JP7226585B2 - A Passive Entry/Passive Start System Implementing the MUSIC Algorithm Based on Angle of Arrival Determination of Signals Received Through a Circularly Polarized Antenna - Google Patents

Description

Cross-references to related applications

This application claims priority to U.S. patent application Ser. /744814, U.S. Provisional Application No. 62/801,392 filed Feb. 5, 2019, and U.S. Provisional Application No. 62/826212, filed Mar. 29, 2019, 2019. This is a continuation-in-part of US application Ser. No. 16/598,191 filed Oct. 10. This application also claims priority to U.S. Provisional Application No. 62/823,210, filed March 25, 2019, and U.S. Provisional Application No. 62/826,276, filed March 29, 2019.

The present disclosure relates to passive entry/passive start systems.

The background description provided herein is for the purpose of generally presenting the context of the present disclosure. The inventor's work to the extent described in this Background section, as well as portions of the description that may not be considered prior art at the time of filing, are expressly or implicitly identified as prior art to the present disclosure. Not acceptable.

Conventional passive entry/passive start (PEPS) systems provide user access to various vehicle functions when the user possesses a key fob that is paired with the onboard PEPS electronic controller (or PEPS module). Allow keyless entry, including As an example, a user with a key fob may approach a vehicle equipped with a PEPS module. The key fob communicates with the PEPS module, and if the key fob is authenticated, the PEPS module can unlock the vehicle doors. The PEPS module (i) performs an authentication process to determine if the key fob is authorized to access the vehicle, and (ii) determines the location of the key fob relative to the vehicle. The authentication process may include exchange of encrypted passwords or signatures. If the password or signature is correct, the key fob is determined to be authorized. The location of the key fob can be determined, for example, based on the strength of the signal received from the key fob. If the key fob is authenticated and located within the vehicle's authorized zone, access to the interior of the vehicle is granted without the use of a conventional key.

As another example, a user possessing a key fob may activate a vehicle function by pressing a button on the key fob. In response to the button press, the key fob communicates with the PEPS module, and if the key fob is authenticated and within a predetermined distance of the vehicle, the PEPS module communicates the specified (e.g., start the vehicle, open a door, sound an alarm, etc.). The communications performed in two examples may include the key fob and PEPS modules performing a one-way low frequency (LF) wake-up function and a one-way or two-way radio frequency (RF) authentication function.

A phone-as-a-key (PAK) vehicle access system can operate similarly to the PEPS system described, except that a cell phone is used to access the vehicle rather than a key fob. As an example, a mobile phone can communicate with a PAK module or telematics control unit (TCU) in a vehicle to initiate an access pairing process. The mobile phone and either the PAK module or the TCU perform an access pairing process to establish a trust relationship. The pairing process may include Bluetooth® pairing, whereby security information is exchanged directly between the mobile phone and the vehicle, including the mobile phone address, mobile phone ID resolution key, reservation identifier, and/or cryptographic keys are exchanged via a cloud-based network, and/or a mobile phone presents a certificate to the vehicle, which certificate is used by (i) the mobile phone, (ii) the vehicle's manufacturing It is signed by a trusted security signing authority, such as a merchant, and/or (iii) a trusted third party. In the case of a certificate, the certificate may include the identifier of the person authorized to access the vehicle, the identifier of the cloud-based network authorized to transfer the certificate, the identifier of the vehicle rental or lease contract, the identifier of the vehicle, the authorization It may include dates and periods during which the authorized person is permitted to use the vehicle, and/or other restrictions, and/or access/licensing information.

For passive entry, typically some user action is required to initiate the process of waking up the key fob or cell phone (referred to as a portable access device). For example, this includes the user approaching the vehicle with the portable access device and/or touching and/or pulling on the door handle. When the PEPS module or PAK module, called the access module, detects this motion, the access module performs a positioning process to initiate searching and waking up the key fob. In a one-way RF system, an LF downlink signal (e.g., a 125 kilohertz (kHz) signal) is sent from the access module to the key fob to wake up the key fob and send commands and data to the key fob for authentication purposes. be done. The key fob then transmits a response signal to the access module over the RF uplink. The response signal may be very high frequency (eg, 315 megahertz (MHz) or 433 MHz). In a bi-directional RF system, an LF downlink signal is sent from the access module to the key fob to wake up the key fob and establish a bi-directional RF link between the access module and the key fob. A bi-directional RF link can transmit signals at UHF frequencies (eg, 315 MHz, 422 MHz, 868 MHz, or 915 MHz). A two-way RF link is then used to authenticate the key fob. The key fob contains a microcontroller that maintains a sleep mode (or low power listening mode) that constantly checks for valid LF signals. A valid LF signal containing the correct vehicle-specific wake-up identifier causes the microcontroller to generate a signal to wake up the PEPS controller to communicate with the vehicle's access module.

A vehicle may, for example, have 4-6 LF antennas that generate LF magnetic fields. The key fob controller measures the LF signal level during communication with the access module. The controller determines a received signal strength indicator (RSSI) and provides the RSSI to the access module. The access module then determines the location of the key fob based on the RSSI. The key fob contains three separate antenna coils or one 3D coil that is used to determine the x, y, and z axis values that indicate the key fob's position.

Smartphones, wearable devices, and/or other smart portable network devices can function as key fobs. Smart portable network devices can enable various vehicle functions such as passive welcome lighting, distance demarcation in remote parking applications, and long-range distance functions.

A vehicle access system is provided and includes an antenna and an access module. The antennas are configured to each receive signals transmitted from the portable access device to the vehicle. The antenna includes a circularly polarized antenna and a linearly polarized antenna. A linearly polarized antenna extends perpendicular to the radius of a circularly polarized antenna . The access module downconverts the received signal to produce an in-phase signal and a quadrature-phase signal, executes a MUSIC algorithm to determine the angle of arrival of the received signal received at the antenna, and based on the angle of arrival: It is configured to determine a distance between the portable access device and the vehicle and to grant access to the vehicle based on the distance.

In other features, the antenna is a circularly polarized antenna including a conductive ring-shaped body having an inner bore, a circular isolator connected to the conductive ring-shaped body, and the circularly polarized antenna and the circular isolator connected. , and a linearly polarized antenna extending outwardly from the circular isolator. A linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. A linearly polarized antenna extends perpendicular to the radius of a circularly polarized antenna.

In other features, the access module collects analytical signal samples of signals received at each antenna while executing the MUSIC algorithm to generate a received data matrix; Estimate the matrix and use an eigenvalue decomposition process to determine an M×M matrix based on the covariance matrix, where M is an integer greater than or equal to 2, determine the number of incident signals, M×M It is configured to divide the matrix into multiple matrices, calculate a MUSIC spectrum based on one of the matrices, and perform a peak search of the MUSIC spectrum to determine the angle of arrival.

In other features, the access module performs a covariance smoothing method to generate a modified covariance matrix and uses an eigenvalue decomposition process to determine an M×M matrix based on the modified covariance matrix. configured to

In other features, the access module converts the inphase and quadrature sample vectors to phase angle vectors while generating the receive data matrix, and recreates the inphase and quadrature samples for each antenna based on the phase angle vectors. It is configured to generate a quadrature sample vector and to generate a received data matrix based on the recreated in-phase and quadrature sample vectors for each antenna.

In other features, the access module creates time vectors corresponding to the in-phase and quadrature sample vectors, discards some analysis signal samples acquired around the antenna switching time, and repeats each iteration of the remaining samples. Unwrap the part with a step size π, average the frequency of the sine wave of the remaining samples, find the average slope of the remaining samples, measure the standard deviation of the average slope, and based on the measured standard deviation, which antenna are not aligned, and for each antenna is configured to interpolate a straight line of points on the time vector to produce a reconstructed phase angle vector.

In another feature, the access module checks which one of the antennas has incorrect alignment if the standard deviation is greater than a predetermined threshold, and for that one the standard deviation of the average slope is configured to remeasure the

In other features, the access module removes the source signals one at a time using a calibrated array manifold containing antennas, and forces the position of the source signals to an offset position to remain is configured to perform a clean method including performing an iterative process including recalculating the angle of arrival of the signal. The access module converges on a new set of incident arrival angles while iterating.

In another aspect, a vehicle is provided that includes a body and a roof, center console, floor, or at least partially enclosed metal structure. An antenna is mounted to at least one of the roof, center console, floor, or at least partially enclosed metal structure.

In other features, the antenna includes a multi-axis polarized RF antenna assembly, the multi-axis polarized RF antenna assembly including a circularly polarized antenna oriented at the roof.

In other features, a method is provided comprising receiving a signal transmitted from a portable access device to a vehicle with each of a plurality of antennas comprising a circularly polarized antenna and a linearly polarized antenna , wherein: The linearly polarized antenna extends orthogonally to the radius of the circularly polarized antenna , downconverts the received signal to produce in-phase and quadrature signals, and performs the MUSIC algorithm to generate the signals received at the antenna. determining an angle of arrival of the received signal; determining a distance between the portable access device and the vehicle based on the angle of arrival; and granting access to the vehicle based on the distance.

In other features, executing the MUSIC algorithm includes collecting analysis signal samples of signals received at each antenna to generate a received data matrix, estimating a data covariance matrix based on the received data matrix. determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to 2 and determining the number of incident signals, M×M Splitting the matrix into multiple matrices, calculating a MUSIC spectrum based on one of the matrices, and performing a peak search of the MUSIC spectrum to determine the angle of arrival.

In another aspect, the method performs a covariance smoothing method to generate a modified covariance matrix, and uses an eigenvalue decomposition process to determine an M×M matrix based on the modified covariance matrix. further comprising:

In another aspect, the method includes converting the in-phase and quadrature sample vectors to phase angle vectors while generating the receive data matrix; Further comprising generating a quadrature sample vector and generating a received data matrix based on the recreated in-phase and quadrature sample vectors for each antenna.

In other features, the method includes creating time vectors corresponding to the in-phase and quadrature sample vectors, discarding some analysis signal samples acquired around the antenna switching time, unwrapping the repeated portion with a step size π, averaging the sinusoidal frequency of the remaining samples, determining the average slope of the remaining samples, measuring the standard deviation of the average slope, the measured standard Further determining which antennas are misaligned based on the deviations and, for each antenna, interpolating a straight line of points on the time vector to produce a reconstructed phase angle vector. include.

In other features, the method checks which one of the antennas has incorrect alignment if the standard deviation is greater than a predetermined threshold, and for one of the antennas, the average slope further comprising re-measuring the standard deviation of

In another aspect, the method includes removing source signals one at a time using a calibrated array manifold containing antennas, and forcing the position of the source signals to offset positions and remaining Performing an iterative process that includes recalculating the signal direction-of-arrival angles, and performing a clean method that includes converging to a new set of incident arrival angles while performing the iterations. further includes

In other features, a vehicle includes (i) a body and (ii) a roof, center console, floor, or at least partially enclosed metal structure. An antenna is mounted to at least one of the roof, center console, floor, or at least partially enclosed metal structure.

In other features, the antenna includes a multi-axis polarized RF antenna assembly. A multi-axis polarized RF antenna assembly includes a circularly polarized antenna and is oriented at the roof.

A vehicle access system is provided. The access system includes a receiver and an access module. The receiver is configured to receive signals transmitted from the portable access device to the vehicle. The access module generates a differentiated signal based on the received signal, upsamples the differentiated signal to generate a first upsampled signal, obtains or generates an expected signal, upsamples the expected signal to a first generating two upsampled signals; cross-correlating the first upsampled signal and the second upsampled signal to generate a cross-correlated signal; based on the cross-correlated signal, generating the first upsampled signal and the second upsampled signal; is configured to determine a phase difference between the upsampled signal of the receiver, determine the round trip time of the signal received by the receiver, and grant access to the vehicle based on the round trip time.

In other features, the access module downconverts the signal to produce a downconverted signal, samples the downconverted signal to produce a sampled signal, performs an arctangent of the sampled signal to produce an arctangent signal and differentiate the arctangent signal to produce a differentiated signal.

In other features, the access module determines at least one of a location or distance of the portable access device relative to the vehicle based on the round trip time and grants access to the vehicle based on at least one of the location or distance. configured to

In other features, the access module comprises a first upsampler configured to upsample the differentiated signal to produce a first upsampled signal; and an upsampler to upsample the expected signal to produce a second upsampled signal. and a second upsampler configured to generate a sampling signal. The upsampling rate of the first upsampler is the same sampling rate as the second upsampler.

In other features, the access module includes a sign module configured to determine the sign of the differentiated signal and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.

In other features, the access module is configured to obtain an expected signal, the expected signal being a predetermined signal obtained by the access module prior to receiving the received signal.

In other features, the access module multiplies bits of the first upsampled signal and the second upsampled signal to produce a resulting product, sums the resulting products, and provides a sum of products value. and configured to perform an iterative process including shifting a second upsampling signal with respect to the first upsampling signal. The iterative process provides sum-of-products values. The access module is configured to determine the phase difference based on the sum of products value.

In other features, the access module is configured to reconstruct the signal transmitted from the portable access device to the vehicle based on zero crossings of the portion of the cross-correlation signal associated with the maximum sum-of-products value.

In other features, the access module comprises an upsampler configured to upsample the differentiated signal to generate a first upsampled signal; and a sign of the first upsampled signal. and a bit pattern module configured to generate an expected signal based on the sign of the first upsampled signal.

In another aspect, a portable access device for a vehicle access system is provided. A portable access device includes a receiver and a control module. The receiver is configured to receive signals transmitted from the vehicle's access module to the portable access device. The control module generates a differentiated signal based on the received signal, upsamples the differentiated signal to generate a first upsampled signal, obtains or generates an expected signal, upsamples the expected signal, and produces a first generating two upsampled signals; cross-correlating the first upsampled signal and the second upsampled signal to generate a cross-correlated signal; based on the cross-correlated signal, generating the first upsampled signal and the second upsampled signal; determine the phase difference between the upsampled signal of the receiver, determine the round trip time of the signal received by the receiver, and transmit the round trip time to the vehicle to gain access to the vehicle based on the round trip time. or, is configured to determine at least one of the position or distance between the portable access device and the vehicle and transmit at least one of the position or distance to the vehicle to gain access to the vehicle. .

In other features, the control module downconverts the signal to produce a downconverted signal, samples the downconverted signal to produce a sampled signal, performs an arctangent of the sampled signal, and produces an arctangent signal. and configured to differentiate the arctangent signal to generate a differentiated signal.

In other features, the control module determines at least one of a position or distance of the portable access device relative to the vehicle based on the round trip time, and accesses the vehicle based on at least one of the position or distance. is configured to transmit at least one of position or distance to the vehicle in order to obtain

In other features, the control module comprises a first upsampler configured to upsample the differentiated signal to generate a first upsampled signal; and a first upsampler configured to upsample the expected signal to generate a second upsampled signal. a second upsampler configured to generate a sampling signal, wherein the upsampling rate of the first upsampler is the same sampling rate as the second upsampler.

In other features, the control module includes a sign module configured to determine the sign of the differentiated signal and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.

In other features, the control module is configured to obtain an expected signal, the expected signal being a predetermined signal obtained by the access module prior to receiving the received signal.

In other features, the control module multiplies bits of the first upsampled signal and the second upsampled signal to produce a resulting product, sums the resulting products, and produces a sum of products value. and configured to perform an iterative process including shifting a second upsampling signal with respect to the first upsampling signal. The iterative process provides sum-of-products values. The control module is configured to determine the phase difference based on the sum of products value.

In other features, the control module is configured to reconstruct the signal transmitted from the access module of the vehicle to the portable access device based on zero crossings of the portion of the cross-correlation signal associated with the maximum value of the sum of products value. be done.

In other features, the control module is configured to determine an upsampler configured to upsample the differentiated signal to generate a first upsampled signal and a sign of the first upsampled signal. and a bit pattern module configured to generate an expected signal based on the sign of the first upsampled signal.

A vehicle access system is provided. An access system includes an antenna and an access module. The antennas are configured to each receive signals transmitted from the portable access device to the vehicle. The signal is transmitted at a frequency of 2.4 Gigahertz. The access module down-converts the received signal to produce in-phase and quadrature signals and executes a MUSIC algorithm to (i) determine the distance between the portable access device and the vehicle, and (ii) ) perform carrier phase-based ranging including determining the angle of arrival of a received signal received at an antenna; determine the position of the portable access device relative to the vehicle based on the range and angle of arrival; is configured to allow access to the vehicle based on

In other features, the antenna is positioned on the vehicle such that received signals have multiple corresponding bounce paths between the portable access device and the antenna.

In other features, the antenna is located within the metal structure of the vehicle.

In other features, the antenna is positioned such that there is no line of sight between the antenna and the portable access device.

In other features, the access system further includes sensors, each sensor including two or more antennas, the sensors having a plurality of corresponding bounce paths for received signals between the portable access device and the respective sensor. are placed in the vehicle as follows.

In other features, the access module monitors the received signal, generates a received signal strength indicator based on the received signal, and determines whether the portable access device is inside or outside the vehicle based on the received signal strength indicator. and is configured to determine the distance between the portable access device and the vehicle if the portable access device is outside the vehicle.

In other features, at least one of the antennas is a circularly polarized antenna.

In other features, the antenna is a circularly polarized antenna including a conductive ring-shaped body having an inner bore, a circular isolator connected to the conductive ring-shaped body, and the circularly polarized antenna and the circular isolator connected. , and a linearly polarized antenna extending outwardly from the circular isolator. A linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. A linearly polarized antenna extends perpendicular to the radius of a circularly polarized antenna.

In other features, the access module collects analytical signal samples of signals received at each antenna while executing the MUSIC algorithm to generate a received data matrix; Estimate the matrix and use an eigenvalue decomposition process to determine an M×M matrix based on the covariance matrix, where M is an integer greater than or equal to 2, determine the number of incident signals, M×M It is configured to divide the matrix into matrices, calculate a MUSIC spectrum based on one of the matrices, and perform a peak search of the MUSIC spectrum to determine the angle of arrival.

In other features, the receiver includes a phase-locked loop and is phase-locked with the portable access device's transmitter. The access module is configured to perform tone exchange with the transmitter and determine at least one of range or angle of arrival based on the tone exchange.

In other features, the receiver includes a phase-locked loop and is phase-locked with the portable access device's transmitter. The access module is configured to perform tone exchange with the transmitter, determine round trip time of flight information based on the tone exchange, and determine distance based on the round trip time of flight information.

In another aspect, a vehicle is provided that includes an access system, a body, and a roof, center console, floor, or at least partially enclosed metal structure. An antenna is mounted to at least one of the roof, center console, floor, or at least partially enclosed metal structure.

In other features, a method is provided comprising: receiving at each of a plurality of antennas a signal transmitted from a portable access device to a vehicle; the signal transmitted at a frequency of 2.4 gigahertz; Downconverting to produce in-phase and quadrature signals, (i) determining the distance between the portable access device and the vehicle, and (ii) determining the angle of arrival of the received signal received at the antenna. determining the position of the portable access device relative to the vehicle based on the range and angle of arrival; and determining the position of the portable access device relative to the vehicle based on the position. Including granting access.

In other features, the antenna is positioned on the vehicle such that received signals have multiple corresponding bounce paths between the portable access device and the antenna.

In other features, the antenna is positioned such that there is no line of sight between the antenna and the portable access device.

In other features, pairs of antennas are implemented as part of respective sensors. The sensors are arranged in the vehicle such that received signals have multiple corresponding bounce paths between the portable access device and each sensor.

In other features, the method includes monitoring the received signal, generating a received signal strength indicator based on the received signal, and determining whether the portable access device is inside or outside the vehicle based on the received signal strength indicator. and determining the distance between the portable access device and the vehicle if the portable access device is outside the vehicle.

In other features, at least one of the antennas is a circularly polarized antenna.

In another aspect, the method includes, while executing the MUSIC algorithm, collecting analysis signal samples of signals received at each antenna to generate a received data matrix; estimating a matrix; determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to 2 and determining the number of incident signals; It further includes dividing the M×M matrix into multiple matrices, calculating a MUSIC spectrum based on one of the matrices, and performing a peak search of the MUSIC spectrum to determine the angle of arrival.

In other features, the method further includes performing tone exchange with a transmitter of the portable access device and determining at least one of range or angle of arrival based on the tone exchange. The portable access device receiver, which performs tone switching, includes a phase-locked loop and is phase-locked with the portable access device transmitter.

In other features, the method further includes performing tone exchange with the transmitter, determining round-trip time-of-flight information based on the tone exchange, and determining distance based on the round-trip time-of-flight information. . The portable access device receiver, which performs tone switching, includes a phase-locked loop and is phase-locked with the portable access device transmitter.

