JP2003512218A - Relay Attack Detection for Secure Communication of Vehicle Commands - Google Patents

Abstract

(57) [Summary] A passive remote entry system evaluates the delay between an interrogation signal from a security system and a response signal from a passive key fob. If the delay exceeds the threshold, identification fails and access is denied. The fob uses the signal from the security system as a reference signal to emit a response signal. The security system generates an interrogation signal that varies in frequency, and this frequency is compared to the frequency of the response signal. The delay in the change in the frequency of the response signal compared to the change in the frequency of the interrogation signal indicates the magnitude of the delay between the interrogation signal and the response signal.

Description

Detailed Description of the Invention

The present invention relates to a vehicle safety protection system, and more particularly to a passive remote entry system having protection against relay attack.

Remote control units such as key fobs for remotely controlling vehicle functions are well known. Presently, many vehicle native devices include wireless transmitters for activating / deactivating vehicle alarms and / or locking or unlocking vehicle doors. In addition, other systems may be used that control the above functions and other functions such as activating a vehicle starter to start the engine.

When a user selects a desired function by pressing the associated button on the transmitter keypad, the transmitter responds by emitting an appropriate signal and / or code. However, this requires the user to access the transmitter and press the relevant button. Passive systems have been developed that automatically activate the vehicle system when the key fob is within a predetermined distance of the vehicle. Typically, these passive systems are two-way communication systems in which the challenge and response are encrypted to prevent actuation by unauthorized persons.

When the relay attack method is used, an unauthorized person can sometimes disable the security protection function by an attack. Such a two-stage relay attack follows the vehicle owner, with the first attacker in the vicinity of the vehicle and the second attacker carrying the passive remote control key fob away from the vehicle. The first attacker triggers a desired function of the vehicle, such as unlocking the vehicle door or operating the engine, and receives an interrogation signal from the vehicle. The first attacker captures this interrogation signal with a scanner type device and sends this interrogation signal to the second attacker. The second attacker receives the interrogation signal from the first attacker and retransmits the interrogation signal to the vehicle owner. A passive remote key fob carried by the vehicle owner receives the vehicle interrogation signal and responds with an appropriate response signal. The response signal is captured by the second attacker and relayed to the attacker of the first signal. The first attacker receives the response signal from the second attacker and retransmits the response signal to the vehicle.
The first attacker then accesses the desired functionality of the vehicle. This type of attack invalidates most of the encryption system, since the proper response signal is obtained from the true owner of the vehicle.

Therefore, it is desirable to provide a passive remote system having protection against such a two stage relay attack.

[0005]

[Outline of the Invention]

The present invention provides a passive remote entry system with protection against relay attacks consisting of the two stages described above. In general, the present invention repels a two stage relay attack by determining the delay between the interrogation signal and the response signal. However, the key fob of the present invention does not just measure the transit time of the signal directly, but utilizes the incoming radio signal from the vehicle as its reference isolation means by which the frequency of the transmitted signal from the key fob is determined. Decided. In general, this vehicle safety protection system changes the frequency transmitted by this system of the vehicle, thereby increasing the amount of delay existing between the frequency change of the interrogation signal and the frequency change of the response signal from the key fob. You can ask for it. The vehicle safety protection system does this by mixing its reference signal with the derivative of the signal received from the key fob and evaluating the frequency difference.

For example, the basic signal of a vehicle safety protection system is preferably a ramp-shaped oscillating signal of increasing frequency. The key fob uses the signal it receives from the vehicle safety protection system as its reference signal, thus increasing the frequency of the signal from the key fob (preferably a much higher frequency signal). The security system then compares the signal received from the key fob with its base signal (ramp oscillator). The amount by which the frequency of the base lamp oscillator differs from the frequency of the signal from the key fob introduces a delay due to the time the signal is sent from the vehicle safety protection system to the key fob and back to the vehicle safety system via the key fob's circuitry. Represent.
If this propagation frequency exceeds a predetermined threshold, the delay is too great and the identification fails and access to the vehicle is denied.

