JP2022527103A - Passive entry / passive start system that implements the MUSIC algorithm based on the arrival angle determination of the signal received via the circularly polarized antenna. - Google Patents

Abstract

A vehicle access system is provided, including an antenna and an access module. The antenna is configured to receive each signal transmitted from the portable access device to the vehicle. One of the antennas is a circularly polarized antenna. The access module downconverts the received signal to generate in-phase and orthogonal phase signals, executes the MUSIC algorithm to determine the arrival angle of the received signal received by the antenna, and based on the arrival angle, It is configured to determine the distance between the portable access device and the vehicle and allow access to the vehicle based on the distance.

Description

Cross-reference to related applications

This application claims the priority of US Patent Application No. 16/824367 filed on March 19, 2020, and the US Patent Application is US Provisional Application No. 62 filed on October 12, 2018. / 744814, US Provisional Application No. 62/801392 filed February 5, 2019, and US Provisional Application No. 62/826212 filed March 29, 2019 claim the interests of 2019. This is a partial continuation of US Application No. 16/598191 filed on October 10. This application also claims the priority of US Provisional Application No. 62/823210, filed March 25, 2019, and US Provisional Application No. 62/826276 filed March 29, 2019.

The present disclosure relates to a passive entry / passive start system.

The description of the background art provided herein is to provide a general presentation of the context of this disclosure. The research of the present inventor to the extent described in this background art column, as well as the explanatory parts that may not be considered as prior art at the time of filing, are expressed or implied as prior art to the present disclosure. Not tolerated.

Traditional passive entry / passive start (PEPS) systems provide user access to various vehicle functions if the user has a key fob paired with an in-vehicle PEPS electronic controller (or PEPS module). Allow keyless entry including. As an example, a user in possession of a key fob may approach a vehicle equipped with a PEPS module. The key fob communicates with the PEPS module, and once the key fob is authenticated, the PEPS module can unlock the vehicle door. The PEPS module performs an authentication process to determine (i) whether the key fob is authorized to access the vehicle, and (ii) determines the position of the key fob with respect to the vehicle. The authentication process may include exchanging encrypted passwords or signatures. If the password or signature is correct, the key fob is determined to be authorized. The position of the key fob can be determined, for example, based on the strength of the signal received from the key fob. If the key fob is authenticated and located within the vehicle's permit zone, access to the interior of the vehicle is granted without the use of traditional keys.

As another example, a user in possession of a key fob can activate a vehicle function by pressing a button on the key fob. In response to pressing a button, the key fob communicates with the PEPS module, and if the key fob is authenticated and within a given distance from the vehicle, the PEPS module is designated, associated with the button being pressed on the key fob. Performs any function (eg, starting a vehicle, opening a door, sounding an alarm, etc.). The communication performed in the two examples may include the key fob and the PEPS module performing a one-way low frequency (LF) wake-up function and a one-way or two-way radio frequency (RF) authentication function.

The phone-as-key (PAK) vehicle access system can operate similarly to the PEPS system described, except that the vehicle is accessed using a mobile phone rather than a key fob. As an example, the mobile phone can communicate with the PAK module or telematics control unit (TCU) in the vehicle to initiate the access pairing process. The mobile phone and either the PAK module or the TCU perform an access pairing process to establish a trust relationship. The pairing process can include Brutus® pairing, which allows security information to be exchanged directly between the mobile phone and the vehicle, including the mobile phone address, mobile phone ID resolution key, reservation identifier, And / or the encryption key is exchanged over a cloud-based network and / or the mobile phone presents a certificate to the vehicle, the certificate of which is (i) the mobile phone, (ii) the manufacture of the vehicle. It is signed by a trusted security signing authority such as a vendor and / or (iii) a trusted third party. In the case of a certificate, the certificate is the identifier of the person authorized to access the vehicle, the identifier of the cloud-based network authorized to transfer the certificate, the identifier of the vehicle rental or lease agreement, the identifier of the vehicle, the permit. It may include the date and period on which the vehicle is permitted to be used by a person, and / or other restrictions, and / or access / license information.

In the case of passive entry, some user action is usually required to initiate the process of waking up a key fob or mobile phone (referred to as a portable access device). For example, this includes the user approaching the vehicle with the portable access device and / or touching and / or pulling the door handle. When a PEPS module or PAK module, called an access module, detects this behavior, the access module performs a positioning process to initiate key fob search and wakeup. In a one-way RF system, an LF downlink signal (eg, a 125 kHz (kHz) signal) is transmitted from the access module to the keyfob to wake up the keyfob and send commands and data to the keyfob for authentication purposes. Will be done. The key fob then sends a response signal to the access module over the RF uplink. The response signal may be ultra-high frequency (eg, 315 MHz (MHz) or 433 MHz). In a bidirectional RF system, an LF downlink signal is transmitted from the access module to the keyfob to wake up the keyfob and establish a bidirectional RF link between the access module and the keyfob. The bidirectional RF link can transmit signals at UHF frequencies (eg, 315 MHz, 422 MHz, 868 MHz, or 915 MHz). The bidirectional RF link is then used to authenticate the key fob. The key fob includes a microcontroller that goes into sleep mode (or low power listening mode) to constantly check for valid LF signals. If it is a valid LF signal containing the correct vehicle-specific wake-up identifier, the microcontroller wakes up the PEPS controller to generate the signal and communicate with the vehicle's access module.

The vehicle can have, for example, 4-6 LF antennas that generate an LF magnetic field. The key fob controller measures the LF signal level during communication with the access module. The controller determines the received signal strength indicator (RSSI) and provides the RSSI to the access module. The access module then determines the position of the key fob based on RSSI. The key fob includes three separate antenna coils or one 3D coil used to determine the x, y, and z axis values that indicate the position of the key fob.

Smartphones, wearable devices, and / or other smart portable network devices can act as key fobs. Smart portable network devices can enable a variety of vehicle functions, such as passive welcome lighting, distance boundaries in remote parking applications, and long range distance functions.

A vehicle access system is provided, including an antenna and an access module. The antenna is configured to receive each signal transmitted from the portable access device to the vehicle. One of the antennas is a circularly polarized antenna. The access module downconverts the received signal to generate in-phase and orthogonal phase signals, executes the MUSIC algorithm to determine the arrival angle of the received signal received by the antenna, and based on the arrival angle, It is configured to determine the distance between the portable access device and the vehicle and allow access to the vehicle based on the distance.

In another feature, the antenna is connected to a circularly polarized antenna including a conductive ring-shaped body having an inner hole, a circular isolator connected to the conductive ring-shaped body, and a circularly polarized antenna and a circular isolator. Includes a linearly polarized antenna extending outward from a circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

In another feature, the access module collects an analysis signal sample of the signal received at each antenna to generate a received data matrix and data co-distribution based on the received data matrix while running the MUSIC algorithm. Estimate the matrix and use the eigenvalue decomposition process to determine the M × M matrix based on the covariance matrix, where M is an integer greater than or equal to 2 and determines the number of incident signals, M × M. It is configured to divide the matrix into multiple matrices, calculate the MUSIC spectrum based on one of the matrices, and perform a peak search of the MUSIC spectrum to determine the arrival angle.

In another feature, the access module performs a covariance smoothing method to generate a modified covariance matrix and uses an eigenvalue decomposition process to determine the M × M matrix based on the modified covariance matrix. It is configured to do.

In another feature, the access module converts in-phase and orthogonal-phase sample vectors into phase-angle vectors while generating the received data matrix, and in-phase and recreated per antenna based on the phase-angle vector. It is configured to generate an orthogonal phase sample vector and then generate a received data matrix based on the in-phase and orthogonal phase sample vectors recreated for each antenna.

In another feature, the access module creates a time vector corresponding to the in-phase and orthogonal-phase sample vectors, discards some analysis signal samples acquired near the antenna switching time, and repeats each of the remaining samples. Unwrap the portion with a step size π, average the frequencies of the sinusoidal waves of the remaining samples, determine the average gradient of the remaining samples, measure the standard deviation of the average gradient, and which antenna based on the measured standard deviation. Is configured to determine if they are not aligned and, for each antenna, interpolate the straight lines of points on the time vector to generate a reconstructed phase angle vector.

In another feature, the access module checks which one of the antennas has an inaccurate alignment if the standard deviation is greater than a given threshold, and the standard deviation of the mean gradient with respect to one of the antennas. Is configured to be remeasured.

In other features, the access module uses a calibrated array manifold that includes an antenna to remove the source signals one at a time, and forces the source signal to be in an offset position and remains. It is configured to perform a clean method that involves performing an iterative process that involves recalculating the angle of arrival of the incoming signal. The access module converges on a new set of incident angles while performing iterative processing.

In other features, a vehicle is provided, the vehicle comprising a body and a roof, a center console, a floor, or at least a partially enclosed metal structure. The antenna is mounted on the roof, center console, floor, or at least one of the partially enclosed metal structures.

In another feature, the antenna includes a multi-axis polarized RF antenna assembly, the multi-axis polarized RF antenna assembly includes a circularly polarized antenna and is oriented in the roof.

In another feature, a method is provided, in which a signal transmitted from a portable access device to a vehicle is received by each of a plurality of antennas, where one of the antennas is a circularly polarized antenna and receives. Down-converting the signal to generate an in-phase signal and an orthogonal phase signal, running the MUSIC algorithm to determine the arrival angle of the received signal received by the antenna, with a portable access device based on the arrival angle. Includes determining the distance to and from the vehicle and granting access to the vehicle based on the distance.

In another feature, running the MUSIC algorithm collects an analysis signal sample of the signal received at each antenna to generate a received data matrix, estimates a data covariance matrix based on the received data matrix. To determine the M × M matrix based on the covariance matrix using the eigenvalue decomposition process, where M is an integer greater than or equal to 2 and determines the number of incident signals, M × M It involves dividing the matrix into multiple matrices, calculating the MUSIC spectrum based on one of the matrices, and performing a peak search of the MUSIC spectrum to determine the arrival angle.

In other features, the method is to perform a covariance smoothing method to generate a modified covariance matrix, and to use an eigenvalue decomposition process to determine the M × M matrix based on the modified covariance matrix. Including more to do.

In another feature, the method is to convert the in-phase and orthogonal phase sample vectors into phase-angle vectors while generating the received data matrix, in-phase and re-created per antenna based on the phase-angle vector. It further includes generating an orthogonal phase sample vector and generating a received data matrix based on the in-phase and orthogonal phase sample vectors recreated for each antenna.

In other features, the method is to create a time vector corresponding to the in-phase and orthogonal phase sample vectors, discard some analysis signal samples obtained near the antenna switching time, and each of the remaining samples. Unwrapping the repeating part with a step size π, averaging the frequencies of the sinusoidal waves of the remaining samples, determining the average gradient of the remaining samples, measuring the standard deviation of the average gradient, the measured standard. Further determining which antennas are not aligned based on the deviation, and interpolating the straight lines of points on the time vector for each antenna to generate a reconstructed phase angle vector. include.

In other features, the method is to check which one of the antennas has inaccurate alignment if the standard deviation is greater than a given threshold, and the mean gradient with respect to one of the antennas. Further includes re-measuring the standard deviation of.

In other features, the method remains, using a calibrated array manifold that includes an antenna to remove the source signals one at a time, and forcing the position of the source signals to be offset. Performing an iterative process that involves recalculating the angle of arrival of the signal, and performing a clean method that involves converging to a new set of incoming arrival angles while performing the iterative process. Including further.

In other features, the vehicle comprises (i) a body and (ii) a roof, a center console, a floor, or at least a partially enclosed metal structure. The antenna is mounted on the roof, center console, floor, or at least one of the partially enclosed metal structures.

In other features, the antenna includes a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly includes a circularly polarized antenna and is oriented in the roof.

A vehicle access system is provided. The access system includes a receiver and an access module. The receiver is configured to receive a signal transmitted from the portable access device to the vehicle. The access module generates a differential signal based on the received signal, upsamples the differential signal, generates a first upsampling signal, acquires or generates an expected signal, upsamples the expected signal, and so on. The second upsampling signal is generated, the first upsampling signal and the second upsampling signal are correlated with each other to generate a mutual correlation signal, and based on the mutual correlation signal, the first upsampling signal and the second upsampling signal are generated. It is configured to determine the phase difference to and from the upsampling signal of, determine the round trip time of the signal received by the receiver, and allow access to the vehicle based on the round trip time.

In another feature, the access module downconverts the signal to generate a downconverted signal, samples the downconverted signal, generates a sampled signal, performs an arctangent on the sampled signal, and performs an arctangent signal. And then differentiate the arc tangent signal to generate a differential signal.

In another feature, the access module determines at least one of the positions or distances of the portable access device to the vehicle based on the round trip time and grants access to the vehicle based on at least one of the positions or distances. It is configured to do.

In another feature, the access module upsamples the differential signal with a first upsampler configured to generate a first upsampling signal and upsamples the expected signal with a second upsampling. It includes a second upsampler configured to generate a sampling signal. The upsampling rate of the first upsampler is the same sampling rate as that of the second upsampler.

In another feature, the access module includes a code module configured to determine the sign of the derivative signal and a bit pattern module configured to generate the expected signal based on the code of the derivative signal.

In another feature, the access module is configured to acquire an expected signal, which is a predetermined signal acquired by the access module prior to receiving the received signal.

In another feature, the access module multiplies the bits of the first upsampling signal and the second upsampling signal to produce the resulting product, sums the resulting products, and yields the sum of products. It is configured to generate and perform an iterative process involving shifting the second upsampling signal relative to the first upsampling signal. The iterative process provides a sum-of-product value. The access module is configured to determine the phase difference based on the sum of products value.

In another feature, the access module is configured to reconstruct the signal transmitted from the portable access device to the vehicle based on the zero cross of some of the cross-correlation signals associated with the maximum sum of products.

In another feature, the access module is configured to upsample the differential signal to generate a first upsampling signal and to determine the sign of the first upsampling signal. A code module and a bit pattern module configured to generate an expected signal based on the code of the first upsampling signal.

Other features provide portable access devices for vehicle access systems. Portable access devices include receivers and control modules. The receiver is configured to receive a signal transmitted from the vehicle access module to the portable access device. The control module generates a differential signal based on the received signal, upsamples the differential signal, generates a first upsampling signal, acquires or generates an expected signal, upsamples the expected signal, and so on. The second upsampling signal is generated, the first upsampling signal and the second upsampling signal are correlated with each other to generate a mutual correlation signal, and based on the mutual correlation signal, the first upsampling signal and the second upsampling signal are generated. Determines the phase difference from the upsampling signal of, determines the round trip time of the signal received by the receiver, and sends the round trip time to the vehicle to gain access to the vehicle based on the round trip time. Alternatively, it is configured to determine at least one of the positions or distances between the portable access device and the vehicle and transmit at least one of the positions or distances to the vehicle in order to gain access to the vehicle. ..

In another feature, the control module downconverts the signal to generate a downconvert signal, samples the downconvert signal to generate a sampled signal, performs an arctangent on the sampled signal, and produces an arctangent signal. It is configured to generate and then differentiate the arc tangent signal to produce a differential signal.

In another feature, the control module determines at least one of the positions or distances of the portable access device to the vehicle based on the round trip time and access to the vehicle based on at least one of the positions or distances. At least one of the positions or distances is configured to be transmitted to the vehicle in order to obtain.

In another feature, the control module upsamples the differential signal with a first upsampler configured to generate a first upsampling signal and upsamples the expected signal with a second upsampling. The upsampling rate of the first upsampler is the same sampling rate as the second upsampler, including a second upsampler configured to generate a sampling signal.

In another feature, the control module includes a code module configured to determine the sign of the derivative signal and a bit pattern module configured to generate the expected signal based on the code of the derivative signal.

In another feature, the control module is configured to acquire an expected signal, which is a predetermined signal acquired by the access module prior to receiving the received signal.

In another feature, the control module multiplies the bits of the first upsampling signal and the second upsampling signal to produce the resulting product, sums the resulting products, and yields the sum of products. It is configured to generate and perform an iterative process involving shifting the second upsampling signal relative to the first upsampling signal. The iterative process provides a sum-of-product value. The control module is configured to determine the phase difference based on the sum of products value.

In another feature, the control module is configured to reconstruct the signal transmitted from the vehicle access module to the portable access device based on the zero cross of some of the cross-correlation signals associated with the maximum sum of products. Will be done.

In another feature, the control module is configured to upsample the differential signal to generate a first upsampling signal and to determine the sign of the first upsampling signal. A code module and a bit pattern module configured to generate an expected signal based on the code of the first upsampling signal.

A vehicle access system is provided. The access system includes an antenna and an access module. The antenna is configured to receive each signal transmitted from the portable access device to the vehicle. The signal is transmitted at a frequency of 2.4 GHz. The access module down-converts the received signal to generate an in-phase signal and an orthogonal phase signal, executes the MUSIC algorithm, (i) executes the distance between the portable access device and the vehicle, and (ii). ) Perform carrier phase-based ranging, including determining the arrival angle of the received signal received by the antenna, position the portable access device to the vehicle based on the distance and arrival angle, and in position. Based on this, it is configured to allow access to the vehicle.

In another feature, the antenna is arranged in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and the antenna.

In another feature, the antenna is located within the metal structure of the vehicle.

In another feature, the antenna is positioned so that there is no line of sight between the antenna and the portable access device.

In another feature, the access system further includes a sensor, each of which contains two or more antennas, where the received signal has multiple corresponding bounce paths between the portable access device and each sensor. Is placed on the vehicle.

In another feature, the access module monitors the received signal, generates a received signal strength indicator based on the received signal, and determines whether the portable access device is inside or outside the vehicle based on the received signal strength indicator. However, if the portable access device is outside the vehicle, it is configured to determine the distance between the portable access device and the vehicle.

In another feature, at least one of the antennas is a circularly polarized antenna.

In another feature, the antenna is connected to a circularly polarized antenna including a conductive ring-shaped body having an inner hole, a circular isolator connected to the conductive ring-shaped body, and a circularly polarized antenna and a circular isolator. Includes a linearly polarized antenna extending outward from a circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

In another feature, the access module collects an analysis signal sample of the signal received at each antenna to generate a received data matrix and data co-distribution based on the received data matrix while running the MUSIC algorithm. Estimate the matrix and use the eigenvalue decomposition process to determine the M × M matrix based on the covariance matrix, where M is an integer greater than or equal to 2 and determines the number of incident signals, M × M. The matrix is divided into matrices, the MUSIC spectrum is calculated based on one of the matrices, and a peak search of the MUSIC spectrum is performed to determine the arrival angle.

In another feature, the receiver includes a phase lock loop and is phase locked with the transmitter of the portable access device. The access module is configured to perform a tone exchange with the transmitter and determine at least one of the distance or the angle of arrival based on the tone exchange.

In another feature, the receiver includes a phase lock loop and is phase locked with the transmitter of the portable access device. The access module is configured to perform a tone exchange with the transmitter, determine round-trip flight time information based on the tone exchange, and determine the distance based on the round-trip flight time information.

In other features, a vehicle is provided, which includes an access system, a body, and a roof, center console, floor, or at least a partially enclosed metal structure. The antenna is mounted on the roof, center console, floor, or at least one of the partially enclosed metal structures.

In another feature, a method is provided, in which the signal transmitted from the portable access device to the vehicle is received by each of multiple antennas, the signal is transmitted at a frequency of 2.4 gigahertz and the received signal is transmitted. Down-converting to generate in-phase and orthogonal phase signals, (i) determining the distance between the portable access device and the vehicle, and (ii) determining the arrival angle of the received signal received by the antenna. To perform carrier phase-based ranging, including executing the MUSIC algorithm, to determine the position of the portable access device with respect to the vehicle based on distance and arrival angle, and to the vehicle based on the position. Includes allowing access.

In another feature, the antenna is arranged in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and the antenna.

In another feature, the antenna is positioned so that there is no line of sight between the antenna and the portable access device.

In another feature, a pair of antennas is implemented as part of each sensor. The sensors are arranged in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and each sensor.

In another feature, the method monitors the received signal and generates a received signal strength indicator based on the received signal, based on the received signal strength indicator to determine if the portable access device is inside or outside the vehicle. And, if the portable access device is outside the vehicle, further include determining the distance between the portable access device and the vehicle.

In another feature, at least one of the antennas is a circularly polarized antenna.

In another feature, the method is to collect an analysis signal sample of the signal received at each antenna and generate a received data matrix while running the MUSIC algorithm, data co-distribution based on the received data matrix. Estimating the matrix, using the eigenvalue decomposition process to determine the M × M matrix based on the covariance matrix, where M is an integer greater than or equal to 2 and determining the number of incident signals. It further includes dividing the M × M matrix into multiple matrices, calculating the MUSIC spectrum based on one of the matrices, and performing a peak search of the MUSIC spectrum to determine the arrival angle.

In other features, the method further comprises performing a tone exchange with the transmitter of the portable access device and determining at least one of the distance or the angle of arrival based on the tone exchange. The receiver of the portable access device that performs the tone exchange includes a phase lock loop and is phase locked with the transmitter of the portable access device.

In other features, the method further comprises performing a tone exchange with the transmitter, determining round-trip flight time information based on the tone exchange, and determining the distance based on the round-trip flight time information. .. The receiver of the portable access device that performs the tone exchange includes a phase lock loop and is phase locked with the transmitter of the portable access device.

A multi-axis polarized RF antenna assembly is provided, which includes a circularly polarized antenna, a circular isolator, and a linearly polarized antenna. The circularly polarized antenna includes a conductive ring-shaped body having an inner hole. The circular isolator is connected to the conductive ring-shaped body. The linearly polarized antenna is connected to a circularly polarized antenna and a circular isolator, and extends outward from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

In another feature, the conductive element is a wire. In another feature, the sleeve is made of polytetrafluoroethene. The conductive element is made of copper.

In another feature, the linearly polarized antenna is configured to extend downward from the circularly polarized antenna in use.

In another feature, the circularly polarized antenna is a biaxial antenna. The linearly polarized antenna is a uniaxial antenna.

In another feature, the multi-axis polarized RF antenna assembly further includes a ground layer. The circular isolator is placed on the ground plane between the conductive element and the ground plane, and between the circularly polarized antenna and the ground plane.

In another feature, the circularly polarized antenna comprises two feeding points that are 90 ° phase offset and is configured to receive signals that are 90 ° out of phase with each other.

In other features, the vehicle is provided, the vehicle including the body and roof. The roof includes a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly is oriented in the roof so that the linearly polarized antenna extends downward from the circularly polarized antenna.

In other features, a vehicle system is provided, the vehicle system including a multi-axis polarized RF antenna assembly, a second multi-axis polarized RF antenna assembly, and an access module. The multi-axis polarized RF antenna assembly is a first multi-axis polarized RF antenna assembly and is configured to be mounted on a vehicle. The second multi-axis polarized RF antenna assembly is a second circularly polarized antenna, the second, which is configured to be mounted on a vehicle and includes a second conductive ring-shaped body having a second inner hole. It includes a second circular isolator connected to a conductive ring-shaped body and a second linearly polarized antenna connected to a second circular isolator and extending outward from the second circular isolator. The second linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. The second linearly polarized antenna extends perpendicular to the radius of the second circularly polarized antenna. The access module is connected to the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly, the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly. It is configured to communicate with a portable access device via.

In another feature, at any given time, at least one of the linearly polarized antenna or the first multi-axis polarized RF antenna assembly is not cross-polarized with the antenna of the second multi-axis polarized RF antenna assembly.

In another feature, the access module is a passive entry passive start that includes sending and receiving radio frequency signals through the first one of the multi-axis polarized RF antenna assembly and the second one of the multi-axis polarized RF antenna assembly. It is configured to perform an action or a phone-as-akey action.

In another feature, the access module is configured to grant access to the vehicle based on a radio frequency signal.

In another feature, the access module is used by either antenna pair of the first one of the multi-axis polarized RF antenna assembly and the second one of the multi-axis polarized RF antenna assembly to communicate with the portable access device. It is configured to run an algorithm that determines what should be done. In another feature, the portable access device is a key fob or mobile phone.

Another feature provides a way to communicate with portable access devices. The method comprises repeatedly executing the algorithm through the vehicle's access module, the algorithm selecting one frequency from among the frequencies, selecting one antenna pair from possible antenna pairs, the idea. The antennas of the possible antenna pair include antennas with different axes of polarization, transmitting the packet to the portable access device over the selected antenna pair, the first receive signal strength indicator (RSSI) and the response signal. Receiving from a portable access device, the first RSSI corresponds to the transmission of the packet, and includes measuring the second RSSI of the response signal. Based on the first RSSI and the second RSSI, the best antenna pair among the antenna pairs that can be considered one of the best in frequency is selected. One or more additional packets are transmitted using the best frequency selected and the best antenna pair selected.

In another feature, each antenna pair selected includes one of the linearly polarized antennas and one of the circularly polarized antennas.

In another feature, the method of claim 1 is to send one or more additional packets to formally authorize the portable access device, whether the portable access device is authorized to access the interior of the vehicle. And, if a portable access device is permitted, further include permitting access to the interior of the vehicle.

In another feature, the method determines the flight time of one or more additional packets, including the time to send one or more additional packets to the portable access device and the time to receive one or more responses from the portable access device. It further includes measuring and estimating the distance between the vehicle and the portable access device based on the measured flight time.

In another feature, the estimated distance is used to detect if another device is attempting a range extender type relay station attack. In another feature, the method of claim 4 further comprises taking measures, including preventing access to the interior of the vehicle, if another device is attempting to perform a range extender type relay station attack. .. In another feature, countermeasures include notifying the vehicle owner of a range extender type relay station attack.

In another feature, the method is to replace multiple pairs of unmodulated carrier tones with a portable access device at multiple frequencies, the pair of unmodulated carrier tones includes the received tone and the transmitted tone, and the received tone to the transmitted tone. It further includes measuring the phase, collecting frequency data, and estimating the distance between the vehicle and the portable access device based on the measured phase and frequency data.

In other features, the method involves determining whether another device is attempting a range extender type relay station attack based on the estimated distance. In another feature, each antenna pair selected includes a linearly polarized antenna.

In another feature, the algorithm involves switching between possible antenna pairs between packets transmitted in succession. In another feature, the algorithm involves switching between possible antenna pairs during the transmission of some of the packets. Another feature is that some of the packets are continuous wave tones.

In another feature, a particular pair of possible antenna pairs includes two juxtaposed antennas.

In other features, the method is to send the packet to a portable access device, measure the flight time value of the packet based on the response signal received from the portable access device, the response signal is sent based on the packet, Inward the vehicle in response to determining if another device is performing a range extender type relay station attack based on the flight time value and detecting a range extender type relay station attack. Further includes preventing access to.

In another feature, the portable access device is a key fob or mobile phone. In other features, the method further comprises encrypting the identifier of the best antenna pair. The transmission of one or more additional packets contains the encrypted identifier of the best antenna pair.

Another feature provides a vehicle system for communicating with portable access devices. The vehicle system includes antennas and access modules with different axes of polarization. The access module is configured to execute the algorithm repeatedly. The algorithm selects one frequency from multiple frequencies, selects one antenna pair from antennas with different polarization axes, sends a packet through the selected antenna pair to a portable access device, A series of processes including receiving the first RSSI and the response signal from the portable access device, the first RSSI corresponding to the transmission of the packet, and measuring the second RSSI of the response signal. .. The access module selects the best one of the frequencies and the best antenna pair of the antenna pairs based on the first RSSI and the second RSSI, and the best frequency selected and selected. It is configured to send one or more additional packets using the best antenna pair.

In another feature, the access module has the flight time of one or more additional packets, including the time to send one or more additional packets to the portable access device and the time to receive one or more responses from the portable access device. And is configured to estimate the distance between the vehicle and the portable access device based on the measured flight time.

In another feature, the access module replaces multiple pairs of unmodulated carrier tones with a portable access device at multiple frequencies, the unmodulated carrier tone includes the receive tone and the transmit tone, and the phase of the receive tone with respect to the transmit tone. It is configured to measure, collect measured phase and frequency data, and use the measured phase and frequency data to estimate the distance between the vehicle and the portable access device.

In another feature, the access module is configured to detect whether a portable access device is attempting a range extender type relay station attack based on an estimated distance.

In another feature, the access module is configured to detect if a device is attempting a range extender type relay station attack based on an estimated distance.

In another feature, the access module is configured to take measures, including preventing access to the interior of the vehicle, if the portable access device is attempting to perform a range extender type relay station attack.