A multi-axis polarized RF antenna assembly is provided, the multi-axis polarized RF antenna assembly includes a circularly polarized antenna, a circular isolator and a linearly polarized antenna. A circularly polarized antenna includes a conductive ring-shaped body having an inner bore. A circular isolator is connected to the conductive ring-shaped body. A linearly polarized antenna is connected to the circularly polarized antenna and the circular isolator and extends outwardly from the circular isolator. A linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. A linearly polarized antenna extends perpendicular to the radius of a circularly polarized antenna.

In other features, the conductive elements are wires. In other features, the sleeve is formed of polytetrafluoroethene. The conductive elements are made of copper.

In other features, the linearly polarized antenna is configured to extend downwardly from the circularly polarized antenna when in use.

In other features, the circularly polarized antenna is a dual axis antenna. A linearly polarized antenna is a single axis antenna.

In other features, the multi-axis polarized RF antenna assembly further includes a ground layer. A circular isolator is placed on the ground plane between the conductive element and the ground plane and between the circularly polarized antenna and the ground plane.

In other features, the circularly polarized antenna includes two feed points that are 90° phase offset and configured to receive signals that are 90° out of phase with each other.

In another aspect, a vehicle is provided, the vehicle including a body and a roof. The roof includes a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly is oriented at the roof such that the linearly polarized antenna extends downward from the circularly polarized antenna.

In other features, a vehicle system is provided and includes a multi-axis polarized RF antenna assembly, a second multi-axis polarized RF antenna assembly, and an access module. The multi-axis polarized RF antenna assembly is a first multi-axis polarized RF antenna assembly and is configured to be mounted on a vehicle. A second multi-axis polarized RF antenna assembly is configured to be mounted on a vehicle and includes a second conductive ring-shaped body having a second bore; A second circular isolator connected to the conductive ring-shaped body and a second linearly polarized antenna connected to the second circular isolator and extending outwardly from the second circular isolator. The second linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. A second linearly polarized antenna extends perpendicular to the radius of the second circularly polarized antenna. The access module is connected to the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly, the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly configured to communicate with a portable access device via a

In other features, at any one time at least one of the linearly polarized antenna or the first multi-axis polarized RF antenna assembly is not cross-polarized with the antenna of the second multi-axis polarized RF antenna assembly.

In other features, the access module includes receiving and transmitting radio frequency signals via a first one of the multi-axis polarized RF antenna assemblies and a second one of the multi-axis polarized RF antenna assemblies. configured to perform an action or a phone-as-a-key action;

In other features, the access module is configured to grant access to the vehicle based on the radio frequency signal.

In other features, the access module uses any antenna pair of the first one of the multi-axis polarized RF antenna assemblies and the second one of the multi-axis polarized RF antenna assemblies for communication with the portable access device. configured to run an algorithm to determine what should be done. In other features, the portable access device is a key fob or mobile phone.

In another aspect, a method of communicating with a portable access device is provided. The method includes repeatedly executing an algorithm via the access module of the vehicle, the algorithm selecting one frequency from among the frequencies, selecting one antenna pair from the possible antenna pairs, The antennas of the antenna pair that can be used include antennas with different polarization axes, transmitting the packet to the portable access device via the selected antenna pair, the first received signal strength indicator (RSSI) and the response signal. A sequence of operations including receiving from the portable access device, a first RSSI corresponding to the transmission of the packet, and measuring a second RSSI of the response signal. Based on the first RSSI and the second RSSI, the best antenna pair among the antenna pairs that can be considered the best one among the frequencies is selected. One or more additional packets are transmitted using the best selected frequency and the best selected antenna pair.

In other features, each antenna pair selected includes one linearly polarized antenna and one circularly polarized antenna.

In other features, the method of claim 1 comprises transmitting one or more additional packets to authorize the portable access device, whether the portable access device is authorized to access the interior of the vehicle. and allowing access to the interior of the vehicle if the portable access device is authorized.

In other features, the method calculates flight times of the one or more additional packets including time to transmit the one or more additional packets to the portable access device and time to receive one or more responses from the portable access device. Further comprising measuring and estimating a distance between the vehicle and the portable access device based on the measured flight time.

In other features, the estimated distance is used to detect if another device is attempting a range extender type relay station attack. In other features, the method of claim 4 further comprises implementing countermeasures including preventing access to the interior of the vehicle if another device is attempting to perform a range extender type relay station attack. . In another aspect, the countermeasures include notifying vehicle owners of range extender type relay station attacks.

In other features, the method exchanges multiple pairs of unmodulated carrier tones at multiple frequencies with the portable access device, wherein the pairs of unmodulated carrier tones include receive tones and transmit tones, wherein the ratio of receive tones to transmit tones. Further including measuring phase and collecting frequency data, and estimating a distance between the vehicle and the portable access device based on the measured phase and frequency data.

In other features, the method includes determining whether another device is attempting a range extender type relay station attack based on the estimated range. In other features, each antenna pair selected includes linearly polarized antennas.

In another aspect, the algorithm includes switching possible antenna pairs between consecutively transmitted packets. In another aspect, the algorithm includes switching between possible antenna pairs during transmission of a portion of the packet. In other features, some of the packets are continuous wave tones.

In another aspect, a particular pair of possible antenna pairs includes two collocated antennas.

In other features, the method includes: transmitting a packet to a portable access device; measuring a time-of-flight value for the packet based on a response signal received from the portable access device; the response signal transmitted based on the packet; determining whether another device is performing a range extender-type relay station attack based on the time-of-flight value; and preventing access to the

In other features, the portable access device is a key fob or mobile phone. In other features, the method further includes encrypting the identifier of the best antenna pair. Transmission of one or more additional packets contains the encrypted identifier of the best antenna pair.

In other features, a vehicle system is provided for communicating with a portable access device. The vehicle system includes antennas and access modules with different polarization axes. The access module is configured to repeatedly execute the algorithm. The algorithm selects one frequency from a plurality of frequencies, selects one antenna pair from antennas with different polarization axes, transmits the packet to the portable access device via the selected antenna pair, A series of processes including receiving a first RSSI and a response signal from the portable access device, the first RSSI corresponding to transmission of the packet, and measuring a second RSSI of the response signal. . The access module selects a best one of the frequencies and a best antenna pair of the antenna pairs based on the first RSSI and the second RSSI; It is configured to transmit one or more additional packets using the best pair of antennas.

In other features, the access module measures the flight time of the one or more additional packets including the time to transmit the one or more additional packets to the portable access device and the time to receive the one or more responses from the portable access device. and estimates the distance between the vehicle and the portable access device based on the measured time of flight.

In other features, the access module exchanges multiple pairs of unmodulated carrier tones at multiple frequencies with the portable access device, the unmodulated carrier tones including a receive tone and a transmit tone, and phase of the receive tone with respect to the transmit tone. It is configured to measure, collect the measured phase and frequency data, and use the measured phase and frequency data to estimate a distance between the vehicle and the portable access device.

In other features, the access module is configured to detect whether the portable access device is attempting to perform a range extender type relay station attack based on the estimated range.

In other features, the access module is configured to detect whether a device is attempting a range extender type relay station attack based on the estimated range.

In other features, the access module is configured to take countermeasures including preventing access to the interior of the vehicle if the portable access device is attempting to conduct a range extender type relay station attack.

In another aspect, the countermeasures include notifying vehicle owners of range extender type relay station attacks. In other features, the portable access device is a key fob or mobile phone.

In other features, the portable access device is configured to encrypt the identifier of the best antenna pair. Transmission of one or more additional packets contains the encrypted identifier of the best antenna pair.

In another aspect, a system is provided for detecting range extender type relay attacks. The system includes a first transmitter, a receiver, and a first module. A first transmitter is configured to transmit a first radio frequency signal from one of the vehicle and the portable access device to the other one of the vehicle and the portable access device. A receiver is configured to receive a first response signal from one of the vehicle and the portable access device in response to the first radio frequency signal. A first module monitors or generates one or more parameters associated with transmission of the first radio frequency signal and reception of the first response signal, and based on the one or more parameters, access to the vehicle. or detect a range extension type relay attack performed by an attack device to gain at least one operational control of the vehicle, wherein (i) the first radio frequency signal is transmitted from the vehicle to the portable access device to the attack device; or (ii) the first response signal is relayed from the portable access device to the vehicle via an attack device, and detecting a range extension type relay attack It is configured to implement countermeasures depending on what is to be done.

In other features, the first module is mounted on the vehicle. In other features, the first module is implemented in a portable access device.

In other features, the first module is configured to measure a round trip time of the first radio frequency signal and detect range extension type relay attacks based on the round trip time.

In other features, the first module transmits the second radio frequency signal and receives the second response signal prior to transmitting the first radio frequency signal and receiving the first response signal; monitoring at least one of the first received signal strength indicator of the second radio frequency signal or the second received signal strength indicator of the second response signal; configured to determine at least one of a path, frequency, channel, or antenna pair for transmission of the first radio frequency signal and reception of the first response signal based on at least one of the received signal strength indicators; be done.

In other features, the first module transmits the second radio frequency signal and receives the second response signal prior to transmitting the first radio frequency signal and receiving the first response signal; monitoring an antenna polarization state corresponding to at least one of the second radio frequency signal or the second response signal, based on the antenna polarization state of at least one of the first radio frequency signal or the first response signal; , to determine at least one of a path, frequency, channel, or antenna pair for transmission of the first radio frequency signal and reception of the first response signal.

In other features, the first module is configured to transmit the first radio frequency signal while receiving the first response signal or the second radio frequency signal from one of the vehicle and the portable access device. be.

In other features, the first module is configured to receive the first response signal while receiving a second radio frequency signal from one of the vehicle and the portable access device.

In other features, the first module determines a randomly selected set of frequencies or channels; shares the randomly selected set of frequencies or channels with one of the vehicle and the portable access device; and It is configured to transmit a first radio frequency signal and receive a first response signal based on a randomly selected frequency or channel.

In other features, the first module randomizes an access address of the vehicle or portable access device, shares the randomized access address with the portable access device, and controls the first radio including one of the access addresses. configured to generate a frequency signal;

In other features, the first module is configured to measure a length of at least one bit of the first response signal and detect a range extension type relay attack based on the length of at least one bit. be done.

In other features, the first module is configured to monitor slopes of rising and falling edges of the first response signal and detect range extension type relay attacks based on the slopes.

In other features, the first module uses a sliding correlation function to transform the first response signal into an idealized Gaussian waveform of known bit pattern and bit rate, including peak scaling and zero offset adjustment. aligned and configured to detect range extension type relay attacks based on the alignment.

In another feature, the first module accumulates an early portion of the first response signal after a zero crossing of the predetermined waveform and before the next peak, and averages based on the accumulated portion. and is configured to detect range extension type relay attacks based on the average.

In another feature, the first module accumulates a late stage portion of the first response signal after the peak of the predetermined waveform and before the next zero crossing; and is configured to detect range extension type relay attacks based on the average.

In other features, the first module comprises determining whether the first radio frequency signal is transmitted from the vehicle to the portable access device or from the portable access device to the vehicle. Configured to randomize the direction of travel.

In another aspect, the countermeasures include preventing at least one of access to the vehicle or operational control of the vehicle.

In other features, the system is configured to transmit dummy signals while the first transmitter transmits the first radio frequency signal or the receiver receives the first response signal. Further includes a second transmitter.

In other features, a system includes a first module mounted on a vehicle and a portable access device comprising a second module. The first module is configured to transmit a first radio frequency signal to the portable access device and receive a first response signal from the portable access device. The second module is configured to transmit a second radio frequency signal to the vehicle and receive a second response signal from the vehicle. The first module transmits the first radio frequency signal while the second module transmits the first response signal or the second radio frequency signal, or the second module transmits the second radio frequency signal. At least one of the first module receives a first response signal while transmitting the signal.

In other features, the first module and the second module exchange at least three pairs of wireless signals including sections of unmodulated carrier tones, the unmodulated carrier tones including receive tones and transmit tones; and , configured to measure the phase of the received tone with respect to the transmitted tone. One or more of the first module and the second module collect frequency and phase information and estimate a distance between the first module and the second module based on the phase and frequency information. configured as

In other features, one or more of the first module and the second module are configured to detect range extension type relay attacks using the estimated range.

In another aspect, a method is provided for detecting range extension type relay attacks. The method comprises: transmitting a radio frequency signal from one of the vehicle and the portable access device to the other one of the vehicle and the portable access device via a transmitter; responding to the radio frequency signal via a receiver; receiving a response signal from one of the vehicle and the portable access device; monitoring or generating one or more parameters associated with transmitting the radio frequency signal and receiving the response signal; detecting a range-extension-type relay attack performed by the attack device to gain at least one of access to the vehicle or operational control of the vehicle, based on. At least one of (i) the radio frequency signal is relayed from the vehicle to the portable access device via the attack device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attack device. is. The method further comprises: performing countermeasures in response to detecting a range extension type relay attack; measuring the round trip time of the radio frequency signal; Further comprising monitoring at least one of the second received signal strength indicators and detecting a range extension type relay attack based on the round trip time.

In another aspect, a system is provided for accessing a vehicle or providing operational control of the vehicle. The system includes a first antenna module comprising first antennas with different polarization axes, a transmitter configured to transmit a challenge signal from the vehicle to a slave device via the first antenna module, a slave The device is a portable access device and includes a master device including a first receiver configured to receive a response signal responsive to the challenge signal from the slave device. The system further receives a challenge signal from the transmitter and a response signal from the slave device via a second antenna module comprising a second antenna with a different polarization axis and via the second antenna module. a first sniffer device including a second receiver configured to. The first sniffer device is configured to measure when the challenge and response signals arrive at the first sniffer device to provide arrival times. The master device or the first sniffer device (i) estimates at least one of the distance from the vehicle to the slave device or the position of the slave device relative to the vehicle based on the time of arrival; and (ii) the estimated distance or It is configured to prevent at least one of access to the vehicle or motion control of the vehicle based on at least one of the locations.

In other features, the master device or the first sniffer device determines a round trip time associated with transmitting the challenge signal based on the time of arrival and at least accesses the vehicle or controls motion of the vehicle based on the round trip time. It is configured to detect range extension type relay attacks performed by an attacking device to acquire one. The response signal is relayed from the slave device to the vehicle by the attack device and modified by the attack device. The master device is configured to take countermeasures in response to detecting range extension type relay attacks.

In other features, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module at any one time.

In other features, at any one time at least one of the first antennas of the first antenna module is not cross-polarized with the antenna of the slave device.

In other features, the master device or the first sniffer device determines a first length of time for the first sniffer device to receive the challenge signal and a second length of time for the sniffer device to receive the response signal. , and is configured to estimate a distance based on the first length of time and the second length of time.

In other features, the system further includes a second sniffer and a third sniffer. A second sniffer device is configured to receive a third antenna module including a third antenna and a challenge signal from the transmitter and a response signal from the slave device via the third antenna module. and a third receiver. A third sniffer device is configured to receive a challenge signal from the transmitter and a response signal from the slave device via a fourth antenna module including a fourth antenna and via the fourth antenna module. and a fourth receiver. The second sniffer device is configured to measure when the challenge and response signals arrive at the second sniffer device to provide arrival times. A third sniffer device is configured to measure when the challenge and response signals arrive at the third sniffer device to provide arrival times. The master device, the first sniffer device, the second sniffer device, or the third sniffer device determines the arrival time provided by the first sniffer device, the arrival time provided by the second sniffer device, and the third sniffer device. It is arranged to estimate the position based on the time of arrival provided by the sniffer device.

In other features, the first sniffer device is configured to determine a first length of time for which the first sniffer device receives the response signal. The second sniffer device is configured to determine a second length of time for which the second sniffer device receives the response signal. A third sniffer device is configured to determine a third length of time for which the third sniffer device receives the response signal. A master device, a first sniffer device, a second sniffer device, or a third sniffer device estimates a position based on the first length of time, the second length of time, and the third length of time. configured to

In other features, the master device is configured to periodically send a challenge signal or other challenge signal to the slave devices and receive respective response signals from the slave devices. The first sniffer device is configured to measure when the challenge and response signals arrive at the first sniffer device to provide corresponding arrival times. The master device or the first sniffer device (i) updates at least one of distance or position based on times of arrival associated with the challenge signal and the response signal, and (ii) updates the updated distance or the updated position. Based on the at least one, it is configured to prevent at least one of access to the vehicle or operational control of the vehicle.

In another aspect, a method is provided for accessing or providing operational control of a vehicle. The method includes transmitting a challenge signal from a master device of the vehicle to a slave device via a first antenna module, the first antenna module including first antennas with different polarization axes, receiving, at a receiver, a response signal from a slave device in response to the challenge signal; at a first sniffer device, through a second antenna module and a second receiver, receiving a challenge signal from the master device and the slave; Receiving a response signal from the device, the second antenna module including a second antenna with a different polarization axis, for providing time of arrival through the first sniffer device, the challenge signal and the response measuring when the signal was received at the first sniffer device; estimating at least one of a distance from the vehicle to the slave device or a position of the slave device relative to the vehicle based on the time of arrival; preventing at least one of access to the vehicle or motion control of the vehicle based on at least one of the distance or location.

In other features, the method determines a round trip time associated with transmitting the challenge signal based on the time of arrival, and gains at least one of access to the vehicle or operational control of the vehicle based on the round trip time. detecting a range extension type relay attack performed by the attack device to detect a range extension type relay attack, the response signal being relayed from the slave device to the vehicle via the attack device and modified by the attack device; Including taking countermeasures in response to detecting an attack.

In other features, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module at any one time.

In other features, at any one time at least one of the first antennas of the first antenna module is not cross-polarized with the antenna of the slave device.

In other features, the method further comprises determining a first length of time for the first sniffer device to receive the challenge signal and a second length of time for the sniffer device to receive the response signal; Estimating a distance based on the first length of time and the second length of time.

In other features, the method further comprises receiving at a third receiver of the second sniffer device via a third antenna module the challenge signal from the transmitter and the response signal from the slave device; A third antenna module includes a third antenna with a different polarization axis, and at a fourth receiver of a third sniffer device, through the fourth antenna module, the challenge signal from the transmitter and receiving a response signal from the slave device. A fourth antenna module comprises a fourth antenna with a different polarization axis. The method further includes measuring when the challenge signal and the response signal arrive at the second sniffer device to provide a time of arrival through the second sniffer device; arriving through the third sniffer device; measuring when the challenge and response signals arrive at the third sniffer device to provide time and the arrival time provided by the first sniffer device provided by the second sniffer device; estimating the location based on the time of arrival and the time of arrival provided by the third sniffer device.

In other features, the method further comprises determining a first length of time for the first sniffer device to receive the response signal, and determining a second length of time for the second sniffer device to receive the response signal. determining; determining a third length of time for the third sniffer device to receive the response signal; estimating a position based on.

In other features, the master device periodically transmits a challenge signal or other challenge signal to the slave devices and receives respective response signals from the slave devices. Measuring when the challenge and response signals arrive at the first sniffer device to provide corresponding arrival times at the first sniffer device. At least one of the distance or location is updated based on the arrival times associated with the challenge and response signals. and, based on at least one of the updated distance or the updated position, at least one of access to the vehicle or motion control of the vehicle is prevented.

In another aspect, a system is provided for accessing a vehicle or providing operational control of the vehicle. The system includes a first network device and a control module. A first network device includes a first antenna module, a transmitter, and a receiver. The first antenna module includes antennas with different polarization axes. The transmitter is configured to transmit a series of tones from the vehicle to the second network device via the first antenna module and change the frequency of the tones during transmission of the series of tones. At any one time, at least one of the antennas of the first antenna module is not cross-polarized with the antenna of the second network device. A receiver is configured to receive a series of tones from the second network device. The control module (i) determines a phase difference of the series of tones for a frequency difference of the series of tones, and (ii) based on the phase difference and the frequency difference, the first network device and the second network and (iii) configured to prevent at least one of access to the vehicle or motion control of the vehicle based on the distance.

In another aspect, the control module generates, for each of the tones, a corresponding frequency change during transmission of that tone, and a respective tone curve relating the change in frequency to the change in phase of each of the tones. , is configured to determine the slope of the curve and to determine the distance based on the slope of the curve.

In another feature, the control module randomizes the channel selected for transmission of the series of tones.

In other features, the control module randomizes the direction in which tones are transmitted between the first network device and the second network device. A tone includes one or more tones in a sequence of tones.

In other features, the control module is configured to transmit and receive a series of tones via the transmitter and receiver and determine the distance based on a phase difference and a corresponding frequency difference of the series of tones. be done.