The key fob preferably emits at a frequency that is several orders of magnitude higher than the signal from the vehicle. Therefore, the lamp oscillator signal received from the key fob must be stepped up by several orders of magnitude before it is emitted by the key fob and down by several orders before the vehicle safety protection system makes the comparison. This introduces some small delay, which can be compensated. However, this introduces a much larger delay in the circuit than the attacker.

[0008]

Detailed Description of the Preferred Embodiments

The present invention provides a vehicle passive remote entry system 10, generally indicated at 12 in FIG. The passive remote entry system 10 is mounted on a vehicle 12 and includes a vehicle safety protection system 14 for controlling access to the vehicle 12 and operation of the vehicle in a known manner. Includes actuation of locks and ignition and / or actuation of vehicle engines. The passive remote entry system 10 further includes a user-carryable passive key fob 16 that is portable to the vehicle 12. Similar to known passive remote entry systems, the present invention generally uses interrogation / answer signaling to implement passive remote entry. Generally, the vehicle safety protection system 14 generates a wireless interrogation signal in response to an attempt to move the vehicle or to actuate a vehicle door latch, or to move the vehicle or detect the presence of a vehicle near it. To do. The key fob 16 receives the interrogation signal, and the key fob responds by transmitting a wireless response signal. When vehicle safety protection system 14 receives the proper response signal, identification is successful and access to vehicle 12 is granted. The vehicle safety protection system 14 and the key fob 16 can utilize any of a number of known schemes including encryption or rolling code.

According to the present invention, the vehicle safety protection system 14 evaluates the delay between the outgoing interrogation signal and the received response signal in order to prevent a relay attack.
This is done by using the interrogation signal from the vehicle safety protection system as a reference oscillator for the response signal transmitted from the key fob 16. By varying the frequency of the interrogation signal and comparing the frequency of the interrogation signal with the frequency of the response signal from the key fob 16, the frequency difference represents a delay between the interrogation signal and the response signal.

In the passive remote entry system 10 of the present invention, the vehicle safety protection system 14 preferably emits an encrypted interrogation signal to which the key fob 16 responds by transmitting an encrypted response signal. However, the vehicle safety protection system 14 utilizes a more typical interrogation / answer signaling that evaluates this. When the proper response signal is received, the passive remote entry system 10 evaluates the delay,
The key fob 16 uses the interrogation signal as a reference oscillator and the vehicle safety protection system 14 compares the frequency of the interrogation signal with the frequency of the response signal.

The interrogation signal originating from the vehicle safety protection system is preferably of low frequency, around 1 MHz and preferably around 125 kHz. This reduces the range of the area in the immediate vicinity of the vehicle 12 where the interrogation signal arrives. Key fob 16
Emits a response signal at a frequency that is several orders of magnitude higher than the frequency of the interrogation signal. Preferably the response signal is at a frequency higher than 100 MHz, more preferably 315.
Sent at or near MHz. Therefore, in order for the key fob 16 to use the interrogation signal as a reference oscillator, it first steps up the interrogation signal by several orders of magnitude. Similarly, the frequency of the response signal must be stepped down by several orders of magnitude before the vehicle safety protection system 14 compares the frequency of the response signal with the frequency of its reference oscillator. This introduces a small delay by the circuit of the key fob 16 of the vehicle safety protection system 14, which is several orders of magnitude lower than the delay introduced by the circuit due to the supposed relay aac.

FIG. 2 is a schematic diagram of a typical circuit used in the vehicle safety protection system 14 and the key fob 16 of the present invention. The values shown are for purposes of illustrating the preferred embodiment; the interrogation signal is emitted at 125 KHz and the response signal is emitted at 315 MHz. Of course, other values and other circuits can be utilized. The vehicle security system 14 has a microcontroller 20 that implements a rolling code or an encrypted code and controls the operation of the vehicle security system 14. The encoded interrogation signal is first sent from the microcontroller 20 to the switch 22, converted into an amplitude shift key code based on the reference oscillator 26, and transmitted from the antenna 24. The reference oscillator 26 may be a voltage controlled oscillator. First, this oscillator 26
Operates at 125 kHz.

