JP2021105249A - Portable device, on-vehicle device, and remote keyless entry system - Google Patents

Abstract

To improve the safety of a remote keyless system.SOLUTION: A portable device according to an embodiment includes: a portable device receiver equipped with a 3-axis antenna and receiving a request signal including a measurement signal from an on-vehicle device; a portable device transmitter transmitting an answer signal to the on-vehicle device; and a portable device control unit controlling the portable device receiver and the portable device transmitter. The portable device control unit includes a received signal strength calculation unit that calculates the received signal strength of each axis of the signal for measurement, and a relay attack determination unit that determines whether a relay attack has taken place based on the ratio of the received signal strength of each axis of the signal for measurement.SELECTED DRAWING: Figure 5

Description

The present invention relates to a portable device, an on-board unit, and a remote keyless entry system.

Conventionally, as a system for wirelessly controlling the unlocking and locking of a vehicle, a remote keyless entry system (hereinafter referred to as "RKE system") including an on-board unit installed in the vehicle and a portable device owned by a user has been used. It's being used. In the RKE system, the on-board unit periodically transmits a request signal wirelessly, the user's portable device approaching the vehicle returns an answer signal in response to the request signal, and the on-board unit returns the answer signal based on the answer signal. Is certified, and the unlocking and locking of the vehicle is controlled according to the certification result.

A relay attack is known as a method of stealing a vehicle using the RKE system. The relay attack is a method of illegally unlocking a vehicle by causing the portable device to transmit an answer signal by relaying a request signal to a user's portable device away from the vehicle by a repeater. As a countermeasure against this relay attack, the transmission signal strength of the request signal is changed in a predetermined pattern, and the pattern of the transmission signal strength is compared with the pattern of the reception signal strength of the request signal received by the portable device. A method for detecting a relay attack has been proposed.

Japanese Unexamined Patent Publication No. 2010-185186

However, the above-mentioned conventional measures have a problem that a relay attack cannot be detected when the pattern of the transmission signal strength is imitated by the repeater.

The present invention has been made in view of the above problems, and an object of the present invention is to improve the safety of the RKE system.

The portable device according to the embodiment includes a portable device receiver that includes a 3-axis antenna and receives a request signal including a measurement signal from the vehicle-mounted device, a portable device transmitter that transmits an answer signal to the vehicle-mounted device, and the above. The portable device control unit includes a portable device receiving unit and a portable device control unit that controls the portable device transmitting unit, and the portable device control unit includes a received signal strength calculation unit that calculates a received signal strength for each axis of the measurement signal. A relay attack determination unit for determining whether or not a relay attack has been performed is provided based on the ratio of the received signal strength for each of the axes of the measurement signal.

According to each embodiment of the present invention, the safety of the RKE system can be improved.

The figure which shows an example of the RKE system. The figure which shows an example of an answer signal and a request signal. The figure explaining the outline of the operation of the RKE system. The figure explaining the relay attack. The figure which shows an example of the functional structure of the portable device control part. The figure which shows an example of the received signal strength I of the measurement signal. The figure which shows an example of the ratio r of the received signal strength Ix, Iy, Iz of a measurement signal. The figure which shows an example of the ratio r of the received signal strength Ix, Iy, Iz of a measurement signal. The figure which shows an example of the functional composition of the vehicle-mounted device control unit. The flowchart which shows an example of the transmission processing of a request signal by an in-vehicle device. The flowchart which shows an example of the reception processing of the answer signal by an in-vehicle device. The flowchart which shows an example of the reception processing of a request signal by a portable device. The flowchart which shows an example of the transmission processing of the answer signal by a portable device.

Hereinafter, each embodiment of the present invention will be described with reference to the accompanying drawings. Regarding the description of the specification and the drawings according to each embodiment, the components having substantially the same functional configuration are designated by the same reference numerals, and the superimposed description will be omitted.

The RKE system 100 according to the embodiment will be described with reference to FIGS. 1 to 13. The RKE system 100 according to the present embodiment is a system for locking and unlocking a vehicle by a wireless signal.

First, the hardware configuration of the RKE system 100 will be described. FIG. 1 is a diagram showing an example of the RKE system 100. The RKE system 100 of FIG. 1 includes a portable device 1 and an in-vehicle device 2.

The portable device 1 is a device possessed by the user U of the RKE system 100, such as a vehicle driver. The portable device 1 of FIG. 1 includes a portable device receiving unit 11, a portable device transmitting unit 12, a portable device control unit 13, and a battery 14.

The portable device receiving unit 11 is hardware that receives the request signal R wirelessly transmitted by the vehicle-mounted device 2. The request signal R is, for example, a 125 kHz LF (Low Frequency) signal, but is not limited thereto. Further, the communicable distance of the request signal R is, for example, 1 m or less, but is not limited to this. The portable device receiving unit 11 includes a 3-axis antenna that converts a request signal R (radio signal) into an electric signal, and a receiving circuit that performs predetermined signal processing such as demodulation on the request signal R (electric signal). Hereinafter, each axis of the 3-axis antenna will be referred to as an X-axis, a Y-axis, and a Z-axis, respectively. The receiving circuit includes a low noise amplifier, a filter, a mixer, a demodulation circuit, and the like. The portable device receiving unit 11 inputs the request signal R that has undergone predetermined signal processing to the portable device control unit 13. The receiving circuit may be an independent IC (Integrated Circuit) or may be incorporated in the portable device control unit 13.