In other features, the system further includes a second network device. The first network device includes a first tone exchange responder and a first tone exchange initiator. A first tone exchange initiator includes a transmitter. The first tone exchange responder includes a receiver. The second network device includes a second tone exchange responder and a second tone exchange initiator. The second tone exchange responder responds to the series of tones by sending a series of tones or a second series of tones back to the first tone exchange initiator. The second tone exchange initiator sends a third series of tones to the first tone exchange responder.

In other features, the control module controls (i) the phase difference of the second series of tones for the frequency difference of the second series of tones or (ii) the phase difference of the third series of tones for the frequency difference of the third series of tones. It is configured to determine the distance based on at least one of the phase differences of the three series of tones.

In other features, the first network device is implemented within the vehicle. The second network device is a portable access device.

In other features, the first network device simultaneously transmits two symbols on two different frequencies to the second network device. To prevent a successful attack, each of the two symbols is less than 1 μs long.

In other features, the clock timing of the first network device and the second network device are synchronized. A first network device transmits a first symbol on a first frequency to a second network device. The second network device transmits the second symbol to the first network device concurrently with transmission of the first symbol to the second network device by the first network device. To prevent a successful attack, the length of the first symbol and the second symbol are each less than 1 μs.

In another aspect, a method of accessing or providing operational control of a vehicle is provided. The method includes transmitting a series of tones from a first network device to a second network device via a transmitter and a first antenna module and changing the frequency of the tones during transmission of the series of tones; The first antenna module includes an antenna, and at any one time at least one of the antennas of the first antenna module is not cross-polarized with the antenna of the second network device, and at the vehicle's receiver, the second receiving a series of tones from a network device of the first network device; determining a phase difference of the series of tones for a frequency difference of the series of tones; based on the phase difference and the frequency difference; Determining a distance between the second network device and preventing at least one of access to the vehicle or motion control of the vehicle based on the distance.

In other features, the method further comprises, for each of the tones, varying a corresponding frequency during transmission of that tone; creating a curve for each tone relating a change in phase of each of the tones to the change in frequency; determining a slope of the curve; and determining a distance based on the slope of the curve.

In other features, the method further includes randomizing channels selected for transmission of the series of tones.

In other features, the method further includes randomizing a direction in which tones are transmitted between the first network device and the second network device. A tone includes one or more tones in a sequence of tones.

In other features, the method includes transmitting and receiving a series of tones via a transmitter and a receiver, and determining distance based on phase differences and corresponding frequency differences of the series of tones. Including further.

In other features, the method sends the series of tones or the second series of tones back to the first tone exchange initiator of the first network device via the second tone exchange responder of the second network device. and responding to a series of tones, the first tone exchange initiator including a transmitter, and transmitting a third series of tones to the first network device via a second tone exchange initiator of a second network device. transmitting to a first tone exchange responder of the device, the first tone exchange responder including a receiver.

In another aspect, the method comprises: (i) the phase difference of the second series of tones for the frequency difference of the second series; or (ii) the third series of tones for the frequency difference of the third series. determining the distance based on at least one of the phase differences of the series of tones.

In other features, the first network device is implemented in the vehicle. The second network device is a portable access device.

In another aspect, a system is provided for accessing a vehicle or providing operational control of the vehicle. The system includes an initiator device and a sniffer device. The initiator device includes a first antenna module including a plurality of polarized antennas, a transmitter configured to transmit a first tone signal from the vehicle to the responder device via the first antenna module, and the responder device. is a portable access device and includes a first receiver configured to receive a second tone signal from a responder device responsive to the first tone signal. The sniffer device receives a second antenna module comprising a plurality of polarized antennas and a first tone signal from the transmitter and a second tone signal from the responder device via the second antenna module. and a second receiver configured to: The sniffer device is configured to determine states of the first tone signal and the second tone signal including their respective phase lags. The initiator device or the sniffer device determines (i) a first distance from the vehicle to the responder device or from the responder device to the sniffer device based on the state of the first tone signal and the second tone signal including respective phase delays. and (ii) at least one of assessing the vehicle or controlling motion of the vehicle based on at least one of the estimated first distance or the second distance configured to prevent

In other features, the initiator device or sniffer device estimates the first distance and the second distance, and determines at least one of access to the vehicle or motion control of the vehicle based on the first distance and the second distance. configured to prevent

In other features, the initiator device or sniffer device is configured to attack the attack device to gain at least one of access to the vehicle or operational control of the vehicle based on at least one of the first distance or the second distance. configured to detect range extension type relay attacks performed by The second tone signal is relayed from the responder device to the vehicle by the attacking device and modified. The initiator device is configured to take countermeasures in response to detecting a range extension type relay attack.

In other features, at any one time at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with at least one of the plurality of polarized antennas of the second antenna module.

In other features, at any one time at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the antenna of the responder device.

In other features, the initiator device or sniffer device determines a first length of time for the first tone signal to travel from the initiator device to the responder device based on the state of the first tone signal when received at the responder device. and based on the state of the second tone signal as received at the sniffer device, determine a second length of time for the second tone signal to travel from the responder device to the sniffer device; and and a second length of time for estimating a first distance and a second distance.

In other features, the initiator device or sniffer device generates in natural logarithmic form a first representation of the first tone signal when received at the responder device; generating a second representation of the signal in natural logarithmic form; generating a third representation of the second tone signal as received at the sniffer device in natural logarithmic form; and and a third representation, configured to estimate a first distance and a second distance.

In another aspect, a method is provided for accessing a vehicle or providing operational control of the vehicle. The method includes transmitting a first tone signal from an initiator device of a vehicle to a responder device via a first antenna module, the first antenna module comprising a plurality of polarized antennas, the responder device being a portable access device. a second tone signal from the responder device in response to the first tone signal, receiving at the initiator device a second tone signal from the transmitter and the second tone signal from the responder device; receiving with a sniffer device via two antenna modules, the second antenna module having a plurality of polarized antennas, and receiving states of the first tone signal and the second tone signal including respective phase delays to the sniffer device; a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the state of the first tone signal and the second tone signal including their respective phase delays; and preventing at least one of access to the vehicle or motion control of the vehicle based on at least one of the estimated first distance or the second distance. include.

In other features, the method includes estimating a first distance and a second distance; and at least one of accessing the vehicle or controlling movement of the vehicle based on the first distance and the second distance. to prevent

In other features, a method is performed by an attack device to gain at least one of access to or operational control of a vehicle based on at least one of the first distance or the second distance. detecting a range extension type relay attack, the second tone signal being relayed by the attack device from the responder device to the vehicle and modified, and in response to detecting the range extension type relay attack; Further including implementing countermeasures.

In other features, at any one time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the linearly polarized antenna or at least one of the plurality of polarized antennas.

In other features, at any one time at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the antenna of the responder device.

In other features, the method determines a first length of time for the first tone signal to travel from the initiator device to the responder device based on the state of the first tone signal when received at the responder device. , determining a second length of time for the second tone signal to travel from the responder device to the sniffer device based on the state of the second tone signal as received at the sniffer device; Further including estimating the first distance and the second distance based on the length and the second length of time.

In another aspect, a system is provided for accessing a vehicle or providing operational control of the vehicle. The system includes a first network device and a control module. The first network device includes a first antenna module and a control module. a first antenna module comprising a plurality of polarized antennas and a transmitter configured to transmit initiator packets from the vehicle through the first antenna module to a second network device; a word and a first continuous wave (CW) tone, one of the first network device and the second network device being implemented in the vehicle, and the other one of the first network device and the second network device; is a portable access device, and at any one time at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the antenna of the second network device and a receiver configured to receive a response packet from the device, the response packet including the synchronization access word and the first CW tone. The control module (i) determines that a round-trip timing difference between the initiator packet and the response packet is greater than a predetermined threshold; and (ii) based on the timing difference being greater than the predetermined threshold, detecting a range extension type relay attack performed by the attack device to gain at least one of access to the vehicle or operational control of the vehicle; and (iii) detecting the range extension type relay attack. is configured to prevent at least one of access to the vehicle or motion control of the vehicle in response to the .

In other features, the control module is configured to determine a start time and an end time of the synchronous access word based on the initiator packet and detect a timing difference based on the start time and the end time. .

In other features, the control module determines the start time and end time of the synchronous access word for the first CW tone of the response packet based on the initiator packet, and determines the start time and end time of the synchronous access word of the response packet. , determine whether the determined start time and end time match, and detect the timing difference if the start time and end time of the synchronous access word in the response packet do not match the determined start time and end time. configured to

In other features, the control module determines a first length of a synchronization access word of the initiator packet, compares the first length to a second length of the synchronization access word of the response packet, and determines a second length of the synchronization access word of the response packet. It is configured to detect a range extension type relay attack if the difference between the length of one and the length of the second is greater than a predetermined amount.

In other features, the control module determines a first length of the first CW tone of the initiator packet and compares the first length to a second length of the first CW tone of the response packet. and is configured to detect a range extension type relay attack if the difference between the first length and the second length is greater than a predetermined amount.

In other features, the first CW tone of the initiator packet is at the end of the initiator packet and the first CW tone of the response packet is at the beginning of the response packet.

In other features, the initiator packet includes the second CW tone. The response packet contains the second CW tone.

In other features, the first CW tone of the initiator packet is at the beginning of the initiator packet. The second CW tone of the initiator packet is at the end of the initiator packet. The first CW tone of the response packet is at the beginning of the response packet. The second CW tone of the response packet is at the end of the response packet.

In other features, the initiator packet and the response packet have the same format.

In other features, the response packet indicates the amount of phase difference between the second CW tone of the initiator packet and the first CW tone of the response packet. The first CW tone of the response packet is in phase with the responder's phase-locked loop.

In other features, the control module is configured to determine a phase difference between the first CW tone of the response packet and the second CW tone of the initiator packet. The second CW tone of the initiator packet is in phase with the initiator's phase-locked loop. The first device and the second device are configured to determine a phase difference for the second frequency and a phase difference for the third frequency. The control module determines (i) the phase difference between the first CW tone and the second CW tone, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency. based on which the distance between the devices is determined.

In other features, the control module compares the frequency, power level, bits and amplitude of the portion of the received signal comprising the response packet to the frequency, power level, bit and amplitude of the portion of the transmitted signal comprising the initiator packet. , is configured to determine if a range extension type relay attack is occurring based on the resulting difference.

In another aspect, a method is provided for accessing a vehicle or providing operational control of the vehicle. The method includes transmitting an initiator packet from the vehicle to a second network device via a first antenna module of the first network device, the first antenna module including a plurality of polarized antennas, the initiator packet including a synchronous access word and a first continuous wave (CW) tone, one of the first network device and the second network device being implemented in the vehicle and the other of the first network device and the second network device; is a portable access device, and at any one time at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the antenna of the second network device and the second receiving a response packet from the network device, the response packet including the synchronization access word and the first CW tone, and determining that a timing difference between the initiator packet and the response packet is greater than a predetermined threshold. a range extension type relay attack performed by the attack device to gain at least one of access to the vehicle or operational control of the vehicle based on the timing difference being greater than a predetermined threshold; detecting and, in response to detecting a range extension type relay attack, preventing at least one of access to the vehicle or motion control of the vehicle.

In other features, the method further includes determining a start time and an end time of the synchronous access word based on the initiator packet and detecting a timing difference based on the start time and the end time. .

In other features, the method includes determining a start time and end time of a synchronous access word for the first CW tone of the response packet based on the initiator packet, determining the start time and end time of the synchronous access word of the response packet. , determining whether the determined start time and end time match, and if the start time and end time of the synchronous access word in the response packet do not match the determined start time and end time, determine the timing difference. further comprising detecting.

In other features, the first CW tone of the initiator packet is at the end of the initiator packet and the first CW tone of the response packet is at the beginning of the response packet.

In other features, the initiator packet includes the second CW tone. The response packet contains the second CW tone. The first CW tone of an initiator packet is at the beginning of the initiator packet. The second CW tone of the initiator packet is at the end of the initiator packet. The first CW tone of the response packet is at the beginning of the response packet. The second CW tone of the response packet is at the end of the response packet.

In other features, the method further includes determining a round trip time of the initiator packet based on the amount of phase lag. The response packet indicates the amount of phase delay between the first CW tone of the initiator packet and the first CW tone of the response packet.

In another aspect, a system is provided for detecting range extension type relay attacks. The system includes a transmitter, a receiver and a control module. A transmitter is configured to transmit a radio frequency signal from one of the vehicle and the portable access device to the other one of the vehicle and the portable access device. A receiver is configured to receive a response signal from one of the vehicle and the portable access device in response to the radio frequency signal. A control module converts the response signal into an in-phase signal and a quadrature-phase signal, and obtains at least one of access to the vehicle or motion control of the vehicle based on the radio-frequency signal, the in-phase signal, and the quadrature-phase signal. Detect range extension type relay attacks performed by the attack device to either (i) relay a radio frequency signal from the vehicle to the portable access device through the attack device, or (ii) respond to the is relayed from the portable access device to the vehicle via the attack device, and is configured to perform countermeasures in response to detecting a range extension type relay attack.

In other features, the system further includes an antenna module. An antenna module is installed in the vehicle and one of the portable access devices in which the transmitter and receiver are installed. The antenna module includes multiple polarized antennas. At any one time, at least one of the plurality of polarized antennas of the antenna module is not cross-polarized with one other antenna of the vehicle and portable access device.

In another aspect, the control module is mounted on the vehicle. In other features, the control module is implemented in the portable access device.

In other features, the control module determines a phase difference based on the in-phase signal and the quadrature-phase signal, measures a round trip time of the radio frequency signal based on the phase difference, and determines a round trip time based on the round trip time. , configured to detect range extension type relay attacks.

In other features, the control module is configured to sample the in-phase signal and the quadrature-phase signal and determine the received bits based on the in-phase signal and the quadrature-phase signal.

In other features, the control module upsamples the received bits based on the in-phase signal and the quadrature-phase signal, upsamples another signal, and outputs the results of upsampling the received bits based on the in-phase signal and the quadrature-phase signal. , is configured to cross-correlate another signal with the result of upsampling, and determine the phase based on the cross-correlation result.

In other features, another signal includes a reference bit pattern. The control module is configured to determine the sign of the differentiated arctangent signal and generate a reference bit pattern based on the sign. In other features, the another signal comprises a radio frequency signal after being filtered through a Gaussian lowpass filter.

In another aspect, a method is provided for detecting range extension type relay attacks. The method includes: transmitting a radio frequency signal from one of the vehicle and the portable access device to the other one of the vehicle and the portable access device via a transmitter; receiving a response signal from one via a receiver; converting the response signal to an in-phase signal and a quadrature signal via a control module; a radio frequency signal, an in-phase signal via a control module , and detecting, based on the quadrature signals, a range extension type relay attack performed by the attack device to gain at least one of access to the vehicle or operational control of the vehicle, which includes (i) wireless at least one of the frequency signal is relayed from the vehicle to the portable access device via the attack device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attack device; and , performing countermeasures in response to detecting range extension type relay attacks.

In other features, the antenna module is implemented in one of the vehicle and portable access device in which the transmitter and receiver are implemented. The antenna module includes multiple polarized antennas. At any one time, at least one of the plurality of polarized antennas of the antenna module is not cross-polarized with one other antenna of the vehicle and portable access device.

In another aspect, the control module is mounted on the vehicle. In other features, the control module is implemented in the portable access device.

In other features, the method comprises: determining a phase difference based on the in-phase signal and the quadrature signal; measuring a round trip time of the radio frequency signal based on the phase difference; and based on the round trip time, Detecting range extension type relay attacks.

In other features, the method further includes sampling the in-phase signal and the quadrature-phase signal and determining received bits based on the in-phase signal and the quadrature-phase signal.

In other features, the method includes upsampling received bits based on the in-phase and quadrature signals, cross-correlating the results of upsampling the received bits with the results of upsampling another signal, and Further comprising determining the phase based on the cross-correlation results. In other features, another signal includes a reference bit pattern. In other features, the another signal comprises a radio frequency signal after being filtered through a Gaussian lowpass filter.

Further areas of applicability of the present disclosure will become apparent from the detailed description, claims, and drawings. The detailed description and specific examples are intended for purposes of illustration only and are not intended to limit the scope of the disclosure.