The 125 kHz signal is received by the key fob 16 at the antenna 30, and the buffer 32
Will be amplified. The encoded signal is then demodulated by the detector 34 and sent to the microcontroller 36, which evaluates the code. The microcontroller 36 is the microcontroller 2 of the vehicle safety protection system 14.
The same encryption or rolling code method as 0 is used, but the proper encoded response signal is transmitted by amplitude shift keying by a switch 38 connected to an oscillator 40 controlled by a crystal 42. Under the control of the microcontroller 36, the switch 43 connects the crystal controlled oscillator 40 with the amplitude shift key switch 38. This high frequency signal from oscillator 40 is stepped down by frequency divider 44 before undergoing amplitude shift keying by switch 38 and then transmitted via antenna 46.

The 315 MHz amplitude shift keying coded response signal transmitted by the antenna 46 of the key fob 16 is received by the receiving antenna 50 of the vehicle safety protection system 14. The 9.509375 GHz crystal 52 controls an oscillator 54 to provide an outgoing signal, which is stepped down by a frequency divider 56 to 304.3M.
Hz signal, which is received by the antenna 15 from the key fob 16 3
Mixed with 15 MHz signal. The result is a 10.7 MHz signal 58, which is buffered by buffer 60 and then evaluated by microcontroller 20. If the proper encoded response signal is received by the microcontroller 20, the microcontroller 20 evaluates the delay at the next interrogation and response signal. This may use encryption or rolling code.

Microcontroller 20 then controls voltage controlled oscillator 26 to provide a ramp signal, preferably centered at 120 kHz. This signal is antenna 2
4 and is received by the antenna 30 of the key fob 16. Microcontroller 36 controls switch 43 to use the signal received by antenna 30 as the reference oscillator (rather than oscillator 40 of crystal 42). This low frequency signal centered at 125 kHz is stepped up by frequency multiplier 70, then stepped down by frequency divider 44, modulated by frequency shift keying by switch 38, and by switch 38 and microcontroller 36. The signal is modulated by amplitude shift keying and transmitted from the antenna 46.
The oscillation signal from the voltage controlled oscillator 26 is supplied to the switch 2 of the microcontroller 20.
After being modulated by the amplitude shift keying by 2, the signal is transmitted from the antenna 24. Since the key fob 16 uses the interrogation signal received (centered at 125 kHz) as its reference oscillator, the response signal (215 MH) from the key fob 16 is used.
centered around z) changes accordingly. This response signal is received by the antenna 50 of the vehicle safety protection system 14 and mixed into 125 kHz. This signal is then mixed by mixer 76 with the signal from voltage controlled oscillator 26. The resulting signal is the error frequency signal 78, whose frequency is the voltage controlled oscillator 2
Equal to the frequency of 6 and the stepped down frequency of the response signal from the key fob 16. This error frequency signal 78 is evaluated by the microcontroller 20 and / or another hardwired circuit. If the frequency of the error frequency signal 78 exceeds a predetermined threshold, it is determined that the delay between the interrogation signal and the response signal is too large, the identification fails, and access to the vehicle 12 is denied. It

For example, if the delay of the circuit of the vehicle safety protection system 14 and the key fob 16 is zero and the delay between these two circuits is zero, the stepped down frequency of the response signal is the frequency of the voltage controlled oscillator 26. And the error frequency is 0 (or DC). However, since the frequency of the voltage controlled oscillator 26 increases,
The delay between the interrogation signal and the response signal causes the frequency of the voltage controlled oscillator 26 to be higher than the frequency of the stepped down response signal of the mixer 78, resulting in a higher error frequency 78.

FIG. 3 is a graph showing this. As can be seen in FIG. 3, the frequency of the interrogation signal increases over time (preferably linear, but that is not a requirement). The slope of the response signal from the key fob 16 (shown stepped down to the 125 kHz range) is shifted to the right by a delay as shown by Δt, but is the same as the slope of the interrogation signal. However, the present invention directly represents the delay where the error frequency is Δt. A proper response signal Δt from the key fob 16
Is expected to be on the order of 100 nanoseconds. Δt of signal due to relay attack
Are on the order of a few microseconds, so that the error frequency between them is significantly higher, depending on the slope of the interrogation signal.