The portable device transmission unit 12 is hardware that wirelessly transmits the answer signal A. The answer signal A is, for example, a 315 MHz UHF (Ultra High Frequency) signal, but is not limited thereto. Further, the communicable distance of the answer signal A is, for example, 20 m or less, but is not limited to this. The portable device transmission unit 12 includes a transmission circuit that performs predetermined processing such as modulation on the answer signal A (electric signal) generated by the portable device control unit 13, and an antenna that converts the answer signal A (electric signal) into a wireless signal. , Equipped with. The transmission circuit includes a modulation circuit, a mixer, a filter, a power amplifier, and the like. The transmission circuit may be an independent IC or may be incorporated in the portable device control unit 13. Further, the receiving circuit of the portable device receiving unit 11 and the transmitting circuit of the portable device transmitting unit 12 may be incorporated in one IC.

The portable device control unit 13 is hardware that controls the overall operation of the portable device 1 including the portable device receiving unit 11 and the portable device transmitting unit 12, and is a CPU (Central Processing Unit), a ROM (Read Only Memory), and a ROM (Read Only Memory). Includes RAM (Random Access Memory). The CPU controls each configuration of the portable device 1 by executing a program, and realizes the function of the portable device 1. The program executed by the CPU can be recorded on any computer-readable recording medium such as a CD (Compact Disk), a DVD, or a flash memory. The ROM stores programs executed by the CPU and various types of data. The ROM contains the portable device ID which is the identification information of the portable device 1, the vehicle-mounted device ID which is the identification information of the vehicle-mounted device 2 corresponding to the portable device 1, and the transmission signal strength of the measurement signal Rr included in the request signal R. The pattern and the distance table showing the correspondence between the received signal strength I of the measurement signal Rr and the distance L are stored in advance. The measurement signal Rr and the distance L will be described later. The RAM provides the CPU with a work area. The portable device control unit 13 is, for example, a microcomputer, but the present invention is not limited to this.

The battery 14 supplies electric power to the portable device receiving unit 11, the portable device transmitting unit 12, and the portable device control unit 13.

The configuration of the portable device 1 is not limited to the example of FIG. For example, the portable device 1 may include an unlock button and a lock button for the user U to manually operate the unlocking and locking of the vehicle.

The vehicle-mounted device 2 is a device that controls locking and unlocking of the vehicle in response to the answer signal A received from the portable device 1, and is mounted on the vehicle. The vehicle-mounted device 2 is supplied with electric power from a battery mounted on the vehicle. The on-board unit 2 of FIG. 1 includes an on-board unit receiving unit 21, an on-board unit transmitting unit 22, and an on-board unit control unit 23.

The on-board unit receiving unit 21 is hardware that receives the answer signal A wirelessly transmitted by the portable device 1. The in-vehicle device receiving unit 21 includes an antenna that converts an answer signal A (radio signal) into an electric signal, and a receiving circuit that performs predetermined signal processing such as demodulation on the answer signal A (electric signal). The receiving circuit includes a low noise amplifier, a filter, a mixer, a demodulation circuit, and the like. The vehicle-mounted device receiving unit 21 inputs the answer signal A that has undergone predetermined signal processing to the vehicle-mounted device control unit 23. The receiving circuit may be an independent IC or may be incorporated in the on-board unit control unit 23.

The on-board unit transmission unit 22 is hardware that wirelessly transmits the request signal R. The in-vehicle device transmission unit 22 includes a transmission circuit that performs predetermined processing such as modulation on the request signal R (electric signal) generated by the in-vehicle device control unit 23, and a plurality of transmission circuits that convert the request signal R (electric signal) into a wireless signal. It is equipped with an antenna Ant. The transmission circuit includes a modulation circuit, a mixer, a filter, a power amplifier, and the like. The plurality of antennas are connected to the transmission circuit via the antenna wire, and are installed at different positions of the vehicle. The transmission circuit may be an independent IC or may be incorporated in the on-board unit control unit 23. Further, the receiving circuit of the on-board unit receiving unit 21 and the transmitting circuit of the on-board unit transmitting unit 22 may be incorporated in one IC.

The on-board unit control unit 23 is a circuit that controls the overall operation of the on-board unit 2 including the on-board unit receiving unit 21 and the on-board unit transmitting unit 22, and includes a CPU, ROM, RAM, and a communication interface. The CPU controls each configuration of the vehicle-mounted device 2 by executing a program, and realizes the function of the vehicle-mounted device 2. The program executed by the CPU can be recorded on any computer-readable recording medium such as a CD, DVD, or flash memory. The ROM stores programs executed by the CPU and various types of data. In the ROM, the vehicle-mounted device ID, which is the identification information of the vehicle-mounted device 2, and the portable device ID, which is the identification information of the portable device 1 corresponding to the vehicle-mounted device 2, are stored in advance. The RAM provides the CPU with a work area. The communication interface connects the vehicle-mounted device control unit 23 to a vehicle-mounted network such as a CAN (Controller Area Network). The vehicle-mounted device control unit 23 communicates with the door control unit 3 connected to the vehicle-mounted network via the communication interface, and requests the door control unit 3 to unlock or lock the vehicle. The on-board unit control unit 23 is, for example, a microcomputer, but the present invention is not limited to this.