The present disclosure will become more fully understood from the detailed description and accompanying drawings.
FIG. 3B is a side view of an object showing the RF primary high power signal traveling along the bounce path due to the cross-polarization of the RF antenna. 1 is a functional block diagram of an example vehicle access system including an access module, an RF antenna, and a portable access device in accordance with an embodiment of the present disclosure; FIG. 3 is a functional block diagram of an example vehicle including the access module of FIG. 2, in accordance with an embodiment of the present disclosure; FIG. 3 is a functional block diagram of an example access module of FIG. 2, in accordance with an embodiment of the present disclosure; FIG. 1 is a functional block diagram of an example RF antenna module for a vehicle, in accordance with an embodiment of the present disclosure; FIG. 1 is a functional block diagram of an example portable network device, in accordance with an embodiment of the present disclosure; FIG. FIG. 2 is an example polarization axis diagram illustrating an exemplary placement for polarization diversity, in accordance with an embodiment of the present disclosure; FIG. 10 is an example polarization axis diagram showing another exemplary polarization diversity arrangement, in accordance with an embodiment of the present disclosure; 2 is an exemplary electric field diagram and polar plots showing the electric field pattern and nulls of a linear antenna; FIG. 4 is an exemplary voltage versus electric field diagram for a linearly polarized antenna; 1 is a top perspective view of an example of at least a portion of a multi-axis polarized RF antenna assembly including a linearly polarized antenna and a circularly polarized antenna in accordance with an embodiment of the present disclosure; FIG. 11B is a bottom perspective view of at least a portion of the multi-axis polarized RF antenna assembly of FIG. 11A; FIG. 11A-B are exemplary polar plots of radiated power associated with the linearly polarized antenna of FIGS. 11A-B are exemplary polar plots of radiated power associated with the circularly polarized antenna of FIGS. FIG. 2 is an example functional block diagram of RF circuitry and a portion of a portable access device, in accordance with an embodiment of the present disclosure; [0014] Fig. 4 is a block diagram of an example portion of a key fob having two linearly polarized slot antennas, metal trim, and a spare key in accordance with an embodiment of the present disclosure; 16 is a block diagram of an example of a portion of the key fob of FIG. 15 with a linear x-axis polarized slot antenna and a linear y-axis polarized slot antenna, without the metal trim and spare key. FIG. 17 is an exemplary polar plot of radiated power associated with the x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 16; 17 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 16; FIG. 17 is an example return loss versus frequency plot for the linearly polarized slot antenna of FIG. 16; FIG. 16 is a block diagram of an example of a portion of the key fob of FIG. 15 including a spare key and no metal trim; 21 is an exemplary polar plot of radiated power associated with the x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 20; 21 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 20; 21 is an example of a return loss versus frequency plot for the linearly polarized slot antenna of FIG. 20; 16 is a block diagram of an example of a portion of the key fob of FIG. 15 with a portion of metal trim and a spare key; FIG. 25 is an exemplary polar plot of radiated power associated with the x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 24; 25 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 24; FIG. 25 is an example return loss versus frequency plot for the linearly polarized slot antenna of FIG. 24; 16 is an exemplary polar plot of radiated power associated with the x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 15; 16 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 15; FIG. 16 is an example return loss versus frequency plot for the linearly polarized slot antenna of FIG. 15; FIG. 10 is a block diagram of an example portion of a key fob having a closed linearly polarized slot antenna, an open linearly polarized slot antenna, metal trim, and a spare key in accordance with an embodiment of the present disclosure; 32 is an exemplary polar plot of radiated power associated with the x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 31; 32 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 31; 32 is an example return loss versus frequency plot for the linearly polarized slot antenna of FIG. 31; 4 illustrates a method for determining which antenna combination to use for packet exchange between RF antenna modules of a vehicle and a portable access device for round-trip time-of-flight measurements, according to an embodiment of the present disclosure; 4 illustrates another method of determining which antenna combination to use for packet exchange between the vehicle and the RF antenna modules of the portable access device for round-trip time-of-flight measurements, according to an embodiment of the present disclosure; It is a time-of-flight measurement diagram. 1 is a functional block diagram of an exemplary BLE radio with a superheterodyne receiver and transmitter in accordance with one embodiment of the disclosure; FIG. 4 is an exemplary GFSK parameter definition plot; 1 is a functional block diagram of a system for transmitting BLE packets; FIG. Fig. 3 shows exemplary preambles and access addresses for different types of BLE packets; 4 is an example plot of a BLE packet signal showing corresponding bits; FIG. 4B is another example plot of another BLE packet signal showing corresponding bits; FIG. 45 is an overlap plot of the BLE packet signals of FIG. 44 with one of the BLE packet signals shifted with respect to the other of the BLE packet signals; 4 illustrates an exemplary method for detecting range extension type relay attacks, according to an embodiment of the present disclosure; FIG. 2 is a functional block diagram of an example vehicle and portable access device, including respective round trip time initiators and round trip time responders, in accordance with an embodiment of the present disclosure; 47 is a functional block diagram of the vehicle and portable access device of FIG. 46 showing radio frequency signal transmission via corresponding antennas; FIG. 47 is a functional block diagram of the vehicle and portable access device of FIG. 46 under attack by a range extension type relay attack device; FIG. FIG. 2 is a functional block diagram of two exemplary BLE radios, according to one embodiment of the disclosure; 1 is a functional block diagram of an exemplary position and distance determination system including a round trip time sniffer, in accordance with an embodiment of the present disclosure; FIG. 1 is a functional block diagram of an exemplary position and distance determination system including multiple round trip time sniffers, in accordance with an embodiment of the present disclosure; FIG. [0014] Figure 4 is a functional block diagram of an exemplary network device configured to perform tone exchange for range determination and attack detection, in accordance with an embodiment of the present disclosure; 1 is a functional block diagram of an exemplary positioning system including a tone exchange sniffer in accordance with one embodiment of the disclosure; FIG. 4 illustrates a method for determining distances between initiators and responders and between responders and sniffers, according to an embodiment of the present disclosure; 1 is a functional block diagram of an exemplary passive tone switching and phase detection system, according to one embodiment of the present disclosure; FIG. 1 is a functional block diagram of an example active tone switching and phase detection system in accordance with an embodiment of the present disclosure; FIG. FIG. 10 is a diagram of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, the packets including continuous wave (CW) tones and preambles, in accordance with one embodiment of the present disclosure; FIG. 10 is a diagram of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, the packets including CW tones and no preamble, in accordance with an embodiment of the present disclosure; FIG. 10 is a diagram of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, where the packets are of the same format, include multiple CW tones, and do not include a preamble, in accordance with an embodiment of the present disclosure; [0014] Figure 4 illustrates an exemplary initiator and response packet having the same format according to another embodiment of the present disclosure; FIG. 4 is a functional block diagram of an antenna routing system for network devices having respective antenna modules, according to another embodiment of the present disclosure; 39 is an exemplary radio model corresponding to the structure, function and operation of the BLE radio of FIG. 38; FIG. 4 illustrates a method of exchanging packets between RF antenna modules of a BLE radio for detecting range extension type relay attacks, according to another embodiment of the present disclosure; FIG. 63 is an exemplary plot of signals from each of the sampling module, Gaussian LPF, and integrator of the model of FIG. 62; 63 is an exemplary plot of the signal from the resampling module of the model of FIG. 62; 63 is an exemplary plot of the signal from the arctangent module of the model of FIG. 62; 63 is an exemplary plot of the signal from the differentiator superimposed on the signal from the Gaussian LPF of the model of FIG. 62; FIG. 4 depicts different pairs of antenna shaft assemblies, each including two linearly polarized antennas, in accordance with another embodiment of the present disclosure; FIG. 12B illustrates a perspective view of a pair of antenna shaft assemblies having the same number of antennas, one positioned within the metal enclosure and the other outside the metal enclosure, according to another embodiment of the present disclosure; FIG. 12B shows a perspective view of another pair of antenna shaft assemblies having different numbers of antennas, one positioned within the metal enclosure and the other outside the metal enclosure, according to another embodiment of the present disclosure; FIG. 10 illustrates distance bounds while performing fast bit exchange, where the prober sequence may be cryptographically secure and known independently of the verifier sequence. FIG. 10 illustrates preventing response bits from being sent too early while performing fast bit exchange, where the prober sequence is cryptographically secure and can rely on the verifier sequence. FIG. 4 is a side view of multiple antennas showing angles of arrival; 4 illustrates an AOA method including use of the MUSIC algorithm according to the present disclosure; 4 is an example of a covariance plot according to the present disclosure; 5 is an example plot of eigenvectors and array manifold responses according to the present disclosure; 5 is another example plot of eigenvectors and array manifold responses according to the present disclosure; 4 is an example of a MUSIC power spectrum plot according to the present disclosure; 1 is a functional block diagram of an antenna selection system according to the present disclosure; FIG. 4 illustrates an exemplary reconstruction method according to the present disclosure; 1 is a top view of a vehicle showing an example placement of sensors according to the present disclosure; FIG. Figure 78B is a side view of the vehicle of Figure 78A; 78B is a rear view of the vehicle of FIG. 78A showing bounce reflections and corresponding paths of transmitted signals detected by sensors in accordance with the present disclosure; FIG. 4 is a top view of a vehicle showing another example placement of sensors according to the present disclosure; FIG. Figure 79B is a side view of the vehicle of Figure 79A; 79B is a rear view of the vehicle of FIG. 79A showing bounce reflections and corresponding paths of transmitted signals detected by sensors in accordance with the present disclosure; FIG. In the drawings, reference numbers may be reused to identify similar and/or identical elements.

RF devices can measure distance by unmodulated carrier tone exchange. For example, US Pat. No. 8,644,768, which is incorporated herein by reference, provides a system and method for distance measurement between two nodes of a wireless network using unmodulated carrier tone exchange.

RF devices can measure or limit distance by round-trip timing of rapid exchanges of cryptographically secure messages. For example, "Distance-Bounding Protocols (Extended abstract)" by Brans and Chaum, in a workshop at Theory and Applications of Cryptographic Techniques for the Advancement of Cryptographic Techniques (EUROCRYPT '93), incorporated herein by reference. uses a sequence of fast bit exchanges between the verifier and the prober. The prober sequence may be cryptographically secure and known independently of the verifier sequence, as shown in FIG. A prober sequence may be cryptographically secure and dependent on a verifier sequence, as shown in FIG.

RF devices that measure distance by round trip timing are described in "Attacks on Time-of - Can be subject to early detection and late commit attacks, as described in Flight Distance Bounding Channels. An RF device that measures distance by unmodulated carrier tone exchange is described in "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan, and Capkun, IACR Cryptology ePrint Archive 2016, incorporated herein by reference. vulnerable to signal delay rollover attacks.

Conventional PEPS systems allow keyless entry and vehicle starting, but conventional PEPS systems can be susceptible to range extender type relay station attacks. Range extender-type relay station attacks refer to the use of relay devices by attackers to detect, amplify, and relay signals between a key fob (or other smart portable network device) and a vehicle, As a result, the vehicle's access module behaves as if the key fob were close to the vehicle and in the vicinity of the vehicle. For example, when an attacker touches a vehicle door handle by hand and/or with an intermediary device, the access module may generate and transmit an LF wakeup signal. As a result, the relay device is actually detected and the access module sends an LF wakeup signal to the key fob, which is received at the relay device. A relay device receives, amplifies, and forwards (or rebroadcasts) the LF wakeup signal to the actual key fob. A key fob, for example, may be located inside a house, while a vehicle may be parked outside or in front of the house. A key fob may receive an amplified wake-up signal, generate a response signal, and/or initiate communication over an RF link. The response signal and/or RF communication signal is amplified and relayed between the vehicle's antenna and one or more antennas on the key fob. This can be done via a relay device. As a result, the intermediary device is assumed by the access module to be a key fob and "tricks" the access module into acting as if the key fob is at the intermediary device, which gives the access module access to the interior of the vehicle. provide unauthorized access.

In addition, the antenna systems of current PEPS systems prevent the PEPS system from accurately estimating the distance between the key fob and the vehicle and accurately estimating the location of the key fob relative to the vehicle, as further described below. there is a possibility. Distance and position may be determined based on time-of-flight measurements. Time of flight and corresponding received signal strength are measured. The received signal strength indicator (RSSI) with the largest magnitude usually corresponds to the direct or shortest distance between the key fob and the vehicle. The time-of-flight measurement associated with the largest RSSI is used to calculate the distance between the key fob and the vehicle.

Examples described herein include a combined LF and RF PEPS key fob that uses RF Round Trip Timing (RTT) measurements to prevent range extender type relay station attacks. Other examples include RTT measurements, carrier phase-based ranging, and a combination of RTT measurements and carrier phase-based ranging in PEPS systems. These examples also reveal many other features, which are further described below.

FIG. 1 illustrates an example when cross-polarization of antennas can cause inaccurate range determination between a first RF antenna on a key fob and a second RF antenna on a vehicle. If the key fob's first RF antenna is positioned relative to the vehicle's second RF antenna such that the first RF antenna is cross-polarized with the second RF antenna, the determined distance is a direct Corresponds to bounce paths rather than paths. The antennas are cross polarized, for example when the polarizations of the antennas are perpendicular to each other. An example of this is shown in FIG.

FIG. 1 shows an object 10 and the polarization axes 12, 14 of respective RF antennas. The antenna is a linearly polarized antenna. A first RF antenna has a first polarization axis 12 and is within the vehicle. A second RF antenna has a second polarization axis 14 and is within the key fob. Due to the relative positions of the first RF antenna, the second RF antenna, and the object 10 , the RF signal 16 transmitted from the antennas may bounce off the object 10 . The signal energy (or voltage) corresponding to the bounce path is greater than the signal energy (or voltage) corresponding to the direct path 18 between the antennas. This is due to the cross polarization of the RF antenna. An access module that determines the distance between antennas based on the signal path with the greatest signal energy or voltage incorrectly assumes the distance between the antennas is the length of the bounce path 16 rather than the length of the direct path 18. may decide to

Aligning the nulls in co-polarized antenna arrangements also results in the use of bounce paths. This occurs when the first and second RF antennas are pointing in the same direction. The antenna may be arranged such that the wire extends longitudinally through the antenna. This is further illustrated in FIGS. 9-10.

Examples described herein include polarization diversity for RF signal transmission between a vehicle's RF antenna and a portable access device's (eg, key fob, cell phone, wearable device, etc.) RF antenna. Additionally, these examples include pseudo-random two-way data exchanges. Polarization diversity is defined as at least one transmit antenna having at least one transmit antenna that, at any given time, is co-polarized rather than cross-polarized with the axis of polarization of at least one receive antenna, with a slight co-polarization and no collinear null. provided to ensure that it has an axis of polarization. As used herein, the phrase "at any point in time" means that the corresponding devices are communicating with each other at all times and/or while one or more signals are being transmitted between the devices. and whenever one or more signals are being received by one or more devices. In addition to allowing accurate distance determination, this also helps prevent range extender type relay station attacks. The pseudo-random two-way data exchange described below also helps prevent range extender type relay station attacks.

Exemplary embodiments will now be described in more detail with reference to the accompanying drawings.

FIG. 2 shows a vehicle access system 28 that functions as a PEPS system and a PAK system. Vehicle access system 28 includes a vehicle 30 and may include key fobs 32, cell phones 34, and/or other portable access devices such as wearable devices, laptop computers, or other portable network devices. The portable access device may be, for example, a Bluetooth enabled communication device such as a smart phone, smart watch, wearable electronic device, key fob, tablet device, or other device associated with the user of vehicle 30 . The user may be the owner, driver, or passenger of vehicle 30 and/or a mechanic for vehicle 30 .

Vehicle 30 includes access module 36 , LF antenna module 38 and RF antenna module 40 . The access module 36 can wirelessly transmit LF signals to the portable network device via the LF antenna module 38 and wirelessly communicate with the portable access device via the RF antenna module 40 . The RF antenna module 40 provides polarization diversity between each of the antennas of the portable network device and the RF antenna module 40 . Polarization diversity, described further below, provides a minimum number, combination, and placement of polarization axes in portable network devices and vehicles 30 such that, at any one time, at least one transmit antenna is associated with at least one receive antenna. have at least one polarization axis that is not cross-polarized with the polarization axis of In other words, at any one time, the vehicle's at least one RF antenna has at least one polarization axis that is not cross-polarized with the polarization axis of each portable access device's at least one RF antenna. Although a specific number of LF and RF antenna modules are shown, any number of each may be utilized.

Access module 36 may communicate with LF antenna module 38 and RF antenna module 40 wirelessly and/or via vehicle interface 45 . As an example, vehicle interface 45 may include a Controller Area Network (CAN) bus, a Local Interconnect Network (LIN) for lower data rate communications, a Clock Expansion Peripheral Interface (CXPI) bus, and/or one or more other A vehicle interface may be included.

LF antenna modules 38 are located at various locations on the vehicle and are capable of transmitting low frequency signals (eg, 125 kHz signals). Each of the LF antenna modules includes an LF antenna and may include a control module and/or other circuitry for LF signal transmission. RF antenna modules 40 are also placed at various locations in the vehicle and can transmit RF signals, such as Bluetooth Low Energy (BLE) signals, according to the BLE communication protocol. Alternatively, the RF antenna module 40 may communicate according to other wireless communication protocols such as Wi-Fi. An example antenna is shown in FIG. 11 (referring collectively to FIGS. 11A and 11B).

In one embodiment, the RF antenna module 40 is placed on the roof 46 of the vehicle 30 to improve signal coverage and improve transmission and reception characteristics for the vehicle. As an example, each of the RF antenna modules 40 can include a pair of RF antennas, one linearly polarized antenna, and one circularly polarized antenna. The number and location of RF antenna modules can be pre-selected based on the size and shape of vehicle 30 . In one embodiment, two RF antenna modules are included and spaced apart from each other as shown in FIG. 2 such that the corresponding electric fields overlap each other and extend in a 360° pattern around the vehicle beyond the perimeter of the vehicle. there is The electric field provides the resulting electric field as shown in FIG. 1, represented by the dashed circle 48 . The dashed circle provides a "rectangular-like" overall shape. For larger vehicles, more antenna modules 40 may be added to make the shape more "rectangular". In smaller vehicles, only one RF antenna module 40 may be included.

Different numbers of antennas with different numbers of antenna polarizations may be used. Figures 65-67 show several other exemplary antenna embodiments. Figures 65-67 include fewer antennas and antenna polarizations that a diverse set of frequencies and/or RF channels are used to measure or limit range and/or reflections from vehicle metal. used to measure or limit distance when This is done to create virtual polarization diversity. Antenna systems can tolerate some erroneous measurements due to cross-polarization and/or null alignment. 65-67, 7100A-J refer to antenna shaft assemblies, 7100A-7100I refer to antenna shaft assemblies with two polarization axes, and 7100J refer to antenna shaft assemblies with one polarization axis. Numeric designators 7101A-7101I and 7102A-7102I refer to the polarization antenna axes of the two polarization antenna axis assemblies. Numeric designator 7101J refers to the single polarization axis of 7100J. Numeric designators 7103AB, 7103CD, 7103EF, 7103GH, and 7103JI refer to RF paths between pairs of antenna assemblies. There are many RF paths between the antenna axes, some with large link margins, some with small link margins, some with large phase rotation time delays, some with small phase rotation delays. The different round-trip timing and unmodulated carrier tone exchange ranging algorithms disclosed, described and/or referenced herein provide what the link margin is compared to the path with the highest link margin, which may not be the shortest. It has the ability to find or measure shorter paths up or down decibels (dB). The more round-trip timing or tone exchange measurements made on more frequencies (or channels), and the more mathematically complex and time-consuming the algorithm, the shorter the indirect The path's link margin may be smaller.

Additional antenna axes provide polarization diversity in the RF path between antenna axis assemblies, which provides path diversity. Numeric designator 7200 refers to a simplified representation of an open three-sided metal box and/or car body for RF radio waves in the gigahertz or multi-gigahertz range. Numeric designator 7201 refers to a shorthand representation of metal plates and/or lids to boxes and/or vehicle roofs for RF radio waves in the gigahertz or multi-gigahertz range. Figures 66 and 67 can also be viewed upside down, where 7200 is a simplified representation of the open concave shape of the roof of the vehicle and 7201 is a simplified representation of the floor of the vehicle. It is what I did.

The RF connection between 7100A and 7100B along RF path 7101AB is strong because both pairs of antenna shafts between the antenna shaft assemblies are co-polarized. Even when the co-polarization zone is wide and the link margin is approximately 6 dB higher than the median of the link margin at rotations from 90° to approximately 5°, this condition is rare for any oriented pair of dual-axis antennas. be. This is because it requires 3 degrees of rotation to manipulate any oriented antenna axis assembly pair into this setup, and the antenna axis is symmetrical every 90 degrees, so the setup is approximately (5 /90) ^* (5/90) ^* (5/90), ie 1.71E-4, occurs randomly in the time portion. The RF connection between 7100C and 7100D along RF path 7101CD is not as strong as 7101AB, but is good because there are no co-polarized or cross-polarized antenna paths and no nulls are aligned. . The RF connection between 7100E and 7100F along RF path 7101EF is weak because each antenna path between individual antenna axes is cross-polarized or contains at least one antenna null. Again, this situation is rare because it takes three degrees of rotation to steer a pair of arbitrarily oriented antenna axis pairs into this configuration. Further, for ^example , any orientation of a dual-axis antenna pair with 5° cross-polarization ^and null-aligned zones, e.g. As an antenna pair, 3 angle rotations are required to steer an arbitrarily oriented antenna pair into this setup, and since the antenna axes are symmetrical every 90 degrees, the setup is approximately (5/90) ^* (5/90) ^* (5/90), ie 1.71E-4, occurs randomly in the time portion.

Looking at FIGS. 7-8, with three nearly orthogonal polarization axes on one side and two nearly orthogonal polarization axes on the other side, nulls cannot be aligned while being cross-polarized. It is clear that With three nearly orthogonal polarization axes on one side and one on the other side, nulls can be aligned via two rotations and arbitrarily generated.

In general, the more antenna axes on each side of the connection, the less likely a direct path with low link margin will occur. Round-trip timing ranging and unmodulated carrier tone exchange ranging tend to measure direct paths with higher link margins for direct paths compared to reflected paths, thus preventing the possibility of direct paths with low link margins or is beneficial to reduce. Conversely, the lower the link margin of the direct path compared to the reflected path, the more likely the ranging technique will measure distance along the reflected path.

In FIG. 66, the size of the metal box is moderately sized for the determined range of distances to be measured, and the distance variation is measured based on different reflection paths inside the metal box, and the ranging connection If one side of the is placed inside a metal box, planning a small number of direct paths can reduce the number of polarization axes needed to get a reasonable measurement. If one of the antenna axes of 7100G is oriented such that the null is oriented along the strongest and/or shortest reflected path towards 7100H, then the other antenna axis of 7100G is aligned with antenna axis 7101H or 7102H. Find bounce paths with strong link margins on one of the . This is especially true when averaged over multiple channels, such as 37 data channels in a BLE data link. Some combinations of channel and antenna axis paths may fade rapidly due to multipath, but not most. For any orientation of antenna axis pair 7100G, the link margins to antenna axis pair 7100H are approximately the same and the distances measured along the reflected paths of 7103IJ are approximately the same. How the reflected path 7103GH bounces off the sidewalls of the roof 7201 or 7200 varies, but the overall path variation is limited by the size and location of the 7200 and 7201 components. This path variation limit changes when 7100G is raised to a height where there is a direct path, which shortens the measured distance by removing reflections from path 7103GH. The range measured between 7100G and 7100H along the reflected path or the shorter direct path sets a comparison boundary indicating that 7100G, which may be part of the portable device, is within the distance threshold of 7100H. 7100H may be part of PEPS module 211 or PAKM module 212 . These distance range measurements between a pair of 7100 modules may be made and compared to less than the boundary. Measurements, distances, and/or results of the comparison may be used in an “if-then” software decision tree to indicate that portable access device 400 is within the approach zone, unlock zone, and/or vehicle mobilization zone. -else" may be used as part of the comparison.

FIG. 67 is similar to FIG. 66 except antenna shaft assembly 7100J includes a single polarized antenna shaft 7101J. In one embodiment, antenna shaft assembly 7100J includes only a single polarized antenna shaft. It is possible to orient 7101J so that the null is directed along the strongest and/or shortest reflection path towards 7100H. In this case, round-trip timing and unmodulated carrier tone exchange techniques tend to measure distance along a path (not shown) leaving box 7200 and bouncing back toward the box. Manipulating an arbitrarily oriented antenna pair into this ^{configuration} requires two degrees of rotation, and since the antennas are symmetrical every 90 degrees, e.g. 180) ^∧ 2) Down, say, having a 5° wide null aligned zone requires two rotations to orient an arbitrary oriented antenna axis to this orientation. This orientation occurs randomly at approximately (5/90) ^* (5/90) or 3E-3 fractions of time. Range measurements between a pair of 7100 modules are made, except for increasing portions of the time when indirect paths that differ significantly due to higher power paths reflected by distant objects are measured, and the measurements are taken from the boundary. This setting can be used to compare even smaller. The measurements, distances, and/or results of the comparison may include one or more "if-then" values to indicate that the portable access device 400 is within the approach zone, unlock zone, and/or vehicle mobilization zone. -else" comparisons and may be used as part of software decision trees.