In other features, countermeasures include notifying the vehicle owner of a range extender type relay station attack. In another feature, the portable access device is a key fob or mobile phone.

In another feature, the portable access device is configured to encrypt the identifier of the best antenna pair. The transmission of one or more additional packets contains the encrypted identifier of the best antenna pair.

Another feature is to provide a system for detecting range extender type man-in-the-middle attacks. The system includes a first transmitter, a receiver, and a first module. The first transmitter is configured to transmit the first radio frequency signal from one of the vehicle and the portable access device to the other of the vehicle and the portable access device. The receiver is configured to receive a first response signal from one of the vehicle and the portable access device that responds to the first radio frequency signal. The first module monitors or generates one or more parameters related to the transmission of the first radio frequency signal and the reception of the first response signal, and access to the vehicle based on the one or more parameters. Alternatively, it detects a range extension type relay attack performed by the attacking device to gain at least one of the vehicle's motion controls, where (i) the first radio frequency signal is from the vehicle to the portable access device. At least one of them is relayed via, or (ii) the first response signal is relayed from the portable access device to the vehicle via the attack device, and a range extension type relay attack is detected. It is configured to take measures accordingly.

In another feature, the first module is mounted on the vehicle. In another feature, the first module is implemented in a portable access device.

In another feature, the first module is configured to measure the round trip time of the first radio frequency signal and detect a range extension type relay attack based on the round trip time.

In another feature, the first module transmits a second radio frequency signal and receives a second response signal prior to transmitting the first radio frequency signal and receiving the first response signal. Monitor at least one of the first received signal strength indicator of the second radio frequency signal, or the second received signal strength indicator of the second response signal, and the first received signal strength indicator or the second. Configured to determine at least one of a path, frequency, channel, or antenna pair for transmitting a first radio frequency signal and receiving a first response signal based on at least one of the received signal strength indicators. Will be done.

In another feature, the first module transmits a second radio frequency signal and receives a second response signal prior to transmitting the first radio frequency signal and receiving the first response signal. It monitors the antenna polarization state corresponding to at least one of the second radio frequency signal or the second response signal and is based on at least one antenna polarization state of the first radio frequency signal or the first response signal. , Configured to determine at least one of a path, frequency, channel, or antenna pair for transmitting a first radio frequency signal and receiving a first response signal.

In another feature, the first module is configured to transmit a first radio frequency signal while receiving a first response signal or a second radio frequency signal from one of the vehicle and portable access device. Ru.

In another feature, the first module is configured to receive a first response signal while receiving a second radio frequency signal from one of the vehicle and portable access device.

In another feature, the first module determines a set of randomly selected frequencies or channels, shares the set of randomly selected frequencies or channels with the vehicle and one of the portable access devices, and It is configured to transmit a first radio frequency signal and receive a first response signal based on a randomly selected frequency or channel.

In another feature, the first module randomizes the access address of the vehicle or portable access device, shares the randomized access address with the portable access device, and contains one of the access addresses in the first radio. It is configured to generate a frequency signal.

In another feature, the first module is configured to measure the length of at least 1 bit of the first response signal and detect range extension type relay attacks based on the length of at least 1 bit. Will be done.

In another feature, the first module is configured to monitor the tilt of the rising and falling edges of the first response signal and detect range extension type relay attacks based on the tilt.

In another feature, the first module uses a sliding correlation function to turn the first response signal into an idealized Gaussian waveform with known bit patterns and bit rates, including peak scaling and zero offset adjustment. Aligned and configured to detect range extension type relay attacks based on the alignment.

In another feature, the first module accumulates the early part of the first response signal after the zero cross of a given waveform and before the next peak and averages based on the accumulated part. Is configured to detect range extension type relay attacks based on the average.

In another feature, the first module accumulates the late stage portion of the first response signal after the peak of a given waveform and before the next zero cross, and averages based on the accumulated portion. Is configured to detect range extension type relay attacks based on the average.

In another feature, the first module comprises a first radio frequency signal, including whether the first radio frequency signal is transmitted from the vehicle to the portable access device or from the portable access device to the vehicle. It is configured to randomize the direction of travel.

In other features, countermeasures include preventing at least one of vehicle access or vehicle motion control.

In another feature, the system is configured to transmit a dummy signal while the first transmitter transmits the first radio frequency signal or the receiver receives the first response signal. Further includes a second transmitter.

In another feature, the system includes a first module mounted on the vehicle and a portable access device comprising a second module. The first module is configured to send a first radio frequency signal to the portable access device and receive a first response signal from the portable access device. The second module is configured to transmit a second radio frequency signal to the vehicle and receive a second response signal from the vehicle. The first module transmits the first radio frequency signal while the second module transmits the first response signal or the second radio frequency signal, or the second module transmits the second radio frequency. At least one of whether the first module receives the first response signal while transmitting the signal.

In other features, the first module and the second module exchange at least three pairs of radio signals, including a section of unmodulated carrier tones, the unmodulated carrier tones include receive and transmit tones, and , It is configured to measure the phase of the received tone with respect to the transmitted tone. One or more of the first module and the second module collects frequency and phase information and estimates the distance between the first module and the second module based on the phase and frequency information. It is configured as follows.

In another feature, one or more of the first and second modules are configured to use the estimated distance to detect range extension type man-in-the-middle attacks.

Another feature provides a way to detect range extension type man-in-the-middle attacks. The method is to transmit a radio frequency signal from one of the vehicle and the portable access device to the other one of the vehicle and the portable access device via the transmitter, and respond to the radio frequency signal via the receiver. To receive a response signal from one of the vehicle and portable access device, to monitor or generate one or more parameters related to the transmission of radio frequency signals and the reception of response signals, and to one or more parameters. Based on this, it involves detecting a range extension type relay attack performed by an attacking device in order to gain at least one of vehicle access or vehicle motion control. At least one of (i) the radio frequency signal being relayed from the vehicle to the portable access device via the attack device, or (ii) the response signal being relayed from the portable access device to the vehicle via the attack device. Is. The method further implements countermeasures in response to detecting a range extension type relay attack, measures the round trip time of the radio frequency signal, the first received signal strength indicator of the radio frequency signal or the response signal. It further includes monitoring at least one of the second received signal strength indicators and detecting range extension type relay attacks based on round trip time.

Another feature is to provide a system for accessing the vehicle or for providing motion control of the vehicle. The system consists of a first antenna module with a first antenna having different polarization axes, a transmitter configured to transmit a challenge signal from the vehicle to the slave device via the first antenna module, and a slave. The device is a portable access device and includes a master device, including a first receiver configured to receive a response signal in response to a challenge signal from the slave device. The system also receives a challenge signal from the transmitter and a response signal from the slave device via a second antenna module with a second antenna having a different polarization axis and a second antenna module. Includes a second receiver configured to do so, and a first sniffer device including. The first sniffer device is configured to measure when the challenge and response signals reach the first sniffer device to provide the arrival time. The master device or first sniffer device estimates (i) at least one of the distance from the vehicle to the slave device or the position of the slave device with respect to the vehicle based on the arrival time, and (ii) the estimated distance or It is configured to prevent at least one of vehicle access or vehicle motion control based on at least one of the positions.

In another feature, the master device or the first sniffer device determines the round trip time associated with the transmission of the challenge signal based on the arrival time and at least the vehicle access or vehicle motion control based on the round trip time. It is configured to detect range extension type relay attacks performed by the attacking device to win one. The response signal is relayed from the slave device to the vehicle by the attack device and modified by the attack device. The master device is configured to take action in response to detecting a range extension type man-in-the-middle attack.

In another feature, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

In another feature, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with the antenna of the slave device.

In another feature, the master device or the first sniffer device determines the first time length for the first sniffer device to receive the challenge signal and the second time length for the sniffer device to receive the response signal. , And it is configured to estimate the distance based on the first time length and the second time length.

In other features, the system further comprises a second sniffer and a third sniffer. The second sniffer device is configured to receive a challenge signal from a transmitter and a response signal from a slave device via a third antenna module including a third antenna and a third antenna module. Includes a third receiver. The third sniffer device is configured to receive a challenge signal from a transmitter and a response signal from a slave device via a fourth antenna module including a fourth antenna and a fourth antenna module. Includes a fourth receiver. The second sniffer device is configured to measure when the challenge and response signals reach the second sniffer device to provide the arrival time. The third sniffer device is configured to measure when the challenge and response signals reach the third sniffer device to provide the arrival time. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is the arrival time provided by the first sniffer device, the arrival time provided by the second sniffer device, and the third. It is configured to estimate the position based on the arrival time provided by the sniffer device.

In another feature, the first sniffer device is configured to determine the first time length for the first sniffer device to receive a response signal. The second sniffer device is configured to determine the second time length for the second sniffer device to receive the response signal. The third sniffer device is configured to determine the third time length at which the third sniffer device receives the response signal. The master device, the first sniffer device, the second sniffer device, or the third sniffer device estimates the position based on the first time length, the second time length, and the third time length. It is configured to do.

In another feature, the master device is configured to periodically transmit a challenge signal or other challenge signal to the slave device and receive the respective response signal from the slave device. The first sniffer device is configured to measure when the challenge and response signals reach the first sniffer device to provide the corresponding arrival time. The master device or first sniffer device (i) updates at least one of the distances or positions based on the arrival time associated with the challenge and response signals, and (ii) the updated distances or updated positions. Based on at least one, it is configured to prevent at least one of vehicle access or vehicle motion control.

Other features provide methods for accessing the vehicle or for providing motion control of the vehicle. In this method, a challenge signal is transmitted from the master device of the vehicle to the slave device via the first antenna module, the first antenna module includes a first antenna having a different polarization axis, and the first. Receiving the response signal from the slave device in response to the challenge signal at the receiver, the challenge signal from the master device and the slave via the second antenna module and the second receiver at the first sniffer device. Receiving the response signal from the device, the second antenna module includes a second antenna with a different polarization axis and the challenge signal and response to provide the arrival time via the first sniffer device. Measuring when the signal was received by the first sniffer device, estimating at least one of the distance from the vehicle to the slave device or the position of the slave device with respect to the vehicle, and estimated based on the arrival time. Includes preventing at least one of vehicle access or vehicle motion control based on at least one of the distances or locations.

In another feature, the method determines the round trip time associated with the transmission of the challenge signal based on the arrival time, gains at least one of vehicle access or vehicle motion control based on the round trip time. To detect a range extension type relay attack performed by an attack device, the response signal is relayed from the slave device to the vehicle via the attack device and modified by the attack device, and the range extension type relay. Includes taking action in response to detecting an attack.

In another feature, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

In another feature, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with the antenna of the slave device.

In another feature, the method further determines a first time length for the first sniffer device to receive the challenge signal, and a second time length for the sniffer device to receive the response signal, and Includes estimating distances based on a first time length and a second time length.

In another feature, the method further comprises receiving a challenge signal from the transmitter and a response signal from the slave device via the third antenna module at the third receiver of the second sniffer device. The third antenna module comprises a third antenna having a different polarization axis, and at the fourth receiver of the third sniffer device, via the fourth antenna module, with a challenge signal from the transmitter. Includes receiving response signals from slave devices. The fourth antenna module comprises a fourth antenna having a different polarization axis. The method further provides arrival time via the second sniffer device, thus measuring when the challenge and response signals reach the second sniffer device, reaching via the third sniffer device. To provide time, measuring when the challenge and response signals reach the third sniffer device, and the arrival time provided by the first sniffer device, provided by the second sniffer device. Includes estimating the position based on the arrival time and the arrival time provided by the third sniffer device.

In another feature, the method further determines a first time length for the first sniffer device to receive the response signal, a second time length for the second sniffer device to receive the response signal. To determine, to determine the third time length for the third sniffer device to receive the response signal, and to the first time length, second time length, and third time length. Includes estimating the position based on.

Another feature is that the master device periodically sends a challenge signal or other challenge signal to the slave device and receives each response signal from the slave device. The first sniffer device measures when the challenge and response signals reach the first sniffer device to provide the corresponding arrival time. Update at least one of the distances or positions based on the arrival time associated with the challenge and response signals. And, based on at least one of the updated distances or updated positions, at least one of vehicle access or vehicle motion control is prevented.

Another feature is to provide a system for accessing the vehicle or for providing motion control of the vehicle. The system includes a first network device and a control module. The first network device includes a first antenna module, a transmitter, and a receiver. The first antenna module includes antennas having different polarization axes. The transmitter is configured to transmit a series of tones from the vehicle to the second network device via the first antenna module and to change the frequency of the tones during the transmission of the series of tones. At any given time, at least one of the antennas of the first antenna module is not cross-polarized with the antenna of the second network device. The receiver is configured to receive a series of tones from a second network device. The control module (i) determines the phase difference of the series of tones with respect to the frequency difference of the series of tones, and (ii) the first network device and the second network based on the phase difference and the frequency difference. It is configured to determine the distance to and from the device and, based on the (iii) distance, prevent at least one of access to the vehicle or control of the vehicle's motion.

In another feature, for each tone, the control module modifies the corresponding frequency during transmission of that tone and produces a curve of tones that associates the change in frequency with the change in each phase of the tone. , Determines the slope of the curve, and is configured to determine the distance based on the slope of the curve.

In another feature, the control module randomizes the channel selected for transmission of a series of tones.

In another feature, the control module randomizes the direction in which the tone is transmitted between the first network device and the second network device. A tone contains one or more tones within a series of tones.

In another feature, the control module is configured to send and receive a series of tones through the transmitter and receiver, and to determine the distance based on the phase difference of the series of tones and the corresponding frequency difference. Will be done.

In other features, the system further includes a second network device. The first network device includes a first tone exchange responder and a first tone exchange initiator. The first tone exchange initiator includes a transmitter. The first tone exchange responder includes a receiver. The second network device includes a second tone exchange responder and a second tone exchange initiator. The second tone exchange responder responds to a series of tones by sending a series of tones or a second series of tones back to the first tone exchange initiator. The second tone exchange initiator transmits a third series of tones to the first tone exchange responder.

In another feature, the control module has (i) a second set of tones for a phase difference to a second set of tones, or (ii) a third set of tones to a frequency difference. It is configured to determine the distance based on at least one of the phase differences of the three series of tones.

In another feature, the first network device is mounted in the vehicle. The second network device is a portable access device.

In another feature, the first network device simultaneously transmits two symbols to the second network device at two different frequencies. To prevent a successful attack, the length of each of the two symbols is less than 1 μs.

Another feature is that the clock timings of the first network device and the second network device are synchronized. The first network device transmits the first symbol to the second network device at the first frequency. The second network device transmits the second symbol to the first network device at the same time as the transmission of the first symbol to the second network device by the first network device. To prevent a successful attack, the length of the first symbol and the second symbol is 1 μs or less, respectively.

Other features provide a method of accessing the vehicle or providing motion control of the vehicle. The method is to transmit a series of tones from the first network device to the second network device via the transmitter and the first antenna module, and to change the frequency of the tones during the transmission of the series of tones. The first antenna module includes an antenna, and at any given time, at least one of the antennas of the first antenna module is not cross-polarized with the antenna of the second network device and is the receiver of the vehicle, the second. To receive a series of tones from a network device, determine the phase difference of a series of tones relative to the frequency difference of the series, and the first network device based on the phase difference and frequency difference. Includes determining the distance to and from a second network device and preventing at least one of vehicle access or vehicle motion control based on the distance.

In another feature, the method further modifies, for each of the tones, the corresponding frequency during transmission of that tone, and a curve of tones that associates the change in frequency with the change in each phase of the tone, respectively. Includes generating, determining the slope of the curve, and determining the distance based on the slope of the curve.

In another feature, the method further comprises randomizing the channel selected for transmission of a series of tones.

In another feature, the method further comprises randomizing the direction in which the tone is transmitted between the first network device and the second network device. A tone contains one or more tones within a series of tones.

In another feature, the method is to send and receive a series of tones through the transmitter and receiver, and to determine the distance based on the phase difference of the series of tones and the corresponding frequency difference. Further included.

In another feature, the method is via a second tone exchange responder of a second network device by sending a series of tones or a second series of tones back to the first tone exchange initiator of the first network device. In response to a series of tones, the first tone exchange initiator includes a transmitter, and a third series of tones is sent to the first network via the second tone exchange initiator of the second network device. Further including transmitting to the first tone exchange responder of the device, the first tone exchange responder includes a receiver.

In another feature, the method is (i) a phase difference of a second series of tones with respect to a frequency difference of a second series of tones, or (ii) a third with respect to a frequency difference of a third series of tones. Further includes determining the distance based on at least one of the phase differences of a series of tones.

In another feature, the first network device is mounted on the vehicle. The second network device is a portable access device.

Another feature is to provide a system for accessing the vehicle or for providing motion control of the vehicle. The system includes an initiator device and a sniffer device. The initiator device includes a first antenna module including a plurality of polarized antennas, a transmitter configured to transmit a first tone signal from the vehicle to the responder device via the first antenna module, and a responder device. Is a portable access device, including a first receiver configured to receive a second tone signal from a responder device that responds to the first tone signal. The sniffer device is configured to receive a second tone signal from a transmitter and a second tone signal from a responder device via a second antenna module having a plurality of polarized antennas and a second antenna module. Includes a second receiver configured in. The sniffer device is configured to determine the state of the first tone signal and the second tone signal, including their respective phase lags. The initiator device or sniffer device may (i) be the first distance from the vehicle to the responder device or from the responder device to the sniffer device based on the state of the first tone signal and the second tone signal including their respective phase lags. At least one of the second distances of the vehicle is estimated, and (ii) at least one of the vehicle's assessments or vehicle motion controls based on at least one of the estimated first or second distances. It is configured to prevent one.

In another feature, the initiator device or sniffer device estimates a first distance and a second distance, and based on the first and second distances, at least one of access to the vehicle or control of vehicle motion. It is configured to prevent one.

In another feature, the initiator device or sniffer device is an attack device to gain at least one of vehicle access or vehicle motion control based on at least one of a first distance or a second distance. It is configured to detect range extension type man-in-the-middle attacks executed by. The second tone signal is relayed from the responder device to the vehicle by the attack device and modified. The initiator device is configured to take action in response to detecting a range extension type man-in-the-middle attack.

In another feature, at any given time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with at least one of the plurality of polarized antennas of the second antenna module.

In another feature, at any given time, at least one of the plurality of polarized waves of the first antenna module is not cross-polarized with the antenna of the responder device.

In another feature, the initiator device or sniffer device has a first time length at which the first tone signal travels from the initiator device to the responder device based on the state of the first tone signal when received by the responder device. And based on the state of the second tone signal when received by the sniffer device, determine the second time length at which the second tone signal travels from the responder device to the sniffer device, and then the first. It is configured to estimate the first distance and the second distance based on the time length and the second time length of.

In another feature, the initiator device or sniffer device produces the first representation of the first tone signal when received by the responder device in natural logarithmic form and the first tone when received by the sniffer device. The second representation of the signal is generated in natural logarithmic form, the third representation of the second tone signal when received by the sniffer device is generated in natural logarithmic form, and the first representation, second representation, And based on the third expression, it is configured to estimate the first distance and the second distance.

Other features provide methods for accessing the vehicle or for providing motion control of the vehicle. The method is to transmit the first tone signal from the vehicle initiator device to the responder device via the first antenna module, the first antenna module is equipped with multiple polarized antennas, and the responder device is a portable access device. Yes, the initiator device receives the second tone signal from the responder device that responds to the first tone signal, and the first tone signal from the transmitter and the second tone signal from the responder device are the first. Receiving with the sniffer device via the second antenna module, the second antenna module comprises a plurality of polarized antennas, and the state of the first tone signal and the second tone signal including the phase delay of each is the sniffer device. The first distance from the vehicle to the responder device or the second distance from the responder device to the sniffer device, based on the state of the first tone signal and the second tone signal, including their respective phase lags. Estimating at least one of, and preventing at least one of vehicle access or vehicle motion control based on at least one of the estimated first or second distances. include.

In another feature, the method is to estimate a first distance and a second distance, and at least one of access to the vehicle or control of vehicle motion based on the first and second distances. Including, to prevent.

In another feature, the method is performed by an attack device to gain at least one of vehicle access or vehicle motion control based on at least one of a first distance or a second distance. To detect a range extension type relay attack, the second tone signal is relayed and modified by the attacking device from the responder device to the vehicle, and in response to detecting a range extension type relay attack, Further includes taking measures.

In another feature, at any given time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with at least one of the linearly polarized antenna or the plurality of polarized antennas.

In another feature, at any given time, at least one of the plurality of polarized waves of the first antenna module is not cross-polarized with the antenna of the responder device.

In another feature, the method is to determine the first time length at which the first tone signal travels from the initiator device to the responder device, based on the state of the first tone signal when received by the responder device. , Determining the second time length at which the second tone signal travels from the responder device to the sniffer device, based on the state of the second tone signal as received by the sniffer device, and the first time. Further comprising estimating a first distance and a second distance based on the length and the second time length.

Another feature is to provide a system for accessing the vehicle or for providing motion control of the vehicle. The system includes a first network device and a control module. The first network device includes a first antenna module and a control module. The first antenna module includes a plurality of polarized antennas, a transmitter configured to transmit the initiator packet from the vehicle to the second network device via the first antenna module, and the initiator packet for synchronous access. Including a word and a first continuous wave (CW) tone, one of the first network device and the second network device is mounted in the vehicle, the first network device and the other one of the second network devices. One is a portable access device, at which point at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the antenna of the second network device and the second network. It comprises a receiver configured to receive a response packet from the device, the response packet comprising a sync access word and a first CW tone. The control module determines that (i) the difference in round-trip timing between the initiator packet and the response packet is greater than a predetermined threshold, and (ii) is based on the fact that the difference in timing is greater than a predetermined threshold. Detecting a range extension type relay attack performed by an attacking device and (iii) detecting a range extension type relay attack in order to gain at least one of vehicle access or vehicle motion control. In response to, it is configured to prevent at least one of vehicle access or vehicle motion control.

In another feature, the control module is configured to determine the start and end times of the synchronous access word based on the initiator packet and detect the timing difference based on the start and end times. ..

In another feature, the control module determines the start and end times of the synchronous access word for the first CW tone of the response packet based on the initiator packet, and the start and end times of the synchronous access word of the response packet. , Determines if the determined start and end times match, and detects the timing difference if the start and end times of the response packet synchronization access word do not match the determined start and end times. It is configured to do.

In another feature, the control module determines the first length of the synchronous access word of the initiator packet, compares that first length with the second length of the synchronous access word of the response packet, and the second. When the difference between the length of 1 and the length of the second length is larger than a predetermined amount, it is configured to detect a range extension type relay attack.

In another feature, the control module determines the first length of the first CW tone of the initiator packet and compares that first length to the second length of the first CW tone of the response packet. And, if the difference between the first length and the second length is larger than a predetermined amount, it is configured to detect a range extension type relay attack.

In another feature, the first CW tone of the initiator packet is at the end of the initiator packet and the first CW tone of the response packet is at the beginning of the response packet.

In another feature, the initiator packet contains a second CW tone. The response packet contains a second CW tone.

In another feature, the first CW tone of the initiator packet is at the beginning of the initiator packet. The second CW tone of the initiator packet is at the end of the initiator packet. The first CW tone of the response packet is at the beginning of the response packet. The second CW tone of the response packet is at the end of the response packet.

In other features, the initiator packet and the response packet have the same format.

In another feature, the response packet indicates the amount of phase difference between the second CW tone of the initiator packet and the first CW tone of the response packet. The first CW tone of the response packet is in phase with the responder's phase lock loop.

In another feature, the control module is configured to determine the phase difference between the first CW tone of the response packet and the second CW tone of the initiator packet. The second CW tone of the initiator packet is in phase with the initiator's phase lock loop. The first device and the second device are configured to determine the phase difference for the second frequency and the phase difference for the third frequency. The control module has (i) the phase difference between the first CW tone and the second CW tone, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency. Based on, it is configured to determine the distance between devices.

In another feature, the control module compares the frequency, power level, bits and amplitude of some of the received signal, including the response packet, with the frequency, power level, bit and amplitude of some of the transmitted signal, including the initiator packet. , It is configured to determine if a range extension type relay attack is taking place based on the resulting differences.

Other features provide methods for accessing the vehicle or for providing motion control of the vehicle. In this method, an initiator packet is transmitted from the vehicle to the second network device via the first antenna module of the first network device, the first antenna module contains a plurality of polarized antennas, and the initiator packet is Includes a sync access word and a first continuous wave (CW) tone, one of the first network device and the second network device is mounted in the vehicle, the first network device and the other of the second network device. One is a portable access device, at which time at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the antenna of the second network device and the second. Receiving a response packet from a network device, the response packet contains a synchronous access word and a first CW tone, and determines that the timing difference between the initiator packet and the response packet is greater than a predetermined threshold. A range extension type relay attack performed by the attacking device to gain at least one of vehicle access or vehicle motion control based on the timing difference being greater than a predetermined threshold. Includes detecting and preventing at least one of vehicle access or vehicle motion control in response to detecting a range extension type relay attack.

In other features, the method further comprises determining the start and end times of the synchronous access word based on the initiator packet, and detecting the timing difference based on the start and end times. ..

In another feature, the method is to determine the start and end times of the synchronous access word for the first CW tone of the response packet, based on the initiator packet, the start and end times of the synchronous access word of the response packet. , Determining if the determined start and end times match, and if the start and end times of the response packet synchronization access word do not match the determined start and end times, the timing difference. Further includes detecting.

In another feature, the first CW tone of the initiator packet is at the end of the initiator packet and the first CW tone of the response packet is at the beginning of the response packet.

In another feature, the initiator packet contains a second CW tone. The response packet contains a second CW tone. The first CW tone of the initiator packet is at the beginning of the initiator packet. The second CW tone of the initiator packet is at the end of the initiator packet. The first CW tone of the response packet is at the beginning of the response packet. The second CW tone of the response packet is at the end of the response packet.

In another feature, the method further comprises determining the round trip time of the initiator packet based on the amount of phase lag. The response packet indicates the amount of phase lag between the first CW tone of the initiator packet and the first CW tone of the response packet.

Another feature provides a system for detecting range extension type man-in-the-middle attacks. The system includes a transmitter, a receiver, and a control module. The transmitter is configured to transmit a radio frequency signal from one of the vehicle and the portable access device to the other of the vehicle and the portable access device. The receiver is configured to receive a response signal from one of the vehicle and the portable access device in response to the radio frequency signal. The control module converts the response signal into an in-phase signal and an orthogonal phase signal, and gains at least one of vehicle access or vehicle motion control based on the radio frequency signal, the in-phase signal, and the orthogonal phase signal. To detect a range extension type relay attack performed by the attacking device, it may (i) relay the radio frequency signal from the vehicle to the portable access device via the attacking device, or (ii) a response signal. Is at least one of the relays from the portable access device to the vehicle via the attack device, and is configured to take action in response to detecting a range extension type relay attack.

In other features, the system also includes an antenna module. The antenna module is mounted on one of the vehicles and portable access devices where the transmitter and receiver are mounted. The antenna module includes a plurality of polarized antennas. At any given time, at least one of the multiple polarized antennas in the antenna module is not cross-polarized with the other antenna in the vehicle and portable access device.

In another feature, the control module is mounted on the vehicle. In another feature, the control module is implemented in a portable access device.

In another feature, the control module determines the phase difference based on the in-phase signal and the orthogonal phase signal, measures the round-trip time of the radio frequency signal based on the phase difference, and based on the round-trip time. , Configured to detect range extension type relay attacks.

In another feature, the control module is configured to sample in-phase and quadrature signals and determine the receive bit based on the in-phase and quadrature signals.

In another feature, the control module upsamples the receive bit based on the in-phase signal and the orthogonal phase signal, upsamples another signal, and upsamples the received bit based on the in-phase signal and the orthogonal phase signal. , It is configured to cross-correlate another signal with the result of upsampling and determine the phase based on the result of the cross-correlation.

In other features, another signal contains a reference bit pattern. The control module is configured to determine the sign of the differentiated arctangent signal and generate a reference bit pattern based on that sign. In another feature, another signal includes a radio frequency signal after being filtered through a Gaussian low pass filter.