The configuration of the on-board unit 2 is not limited to the example of FIG. For example, the vehicle-mounted device 2 may include a battery that supplies power to the vehicle-mounted device receiving unit 21, the vehicle-mounted device transmitting unit 22, and the vehicle-mounted device control unit 23.

Next, the answer signal A and the request signal R will be described. FIG. 2 is a diagram showing an example of an answer signal A and a request signal R.

The answer signal A includes a preamble signal Ap and a control signal Ac. The preamble signal Ap is a signal indicating that the signal is an answer signal A. The control signal Ac is a signal including a control command such as an unlock request for unlocking the vehicle, data such as a portable device ID and a distance L, and the like. The distance L is the distance between the vehicle-mounted device 2 and the portable device 1 measured by the portable device 1.

The request signal R includes a preamble signal Rp, a control signal Rc, and a measurement signal Rr. The preamble signal Rp is a signal indicating that the signal is the request signal R. The control signal Rc is a signal including a control command such as a response request requesting transmission of the answer signal A and data such as an on-board unit ID.

The measurement signal Rr is a signal that is transmitted with a predetermined transmission signal strength and whose reception signal strength (RSSI) I is measured by the portable device 1. The portable device 1 measures the distance L based on the received signal strength I of the measurement signal Rr, and determines whether or not a relay attack has been performed. In the example of FIG. 2, the request signal R includes, but is not limited to, two measurement signals Rr1 and Rr2 transmitted with different transmission signal strengths. The request signal R may include three or more measurement signals Rr transmitted with different transmission signal strengths. As described above, the request signal R preferably includes a plurality of measurement signals Rr transmitted with different transmission signal strengths. In other words, it is preferable that the plurality of measurement signals Rr are transmitted so that the transmission signal strength changes in a predetermined pattern. Thereby, the portable device 1 can determine whether or not the relay attack has been performed based on the pattern of the received signal strength I of the measurement signal Rr.

The request signal R may include only one measurement signal Rr. In this case, the portable device 1 cannot determine whether or not the relay attack has been performed based on the pattern of the received signal strength I of the measurement signal Rr, but the received signal strength Ix, Iy of each axis of the measurement signal Rr. , Iz can be used to determine if a relay attack has taken place. The determination method based on the received signal intensities Ix, Iy, and Iz of each axis of the measurement signal Rr will be described later.

Next, an outline of the operation of the RKE system 100 and a relay attack will be described. FIG. 3 is a diagram illustrating an outline of the operation of the RKE system 100. In the example of FIG. 3, the portable device 1 is possessed by the user U, and the vehicle-mounted device 2 is mounted on the vehicle. Further, antennas Ant1 to Ant5 of the vehicle-mounted device transmitter 22 are installed at different positions of the vehicle.

The vehicle-mounted device 2 mounted on the vehicle periodically transmits the request signal R from the antennas Ant1 to Ant5. When the user U approaches the vehicle, the portable device 1 receives the request signal R and returns an answer A to the request signal R. Upon receiving the answer signal A, the vehicle-mounted device 2 requests the door control unit 3 to unlock the door. The door control unit 3 unlocks the door according to the request. As described above, the RKE system 100 is a so-called smart entry system in which the user U can unlock the door without operating the portable device 1. Since the request signal R has a short communicable distance as described above, the door is usually unlocked only when the user U approaches the vehicle.

FIG. 4 is a diagram illustrating a relay attack. As shown in FIG. 4, the relay attack is performed using two repeaters 4A and 4B that relay the request signal R. The repeater 4A receives the request signal R near the vehicle-mounted device 2, amplifies the request signal R, converts the frequency, and transmits the request signal R. As a result, the request signal R is transmitted farther than the original communicable distance. The repeater 4B receives the request signal R transmitted by the repeater 4A near the user U, restores the frequency of the request signal R, and transmits the request signal R. When the portable device 1 receives the request signal R transmitted by the repeater 4B, the portable device 1 returns an answer signal A. Upon receiving the answer signal A, the vehicle-mounted device 2 requests the door control unit 3 to unlock the door. The door control unit 3 unlocks the door according to the request. Thus, according to the relay attack, the door of the vehicle is unlocked even though the user U is away from the vehicle.

As a countermeasure against the relay attack, a method of detecting the relay attack based on the pattern of the transmission signal strength of the request signal R is known, but when the repeaters 4A and 4B can imitate the pattern, this method can be used. The relay attack cannot be detected. Therefore, in the present embodiment, the request signal R is transmitted from the plurality of antenna Ants, and the relay is relayed based on the ratio r of the received signal strengths Ix, Iy, and Iz for each axis of each request signal R calculated by the portable device 1. Determine if an attack has taken place.

As can be seen from FIG. 3, when the request signal R is transmitted from each antenna Ant when the relay attack is not performed, the request signal R arrives at the portable device 1 from a different direction for each antenna Ant. Therefore, the request signal R from the antenna Ant1 has the maximum reception signal strength Ix on the X-axis, the request signal R from the antenna Ant2 has the maximum reception signal strength Iy on the Y-axis, and so on. The ratio r of the received signal strengths Ix, Iy, and Iz for each axis is a different ratio r for each request signal R.