Different polarizations of antennas can be used to create polarization diversity. Multiple polarized antennas (or antenna axes) create polarization diversity. A linear axis and another linear axis, two linear axes including a linear axis and a circularly polarized antenna, or three independent linear axes (a linearly polarized antenna) are all possible. Especially if there is metal nearby to create virtual polarization diversity.

The 7101H or 7101J antenna axis pair can be placed either low on the vehicle body metal box or high on the vehicle roof metal box to achieve these virtual antenna axis array effects. good.

FIG. 3 illustrates a vehicle 200 that is an example of vehicle 108 in FIG. Vehicle 200 includes a PAK system 202 that includes a vehicle control module 204, an infotainment module 206, and other control modules 208 (eg, body control modules). Modules 204, 206, 208 may communicate with each other via controller area network (CAN) bus 209 and/or other vehicle interfaces (eg, vehicle interface 45 of FIG. 2). Vehicle control module 204 may control the operation of vehicle systems. Vehicle control module 204 may include PEPS module 211, PAK module 212, and parameter adjustment module 213, as well as other modules shown in FIG. Vehicle control module 204 is configured to execute instructions stored in a non-transitory computer-readable medium, such as memory 218, which may include read-only memory (ROM) and/or random-access memory (RAM). More than one processor may also be included.

The PEPS module 211 may perform PEPS operations to provide access to the interior of the vehicle as well as authorize starting and/or operation of the vehicle. PAK module 212 works in conjunction with PEPS module 211 to perform the PAK operations described herein. PEPS module 211 may include PAK module 212, or modules 211, 212 may be implemented as a single module. Parameter adjustment module 213 may be used to adjust parameters of vehicle 200 .

PAK system 202 may further include memory 218 , display 220 , audio system 221 , and one or more transceivers 222 including LF antenna module 38 and RF antenna module 40 . RF antenna module 40 may include and/or be connected to RF circuitry 223 . PAK system 202 may further include a telematics module 225 , sensors 226 and a navigation system 227 including a global positioning system (GPS) receiver 228 . RF circuitry 223 may be used to communicate with mobile devices (eg, mobile device 102 of FIG. 1) that transmit Bluetooth® signals at 2.4 gigahertz (GHz). RF circuitry 223 may include a BLE radio, transmitter, receiver, etc. for transmitting and receiving RF signals.

One or more transceivers 222 include RF transceivers including RF circuitry 223 to execute access applications having code for examining time-stamped data transmitted and received by RF antenna module 40 . The access application can, for example, check whether the RF antenna module received the correct data at the correct time. Access applications may be stored in memory 218 and executed by PEPS module 211 and/or PAK module 212 . Other examples of access application operation are described further below.

The access application may implement a Bluetooth® protocol stack configured to provide a channel map, access identifier, next channel, and next channel time. The access application is configured to output a timing signal for timestamping signals transmitted and received via the RF antenna module 40 . The access application can obtain channel map information and timing information and share this information with other modules in the vehicle.

The telematics module 225 can communicate with the server via the cell tower station. This may include transferring timing information including certificates, license information, and/or global clock timing information. Telematics module 225 is configured to generate location information and/or location information errors for vehicle 200 . Telematics module 225 may be implemented by navigation system 227 .

Sensors 226 may include sensors used in PEPS and PAK operations, cameras, object detection sensors, temperature sensors, accelerometers, vehicle speed sensors, and/or other sensors. Sensor 226 may include a touch sensor, for example, to detect a person touching a door handle to initiate the process of waking up the portable access device. The sensor 226 may be connected to a body control module that can communicate with the LF and RF antenna circuits and/or other control modules 208 such as the modules disclosed herein. GPS receiver 228 may provide vehicle speed and/or vehicle direction (ie, heading) and/or global clock timing information.

Memory 218 may store sensor data and/or parameters 230 , credentials 232 , connection information 234 , timing information 236 , tokens 237 , keys 238 , and applications 239 . Applications 239 may include applications executed by modules 38 , 40 , 204 , 206 , 208 , 210 , 211 , 212 , 223 and/or transceiver 222 . By way of example, applications may include access applications, PEPS applications, and/or PAK applications executed by transceiver 222 and modules 210 , 211 , and/or 212 . Although memory 218 and vehicle control module 204 are shown as separate devices, memory 218 and vehicle control module 204 may be implemented as a single device. A single device can include one or more other devices shown in FIG.

Vehicle control module 204 operates engine 240, converter/generator 242, transmission 244, window/door system 250, lighting system 252, seating system, according to parameters set by modules 204, 206, 208, 210, 211, 212, 213. 254, mirror system 256, braking system 258, electric motor 260, and/or steering system 262 may be controlled. Vehicle control module 204 may perform PEPS and/or PAK operations, which may include setting a number of parameters. PEPS and PAK operations can be based on signals received from sensor 226 and/or transceiver 222 . Vehicle control module 204 may include engine 240, converter/generator 242, transmission 244, window/door system 250, lighting system 252, seating system 254, mirror system 256, braking system 258, electric motor 260, and/or steering system 262. Power may be received from a power supply 264 that may be provided to the Some PEPS and PAK actions include unlocking the doors of the window/door system 250, enabling fuel and ignition of the engine 240, starting the electric motor 260, system 250, 252, 254, 256, 258, 262. and/or perform other operations further described herein.

Engine 240 , converter/generator 242 , transmission 244 , window/door system 250 , lighting system 252 , seat system 254 , mirror system 256 , braking system 258 , electric motor 260 , and/or steering system 262 are controlled by vehicle control module 204 . It includes controlled actuators that can adjust, for example, fuel, ignition, airflow, steering wheel angle, throttle position, pedal position, door locks, window position, seat angle, and more. This control can be based on the outputs of sensors 226 , navigation system 227 , GPS 228 , and the above data and information stored in memory 218 .

FIG. 4 shows access module 210 . The access module 210 includes a PEPS module 211, a PAK module 212, a parameter adjustment module 213, a link authentication module 300, a connection information delivery module 302, a timing control module 304, a sensor processing and location module 306, and a data management module 308. , and security filtering module 310 . PAK module 212 may include RTC 312 that maintains local clock time.

Link authentication module 300 can authenticate the portable access device of FIG. 2 and establish a secure communication link. For example, link authentication module 300 may be configured to perform challenge-response authentication or other cryptographic verification algorithms to authenticate portable access devices.

The connection information distribution module 302 is configured to communicate with some of the sensors 226 of FIG. 3 and provide the sensors with communication information necessary for them to locate and track or intercept secure communication links. This can occur once the sensor is synchronized with a communication gateway, which may be included or implemented in one of transceivers 222 . As an example, vehicle 200 and/or PAK system 202 may include any number of sensors placed anywhere on vehicle 200 to detect and monitor mobile devices. The connection information distribution module 302 is configured to obtain information corresponding to the communication channel and channel switching parameters of the communication link and transmit the information to the sensor 226 . Depending on the sensor 226 receiving information from the connectivity information distribution module 302 via the vehicle interface 45 and the sensor 226 being synchronized with the communication gateway, the sensor 226 can locate and track or intercept the communication link. .

The timing control module 304, when not governed by the PAK module 212, maintains the RTC and/or currently stored date, emits current timing information to the sensors, handles incoming and outgoing messages, requests, signals, certificates, etc. It can generate timestamps for books and/or other items, calculate round-trip times, and the like. Round trip time may refer to the length of time between when a request is generated and/or sent and when a response to the request is received. The timing control module 304 can obtain timing information corresponding to the communication link when the link authentication module 300 performs challenge-response authentication. Timing control module 302 is also configured to provide timing information to sensors 226 via vehicle interface 209 .

After link authentication is established, data management module 308 collects the current location of vehicle 108 from telematics module 225 and shares that location with the portable access device. The portable access device optionally includes a GPS module and application software that, when run, compares the estimated relative position of the portable access device with the vehicle 108 . Based on the estimated position of the portable access device relative to vehicle 108, the portable access device can send a signal to one of transceivers 222 requesting the vehicle to perform a particular action. As an example, data management layer 308 is configured to obtain vehicle information obtained by any module (eg, location information obtained by telematics module 225) and transmit the vehicle information to the portable access device. .

The security filtering module 310 detects physical layer and protocol violations and filters the data accordingly before providing the information to the sensor processing and location module 306 . The security filtering module 310 flags the injected data so that the sensor processing and location module 306 can discard the data and alert the PEPS module 211 . Data from the sensor processing and location module 306 is passed to the PEPS module 211, which detects the user's intent to access a feature and locates the mobile device 102 in the door or trunk of the vehicle. It is configured to read vehicle status information from the sensors for comparison with a set of positions that permit certain vehicle functions, such as unlocking the vehicle and/or starting the vehicle.

FIG. 5 is a functional block diagram of RF antenna module 40, which includes a control module 350 connected to a multi-axis polarized RF antenna assembly 352. As shown in FIG. The multi-axis polarized RF antenna assembly 352 may include linearly polarized antennas, other linearly polarized antennas, and/or circularly polarized antennas (eg, a right circularly polarized antenna or a left circularly polarized antenna). An example of a multi-axis polarized RF antenna is shown in FIG. Control module 350 may include or be part of a BLE communications chipset. Alternatively, control module 350 may include or be part of a Wi-Fi or Wi-Fi Direct communications chipset. Multi-axis polarized RF antenna assembly 352 may be included as part of RF antenna module 40 or may be located separately from control module 350 . Some or all of the operations of control module 350 may be performed by one or more of modules 204, 210, 211, 212 of FIG.

Control module 350 (or one or more of modules 204, 210, 211, 212 of FIG. 3) provides a secure connection with a portable access device (eg, one of portable access devices 32, 34 of FIG. 2). communication connection can be established. For example, control module 350 can establish a secure communication connection using the BLE communication protocol, which can include transmit and/or receive timing and synchronization information. Timing and synchronization information may include timing of next communication connection events, timing intervals between communication connection events, communication channels for next communication connection events, channel maps, channel hop intervals or offsets, communication delay information, communication jitter information, etc. can contain information directed to secure communication connections. The control module 350 can detect (or “intercept”) packets sent by the portable access device to the vehicle control module 204 and measure signal information in signals received from the portable access device. A channel hop interval or offset can be used to calculate the channel for subsequent communication connection events.

Control module 350 can measure the received signal strength of signals received from portable access devices and generate corresponding RSSI values. Additionally or alternatively, control module 350 can make other measurements of signals received from portable access devices, such as angle of arrival, time of arrival, time difference of arrival, and the like. Control module 350 can then transmit the measured information to vehicle control module 204, which determines the position and/or distance of the portable access device relative to vehicle 30 based on the measured information. can decide. Position and distance determinations can be based on similar information received from one or more other RF antenna modules and/or other sensors.

As an example, vehicle control module 204 can determine the location of the portable access device, eg, based on patterns of RSSI values corresponding to signals received from the portable access device by RF antenna module 40 . A strong (or high) RSSI value indicates that the portable access device is close to the vehicle 30 and a weak (or low) RSSI value indicates that the portable access device is far from the vehicle 30 . By analyzing the RSSI values, control module 204 can determine the position and/or distance of the portable access device relative to vehicle 30 . Additionally or alternatively, measurements of the angle of arrival, angle of departure, round trip timing, unmodulated carrier tone exchange, or time difference of arrival of signals transmitted between the portable access device and the control module 204 are also provided by the portable access device. It may be used by control module 204 or a portable access device to determine location. Additionally or alternatively, RF antenna module 40 may determine the position and/or distance of the portable access device based on the measured information and communicate the position or distance to control module 204 .

Based on the determined position or distance of the portable access device relative to vehicle 30, modules 211, 212 of FIG. Vehicle functions, such as allowing vehicle 30 to start, may be enabled and/or performed. As another example, the modules 211 , 212 may turn on the interior or exterior lights of the vehicle 30 when the portable access device is less than a first predetermined distance from the vehicle 30 . The modules 211 , 212 may unlock the doors or trunk of the vehicle 30 when the portable access device is less than a second predetermined distance from the vehicle 30 . Modules 211 , 212 may allow the vehicle 30 to start if the portable access device is located inside the vehicle 30 .

Referring again to FIG. 5, the control module 350 can include a physical layer (PHY) module 356, a medium access control (MAC) module 358, a time synchronization module 360, and a channel map reconstruction module 362. PHY module 356 receives BLE signals via multi-axis polarized RF antenna assembly 352 . The control module 350 monitors received BLE physical layer messages and uses, for example, a channel map generated by the channel map reconstruction module 362 to measure physical characteristics of the corresponding signals, including received signal strength. value can be obtained. The control module 350 communicates with the control modules and/or modules 204, 210, 211, 212 of the other RF antenna modules via the vehicle interface 45 to determine time difference of arrival, time of arrival, angle of arrival, and/or other timing. Information can be determined. In one embodiment, control module 350 includes a portion of RF circuitry 223 of FIG.

The time synchronization module 360 is configured to accurately measure the reception time of signals/messages at the vehicle interface 45 . Control module 350 can tune PHY module 356 to a particular channel at a particular time based on channel map information and time of reception and/or other timing information. In addition, the control module can monitor incoming PHY messages and data conforming to the Bluetooth® Physical Layer Specification, such as the Bluetooth® Specification Version 5.1. Data, timestamps, and measured signal strengths may be reported by control module 350 to control module 204 via vehicle interface 45 .

FIG. 6 shows an exemplary portable access device 400, which is an example of one of the portable access devices 32, 34 of FIG. Portable access device 400 may include control module 402 , user interface 404 , memory 406 , sensors 407 and transceiver 408 . Transceiver 408 may include MAC module 410 , PHY module 412 , and multiple linearly polarized antennas 414 .

Control module 402 may include or be part of a BLE communications chipset. Alternatively, control module 402 may include or be part of a Wi-Fi or Wi-Fi Direct communications chipset. Memory 406 can store application code executable by control module 402 . Memory 406 may be a non-transitory computer-readable medium including read-only memory (ROM) and/or random-access memory (RAM).

Control module 402 communicates with vehicle modules 204 and 350 to perform authentication and other operations, as further described below. The control module 402 controls the position and/or velocity information obtained from one or more sensors 407 (e.g., global navigation satellite system (e.g., GPS) sensors, accelerometers, and/or angular rate sensors), Information about the portable access device 400 can be transmitted. User interface 404 may include a keypad, touch screen, voice activated interface, and/or other user interface.

FIG. 7 shows a polarization axis diagram showing an exemplary arrangement for polarization diversity. In the example shown, two 3-axis antennas located within the vehicle communicate with a 2-axis antenna located on the portable access device (or mobile access network device). This antenna topology, with sufficient antenna axes, can prevent situations where cross-polarization exists between one of the three-axis antennas and the two-axis antenna. Also, with sufficient antenna axes, the system can be configured such that there is at least one pair of antennas with no nulls (or pointing) in the direct signal path. A heuristic measurement of RSSI on the continuous wave (CW) tone portion of a packet can be made while measuring the round trip time and phase delay of the packet. This can be repeated over multiple frequencies. This can be accomplished with a vehicle access module and/or a portable access device. Round trip timing and/or unmodulated carrier tone exchange may be used to ensure ranging. RSSI and change (or delta) phase per frequency may be used.

FIG. 8 shows a polarization axis diagram showing another exemplary arrangement for polarization diversity. In the example shown, two single-axis antennas located within a vehicle communicate with a tri-axis antenna located on a portable access device (or mobile access network device). This antenna topology, with sufficient antenna axes, can also prevent situations where cross-polarization exists between one of the single-axis antennas and the three-axis antenna. Also, with sufficient antenna axes, the system can be configured such that there is at least one pair of antennas with no nulls (or pointing) in the direct signal path. A heuristic measurement of RSSI on the continuous wave (CW) tone portion of a packet can be made while measuring the round trip time and phase delay of the packet. This can be repeated over multiple frequencies. This can be accomplished with a vehicle access module and/or a portable access device. Round trip timing is used to ensure ranging. RSSI and change (or delta) phase per frequency may be used. The example of FIG. 7 may be more suitable than the example of FIG. This is because it can be difficult to incorporate a triaxial antenna into certain portable access devices such as key fobs.

FIG. 9 shows an electric field diagram 900 and a polar plot 902 showing the electric field pattern and null 906 of a linear antenna. A linear antenna is positioned along a vertical axis 908 . A linear antenna has a "doughnut" shaped radiation pattern. When the nulls are aligned between the transmit and receive antennas (co-polarized antennas with nulls collinear or nearly collinear), the bounce path of the transmitted signal is measured. The examples described herein prevent this situation from existing between at least one transmit antenna and at least one receive antenna at any time. Algorithms are presented herein for determining which transmit and receive antennas to use at any given time to prevent the use of cross-polarized and/or co-polarized antennas. Once the appropriate antenna pair is selected, time-of-flight measurements are made to determine the distance between the transmitter and receiver and/or between the vehicle and the portable access device. FIG. 10 shows a voltage versus electric field diagram 1000 for a linearly polarized antenna 1002 .

11A-B illustrate at least a portion of an example multi-axis polarized RF antenna assembly 1100 including a linearly polarized antenna 1102 and a circularly polarized antenna 1104. FIG. Antennas 1102, 1104 are placed together. Linearly polarized antenna 1102 extends linearly from the center of circularly polarized antenna 1104 axially outward away from circularly polarized antenna 1104 . Antennas 1102, 1104 may transmit 90 degrees out of phase with each other. Linearly polarized antenna 1102 can include a conductive element (eg, straight wire or spiral) 1110 that extends within sleeve 1112 . Circularly polarized antenna 1104 may be ring-shaped.

Linearly polarized antenna 1102 is a monopole antenna. Sleeve 1112 is formed of a dielectric material such as Teflon. Both antennas 1102 , 1104 are concentric with a disk-shaped insulator (or isolator) 1106 and a disk-shaped ground plane 1108 . A ring-shaped insulator 1106 is stacked as a top layer over a ground plane 1108 (or bottom layer). Circularly polarized antenna 1104 is positioned on ground plane 1108 within inner recess 1114 of insulator 1106 . An insulator inner recess 1114 is positioned between the circularly polarized antenna 1104 and the ground plane 1108 .

The circularly polarized antenna has two feed points 1120 , 1122 and the linearly polarized antenna 1102 has a single feed point 1124 . RF signals are transmitted and/or received via feed points 1120 , 1122 , 1124 . RF signals are transferred between antennas 1102, 1104 and RF circuitry 1114 via coaxial cables. The coaxial cable includes inner conductive lines 1130, 1132, 1134 and an outer ground shield (not shown). The ground shield is connected to ground plane 1108 . Conductive lines 1130 , 1132 , 1134 are connected to feed points 1120 , 1122 , 1124 .

During transmission, a signal or voltage is provided between ground plane 1108 and conductive element 1110 via feed point 1124 which is connected to conductive element 1110 and ground plane 1108 via another conductive element 1140 . be. An RF signal or voltage is also applied between the ground plane 1108 and the feed points 1120 , 1122 of the circularly polarized antenna 1104 . The feed points 1120, 1122 are located 90° offset in the plane of the antenna 1104 and are 90° out of phase with each other. A 90° electrical phase shift combined with a 90° geometric phase shift causes circularly polarized antenna 1104 to radiate a circularly polarized signal. Feed points 1120 , 1122 are connected from ground plane 1108 through insulator 1106 to circularly polarized antenna 1104 . Hole 1142 in the center of ground plane 1108 and hole 1144 in the center of circularly polarized antenna 1104 are large enough to allow linearly polarized antenna 1102 to radiate without shorting to ground plane 1108. is.

Antennas 1102, 1104 may be formed of a conductive material, while circular isolator 1106 may be formed of a non-conductive (or electrically insulating) material. In one embodiment, linearly polarized antenna 1102 can be implemented as a straight wire, sleeve 1112 is formed of polytetrafluoroethene (PTFE), and conductive element 1110 is formed of copper. In another embodiment, the linearly polarized antenna 1102 is implemented as a helix, with a wire wrapped around a cylindrically-shaped object made of PTFE. FIG. 12 shows a polar plot 1200 of radiated power for the linearly polarized antenna 1102 of FIG. FIG. 13 shows a polar plot of radiated power for the circularly polarized antenna 1104 of FIG. The antennas 1102, 1104 may be connected to an RF circuit 1114, such as one of the RF circuits 223 of FIG. 3, and configured to be mounted on the roof of the vehicle. Antennas 1102, 1104 can be used for time-of-flight measurements between the vehicle and the portable access device, while other LF antennas in the vehicle can be used for portable access device authentication.