Other features provide a method for detecting range extension type man-in-the-middle attacks. The method is to transmit a radio frequency signal from one of the vehicle and the portable access device to the other one of the vehicle and the portable access device via a transmitter, in response to the radio frequency signal, of the vehicle and the portable access device. Receiving a response signal from one via a receiver, converting a response signal into an in-phase signal and an orthogonal phase signal via a control module, a radio frequency signal, an in-phase signal via a control module. , And to detect range extension type relay attacks performed by the attacking device to gain at least one of vehicle access or vehicle motion control based on the orthogonal phase signal, it is (i) radio. The frequency signal is at least one of whether the frequency signal is relayed from the vehicle to the portable access device via the attack device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attack device, and. Includes taking action in response to detecting range extension type relay attacks.

In another feature, the antenna module is mounted on one of the vehicle and portable access devices, where the transmitter and receiver are mounted. The antenna module includes a plurality of polarized antennas. At any given time, at least one of the multiple polarized antennas in the antenna module is not cross-polarized with the other antenna in the vehicle and portable access device.

In another feature, the control module is mounted on the vehicle. In another feature, the control module is implemented in a portable access device.

In other features, the method determines the phase difference based on the in-phase signal and the orthogonal phase signal, measures the round-trip time of the radio frequency signal based on the phase difference, and based on the round-trip time. Further includes detecting range extension type relay attacks.

In other features, the method further comprises sampling in-phase and quadrature signals and determining receive bits based on in-phase and quadrature signals.

In other features, the method is to upsample the received bit based on the in-phase signal and the orthogonal phase signal, to correlate the result of upsampling the received bit with the result of upsampling another signal, and Further including determining the phase based on the result of the mutual correlation. In other features, another signal contains a reference bit pattern. In another feature, another signal includes a radio frequency signal after being filtered through a Gaussian low pass filter.

Further applicable areas of the present disclosure will be apparent from the detailed description, claims and drawings. The detailed description and specific examples are intended for purposes of illustration only and are not intended to limit the scope of this disclosure.

This disclosure will be more fully understood from the detailed description and accompanying drawings.
It is a side view of the object which shows the RF primary high output signal which travels along a bounce path by the cross polarization of an RF antenna. It is a functional block diagram of an example of a vehicle access system including an access module, an RF antenna, and a portable access device according to an embodiment of the present disclosure. FIG. 3 is a functional block diagram of an example of a vehicle including the access module of FIG. 2 according to an embodiment of the present disclosure. FIG. 3 is a functional block diagram of an example of the access module of FIG. 2 according to an embodiment of the present disclosure. It is a functional block diagram of an example of an RF antenna module of a vehicle according to one embodiment of the present disclosure. FIG. 3 is a functional block diagram of an example of a portable network device according to an embodiment of the present disclosure. It is an example of a polarization axis diagram showing an exemplary arrangement of polarization diversity according to one embodiment of the present disclosure. It is an example of a polarization axis diagram showing an exemplary arrangement of another polarization diversity according to one embodiment of the present disclosure. An exemplary electric field diagram and polar plot showing the electric field pattern and nulls of a linear antenna. It is an exemplary voltage vs. electric field diagram of a linearly polarized antenna. FIG. 3 is a top perspective view of at least a portion of a multiaxially polarized RF antenna assembly comprising a linearly polarized wave antenna and a circularly polarized wave antenna according to an embodiment of the present disclosure. FIG. 11A is a bottom perspective view of at least a portion of the multiaxially polarized RF antenna assembly of FIG. 11A. 11A-B is an exemplary polar plot of radiant power associated with the linearly polarized antenna. 11A-B is an exemplary polar plot of radiant power associated with the circularly polarized antenna. FIG. 3 is a functional block diagram of a portion of an RF circuit and a portable access device according to an embodiment of the present disclosure. FIG. 3 is a block diagram of a portion of a key fob having two linearly polarized slot antennas, a metal trim, and a spare key according to an embodiment of the present disclosure. FIG. 5 is a block diagram of a portion of the key fob of FIG. 15, having an x-axis linearly polarized slot antenna and a y-axis linearly polarized slot antenna, without metal trims and spare keys. FIG. 16 is an exemplary polar plot of radiant flux associated with some x-axis linearly polarized slot antennas in the key fob of FIG. FIG. 16 is an exemplary polar plot of radiant flux associated with some y-axis linearly polarized slot antennas in the key fob of FIG. It is an example of the reflection attenuation vs. frequency plot of the linearly polarized slot antenna of FIG. FIG. 5 is a block diagram of an example of a portion of the key fob of FIG. 15, including a spare key and no metal trim. FIG. 20 is an exemplary polar plot of radiant flux associated with some x-axis linearly polarized slot antennas in the key fob of FIG. FIG. 20 is an exemplary polar plot of radiant flux associated with some y-axis linearly polarized slot antennas in the key fob of FIG. It is an example of the reflection attenuation vs. frequency plot of the linearly polarized slot antenna of FIG. FIG. 5 is a block diagram of an example of a portion of the key fob of FIG. 15 with a portion of metal trim and a spare key. FIG. 24 is an exemplary polar plot of radiant flux associated with some x-axis linearly polarized slot antennas in the key fob of FIG. FIG. 24 is an exemplary polar plot of radiant flux associated with some y-axis linearly polarized slot antennas in the key fob of FIG. It is an example of the reflection attenuation vs. frequency plot of the linearly polarized slot antenna of FIG. 24. FIG. 15 is an exemplary polar plot of radiant flux associated with some x-axis linearly polarized slot antennas in the key fob of FIG. FIG. 15 is an exemplary polar plot of radiant flux associated with some y-axis linearly polarized slot antennas in the key fob of FIG. It is an example of the reflection attenuation vs. frequency plot of the linearly polarized slot antenna of FIG. FIG. 3 is a block diagram of a portion of a key fob having a closed linearly polarized slot antenna, an open linearly polarized slot antenna, a metal trim, and a spare key according to an embodiment of the present disclosure. FIG. 31 is an exemplary polar plot of radiant flux associated with some x-axis linearly polarized slot antennas in the key fob of FIG. FIG. 31 is an exemplary polar plot of radiant flux associated with some y-axis linearly polarized slot antennas in the key fob of FIG. This is an example of the reflection attenuation vs. frequency plot of the linearly polarized slot antenna of FIG. 31. According to one embodiment of the present disclosure, a method of determining which antenna combination to use for exchanging packets between a vehicle and an RF antenna module of a portable access device for round-trip flight time measurement is shown. According to one embodiment of the present disclosure, another method of determining which antenna combination to use for exchanging packets between a vehicle and an RF antenna module of a portable access device for round-trip flight time measurement is shown. It is a flight time measurement diagram. FIG. 3 is a functional block diagram of an exemplary BLE radio with a superheterodyne receiver and transmitter according to an embodiment of the present disclosure. It is an exemplary GFSK parameter definition plot. It is a functional block diagram of the system for transmitting a BLE packet. Shown are exemplary preambles and access addresses for different types of BLE packets. It is an example of a plot of a BLE packet signal showing the corresponding bits. It is an example of another plot of other BLE packet signals showing the corresponding bits. It is an overlap plot of the BLE packet signal of FIG. 44, and one of the BLE packet signals is shifted with respect to the other of the BLE packet signals. An exemplary method for detecting a range extension type man-in-the-middle attack according to an embodiment of the present disclosure is shown. FIG. 3 is a functional block diagram of an example vehicle and portable access device, including each round trip time initiator and round trip time responder, according to an embodiment of the present disclosure. FIG. 46 is a functional block diagram of the vehicle and portable access device of FIG. 46 showing radio frequency signal transmission via the corresponding antenna. FIG. 6 is a functional block diagram of the vehicle and portable access device of FIG. 46 that is being attacked by a range extension type man-in-the-middle attack device. It is a functional block diagram of two exemplary BLE radios according to one embodiment of the present disclosure. FIG. 3 is a functional block diagram of an exemplary position / distance determination system including a round trip time sniffer according to an embodiment of the present disclosure. FIG. 3 is a functional block diagram of an exemplary position / distance determination system including a plurality of round trip time sniffers according to an embodiment of the present disclosure. FIG. 3 is a functional block diagram of an exemplary network device configured to perform tone exchange for distance determination and attack detection according to an embodiment of the present disclosure. FIG. 3 is a functional block diagram of an exemplary position-fixing system including a tone exchange sniffer according to an embodiment of the present disclosure. A method of determining the distance between an initiator and a responder and between a responder and a sniffer according to an embodiment of the present disclosure is shown. FIG. 3 is a functional block diagram of an exemplary passive tone exchange / phase difference detection system according to an embodiment of the present disclosure. FIG. 3 is a functional block diagram of an example of an active tone exchange / phase difference detection system according to an embodiment of the present disclosure. Illustration of an exemplary initiator and responder packet used for RSSI and flight time measurements according to an embodiment of the present disclosure, the packet comprising a continuous wave (CW) tone and a preamble. FIG. 6 is a diagram of an exemplary initiator and responder packet used for RSSI and flight time measurements according to an embodiment of the present disclosure, wherein the packet includes a CW tone and no preamble. Illustration of an exemplary initiator and responder packet used for RSSI and flight time measurements according to one embodiment of the present disclosure, the packet having the same format, including multiple CW tones and no preamble. FIG. 3 illustrates an exemplary initiator and response packet having the same format according to another embodiment of the present disclosure. FIG. 3 is a functional block diagram of an antenna routing system for a network device with each antenna module according to another embodiment of the present disclosure. It is an exemplary radio device model corresponding to the structure, function and operation of the BLE radio device of FIG. 38. According to another embodiment of the present disclosure, a method of exchanging packets between RF antenna modules of a BLE radio for detecting a range extension type relay attack is shown. An exemplary plot of signals from the sampling module, Gaussian LPF, and integrator of the model of FIG. 62. FIG. 6 is an exemplary plot of signals from the resampling module of the model of FIG. FIG. 6 is an exemplary plot of signals from the Arctangent module of the model of FIG. FIG. 6 is an exemplary plot of the signal from the differentiator, superimposed on the signal from the Gaussian LPF of the model of FIG. FIG. 3 represents a different pair of antenna axis assemblies, each comprising two linearly polarized antennas, according to another embodiment of the present disclosure. FIG. 3 shows a perspective view of a pair of antenna shaft assemblies having the same number of antennas, one placed inside the metal container and the other outside the metal container, according to another embodiment of the present disclosure. FIG. 3 shows a perspective view of another pair of antenna shaft assemblies with different numbers of antennas, one placed inside the metal container and the other outside the metal container, according to another embodiment of the present disclosure. It is a diagram showing the distance boundary while performing high-speed bit exchange, and the prober sequence may be cryptographically secure and known independently of the verifier sequence. It is a diagram showing that the response bits are prevented from being transmitted too quickly while performing a fast bit exchange, the prober sequence is cryptographically secure and may depend on the verifier sequence. It is a side view of a plurality of antennas showing an arrival angle. The AOA method including the use of the MUSIC algorithm according to the present disclosure is shown. This is an example of a plot of covariance according to the present disclosure. It is an example of the plot of the eigenvector and the array manifold response according to the present disclosure. It is an example of another plot of eigenvectors and array manifold responses according to the present disclosure. This is an example of the MUSIC power spectrum plot according to the present disclosure. It is a functional block diagram of the antenna selection system by this disclosure. An exemplary reconstruction method according to the present disclosure is shown. It is a top view of the vehicle which shows the arrangement example of the sensor by this disclosure. It is a side view of the vehicle of FIG. 78A. FIG. 78A is a rear view of the vehicle of FIG. 78A showing the bounce reflection of the transmitted signal detected by the sensor according to the present disclosure and the corresponding path. It is a top view of the vehicle which shows another arrangement example of the sensor by this disclosure. It is a side view of the vehicle of FIG. 79A. FIG. 79A is a rear view of the vehicle of FIG. 79A showing the bounce reflection of the transmitted signal detected by the sensor according to the present disclosure and the corresponding path. In drawings, reference numbers may be reused to identify similar and / or identical elements.

RF devices can measure distance by unmodulated carrier tone exchange. For example, US Pat. No. 6,644,768, which is incorporated herein by reference, provides a system and method for measuring the distance between two nodes of a wireless network using unmodulated carrier tone exchange.

RF devices can measure or limit distances by timing round trips to the rapid exchange of cryptographically secure messages. For example, "Disstance-Bounding Protocols (Exted abstracts)" by Bran and Chaum in a workshop on the theory and application of cryptographic techniques for the advancement of cryptographic techniques (EUROCRYPT '93), which is incorporated herein by reference. Uses a sequence of fast bit exchanges between the verifier and the prober. The prober sequence can be cryptographically secure and known, independent of the verifier sequence, as shown in FIG. The prober sequence is cryptographically secure and may depend on the verifier sequence, as shown in FIG.

RF devices that measure distance by round-trip timing are the "Attacks on Time-of" by Hancke and Khun in the proceedings of the 1st ACM Conference on Wireless Network Security (WiSec '08), which is incorporated herein by reference. -As described in "Flight Distance Bounding Channels", you may be subject to early detection and late commit attacks. RF devices that measure distance by unmodulated carrier tone exchange are incorporated herein by reference in the IACR Cryptography ePrint Archive 2016 Officesdotter, Rangatan, and Capkun "On the Signaly of Carrier Phase". Can be subject to signal delay rollover attacks.

While traditional PIPS systems allow keyless entry and vehicle start, conventional PIPS systems can be vulnerable to range extender-type relay station attacks. A range extender type relay station attack refers to an attacker using a relay device to detect, amplify, and relay a signal between a key fob (or other smart portable network device) and the vehicle. As a result, the vehicle access module operates as if the key fob was close to the vehicle and was in the vicinity of the vehicle. For example, if an attacker touches the vehicle door handle by hand and / or with a relay device, the access module may generate and transmit an LF wakeup signal. As a result, the relay device is actually detected and the access module sends an LF wakeup signal to the key fob, which is received by the relay device. The relay device receives the LF wakeup signal, amplifies it, and transfers (or rebroadcasts) it to the actual key fob. The key fob may be placed, for example, inside the house, while the vehicle may be parked outside or in front of the house. The key fob may receive the amplified wake-up signal, generate a response signal, and / or initiate communication over the RF link. The response signal and / or the RF communication signal is amplified and relayed between the vehicle antenna and one or more antennas of the key fob. This can be done via a relay device. As a result, the relay device is considered by the access module to be a key fob, "fooling" the access module into acting as if the key fob was in the position of the relay device, which causes the access module to enter the vehicle. Provide unauthorized access.

In addition, the antenna system of the current PEPS system prevents the PEPS system from accurately estimating the distance between the key fob and the vehicle and accurately estimating the position of the key fob with respect to the vehicle, as further described below. there is a possibility. Distance and position can be determined based on flight time measurements. The flight time and the corresponding received signal strength are measured. The largest received signal strength indicator (RSSI) usually corresponds to the direct or shortest distance between the key fob and the vehicle. The flight time readings associated with the maximum RSSI are used to calculate the distance between the key fob and the vehicle.

The examples described herein include a combined LF and RF PEPS key fob that uses RF round trip timing (RTT) measurements to prevent range extender type relay station attacks. Other examples include RTT measurements, carrier phase-based ranging, and a combination of RTT measurements and carrier phase-based ranging in a PEPS system. Those examples also reveal many other features, further described below.

FIG. 1 shows an example when cross-polarization of the antenna can cause inaccurate distance determination between the key fob's first RF antenna and the vehicle's second RF antenna. If the key fob's first RF antenna is placed relative to the vehicle's second RF antenna so that the first RF antenna is cross-polarized with the second RF antenna, the determined distance is direct. Corresponds to the bounce route rather than the route. Antennas are cross-polarized, for example, when the polarizations of the antennas are perpendicular to each other. An example of this is shown in FIG.

FIG. 1 shows the polarization axes 12 and 14 of the object 10 and the respective RF antennas. The antenna is a linearly polarized antenna. The first RF antenna has a first polarization axis 12 and is in the vehicle. The second RF antenna has a second polarization axis 14 and is in the key fob. Depending on the relative positions of the first RF antenna, the second RF antenna, and the object 10, the RF signal 16 transmitted from the antenna may hit the object 10 and bounce off. The signal energy (or voltage) corresponding to the bounce path is greater than the signal energy (or voltage) corresponding to the direct path 18 between the antennas. This is due to the cross polarization of the RF antenna. Access modules that determine the distance between antennas based on the signal path with maximum signal energy or voltage are inaccurate if the distance between the antennas is the length of the bounce path 16 rather than the length of the direct path 18. May be decided.

If the nulls are aligned with the same polarization antenna arrangement, the bounce path will also be used. This happens when the first and second RF antennas are pointing in the same direction. The antenna may be arranged so that the wire extends longitudinally through the antenna. This is further illustrated in FIG. 9-10.

The examples described herein include polarization diversity for RF signal transmission between the RF antenna of a vehicle and the RF antenna of a portable access device (eg, key fob, mobile phone, wearable device, etc.). In addition, these examples include pseudo-random bidirectional data exchange. Polarization diversity is at least one in which at least one transmitting antenna is not cross-polarized with the polarization axis of at least one receiving antenna at any given time, but is slightly co-polarized with no corinary nulls. It is provided to ensure that it has a polarization axis. As used herein, the phrase "at any time" is used while the corresponding devices are communicating with each other, and / or while one or more signals are being transmitted between the devices. And, always, while one or more signals are being received by one or more devices. This not only allows accurate distance determination, but also helps prevent range extender type relay station attacks. The pseudo-random bidirectional data exchange described below also helps prevent range extender type relay station attacks.

Next, exemplary embodiments will be described in more detail with reference to the accompanying drawings.

FIG. 2 shows a vehicle access system 28 that functions as a PEPS system and a PAK system. The vehicle access system 28 includes the vehicle 30 and may include a key fob 32, a mobile phone 34, and / or other portable access devices such as wearable devices, laptop computers, or other portable network devices. The portable access device can be a Bluetooth® capable communication device such as, for example, a smartphone, smartwatch, wearable electronic device, key fob, tablet device, or other device associated with the user of the vehicle 30. The user may be the owner, driver, or passenger of the vehicle 30, and / or a mechanic for the vehicle 30.

The vehicle 30 includes an access module 36, an LF antenna module 38, and an RF antenna module 40. The access module 36 can wirelessly transmit the LF signal to the portable network device via the LF antenna module 38, and can wirelessly communicate with the portable access device via the RF antenna module 40. The RF antenna module 40 provides polarization diversity between the antenna of the portable network device and the antenna of the RF antenna module 40, respectively. The polarization diversity described further below provides the minimum number, combination, and arrangement of polarization axes in portable network devices and vehicles 30, with at least one transmitting antenna and at least one receiving antenna at any given time. It is guaranteed to have at least one polarization axis that is not cross-polarized with the polarization axis of. In other words, at any given time, at least one RF antenna in the vehicle has at least one axis of polarization that is not cross-polarized with the axis of polarization of at least one RF antenna in each portable access device. A specific number of LF antenna modules and RF antenna modules are shown, but any number can be used for each.

The access module 36 can communicate with the LF antenna module 38 and the RF antenna module 40 wirelessly and / or via the vehicle interface 45. As an example, the vehicle interface 45 is a controller area network (CAN) bus, a local interconnect network (LIN) for lower data rate communication, a clock extended peripheral interface (CXPI) bus, and / or one or more other. Can include vehicle interfaces.

The LF antenna module 38 is located at various locations in the vehicle and is capable of transmitting low frequency signals (eg, 125 kHz signals). Each of the LF antenna modules includes an LF antenna and can include a control module and / or other circuits for transmitting LF signals. The RF antenna module 40 is also located at various locations in the vehicle and can transmit RF signals such as Bluetooth Low Energy (BLE) signals according to the BLE communication protocol. Alternatively, the RF antenna module 40 may communicate according to another wireless communication protocol such as Wi-Fi. An example of an antenna is shown in FIG. 11 (pointing together FIGS. 11A and 11B).

In one embodiment, the RF antenna module 40 is located on the roof 46 of the vehicle 30 in order to improve signal coverage for the vehicle and improve transmission and reception characteristics. As an example, each of the RF antenna modules 40 can include a pair of RF antennas, one linearly polarized antenna and one circularly polarized antenna. The number and location of RF antenna modules can be preselected based on the size and shape of the vehicle 30. In one embodiment, two RF antenna modules are included and are spaced apart from each other as shown in FIG. 2 so that the corresponding electric fields overlap each other and spread in a 360 ° pattern around the vehicle beyond the perimeter of the vehicle. There is. The electric field provides the resulting electric field as shown in FIG. 1, represented by the dashed circle 48. The dashed circle provides the overall shape "like a rectangle". For larger vehicles, more antenna modules 40 may be added to make the shape more "rectangular". For small vehicles, only one RF antenna module 40 may be included.

Different numbers of antennas Different numbers of antennas with polarization may be utilized. FIGS. 65-67 show examples of some other exemplary antennas. Figures 65-67 include fewer antennas and antenna polarizations, which are used by a diverse set of frequencies and / or RF channels to measure or limit distance and / or reflections from vehicle metal. Used to measure or limit distance, if done. This is done to create virtual polarization diversity. The antenna system can tolerate some erroneous measurements due to cross-polarization and / or null alignment. In FIGS. 65-67, 7100A-J refers to an antenna axis assembly, 7100A-7100I refers to an antenna axis assembly having two polarization axes, and 7100J refers to an antenna axis assembly having one polarization axis. Numeric specifiers 7101A-7101I and 7102A-7102I refer to the polarization antenna axes of the two polarization antenna axis assemblies. The numerical specifier 7101J points to a single polarization axis of the 7100J. Numeric specifiers 7103AB, 7103CD, 7103EF, 7103GH, and 7103JI refer to RF paths between pairs of antenna assemblies. There are many RF paths between the antenna axes, some with large link margins, some with small link margins, some with large phase rotation time delays, and some with small link margins. The different round-trip timing and unmodulated carrier tone exchange ranging algorithms disclosed, described and / or referenced herein have what the link margin is compared to the route with the highest link margin, which may not be the shortest. Has the ability to find or measure shorter pathways up or down in decibels (dB). The shorter the indirect found, the more reciprocating timing or tone exchange measurements are made at more frequencies (or channels), and the more mathematically complex and time-consuming algorithms are. The link margin of the route may be smaller.

The additional antenna axis provides polarization diversity for the RF path between the antenna axis assemblies, which provides path diversity. Numerical specifier 7200 refers to a simplified representation of an open three-sided metal box and / or body for RF radio waves in the gigahertz or multi-gigahertz range. Numerical specifier 7201 refers to a simplified representation of a metal plate and / or a lid on a box and / or a vehicle roof for RF radio waves in the gigahertz or multi-gigahertz range. FIGS. 66 and 67 can also be viewed upside down, where 7200 is a simplified representation of the open concave shape of the vehicle roof and 7201 is a simplified representation of the vehicle floor. It was done.

The RF connection between the 7100A and 7100B along the RF path 7101AB is strong because both pairs of antenna axes between the antenna axis assemblies are covalently polarized. This condition is rare for any orientation pair of 2-axis antennas, even when the co-polarization zone is wide and the link margin is approximately 6 dB higher than the median link margin at 90 ° to approximately 5 ° rotation. be. This is because manipulating an antenna axis assembly pair in any orientation requires rotation of three angles and the antenna axes are symmetrical every 90 degrees, which is approximately (5). / 90) ^* (5/90) ^* (5/90), that is, it occurs arbitrarily in the time portion of 1.71E-4. The RF connection along the RF path 7101CD between the 7100C and 7100D is not as strong as the 7101AB, but is good because there are no antenna paths that are co-polarized or cross-polarized and the nulls are not aligned. .. The RF connection along the RF path 7101EF between the 7100E and 7100F is weakened because each antenna path between the individual antenna axes is cross-polarized or contains at least one antenna null. Again, this condition is rare because manipulating a pair of antenna axes in any orientation to this setting requires rotation of three angles. Further, for example, the link margin is reduced by 20 dB or power2db (sin (pi ^* 5/180) ^∧ 2), for example, in any direction of the 2-axis antenna pair having a zone where the cross polarization and null of 5 ° are aligned. As an antenna pair, manipulating an antenna pair in any orientation to this setting requires rotation of three angles, and the antenna axis is symmetrical every 90 degrees, so the setting is approximately (5/90). ^* (5/90) ^* (5/90), that is, it occurs arbitrarily in the time portion of 1.71E-4.

Looking at FIG. 7-8, if there are three polarization axes that are almost orthogonal to one side and two polarization axes that are almost orthogonal to the other side, nulls cannot be aligned while being cross-polarized. It is clear. If there are three polarization axes that are approximately orthogonal to one side and one polarization axis on the other side, the nulls are aligned via two rotations and can be generated arbitrarily.

In general, the more antenna axes on each side of the connection, the less likely it is that a direct path with a low link margin will occur. Reciprocating timing distance measurement and unmodulated carrier tone exchange distance measurement have a larger link margin of the direct path compared to the reflection path and tend to measure the direct path, thus preventing the possibility of a direct path with a low link margin. Or it is beneficial to reduce. Conversely, the lower the link margin of the direct path compared to the reflected path, the more likely the ranging technique will measure the distance along the reflected path.

In FIG. 66, the size of the metal box is reasonably large with respect to the range of distance determination to be measured, distance variation is measured based on different reflection paths within the metal box, and distance measurement connections are made. If one side is located inside a metal box, planning a small number of direct paths can reduce the number of polarization axes required to obtain reasonable measurements. If one of the antenna axes of the 7100G is oriented so that the null is oriented along the strongest and / or shortest reflection path towards the 7100H, the other antenna axis of the 7100G is the antenna axis 7101H or 7102H. Find a bounce path with a strong link margin in one of them. This is especially true when averaging across multiple channels, such as 37 data channels within a BLE data link. Some of the channel and antenna axis path combinations can fade rapidly due to multipath, but not most. In any orientation of the antenna axis pair 7100G, the link margin to the antenna axis pair 7100H is approximately the same, and the distance measured along the reflection path of the 7103IJ is approximately the same. How the reflection path 7103GH bounces off the side walls of the roof 7201 or 7200 varies, but the overall path variation is limited by the size and location of the components of the 7200 and 7201. This limitation of path variation changes as the 7100G is raised to the height at which the direct path exists, which shortens the measured distance by removing reflections from the path 7103GH. The range measured between the 7100G and the 7100H along the reflection path or the shorter direct path sets a comparison boundary indicating that the 7100G, which may be part of the portable device, is within the distance threshold of the 7100H. The 7100H may be a part of the PEPS module 211 or the PAKM module 212. These distance range measurements between a pair of 7100 modules may be made and compared to less than the boundary. Measurements, distances, and / or comparison results indicate that the portable access device 400 is in the approach zone, unlock zone, and / or vehicle mobilization zone, "if-then" in the software decision tree. -Else "may be used as part of the comparison.

FIG. 67 is similar to FIG. 66, except that the antenna shaft assembly 7100J includes a single polarized antenna shaft 7101J. In one embodiment, the antenna axis assembly 7100J comprises only a single polarized antenna axis. It is possible to orient the 7101J so that the null is oriented along the strongest and / or shortest reflection path towards the 7100H. In this case, reciprocating timing and unmodulated carrier tone exchange techniques tend to measure distance along a path (not shown) that bounces away from the box 7200 and bounces towards the box. Manipulating an antenna pair in any orientation requires two angles of rotation, and the antennas are symmetrical every 90 degrees, so for example, the link margin is 20 dB or pow2db (sin (pi ^* 5 /). 180) ^∧ 2) Down, for example, having a zone with 5 ° wide nulls, two rotations are required to orient the antenna axis in any orientation. This orientation occurs approximately (5/90) ^* (5/90), that is, at the time portion of 3E-3. For higher power paths reflected by distant objects, distance range measurements between a pair of 7100 modules are made and the measurements are taken from the boundary, except for the increased time when significantly different indirect paths are measured. This setting can also be used to compare with smaller. Measurements, distances, and / or comparison results indicate that the portable access device 400 is in the approach zone, unlock zone, and / or vehicle mobilization zone, one or more "if-then". -Else "may be used as part of a comparison and software decision tree.

Different polarizations of the antenna can be used to create polarization diversity. Multiple polarization antennas (or antenna axes) create polarization diversity. A linear axis and another linear axis, two linear axes including a linear axis and a circularly polarized antenna, or three independent linear axes (linearly polarized antennas) are all possible. This is especially true if there are nearby metals to create virtual polarization diversity.

Even if the 7101H or 7101J antenna shaft pair is placed at a low position of the metal box which is the vehicle body or at a high position of the metal box which is the roof of the vehicle in order to realize these virtual antenna axis array effects. good.