On the other hand, as can be seen from FIG. 4, when the relay attack is performed, even if the request signal R is transmitted from each antenna Ant, the request signal R is transmitted to the portable device 1 only from the direction of the repeater 4B. It doesn't come. Therefore, unlike the case where the relay attack is not performed, the ratio r of the received signal intensities Ix, Iy, and Iz for each axis of the request signal R is the same for the plurality of request signals R.

In this way, the relationship of the ratio r of the received signal intensities Ix, Iy, and Iz for each axis of the request signal R differs among the plurality of request signals R depending on whether or not the relay attack has been performed. Therefore, the request signal It can be determined whether or not the relay attack has been performed based on the ratio r of the received signal intensities Ix, Iy, and Iz for each axis of R.

Next, the functional configuration of the portable device control unit 13 of the portable device 1 according to the present embodiment will be described. FIG. 5 is a diagram showing an example of the functional configuration of the portable device control unit 13. The portable device control unit 13 of FIG. 5 includes a received signal strength calculation unit 131, a signal selection unit 132, a relay attack determination unit 133, a distance measurement unit 134, a portable device storage unit 135, and a request signal authentication unit 136. , And an answer signal generation unit 137. Each functional configuration is realized by the CPU executing a program and cooperating with other hardware. Further, the portable device storage unit 135 is realized by a ROM or a RAM.

The reception signal strength calculation unit 131 calculates the reception signal strengths Ix, Iy, and Iz for each axis of the measurement signal R included in the request signal R received by the portable device reception unit 11 by the 3-axis antenna. The received signal strengths Ix, Iy, and Iz are the received signal strengths of the measurement signal R received on the X-axis, Y-axis, and Z-axis of the 3-axis antenna, respectively. Further, the reception signal strength calculation unit 131 calculates the reception signal strength I of the measurement signal R included in the request signal R received by the portable device reception unit 11 by the 3-axis antenna. The received signal strength I is a composite value of the received signal strengths Ix, Iy, and Iz for each axis, and I = (Ix ² + Iy ² + Iz ² ) ^1/2 .

The signal selection unit 132 selects the measurement signal Rr used by the relay attack determination unit 133 for the relay attack determination. Specifically, the signal selection unit 132 selects the measurement signal Rr whose received signal strength I is within the predetermined range Ir from the plurality of measurement signals Rr received by the portable device reception unit 11. The predetermined range Ir is set in a range in which the input / output characteristics of the portable device receiving unit 11 are linear.

When each request signal R includes a plurality of measurement signals Rr, the measurement signal Rr whose received signal strength I is closest to the predetermined value Is from among the plurality of measurement signals Rr included in each request signal R. Select. The predetermined value Is is set in the center of the range in which the input / output characteristics of the portable device receiving unit 11 are linear.

As a result, the signal selection unit 132 measures that the received signal strength I is included in the predetermined range Ir and the received signal strength I is closest to the predetermined value Is from the measurement signals R included in each request signal R. The signal Rr is selected as the measurement signal Rr used for the relay attack determination.

FIG. 6 is a diagram showing an example of the received signal strength I of the measurement signal Rr. FIG. 6 shows the received signal strength I of each measurement signal Rr included in the request signals R1 to R5. Each of the request signals R1 to R5 includes two measurement signals Rr.

In the example of FIG. 6, the signal selection unit 132 selects the measurement signals Rr22, Rr31, Rr32, and Rr41 as the measurement signal Rr whose received signal strength I is included in the predetermined range Ir. In this way, by selecting the measurement signal Rr whose received signal strength I is within the predetermined range Ir, the measurement signal Rr for which the received signal strength I is accurately calculated is used for the relay attack determination. It can be selected as Rr. In other words, the measurement signal Rr having a large or small received signal strength I calculated with low accuracy according to the input / output characteristics of the portable device receiving unit 11 is used for the relay attack determination from the measurement signal Rr. Can be excluded. As a result, the accuracy of the relay attack determination can be improved.

Further, in the example of FIG. 6, the signal selection unit 132 uses the measurement signal Rr whose received signal strength I is closest to the predetermined value Is from among the plurality of measurement signals Rr included in each request signal R1 to R5. The measurement signals Rr12, Rr22, Rr31, Rr41, and Rr51 are selected. In this way, by selecting the measurement signal Rr whose received signal strength I is closest to the predetermined value Is, the received signal strength I is calculated more accurately when each request signal R includes a plurality of measurement signals Rr. The measured measurement signal Rr can be selected as the measurement signal Rr used for the relay attack determination. As a result, the accuracy of the relay attack determination can be improved.

As a result of the signal selection unit 132 selecting the measurement signal Rr as described above, in the example of FIG. 6, the measurement signals Rr22, Rr31, and Rr41 are selected as the measurement signals Rr used for the relay attack determination.

The relay attack determination unit 133 determines whether or not a relay attack has been performed based on the ratio r of the received signal strengths Ix, Iy, and Iz for each axis of the plurality of measurement signals Rr selected by the signal selection unit 132 (the relay attack determination unit 133). Execute relay attack judgment). The ratio r of the received signal intensities Ix, Iy, and Iz for each axis of the measurement signal Rr corresponds to the arrival direction of the measurement signal Rr (request signal R). When a plurality of measurement signals Rr arrive from the same direction, the ratio r of each measurement signal Rr becomes the same. On the other hand, when a plurality of measurement signals Rr arrive from different directions, the ratio r of each measurement signal Rr becomes different.