Although the antenna assembly is primarily described as having a circularly polarized antenna and a linearly polarized antenna, which may be placed, for example, on the roof of a vehicle, two linearly polarized antennas may be used instead. This is true for each example disclosed herein. The two linearly polarized antennas can be placed deeper into the vehicle, such as the vehicle floor, instrument panel, or center console.

FIG. 14 shows a first RF circuit 1400, a second RF circuit 1401, and a portion 1403 of a portable access device (eg, one of the portable access devices described above). Although a specific number of RF circuits are shown, any number of RF circuits can be included to communicate with the portable access device. The first RF circuit 1400 includes a serial transmission module 1402, an RF transceiver module 1404, a switch 1406, a splitter 1408, a uniaxially polarized (or monopole) antenna 1410, a delay module 1412, and a circularly polarized antenna assembly 1414. . Antennas 1410, 1414 may be implemented as the multi-axis polarized RF antenna assembly of FIG. Although the RF circuits are each shown as having a single-axis antenna and a circularly-polarized antenna to provide three axes of polarization, each RF circuit may include only two single-axis polarized antennas. . Various combinations of linear and circular antenna axes can be combined to achieve polarization diversity of the module, which prevents collinear alignment of cross-polarizations and/or nulls. If the RF circuit includes two uniaxial antennas, the portable access device includes a triaxial antenna or three uniaxial antennas orthogonal to each other to correspond to the x, y, and z axes.

Serial transmission module 1402 can communicate with one or more vehicle modules (eg, the vehicle control module or access module described above) via a serial bus according to a serial peripheral interconnect (SPI) protocol. Discrete signals (or general purpose I/O signals) can be sent between modules 1402 , 1404 and between RF transceiver module 1404 and switch 1406 . RF transceiver module 1404 may communicate with PEPS module 211 (of FIG. 3). A switch 1406 switches between antennas 1410 and 1414 . Splitter 1408 may split the signal received from RF transceiver module 1404 , provide the signal to antenna 1410 and antenna 1414 , and/or combine the signal received from antenna 1410 and antenna 1414 . Splitter 1408 is a 90° splitter that splits the single signal into two 90° out-of-phase signals and feeds the signals to the two feed points of a circularly polarized antenna (e.g., feed point 1120 in FIG. 11). , 1122). Splitter 1408 can provide signals to or receive signals from antenna 1414 via delay module 1412 .

Second RF circuit 1401 includes switch 1420 , splitter 1422 , uniaxially polarized (or monopole) antenna 1424 , delay module 1426 and circularly polarized antenna 1428 . Antennas 1424, 1428 may be implemented as the multi-axis polarized RF antenna assembly of FIG. Devices 1420 , 1422 , 1424 , 1426 , 1428 can operate similarly to devices 1406 , 1408 , 1410 , 1412 , 1414 . Switch 1420 can communicate with RF transceiver module 1404 . Switch 1406 may also connect splitter 1408 , uniaxially polarized antenna 1410 , and/or switch 1420 to RF transceiver module 1404 . A switch 1420 can connect a single polarized antenna 1424 or splitter to the switch 1406 or RF transceiver module 1404 .

Part 1403 includes triaxial LF antenna 1430 , LF module 1432 , RF module 1434 , user interface 1436 , first uniaxially polarized antenna 1438 , second uniaxially polarized antenna 1440 , and switch 1442 . LF module 1432 transmits and receives LF signals via 3-axis LF antenna 1430 . RF module 1434 transmits and receives RF signals via switch 1442 and antennas 1438 , 1440 . A switch 1442 connects one or more of the antennas 1438 , 1440 to the RF module 1434 . Discrete signals and serial peripheral interconnect (SPI) signals may be transmitted between LF module 1432 and RF module 1434 . Discrete signals may be transmitted between RF module 1434 and switch 1442 .

RF signals are transmitted between (i) antennas 1410 , 1414 , 1424 , 1428 and (ii) antennas 1438 , 1440 . As an example, antennas 1410, 1424 can be associated with the z-axis and antennas 1414, 1428 can be associated with the x-axis and y-axis, respectively. Antennas 1438, 1440 can be, for example, slot antennas associated with the x and y axes, respectively. The 3-axis LF antenna 1430 can communicate with a corresponding vehicle LF antenna, as described above. The LF antenna may be used for the purpose of waking up the downlink. RF antennas can be used for authentication and communication.

Antennas 1410 , 1414 can be used to communicate with antennas 1438 , 1440 or antennas 1424 , 1428 can be used to communicate with antennas 1438 , 1440 . Alternatively, one of antennas 1410,1424 and either one of antennas 1414,1428 may be used to communicate with antennas 1438,1440. One or more antennas in circuit 1400 can be used while one or more antennas in circuit 1401 are used. By using one monopole (or linearly polarized) RF antenna and a dipole (or multi-axis polarized) RF antenna, such as a circularly polarized antenna, the number of RF switching lanes to poll is reduced from 3 to 2 is reduced to A heuristic measurement of RSSI on the continuous wave tone of a packet can be made while measuring the round trip time and phase delay of the packet. This can be repeated over multiple frequencies.

FIG. 15 shows a key fob portion 1500 having two linearly polarized slot antennas 1502 , 1504 , metal trim 1506 and spare key 1508 . Metal in the key fob can short out fields that should be stable along the key fob's length (or Y direction). As a result, it can be difficult to design an efficient radiator in a structure that includes a properly operating antenna. Antenna 1502 is an x-axis linearly polarized slot antenna. Antenna 1504 is a y-axis linearly polarized slot antenna. Metal trim 1506 can be a cast decorative trim. The key fob may also include an LF coil antenna 1510, a processor (not shown), a battery 1512, and a metal plate (or conductive film) 1514. An RF signal is fed to the metal plate 1514 and the apertures of the slot antennas 1502, 1504 radiate electromagnetic waves.

FIG. 16 shows a portion 1600 of the key fob of FIG. 15 without the metal trim 1506 and spare key 1508. FIG. Part 1600 includes an x-axis linearly polarized slot antenna 1502 and a y-axis linearly polarized slot antenna 1504 . Removing metal trim 1506 and spare key 1508 supports radiation from slot antennas 1502,1504. Although this arrangement is configured to work with nearby metal such as metal trim and spare keys, the plots of FIGS. is distorted from the plot of FIG. 17 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the key fob portion 1600 of FIG. FIG. 18 shows an exemplary polar plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion 1600 of FIG. FIG. 19 shows a plot of return loss (in decibels (dB)) versus frequency for the linearly polarized slot antennas 1502, 1504 of FIG. S2,2 is the reflected power of the second port or antenna 1504 of the second radio (or transmitter). Given the structure of the key fob, S1,1 and S2,2 plots can be defined, where the "dip" or minimum return loss in the S1,1 and S2,2 curves indicates improved performance. to provide the same frequency or within a predetermined range of each other.

Return loss is a means of measuring how well an antenna transforms the voltage at its terminals into an electric field in space, or how well an antenna transforms an electric field in space into a voltage at its terminals. Return loss is a decibel measurement of how much power is reflected at a terminal. For example, if the return loss is 0 dB, all power is reflected and no power is transferred to the terminals. As another example, a return loss of -10 dB means that approximately 10% of the power is reflected and 90% of the power is transferred. If the return loss plot contains a curve that drops to a reasonable level (eg -6 dB) at the operating frequency, the corresponding antenna is functioning properly. If the return loss drops to -10 dB, the antenna is considered a well functioning antenna. Return loss is measured as an S-parameter. S1,1 is the return loss of port 1; S2,2 is the return loss of port 2;

FIG. 20 shows the key fob portion 2000 of FIG. 15 including a spare key 1508 and without the metal trim 1506. FIG. FIG. 21 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the key fob portion 2000 of FIG. FIG. 22 shows a polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion 2000 of FIG. Adding a spare key may adversely affect the y-polarization, but it works fine. FIG. 23 shows return loss versus frequency plots for the linearly polarized slot antennas 1502, 1504 of FIG. It is for

FIG. 24 shows the key fob portion 2400 of FIG. 15 with a portion of metal trim 2402 and spare key 1508 . Adding metal trim 2402 near spare key 1508 can adversely affect operation, as shown by the plots and curves of FIGS. 25-27. FIG. 25 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the key fob portion 2400 of FIG. FIG. 26 shows a polar plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of a portion of the key fob of FIG. 27 shows a plot of return loss versus frequency for the linearly polarized slot antenna of FIG. 24, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504. It is. Figures 19, 23 and 27 show that the antenna works well in the frequency range of interest (eg 2.4-2.8 GHz).

Referring to portion 1500 of FIG. 15, where full metal trim 1506 is present, antenna operation is further adversely affected as shown in the plots and curves of FIGS. 28-30. FIG. 28 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of portion 1500 . FIG. 29 shows a polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of portion 1500 . FIG. 30 shows return loss versus frequency plots for linearly polarized slot antennas 1502, 1504, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504. It is a thing.

The y-axis linearly polarized slot antennas 1502, 1504 are open slot antennas because each of the antennas 1502, 1504 has an open end. FIG. 31 shows a key fob portion 3100 having an open linearly polarized slot antenna 3102 , a closed linearly polarized slot antenna 3104 , metal trim 3106 and a spare key 3108 . FIG. 32 shows a polar plot of radiated power associated with the x-axis linearly polarized slot antenna 3102 of portion 3100 . FIG. 33 shows a polar plot of radiated power associated with the y-axis linearly polarized slot antenna 3104 of portion 3100 . FIG. 34 shows a plot of return loss versus frequency for the linearly polarized slot antennas 3102, 3104 of FIG. Figure 34 shows that the antenna measured at port S2,2 does not work.

If the portable access device has multiple orthogonal antennas as described above, the larger the portable access device is compared to the corresponding physical metal keys, and the larger the portable access device is compared to the palm of the hand, the more decorative. Elimination of unwanted metal trim provides improved round trip time performance. Improved round-trip time performance improves the accuracy of distance determination.

The systems disclosed herein can operate using many of the methods described herein. Some exemplary methods of determining which antenna combination to use are shown in FIGS. Figures 35 and 36 show a method for determining which antenna combination to use to exchange packets between the RF antenna modules (or RF circuits) of the vehicle and the portable access device for round-trip time-of-flight measurements. indicate. Figures 35 and 37 represent the method from the initiator's point of view of the round-trip time-of-flight measurement. In one embodiment, this is a vehicle. In another embodiment it is a portable access device. The reflector/responder performs explicit steps that correspond to the initiator steps of the process. Round-trip time-of-flight measurements may be used to prevent range extender-type relay station attacks, as further described below. FIG. 35 shows an approach for switching antennas between packets. FIG. 36 illustrates an approach for switching antennas during transmission of packets and/or continuous wave (CW) tones.

Although the following process is primarily described with respect to the examples of FIGS. 2-6, 11, and 14, the process can be easily modified to apply to other embodiments of the present disclosure. The process can be performed repeatedly.

The method may start at 3500. The following processing may generally be performed concurrently by the control module 402 within the portable access device 400 and by modules located on the vehicle, for example, by the access module 210, PEPS module 211 and/or PAK module 212 of FIG. . There are many ways in which the sampled frequency and antenna combination can be selected to identify the best frequency (or channel) and antenna axis. Optionally, at 3501, the module negotiates an initial frequency (or channel) and antenna combination to use for frequency and antenna sampling. This step may be based on prior agreement, negotiated between modules based on a posteriori data, and/or mandated by modules based on a posteriori data. At 3502, the frequency (or channel) on which to transmit the first (or next) packet is selected.

At 3504, an antenna pair for transmitting and receiving packets is selected. Such as two of the vehicle RF circuit antennas of FIG. At 3506, the packet is transmitted from the first (or transmit) antenna on the selected frequency to the portable access device. The portable access device measures the RSSI of the transmission and sends the packet back to the second (or receive) antenna of the selected antenna pair as the first RSSI.

At 3508, a second antenna receives the packet and/or a response to the transmission of the packet and the first RSSI. At 3512, a second RSSI is measured for a second transmission of the packet. At 3514, the first RSSI and the second RSSI are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

At 3516, if another antenna pair is selected, process 3504 is performed, otherwise process 3518 is performed. As a result, the replacement of each antenna pair can be circulated for each selected frequency. The permutation of antenna pairs may be cycled in a pseudo-random and/or predefined order.

At 3518, if another frequency (or channel) is selected, process 3502 is performed, otherwise process 3520 is performed. This allows each frequency (or channel) to be cycled. This allows the RSSI for each of the frequencies (or channels) to be determined. Due to multipath fast fading, some frequencies may have low power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels are cycled in a pseudo-random and/or predefined order to determine the best frequency and/or channel and best antenna pair for transmission of other packets. can do.

Optionally, at 3519, after cycling through a predetermined, negotiated, and/or agreed set of frequency and antenna axis pairs, the algorithm sends the node (control module) an optional antenna and/or channel RSSI You can exchange the results. The exchange of RF channels allows the modules to use heuristics to select the antenna axis used by the modules without sharing the antenna RSSI measurements obtained by the modules. The exchange of RF channels allows the module to use heuristics to select a channel (frequency) without results from other channels, while the module uses algorithms to select channels based on results from channels. may be used. In this case, the algorithm and system are less susceptible to interference from other nearby transmitters.

At 3520, after cycling through a predetermined number of frequencies and antenna pairs, the antenna axis combination and/or frequency (channel) with the best RSSI is selected for transmission of the remaining packets. The combination of antenna axes with the highest RSSI is optimal. With respect to frequency (or channel), those that do not have low RSSI and/or high RSSI are best. At 3522, the selected antenna pair and/or frequency (channel) identifier may be encrypted. At 3524, the encrypted selected antenna axis pair and/or frequency (channel) can be transmitted to other nodes. At 3526, the packet is transmitted and the response is received using the selected frequency (channel) and antenna pair. The method may end at 3528.

Although the following process of FIG. 36 is primarily described with respect to the embodiments of FIGS. 2-6, 11, and 14, the process can be easily modified to apply to other embodiments of the present disclosure. The process can be performed repeatedly.

The method may begin at 3700. The following processing may generally be performed concurrently by control module 402 within portable access device 400 and by modules located on the vehicle, for example, by PEPS module 211 and/or PAK module 212 of FIG. Many different techniques can be used to select the sampled frequency and antenna combination to identify the best frequency (or channel) and antenna axis. Optionally, at 3701, the module negotiates an initial frequency (or channel) and antenna combination to use for frequency and antenna sampling. This step can be based on prior agreement, negotiated between modules based on a posteriori data, or mandated by modules based on a posteriori data. At 3702, a frequency (or channel) is selected to transmit the first (or next) packet.

At 3704, an antenna pair for transmitting and receiving packets is selected. Such as two of the vehicle RF circuit antennas of FIG. At 3706, the packet is transmitted from the first (or transmit) antenna on the selected frequency to the portable access device. During the CW tone portion of the packet, the vehicle switches between the negotiated set of antenna axes with a period of state maintenance. The portable access device switches and receives a negotiated set of antenna axes with a period of maintaining state in each of the "switching and maintaining periods" of each vehicle antenna axis during the period within the CW tone. measure the RSSI of the transmit and receive antenna axis shifts in the packet and return the packet and the first set of measured RSSI to the vehicle; Switch the set of negotiated antenna axes for the selected antenna pair.

At 3708, the vehicle receives the packet and/or the response to the transmission of the packet and the first set of RSSI. At 3712, a second RSSI is measured for a second transmission of the packet. At 3714, the first RSSI and the second RSSI are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

At 3716, if another packet needs to be sent, process 3718 may be performed, otherwise process 3726 may be performed. At 3718, if another antenna pair needs to be selected, process 3720 is performed, otherwise process 3724 is performed. As a result, the replacement of each antenna pair can be circulated for each selected frequency. The permutation of antenna pairs may be cycled in a pseudo-random and/or predefined order.

At 3720, the first transmission of the next packet is initiated using the previous transmit antenna of the previously selected antenna pair.

At 3722, a switch is made between the previous antenna pair and the next selected antenna pair. This can be done during the CW tones of the currently transmitted packet, or during another portion of the currently transmitted packet, so that the rest of the packet is then transmitted through the transmitting antenna of Process 3708 may be performed following process 3722 .

At 3724, if another frequency (or channel) needs to be selected, process 3704 is performed, otherwise process 3718 is performed. This allows each frequency (or channel) to be cycled. This allows the RSSI for each of the frequencies (or channels) to be determined. Due to multipath fast fading, some frequencies may have low power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels are cycled in a pseudo-random and/or predefined order to determine the best frequency and/or channel and best antenna pair for transmission of other packets. can do. At 3725 the antenna and RSSI result values may be exchanged as described above at 3519 .

At 3726, after cycling through the predetermined number of frequencies and antenna pairs, the antenna combination and frequency and/or channel with the best RSSI is selected for transmission of the remaining packets.

At 3728, the selected antenna pair identifier can be encrypted. At 3730, each remaining packet may be encapsulated to include an encrypted identifier or modified to include an encrypted identifier. At 3732, the encapsulated or modified packet is transmitted using the selected frequency, channel and antenna pair and the response is received. The method may end at 3734.

In the above method, packets sent to determine the best frequency, channel and antenna pair may be discarded. Discarded packets are simply used to measure RSSI values. In another embodiment, CW tones are included at the end of the packet and antenna switching occurs between these tones. In another embodiment, a predetermined time period (eg, 4 μs) is allocated for each antenna swap, a CW tone is included at the end of the packet, and the antenna pair with the best RSSI (or power value) is selected. The selected frequency, channel, and/or antenna pair may change if another nearby network device is transmitting and/or receiving data in the same frequency range. In one embodiment, the pattern in which the frequencies are selected during the method of Figures 35 and 36 is known and shared between the vehicle's access module and the portable access device.

Operations 3526 and 3732 authorize the portable access device, detect range extender type relay station attacks by the portable access device, provide access to the interior of the vehicle, and/or prevent other PEPS and/or PAK system operations. It can be run to run. As an example, the packet is sent to authorize a portable access device to provide access to the interior of the vehicle when it is determined that the portable access device and/or the corresponding user is authorized to access the vehicle. can be This may include allowing vehicle operation. Packets may be sent to make time-of-flight measurements that include the time to send the packet to the portable access device and the time to respond and receive the corresponding response from the portable access device. Based on the measured time-of-flight values, the vehicle's access module (eg, PEPS module or PAK module) can determine whether the portable access device is attempting a range extender type relay station attack. If the portable access device is attempting to carry out a range extender type relay station attack, the access module takes one or more countermeasures including preventing access to the interior of the vehicle. Countermeasures may include notifying vehicle owners of range extender type relay station attacks. This can be done, for example, by a text message or email sent from the access module to one or more of the owner's network devices. One or more warning signals may be generated to notify a central monitoring station and/or authorities of the attack.

FIG. 37 shows a time-of-flight measurement diagram 3800 including an initiation and measurement device 3802 and a reflection (or response) device 3804. FIG. Initiating and measuring device 3802 transmits wireless messages (eg, packets) to reflecting device 3804, and reflecting device 3804 transmits wireless messages back to initiating and measuring device 3802 in response to the wireless messages. The time-of-flight (or the total time to transmit and receive these signals) is equal to the sum of (T ₂ −T ₁ ), (T ₃ −T ₂ ), and (T ₄ −T ₃ ), where: T ₂ -T ₁ is the length of time for the wireless message to travel from the initiation and measurement device 3802 to the reflection device 3804, T ₃ -T ₂ is the length of time for the reflection device 3804 to respond, T ₄ −T ₃ is the length of time for a wireless message to travel from reflection device 3804 to origination and measurement device 3802 . Exemplary average time-of-flight and distance calculations can be performed according to Equations 1-4, where distance refers to the distance between the originating and measuring device 3802 and the reflecting device 3804.

If a timer is used to time the response times T ₃ -T ₂ , the amount of timing information may be reduced to compensate for the fine tuning information measured in relation to the response times. If the initiator is unaware of this length of time, the time T ₃ -T ₂ may be reported to the initiator.