The exemplary configurations shown and described are believed to represent the preferred embodiment of the present invention. However, the present invention may be practiced differently than the specific embodiments illustrated and described without departing from the spirit or scope thereof. Alphabetic designations of method steps recited in the claims are for reference in the dependent claims and do not indicate the required order of execution of the method steps.

[Brief description of drawings]

FIG. 1 is a high level schematic diagram of a passive remote entry system of the present invention implemented in a vehicle.

FIG. 2 is a more detailed diagram of implementing the passive remote entry system of the present invention.

FIG. 3 is a graph showing an interrogation signal and a response signal of the passive remote entry system.

[Procedure for Amendment] Submission for translation of Article 34 Amendment of Patent Cooperation Treaty

[Submission date] December 27, 2001 (2001.12.27)

[Procedure Amendment 1]

[Document name to be amended] Statement

[Name of item to be amended] Claims

[Correction method] Change

[Contents of correction]

[Claims]

─────────────────────────────────────────────────── ─── Continued front page    F term (reference) 2E250 AA21 BB01 BB08 CC20 DD06                       FF27 FF36 HH01 JJ03 JJ05                       KK03 LL01 TT03

Claims (17)

[Claims] 1. A method for wireless remote identification, comprising:   a) Send a wireless interrogation signal,   b) receiving the interrogation signal,   c) emit a wireless response signal in response to step b),   d) receiving the response signal,   e) A method comprising the step of evaluating the delay between steps a) and d). 2. The method of claim 1, further comprising f) rejecting the identification based on step e). 3. The radio frequency interrogation signal is transmitted at the interrogation frequency in f) a), and the interrogation frequency of the interrogation signal is set so that the response frequency corresponds to the interrogation frequency. 2. The method of claim 1, further comprising the step of: h) emitting a radio response signal at step c) as a reference frequency for the response frequency. 4. The method of claim 3, wherein the response frequency is a multiple of the interrogation frequency. 5. The method of claim 4, further comprising varying the interrogation frequency and the response frequency over time. 6. The method of claim 5, further comprising increasing the interrogation frequency and the response frequency over time. 7. The method of claim 6, further comprising the step of evaluating the difference between the interrogation frequency and the response frequency to determine the delay. 8. The method of claim 7, wherein the interrogation frequency is a low frequency. 9. The method of claim 8, wherein the interrogation frequency is a frequency below 1 MHz. 10. The method of claim 8, wherein the response frequency is at least 1000 times the interrogation frequency. 11. A method for wireless remote identification, comprising: a) transmitting a wireless interrogation signal at an interrogation frequency; and b) changing the interrogation frequency of the interrogation signal during step a), c. ) Receiving an interrogation signal, d) determining a response frequency based on the interrogation frequency by using the interrogation frequency as a reference, and e) transmitting a wireless response signal at the response frequency in response to step b). Method. 12. The method of claim 11, wherein the response frequency is a multiple of the interrogation frequency. 13. The method of claim 11, further comprising the step of: i) varying the interrogation frequency and response frequency over time. 14. The method of claim 13, further comprising increasing the interrogation frequency and the response frequency over time. 15. The method of claim 14, further comprising the step of evaluating the difference between the interrogation frequency and the response frequency to determine the delay. 16. The method of claim 15, further comprising rejecting the identification if the delay exceeds a threshold. 17. A security system comprising: a first transmitter and a first receiver for transmitting an interrogation signal at an interrogation frequency; and a first on the fob, the port being portable to the security system. 2 transmitters and 2nd
The second transmitter transmits a response signal in response to the interrogation signal,
The second transmitter is a safety protection system that uses the interrogation signal as a reference oscillator and transmits a response signal at a response frequency corresponding to the interrogation frequency.