FIG. 3 shows a vehicle 200, which is an example of the vehicle 108 of FIG. The vehicle 200 includes a PAK system 202 that includes a vehicle control module 204, an infotainment module 206, and another control module 208 (eg, a body control module). Modules 204, 206, 208 can communicate with each other via the controller area network (CAN) bus 209 and / or other vehicle interfaces (eg, vehicle interface 45 in FIG. 2). The vehicle control module 204 can control the operation of the vehicle system. The vehicle control module 204 can include a PEPS module 211, a PAK module 212, and a parameter adjustment module 213, as well as other modules shown in FIG. The vehicle control module 204 is configured to execute instructions stored in a non-temporary computer-readable medium such as memory 218, which may include read-only memory (ROM) and / or random access memory (RAM). It can also include more than one processor.

The PEPS module 211 may perform a POPS operation to provide access to the interior of the vehicle and allow the vehicle to start and / or operate. The PAK module 212 operates in cooperation with the PEPS module 211 to perform the PAK operation described herein. The PEPS module 211 may include the PAK module 212, or the modules 211, 212 may be realized as a single module. The parameter adjustment module 213 can be used to adjust the parameters of the vehicle 200.

The PAK system 202 can further include a memory 218, a display 220, an audio system 221 and one or more transceivers 222 including an LF antenna module 38 and an RF antenna module 40. The RF antenna module 40 may include or / or be connected to the RF circuit 223. The PAK system 202 can further include a navigation system 227 including a telematics module 225, a sensor 226, and a Global Positioning System (GPS) receiver 228. The RF circuit 223 can be used to communicate with a mobile device (eg, mobile device 102 in FIG. 1) transmitting a Bluetooth® signal at 2.4 gigahertz (GHz). The RF circuit 223 can include a BLE radio, a transmitter, a receiver, and the like for transmitting and receiving RF signals.

One or more transceivers 222 include an RF transceiver including an RF circuit 223 and execute an access application having a code for inspecting time stamped data transmitted and received by the RF antenna module 40. The access application can, for example, check if the RF antenna module has received the correct data at the correct time. The access application is stored in memory 218 and may be executed by the PEPS module 211 and / or the PAK module 212. Other examples of operation of the access application are further described below.

An access application can implement a Bluetooth® protocol stack configured to provide a channel map, access identifier, next channel, and time for the next channel. The access application is configured to output a timing signal for the time stamp of the signal transmitted and received via the RF antenna module 40. The access application can acquire channel map information and timing information and share this information with other modules in the vehicle.

The telematics module 225 can communicate with the server via the cell tower station. This may include the transfer of timing information, including certificates, license information, and / or global clock timing information. The telematics module 225 is configured to generate position information and / or position information errors with respect to the vehicle 200. The telematics module 225 may be implemented by the navigation system 227.

Sensor 226 may include sensors, cameras, object detection sensors, temperature sensors, accelerometers, vehicle speed sensors, and / or other sensors used for PEPS and PAK operations. The sensor 226 may include, for example, a touch sensor for detecting that a person is touching the door handle in order to initiate the process of waking up the portable access device. The sensor 226 may be connected to a body control module capable of communicating with the LF and RF antenna circuits and / or other control modules 208 such as the modules disclosed herein. The GPS receiver 228 can provide vehicle speed and / or vehicle direction (ie, direction of travel) and / or global clock timing information.

Memory 218 can store sensor data and / or parameter 230, certificate 232, connection information 234, timing information 236, token 237, key 238, and application 239. Application 239 can include applications executed by modules 38, 40, 204, 206, 208, 210, 211, 212, 223 and / or transceiver 222. As an example, the application can include an access application, a PEPS application, and / or a PAK application executed by the transceiver 222 and modules 210, 211, and / or 212. Although the memory 218 and the vehicle control module 204 are shown as separate devices, the memory 218 and the vehicle control module 204 may be implemented as a single device. A single device can include one or more other devices shown in FIG.

The vehicle control module 204 has an engine 240, a converter / generator 242, a transmission 244, a window / door system 250, a lighting system 252, a seat system according to the parameters set by the modules 204, 206, 208, 210, 211, 212, 213. The operation of the 254, the mirror system 256, the brake system 258, the electric motor 260, and / or the steering system 262 can be controlled. The vehicle control module 204 can perform PEPS and / or PAK operations, which may include setting some parameters. POPS and PAK operations can be based on signals received from sensors 226 and / or transceiver 222. The vehicle control module 204 includes an engine 240, a converter / generator 242, a transmission 244, a window / door system 250, a lighting system 252, a seat system 254, a mirror system 256, a brake system 258, an electric motor 260, and / or a steering system 262. It may receive power from a power source 264 that may be provided to. Some PEPS and PAK operations allow the door of the window / door system 250 to unlock, fuel and ignite the engine 240, start the electric motor 260, system 250, 252, 254, 256, 258, 262. It may include powering any of the above and / or performing other operations further described herein.

The engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seat system 254, mirror system 256, brake system 258, electric motor 260, and / or steering system 262 are provided by the vehicle control module 204. It includes controlled actuators and can adjust, for example, fuel, ignition, airflow, steering wheel angle, throttle position, pedal position, door lock, window position, seat angle and the like. This control can be based on the output of the sensor 226, the navigation system 227, the GPS 228, and the above data and information stored in the memory 218.

FIG. 4 shows the access module 210. The access module 210 includes a PEPS module 211, a PAK module 212, and a parameter adjustment module 213, and further includes a link authentication module 300, a connection information distribution module 302, a timing control module 304, a sensor processing / position identification module 306, and a data management module 308. , And the security filtering module 310 can be included. The PAK module 212 can include an RTC 312 that maintains a local clock time.

The link authentication module 300 can authenticate the portable access device of FIG. 2 and establish a secure communication link. For example, the link authentication module 300 can be configured to perform challenge-response authentication or other cryptographic verification algorithms to authenticate portable access devices.

The connection information distribution module 302 is configured to communicate with some of the sensors 226 of FIG. 3 to provide the sensors with the communication information necessary for the sensors to find, track or intercept secure communication links. This can happen once the sensor is synchronized with a communication gateway, which can be included or implemented in one of the transceivers 222. As an example, the vehicle 200 and / or the PAK system 202 may include any number of sensors placed at any location on the vehicle 200 to detect and monitor mobile devices. The connection information distribution module 302 is configured to acquire information corresponding to the communication channel of the communication link and the channel switching parameter, and transmit the information to the sensor 226. As the sensor 226 receives information from the connection information distribution module 302 via the vehicle interface 45 and the sensor 226 is synchronized with the communication gateway, the sensor 226 can locate, track or intercept the communication link. ..

The timing control module 304 maintains the RTC and / or the currently stored date, sends current timing information to the sensor, incoming and outgoing messages, requests, signals, certifications when not controlled by the PAK module 212. You can generate time stamps for books and / or other items, calculate round-trip times, and so on. Round trip time may refer to the length between when a request is generated and / or transmitted and when a response to the request is received. The timing control module 304 can acquire timing information corresponding to the communication link when the link authentication module 300 executes challenge-response authentication. The timing control module 302 is also configured to provide timing information to the sensor 226 via the vehicle interface 209.

After the link authentication is established, the data management module 308 collects the current location of the vehicle 108 from the telematics module 225 and shares that location with the portable access device. The portable access device, optionally, includes a GPS module and application software that, at run time, compares the estimated relative position of the portable access device to the vehicle 108. Based on the estimated position of the portable access device with respect to the vehicle 108, the portable access device can send a signal to one of the transceivers 222 requesting the vehicle to perform a particular action. As an example, the data management layer 308 is configured to acquire vehicle information acquired by any module (eg, location information acquired by the telematics module 225) and transmit the vehicle information to a portable access device. ..

The security filtering module 310 detects physical layer and protocol violations and filters the data accordingly before providing information to the sensor processing and locating module 306. The security filtering module 310 flags the injected data so that the sensor processing / positioning module 306 discards the data and warns the PEPSI module 211. The data from the sensor processing / positioning module 306 is passed to the PEPSI module 211, which detects the user's intent to access the function and locates the mobile device 102 at the vehicle door or trunk. It is configured to read vehicle condition information from sensors for comparison with a set of positions that allow certain vehicle functions, such as unlocking and / or starting the vehicle.

FIG. 5 is a functional block diagram of the RF antenna module 40, which includes a control module 350 connected to a multiaxially polarized RF antenna assembly 352. The multi-axis polarized RF antenna assembly 352 may include a linearly polarized antenna, another linearly polarized antenna, and / or a circularly polarized antenna (eg, a right circularly polarized antenna or a left circularly polarized antenna). An example of a multi-axis polarized RF antenna is shown in FIG. The control module 350 may include or be part of a BLE communication chipset. Alternatively, the control module 350 may include or be part of a Wi-Fi or Wi-Fi direct communication chipset. The multi-axis polarized RF antenna assembly 352 may be included as part of the RF antenna module 40 or may be disposed away from the control module 350. Some or all of the operations of the control module 350 may be performed by one or more of the modules 204, 210, 211, 212 of FIG.

The control module 350 (or one or more of the modules 204, 210, 211, 212 of FIG. 3) is secure with a portable access device (eg, one of the portable access devices 32, 34 of FIG. 2). Communication connection can be established. For example, the control module 350 can establish a secure communication connection using the BLE communication protocol, which can include transmit and / or receive timing and synchronization information. Timing and synchronization information includes timing of the next communication connection event, timing interval between communication connection events, communication channel of the next communication connection event, channel map, channel hop interval or offset, communication delay information, communication jitter information, etc. It can contain information directed to a secure communication connection. The control module 350 can detect (or "intercept") packets transmitted by the portable access device to the vehicle control module 204 and measure the signal information of the signal received from the portable access device. The channel hop interval or offset can be used to calculate the channel for subsequent communication connection events.

The control module 350 can measure the received signal strength of the signal received from the portable access device and generate the corresponding RSSI value. Additional or alternative, the control module 350 can make other measurements of the signal received from the portable access device, such as reach angle, reach time, reach time difference, and so on. Then, the control module 350 can transmit the measured information to the vehicle control module 204, and the vehicle control module 204 determines the position and / or distance of the portable access device to the vehicle 30 based on the measured information. Can be decided. Position and distance determination can be based on similar information received from one or more other RF antenna modules and / or other sensors.

As an example, the vehicle control module 204 can determine the position of the portable access device, for example, based on the pattern of RSSI values corresponding to the signal received from the portable access device by the RF antenna module 40. A strong (or high) RSSI value indicates that the portable access device is close to the vehicle 30, and a weak (or low) RSSI value indicates that the portable access device is far from the vehicle 30. By analyzing the RSSI value, the control module 204 can determine the position and / or distance of the portable access device to the vehicle 30. Additional or alternative, measurements of the arrival angle, departure angle, round trip timing, unmodulated carrier tone exchange, or arrival time difference of the signal transmitted between the portable access device and the control module 204 are also available on the portable access device. It may be used by the control module 204 or a portable access device to determine the position. Additional or alternative, the RF antenna module 40 may determine the position and / or distance of the portable access device based on the measured information and communicate that position or distance to the control module 204.

Based on the determined position or distance of the portable access device to the vehicle 30, modules 211, 212 of FIG. 3 unlock the door of the vehicle 30, unlock the trunk of the vehicle 30, start the vehicle 30, and / or Vehicle functions such as permitting the start of the vehicle 30 can be authorized and / or performed. As another example, if the portable access device is less than a first predetermined distance from the vehicle 30, modules 211, 212 may turn on the interior or exterior lights of the vehicle 30. Modules 211, 212 may unlock the door or trunk of the vehicle 30 if the portable access device is less than a second predetermined distance from the vehicle 30. If the portable access device is located inside the vehicle 30, modules 211, 212 may allow the vehicle 30 to start.

Referring again to FIG. 5, the control module 350 can include a physical layer (PHY) module 356, a medium access control (MAC) module 358, a time synchronization module 360, and a channel map reconstruction module 362. The PHY module 356 receives the BLE signal via the multi-axis polarized RF antenna assembly 352. The control module 350 monitors the physical layer message of the received BLE and measures the physical characteristics of the corresponding signal, including the received signal strength, using, for example, the channel map generated by the channel map reconstruction module 362. You can get the value. The control module 350 communicates with the control modules and / or modules 204, 210, 211, 212 of other RF antenna modules via the vehicle interface 45 to reach time differences, arrival times, arrival angles, and / or other timings. Information can be determined. In one embodiment, the control module 350 includes a portion of the RF circuit 223 of FIG.

The time synchronization module 360 is configured to accurately measure the signal / message reception time at the vehicle interface 45. The control module 350 can tune the PHY module 356 to a particular channel at a particular time based on the channel map information and the receive time and / or other timing information. In addition, the control module can monitor received PHY messages and data conforming to the Bluetooth® physical layer specification, such as Bluetooth® specification version 5.1. Data, time stamps, and measured signal strengths may be reported by the control module 350 to the control module 204 via the vehicle interface 45.

FIG. 6 shows an exemplary portable access device 400, which is an example of one of the portable access devices 32, 34 of FIG. The portable access device 400 can include a control module 402, a user interface 404, a memory 406, a sensor 407, and a transceiver 408. The transceiver 408 can include a MAC module 410, a PHY module 412, and a plurality of linearly polarized antennas 414.

The control module 402 may include or be part of a BLE communication chipset. Alternatively, the control module 402 may include, or be part of, a Wi-Fi or Wi-Fi direct communication chipset. The memory 406 can store application code that can be executed by the control module 402. Memory 406 can be a non-temporary computer-readable medium including read-only memory (ROM) and / or random access memory (RAM).

The control module 402 communicates with the vehicle modules 204 and 350 to perform authentication and other operations, as further described below. The control module 402 is such as position and / or velocity information obtained from one or more sensors 407 (eg, global satellite navigation system (eg, GPS) sensors, accelerometers, and / or angular velocity sensors). Information about the portable access device 400 can be transmitted. The user interface 404 may include a keypad, a touch screen, a voice activation interface, and / or other user interfaces.

FIG. 7 shows a polarization axis diagram showing an exemplary arrangement of polarization diversity. In the example shown, the two 3-axis antennas located in the vehicle communicate with the 2-axis antennas located in the portable access device (or mobile access network device). With sufficient antenna axes, this antenna topology can prevent the presence of cross-polarizations between one of the 3-axis antennas and the 2-axis antenna. Also, with sufficient antenna axes, the system can be configured to have at least one pair of antennas with no nulls present (or directed) in the direct signal path. The heuristic measurement of RSSI at the continuous wave (CW) tone portion of the packet can be performed while measuring the round trip time and phase delay of the packet. This can be repeated over multiple frequencies. This can be achieved with vehicle access modules and / or portable access devices. Reciprocating timing and / or unmodulated carrier tone exchange can be used to ensure distance measurement. RSSI and frequency-by-frequency change (or delta) phases may be used.

FIG. 8 shows a polarization axis diagram showing an exemplary arrangement of another polarization diversity. In the example shown, the two uniaxial antennas located in the vehicle communicate with the triaxial antennas located in the portable access device (or mobile access network device). This antenna topology, which uses a sufficient antenna axis, can also prevent the situation where cross-polarization exists between one of the single-axis antennas and the 3-axis antenna. Also, with sufficient antenna axes, the system can be configured to have at least one pair of antennas with no nulls present (or directed) in the direct signal path. The heuristic measurement of RSSI at the continuous wave (CW) tone portion of the packet can be performed while measuring the round trip time and phase delay of the packet. This can be repeated over multiple frequencies. This can be achieved with vehicle access modules and / or portable access devices. Round-trip timing is used to ensure distance measurement. RSSI and frequency-by-frequency change (or delta) phases may be used. The example of FIG. 7 may be more suitable than the example of FIG. This is because it can be difficult to incorporate a 3-axis antenna into a particular portable access device such as a key fob.

FIG. 9 shows an electric field diagram 900 and a polar plot 902 showing the electric field pattern of the linear antenna and the null 906. The linear antenna is arranged along the vertical axis 908. The linear antenna has a "doughnut" -shaped radiation pattern. When the nulls are aligned in a row between the transmit and receive antennas (the nulls are the same straight or nearly identical straight antennas), the bounce path of the transmit signal is measured. The examples described herein prevent this situation from being present between at least one transmitting antenna and at least one receiving antenna at any given time. An algorithm for determining which transmit and receive antennas should be used at any given time to prevent the use of cross-polarized and / or co-polarized antennas is set forth herein. Once the appropriate antenna pair is selected, flight time measurements are made to determine the distance between the transmitter and receiver and / or between the vehicle and the portable access device. FIG. 10 shows a voltage vs. electric field diagram 1000 of the linearly polarized wave antenna 1002.

11A-B show at least a portion of an example of a multi-axis polarized RF antenna assembly 1100 including a linearly polarized antenna 1102 and a circularly polarized antenna 1104. Antennas 1102 and 1104 are arranged together. The linearly polarized antenna 1102 extends linearly outward from the center of the circularly polarized antenna 1104 so as to be separated from the circularly polarized antenna 1104. The antennas 1102 and 1104 can transmit 90 ° out of phase with each other. The linearly polarized antenna 1102 may include a conductive element (eg, a linear wire or spiral) 1110 extending within the sleeve 1112. The circularly polarized antenna 1104 can be ring-shaped.

The linearly polarized wave antenna 1102 is a monopole antenna. The sleeve 1112 is made of a dielectric material such as Teflon. Both antennas 1102 and 1104 are centered on a disk-shaped insulator (or isolator) 1106 and a disk-shaped ground plane 1108. The ring-shaped insulator 1106 is stacked as an uppermost layer on the ground plane 1108 (or the lowest layer). The circularly polarized antenna 1104 is arranged on the ground plane 1108 inside the inner recess 1114 of the insulator 1106. The inner recess 1114 of the insulator is arranged between the circularly polarized antenna 1104 and the ground plane 1108.

The circularly polarized antenna has two feeding points 1120 and 1122, and the linearly polarized antenna 1102 has a single feeding point 1124. RF signals are transmitted and / or received via feed points 1120, 1122, 1124. The RF signal is transferred between the antenna 1102 and 1104 and the RF circuit 1114 via a coaxial cable. Coaxial cable includes inner conductive wires 1130, 1132, 1134 and an outer ground shield (not shown). The ground shield is connected to the ground surface 1108. Conductive wires 1130, 1132, and 1134 are connected to feeding points 1120, 1122, and 1124.

During transmission, a signal or voltage is provided between the ground plane 1108 and the conductive element 1110 via a feed point 1124 connected to the conductive element 1110 and the ground plane 1108 via another conductive element 1140. To. The RF signal or voltage is also applied between the ground plane 1108 and the feeding points 1120 and 1122 of the circularly polarized antenna 1104. The feed points 1120 and 1122 are offset 90 ° on the surface of the antenna 1104 and are 90 ° out of phase with each other. A 90 ° electrical phase shift combined with a 90 ° geometric phase shift causes the circularly polarized antenna 1104 to radiate a circularly polarized signal. The feeding points 1120 and 1122 are connected to the circularly polarized wave antenna 1104 from the ground plane 1108 via the insulator 1106. The hole 1142 in the center of the ground plane 1108 and the hole 1144 in the center of the circularly polarized antenna 1104 are large enough to allow the linearly polarized antenna 1102 to radiate without short-circuiting to the ground plane 1108. Is.

The antenna 1102 and 1104 may be made of a conductive material, while the circular isolator 1106 may be made of a non-conductive (or electrically insulating) material. In one embodiment, the linearly polarized antenna 1102 can be implemented as a straight wire, the sleeve 1112 is made of polytetrafluoroethylene (PTFE), and the conductive element 1110 is made of copper. In another embodiment, the linearly polarized antenna 1102 is implemented as a spiral and the wire is wound around a cylindrical object formed of PTFE. FIG. 12 shows a polar coordinate plot 1200 of radiant power for the linearly polarized antenna 1102 of FIG. FIG. 13 shows a polar coordinate plot of radiant power for the circularly polarized antenna 1104 of FIG. Antennas 1102 and 1104 may be connected to RF circuits 1114, such as one of the RF circuits 223 of FIG. 3, and may be configured to be installed on the roof of a vehicle. Antennas 1102 and 1104 can be used to measure the flight time between the vehicle and the portable access device, while other LF antennas in the vehicle can be used to authenticate the portable access device.

The antenna assembly is primarily described as having a circularly polarized antenna and a linearly polarized antenna that can be located, for example, on the roof of the vehicle, but two linearly polarized antennas may be used instead. This applies to each of the examples disclosed herein. The two linearly polarized antennas can be located deeper in the vehicle, such as on the vehicle floor, instrument panel, or center console.

FIG. 14 shows a first RF circuit 1400, a second RF circuit 1401, and a portion 1403 of a portable access device (eg, one of the above portable access devices). Although a specific number of RF circuits are shown, any number of RF circuits can be included to communicate with portable access devices. The first RF circuit 1400 includes a serial transmit module 1402, an RF transceiver module 1404, a switch 1406, a splitter 1408, a uniaxial polarized (or monopole) antenna 1410, a delay module 1412, and a circular polarized antenna assembly 1414. .. Antennas 1410, 1414 can be implemented as the multiaxially polarized RF antenna assembly of FIG. Although each RF circuit is shown to have a uniaxial antenna and a circularly polarized antenna to provide triaxial polarization, each RF circuit may include only two uniaxial polarized antennas. .. Various combinations of linearly and circularly polarized antenna axes are possible to achieve modular polarization diversity, which prevents cross-polarization and / or null alignment. If the RF circuit comprises two uniaxial antennas, the portable access device comprises a triaxial antenna or three uniaxial antennas orthogonal to each other to correspond to the x, y, and z axes.

The serial transmission module 1402 can communicate with one or more vehicle modules (eg, the vehicle control module or access module described above) via the serial bus according to the Serial Peripheral Interface Interconnection (SPI) protocol. Discrete signals (or general purpose I / O signals) can be transmitted between modules 1402 and 1404, and between RF transceiver modules 1404 and switch 1406. The RF transceiver module 1404 can communicate with the PEPS module 211 (FIG. 3). Switch 1406 switches between antennas 1410 and 1414. Splitter 1408 can split the signal received from the RF transceiver module 1404, provide that signal to antenna 1410 and 1414, and / or combine the signals received from antenna 1410 and antenna 1414. Splitter 1408 is a 90 ° splitter that splits a single signal into two 90 ° out-of-phase signals and splits those signals into two feeding points of a circularly polarized antenna (eg, feeding point 1120 in FIG. 11). 1122). The splitter 1408 can provide a signal to or receive a signal from the antenna 1414 via the delay module 1412.

The second RF circuit 1401 includes a switch 1420, a splitter 1422, a uniaxially polarized (or monopole) antenna 1424, a delay module 1426, and a circularly polarized antenna 1428. The antennas 1424, 1428 can be implemented as the multiaxially polarized RF antenna assembly of FIG. Devices 1420, 1422, 1424, 1426, 1428 can operate similarly to devices 1406, 1408, 1410, 1412, 1414. The switch 1420 can communicate with the RF transceiver module 1404. The switch 1406 can also connect the splitter 1408, the uniaxially polarized antenna 1410, and / or the switch 1420 to the RF transceiver module 1404. Switch 1420 can connect a uniaxially polarized antenna 1424 or splitter to switch 1406 or RF transceiver module 1404.

A portion 1403 includes a 3-axis LF antenna 1430, an LF module 1432, an RF module 1434, a user interface 1436, a first uniaxial polarized antenna 1438, a second uniaxial polarized antenna 1440, and a switch 1442. The LF module 1432 transmits and receives LF signals via the 3-axis LF antenna 1430. The RF module 1434 sends and receives RF signals via the switch 1442 and the antennas 1438 and 1440. The switch 1442 connects one or more of the antennas 1438, 1440 to the RF module 1434. Discrete signals and serial peripheral interconnection (SPI) signals can be transmitted between the LF module 1432 and the RF module 1434. The discrete signal may be transmitted between the RF module 1434 and the switch 1442.

The RF signal is transmitted between (i) antennas 1410, 1414, 1424, 1428 and (ii) antennas 1438, 1440. As an example, antennas 1410, 1424 can be associated with the z-axis, and antennas 1414, 1428 can be associated with the x-axis and y-axis, respectively. The antennas 1438 and 1440 can be, for example, slot antennas associated with the x-axis and the y-axis, respectively. The 3-axis LF antenna 1430 can communicate with the corresponding vehicle LF antenna as described above. The LF antenna can be used for the purpose of wake up the downlink. RF antennas can be used for authentication and communication.

Antennas 1410, 1414 can be used to communicate with antennas 1438, 1440, or antennas 1424, 1428 can be used to communicate with antennas 1438, 1440. Alternatively, one of the antennas 1410, 1424 and any one of the antennas 1414, 1428 may be used to communicate with the antennas 1438, 1440. One or more antennas in circuit 1400 can be used while using one or more antennas in circuit 1401. By using one monopole (or linearly polarized) RF antenna and a dipole (or multi-axis polarized) RF antenna such as a circularly polarized antenna, the number of RF switching lanes to be polled is 3 to 2. Will be reduced to. The heuristic measurement of RSSI in the continuous wave tone of the packet can be performed while measuring the round-trip time and phase delay of the packet. This can be repeated over multiple frequencies.

FIG. 15 shows a portion 1500 of a key fob having two linearly polarized slot antennas 1502, 1504, a metal trim 1506, and a spare key 1508. The metal in the key fob can short the field that should be stable along the longitudinal direction (or Y direction) of the key fob. As a result, it can be difficult to design an efficient radiator with a structure that includes a properly operating antenna. The antenna 1502 is an x-axis linearly polarized wave slot antenna. The antenna 1504 is a y-axis linearly polarized wave slot antenna. The metal trim 1506 can be a cast decorative trim. The key fob can also include an LF coil antenna 1510, a processor (not shown), a battery 1512, and a metal plate (or conductive film) 1514. The RF signal is supplied to the metal plate 1514, and the openings of the slot antennas 1502 and 1504 radiate electromagnetic waves.

FIG. 16 shows a portion 1600 of the key fob of FIG. 15 without the metal trim 1506 and the spare key 1508. Part 1600 includes an x-axis linearly polarized slot antenna 1502 and a y-axis linearly polarized slot antenna 1504. Removing the metal trim 1506 and spare key 1508 supports radiation from slot antennas 1502, 1504. This arrangement is configured to work with nearby metals such as metal trims and spare keys, but the plots of FIGS. 17 and 18 are shown, which, if metal trims and spare keys are included, they. Distorted from the plot of. FIG. 17 shows a polar plot of radiated power associated with the x-axis linearly polarized slot antenna 1502 of part 1600 of the key fob of FIG. FIG. 18 shows an exemplary polar plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of part 1600 of the key fob of FIG. 19 shows a plot of reflected attenuation (decibel (dB)) vs. frequency of the linearly polarized slot antennas 1502, 1504 of FIG. 16, where the curves S1, 1 are the first radio (or transmitter). The reflected power of the first port or antenna 1502 of the machine), and S2 and S2 are the reflected power of the second port or antenna 1504 of the second radio (or transmitter). Given the structure of the key fob, the S1,1 and S2,2 plots can be defined, where the "dip" or minimum reflection attenuation of the S1,1 and S2,2 curves provides improved performance. To provide, they are at the same frequency or within a predetermined range of each other.

The amount of reflection attenuation is a means for measuring how well the antenna converts the voltage at the terminal of the antenna into the electric field in space, or how well the antenna converts the electric field in space into the voltage at the terminal. The reflection attenuation amount is a decibel measurement value of how much power is reflected by the terminal. For example, when the reflection attenuation amount is 0 dB, all the power is reflected and there is no power transferred to the terminal. As another example, a reflected attenuation of -10 dB means that about 10% of the power is reflected and 90% of the power is transferred. If the reflection attenuation plot contains a curve that drops to a reasonable level (eg, -6 dB) at the operating frequency, the corresponding antenna is functioning normally. If the amount of reflection attenuation drops to -10 dB, the antenna is considered to be a well-functioning antenna. The amount of reflection attenuation is measured as an S parameter. S1 and S1 are reflection attenuation amounts of the port 1. S2 and S2 are the amount of reflection attenuation of the port 2.

FIG. 20 shows a portion 2000 of the key fobs of FIG. 15, including spare keys 1508 and without metal trim 1506. FIG. 21 shows a polar plot of radiated power associated with the x-axis linearly polarized slot antenna 1502 of part 2000 of the key fob of FIG. FIG. 22 shows a polar plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of part 2000 of the key fob of FIG. Adding a spare key may adversely affect the y polarization, but there is no problem in operation. 23 shows a plot of reflected attenuation vs. frequency of the linearly polarized slot antennas 1502, 1504 of FIG. 20, where S1 and S1 are for the antenna 1502 and S2 and 2 are for the antenna 1504. Is for.