7 and 8 are diagrams showing an example of the ratio r of the received signal intensities Ix, Iy, and Iz of the measurement signal Rr. 7 and 8 show the ratio r of the measurement signals Rr22, Rr31, and Rr41. Further, FIG. 7 shows the ratio r when the relay attack is performed, and FIG. 8 shows the ratio r when the relay attack is not performed.

When the vehicle-mounted device 2 transmits a request signal R from a plurality of antennas arranged at different positions of the vehicle, when a relay attack is performed, as described above, the portable device 1 receives a plurality of measurement signals Rr. Since all of them arrive from the direction of the repeater 4B, as shown in FIG. 7, the ratio r of the measurement signals Rr22, Rr31, and Rr41 is the same.

On the other hand, when the relay attack is not performed, a plurality of measurement signals Rr arrive at the portable device 1 from different directions. Therefore, as shown in FIG. 8, the measurement signals Rr22, Rr31, The ratio r of Rr41 is different.

In this way, the relay attack determination unit 133 can determine whether or not the relay attack has been performed based on the ratio r of the plurality of measurement signals Rr. The relay attack determination unit 133 determines that the relay attack has been performed when the ratio r of all the measurement signals Rr is the same, and when the ratio r of at least some of the measurement signals Rr is different, the relay attack is performed. You can judge that it is not broken. The term "same ratio r" as used herein means that the similarity of the ratio r is included in a predetermined range including an exact match. The similarity of the ratio r is, for example, the Euclidean distance of the normalized received signal strengths Ix, Iy, Iz (three-dimensional vector), but is not limited to this. The smaller the Euclidean distance, the higher the similarity.

The distance measuring unit 134 measures the distance L from the vehicle-mounted device 2 to the portable device 1 based on the received signal strength I of the measurement signal Rr. Specifically, the distance measuring unit 134 refers to the distance table and acquires the distance corresponding to the received signal strength I as the distance L between the vehicle-mounted device 2 and the portable device 1.

The portable device storage unit 135 stores various preset information used by the portable device control unit 13. The information stored in the portable device storage unit 135 includes the portable device ID, the vehicle-mounted device ID, the transmission signal strength pattern of the measurement signal Rr included in the request signal R, the distance table, the predetermined range Ir, and the predetermined value Is. However, it is not limited to this.

The request signal authentication unit 136 authenticates the request signal R. Specifically, the request signal authentication unit 136 compares the vehicle-mounted device ID included in the request signal R with the vehicle-mounted device ID stored in the portable device storage unit 135, so that the request signal R is the portable device 1. It is determined whether or not the signal is transmitted from the vehicle-mounted device 2 corresponding to the above. When the in-vehicle device IDs match, the request signal authentication unit 136 determines that the request signal R is transmitted from the in-vehicle device 2 corresponding to the portable device 1 (authentication success), and when the in-vehicle device IDs do not match. , It is determined that the request signal R is not transmitted from the vehicle-mounted device 2 corresponding to the portable device 1 (authentication failure).

The answer signal generation unit 137 states that the portable device receiving unit 11 receives the request signal R, the request signal authentication unit 136 succeeds in authenticating the request signal R, and the relay attack determination unit 133 does not perform the relay attack. If it is determined, the answer signal A is generated. As described above, the answer signal A includes the preamble signal Ap and the control signal Ac. The control signal Ac includes an unlock request, a portable device ID, and a distance L.

Next, the functional configuration of the vehicle-mounted device control unit 23 of the vehicle-mounted device 2 according to the present embodiment will be described. FIG. 9 is a diagram showing an example of the functional configuration of the on-board unit control unit 23. The on-board unit control unit 23 of FIG. 9 includes a distance determination unit 231, an on-board unit storage unit 232, an answer signal authentication unit 233, a control signal generation unit 234, and a request signal generation unit 235. Each functional configuration is realized by the CPU executing a program and cooperating with other hardware. Further, the on-board unit storage unit 232 is realized by a ROM or a RAM.

When the on-board unit receiving unit 21 receives the answer signal A, the distance determination unit 231 determines whether the distance L included in the answer signal A is less than the threshold value Lth. When the distance L is less than the threshold Lth, it corresponds to the case where the portable device 1 is near the on-board unit 2 (user U is near the vehicle), and when the distance L is equal to or more than the threshold Lth, the portable device 1 is located near the vehicle-mounted device 2. This corresponds to the case where 1 is not near the on-board unit 2 (user U is not near the vehicle).

The on-board unit storage unit 232 stores various preset information used by the on-board unit 2. The information stored in the vehicle-mounted device storage unit 232 includes, but is not limited to, the portable device ID, the vehicle-mounted device ID, the transmission signal strength pattern of the measurement signal Rr included in the request signal R, and the threshold value Lth.

The answer signal authentication unit 233 authenticates the answer signal A. Specifically, the answer signal authentication unit 233 compares the portable device ID included in the answer signal A with the portable device ID stored in the vehicle-mounted device storage unit 232, so that the answer signal A becomes the vehicle-mounted device 2 It is determined whether or not the message is transmitted from the portable device 1 corresponding to the above. The answer signal authentication unit 233 determines that the answer signal A is transmitted from the portable device 1 corresponding to the vehicle-mounted device 2 when the portable device IDs match (authentication success), and when the portable device IDs do not match. , It is determined that the answer signal A is not transmitted from the portable device 1 corresponding to the vehicle-mounted device 2 (authentication failure).