FIG. 38 shows an exemplary BLE radio 3900 with a superheterodyne receiver 3902 and a transmitter 3904. FIG. BLE radio 3900 may be used, for example, as one of transceivers 222 in FIG. 3 and may include or be part of one of RF antenna module 40 and RF circuitry 223 . In another embodiment, BLE radio 3900 is used as a transceiver of a portable access device, such as transceiver 410 of portable access device 400 of FIG. The superheterodyne receiver 3902 uses frequency mixing to convert the received signal to a fixed intermediate frequency (IF). The superheterodyne receiver 3902 includes an RF (e.g., bandpass) filter 3906, a switch balun 3908, a low noise amplifier 3910, a downconverter 3912, a bandpass filter and amplifier 3914, an analog to digital converter 3916, a demodulator 3918, and Includes correlation and protocol module 3920 . Transmitter 3904 includes processing module 3922 , protocol module 3924 , Gaussian frequency shift keying (GFSK) modulator 3926 , digital to analog converter and low pass filter 3928 , upconverter 3930 and power amplifier 3932 . Crystal oscillator 3934 may generate one or more clock signals, which may be distributed to devices 3914, 3916, 3918, 3920, 3922, 3924, 3936, 3938 and phase locked loops 3940, 3942. As an example, processing module 3922 and correlation and protocol module 3920 may be implemented as a single module, as part of one or more of modules 204, 210, 211, 212 of FIG. The processing performed by modules 3922 and 3920 may be performed by any one of modules 204, 210, 211, 212 of FIGS. One or more of devices 3906, 3908, 3910, 3912, 3914, 3916, 3918, 3920, 3924, 3926, 3928, 3930, 3932, 3934, 3936, 3938, 3940, and 3942 as part of RF circuitry 223 , and/or as part of one or more of modules 204 , 210 , 211 , 212 .

Bandpass filter 3906 can be connected to a linearly polarized antenna and/or a circularly polarized antenna (designated 3907). Downconverter 3912 downconverts the received signal from the RF frequency to the IF frequency based on the signal from phase locked loop 3942 . Upconverter 3930 upconverts the IF signal to an RF signal based on the signal from phase locked loop 3940 .

GPSK modulator 3926 and demodulator 3918 can modulate and demodulate the bits of the signal according to the GFSK protocol. FIG. 39 shows exemplary GFSK parameter definition plots including plots of transmitted carrier frequency Fc showing zero crossing points and error. As an example, the transmit carrier frequency Fc is ±250 kHz or ±500 kHz, the symbol time is 1 μs or 0.5 μs, and the zero cross error is ⅛ of 1 μs (1 Mbps) or ⅛ of 0.5 μs (2 Mbps).

FIG. 40 shows a functional block diagram of a system 4100 for transmitting BLE packets. An exemplary format of a BLE packet 4101 is shown, including preamble, access address, protocol data unit (PDU), and cyclic redundancy check (CRC) bit fields. This is an example of a packet that may be received by correlation and protocol module 3940 and/or generated by processing module 3922 and/or protocol module 3924 of FIG.

The packet preamble is AA or 55 so that the last bit of the preamble is different from the first bit of the access address. The access addresses for peripheral and central devices 4102, 4104 are the same. Sensor 4106 may be used to monitor packets. At each packet and each connection interval, the access address is the same. Access addresses follow the BLE access address rules. Packets within the same connection interval are in the same RF channel. FIG. 41 shows examples of preambles and access addresses for BLE 1M packets and BLE 2M packets. Since the preamble is multiple A's and multiple 5's (AA or 55 at 1 mbit/s, AAAA or 5555 at 2 mbit/s), the last bit of the preamble is different from the first bit of the access address. This is indicated by the bits within circle 4200 .

The access address of the advertising channel packet may be 10001110100010011011111011010110b (0x8E89BED6). Each link layer connection and each periodic advertisement between any two devices has a different access address. The access address can be a 32-bit value. Each time a new access address is needed, the link layer can generate a new random value that satisfies the following rules. The access address is not the address of an existing link-layer connection on the corresponding network device. The access address is not a valid periodic advertising address, does not have six consecutive 0s or 1s, is not an advertising channel packet access address, and is not a sequence that differs from the advertising channel packet access address by one bit, and Does not contain four equal octets. There are no more than 24 changes in the access address. The random number generator seed is from a physical entropy source and has at least 20 bits of entropy. If the access address random number does not satisfy the above rule, a new random number is generated until the rule is satisfied. For embodiments that also support the BLE encoded physical layer (PHY), the access address may have at least three 1's in the least significant 8 bits and no more than 11 changes in the least significant 16 bits. In a normal BLE packet, the preamble may reveal the first bit of the access address, and then the access rule may reveal the next bit of the access address (eg, no more than 6 consecutive 0s or 1s). This can pose a ranging security issue as an attacker may predict bits, but the embodiments disclosed herein mitigate or eliminate this.

FIG. 42 shows an exemplary plot of a BLE packet signal showing corresponding bits. A first BLE signal 4300 represents the bitstream from protocol module 3924 of FIG. A normal BLE packet does not return to the carrier (or midpoint level) if the bits remain the same value. This is called non-regression to zero recording. The bits corresponding to the first plot are indicated above the plot. A second BLE signal 4302 represents the bitstream from the GFSK modulator (or Gaussian filter) 3926 . A Gaussian filter adds a 1/2 bit time lag, giving a little time during the transition. Bits corresponding to the second BLE curve are shown below the second BLE curve. As an example, the carrier frequency may be 2.402 GHz and the BLE packet signal may vary in frequency between 2.402250 GHz and 2.401750 GHz.

FIG. 43 shows an example plot of a BLE packet signal showing corresponding bits of a stronger BLE packet signal transmitting on a faster edge (eg, a BLE packet signal with a larger RSSI) after leading edge sensing. A first BLE signal 4400 represents the bitstream from protocol module 3924 of FIG. A second BLE signal 4402 represents the bitstream from the GFSK modulator (or Gaussian filter) 3926 . A third BLE signal 4404 represents a stronger BLE packet signal transmitted on a faster edge after Gaussian bit leading edge sensing. A third BLE signal 4404 may be generated by an attacking device. As can be seen, the edges are sloping and transition faster than that of the second BLE curve 4402 . This causes the corresponding bits to be earlier than the bits in the second plot (or the output of GFSK modulator 3924). Areas where differences may be detected are indicated by oval 4406 . The bits corresponding to first BLE curve 4400 are shown above first BLE curve 4400 . Bits corresponding to the second BLE curve 4402 are shown below the second BLE curve 4402 . The bits corresponding to the third BLE curve 4404 are shown below the bits of the second BLE curve 4402 and shifted left with respect to the bits of the second BLE curve 4402 .

FIG. 44 shows the second and third BLE curves 4402, 4404 of FIG. 43, where the third BLE curve 4404 is shifted relative to the second BLE curve 4402. To defend against bit acceleration attacks, the following operations can be performed. Bit acceleration attacks involve receiving, processing, and/or modifying and forwarding BLE signals, such as BLE signals transmitted from key fobs and/or other portable access devices, by attacking devices. It refers to when the attacking device accelerates the transmission of BLE signals, taking into account the delay. FIG. 45 illustrates an example method for detecting range extension type relay attacks. Although the following process of Figure 45 is primarily described with respect to the embodiments of Figures 2-6, 11, and 14, the process can be easily modified to apply to other embodiments of the present disclosure. The process can be performed repeatedly. The following processes may be performed by one or more of modules 210, 211, 212, for example.

The method may begin at 4600. At 4602, a sliding correlation function is used to fit the received input waveform to an ideal Gaussian waveform (or other suitable predetermined waveform) of known bit pattern and bit rate, and the received input waveform and the predetermined scales the peaks of the waveform or adjusts the zero offset. This can be done by correlation and protocol module 3920 of FIG. This can be done, for example, to identify synchronization access words. An example of this is shown in FIG.

At 4604, the portion (or portion) of the received waveform that occurs earlier in time after the zero crossing of a given waveform and before the next peak 4605 is integrated and accumulated (or summed). This is called positive accumulation.

At 4606, the portion (or portion) 4607 of the received waveform that occurs later in time after the peak and before the next zero crossing is integrated and accumulated. This is also called positive accumulation.

At 4608, the resulting cumulative values determined at 4604 and 4606 are averaged over the number of transitions used to provide an indication of the level of bit acceleration attack. The cumulative values may be averaged separately to provide two average values, or summed and then averaged to provide one average value.

At 4610, it is determined whether an attack has occurred and/or is likely to have occurred based on one or more averages and one or more predetermined thresholds. At 4612, if an attack has occurred and/or is likely to have occurred, operation 4614 is performed, otherwise operation 4616 is performed. At 4614, a countermeasure is performed, such as one of the countermeasures described above, including preventing access to and/or manipulation of the corresponding vehicle. One or more alerts may be generated. As an example of another countermeasure, data related to the attack may be stored in memory and/or transmitted to the vehicle owner's network device and/or a central monitoring station. At 4616, access and/or motion control of the vehicle is granted if an attack has not occurred and/or is likely not to have occurred. Operational control may include, for example, unlocking or locking the doors of the vehicle, remotely starting the engine of the vehicle, adjusting internal environmental controls of the vehicle, and the like. At 4618, one or more averages may be discarded and/or old aggregated accumulated data may be discarded. When a sliding window is used to monitor the received signal, older portions of the data are discarded and more recent portions are retained for subsequent integration, accumulation, and averaging purposes with newly received data. May be.

FIG. 46 shows a vehicle 5200 including a round trip time (RTT) responder 5202 and an RTT initiator 5204 and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210 . As used herein, an "initiator" refers to a network device, including a BLE radio, transmitter, and/or receiver, capable of initiating a signal or tone exchange. As used herein, “responder” refers to network devices, including BLE radios, transmitters, and/or receivers, capable of responding to signals and/or tones received from an initiator. RTT responders 5202, 5210 and RTT initiators 5204, 5208 may be implemented, for example, by RF antenna module 40, RF circuitry 223, and/or modules 210, 211, 212 of FIG. 3 and include corresponding transmit and receive circuitry. can. Vehicle 5200 may include an antenna module with a single circularly polarized antenna, as described above. RTT responder 5202 and RTT initiator 5204 can transmit and receive using antennas. The antennas have at least one polarization such that at least one of the described antennas of vehicle 5200 is not cross-polarized and co-polarized with at least one polarization axis of the antennas of portable access device 5206 at any one time. With the antennas used by RTT initiator 5208 and RTT responder 5210 (eg, single-polarized antennas) to have an axis, the antennas provide polarization diversity.

Devices 5202, 5204, 5208, 5210 each include a control module as described above and are capable of performing any of the processes described. Devices 5202, 5204, 5208, 5210 can transmit and receive RF signals on random channels (eg, 40 BLE channels across an 80 MHz spectrum). Devices 5202, 5208 can communicate with each other, including transmitting and receiving signals, while devices 5204, 5210 can communicate with each other, including transmitting and receiving signals. Communication between devices 5202 and 5208 can occur concurrently with communication between devices 5204 and 5210 . The transmission of the signal to determine the RTT can be transmitted in both directions at the same time for security reasons and attack detection. Devices 5202 , 5204 can share frequencies to communicate with portable access device 5206 . The frequencies are shown in a given order and can be tracked by devices 5202, 5204, 5208, 5210. FIG. When bandpass filters are used to monitor two channels simultaneously, the filters introduce propagation delays.

A typical bandpass filter has a delay of 0.5 over bandwidth (ie, 0.5/bandwidth). The channel spacing of the protocol, the randomness of channel selection, the randomness of the direction of transmission over time, and simultaneous transmissions cause the bandpass filter to apply bits with large group delays compared to the measurable round trip time delay. Force to detect. This makes it even more difficult for the attacking device to perform range extension type relay attacks. Vehicle 5200 and portable access device 5206 are each wide enough for an attack device, for example, to receive a signal for relay with a sufficiently short delay, but not wide enough to analyze the signal. The transmit power level and transmit channel spacing can be set such that having a filter is not feasible.

In one embodiment, the signal is transmitted to measure direct time-of-flight and whether there is a predetermined amount of delay (eg, 10-500 nanoseconds (ns)) often associated with range extender type attack devices. to decide. Range extender type attack devices, when relaying signals between vehicle 5200 and portable access device 5206, may delay the transmitted signal by a predetermined amount. The bi-directional and simultaneous transmission and reception described makes it difficult for an attacking device to determine the frequency, channel and direction of the transmitted signal at any given time. It is also difficult for attacking devices to avoid relaying signals without a predetermined amount of delay.

FIG. 47 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204 and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210 . FIG. 47 shows the signal paths through the corresponding antennas 5300, 5302, 5304, 5306. FIG. In one embodiment, antennas 5300, 5302 have a total of 3 polarizations and antennas 5304, 5306 have a total of 2 polarizations. In another embodiment, antennas 5300, 5302 have a total of two polarizations and antennas 5304, 5306 have a total of three polarizations.

FIG. 48 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210, and a relay attack device 5400 of range extension type. Range extension attack device 5400 has control module 5402 including bandpass filter 5404 , bit signal direction detector 5406 , and bit acceleration attack module 5408 . A bandpass filter 5404 is used to detect the incoming bits, but has an associated delay time. Bit signal direction detector 5406 determines the direction in which the bit is traveling (eg, from the vehicle to the portable access device or from the portable access device to the vehicle). The bit acceleration attack module 5408 uses a sliding correlation function that averages the shape of a symbol (or bit) over multiple symbols (or bits) to fit an ideal waveform. Bits cannot be accelerated without introducing delay time into part of the . The described delay time can be detected by the vehicle's access module when determining whether an attack is taking place.

As shown, range extension attack device 5400 includes amplifiers 5410, such as low noise amplifiers (LNAs) and power amplifiers, for receiving and transmitting purposes. Range extension attack device 5400 may also include mixers for down-conversion and up-conversion purposes. Amplifier 5410 is connected to antenna 5412 .

In addition to performing the described communications simultaneously, the channel can be pseudo-randomly selected and the access address can also be pseudo-randomly selected. This random selection can be made in the vehicle and pre-shared with the portable access device. Conversely, the selection may be made on the portable access device. Conversely, the selection may be made by secure cryptographic techniques using key material from either or both devices contributing to a pseudorandomly selected sequence of channels and/or a sequence of access addresses. . In this case, the pseudo-random sequence of access addresses serves as a cryptographically secure sequence of bits exchanged for round-trip timing measurements. If the response is on the same channel as the initiator and the response access address is not the same as the initiator access address, simultaneous send and receive operations are performed on a random channel with a randomly chosen access address. , a range extension attack device is difficult to carry out an attack without being detected by the access module of the vehicle and/or the control module of one or more portable access devices. The range extension attack device eavesdrops on all channels, in both directions at the same time, determines in which direction a message passes through the range extension attack device, and detects bits early to ensure that the vehicle and one or more In order to convince the initiator of the portable access device, the bits must be sent in both directions early and in good time. A range extension attack device convinces an initiator of a vehicle and one or more portable access devices that the portable access device is closer than it actually is and at an appropriate distance from the vehicle, thereby enabling access and/or motion control of the vehicle. Permission must be obtained. Also, by using a Gaussian filter on the BLE bits, an attacking device has a small window below the early bit detection time of about 10-100 ns that it can use to detect bits and transmit bits early.

In one embodiment, RF signals associated with the simultaneous communications described above are monitored by modules 210, 211, 212 of FIG. degree of polarization between the antenna and the receiving antenna) is monitored and/or determined. Based on the RSSI value and polarization, one or more modules 210, 211, 212 determine the best path, frequency, channel and antenna pair for communication. Signals related to shortest path (or least interference), best RSSI value, maximum polarization, etc. are used to indicate which path, frequency, channel and antenna pair to use. This information can also be used to determine which devices are transmitting and which devices are receiving at any given time. The selection of transceiver chips and channels in each device may be randomized. In one embodiment, one device (either a vehicle or a portable access device) can transmit while another device is not transmitting, but rather is receiving. The roles are then swapped so that the first device receives while the second device is transmitting and not receiving.

Many of the techniques described above and below monitor, generate, receive, transmit, and/or measure various parameters at the vehicle access module and, based on this information, perform range extension type relay attacks. , but some or all of their processing is performed by a control module (or other module) of a portable access device, such as any of the portable access devices disclosed herein. can be modified to run in Similarly, although various processes are described as being performed on a portable access device, these processes may also be performed on the vehicle's access module.

Examples of various BLERF transmission frequencies are 2.410 gigahertz (GHz), 2.412 GHz, 2.408 GHz, and 2.414 GHz. These and other frequencies may be used by RTT initiators and responders and/or corresponding transmitters and receivers.

In one embodiment, the vehicle and/or other transmitters of the portable access device are used to lightly load one or more channels to the attack device to detect the RF signals transmitted by the initiator and responder. can be forced to have a narrow low-pass filter of The one or more channels may include or be near channels used by initiators and responders. A signal transmitted on one or more channels may be a dummy signal.

FIG. 49 shows two BLE radios 3900 (denoted 3900A and 3900B). The first BLE radio 3900A is acting as an initiation and measurement device. A second BLE radio 3900B functions as a reflective (or response) device. The initiating and measuring device 3900A determines the RTT of packets sent from the first BLE radio 3900A to the second BLE radio 3900B, the time the second BLE radio The time transmitted from 3900B to the first BLE radio 3900A can be measured. In another embodiment, the RTT sends packets from the processing module 3922A of the first BLE radio 3900A to the correlation and protocol module 3920B of the second BLE radio, and from the processing module 3922B or the protocol module 3924B to the demodulator 3918a. Or include time to return to correlation and protocol module 3920A. This includes, from processing module 3922A, through protocol module 3924A, GFSK modulator 3926A, D/A and lowpass filter 3928A, upconverter 3920A, power amplifier 3932A, switch balun 3908A, and bandpass filter 3906A, to BLE radio 3900B and through bandpass filter 3906B, switch balun 3908B, low noise amplifier 3910B, downconverter 3912B, bandpass filter and amplifier 3914B, A/D 3916B, and demodulator 3918B. Measuring travel time to 3920B may be included. The time to travel from demodulator 3918B or correlation and protocol module 3920B to protocol module 3924B or processing module 3922B may also be determined. From protocol module 3924B or processing module 3922B, GFSK modulator 3926B, D/A lowpass filter 3928B, upconverter 3930B, power amplifier 3932B, switch balun 3908B, bandpass filter 3906B, 3906A, switch balun 3908A, low noise amplifier Time through 3910A, downconverter 3912A, bandpass filter and amplifier 3914A, A/D 3916A, and demodulator 3918A, or correlation and protocol module 3920A may also be determined. Although BLE radio 3900A is described as the initiator and BLE radio 3900B is described as the responder, swapping the processing roles such that BLE radio 3900B is the initiator and BLE radio 3900A is the responder. can be done.

The following process sets the RTT between the vehicle's two BLE radios (e.g., BLE radios 3900A, 3900B in FIG. 49) and/or between the vehicle's BLE radio and the portable access device's BLE radio. can be performed to determine exactly. Processing is performed to prevent attacks and/or to easily detect when an attack is being performed and/or has already been performed. The following processes may be performed separately or in any combination. In one embodiment, a large predetermined number of packets are exchanged between BLE radios. An initiator can measure and/or estimate the RTT of signals transmitted between BLE radios. This includes a time T1 at which the packet is sent from the first BLE radio to the second BLE radio, a time T2 at which the second BLE radio responds, and a time T2 at which the second BLE radio sends the packet to the first A time T3 for sending back to the BLE radio and a time T4 for the first BLE radio to receive the packet from the second BLE radio may be included.

In one embodiment, the A/D and D/A clocks of the BLE radio and/or phase-locked loop are dithered between packets. In addition to dithering the clock when possible, a cryptographically random variation may be added for when the least significant bit (LSB) generated by the digital timer is transmitted. , which is known for BLE radios. Cryptographically random variations are used so that an attacking device cannot predict the exact moment a transmission will occur.

In one embodiment, each packet contains a large pre-agreed encrypted random multi-bit identifier (PACRMBI), eg, 16-256 bits. In another embodiment, the packet bit contents from the initiator and the packet bit contents from the responder are indistinguishable to the attacking device. Based on the bit content of the packet, the attacking device cannot identify which direction the packet came from or whether the packet is an initiator or responder packet.

In one embodiment, the BLE radio's channel is cryptographically randomized. In one embodiment, the determination of which of the BLE radios is the initiator or responder is cryptographically randomized. In one embodiment, either or both of the BLE radios transmit dummy packets that the attacking device cannot distinguish from other packets transmitted by the BLE radios. The selection of which BLE radio to transmit dummy packets can be cryptographically randomized and randomly switched. This makes it difficult for an attacking device to determine which packets are valid and in which direction the packets are being sent between BLE radios.

In one embodiment, the polarization of the antenna set being used by the BLE radio is initially cryptographically randomized. A heuristic approach is used to select which antenna permutation provides the best 'antenna-channel' across the set of channels among the BLE radios. This includes using heuristic techniques to select higher received signal strengths, calibrating antenna gains versus frequency and monitoring across multiple channels, and using the combination of antennas with the highest average or median power. and/or using a Rayleigh fading estimator or a Kalman filter estimator. This reduces cryptographically random antenna patterns and allows us to focus on the "antenna-channel" with the highest power and lowest cross-polarization.