FIG. 24 shows a portion 2400 of the key fob of FIG. 15 with a portion of the metal trim 2402 and a spare key 1508. Adding metal trim 2402 near the spare key 1508 can adversely affect operation, as shown by the plots and curves in FIGS. 25-27. FIG. 25 shows a polar plot of radiant power associated with the x-axis linearly polarized slot antenna 1502 of part 2400 of the key fob of FIG. 24. FIG. 26 shows a polar plot of radiant power associated with the y-axis linearly polarized slot antenna 1504 for some of the key fobs of FIG. 24. 27 shows a plot of reflection attenuation vs. frequency for the linearly polarized slot antenna of FIG. 24, where S1,1 is for antenna 1502 and S2,2 are for antenna 1504. It is a thing. Figures 19, 23, and 27 show that the antenna works well in the frequency range of interest (eg, 2.4-2.8 GHz).

With reference to Part 1500 of FIG. 15, where the full metal trim 1506 is present, the operation of the antenna is further adversely affected, as shown in the plot and curve of FIGS. 28-30. FIG. 28 shows a polar plot of radiated power associated with some 1500 x-axis linearly polarized slot antennas 1502. FIG. 29 shows a polar plot of radiated power associated with some 1500 y-axis linearly polarized slot antennas 1504. FIG. 30 shows a plot of reflection attenuation vs. frequency of linearly polarized slot antennas 1502, 1504, where S1,1 are for antenna 1502 and S2,2 are for antenna 1504. It is a thing.

The y-axis linearly polarized slot antennas 1502 and 1504 are open slot antennas because each of the antennas 1502 and 1504 has an open end. FIG. 31 shows a portion 3100 of a key fob having an open linearly polarized slot antenna 3102, a closed linearly polarized slot antenna 3104, a metal trim 3106, and a spare key 3108. FIG. 32 shows a polar plot of radiant power associated with some 3100 x-axis linearly polarized slot antennas 3102. FIG. 33 shows a polar plot of radiant power associated with some 3100 y-axis linearly polarized slot antennas 3104. FIG. 34 shows a reflection attenuation vs. frequency plot of the linearly polarized slot antennas 3102 and 3104 of FIG. FIG. 34 shows that the antennas measured at ports S2 and S2 do not work well.

When a portable access device has multiple orthogonal antennas as described above, the larger the portable access device compared to the corresponding physical metal key, and the larger the portable access device relative to the palm, the more decorative. Metal trim removal provides improved round-trip time performance. The improved round-trip time performance improves the accuracy of distance determination.

The systems disclosed herein can be operated using many of the methods described herein. Several exemplary methods of determining which antenna combination should be used are shown in FIGS. 35 and 36. 35 and 36 are methods of determining which antenna combination should be used to exchange packets between the vehicle and the RF antenna module (or RF circuit) of the portable access device for round-trip flight time measurements. Is shown. 35 and 37 represent a method from the point of view of an initiator for round-trip flight time measurement. In one embodiment, this is a vehicle. In another embodiment, it is a portable access device. The reflector / responder performs the obvious steps that correspond to the initiator steps of the process. Round-trip flight time measurements can be used to prevent range extender-type relay station attacks, as further described below. FIG. 35 shows an approach of switching antennas between packets. FIG. 36 shows an approach of switching antennas during transmission of packets and / or continuous wave (CW) tones.

The following process will be described primarily with respect to the embodiments of FIGS. 2-6, 11 and 14, but the process may be readily modified for application to the other embodiments of the present disclosure. The process can be repeated.

The method can start at 3500. The following processes can generally be performed simultaneously by the control module 402 in the portable access device 400 and by the modules located in the vehicle, for example by the access module 210, PEPS module 211 and / or PAK module 212 of FIG. .. There are many ways in which the sampled frequency and antenna combination can be selected to identify the best frequency (or channel) and antenna axis. Optionally, at 3501, the module negotiates an initial frequency (or channel) and antenna combination used for frequency and antenna sampling. This step may be negotiated between modules based on prior agreement or post-data, and / or may be commanded by the module based on post-data. At 3502, the frequency (or channel) at which the first (or next) packet is transmitted is selected.

At 3504, an antenna pair for transmitting and receiving packets is selected. Two of the antennas of the RF circuit of the vehicle shown in FIG. 11 and the like. At 3506, the packet is transmitted from the first (or transmit) antenna to the portable access device at the selected frequency. The portable access device measures the transmit RSSI and sends the packet back to the second (or receive) antenna of the selected antenna pair as the first RSSI.

At 3508, the second antenna receives the packet and / or the response to the transmission of the packet, and the first RSSI. At 3512, a second RSSI is measured for the second transmission of the packet. At 3514, a first RSSI and a second RSSI are stored in memory in association with a packet, a selected frequency, and a selected antenna pair.

At 3516, if another antenna pair is selected, process 3504 is performed, otherwise process 3518 is performed. This makes it possible to circulate the replacement of each antenna pair for each selected frequency. Antenna pair swapping can be cycled in pseudo-random and / or predefined order.

At 3518, if another frequency (or channel) is selected, process 3502 is performed, otherwise process 3520 is performed. This allows each frequency (or channel) to circulate. This allows the RSSI of each frequency (or channel) to be determined. Due to multipath fast fading, some frequencies may have lower power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels are circulated in a pseudo-random and / or predefined order to determine the best frequency and / or channel for the transmission of other packets and the best antenna pair. can do.

Optionally, at 3519, after circulating a predetermined, negotiated, and / or agreed set of frequencies and antenna axis pairs, the algorithm is optionally sent to the node (control module) for antenna and / or channel RSSI. The results may be exchanged. The exchange of RF channels allows the module to use heuristics to select the antenna axis used by the module without sharing the antenna RSSI measurements obtained by the module. RF channel exchange allows modules to use heuristics to select channels (frequency) without results from other channels, while modules select channels based on results from channels. May be used. In this case, the algorithms and systems are less susceptible to interference from other nearby transmitters.

At 3520, after circulating a predetermined number of frequencies and antenna pairs, the antenna axis combination and / or frequency (channel) with the best RSSI is selected for transmission of the remaining packets. Optimal is the combination of antenna axes with the highest RSSI. With respect to frequency (or channel), it is best if RSSI is not low and / or RSSI is not high. At 3522, the selected antenna pair and / or frequency (channel) identifier may be encrypted. At 3524, the encrypted selective antenna axis pair and / or frequency (channel) may be transmitted to other nodes. At 3526, the packet is transmitted and the response is received using the selected frequency (channel) and antenna pair. The method may end at 3528.

The following process of FIG. 36 will be described primarily with respect to the embodiments of FIGS. 2-6, 11 and 14, but the process may be readily modified for application to the other embodiments of the present disclosure. The process can be repeated.

The method can start at 3700. The following processes can generally be performed simultaneously by the control module 402 in the portable access device 400 and by the modules located in the vehicle, for example by the PEPS module 211 and / or the PAK module 212 of FIG. Many different techniques can be used to select the combination of frequency and antenna to be sampled to identify the best frequency (or channel) and antenna axis. Optionally, at 3701, the module negotiates a combination of frequency and initial frequency (or channel) and antenna used for sampling the antenna. This step can be negotiated between modules based on prior agreement, post-data, or commanded by the module based on post-data. At 3702, the frequency (or channel) at which the first (or next) packet is transmitted is selected.

At 3704, an antenna pair for transmitting and receiving packets is selected. Two of the antennas of the RF circuit of the vehicle shown in FIG. 11 and the like. At 3706, the packet is transmitted from the first (or transmit) antenna to the portable access device at the selected frequency. The vehicle switches between the arranged sets of antenna axes between the CW tone portions of the packet, with a period of time to maintain the state. The portable access device switches and receives the arranged set of antenna axes within each of the "switching and state-maintaining periods" of each vehicle antenna axis during the period within the CW tone, with the state-maintaining period in between. The RSSI of the swapping of the transmit and receive antenna axes inside is measured, the packet and the first set of measured RSSIs are returned to the vehicle, and between the CW tone parts of the packet, with a period to maintain the state, Toggles the set of negotiated antenna axes for the selected antenna pair.

At 3708, the vehicle receives a packet and / or a response to the transmission of the packet, and a first set of RSSIs. At 3712, a second RSSI is measured for the second transmission of the packet. At 3714, the first RSSI and the second RSSI are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

At 3716, if another packet needs to be transmitted, process 3718 may be performed, otherwise process 3726 may be performed. At 3718, process 3720 is performed if another antenna pair needs to be selected, otherwise process 3724 is performed. This makes it possible to circulate the replacement of each antenna pair for each selected frequency. Antenna pair swapping can be cycled in pseudo-random and / or predefined order.

At 3720, the first transmission of the next packet is initiated using the previous transmit antenna of the previously selected antenna pair.

At 3722, a switch is made between the previous antenna pair and the next selected antenna pair. This can be done during the CW tone of the currently transmitted packet, or between another part of the currently transmitted packet, so that the rest of the packet is the next selected antenna pair. It is transmitted via the transmitting antenna of. Process 3708 may be executed following process 3722.

At 3724, if another frequency (or channel) needs to be selected, process 3704 is performed, otherwise process 3718 is performed. This allows each frequency (or channel) to circulate. This allows the RSSI of each frequency (or channel) to be determined. Due to multipath fast fading, some frequencies may have lower power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels are circulated in a pseudo-random and / or predefined order to determine the best frequency and / or channel for transmission of other packets, and the best antenna pair. can do. At 3725, the antenna and RSSI result values can be exchanged as described above at 3519.

At 3726, after circulating a predetermined number of frequencies and antenna pairs, the antenna combination and frequency and / or channel with the best RSSI is selected for transmission of the remaining packets.

At 3728, the identifier of the selected antenna pair can be encrypted. At 3730, each remaining packet can be encapsulated to include an encrypted identifier or modified to include an encrypted identifier. At 3732, the encapsulated or modified packet is transmitted and the response is received using the selected frequency, channel, and antenna pair. The method may end at 3734.

In the above method, packets transmitted to determine the best frequency, channel, and antenna pair may be discarded. The dropped packet is simply used to measure the RSSI value. In another embodiment, the CW tones are included at the end of the packet and antenna switching is done between these tones. In another embodiment, a predetermined period (eg, 4 μs) is allocated to the replacement of each antenna, the CW tone is included at the end of the packet, and the antenna pair with the best RSSI (or power value) is selected. The selected frequency, channel, and / or antenna pair may be modified if another nearby network device is transmitting and / or receiving data in the same frequency range. In one embodiment, between the methods of FIGS. 35 and 36, the pattern in which the frequency is selected is known and shared between the vehicle access module and the portable access device.

Processes 3526 and 3732 allow the portable access device, detect a range extender type relay station attack by the portable access device, provide access to the vehicle, and / or perform other PEPS system and / or PAK system operation. Can be run to run. As an example, a packet is sent to authorize a portable access device and provides access to the interior of the vehicle when it is determined that the portable access device and / or the corresponding user is authorized to access the vehicle. Can be done. This may include permitting the operation of the vehicle. A packet may be sent to make a flight time measurement that includes the time to send the packet to the portable access device and the time to respond and receive the corresponding response from the portable access device. Based on the measured flight time values, the vehicle access module (eg, PEPS module or PAK module) can determine whether the portable access device is attempting to perform a range extender type relay station attack. If the portable access device is attempting to carry out a range extender type relay station attack, the access module will take one or more measures, including preventing access to the vehicle. Countermeasures may include notifying the vehicle owner of a range extender type relay station attack. This can be done, for example, by text message or email sent from the access module to one or more network devices of the owner. One or more warning signals may be generated and may notify the central monitoring station and / or authorities of the attack.

FIG. 37 shows flight time measurement Figure 3800 including start / measurement device 3802 and reflection (or response) device 3804. The start / measurement device 3802 sends a radio message (eg, a packet) to the reflection device 3804, and the reflection device 3804 responds to the radio message and returns the radio message back to the start / measurement device 3802. The flight time (or total time to send and receive these signals) is equal to the sum of (T2 _- T1), ₍ T3 _- T2) _, and ₍ T4 _- T3), where. T2 _- T1 is the length of time that the radio message is transmitted from the start _/ measurement device 3802 to the reflection device 3804, and T3 _- T2 is the length of _time for the reflection device 3804 to respond. T ₄ -T ₃ is the length of time that the radio message is transmitted from the reflection device 3804 to the start / measurement device 3802. An exemplary average flight time and distance calculation can be performed according to Equations 1-4, where distance refers to the distance between the start / measurement device 3802 and the reflection device 3804.

When the time of the response time T ₃ − T ₂ is measured by using the timer, the amount of timing information may be reduced in order to correct the fine adjustment information measured in relation to the response time. If the initiator is not aware of this time length, time T ₃ -T ₂ may be reported to the initiator.

FIG. 38 shows an exemplary BLE radio 3900 equipped with a superheterodyne receiver 3902 and a transmitter 3904. The BLE radio 3900 may be used, for example, as one of the transceivers 222 of FIG. 3 and may include or be part of one of the RF antenna module 40 and the RF circuit 223. In another embodiment, the BLE radio 3900 is used as a transceiver for a portable access device, such as the transceiver 410 for the portable access device 400 of FIG. The superheterodyne receiver 3902 uses frequency mixing to convert the received signal to a fixed intermediate frequency (IF). The superheterodyne receiver 3902 includes an RF (eg, bandpass) filter 3906, a switch balun 3908, a low noise amplifier 3910, a downconverter 3912, a bandpass filter amplifier 3914, an analog-to-digital converter 3916, a demodulator 3918, and Includes Correlation Protocol Module 3920. The transmitter 3904 includes a processing module 3922, a protocol module 3924, a Gaussian frequency shift keying (GFSK) modulator 3926, a digital-to-analog converter / lowpass filter 3928, an upconverter 3930, and a power amplifier 3932. The crystal oscillator 3934 can generate one or more clock signals, which can be distributed to the devices 3914, 3916, 3918, 3920, 3922, 3924, 3936, 3938, and the phase lock loops 3940, 3942. As an example, the processing module 3922 and the correlation protocol module 3920 may be implemented as a single module as part of one or more of the modules 204, 210, 211, 212 of FIG. The process performed by modules 3922 and 3920 may be performed by any one of modules 204, 210, 211, 212 of FIGS. 3 and 4. One or more of the devices 3906, 3908, 3910, 3912, 3914, 3916, 3918, 3920, 3924, 3926, 3928, 3930, 3932, 3934, 3936, 3938, 3940, and 3942 as part of the RF circuit 223. And / or may be implemented as part of one or more of modules 204, 210, 211, 212.

The bandpass filter 3906 can be connected to a linearly polarized wave antenna and / or a circularly polarized wave antenna (specified by 3907). The downconverter 3912 downconverts the received signal from the RF frequency to the IF frequency based on the signal from the phase lock loop 3942. The upconverter 3930 upconverts the IF signal to an RF signal based on the signal from the phase lock loop 3940.

The GPSK modulator 3926 and demodulator 3918 can modulate and demodulate the bits of the signal according to the GFSK protocol. FIG. 39 shows an exemplary GFSK parameter definition plot including a plot of transmit carrier frequency Fc showing zero crosspoint and error. As an example, the transmission carrier frequency Fc is ± 250 kHz or ± 500 kHz, the symbol time is 1 μs or 0.5 μs, and the zero cross error is 1/8 (1 Mbps) of 1 μs or 1/8 (2 Mbps) of 0.5 μs.

FIG. 40 shows a functional block diagram of the system 4100 for transmitting BLE packets. An exemplary format of BLE packet 4101 is shown that includes a preamble, access address, protocol data unit (PDU), and cyclic redundancy check (CRC) bit field. This is an example of a packet that can be received by the Correlation Protocol Module 3940 in FIG. 38 and / or can be generated by the Processing Module 3922 and / or the Protocol Module 3924.

The packet preamble is AA or 55 such that the last bit of the preamble is different from the first bit of the access address. The access addresses of the peripheral and central devices 4102 and 4104 are the same. Sensor 4106 can be used to monitor packets. The access address is the same for each packet and each connection interval. The access address follows the BLE access address rule. Packets within the same connection interval are in the same RF channel. FIG. 41 shows an example of the preamble and access address of the BLE 1M packet and the BLE 2M packet. Since the preamble is a plurality of A's and a plurality of 5's (AA or 55 at 1 mbit / s, AAAA or 5555 at 2 mbit / s), the last bit of the preamble is different from the first bit of the access address. This is indicated by the bits in circle 4200.

The access address of the advertisement channel packet may be 10011101100010011011111011011010b (0x8E89BED6). Each link-layer connection between any two devices and each periodic advertisement has a different access address. The access address can be a 32-bit value. Whenever a new access address is needed, the link layer can generate a new random value that meets the following rules: The access address is not the address of an existing link layer connection on the corresponding network device. The access address is not a valid periodic advertising address, does not have six consecutive 0s or 1s, is not an advertising channel packet access address, is not a sequence that differs by one bit from the advertising channel packet access address, and is Does not include 4 equal octets. There are 24 or less changes in the access address. The seed of the random number generator is from a physical entropy source and has at least 20 bits of entropy. If the random number of the access address does not meet the above rule, a new random number will be generated until the rule is met. In the case of the embodiment that also supports the BLE coded physical layer (PHY), the access address may have at least 3 1s in the least significant 8 bits and 11 or less changes in the least significant 16 bits. In a normal BLE packet, the preamble may reveal the first bit of the access address, and then the access rule may reveal the next bit of the access address (eg, 6 or less consecutive 0s or 1s). This can pose a security issue for ranging because an attacker can predict the bit, which is mitigated or eliminated by the embodiments disclosed herein.

FIG. 42 shows an exemplary plot of BLE packet signals showing the corresponding bits. The first BLE signal 4300 represents a bitstream from the protocol module 3924 of FIG. If the bits remain the same, normal BLE packets will not return to the carrier (or midpoint level). This is called non-regression to zero recording. The bits corresponding to the first plot are shown above the plot. The second BLE signal 4302 represents a bitstream from the GFSK modulator (or Gaussian filter) 3926. The Gaussian filter adds a 1/2 bit time lag and gives a little time during the transition. The bits corresponding to the second BLE curve are shown below the second BLE curve. As an example, the carrier frequency can be 2.402 GHz and the BLE packet signal can vary in frequency between 2.402250 GHz and 2.401750 GHz.

FIG. 43 shows an exemplary plot of a BLE packet signal showing the corresponding bit of a stronger BLE packet signal (eg, a BLE packet signal with a larger RSSI) transmitted at a faster edge after leading edge sensing. The first BLE signal 4400 represents a bitstream from the protocol module 3924 of FIG. The second BLE signal 4402 represents a bitstream from the GFSK modulator (or Gaussian filter) 3926. The third BLE signal 4404 represents a stronger BLE packet signal transmitted at a faster edge after Gauss bit leading edge sensing. The third BLE signal 4404 may be generated by the attacking device. As can be seen, the edges are beveled and transition faster than the transition of the second BLE curve 4402. This causes the corresponding bit to be faster than the bit in the second plot (or the output of the GFSK modulator 3924). Areas where differences can be detected are indicated by the elliptical 4406. The bits corresponding to the first BLE curve 4400 are shown above the first BLE curve 4400. The bits corresponding to the second BLE curve 4402 are shown below the second BLE curve 4402. The bits corresponding to the third BLE curve 4404 are shown below the bits of the second BLE curve 4402 and are shifted to the left with respect to the bits of the second BLE curve 4402.

44 shows the second and third BLE curves 4402 and 4404 of FIG. 43, where the third BLE curve 4404 is shifted with respect to the second BLE curve 4402. To protect against bit-acceleration attacks, the following processing can be performed. A bit-accelerated attack involves the attacking device receiving, processing, and / or modifying and forwarding BLE signals, such as BLE signals transmitted from key fobs and / or other portable access devices. It refers to when the attacking device accelerates the transmission of the BLE signal in consideration of the delay. FIG. 45 shows an example of a method for detecting a range extension type relay attack. The following process of FIG. 45 will be described primarily with respect to the embodiments of FIGS. 2-6, 11 and 14, but the process may be readily modified to apply to the other embodiments of the present disclosure. The process can be repeated. The following processing may be performed, for example, by one or more of modules 210, 211, 212.

The method can start at 4600. In 4602, a sliding correlation function is used to match the received input waveform to an ideal Gaussian waveform (or other suitable predetermined waveform) with a known bit pattern and bit rate, and is predetermined with the received input waveform. Scale the peaks of the waveform and adjust the zero offset. This can be done by the correlation protocol module 3920 of FIG. This can be done, for example, to identify a synchronous access word. An example of this is shown in FIG.

At 4604, some (or partial) 4605 of the received waveforms that occur earlier in time after the zero cross of a given waveform and before the next peak are integrated and accumulated (or summed). This is called positive accumulation.

At 4606, a portion (or partial) of the received waveform that occurs later in time, after the peak and before the next zero cross, is integrated and accumulated. This is also called positive accumulation.

At 4608, the resulting cumulative values determined at 4604 and 4606 are averaged over the number of transitions used to provide an indicator of the level of bit-accelerated attacks. Cumulative values may be averaged separately to provide two mean values, or they may be summed and then averaged to provide one mean value.

At 4610, it is determined whether an attack has been made and / or is likely to have been made based on one or more averages and one or more predetermined thresholds. In 4612, if the attack was and / or is likely to be done, the process 4614 is executed, otherwise the process 4616 is executed. At 4614, measures such as one of the aforementioned measures, including prevention of access to and / or operation of the corresponding vehicle, are implemented. One or more alerts may be generated. As another example of countermeasures, data related to the attack may be stored in memory and / or sent to the vehicle owner's network device and / or central monitoring station. In 4616, access to and / or motion control of the vehicle is permitted when the attack has not been made and / or is likely not made. Motion control may include, for example, unlocking or locking the vehicle door, remote starting of the vehicle engine, adjustment of vehicle internal environmental control, and the like. At 4618, one or more averages may be discarded and / or integrated and accumulated old data may be discarded. If a sliding window is used to monitor the received signal, the old part of the data is discarded and the more recent part is maintained for the purpose of subsequent integration, accumulation, and averaging with the newly received data. May be done.

FIG. 46 shows a vehicle 5200 including a round-trip time (RTT) responder 5202 and an RTT initiator 5204, and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210. As used herein, "initiator" refers to a network device that includes a BLE radio, transmitter, and / or receiver, and can initiate a signal or tone exchange. As used herein, "responder" refers to a network device that includes a BLE radio, transmitter, and / or receiver, and can respond to signals and / or tones received from the initiator. The RTT responders 5202, 5210 and RTT initiators 5204, 5208 may be implemented, for example, by the RF antenna module 40, RF circuit 223, and / or modules 210, 211, 212 of FIG. 3 and include corresponding transmit and receive circuits. can. The vehicle 5200 may include an antenna module with a single circularly polarized antenna, as described above. The RTT responder 5202 and the RTT initiator 5204 can transmit and receive using an antenna. The antenna is at least one polarization in which at least one of the described antennas of the vehicle 5200 is not cross-polarized and not co-polarized with at least one polarization axis of the antenna of the portable access device 5206 at any given time. Using the antenna used by the RTT Initiator 5208 and the RTT Responder 5210 (eg, a single polarized antenna) to have an axis, the antenna provides polarization diversity.

Devices 5202, 5204, 5208, and 5210 each include the control modules described above and are capable of performing any of the processes described. Devices 5202, 5204, 5208, and 5210 can send and receive RF signals over random channels (eg, 40 BLE channels over a spectrum of 80 MHz). Devices 5202 and 5208 can communicate with each other, including transmission and reception of signals, while devices 5204 and 5210 can communicate with each other, including transmission and reception of signals. Communication between devices 5202 and 5208 can be performed simultaneously with communication between devices 5204 and 5210. The transmission of signals to determine RTT may be transmitted bidirectionally at the same time for security reasons and for attack detection. Devices 5202 and 5204 can share the frequency of communication with the portable access device 5206. The frequencies are shown in predetermined order and may be followed by devices 5202, 5204, 5208, 5210. When a bandpass filter is used to monitor two channels simultaneously, the filter causes propagation delay.

The delay of a typical bandpass filter is 0.5 (ie, 0.5 / bandwidth) relative to the bandwidth. The channel spacing of the protocol, the randomness of the channel selection, the randomness of the transmission direction over time, and the simultaneous transmission have the bandpass filter a bit with a large group delay compared to the measurable round-trip time delay. Force to detect. This makes it even more difficult for the attacking device to perform a range extension type man-in-the-middle attack. The vehicle 5200 and the portable access device 5206, respectively, are wide enough for, for example, an attacking device to receive a signal to relay with a sufficiently short delay, but not wide enough to analyze the signal. The transmission power level and transmission channel interval can be set so that it is not feasible to have a filter.

In one embodiment, a signal is transmitted to measure the direct flight time and whether there is a predetermined amount of delay (eg, 10-500 nanoseconds (ns)) that is often associated with range extender type attack devices. To determine. When a range extender type attack device relays a signal between the vehicle 5200 and the portable access device 5206, the transmitted signal may be delayed by a predetermined amount. The described bidirectional and simultaneous transmission and reception make it difficult for the attacking device to determine the frequency, channel, and direction of the signal transmitted at any given time. It is also difficult to prevent the attacking device from relaying the signal without a predetermined amount of delay.

FIG. 47 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210. FIG. 47 shows a signal path through the corresponding antennas 5300, 5302, 5304, 5306. In one embodiment, the antennas 5300 and 5302 have a total of three polarizations and the antennas 5304 and 5306 have a total of two polarizations. In another embodiment, the antennas 5300 and 5302 have a total of two polarizations and the antennas 5304 and 5306 have a total of three polarizations.

FIG. 48 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210, and a range extension type relay attack device 5400. The range extension attack device 5400 has a control module 5402 including a bandpass filter 5404, a bit signal direction detector 5406, and a bit acceleration attack module 5408. Bandpass filter 5404 is used to detect the input bits, but has an associated delay time. The bit signal direction detector 5406 determines the direction in which the bit is moving (eg, from vehicle to portable access device, or from portable access device to vehicle). The Bit Acceleration Attack Module 5408 can detect a symbol (or bit) using a sliding correlation function that averages the shape of the symbol (or bit) across multiple symbols (or bits) and matches it to the ideal waveform. Bits cannot be accelerated without introducing a delay time in part of. The described delay time can be detected by the vehicle's access module when deciding whether an attack is taking place.

As shown, the range extension attack device 5400 includes an amplifier 5410 such as a low noise amplifier (LNA) and a power amplifier for reception and transmission purposes. The range extension attack device 5400 may also include a mixer for down-conversion and up-conversion purposes. The amplifier 5410 is connected to the antenna 5412.

In addition to performing the described communications simultaneously, channels can be pseudo-randomly selected and access addresses can also be pseudo-randomly selected. This random selection is made in the vehicle and can be pre-shared with portable access devices. Conversely, the selection may be made on a portable access device. Conversely, the selection may be made by a secure cryptographic technique with key material from either or both devices that contributes to the sequence of pseudo-randomly selected channels and / or the sequence of access addresses. .. In this case, the pseudo-random sequence of access addresses serves as a sequence of cryptographically secure bits exchanged for round-trip timing measurements. When the response is on the same channel as the initiator and the response access address is not the same as the initiator access adrel, the simultaneous send / receive operation is performed on the random channel with the randomly selected access address. The range extension attack device is difficult to perform an attack without being detected by the vehicle access module and / or the control module of one or more portable access devices. The range extension attack device eavesdrops on all channels in both directions at the same time, determines in which direction the message passes through the range extension attack device, and detects a bit early to detect the vehicle and one or more. In order to convince the initiator of a portable access device, the bit must be transmitted in both directions early and at the appropriate time. The range extension attack device convinces the vehicle and the initiator of one or more portable access devices that the portable access device is closer than it really is and at an appropriate distance from the vehicle to access and / or control the movement of the vehicle. You need to get permission. Also, by using a Gaussian filter for the BLE bit, the attacking device has a small window of about 10-100 ns less than the early bit detection time that can be used to detect the bit and transmit the bit early.