In the control signal generation unit 234, the on-board unit receiving unit 21 receives the answer signal A, the distance determination unit 231 determines that the distance L is less than the threshold value Lth, and the answer signal authentication unit 233 authenticates the answer signal A. If successful, it generates a control signal requesting the door control unit 3 to unlock the door.

The request signal generation unit 235 generates a request signal R every T1 for a predetermined time. As described above, the request signal R includes a preamble signal Rp, a control signal Rc, and one or more measurement signals Rr. The control signal Rc includes a response request and the on-board unit ID.

Next, the process executed by the vehicle-mounted device 2 according to the present embodiment will be described. FIG. 10 is a flowchart showing an example of transmission processing of the request signal R by the vehicle-mounted device 2. The vehicle-mounted device 2 periodically executes the transmission process shown in FIG.

When the transmission process of the request signal R is started, first, the request signal generation unit 235 reads out the vehicle-mounted device ID and the transmission signal strength pattern of the measurement signal Rr from the vehicle-mounted device storage unit 232, and the request signal R Is generated (step S101). The request signal generation unit 235 inputs the generated request signal R to the vehicle-mounted device transmission unit 22.

When the request signal R is input, the on-board unit transmission unit 22 wirelessly transmits the request signal R from any of the antenna Ants (step S102). When the on-board unit transmitter 22 transmits the request signal R from all the antenna Ants (step S103: YES), the transmission process ends.

On the other hand, when there is an antenna Ant that has not transmitted the request signal R (step S103: NO), the on-board unit transmitter 22 waits until a predetermined time T1 elapses after transmitting the request signal R (step S104: NO). When a predetermined time T1 elapses after the request signal R is transmitted (step S104: YES), the process returns to step S102, and the on-board unit transmitter 22 wirelessly transmits the request signal R from the next antenna Ant.

By the above transmission process, the request signal R is wirelessly transmitted from a different antenna Ant every predetermined time T1. Since the request signal R may be transmitted from different antenna Ants a plurality of times, it may be transmitted from all the antenna Ants included in the in-vehicle device transmitter 22 or some antenna Ants included in the in-vehicle device transmitter 22. May be sent from each.

FIG. 11 is a flowchart showing an example of reception processing of the answer signal A by the vehicle-mounted device 2. The vehicle-mounted device 2 periodically executes a reception process for receiving the reception of the answer signal A.

When the vehicle-mounted device receiving unit 21 receives the answer signal A during the execution of the reception process (step S201), the vehicle-mounted device receiving unit 21 inputs the answer signal A to the vehicle-mounted device control unit 23. When the answer signal A is input, the answer signal authentication unit 233 reads the portable device ID from the on-board unit storage unit 232, compares the portable device ID with the portable device ID included in the answer signal A, and answers. The signal A is authenticated (step S202). The answer signal authentication unit 233 notifies the control signal generation unit 234 of the authentication result. When the answer signal authentication unit 233 fails to authenticate the answer signal A (step S202: NO), the process ends.

On the other hand, when the answer signal authentication unit 233 succeeds in authenticating the answer signal A (step S202: YES), the distance determination unit 231 reads the threshold value Lth from the on-board unit storage unit 232, and the distance L included in the answer signal A is It is determined whether or not it is less than the threshold value Lth (step S203). The distance determination unit 231 notifies the control signal generation unit 234 of the determination result. When the distance L is equal to or greater than the threshold value Lth (step S203: NO), the process ends.

On the other hand, when the distance L is less than the threshold value Lth (step S203: YES), that is, when the control signal generation unit 234 is notified that the distance L is less than the threshold value Lth, the control signal generation unit 234 controls the door. A control signal requesting the unlocking of the door is generated in the unit 3 (step S204).

After that, the control signal generation unit 234 transmits the generated control signal to the door control unit 3 via the vehicle-mounted network (step S205). Upon receiving the control signal from the control signal generation unit 234, the door control unit 3 unlocks the vehicle door.

During the execution of the reception process, the vehicle-mounted device 2 executes the above process each time the answer signal A is received. As a result, the on-board unit 2 can cause the door control unit 3 to unlock the door of the vehicle in response to the answer signal A received from the portable device 1 possessed by the user U near the vehicle. The order of step S202 and step S203 in FIG. 11 may be reversed.

Next, the process executed by the portable device 1 according to the present embodiment will be described. FIG. 12 is a flowchart showing an example of reception processing of the request signal R by the portable device 1. The portable device 1 periodically executes a reception process for receiving the reception of the request signal R.

When the portable device receiving unit 11 receives the request signal R during the execution of the reception process (step S301), the portable device receiving unit 11 inputs the request signal R to the portable device control unit 13. When the request signal R is input, the request signal authentication unit 136 reads the vehicle-mounted device ID from the portable device storage unit 135, compares the vehicle-mounted device ID with the vehicle-mounted device ID included in the request signal R, and makes a request. The signal R is authenticated (step S302). The request signal authentication unit 136 notifies the answer signal generation unit 137 of the authentication result. When the request signal authentication unit 136 fails to authenticate the request signal R (step S302: NO), the process ends.

