorithm
• the control unit 21 controls (step E46) to the communication module 23 the transmission of the response REP and the first estimate di via the established wireless link L. (Of course, if the message authentication code MAC was not verified, none of this expected information would be issued by ID 20.)
• the communication module 23 of the identifier 20 thus sends a frame containing the response REP and the first estimate d-i, to the communication module 13 of the vehicle 10.
• the communication module 13 of the vehicle 10 receives this frame in step E50, and transmits it to the exchange management unit 12 which can thus store the response REP and the first estimate di received (step E52).
• This second estimate d 2 is thus received and stored by the module of exchange management 12 at step E56.
• the exchange management module 12 can then check in step E58 whether various conditions are fulfilled, namely whether:
• the response REP received from the identifier corresponds to the expected response (this verification can be done for example by comparing the response received REP to the result of the application of the cryptographic algorithm using the aforementioned secret key, also stored within the trade management unit 12, the challenge determined in step E30); and
• the first estimate di is less than a first predefined threshold (being generally less than 5 m and being for example 1 m);
• the second estimate d 2 is less than a second predefined threshold (generally less than 5 m), possibly identical to the first predefined threshold.
• the first estimate d- ⁇ is generally quite accurate and reliable, but it can be the subject of a relay attack.
• the second estimate d 2 because it is determined on the basis of the travel time of the electromagnetic wave, can not be faked by a conventional relay attack. Thus, checking the condition relating to the second estimate d 2 makes it possible to ensure that the vehicle 10 is not subject to a relay attack.
• the exchange management unit 12 issues an authentication confirmation CONF to the unlocking actuator 166 (or, in the case of the variant mentioned above, to the starter actuator 18). (If a condition was not verified - which is not the case during the normal operation shown in Figure 2, the process would end immediately, without unlocking the doors of the vehicle 10.)
• the data used for the verification of the various conditions could be transmitted from the exchange management unit 12 to the 1 1 access control and startup management unit and the verification of the various conditions could then be performed by the access management unit and startup 1 1 (which would then transmit, in case of verification of all conditions, CONF confirmation confirmation to the unlocking actuator 16 or, if applicable, the starting actuator).
• the unlocking actuator 166 receives the authentication confirmation CONF in step E60 and can thus perform in step E62 the unlocking of the doors of the vehicle 10.
• it is the boot actuator 18 which receives the authentication confirmation CONF and then starts the starting of the vehicle engine 10.
• the storage of the second estimate d 2 , the verification of the aforementioned conditions and the communication of the authentication confirmation requires a duration T 5 (with T 5 less than 5 ms, preferably less than 4 ms).
• the total duration ( ⁇ + T 2 + T 3 + T 4 + T 5 ) separating the first detection of the user by the sensor 1 10 and the unlocking of the doors is less than 105 ms (and preferably less than 78 ms).
• T 2 less than 20 ms (preferably less than 14 ms);
• T 3 less than 10 ms (preferably less than 5 ms), as already proposed above;
• T less than 100 ms (preferably less than 60 ms);
• T 5 less than 30 ms (preferably less than 21 ms).
• the total duration ( ⁇ + T 2 + T 3 + T 4 + T 5 ) separating the detection of the depression of the button 1 15 and the start of the start by the starting actuator 18 is less than 260 ms. (and preferably less than 160 ms).

Landscapes

• Engineering & Computer Science (AREA)
• Mechanical Engineering (AREA)
• Computer Networks & Wireless Communication (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Lock And Its Accessories (AREA)
• Control Of Vehicle Engines Or Engines For Specific Uses (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=54979796

Family Applications (1)

Country Status (2)

Families Citing this family (2)

Family Cites Families (7)

• 2016
  • 2016-12-08 EP EP16809372.2A patent/EP3397526A1/de not_active Withdrawn
  • 2016-12-08 WO PCT/EP2016/080345 patent/WO2017068202A1/fr active Application Filing

Also Published As

Similar Documents

Legal Events