In one embodiment, the RF signal associated with the simultaneous communication described above is monitored by modules 210, 211, 212 of FIG. 3, and the initiators and responders described are the RSSI value and antenna polarization state of the signal (eg, transmission). The degree of polarization between the antenna and the receiving antenna) is monitored and / or determined. Based on RSSI values and polarization, one or more modules 210, 211, 212 determine the best path, frequency, channel, and antenna pair for communication. Signals related to the shortest path (or least interference), best RSSI value, maximum polarization, etc. are used to indicate which path, frequency, channel, and antenna pair should be used. This information can also be used to determine which device sends and which device receives at any given time. The selection of transceiver chips and channels on each device may be randomized. In one embodiment, one device (of a vehicle or portable access device) can transmit while the other device is not transmitting, but rather receiving. Then, this role is alternated, and as a result, the second device is transmitting, and the first device receives while not receiving.

Many of the above and below techniques monitor, generate, receive, transmit, and / or measure various parameters in the vehicle access module, and based on this information, range extension type relay attacks. However, those techniques include controlling modules (or other modules) of portable access devices, such as any portable access device disclosed herein, in part or in whole of their processing. Can be modified to run in. Similarly, various processes are described as being performed on a portable access device, but these processes may be performed on the vehicle access module.

Examples of various BLERF transmission frequencies are 2.41 GHz (GHz), 2.412 GHz, 2.408 GHz, and 2.414 GHz. These and other frequencies may be used by the RTT initiator and responder and / or the corresponding transmitter and receiver.

In one embodiment, the vehicle and / or other transmitter of the portable access device is used to lightly load one or more channels and detect the RF signal transmitted by the initiator and responder to the attacking device. You can force it to have a narrow lowpass filter. The one or more channels may include or be close to the channels used by the initiator and responder. The signal transmitted on one or more channels may be a dummy signal.

FIG. 49 shows two BLE radios 3900 (denoted as 3900A and 3900B). The first BLE radio 3900A functions as a start / measurement device. The second BLE radio 3900B functions as a reflection (or response) device. The start / measurement device 3900A is the RTT of the packet transmitted from the first BLE radio 3900A to the second BLE radio 3900B, the time when the second BLE radio responds, and the packet is the second BLE radio. The time transmitted from the 3900B to the first BLE radio 3900A can be measured. In another embodiment, the RTT sends a packet from the processing module 3922A of the first BLE radio 3900A to the correlation / protocol module 3920B of the second BLE radio and from the processing module 3922B or the protocol module 3924B to the demodulator 3918a. Or includes time to return to Correlation Protocol Module 3920A. This can be done from the processing module 3922A via the protocol module 3924A, GFSK modulator 3926A, D / A lowpass filter 3928A, upconverter 3920A, power amplifier 3932A, switch balun 3908A, and bandpass filter 3906A. Correlation protocol module to BLE radio 3900B and via bandpass filter 3906B, switch balun 3908B, low noise amplifier 3910B, downconverter 3912B, bandpass filter amplifier 3914B, A / D3916B, and demodulator 3918B. Measuring the travel time to 3920B may be included. The time to move from the demodulator 3918B or the correlation protocol module 3920B to the protocol module 3924B or the processing module 3922B can also be determined. From protocol module 3924B or processing module 3922B, GFSK modulator 3926B, D / A lowpass filter 3928B, upconverter 3930B, power amplifier 3932B, switch balun 3908B, bandpass filter 3906B, 3906A, switch balun 3908A, low noise amplifier. Time may also be determined via the 3910A, downconverter 3912A, bandpass filter amplifier 3914A, A / D3916A, and demodulator 3918A, or the correlation protocol module 3920A. The BLE radio 3900A is described as an initiator and the BLE radio 3900B is described as a responder, but the processing roles are switched so that the BLE radio 3900B is an initiator and the BLE radio 3900A is a responder. Can be done.

The following process performs an RTT between two BLE radios in the vehicle (eg, BLE radios 3900A, 3900B in FIG. 49) and / or between the BLE radio in the vehicle and the BLE radio in the portable access device. Can be done to determine exactly. The processing is performed to prevent an attack and / or to easily detect when and / or already have been performed. The following processes may be executed separately or in any combination. In one embodiment, a large number of packets are exchanged between the BLE radios. The initiator can measure and / or estimate the RTT of the signal transmitted between the BLE radios. This includes the time T1 when the packet is transmitted from the first BLE radio to the second BLE radio, the time T2 when the second BLE radio responds, and the second BLE radio first sends the packet. The time T3 for returning to the BLE radio and the time T4 for the first BLE radio to receive a packet from the second BLE radio may be included.

In one embodiment, the A / D and D / A clocks of the BLE radio and / or phase lock loop are dithered between packets. In addition to dithering the clock where possible, cryptographically random variations may be added, for when the least significant bit (LSB) generated by the digital timer is transmitted. , BLE radio was known. Cryptographically random variability is used so that the attacking device cannot predict the exact moment when the transmission occurs.

In one embodiment, each packet contains a previously agreed large, eg, 16-256, encrypted, random, multi-bit identifier (PACRMBI). In another embodiment, the packet bit content from the initiator and the packet bit content from the responder are indistinguishable to the attacking device. The attacking device cannot determine from which direction the packet came from, or whether the packet is an initiator packet or a responder packet, based on the bit content of the packet.

In one embodiment, the channels of the BLE radio are cryptographically randomized. In one embodiment, the determination of which of the BLE radios is the initiator or responder is cryptographically randomized. In one embodiment, either or both of the BLE radios transmit a dummy packet in which the attacking device is indistinguishable from the other packets transmitted by the BLE radio. The choice of which BLE radio sends the dummy packet is cryptographically randomized and can be switched randomly. This makes it difficult for the attacking device to determine which is a valid packet and in which direction the packet is being transmitted between the BLE radios.

In one embodiment, the polarization of the antenna set used by the BLE radio is initially cryptographically randomized. A heuristic method is used to select which antenna sequence provides the best "antenna-channel" for the entire set of channels between BLE radios. This involves using heuristic techniques to select higher received signal strength, correcting antenna gain for frequency and monitoring across multiple channels, and using the combination of antennas with the highest average or intermediate power. And / or using a Rayleigh fading estimator or a Kalman filter estimator. This allows cryptographically random antenna patterns to be reduced and focused on "antenna-channels" with maximum power and minimum cross-polarization.

In one embodiment, the in-phase and orthogonal phase (IQ) stream at the receiver is an IQ stream with an idealized upsampled IQ stream that matches PACRMBI, one corresponding in the BLE radio. Correlation-Upsampled (or interpolated) before being sent to the protocol module. As an alternative to using PACKRMBI, the transmitted message may be encrypted, bit-decoded upon reception, and converted into an ideal upsampled IQ stream. Two upsampled streams can be sent via the Correlation Protocol Module 3920, which monitors upsampled clock edges for which there is sufficient correlation to match that of PACRMBI. Can be done. The Correlation Protocol Module 3920 selects the maximum edge of the matching clock edge. Other clock recovery methods may be used to interpolate the subbit timing in the round trip timing of the bitstream of the communication channel. This can be done in combination with upsampling correlation or in combination with regular clock sampling.

In one embodiment, the amplifier settings are communicated between the BLE radios. The amplifier settings are sufficient to compensate for any frequency or amplifier gain variation in propagation delay between BLE radios.

In another embodiment, the measured die temperature within the BLE radio is communicated (or shared) between the BLE radios to produce any temperature-based frequency or amplifier gain variation in propagation delay between the BLE radios. Compensate.

Another process that can be performed is to communicate balun variations between BLE radios. Another process is to add a short (eg, 6 μs) but cryptographically random length (eg, 4-8 μs) continuous wave tone to the packet pair to perform reciprocating timing measurements while simultaneously performing tone exchange ranging. Is to do.

FIG. 50 shows a position / distance determination system 5600 including an RTT initiator 5602, an RTT responder 5604, and an RTT sniffer 5606. The RTT Initiator 5602 and the RTT Responder 5604 may function as any of the initiators, responders, BLE radios, RF circuits disclosed herein. The RTT sniffer 5606 can be placed in the vehicle together with one of the RTT devices 5602, 5604 and can include one of the antenna modules 40 of FIG. 2, while the RTT device in the vehicle is the antenna module 40. Includes the other one. Devices 5602, 5604, 5606 each include the control modules described above and are capable of performing any of the processes described. The polarization diversity described above is provided between the antennas of the RTT devices 5602, 5604 and between the antennas of one of the RTT devices 5602 and 5604 in the vehicle and the RTT sniffer 5606. Polarization diversity is especially useful when performing reciprocating timing measurements. Each of the RTT devices 5602, 5604 can include a single circularly polarized antenna.

One of the RTT devices 5602, 5604 in the vehicle is called a master device, while the other one of the RTT devices 5602, 5604 is called a slave device. When the master device sends the challenge signal to the slave device, the RTT sniffer 5606 acts as a listener: (i) when the challenge signal was sent and / or when the challenge signal was received by the RTT sniffer 5606, and (ii) the slave device. Detects when the response signal to the challenge signal was transmitted and / or when the (iii) RTT sniffer 5606 received the response signal. The RTT sniffer 5606 can then use triangulation based on the transmission and / or reception time of the challenge signal and the transmission and / or reception time of the response signal to determine the position of the slave device. The master device can also measure the round-trip timing associated with the challenge and response signals to measure the direct path between the antennas instead of the bounce path. This prevents the nulls of the antennas from being aligned and cross-polarization.

The master device and the RTT sniffer 5606 work together to estimate the distance to the slave device. Equations _5-7 below are executed by the master device to determine the length of time the challenge signal is transmitted from the master device to the slave device, where the _TSM is where the response signal is transmitted from the slave device to the master device. _TRX is the time for the response signal to be received by the master device, _{TTX is the time for the challenge signal to be transmitted from the master device, and T SDELAY is} the time after receiving the challenge signal. , The length of the delay time until the slave device responds with the response signal, and FixedOffset ₁ is the length of the first offset time, which can be 0 or more.

The RTT sniffer 5606 transmitted a response signal when the challenge signal was received by the RTT sniffer 5606, when the response signal was received by the RTT sniffer 5606, and when the slave device received the challenge signal. We know the number of slave clock cycles between and. The RTT sniffer 5606 (or listener) uses Equation 8 to determine the difference between the time T _SLRX when the RTT sniffer 5606 receives the response signal and the time TMLRX when the RTT sniffer ₅₆₀₆ receives the challenge signal. Here, T _SL is the length of time it takes for the RTT sniffer 5606 to receive the response signal, and FixedOffset ₂ is the length of the second offset time, which can be 0 or greater. T _ML is the length of time it takes for the RTT sniffer 5606 to receive the challenge signal, T _SLRX is the time it takes for the RTT sniffer 5606 to receive the response signal, and T _MLRX is the time it takes for the RTT sniffer 5606 to receive the challenge signal. It is time to receive the signal.

ＲＴＴスニファ５６０６でのチャレンジ及びレスポンス信号の到達時間を測定し、この情報をＲＴＴスニファ５６０６とマスターデバイスとの間で共有することによって、車両とスレーブデバイスとの間の距離を推定することができる。距離は、例えば、マスターデバイスが、到達時間及び既知の時間Ｔ_ＭＳ、並びに対応する既知の信号伝送速度を使用することによって推定することができる。チャレンジ信号のＲＴＴは、測定された到達時間に基づいて決定することができる。次いで、距離は、ＲＴＴ及び既知の信号伝送速度に基づいて決定することができる。 Since the master device and the RTT sniffer 5606 work together, information is shared so that one or more of these devices can estimate the distance to the slave device based on equations 9-11. The sum of T _MS and T _SL can be replaced to provide equations 9-11.

By measuring the arrival time of the challenge and response signals on the RTT sniffer 5606 and sharing this information between the RTT sniffer 5606 and the master device, the distance between the vehicle and the slave device can be estimated. The distance can be estimated, for example, by the master device using the arrival time and known time _TMS , as well as the corresponding known signal transmission rate. The RTT of the challenge signal can be determined based on the measured arrival time. The distance can then be determined based on the RTT and known signal transmission rates.

FIG. 51 shows another position / distance determination system 5700 including an RTT initiator 5702, an RTT responder 5704, and a plurality of RTT sniffers 5706. The RTT Initiator 5702 and the RTT Responder 5704 may function as any of the initiators, responders, BLE radios, or RF circuits disclosed herein. The RTT sniffer 5706 is deployed in the vehicle with one of the RTT devices 5702, 5704 and includes an antenna module (similar to the antenna module 40 in FIG. 2). Devices 5702, 5704, 5706 each include the control modules described above and are capable of performing any of the processes described. The RTT device in the vehicle can also include an antenna module similar to the antenna module 40 of FIG. Polarization diversity is provided between the antennas of the RTT devices 5702, 5704 and between the antennas of one of the RTT devices 5702, 5704 and the RTT sniffer 5706 in the vehicle. Polarization diversity is especially used when performing round-trip timing measurements to measure the direct path between antennas rather than the bounce path. This makes it possible to align the nulls of the antennas and prevent cross-polarization.

One of the RTT devices 5702, 5704 in the vehicle is called a master device, while the other one of the RTT devices 5702, 5704 is called a slave device. When the master device sends the challenge signal to the slave device, the RTT sniffer 5706 acts as a listener to detect when the challenge signal was sent and when the slave device sent the response signal to the challenge signal. .. The RTT devices 5702, 5704 can operate in the same manner as the RTT devices 5602, 5604 of FIG. Each of the RTT sniffers 5706 can operate in the same manner as the RTT sniffer 5606.

The time TAB is the length of time that the challenge signal is transmitted from the RTT initiator 5702 to the RTT responder 5704. Time TBA is the length of time that the corresponding response signal is transmitted from the RTT responder to the RTT initiator. The time TAC is the length of time that the first RTT sniffer receives the challenge signal. The time TBC is the length of time that the first RTT sniffer receives the response signal. The time TAD is the length of time that the second RTT sniffer receives the challenge signal. The time TBD is the length of time that the second RTT sniffer receives the response signal. The time TAE is the length of time that the third RTT sniffer receives the challenge signal. The time TBE is the length of time that the third RTT sniffer receives the response signal. If the TAB and TAC are known, the TBC can be calculated. If the TAB and TAD are known, the TBD can be calculated. If the TAB and TAE are known, the TBE can be calculated.

式１８－２１は三辺測量式である。

４つの式を４変数で置き換えると、式２２～２５が得られる。

If you have enough RTT sniffers, you can calculate the time TAB. For example, if the three RTT initiators know the position of the RTT initiator with respect to the master device (or initiator), then the time TAB can be calculated. This can be achieved using equations 12-17, assuming that all reflections are momentary, where TRxAC is the time at which the first RTT sniffer receives the challenge signal. Yes, TRxBC is the time for the first RTT sniffer to receive the response signal, TRxAD is the time for the second RTT sniffer to receive the challenge signal, and TRxBD is the time for the second RTT sniffer to receive the response signal. TRxAE is the time for the third RTT sniffer to receive the challenge signal, TRxBE is the time for the third RTT sniffer to receive the response signal, and deltaRxAtC is the time for the first RTT sniffer. Is the time difference between the time when the response signal is received and the time when the first RTT sniffer receives the challenge signal, and deltaRxAtD is the time when the second RTT sniffer receives the response signal and the second RTT. The time difference between the time when the sniffer received the challenge signal and the time when the third RTT sniffer received the response signal and the time when the third RTT sniffer received the challenge signal. Is. The position of the slave device (or responder) can also be determined using equations 18-25. Here, xa is the x-coordinate of the master device, ya is the y-coordinate of the master device, za is the z-coordinate of the master device, xb is the x-coordinate of the slave device, and yb is the y-coordinate of the slave device. zb is the z-coordinate of the slave device, xc is the x-coordinate of the first RTT sniffer, yc is the y-coordinate of the first RTT sniffer, and zc is the z-coordinate of the first RTT sniffer. Yes, xd is the x-coordinate of the second RTT sniffer, yd is the y-coordinate of the second RTT sniffer, zd is the z-coordinate of the second RTT sniffer, and xe is the third. It is the x-coordinate of the RTT sniffer, yes is the y-coordinate of the third RTT sniffer, and ze is the z-coordinate of the third RTT sniffer. The x, y, z coordinates of the master device and the slave device are known, and the x, y, z coordinates of the slave device are determined. TBC, TBD, and TBE can be determined in the same manner as described above.

Equation 18-21 is a three-sided survey equation.

Replacing the four equations with four variables gives equations 22-25.

When three RTT sniffers (eg, the RTT sniffer 5706 shown) are used, 3 to measure and position the distance of one of the RTT devices 5702, 5704 and / or the slave device to the corresponding vehicle. You can use one circle to perform a three-sided survey. This can be done with a master device and / or one or more RTT sniffers. The information determined by the master device and the RTT sniffer can be shared with each other. Time, distance, and / or position are determined and can be updated on a regular basis.

In the vehicle, if an object (eg, the head of a vehicle occupant) is present near and / or between the master device and one or more RTT sniffer antenna modules so that the object interferes with the signal transmitted by the master device. , Round-trip timing measurements may be updated on a regular basis. This can be done to measure the distance between the master device and the RTT sniffer and to detect when the corresponding physical environment / system has changed.

FIG. 52 shows a first network device (or vehicle) 5800 and a second network device (or portable network device) 5802. The first network device 5800 includes a tone exchange responder 5804 and a tone exchange initiator 5806. Tone exchange is also called unmodulated carrier tone exchange. The second network device 5802 includes a tone exchange initiator 5808 and a tone exchange responder 5810. The device 5804, 5806, 5808, 5810 may be implemented as any of the other BLE radios, RF circuits, initiators, responders, etc. disclosed herein. At least one of the devices 5804 and 5808 and at least one of the devices 5806 and 5808 may include or be connected to a single polarized and circularly polarized antenna. Devices 5804, 5806, 5808, 5810, respectively, can include the antenna module 40 of FIG. 2 and / or the antenna shown in FIG.

Tone exchange can be performed between the responder 5804 and the initiator 5808, and between the initiator 5806 and the responder 5810. The RTT measurement may be transmitted in the same packet as the exchanged tone. Devices 5804, 5806, 5808, 5810 can randomly select the channel used to send the packet. The packet can be transmitted at the same time as the packet is received. For example, the initiator 5808 can transmit the tone to the responder 5804 on the first channel while the initiator 5808 receives the tone from the responder 5804 on the second channel. The initiator 5806 can transmit and / or receive the tone while the initiator 5804 transmits and / or receives the tone.

The network devices 5800, 5802 may be pre-synchronized, for example, via sequence signal exchange (or handshake) to synchronize the clocks of the network devices 5800, 5802. This synchronization may be performed to allow network devices to send signals to each other at the same time. As an example, two 1 MHz signals can be transmitted, each transmitting data at 1 Mbps. The signals can be 2 MHz apart from each other. This prevents the attacking device from being able to perform attacks such as range extension attacks and attacks that include active manipulation of tones. If an attacker uses a 1 MHz wide bandpass filter, the delay time of the bandpass filter will be long, and the attacker will not respond fast enough to be able to make an attack. When an attacker uses a wideband bandpass filter, such as a 4MHz bandpass filter, the corresponding signal eye diagram is too noisy to discern the signal transmitted by the network devices 5800, 5802. As another example, the signal may be transmitted from the network device at a symbol transmission rate of a predetermined time length (eg, 1 μs per symbol) or less. This enables rapid transmission and prevents attacks. Also, two simultaneous signals require the attacker to detect and influence both signals, further hindering the attacker's success. As mentioned above, both signals may be transmitted at different frequencies by the same network device or different network devices.

Devices 5804, 5806, 5808, 5810 change the frequency of the transmitted tone, monitor the phase change due to the frequency change, and determine the distance between the network devices 5800, 5802 based on the phase change. Can be done. This is sometimes referred to as carrier phase-based ranging. Alternatively, if the signal is transmitted or received as a result of the signal being reflected back to the source, the phase difference between the transmitted and received signals is used to determine the modulo of the distance between the source and the reflector. can do. Similarly, the initiator is between the initiator and the responder based on the phase difference between (i) the signal transmitted from the initiator to the responder and (ii) the corresponding response signal returned from the responder to the initiator. The modulo of the distance can be determined. The gradient of the phase difference with respect to the amount of change in frequency corresponds to or is equal to the distance, with the limitation of the frequency step size. The smaller the frequency step, the larger the modulo rollover distance (see "On the Security of Carrier Phase-Based Distance Measurement" by Officedotter, Rangatan, and Capkun, which is incorporated herein by reference).

As another example, the received signal strength indicator (RSSI) parameter can be monitored to determine if the network device is close to the vehicle, and then a series of tone exchanges can be performed to measure the distance. Based on the touch of the user's door handle, a tone exchange may be performed to confirm that there is no attack. Multiple round-trip timing measurements may be performed to determine the distance of the network device to the vehicle.

The above distance determination technique can be used in combination with other techniques disclosed herein to determine the RTT value. The direction of travel of the tone between devices 5804, 5806, 5808, 5810 can be randomized.

In one embodiment, the control module of the first network device 5800 plots the phase change vs. the frequency change for each of the exchanged tones to generate a plurality of linear curves. The control module determines the slope of the curve, which provides the ratio of the phase change to the frequency change. The gradient is then used to determine the distance between adjacent objects in the curve, which is related to the distance between the first and second network devices 5800, 5802.

FIG. 53 shows a positioning system 5900 including a tone exchange initiator 5902, a tone exchange responder 5904, and a tone exchange sniffer 5906. The tone exchange initiator 5902 and the tone exchange responder 5904 can function as any of the initiators, responders, BLE radios, and RF circuits disclosed herein. The tone exchange sniffer 5906 can function similarly to the RTT sniffer 5606 of FIG. 50 and is placed in the vehicle together with one of the tone exchange devices 5902, 5904 and includes one of the antenna modules 40 of FIG. The tone switching device in the vehicle includes the other one of the antenna modules 40. Devices 5902, 5904, 5906 each include the control modules described above and are capable of performing any of the processes described. Polarization diversity is provided between the antennas of the tone exchange devices 5902, 5904 and between the antennas of one of the tone exchange devices 5902, 5904 and the tone exchange sniffer 5906 in the vehicle. Polarization diversity is especially useful when performing reciprocating timing measurements.

One of the tone exchange devices 5902, 5904 in the vehicle is called a master device, while the other one of the tone exchange devices 5902, 5904 is called a slave device. When the master device sends a tone signal to the slave device and vice versa, the tone exchange sniffer 5906 acts as a listener: (i) when the tone was sent to the tone switch sniffer 5906 and / or to the tone switch sniffer 5906. And / or (iii) when the tone exchange sniffer 5906 received the tone transmitted by the slave device. The slave device acts as a reflector and can return the tones received from the master device to the master device. The master device and / or the sniffer device can prevent at least one of vehicle access or motion control based on the arrival time of the tone, the round trip timing measurements, and / or the estimated distance between the devices.

FIG. 54 shows how to determine the distance between the initiator and the responder, and between the responder and the sniffer. The following processes of FIG. 54 will be described primarily with respect to the embodiments of FIGS. 50 and 53, but the processes of the present disclosure include examples of FIGS. 2-6, 11, 14, 39, and 46-49. It can be easily modified to apply to other embodiments. The process can be repeated. Although this method is described primarily with respect to the embodiment of FIG. 53, this method may be applied to other embodiments of the present disclosure.

The method can start at 6000. At 6002, the tone exchange initiator 5902 transmits a tone signal including tones to the tone exchange responder 5904. The tone can be expressed as e ^{(jωt + Ф} _A ^{) · τ} _AB , where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, τ _AB is the time to move from A to B, and the tone exchange initiator. Directly related to the distance between 5902 and the tone exchange responder 5904, ω is the frequency, φ _A is the phase of the tone at the tone exchange initiator 5902, and t is the time.

トーン交換スニファ５９０６で、受信トーン信号はベースバンドにダウンコンバートされ、これは式２７で表すことができる。

At 6004, the tone is received on the tone exchange responder 5904 with a delay φ _B and on the tone exchange sniffer 5906 with a delay φ _C. With the tone exchange responder 5904, the received tone signal is downconverted to baseband, which can be represented by Equation 26.

With the tone exchange sniffer 5906, the received tone signal is downconverted to baseband, which can be represented by Equation 27.

At 6006, the tone exchange initiator 5902 receives the tone from the tone exchange responder 5904, and the tone exchange responder 5904 retransmits the tone signal as a second tone signal to the tone exchange initiator 5902. The tone can be expressed as e ^{(jωt + Ф} _A ^{) · τ} _AB . The second tone signal received can be represented by Equation 28. The tone exchange sniffer 5906 also receives a second tone signal that can be represented by equation 29.

In 6008, the tone exchange initiator 5902 receives from the tone exchange responder 5904 a phase signal indicating a natural logarithmic tone value including a difference in the phase of the tones when received by the tone exchange responder 5904. Thus, the tone exchange responder 5904 sends the measured phase to the tone exchange initiator 5902, where the values are multiplied, as represented by Equation 30.

At 6010, the tone exchange sniffer 5906 is based on the received tone signal, the phase difference of the tone between when transmitted from the tone exchange initiator and when received by the tone exchange sniffer, and the tone exchange responder. Determines the tone value associated with the phase difference in tone between when transmitted from and when received by a tone exchange sniffer. The tone value can be expressed as e ^(jωτ _BC ^{+ θ} _B ^−θ _C ⁾ and e ^(jωτ _AC ^{+ θ} _A ^−θ _C ⁾ .

イニシエータ５９０２及び／又はスニファ５９０６は、式３１の結果の逆対数を取り、時間τ_ＢＣ、τ_ＡＢを提供することができる。レスポンダ５９０４とスニファ５９０６との間、及びイニシエータ５９０２とレスポンダ５９０４との間の距離は、これらの時間及びトーン信号の既知の伝送速度に基づいて決定され得る。方法は６０１４で終了し得る。イニシエータ５９０２又はスニファ５９０６は、推定された少なくとも１つの距離に基づいて、車両へのアクセス又は車両の動作制御のうちの少なくとも１つを防止することができる。 At 6012, the initiator 5902 and / or the sniffer 5906 determines the distance between the initiator 5902 and the responder 5904 and the distance between the initiator 5902 and the sniffer 5906. The distance value can be determined in the same manner as when sniffing the round trip time above, see, for example, Equations 12 and 15 and the corresponding description. Phase is used instead of round trip time. This calculation involves the use of Equation 31, where the tone values e ^(jωτ _BC ^{+ θ} _B ^−θ _C ⁾ and e ^(−jωτ _AC ^−θ _A ^{+ θ} _C ⁾ are measured or determined by the sniffer 5906 and e ^{( jωτ} _AC ⁾ is known a priori, and the tone value e ^(jωτ _AB ^{+ θ} _A ^−θ _B ⁾ is determined by the responder 5904.

The initiator 5902 and / or the sniffer 5906 can take the inverse logarithm of the result of equation 31 and provide the time τ _BC , τ _AB . The distance between the responder 5904 and the sniffer 5906 and between the initiator 5902 and the responder 5904 can be determined based on these times and known transmission rates of the tone signal. The method may end at 6014. The initiator 5902 or sniffer 5906 can prevent at least one of vehicle access or vehicle motion control based on the estimated at least one distance.

FIG. 55 shows an example of the passive tone exchange / phase difference detection system 6100. The system 6100 includes a phase lock loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and an antenna module 6110. The antenna module 6110 may be similar to the antenna module 40 of FIG. The transmitter 6106 transmits a first tone, which is the output of the PLL 6102 and is reflected by the reflector 6112 back to the receiver 6108. The output of the PLL and the reflected tone signal are provided to the phase module 6104. The phase module 6104 determines the phase difference between the output of the PLL and the reflected tone signal. The phase module 6104 or other module disclosed herein determines the distance between the transmitter 6106 and the reflector 6112 based on the phase difference. The phase module 6104 or other modules disclosed herein can prevent access to the interior of the vehicle and / or control of vehicle operation based on the determined distance.

FIG. 56 shows an example of the active tone exchange / phase difference detection system 6200. The system 6200 operates in the same manner as the system 6100 of FIG. 55. The transmitter and receivers 6106, 6108 are represented by a box 6202. The reflector 6112 of FIG. 55 can be replaced with a responder device 6204 for active exchange of tones. Responder device 6204 can receive a first tone signal including one or more first tones from transmitter 6106 and respond with a second tone signal. The second tone signal may include one or more tones and / or one or more other tones. The second tone signal is returned to the receiver 6108.