On the other hand, when the request signal authentication unit 136 succeeds in authenticating the request signal R (step S302: YES), the reception signal strength calculation unit 131 receives the reception signal strengths I, Ix of the measurement signal Rr included in the request signal R. , Iy, and Iz, respectively (step S303). The reception signal strength calculation unit 131 notifies the signal selection unit 132 and the distance measurement unit 134 of the calculated reception signal strength I. Further, the reception signal strength calculation unit 131 notifies the relay attack determination unit 133 of the calculated reception signal strengths Ix, Iy, and Iz.

When the distance measuring unit 134 is notified of the received signal strength I, the distance measuring unit 134 measures the distance L (step S304). Specifically, the distance measuring unit 134 refers to the distance table stored in the portable device storage unit 135, and sets the distance corresponding to the notified received signal strength I between the vehicle-mounted device 2 and the portable device 1. Is acquired as the distance L of. The distance measuring unit 134 notifies the answer signal generation unit 137 of the measured distance L.

During the execution of the reception process, the portable device 1 executes the above process each time the request signal R is received. By setting the execution period of the reception process to be longer than the predetermined time T1, the portable device 1 can receive a plurality of request signals R transmitted from different antenna Ants.

FIG. 13 is a flowchart showing an example of transmission processing of the answer signal A by the portable device 1. The portable device 1 executes the transmission process of FIG. 13 after executing the reception process of the request signal R.

First, the signal selection unit 132 reads the predetermined range Ir and the predetermined value Is from the portable device storage unit 135, and receives the predetermined range Ir and the predetermined value Is and each measurement signal Rr notified during the execution of the reception process. Based on the signal strength I and the measurement signal Rr used for the relay attack determination, the measurement signal Rr is selected (step S401). The method of selecting the measurement signal Rr is as described above.

Next, the signal selection unit 132 confirms whether or not there are a plurality of selected measurement signals Rr (step S402). When the selected measurement signal Rr is one or less (step S402: NO), the process ends. When the measurement signal Rr is one or less, the measurement signal Rr whose received signal strength I is within the predetermined range Ir cannot be received or the request signal R can be received during the execution of the reception process. Includes cases where there was not.

On the other hand, when a plurality of measurement signals Rr are selected (step S402: YES), the signal selection unit 132 notifies the relay attack determination unit 133 of the selected measurement signals Rr. When the relay attack determination unit 133 is notified of the plurality of measurement signals Rr, the relay attack determination unit 133 compares the ratio r of the received signal intensities Ix, Iy, and Iz of each measurement signal Rr (step S403), and has the relay attack been performed? judge. The relay attack determination unit 133 notifies the answer signal generation unit 137 of the determination result.

When the ratio r of all the measurement signals Rr is the same (step S403: YES), the relay attack determination unit 133 determines that the relay attack has been performed (step S407), and ends the process.

On the other hand, when the ratio r of at least a part of the measurement signals Rr is different (step S403: NO), the relay attack determination unit 133 determines that the relay attack has not been performed (step S404). When it is determined that the relay attack has not been performed, the answer signal generation unit 137 reads the portable device ID from the portable device storage unit 135, and the portable device ID, the distance L notified from the distance measurement unit 134, and the distance L. An answer signal A including an unlock request is generated (step S405). The answer signal generation unit 137 inputs the generated answer signal A to the portable device transmission unit 12.

The answer signal A may include a distance L corresponding to all the request signals R received during the execution of the reception process, or correspond to a plurality of measurement signals Rr used for the relay attack determination. The distance L may be included, the average value calculated from these distances L may be included, or only the distance L corresponding to the last received request signal R may be included.

When the answer signal A is input, the portable device transmission unit 12 wirelessly transmits the answer signal A (step S406).

The portable device 1 executes the above processing each time the reception processing is executed. As a result, the portable device 1 can transmit the answer signal A in response to the plurality of request signals R received from the vehicle-mounted device 2 when the relay attack is not performed. In other words, the portable device 1 can not transmit the answer signal A when the relay attack is performed.

The relay attack determination unit 133 may perform a relay attack determination based on the pattern of the received signal intensity I as well as a relay attack determination based on the ratio r of the received signal intensity Ix, Iy, and Iz for each axis. As a result, the relay attack can be detected more accurately.

As described above, according to the present embodiment, the RKE system 100 can determine whether or not a relay attack has been performed based on the ratio r of the received signal intensities Ix, Iy, and Iz of the plurality of measurement signals Rr. .. Due to the nature of the relay attack, it is difficult to make the ratio r of the received signal intensities Ix, Iy, and Iz different for each measurement signal Rr. Therefore, according to the present embodiment, it is possible to accurately detect the relay attack and improve the safety of the RKE system 100.

The distribution of functional configurations in the RKE system 100 is not limited to the above examples. For example, the signal selection unit 132 and the relay attack determination unit 133 may be provided on the vehicle-mounted device 2. In this case, the portable device 1 may transmit the answer signal A including the reception signal strengths I, Ix, Iy, and Iz of each measurement signal Rr received during the reception processing of the request signal R. The signal selection unit 132 and the relay attack determination unit 133 provided in the vehicle-mounted device 2 can perform the above processing based on the received signal intensities I, Ix, Iy, and Iz included in the answer signal A.

Further, the distance determination unit 231 may be provided in the portable device 1 together with the vehicle-mounted device 2 or instead of the vehicle-mounted device 2. In this case, the threshold Lth may be stored in advance in the portable device storage unit 135. As a result, the portable device 1 can transmit the answer signal A only when the distance L is less than the threshold value Lth. As a result, the power consumption of the portable device 1 can be reduced.

The present invention is not limited to the configurations shown here, such as combinations with other elements in the configurations and the like described in the above embodiments. These points can be changed without departing from the spirit of the present invention, and can be appropriately determined according to the application form thereof.

1: Portable device 2: Vehicle-mounted device 3: Door control unit 11: Portable device receiving unit 12: Portable device transmitting unit 13: Portable device control unit 21: Vehicle-mounted device receiving unit 22: Vehicle-mounted device transmitting unit 23: Vehicle-mounted device control unit 100 : RKE system 131: Received signal strength calculation unit 132: Signal selection unit 133: Relay attack determination unit 134: Distance measurement unit 135: Portable device storage unit 136: Request signal authentication unit 137: Answer signal generation unit 231: Distance determination unit 232 : On-board unit storage unit 233: Answer signal authentication unit 234: Control signal generation unit 235: Request signal generation unit

Claims (11)

A portable device receiver equipped with a 3-axis antenna and receiving a request signal including a measurement signal from an in-vehicle device.
A portable device transmitter that transmits an answer signal to the on-board unit,
A portable device control unit that controls the portable device receiving unit and the portable device transmitting unit,
With
The portable device control unit
A reception signal strength calculation unit that calculates the reception signal strength for each axis of the measurement signal, and a reception signal strength calculation unit.
A relay attack determination unit that determines whether a relay attack has been performed based on the ratio of the received signal strength for each axis of the measurement signal.
A portable device equipped with. When the measurement signals included in the plurality of received request signals have different ratios of at least a part of the measurement signals, the relay attack determination unit determines that the relay attack has not been performed. Item 1. The portable device according to item 1. Claim 1 that the relay attack determination unit determines that the relay attack has been performed when the ratio of all the measurement signals is the same in the measurement signals included in the plurality of received request signals. Or the portable device according to claim 2. A signal selection unit for selecting the measurement signal whose combined value of the received signal strength for each axis is included in a predetermined range from the plurality of received measurement signals is further provided.
The portable device according to any one of claims 1 to 3, wherein the relay attack determination unit determines whether or not the relay attack has been performed based on the measurement signal selected by the signal selection unit. .. The request signal includes a plurality of the measurement signals.
The signal selection unit selects the measurement signal whose combined value is closest to the predetermined value from the plurality of measurement signals included in one of the received plurality of request signals.
The portable device according to claim 4, wherein the relay attack determination unit determines whether or not the relay attack has been performed based on the measurement signal selected by the signal selection unit. The on-board unit receiver that receives the answer signal from the portable device,
An on-board unit transmitter that includes a plurality of antennas and transmits a request signal including a measurement signal from each of the antennas to the portable device.
An on-board unit control unit that controls the on-board unit receiving unit and the on-board unit transmitting unit,
With
The on-board unit control unit
An on-board unit including a relay attack determination unit that determines whether or not a relay attack has been performed based on the ratio of the received signal strength for each axis of the measurement signal received by the portable device. When the measurement signals included in the request signals transmitted from the plurality of antennas have different ratios of at least a part of the measurement signals, the relay attack determination unit determines that the relay attack has not been performed. The vehicle-mounted device according to claim 6. The relay attack determination unit determines that the relay attack has been performed when the ratio of all the measurement signals is the same in the measurement signals included in the request signals transmitted from the plurality of antennas. The vehicle-mounted device according to claim 6 or 7. A signal selection unit for selecting the measurement signal whose combined value of the received signal strength for each axis is included in a predetermined range from the plurality of transmitted measurement signals is further provided.
The relay attack determination unit is any one of claims 6 to 8 that determines whether or not the relay attack has been performed based on the measurement signal included in the request signal selected by the signal selection unit. The in-vehicle device described in the section. The transmitted request signal includes a plurality of the measurement signals.
The signal selection unit selects the measurement signal whose combined value is closest to the predetermined value from the plurality of measurement signals included in one of the plurality of transmitted request signals.
The vehicle-mounted device according to claim 9, wherein the relay attack determination unit determines whether or not the relay attack has been performed based on the measurement signal selected by the signal selection unit. A portable device receiver equipped with a 3-axis antenna and receiving a request signal including a measurement signal from an in-vehicle device, a portable device transmitting unit that transmits an answer signal to the in-vehicle device, the portable device receiving unit, and the portable device transmitting. A portable device having a portable device control unit that controls the unit, and a portable device
An on-board unit receiver that receives the answer signal from the portable device, an on-board unit transmitter that has a plurality of antennas and transmits the request signal from each antenna to the portable device, the on-board unit receiver, and the on-board unit. The on-board unit including the on-board unit control unit that controls the unit transmitter, and the on-board unit.
It is a remote keyless entry system equipped with
A reception signal strength calculation unit that calculates the reception signal strength for each axis of the measurement signal, and a reception signal strength calculation unit.
A relay attack determination unit that determines whether a relay attack has been performed based on the ratio of the received signal strength for each axis of the measurement signal.
Remote keyless entry system with.

Images