FIG. 57 shows the initiator packet 6300 and the response packet 6302 used to measure RSSI and flight time. The initiator packet 6300 includes a preamble, a synchronous access word (eg, a pseudo-random synchronous access word), a data field containing data, a cyclic redundancy check (CRC) field including CRC bits, and a continuous wave (CW) tone field including CW tones. Can contain multiple fields such as. The response packet 6302 can include a CW tone field, a preamble, a synchronous access word, a data field, and a CRC field.

The initiator device can transmit the initiator packet 6300, which can be received by the responder device. The responder device can then generate a response packet 6302 and return the response packet to the initiator device. This can be done for tone exchange, phase difference determination, reciprocating timing measurement, and the like. The distance between the devices can then be determined. These measurements and calculations can be performed to detect range extender type relay station attacks. In one embodiment, the initiator and responder pre-arrange what the sync access word will be based on a given list. Synchronous access words include access addresses. The initiator can measure, for example, the length of time it takes to receive (i) the response packet after transmitting the initiator packet and / or (ii) the synchronous access word. The time length and synchronous access word can be compared with a given time length and given synchronous access word. If the comparisons performed result in a match, then no range extender type relay station attack has occurred. However, if the received synchronous access words do not match and / or the length of time differs from the expected value by a predetermined length or more, there is a possibility that a range extender type relay station attack has been performed.

In one embodiment, the initiator and responder exchange a given key, a list of sync access words, and a time each of the sync access words should be transmitted. When first created, the sync access word can be randomly selected. This allows the responder to know the appropriate key and / or synchronization access word to respond when it receives the initiator packet. The key can be included in the response packet. In another embodiment, the initiator and response packet do not include a preamble, as shown in FIG. In one embodiment, the CW tone is 4-10 μs in length.

In another embodiment, the initiator packet and the response packet have the same format as shown in FIG. 59. Each of the packets contains a first CW tone as the first field, a sync access word, a data field, a CRC field, and a second CW tone as the last field. Another example of an initiator and response packet with the same format is shown in FIG. 60, where each packet has a first CW tone as the first field, a sync word containing PACRMBI, a PDU field containing PDUs, a medium. An access controller (MAC) field, a CRC field, and a second CW tone as the last field are included. The CW tones of FIG. 57-60 are cryptographically random length tones and may be inspected by the initiator upon reception. For example, if the CW tone received from the responder is incorrect, a range extender type relay station attack may have occurred. In the embodiment of FIG. 59-60, the reciprocating timing of the syncword prevents laps of the CW tone exchange beyond an uncertain range (eg, 75 meters) at the 2 MHz channel tone step. The initiator packet and the responder packet described above may be transmitted at the same frequency. By making the initiator packet and the responder packet the same format, the attacking device cannot distinguish which packet is the initiator packet and which is the responder packet. In one embodiment, the CW tone is not included at the end of the packet.

In one embodiment, the timing, frequency, length, power level, amplitude, and CW tone and sync access word content of the initiator and responder packets are checked by the initiator and responder to be correct and / or consistent. Determine if an attack is taking place. In one embodiment, a pseudo-random number of packets is exchanged at a first frequency before changing to the next frequency and exchanging another pseudo-random number of packets.

Since the attacking device usually includes a filter (eg, lowpass filter, bandpass filter) and a mixer (eg, downconverter, upconverter), the attacking device causes a delay when relaying the signal. To prevent the attack by the attacking device from being detected, the attacking device must retransmit the received signal without a detectable delay. This makes it difficult to prevent the attacking device from being detected. Attacking devices can delay the signal by 500 ns, which can delay the signal by 500 feet (ft) in space. In order for the attacking device to accelerate the transmission of the tone or start transmitting the tone at an appropriate time, the attacking device may need to know in advance what is being transmitted. This is impossible. This is especially true when using a heterodyne receiver to receive relay signals. The heterodyne receiver converts the packet / tone into an in-phase (I) -quadrature (Q) domain and captures within the IQ domain. Phase differences are detected in the IQ domain. If there is an attack, the delay due to the attack can be detected in the IQ domain based on the phase difference. If the tone is shortened by the attacking device so that the corresponding sync access word arrives at the correct time, the timing and length of the CW tone is incorrect and is detected by the initiator.

In one embodiment, the initiator transfers the received CW tone transmitted from the responder to (i) the length relative to the start position of the transmitted synchronous access word, (ii) before the synchronous access word, and to the synchronous access word. Check for power (or amplitude) and consistent tones across (iii) synchronous access words. Consistent tones may refer to consistent frequencies, power levels, amplitudes, and so on. In another embodiment, it is known that the start and end times of the sync access word for the beginning of the first CW tone of the transmitted packet are within a predetermined time (eg, within ± 10 ns). Therefore, if the start time and end time are within the predetermined range of the beginning of the first CW tone of the packet, there is no attack, otherwise there is a possibility that an attack has been made.

As another example, the PLL of the initiator transmitting the tone has three different tones that the PLL can produce on a given channel: the center tone, the high tone at the first frequency (eg 250 KHz), and the PLL. It can have a low tone at a second predetermined frequency (eg, -250 KHz). The tones to be transmitted may be selected and transmitted according to a random sequence and / or pattern of pre-determined and agreed tones. This can be agreed between the initiator and the responder. The initiator and attack device PLLs may not be consistent with each other. If there is a frequency difference exceeding a predetermined threshold between the signal transmitted by the initiator and the signal received in response to the signal, the initiator can determine that an attack is being performed.

In one embodiment, the responder can measure what phase delay is detected with respect to the received signal and respond with data. This can be based on when the responder receives the tail-end CW tone of the packet from the initiator. The responder is (i) the tail end (or end) CW tone of the packet received from the initiator and (ii) the front end (or the first leading CW tone) of the packet being transmitted by the responder in response to the packet received from the initiator. ) And the phase lag can be measured. The initiator can calculate the total bidirectional round-trip time of the packet from the initiator to the responder and back from the responder to the initiator.

In addition to detecting signal delay, the initiator can also detect when the attacking device amplifies the signal (or tone). Signal / tone amplification can also delay transmission, which can be detected. During the relaying of a tone on the attacking device, the tone may be distorted and / or another tone may be transmitted that is not the original transmitted tone.

The above example allows for more accurate distance measurements with a smaller number of packets, each with both a synchronous access word and a CW tone. Synchronous access words protect the CW tone from being undetected and modified by the attacking device, and vice versa. Two-way randomized communication is performed that protects both the synchronous access word and the CW tone.

The initiator's PLL disclosed herein can be a phase predictable PLL that allows the initiator to predict the phase of the signal when the frequency of the signal changes. This eliminates the need to check if the timing of the CW tone transmitted by the initiator and the CW tone transmitted by the responder are correct. The responder measures, for example, the time the tail-end CW tone from the initiator is received, determines the corresponding phase delay of the tail-end CW tone for the responder's generation of the front-end CW tone for the response signal, and the front end. This information can be transmitted to the initiator along with the CW tone. The initiator can then calculate the total round trip time based on the information received.

In one embodiment, the initiator is one of the vehicle or portable access device and the responder is the other of the vehicle and portable access device. The order in which the vehicle and the portable access device send and respond is pseudo-randomly changed. Also, the packet and / or tone signal can be transmitted as a response and then used as an initiator packet and / or an initiator tone signal. In one embodiment, the order in which the vehicle and the portable access device transmit and respond is not changed within a short period of time (eg, a replacement period of less than a predetermined period), but a long replacement period (eg, of a predetermined period or longer). It will be changed during the exchange period). The order can be switched periodically. In these examples, antenna polarization diversity is used to exchange bidirectional data to provide the correct timing measurements.

The process is performed to provide accurate measurements at the start and end of the CW tone and synchronous access word. The Correlation Protocol Module 3920 maintains a circular queue of bits to keep track of the CW tone of the transmitted (initiator) packet and the start and end times and lengths of the sync access word, and the CW tone of the received (responder) packet. And lock-in can be done to compare the start time and end time and length of the sync access word. The Correlation Protocol Module 3920 can interpolate where the zero crosspoint is located. Post-processing of the I and Q data associated with the synchronous access word may be performed for clock recovery to interpolate when the synchronous access word arrives. The transition / spin rate may be different between the I data and the Q data. Interpolation may be performed to determine where the center point of the transition is in order to obtain the exact timing of clock recovery. Multiple zero crosspoints can be detected and aligned for timing. In addition, I data and Q data may be oversampled as described further below in order to optimally fit / align to one or more bits.

FIG. 61 shows an antenna routing system 6700 for network devices, each with an antenna module. The antenna module exhibits polarization diversity. In this example, two polarization axes for each antenna module are shown. Each antenna module contains a vertical antenna and a horizontal antenna. Possible channel vectors h _VV , h _VH , h _HV , and h _HH are shown. The ranging module 6710 is shown. The ranging module 6710 determines the range (or distance) between the corresponding antennas of the network device based on each one of the channel vectors _hVV , _hVH , _hHV , and _hHH . The ranging module can run a ranging algorithm to determine the ranges r _VV , r _VH , r _HV , and r _HH . The determined ranges r _VV , r _VH , r _HV , and r _HH are provided in the smallest module 6712 which determines which range r _VV , r _VH , r _HV , and r _HH is the shortest. The shortest route can be selected.

Each channel vector can be generated for one or more selected frequencies. When compared, ranges can be generated for channel vectors of the same frequency or different frequencies. As an example, a vector has a 1 MHz frequency step between adjacent tones and is generated for at least some of the 80 different tones within the 2.4 GHz industrial, scientific, and medical (ISM) band. obtain. You can select the frequency associated with the shortest range. Other factors such as signal strength, amplitude, voltage, and parameter consistency may be taken into account when making the choice. This route selection may be performed by any of the initiators, responders, modules, network devices, etc. disclosed herein and used for round-trip timing measurements. This allows the optimum antenna path to be selected for bidirectional packet and / or tone signal exchange to determine round trip time.

Here, with reference to FIGS. 38, 62, FIG. 62 describes the structure, function and operation of the BLE radio 3900 (and / or a modified version of the BLE radio 3900) and RF channels of FIG. 38 and the corresponding RF circuits. The corresponding exemplary radio model 6800 is shown. The radio model 6800 has a first sampling module 6802, a time offset module 6804, a Gaussian low pass filter 6806, an integrator 6808, a first upsampler 6810, an amplifier 6812, an adder 6814, a modulator 6816, and a second sampling. Module 6818, Phase / Frequency Offset Module 6820, First Mixer 6822, Phase Delay Device 6823, Second Mixer 6824, Phase Delay Module 6626, Second Low Pass Filter 6828, Resample Module 6830, Arctangent Module 6832, Differentiation It includes an instrument 6834, a coding determination module 6863, a bit pattern module 6838, a second upsampler 6840, a third upsampler 6842, an intercorrelation module 6844, and a peak detector 6846. Devices 6802, 6804, 6806, 6808, 6810, 6812 show an example of the transmitter portion of a BLE radio 3900 or another BLE radio. Adder 6814 represents a channel between (i) another BLE radio and (ii) a BLE radio 3900 including devices 3907, 3906, 3908, 3932, and 3910. Since the receiving BLE radio is not phase-locked to the transmitting BLE radio, there may be a phase and frequency offset between the receiving BLE radio and the transmitting BLE radio. Devices 6816, 6818, 6820, 6822, 6824, 6828, 6830 correspond to the receiver portion of the BLE radio and are related to the RF sampling rate. Devices 6830, 6832, 6834, 6863, 6838 also correspond to the receiver portion and perform processing on the baseband signal. The resample module 6830 functions as an analog-to-digital converter. The devices 6840, 6842, 6844, and 6846 also correspond to the receiver portion and relate to interpolation for determining the phase.

When recovering the bitstream, the zero cross of the reconstructed signal from the differentiator 6834 can be determined. There can be a significant amount of jitter at the zero cross, which adversely affects the timing of the zero cross to determine flight time. A small amount of jitter adversely affects the determination of transmission time and reception time.

The upsamplers 6840, 6842 and the cross-correlation module 6844 are implemented to reduce the jitter associated with sampling and zero cross determination. The upsamplers 6840, 6842 perform signal processing to interpolate and inject data points between existing received data points to further refine the temporal resolution.

In one embodiment, the transmitted bitstream is known to the BLE receiver in advance and is provided to the upsampler 6842 as indicated by arrow 6843. In this example, the coding determination module 6863 and the bit pattern module 6838 are not included. In another embodiment, the bitstream to be transmitted is unknown and includes a coding determination module 6863 and a bit pattern module 6838 to provide an estimated bitstream to the upsampler 6842. As an example, the transmitted bitstream can be an access address indicating which device is transmitting. The estimated bitstream can be determined based on criteria. For example, the reference can be a preamble and / or set of bits of bits received before the bitstream is estimated. The preamble and / or set of bits provide a temporal reference based on which estimated bitstream is generated. The estimated bitstream is generated based on the known clock frequency of the transmitter and is associated with the transmitted signal and the clock frequency of the receiver.

The cross-correlation module 6844 performs cross-correlation between the outputs of the upsampler 6840, 6842 and / or the output of the upsampler 6840 and the output of the bit pattern module 6838. Cross-correlation is performed to match the envelopes of the signals provided to the cross-correlator and determine the phase difference. Cross-correlation can include performing a product of output signals, including taking the product of the corresponding data points of the two output signals and summing the products. While repeating this multiply-accumulate operation, at each iteration, one of the outputs is gradually shifted by one data point with respect to the other of the outputs, so that multiple results of the product-sum value can be obtained. can get. The maximum value of the sum of products means when the two outputs are synchronized (or aligned) so that the waveforms match and are aligned in time. Based on this information, the phase offset (or difference) between the two outputs is determined.

Cross-correlation improves resolution by upsampling performed by upsamplers 6840, 6842. The cross-correlation module 6846 correlates with a signal having a finer resolution than the originally received signal and finely interpolates the arrival time of the received packet in the received signal. The higher the correlation resolution, the lower the signal-to-noise ratio and the bit length of the message, allowing finer resolutions to be interpolated. Phase offsets can be used to determine flight time, as described herein. The peak detection module 6846 evaluates the results of the cross-correlation and indicates (i) when time-matched peaks occur and / or (ii) phase offset. In one embodiment, the cross-correlation module 6844 receives a digital value and the peak detection module 6846 determines whether the cross-correlation output (or product-sum value) has reached a predetermined threshold. When a predetermined threshold is reached, the peak detection module indicates "signal discovery" with the determined phase.

In one embodiment, the output of the upsampler 6840 is provided to the coding determination module 6863 and the cross-correlation module 6844 and does not include the upsampler 6842. In this example, the output of the bit pattern module 6838 is provided directly to the cross-correlation module 6844.

The devices of FIGS. 38 and 62 are further described with respect to the method of FIG. The following process of FIG. 63 will be described primarily with respect to the embodiments of FIGS. 2-6, 11, 14 and 38, but the process is readily modified for application to the other embodiments of the present disclosure. be able to. The process can be repeated.

The method can start with 6900. At 6902, the sampling module 6802 of the first network device (eg, a network device or portable access device mounted on the vehicle as part of an in-vehicle system) receives a bitstream transmitted from the processing module 3922. The sampling module 6802 samples the bitstream.

At 6904, the time offset module 6804 can receive the output of the sampling module 6802 and introduce a time offset (or delay). The sampling module 6802 and the time offset module 6804 can be implemented by the protocol module 3924. At 6906, the Gaussian lowpass filter (LPF) 6806 receives the output of the time offset module 6804, and the Gaussian LPF6806 may include a bitstream that is filtered to convert a square wave into a sine wave. The processing of the Gaussian LPF6806 can be realized by the GFSK modulator 3926. At 6908, the integrator 6808 integrates the output of the Gaussian LPF6806 and can be realized by a D / A lowpass filter 3928. Examples of signals 7000, 7002, 7004 output from the sampling module 6802, the Gaussian LPF6806, and the integrator 6808 are shown in FIG. 64A.

At 6910, the upsampler 6810 upsamples the output of the integrator 6808 to include additional points per sample. The upsampler 6810 can be realized by the upconverter 3930. In the 6912, the amplifier 6812 provides a gain of frequency deviation. At 6914, the sampling module 6818 receives RF tones that may be provided by PLL3940. The output of the sampling module 6818 is provided to both the modulator 6816 and the phase / frequency offset module 6820. In the 6916, the modulator 6816 modulates the output of the sampling module 6818 based on the output of the amplifier 6812 to provide an initiator signal. The modulator 6816 can be at least partially realized by the upconverter 3930.

At 6918, the initiator signal from the modulator 6816 may be provided to the power amplifier 3932 and transmitted to a second network device. The second network device can be a network device or a portable access device mounted on the vehicle as part of an in-vehicle system. The initiator signal can be any of the initiator signal, start tone signal, master device transmit signal, and / or the like disclosed herein.

At 6920, the low noise amplifier 3910 receives a response signal in response to the initiator signal. The response signal may include Gaussian noise contained in the received response signal, as represented by the adder 6814. In the 6922, the mixers 6822 and 6824 receive the response signal from the low noise amplifier 3910 and downconvert the response signal to the in-phase (I) and quadrature (Q) baseband signals. The quadrature baseband signal can be phase delayed by 90 ° via the phase delay device 6823. This can be achieved with the down converter 3912.

At 6924, LPF6828 filters the baseband signal to remove high frequency components. The LPF6828 may include one or more LPFs for each down-converted signal. The LPF6828 can be replaced and / or realized by a bandpass filter amplifier 3914. At 6926, the resampling module 6830 samples the filtered baseband signal with sample jitter. The resampling module 6830 may be implemented by an A / D converter 3916. An example of signals 7006, 7008 from the resampling module 6830 is shown in FIG. 64B.

At 6928, the arctangent module 6832 determines the arctangent of the baseband signal and produces an arctangent signal. An example of the signal 7010 from the arctangent module 6832 is shown in FIG. 64C. At 6930, the differentiator 6834 differentiates the arctangent signal from the arctangent module 6832. An example of the signal 7012 from the differentiator 6834, which is superimposed on the original Gauss filtered signal 7002, is shown in FIG. 64D.

At 6932, the sign module 6863 executes a sign function to determine the sign of the output of the differentiator 6834. At 6934, the bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of the code module 6863. After the processing of the lowpass filter 6828 and the arctangent module 6832 is applied, an idealized bit pattern is obtained that matches the bit pattern or other bit pattern from the Gaussian LPF6806 with the received bit pattern. This is done so that the upsampled values are similar to the noise-free resampled data.

At 6936, the upsamplers 6840 and 6842 upsample the outputs of the differentiator 6834 and the bit pattern module 6838, respectively. At 6938, the outputs of the upsamplers 6840, 6842 are correlated by the cross-correlation module 6844 to generate a correlation signal. The devices 6832, 6834, 6863, 6838, 6840, 6842 can be implemented by the demodulator 3918. At 6940, the peak detector 6846 determines the phase of the correlation signal obtained from the cross-correlation module 6844. The cross-correlation module 6844 and the peak detector 6846 can be implemented by the correlation protocol module 3920. In one embodiment, the peak detector 6846 is implemented as a three-point parabolic peak interpolator on top of the upsampled cross-correlation module 6844. Two points near the detected peak (within a predetermined distance) are selected and upsampled to obtain a three-point parabolic interpolation.

At 6942, distances, positions, round trip times, and / or other parameters are determined based on the phase (or the resulting three-point parabolic interpolation that is upsampled). The distance can be the distance between the first network device and the second network device. The location can be that of a second network device relative to a first network device. The round trip time is the time when the initiator signal moves to the second network device and the first network device receives the response signal, and the time when the second network device generates the response signal after receiving the initiator signal. including.

At 6944, the processing module 3922 can determine if a range extension type relay attack is taking place based on the phase, distance, position, round trip time, and / or other parameters determined by 6942. .. If a range extension type relay attack is taking place, process 6946 is performed, otherwise the method can end at 6948. At 6946, processing module 3922 implements measures such as any of the measures disclosed herein.

The above processes of FIGS. 35, 36, 45, 54, and 63 are intended to be illustrative examples. Processing can be performed sequentially, synchronously, simultaneously, continuously, during overlapping periods, or in different orders, depending on the application. Further, arbitrary processing may not be performed or may be skipped depending on the order of the examples and / or events.

There is a variation in transmission timing between (i) the time it takes for the generated waveform to reach the antenna to be transmitted and (ii) the corresponding time measured by the timer. Factors that may contribute to this include clock domain crossovers, clock cycle changes, power amplifier propagation delays due to power amplifier gain settings, temperature, and processing propagation delays. Fluctuations in processing, temperature, and amplifier gain settings can be calibrated from timing measurements.

A second BLE device (eg, BLE device (or radio) 3900B) that is similar to or identical to the first BLE device (eg, BLE device (or radio) 3900A in FIG. 38) is shown in FIG. It may be added or mounted on the vehicle to represent such a reflective (or responder) device. Each of the BLE radios 3900 can be mounted on a separate system-on-chip (SOC). The first BLE radio 3900A can transmit an initiator signal that can be received by the receiver portion of the second BLE device.

When a first bitstream is generated and / or provided to protocol module 3924A of the first BLE radio 3900A to generate an initiator signal to be transmitted from the first BLE radio 3900A. Time T1 may be generated, as determined by timer 3938A. The time T2, as determined by timer 3938B, may be when the correlation protocol module 3920B of the second BLE radio 3900B receives the first bitstream. The first calibration constant CAL1 is set equal to or equal to the difference between when timer 3938A detects the generation of the first bitstream and when the corresponding initiator signal is transmitted from antenna 3907A. It can be determined based on the difference. The second calibration constant CAL2 may be set equal to or based on the difference between timer 3938B and when the correlation protocol module 3920B detects the reception of the first bitstream. The flight time of the first bitstream from the protocol module 3924A to the correlation protocol module 3920B is (T2-CAL2)-(T1-CAL1).

同様の情報を収集し、較正値を追加する。

時間測定値から較正値を分離する。

Similarly, a second bitstream corresponding to the first bitstream is generated and / or provided to the protocol module 3924B to generate a response signal to be transmitted from the second BLE radio 3900B. For times, time T3, as determined by timer 3938B, can be generated. The response signal is generated in response to the initiator signal. The time T4, as determined by timer 3938A, may be when the correlation protocol module 3920A receives a second bitstream. The third calibration constant CAL3 is set equal to or equal to the difference between when timer 3938B detects the generation of the second bitstream and when the corresponding response signal is transmitted from antenna 3907B. It can be determined based on the difference. The fourth calibration constant CAL4 may be set equal to or based on the difference between timer 3938A and when the correlation protocol module 3920A detects the reception of the second bitstream. The flight time of the second bitstream from the protocol module 3924B to the correlation protocol module 3920A is (T4-CAL4)-(T3-CAL3). The average flight time, distance between the first and second BLE radios 3900 can be determined using equations 33-35, where equation 33 is based on and is described. It takes into account timing variations and therefore includes the corresponding calibration values.

Gather similar information and add calibration values.

Separate the calibration value from the time measurement.

Timer 3938B can be activated by processing agreement and / or fine-tune the transmission time in the second BLE radio 3900B to minimize reporting on T2-T3.

The PLL3940A, 3942A of the first BLE radio 3900A can be realized as a single PLL. Similarly, the PLL3940B, 3942B of the second radio 3900B can be realized as a single PLL. The two PLLs allow the transmitter and receiver hardware to capture the initiator signal transmission time using the same BLE circuit used to capture the response signal reception time. It becomes possible to implement the wear.

According to this teaching, the multi-axis polarized RF antenna assembly includes a circularly polarized antenna including a conductive ring-shaped main body having an inner hole, a circular isolator connected to the conductive ring-shaped main body, and a circularly polarized antenna. Includes a linearly polarized antenna connected to a circular isolator and extending outward from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

According to this teaching, the multiaxially polarized RF antenna can include a conductive element as a wire.

According to this teaching, the sleeve can be made of polytetrafluoroethene and the conductive element can be made of copper.

According to this teaching, the linearly polarized antenna can be configured to extend downward from the circularly polarized antenna during use.

According to this teaching, the circularly polarized antenna can be a biaxial antenna, and the linearly polarized antenna can be a uniaxial antenna.

According to this teaching, the multiaxially polarized RF antenna assembly can further include a ground layer, and the circular isolator is between the conductive element and the ground plane and between the circularly polarized antenna and the ground plane. , Can be placed on the ground plane.

According to this teaching, the circularly polarized antenna can include two feeding points that are 90 ° phase offset and can be configured to receive signals that are 90 ° out of phase with each other.

According to this teaching, the vehicle can include a body and a roof including a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly can be oriented in the roof so that the linearly polarized antenna extends downward from the circularly polarized antenna.

According to this teaching, the vehicle can include a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly is a first multi-axis polarized RF antenna assembly configured to be mounted on a vehicle and a second configured to be mounted on a vehicle and having a second inner hole. A second circularly polarized antenna including the conductive ring-shaped body, a second circular isolator connected to the second conductive ring-shaped body, and a second circular isolator connected to the second circular isolator. It can include a second multiaxially polarized RF antenna assembly that includes a second linearly polarized antenna extending outward from. The second linearly polarized antenna can include a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. The second linearly polarized antenna can extend perpendicular to the radius of the second circularly polarized antenna, and the access module is a first multi-axis polarized RF antenna assembly and a second multi-axis polarized RF. It is connected to an antenna assembly and can be configured to communicate with a portable access device via a first multi-axis polarized RF antenna assembly and a second multi-axis polarized RF antenna assembly.

According to this teaching, at any given time, at least one of the linearly polarized antenna or the first multiaxially polarized RF antenna assembly is not cross-polarized with the antenna of the second multiaxially polarized RF antenna assembly.

According to this teaching, the access module is a passive entry passive that includes sending and receiving radio frequency signals via one of the first multi-axis polarized RF antenna assembly and the second of the multi-axis polarized RF antenna assembly. It can be configured to perform a start operation or a phone as a key operation.

According to this teaching, the access module can be configured to allow access to the vehicle based on the radio frequency signal.

According to this teaching, the access module allows either antenna pair of the first one of the multi-axis polarized RF antenna assembly and the second one of the multi-axis polarized RF antenna assembly to communicate with the portable access device. It can be configured to run an algorithm that determines whether it should be used.

According to this teaching, the portable access device can be a key fob or a mobile phone.

In one embodiment, the telephone as the key system described herein uses a BLE radio of a mobile phone to microlocate the location of the telephone with respect to a set of receiving sensors. The sensor is placed inside the vehicle. Sensors are used to detect if the phone is close enough to the vehicle to allow access to the vehicle (eg, unlocking the door and / or starting the vehicle). The vehicle access module uses the principle of arrival angle (AOA). By knowing the arrival angle of the signal transmitted from the BLE radio to at least two separate sensors in the vehicle, the source (ie, the BLE radio) can be positioned in a two-dimensional plane. In this case, a phased antenna array is used to measure the arrival angle of the incoming signal. A phased antenna array includes multiple antennas that receive transmit signals. Each sensor in the vehicle includes one or more antennas. Each sensor is a 3-antenna interleaved circular polarization (CP) receiver with a single radio receiver, a 6-antenna interleaved linear polarization (LP) receiver with a single radio receiver, single. It may be a phased array sensor including a three-antenna interleaved CP receiver with one radio receiver and a three-antenna interleaved print antenna CP receiver with a single radio receiver.

The access module detects the direction of the incident AOA signal in consideration of the multipath effect. As an example, two sinusoidal RF signals transmitted to reach the sensor array are summed at the antenna of the sensor array. The sum of the two sine wave RF signals is a sine wave with different phases and amplitudes depending on the phase angle and amplitude of the two source sine waves. The mathematical model used to predict the AOA direction can show an error. This error is very large and can be unstable in a dynamic multipath environment. To prevent this error, the MUSIC algorithm disclosed herein can be used to identify the source signal along with a potentially strong multipath reflection signal. Direct path signals are accurately tracked from mobile phones. This tracking identifies any additional reflected signal. The reflected signal may be identified and discarded.

The access modules and control modules disclosed herein can implement any MUSIC algorithm referenced and / or disclosed herein. Direction-finding methods can generally be divided into two categories, sometimes referred to as classical and modern methods. Classic methods include various beamforming methods. The modern method is commonly referred to as the subspace method. The MUSIC algorithm is classified as a super-resolution parameter estimation algorithm using the subspace separation method. The subspace method may require a specific array arrangement of two identical but physically shifted arrays. Other methods include maximum likelihood estimation and beamforming.

FIG. 70 shows a side view of a plurality of antennas 7000 in the array showing the arrival angle θ. An array of antennas is sometimes referred to as an array manifold. Each antenna 7000 may be configured identically and / or similarly to any of the antennas disclosed herein. In one embodiment, the one or more antennas are quadriffial helix antennas.

The MUSIC algorithm uses a model of an array manifold that describes the response of the array manifold to one or more incident AOA signals. An even linear array of antennas (ULA) can be defined as shown in FIG. 70, where m is the antenna index to the array starting at 1, M is the total number of antennas, and d is between the antenna elements. The interval, θ, is the angle of the incident signal. The response of the array element m to the incident signal s can be expressed by Equation 37, where r is the received signal, a is the complex array manifold response, s is the source signal, and m is the antenna of interest as described. The index number of the element, θ is the physical angle of the incident source signal as described, λ is the wavelength of the signal, and n (t) is the noise in the receiver channel. This shows the effect of phase delay as a function of the physical position of the elements of the receiving sensor array, with a complete 180 ° phase shift at d = λ / 2. It also shows a phase shift as a function of the incident angle θ.

The array steering vector a _m is defined by Equation 38 for a given source signal n at an incident angle θ _n at the antenna element m in the case of an antenna of 1 ≦ m ≦ M. This assumes an amplitude response of 1 for each antenna and an ideal phase response of ULA to antenna 1.

In the case of N incident signals, the received signal r (t) is the sum of the source signals via the array manifold and can be expressed by Equation 39.

In vector notation, the array manifold response parameters a and A are defined by equations 40 and 41. The vector a describes the array response of each element to a single source signal n, A describes the response of all M array elements to all N source signals, and is an M × N matrix. Here, M and N are integers of 2 or more, respectively. The N source signals sampled at the moment t in time are represented as N × 1 vector S (t) as represented by Equation 42.

アレイマニホールドモデルのこの数学的構造は、ＭＵＳＩＣアルゴリズムを導出するために使用され、テスト環境のシミュレーションとモデリングにも使用され得る。 Various source arrival angles represented in the signal S (t) at a given time t via the antenna array response manifold model A to the received (measured) data vector r (t) including the channel noise n (t). Then, in order to map N source tones, the equation 43 may be used, where r (t) is an M × 1 vector of data received by each antenna element.

This mathematical structure of the array manifold model can be used to derive the MUSIC algorithm and can also be used for simulation and modeling of test environments.

FIG. 71 shows an exemplary AOA method involving the use of the MUSIC algorithm. The processing is described primarily as being performed by a vehicle access module, such as one of the access modules disclosed herein, even if the processing is performed by a control module of a portable access device. good. The H operator indicates a Hermitian transpose or a conjugate transpose operation. The method can start with 7400. At 7402, the access module simultaneously collects T analytical signal samples from each antenna, as represented by {r (t)} ^T _{t = 1} .

At 7404, the access module estimates the data covariance matrix R, as represented by Equation 44.

Estimates of the covariance matrix are calculated according to Equation 44, and an example of the covariance is shown in FIG. For interpretation, each arrow represents the covariance between the antenna numbers on the X and Y axes at the base of the arrow. The arrow in the upper center represents the covariance of antenna number 1 with respect to antenna number 2 (c ₁₂ ), while the arrow in the center left represents the covariance of antenna number 2 with respect to antenna number 1 (c ₂₁ ), which is c. _Twelve complex conjugates. The direction of the arrow is a complex plane representation of magnitude and direction (the X-axis is the real axis and the Y-axis is the imaginary axis).

The diagonal line (from upper left to lower right) represents the autocovariance, which has a magnitude of 1 and an imaginary value of zero. Also note that the matrix is hermician, which means that _cij = c ^* for all i and j, where * is the complex conjugate. Thus, all useful information is (i) c ₁₂ , c ₂₃ , and c ₁₃ , or (ii) c ₂₁ , c ₃₂ , and c ₃₁ (upper right, not including diagonal lines from top left to bottom right). Included in the corner or lower left corner). This can be expected to save data storage and reduce the transmission size.

At 7406, the access module uses Singular Value Decomposition (SVD) or another eigenvalue decomposition technique to compute the M × M matrix U as represented by Equation 45.

After the eigenvalue decomposition of the covariance matrix estimate R, the resulting complex eigenvectors are provided, an example of which is shown in FIG. 73. FIG. 73 shows the visualization of eigenvectors with an array manifold response at 35 °. FIG. 74 shows the visualization of the eigenvectors by the array manifold response at 0 °.

As shown in FIG. 72, the magnitude and direction of the arrows indicate the real and imaginary components of each point corresponding to the real numbers on the X-axis and the imaginary numbers on the Y-axis. Solid lines and short dashed arrows represent a 3x3 array of eigenvectors. The vector sequence (X-axis) is sorted from large (left side) to small (right side) according to the eigenvalues of the eigenvector. Thus, the leftmost column number 1 represents the signal subspace, while the columns 2 and 3 represent the noise subspace.

At 7408, the access module estimates or otherwise determines the number of incident signals N. At ₇₄₁₀ , the access module separates the matrix U into an M × N signal subspace matrix _Us and a noise subspace estimation M × (MN) matrix Ue to satisfy equation 46.

The response of the array manifold at the angle of interest (35 °), along with the eigenvalue vector, is indicated by the long dashed arrow. This is derived from Equation 40.

At 7412, the access module calculates the MUSIC spectrum P (θ) in the range of θ of interest at a predetermined resolution, as represented by Equation 47.

At this point, the noise subspace eigenvectors of the covariance matrix estimates need to be perfectly orthogonal to the array manifold response. The results in the denominator of Equation 47 are smaller than the results at various test angles θ.

FIG. 74 presents the same information as in FIG. 73, except that the array manifold response is indicated by an AOA of 0 °. Note that the eigenvalue vector remains the same, as the eigenvalue vector is derived from the measurement data. The array manifold response rotates and shows the expected response to a directly incident signal, which means that there is no phase shift at the antenna element. In this case, the result of the denominator of Equation 47 is much larger than that obtained in the case of FIG. 73.

At 7414, the access module performs a peak search at P (θ) to determine the arrival angle. The value of θ at the maximum value of P (θ) is the arrival angle of N incident signals.

After processing Equation 47 for θ over the range −90 ° to + 90 °, the obtained MUSIC power spectrum P (θ) is shown in FIG. 76 for the 35 ° source signal AOA. Note the clear peak at the 35 ° test AOA. The actual angle is indicated by a vertical dashed line. The resolution of θ is 1 °.

A covariance smoothing method may be used. As an example, the forward-backward method can be used. The forward-backward approach is implemented using equations 48 and 49, where R is the modified covariance matrix estimate and J is the M × M inverse identity matrix (transfer matrix). ..

The effective number of decomposable coherent tones is N ≦ 2M / 3 source. In the case of a three-antenna array, up to two coherent tones can be decomposed. This method can be used for a three-antenna phased array on a phased antenna array receiver board. The method may end at 7416.

As another example, the spatial smoothing method may be used. Spatial smoothing is a technique that involves dividing an array into multiple subarrays and averaging the results of the covariance matrix of the subarrays. As a result, the number of antenna array elements is effectively reduced.

A forward-backward spatial smoothing (FBSS) method, which combines spatial smoothing with a forward-backward approach, may be used. It also reduces the number of antenna elements required. As yet another example, the Teplice completion method may be used and is suitable for NLA.

A variation of the MUSIC algorithm may be implemented. A derivative of the MUSIC algorithm called Rot-MUSIC can be used for ULA to find the incident signal AOA without having to calculate the results at all potential angles. This reduces the computational power required. The reduction in computational complexity results from the need not perform MUSIC algorithm processing 7412, 7414, including computing the MUSIC spectrum over a large set of θ values and finding peaks in the results.

Another derivative, called Spectral-MUSIC, is a generalized version of Rot-MUSIC that can be applied to any array arrangement, but is generally applied to wideband, non-coherent sources. Yet another derivative, called Smooth-MUSIC, refers to various methods of smoothing the covariance matrix of the MUSIC algorithm and is applied between processes 7404 and 7406 in FIG.

Another derivative, called the CLEAN method, involves reconstructing a model of the source signal from a known array manifold once the source signal is identified in a given direction. This reconstructed signal model is subtracted from the measured incident signal to remove the incident signal, which "cleans" the measurement data of unwanted source signals and allows consideration of other sources. ..

One of the problems that arises when implementing the MUSIC algorithm on a non-ideal antenna array is forward-backward covariance smoothing, where two coherent sources can lead to erroneous position measurements. .. Standard array calibration techniques do not solve this, as the covariance matrix itself results in erroneous subspace separation. To counter this, a variation of the CLEAN method was performed on multiple coherent sources, which used the MUSIC algorithm to identify the source signal, and a calibrated array manifold to identify the source signal. Using the CLEAN method to delete one at a time, forcing the position of the source signal to an offset (rather than the originally measured position) and recalculating the AOA direction of the rest of the signal. , Repeating processes 7404 and 7406 of FIG. 71 to verify convergence of the incident arrival angle to a new set if it is not the same as the original arrival angle, and optionally, process 7402 of FIG. 71, system. Includes replacing with a priori knowledge from. For example, while tracking the position of the source signal, it can be assumed that the AOA does not change significantly during subsequent reads.

FIG. 76 shows an antenna selection system 7600 including an antenna 7602, a switch 7604, and a radio receiver 7606. The radio receiver 7606 selects one of the antennas that receives the signal via switch 7604. The antenna selection system 7600 may be implemented in any of the systems disclosed herein. In one embodiment, the antenna selection system 7600 is mounted on the vehicle and the access modules disclosed herein control the operation of the radio receiver 7606.

The antenna selection system 7600 is implemented in the PAK AOA system to realize BLE AOA data reception. The portion of the BLE radio packet received by one of the antennas 7602 includes a CW tone. The radio receiver 7606 samples the CW tone to provide an quadrature analytic signal, meaning two sine waves with a 90 ° phase difference called in-phase signal and quadrature phase signal (I signal and Q signal). .. The I and Q signals are sampled simultaneously and combined to form a complex analytical sample r, where r = iI + Q, where i is an imaginary constant and i = √2. The received data is therefore sliced into interleaved samples from each of the antennas in multiple iterations.

FIG. 77 shows an exemplary reconstruction method for reconstructing IQ data. The interpolated data is interpolated to form a received data matrix r (t) for use in the MUSIC algorithm. The reconstruction method may be performed by any of the access modules disclosed herein. The signal reconstruction method can start at 7700.

At 7702, the access module uses an arctangent function to transform the analytical IQ sample vector r into a phase angle vector Φ. At 7704, the access module creates a time vector t corresponding to the sample vector r based on the data sampling rate.

At 7706, the access module discards the sample taken near the antenna switching time. At 7708, the access module unwraps each repeating portion of the data point with a step size of π. At 7710, the access module measures the average gradient. This is the average frequency of the sine wave.

At 7712, the access module, for each antenna, a) locates the first iteration section of the sampled data, b) predicts the position of the next iteration of the sampled data, and c) the expected position. Includes determining the mean difference from the actual position measured, d) adding or subtracting 2π, and e) repeating the determination of the mean difference and the addition or subtraction of 2π until the average difference is less than π. Repeat processes c and d, f) find the average gradient of all points already aligned, and g) repeat process bg using the new gradient for the next signal iteration.

At 7714, the access module measures the standard deviation of the average gradient of each antenna.

At 7716, the access module checks which antenna may be inaccurately aligned by selecting antenna i based on Equation 50 if the standard deviation exceeds the threshold. do.

At 7718, the access module repeats processing 7712-7718 for the antenna selected at 7716 until the low standard deviation or maximum retry counter expires.

At 7720, the access module interpolates a straight line of points on the original time vector t for each antenna m to obtain the reconstructed phase angle vector Φ _m . This can be based on the phase angle vector Φ determined by 7702.

At 7722, the access module recreates the IQ sample vector rm for each antenna _m using Equation 51, where g is the average magnitude of a valid subset of the original sample vector r. Following process 7722, the method may be terminated at 7724.

In one embodiment, the above method is implemented in a vehicle access system and / or a PAK system with a circularly polarized antenna disclosed herein. The signal is received by a circularly polarized antenna. IQ data is determined based on the received signal, as described above, and the arrival angle is determined using the MUSIC algorithm.

FIGS. 78A-C show configuration examples of sensors 7802 that can be implemented as part of any PAK system disclosed herein and can be connected to any access module disclosed herein. The vehicle 7800 is shown. FIG. 78C shows an example of a bounce reflection of a signal transmitted from a key fob 7804 or other portable access device and detected by a sensor 7802 and a corresponding path. In this example, the sensor 7802 is located high and centered on the vehicle 7800. The sensor 7802 may be located, for example, in the headliner 7803 of the vehicle 7800. The sensor 7802 is arranged to trigger multiple bounce paths of the transmitted signal before being received by the sensor 7802. The key fob 7804 is shown low relative to the vehicle for purposes of illustration, but may be placed at a higher position.

FIGS. 79A-C show a vehicle 7900 showing another configuration example of the sensor 7902. FIG. 79C shows an example of a bounce reflection of a signal transmitted from the key fob 7904 or other portable access device and detected by the sensor 7902 and a corresponding path. In this example, the sensor 7902 is located low and centered on the vehicle 7900. The sensor 7902 can be located on the vehicle floor 7903 or center console 7905. Sensor 7902 is arranged to trigger multiple bounce paths of the transmitted signal before being received by sensor 7902. The key fob 7904 is shown low relative to the vehicle for purposes of illustration, but may be placed at a higher position.

Sensors 7802, 7902 may be located within the vehicle's metal structure with few possible direct paths from the vehicle (ie, it is unlikely that there will be a line of sight between the key fobs 7804, 7904 and the sensors 7802, 7902. ). Since the floor can contain at least a portion of the metal structure, the metal structure includes a frame, a metal housing, a partially enclosed metal structure, a unibody structure, etc., which is at least partially indicated by the dashed line 7903. Can be represented. Although a single sensor is shown in each of FIGS. 78A-C and 79A-C, two or more sensors may be included in each vehicle. In one embodiment, each sensor comprises two or more antennas, eg, two or more antennas disclosed and / or referenced herein. In one embodiment, two sensors are included, and each sensor includes two antennas so that there are four antenna paths. In another embodiment, a single sensor is included, the sensor comprising three or more antennas. There may not be a direct line of sight between the key fob and the sensor, but because there are several to many signal paths between the key fob and the sensor, the short and consistent distance between the key fob and the vehicle is It can be determined using the techniques disclosed herein. Distance information is used to determine whether to allow access to the vehicle.

In one embodiment, carrier phase based ranging using the MUSIC algorithm or the like is implemented to determine the arrival angle of the signal transmitted by the key fobs 7804, 7904. This can include eigenvalue decomposition. The distance between the key fobs 7804, 7904 and the vehicles 7800, 790 is determined based on the arrival angle. If the key fobs 7804, 7904 are within a predetermined distance of the vehicles 7800, 7900, access is granted. The line-of-sight is unlikely, but the transmitted signal is likely to bounce multiple times and follow multiple paths to each of the sensors 7802, 7902. This allows the corresponding access module to determine if the key fobs 7804, 7904 are close to the vehicle 7800, 7900. In addition to carrier phase-based ranging, multipath signal processing is performed. This may include flight time signal processing, for example, as described above with respect to FIGS. 37, 52-56, and 62. As an example, if the key fobs 7804, 7904 are within a predetermined distance of the vehicles 7800, 7900, the access module of the vehicles 7800, 7900 can unlock the doors of the vehicles 7800, 7900.

Use BLE carrier phase-based distance measurement for distance measurement in the indirect reflection path by forcing an indirect signal transmission path, exchanging a predetermined number of tones transmitted in close proximity, and finding eigenvalues. Can be executed. A system with a small number of sensors (called anchors) can be used by arranging the anchors so that the signal follows primarily an indirect path rather than a direct line-of-sight path.

In one embodiment, the RSSI of the transmitted signal is determined to determine whether the key fobs 7804, 7904 are inside or outside the vehicle 7800, 7900. If the key fobs 7804, 7904 are outside the vehicle, carrier phase-based ranging including eigenvalue decomposition is performed to determine if the key fobs 7804, 7904 are within a predetermined distance of the vehicles 7800, 7900.

The above description is merely exemplary in nature and is by no means intended to limit this disclosure, its application, or its use. The broad teachings of the present disclosure can be carried out in various forms. Accordingly, the present disclosure includes certain examples, but the true scope of the present disclosure is so limited as the scope of the drawings, the specification, and the accompanying claims reveals other modifications. Should not be. It should be understood that one or more steps in the method may be performed in different order (or simultaneously) without changing the principles of the present disclosure. Further, although each embodiment is described above as having specific features, any one or more of these features described with respect to any embodiment of the present disclosure may be any other. It can be implemented in embodiments and / or combined with features of any other embodiment, even if the combination is not explicitly described. In other words, the embodiments described are not mutually exclusive and the interchange of one or more embodiments remains within the scope of the present disclosure.

Spatial and functional relationships between elements (eg, between modules, between circuit elements, between semiconductor layers, etc.) are "connected," "engaged," "coupled," "adjacent," and "next to." Explained using various terms, including "on", "above", "above", "below", and "arranged". When the relationship between the first and second elements is described in the above disclosure, the relationship is with other intervening elements between the first and second elements unless explicitly stated to be "direct". Can be a direct relationship in which is not present, but can also be an indirect relationship in which one or more intervening elements are (spatial or functional) present between the first and second elements. As used herein, the phrase with at least one of A, B, and C should be construed to mean logic using a non-exclusive OR (A or B or C). Yes, it should not be construed to mean "at least one of A, at least one of B, and at least one of C".

In drawings, the direction of the arrow indicated by the arrowhead generally indicates the flow of information (such as data or instructions) that is important to the figure. For example, when element A and element B exchange various information, but the information transmitted from element A to element B is related to the figure, the arrow may point from element A to element B. This one-way arrow does not mean that no other information is transmitted from element B to element A. Further, with respect to the information transmitted from element A to element B, element B may transmit to element A a request for information or confirmation of receipt of information.

In this application, including the following definitions, the term "module" or the term "controller" may be replaced with the term "circuit". The term "module" refers to application-specific integrated circuits (ASICs), digital, analog, or analog / digital mixed discrete circuits, digital, analog, or analog / digital mixed integrated circuits, combined logic circuits, and field programmable gate arrays (FPGAs). ), Processor circuit that executes the code (shared, dedicated, or group), memory circuit that stores the code executed by the processor circuit (shared, dedicated, or group), other suitable hardware that provides the described functions. It can refer to, be part of, or include a hardware component, or some or all of the above combinations, such as in a system-on-chip.

The module can include one or more interface circuits. In some examples, the interface circuit can include a wired or wireless interface connected to a local area network (LAN), the Internet, a wide area network (WAN), or a combination thereof. The functionality of any given module of the present disclosure may be distributed among a plurality of modules connected via an interface circuit. For example, multiple modules can enable load balancing. In a further example, the server (also known as remote or cloud) module may perform some functionality on behalf of the client module.

As used above, the term code can include software, firmware, and / or microcode and may refer to programs, routines, functions, classes, data structures, and / or objects. The term shared processor circuit includes a single processor circuit that executes some or all of the code from multiple modules. The term group processor circuit includes processor circuits that, in combination with additional processor circuits, execute some or all of the code from one or more modules. References to multiple processor circuits include multiple processor circuits on individual dies, multiple processor circuits on a single die, multiple cores on a single processor circuit, multiple threads on a single processor circuit, and more. Or includes a combination of these. The term shared memory circuit includes a single memory circuit that stores some or all of the code from multiple modules. The term group memory circuit includes memory circuits that, in combination with additional memory, store some or all of the code from one or more modules.

The term memory circuit is a subset of the term computer readable medium. The term computer-readable medium as used herein does not include transient electrical or electromagnetic signals propagating through a medium (such as on a carrier wave). Therefore, the term computer-readable medium can be regarded as tangible and non-temporary. Non-volatile examples of non-temporary and tangible computer-readable media are non-volatile memory circuits (such as flash memory circuits, erasable programmable read-only memory circuits, or mask read-only memory circuits), SRAM circuits and DRAM circuits. Volatile memory circuits (such as), magnetic storage media (such as analog or digital magnetic tape or hard disk drives), and optical storage media (such as CDs, DVDs, or Blu-ray discs).

The devices and methods described in this application are partially or completely by a dedicated computer created by configuring a general purpose computer to perform one or more specific functions embodied in a computer program. Can be carried out. The above functional blocks, flowchart elements, and other elements serve as software specifications and can be converted into computer programs by the day-to-day work of a skilled technician or programmer.

A computer program contains processor executable instructions stored on at least one non-temporary tangible computer-readable medium. Computer programs may also contain or depend on stored data. A computer program is a basic input / output system (BioS) that interacts with the hardware of a dedicated computer, a device driver that interacts with a specific device on the dedicated computer, one or more operating systems, user applications, background services, and background. It may include an application or the like.

Computer programs are (i) parsed descriptive text such as HTML (hypertext markup language), XML (extended markup language), or JSON (Javascript Object Notation), (ii) assembly code, (iii). ) Object code generated from source code by the compiler, (iv) source code for execution by the interpreter, (v) source code for compilation and execution by the just-in-time compiler, and the like. As an example, the source code is C, C ++, C #, Objective-C, Swift, Haskell, Go, SQL, R, Lisp, Java®, Fortran, Perl, Pascal, Curl, OCaml, Javascript (registered). Trademarks), HTML5 (Hypertext Markup Language 5th Revised Edition), Ada, ASP (Active Server Pages), PHP (Hypertext Preprocessor), Scala, Eiffel, Smalltalk, Erlang, Ruby, Flash®, VisualBasic (registered trademarks) Can be written using language syntax, including Registered Trademarks), Lua, MATLAB, SIMULINK, and Python®.

In any of the elements described in the claims, the element uses the phrase "means for" or, in the case of a method claim, "process for" or "step for". Unless explicitly stated using the phrase, it is not intended to be a Means Plus function element within the meaning of US Patent Law Article 112 (f).

Claims (19)

It ’s a vehicle access system.
Multiple antennas configured to receive each signal transmitted from the portable access device to the vehicle,
One of the plurality of antennas is a circularly polarized antenna, which down-converts the received signal to generate an in-phase signal and an orthogonal phase signal, and determines the arrival angle of the received signal received by the multiple antennas. It comprises an access module configured to run the MUSIC algorithm, determine the distance between the portable access device and the vehicle based on the angle of arrival, and grant access to the vehicle based on the distance. Access system. Multiple antennas
A circularly polarized antenna including a conductive ring-shaped body with an inner hole,
A circular isolator connected to the conductive ring-shaped body,
It is equipped with a circularly polarized antenna and a linearly polarized antenna that is connected to a circular isolator and extends outward from the circular isolator.
The linearly polarized antenna is
With a sleeve
With a conductive element that extends through the sleeve,
The access system according to claim 1, wherein the linearly polarized antenna extends orthogonally to the radius of the circularly polarized antenna. While executing the MUSIC algorithm, the access module collects an analysis signal sample of the signal received by each of the multiple antennas, generates a received data matrix, and estimates the data covariance matrix based on the received data matrix. Then, using the eigenvalue decomposition process, the M × M matrix is determined based on the covariance matrix, where M is an integer of 2 or more, the number of incident signals is determined, and the M × M matrix is pluralized. The first aspect of claim 1, wherein the MUSIC spectrum is calculated based on one of a plurality of matrices, and a peak search of the MUSIC spectrum is performed to determine the arrival angle. Access system. The access module is configured to perform a covariance smoothing method to generate a modified covariance matrix and then use an eigenvalue decomposition process to determine the M × M matrix based on the modified covariance matrix. The access system according to claim 3. While generating the received data matrix, the access module converts the in-phase and orthogonal phase sample vectors into phase-angle vectors and recreates each of the multiple antennas based on the phase-angle vector. The access system of claim 3, wherein the access system is configured to generate a sample vector and then generate a received data matrix based on the in-phase and orthogonal phase sample vectors recreated for each of the plurality of antennas. The access module creates a time vector corresponding to the in-phase and orthogonal phase sample vectors, discards some analysis signal samples acquired near the antenna switching time, and cuts each repeating part of the remaining samples at step size π. Unwrap, average the frequency of the sinusoidal waves of the remaining samples, determine the average gradient of the remaining samples, measure the standard deviation of the average gradient, and align any of the multiple antennas based on the measured standard deviation. 3. The third aspect of claim 3 is configured to determine if this is not the case and, for each of the plurality of antennas, interpolate a straight line of points on the time vector to generate a reconstructed phase angle vector. Access system. The access module checks which one of the multiple antennas has an inaccurate alignment if the standard deviation is greater than a given threshold, and then sets the standard deviation of the mean gradient for that one of the multiple antennas. The access system of claim 6, configured to be remeasured. The access module uses a calibrated array manifold containing multiple antennas to remove the source signals one at a time, and forces the source signal to be in an offset position, leaving the remaining signal. The access system of claim 1, configured to perform a clean method comprising performing an iterative process comprising recalculating the angle of arrival of. The access system of claim 1 and
With the body
With a roof, center console, floor, or at least a partially enclosed metal structure,
Vehicles with multiple antennas mounted on the roof, center console, floor, or at least one of the partially enclosed metal structures. 9. The vehicle of claim 9, wherein the plurality of antennas include a multi-axis polarized RF antenna assembly, the multi-axis polarized RF antenna assembly comprises a circularly polarized antenna, and is oriented in the roof. Receiving the signal transmitted from the portable access device to the vehicle by each of the plurality of antennas, where one of the plurality of antennas is a circularly polarized antenna.
To downconvert the received signal to generate an in-phase signal and a quadrature phase signal,
To execute the MUSIC algorithm to determine the arrival angle of the received signal received by multiple antennas,
Determining the distance between the portable access device and the vehicle based on the angle of arrival, and
A method of allowing access to a vehicle based on distance. Running the MUSIC algorithm is
Analyzing signals received by each of multiple antennas Collecting signal samples to generate a received data matrix,
Estimating the data covariance matrix based on the received data matrix,
Using the eigenvalue decomposition process to determine the M × M matrix based on the covariance matrix, where M is an integer greater than or equal to 2.
Determining the number of incident signals,
Dividing an M × M matrix into multiple matrices,
Computing the MUSIC spectrum based on one of multiple matrices, and
11. The method of claim 11, comprising performing a peak search of the MUSIC spectrum to determine the arrival angle. Performing a covariance smoothing method to generate a modified covariance matrix, and
12. The method of claim 12, further comprising determining an M × M matrix based on a modified covariance matrix using an eigenvalue decomposition process. Converting in-phase and orthogonal phase sample vectors into phase angle vectors while generating the received data matrix,
Generating in-phase and quadrature sample vectors to be recreated for each of multiple antennas based on the phase angle vector, and
12. The method of claim 12, further comprising generating a received data matrix based on in-phase and quadrature sample vectors recreated for each of the plurality of antennas. Creating time vectors corresponding to in-phase and quadrature sample vectors,
Discarding some analysis signal samples acquired near the antenna switching time,
Unwrap each repeating part of the remaining sample with step size π,
Averaging the frequencies of the sine waves of the remaining samples,
Determining the average gradient of the remaining samples,
Measuring the standard deviation of the mean gradient,
Determining which of the multiple antennas is not aligned based on the measured standard deviation, and
12. The method of claim 12, further comprising interpolating a straight line of points on a time vector for each of the plurality of antennas to generate a reconstructed phase angle vector. If the standard deviation is greater than a given threshold, check which one of the multiple antennas has inaccurate alignment, and
15. The method of claim 15, further comprising re-measuring the standard deviation of the mean gradient with respect to one of the plurality of antennas. A calibrated array manifold containing multiple antennas is used to remove the source signals one at a time, and to force the source signal to be in an offset position so that the remaining signal arrives. Performing an iterative process, including recalculating the angles of, and performing clean methods, including converging to a new set of incident arrival angles while performing the iterative process. The method according to claim 11. The vehicle comprises (i) a body and (ii) a roof, a center console, a floor, or at least a partially enclosed metal structure.
11. The method of claim 11, wherein the plurality of antennas are mounted on at least one of a roof, a center console, a floor, or at least a partially enclosed metal structure. Multiple antennas include a multi-axis polarized RF antenna assembly
19. The method of claim 19, wherein the multi-axis polarized RF antenna assembly comprises a circularly polarized antenna and is oriented in the roof.

Images