In one embodiment, the in-phase and quadrature-phase (IQ) streams at the receiver are combined with an IQ stream with an idealized upsampled IQ stream that matches PACRMBI with a corresponding one in the BLE radio. It is upsampled (or interpolated) before sending to the correlation and protocol module. As an alternative to using PACKRMBI, the transmitted message may be encrypted and upon reception bit-decrypted and converted into an ideal upsampled IQ stream. The two upsampled streams can be sent through a correlation and protocol module 3920, which monitors the upsampled clock edges for which there is sufficient correlation to match that of PACRMBI. can be done. Correlation and protocol module 3920 selects the largest of the matching clock edges. Other clock recovery methods may be used to interpolate the sub-bit timing in the round-trip timing of the bitstream of the communication channel. This can be done in combination with upsampling correlation or in combination with normal clock sampling.

In one embodiment, amplifier settings are communicated between BLE radios. The amplifier settings are sufficient to compensate for any frequency and amplifier gain variations in propagation delay between BLE radios.

In another embodiment, the measured die temperature within the BLE radio is communicated (or shared) between the BLE radios to account for any temperature-based frequency and amplifier gain variations in propagation delay between the BLE radios. Compensate.

Another process that may be performed is communicating balun changes between BLE radios. Another process is to add short (eg, 6 μs) but cryptographically random length (eg, 4-8 μs) continuous wave tones to packet pairs to simultaneously perform tone exchange ranging while performing round-trip timing measurements. is to execute

FIG. 50 shows a position and distance determination system 5600 that includes an RTT initiator 5602 , an RTT responder 5604 and an RTT sniffer 5606 . RTT initiator 5602 and RTT responder 5604 may function as any of the initiators, responders, BLE radios, and RF circuits disclosed herein. The RTT sniffer 5606 is co-located in the vehicle with one of the RTT devices 5602, 5604 and may include one of the antenna modules 40 of FIG. including another one of Devices 5602, 5604, 5606 each include a control module as described above and are capable of performing any of the processes described. Polarization diversity as described above is provided between the antennas of the RTT devices 5602, 5604 and between the antennas of one of the RTT devices 5602, 5604 and the RTT sniffer 5606 located in the vehicle. Polarization diversity is of particular use when performing round trip timing measurements. Each of the RTT devices 5602, 5604 can include a single circularly polarized antenna.

One of the RTT devices 5602, 5604 in the vehicle is called the master device, while the other one of the RTT devices 5602, 5604 is called the slave device. When the master device sends a challenge signal to the slave device, the RTT sniffer 5606 acts as a listener to determine (i) when the challenge signal was sent and/or when the challenge signal was received at the RTT sniffer 5606, and (ii) the slave device. sends a response signal to the challenge signal and/or (iii) detects when the RTT sniffer 5606 receives the response signal. The RTT sniffer 5606 can then use triangulation based on the transmission and/or reception time of the challenge signal and the transmission and/or reception time of the response signal to determine the location of the slave device. The master device can also measure the round trip timing associated with the challenge and response signals in order to measure the direct path between antennas instead of the bounce path. This prevents the nulls of the antennas from being aligned and cross-polarization.

The master device and RTT sniffer 5606 work together to estimate the distance to the slave device. Equations 5-7 below are performed by the master device to determine the length of time, _TMS , during which the challenge signal is transmitted from the master device to the slave device, where _TSM is the length of time during which the response signal is transmitted from the slave device to the master device. _{T_RX} is the time the response signal is received at the master device, _{T_TX} is the time the challenge signal is sent from the master device, and _{T_SDELAY} is the time after receiving the challenge signal. , is the length of the delay time before the slave device responds with a response signal, and FixedOffset ₁ is the length of the first offset time, which can be 0 or greater.

The RTT sniffer 5606 detects when the challenge signal was received at the RTT sniffer 5606, when the response signal was received at the RTT sniffer 5606, and when the slave device received the challenge signal and when the slave device sent the response signal. When you know the number of slave clock cycles between. The RTT sniffer 5606 (or listener) uses Equation 8 to determine the difference between the time T _SLRX at which the RTT sniffer 5606 receives the response signal and the time T _MLRX at which the RTT sniffer 5606 receives the challenge signal. where T _SL is the length of time for the RTT sniffer 5606 to receive the response signal, FixedOffset ₂ is the length of the second offset time, which may be greater than or equal to 0; _TML is the length of time before RTT sniffer 5606 receives the challenge signal, T _SLRX is the time it takes RTT sniffer 5606 to receive the response signal, and _TMLRX is the length of time before RTT sniffer 5606 receives the challenge signal. It is time to receive the signal.

ＲＴＴスニファ５６０６でのチャレンジ及びレスポンス信号の到達時間を測定し、この情報をＲＴＴスニファ５６０６とマスターデバイスとの間で共有することによって、車両とスレーブデバイスとの間の距離を推定することができる。距離は、例えば、マスターデバイスが、到達時間及び既知の時間Ｔ_ＭＳ、並びに対応する既知の信号伝送速度を使用することによって推定することができる。チャレンジ信号のＲＴＴは、測定された到達時間に基づいて決定することができる。次いで、距離は、ＲＴＴ及び既知の信号伝送速度に基づいて決定することができる。 Since the master device and RTT sniffer 5606 are cooperating, information is shared so that one or more of these devices can estimate the distance to the slave device based on Equations 9-11. The sum of T _MS and T _SL can be replaced to provide Equations 9-11.

By measuring the arrival time of the challenge and response signals at the RTT sniffer 5606 and sharing this information between the RTT sniffer 5606 and the master device, the distance between the vehicle and the slave device can be estimated. The distance can be estimated, for example, by the master device using the time of arrival and the known time T _MS and the corresponding known signal transmission rate. The RTT of the challenge signal can be determined based on the measured time of arrival. Distance can then be determined based on the RTT and the known signal transmission rate.

FIG. 51 shows another position and distance determination system 5700 including an RTT initiator 5702 , an RTT responder 5704 and multiple RTT sniffers 5706 . RTT initiator 5702 and RTT responder 5704 may function as any of the initiators, responders, BLE radios, and RF circuits disclosed herein. The RTT sniffer 5706 is co-located with one of the RTT devices 5702, 5704 in the vehicle and includes an antenna module (similar to antenna module 40 of FIG. 2). Devices 5702, 5704, 5706 each include a control module as described above and are capable of performing any of the processes described. The RTT device in the vehicle may also include an antenna module similar to antenna module 40 of FIG. Polarization diversity is provided between the antennas of the RTT devices 5702, 5704 and between the antennas of one of the RTT devices 5702, 5704 and the RTT sniffer 5706 located in the vehicle. Polarization diversity is particularly exploited when performing round-trip timing measurements to measure the direct path between antennas rather than the bounce path. This allows the nulls of the antennas to be aligned and prevents cross-polarization.

One of the RTT devices 5702, 5704 in the vehicle is called the master device, while the other one of the RTT devices 5702, 5704 is called the slave device. When the master device sends a challenge signal to the slave device, the RTT sniffer 5706 acts as a listener to detect when the challenge signal is sent and when the slave device sends a response signal to the challenge signal. . RTT devices 5702, 5704 may operate similarly to RTT devices 5602, 5604 of FIG. Each of RTT sniffers 5706 may operate similarly to RTT sniffer 5606 .

Time TAB is the length of time that the challenge signal is transmitted from RTT initiator 5702 to RTT responder 5704 . The time TBA is the length of time during which the corresponding response signal is sent from the RTT responder to the RTT initiator. Time TAC is the length of time that the first RTT sniffer receives the challenge signal. Time TBC is the length of time that the first RTT sniffer receives the response signal. Time TAD is the length of time that the second RTT sniffer receives the challenge signal. Time TBD is the length of time that the second RTT sniffer receives the response signal. Time TAE is the length of time that the third RTT sniffer receives the challenge signal. Time TBE is the length of time that the third RTT sniffer receives the response signal. If TAB and TAC are known, TBC can be calculated. If TAB and TAD are known, TBD can be calculated. If TAB and TAE are known, TBE can be calculated.

式１８－２１は三辺測量式である。

４つの式を４変数で置き換えると、式２２～２５が得られる。

If we have enough RTT sniffers, we can calculate the time TAB. For example, if three RTT initiators know the location of the RTT initiator relative to the master device (or initiator), the time TAB can be calculated. This can be achieved using Equations 12-17, assuming all reflections are instantaneous, where TRxAC is the time at which the first RTT sniffer receives the challenge signal. , TRxBC is the time the first RTT sniffer receives the response signal, TRxAD is the time the second RTT sniffer receives the challenge signal, and TRxBD is the time the second RTT sniffer receives the response signal. is time to receive, TRxAE is the time for the third RTT sniffer to receive the challenge signal, TRxBE is the time for the third RTT sniffer to receive the response signal, deltaRxAtC is the time for the first RTT sniffer to receive is the time difference between the time the response signal was received by the first RTT sniffer and the time the first RTT sniffer received the challenge signal, and deltaRxAtD is the time the second RTT sniffer received the response signal and the second RTT deltaRxAtE is the time difference between the time the sniffer received the challenge signal and deltaRxAtE is the time difference between the time the third RTT sniffer received the response signal and the time the third RTT sniffer received the challenge signal is. The location of the slave device (or responder) can also be determined using equations 18-25. where xa is the x-coordinate of the master device, ya is the y-coordinate of the master device, za is the z-coordinate of the master device, xb is the x-coordinate of the slave device, and yb is the y-coordinate of the slave device; zb is the z-coordinate of the slave device, xc is the x-coordinate of the first RTT sniffer, yc is the y-coordinate of the first RTT sniffer, and zc is the z-coordinate of the first RTT sniffer. where xd is the x-coordinate of the second RTT sniffer, yd is the y-coordinate of the second RTT sniffer, zd is the z-coordinate of the second RTT sniffer, xe is the third is the x-coordinate of the RTT sniffer, ye is the y-coordinate of the third RTT sniffer, and ze is the z-coordinate of the third RTT sniffer. Knowing the x, y, z coordinates of the master and slave devices, the x, y, z coordinates of the slave device are determined. TBC, TBD, and TBE can be determined in a manner similar to that described above.

Equations 18-21 are trilateration equations.

Replacing the four equations with four variables yields equations 22-25.

When three RTT sniffers (eg, the RTT sniffer 5706 shown) are used, three sniffers are used to determine the distance and location of the slave device relative to one of the RTT devices 5702, 5704 and/or the corresponding vehicle. A trilateration can be performed using two circles. This can be done by the master device and/or one or more RTT sniffers. Information determined by the master device and the RTT sniffer can be shared with each other. Time, distance, and/or position can be determined and updated periodically.

In the vehicle, if there is an object (e.g. a vehicle occupant's head) near and/or between the master device and one or more of the RTT sniffer's antenna modules such that the object interferes with the signal transmitted by the master device. , the round-trip timing measurements may be updated periodically. This can be done to measure the distance between the master device and the RTT sniffer, to detect when the corresponding physical environment/system has changed.

FIG. 52 shows a first network device (or vehicle) 5800 and a second network device (or portable network device) 5802 . First network device 5800 includes tone exchange responder 5804 and tone exchange initiator 5806 . Tone exchange is also called unmodulated carrier tone exchange. Second network device 5802 includes tone exchange initiator 5808 and tone exchange responder 5810 . Devices 5804, 5806, 5808, 5810 may be implemented as any of the other BLE radios, RF circuits, initiators, responders, etc. disclosed herein. At least one of the devices 5804, 5808 and at least one of the devices 5806, 5808 may include or be connected to single polarized antennas and circularly polarized antennas. Devices 5804, 5806, 5808, 5810 may each include antenna module 40 of FIG. 2 and/or the antenna shown in FIG.

Tone exchange may be performed between responder 5804 and initiator 5808 and between initiator 5806 and responder 5810 . RTT measurements may be sent in the same packet as the tones exchanged. Devices 5804, 5806, 5808, 5810 can randomly select the channel used to transmit packets. Packet transmission can occur concurrently with packet reception. For example, initiator 5808 can transmit tones to responder 5804 on a first channel while initiator 5808 receives tones from responder 5804 on a second channel. Initiator 5806 can transmit and/or receive tones while initiator 5804 is transmitting and/or receiving tones.

The network devices 5800, 5802 may be pre-synchronized via, for example, an exchange of sequence signals (or handshakes) to synchronize the clocks of the network devices 5800, 5802. This synchronization may be performed to allow network devices to transmit signals to each other at the same time. As an example, two 1 MHz signals can be transmitted, each transmitting data at 1 Mbps. The signals can be 2 MHz apart from each other. This can prevent attack devices from being able to perform attacks such as range extension attacks or attacks involving active manipulation of tones. If an attacker uses a 1 MHz wide bandpass filter, it will not respond fast enough to be able to attack because of the long delay time of the bandpass filter. If an attacker uses a wideband bandpass filter, such as a 4 MHz bandpass filter, the corresponding signal eye diagram will be too noisy to distinguish the signals transmitted by the network devices 5800, 5802. As another example, signals may be transmitted from a network device at a symbol rate less than or equal to a predetermined length of time (eg, 1 μs per symbol). This allows rapid transmission and prevents attacks. Also, two signals at the same time require the attacker to detect and affect both signals, further hampering the attacker's success. As noted above, both signals may be transmitted on different frequencies by the same network device or by different network devices.

The devices 5804, 5806, 5808, 5810 change the frequency of the transmitted tones, monitor the phase change due to the frequency change, and determine the distance between the network devices 5800, 5802 based on the phase change. can be done. This is sometimes called carrier phase based ranging. Alternatively, if the signal is sent and received as a result of the signal being reflected back to the source, the phase difference between the transmitted and received signals is used to determine the modulo the distance between the source and the reflector. can do. Similarly, the initiator determines the phase difference between (i) the signal sent from the initiator to the responder and (ii) the corresponding response signal sent back to the initiator from the responder. can be determined modulo the distance of The slope of the phase difference versus frequency change scales with or equals distance, subject to the frequency step size limit. The smaller the frequency step, the larger the modulo rollover distance (see Olafsdotter, Ranganathan, and Capkun, "On the Security of Carrier Phase-Based Ranging", which is incorporated herein by reference).

As another example, a received signal strength indicator (RSSI) parameter can be monitored to determine if a network device is close to a vehicle and then a series of tone exchanges can be performed to measure distance. Based on the user's touch on the door handle, a tone exchange may be performed to confirm no aggression. Multiple round-trip timing measurements may be performed to determine the distance of the network device to the vehicle.

The distance determination techniques described above may be used in combination with other techniques disclosed herein to determine RTT values. The direction of travel of the tones between devices 5804, 5806, 5808, 5810 can be randomized.

In one embodiment, the control module of the first network device 5800 plots changes in phase versus changes in frequency for each of the multiple tones exchanged to generate multiple linear curves. The control module determines the slope of the curve, which provides the ratio of phase change to frequency change. The slope is then used to determine the distance between neighbors in the curve, which distance is related to the distance between the first and second network devices 5800,5802.

FIG. 53 shows a positioning system 5900 that includes a tone exchange initiator 5902, a tone exchange responder 5904, and a tone exchange sniffer 5906. FIG. Tone exchange initiator 5902 and tone exchange responder 5904 may function as any initiator, responder, BLE radio, or RF circuit disclosed herein. The tone exchange sniffer 5906 can function similarly to the RTT sniffer 5606 of FIG. 50 and is co-located in the vehicle with one of the tone exchange devices 5902, 5904 and includes one of the antenna modules 40 of FIG. , the tone switching device in the vehicle includes another one of the antenna modules 40 . Devices 5902, 5904, 5906 each include a control module as described above and are capable of performing any of the processes described. Polarization diversity is provided between the antennas of the tone switching devices 5902, 5904 and between the antennas of one of the tone switching devices 5902, 5904 and the tone switching sniffer 5906 in the vehicle. Polarization diversity is of particular use when performing round trip timing measurements.

One of the tone switching devices 5902, 5904 in the vehicle is called the master device, while the other one of the tone switching devices 5902, 5904 is called the slave device. When the master device sends tone signals to the slave device, and vice versa, the tone-switching sniffer 5906 acts as a listener to (i) tell when a tone is sent to the tone-switching sniffer 5906 and/or to the tone-switching sniffer 5906 (ii) when the slave device has transmitted a tone to the master device; and/or (iii) when tone exchange sniffer 5906 has received a tone transmitted by the slave device. A slave device can act as a reflector and transmit tones received from the master device back to the master device. The master device and/or sniffer device can prevent at least one of access to or motion control of the vehicle based on the time of arrival of the tone, round trip timing measurements, and/or the estimated distance between the devices.

FIG. 54 shows a method for determining the distance between initiator and responder and between responder and sniffer. 54 are primarily described with respect to the examples of FIGS. It can be easily modified to apply to other embodiments. The process can be performed repeatedly. Although this method will be primarily described with respect to the embodiment of FIG. 53, this method can be applied to other embodiments of the present disclosure.

The method may start at 6000. At 6002 , tone exchange initiator 5902 transmits a tone signal containing tones to tone exchange responder 5904 . A tone can be represented as e ^(jωt+ΦA ₎ ^·τAB _, where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, _τAB is the time to travel from A to B, and the tone exchange initiator is directly related to the distance between 5902 and tone exchange responder 5904, ω is frequency, φ _A is the phase of the tone at tone exchange initiator 5902, and t is time.

トーン交換スニファ５９０６で、受信トーン信号はベースバンドにダウンコンバートされ、これは式２７で表すことができる。

At 6004, the tone is received at tone exchange responder 5904 with delay φ _B and at tone exchange sniffer 5906 with delay φ _C . At tone exchange responder 5904, the received tone signal is downconverted to baseband, which can be expressed in Equation 26.

At the tone exchange sniffer 5906, the received tone signal is downconverted to baseband, which can be expressed in Equation 27.

At 6006, tone exchange initiator 5902 receives the tone from tone exchange responder 5904, and tone exchange responder 5904 retransmits the tone signal to tone exchange initiator 5902 as a second tone signal. A tone can be expressed as e ^(jωt+Φ _A ^)·τ _AB . The received second tone signal can be represented by Equation 28. Tone exchange sniffer 5906 also receives a second tone signal that can be represented by Equation 29.

At 6008 , tone exchange initiator 5902 receives a phase signal from tone exchange responder 5904 that indicates a natural logarithmic tone value that includes the difference in phase of the tone as received at tone exchange responder 5904 . Thus, tone exchange responder 5904 sends the measured phase to tone exchange initiator 5902 where the values are multiplied as represented by equation 30.

At 6010, the tone exchange sniffer 5906 determines, based on the received tone signal, the phase difference of the tone between when it was sent from the tone exchange initiator and when it was received at the tone exchange sniffer, and the tone exchange responder. determine a tone value that relates to the difference in phase of the tone between when it was sent from and when it was received at the tone exchange sniffer. The tone values can be expressed as e ^(jωτ _BC ^{+ θ} _B ^{− θ} _C ⁾ and e ^(jωτ _AC ^{+ θ} _A ^{− θ} _C ⁾ .

イニシエータ５９０２及び／又はスニファ５９０６は、式３１の結果の逆対数を取り、時間τ_ＢＣ、τ_ＡＢを提供することができる。レスポンダ５９０４とスニファ５９０６との間、及びイニシエータ５９０２とレスポンダ５９０４との間の距離は、これらの時間及びトーン信号の既知の伝送速度に基づいて決定され得る。方法は６０１４で終了し得る。イニシエータ５９０２又はスニファ５９０６は、推定された少なくとも１つの距離に基づいて、車両へのアクセス又は車両の動作制御のうちの少なくとも１つを防止することができる。 At 6012, the initiator 5902 and/or the sniffer 5906 determine the distance between the initiator 5902 and the responder 5904 and the distance between the initiator 5902 and the sniffer 5906. The distance value can be determined in a similar manner as when sniffing the round trip time above, see, eg, Equations 12 and 15 and corresponding discussion. Instead of round trip time, phase is used. This calculation involves using Equation 31, where the tone values e ^(jωτ _BC ^{+ θ} _B ^{− θ} _C ⁾ and e ^(−jωτ _AC ^{− θ} _A ^{+ θ} _C ⁾ are measured or determined by sniffer 5906 and e ^{( jωτ} _AC ⁾ is known a priori and the tone value e ^(jωτ _AB ^+θ _A ^−θ _B ⁾ is determined at responder 5904 .

Initiator 5902 and/or sniffer 5906 may take the anti-logarithm of the result of Equation 31 to provide times τ _BC , τ _AB . The distance between responder 5904 and sniffer 5906 and between initiator 5902 and responder 5904 can be determined based on the known transmission rates of these time and tone signals. The method may end at 6014. The initiator 5902 or sniffer 5906 can prevent at least one of access to the vehicle or motion control of the vehicle based on the estimated at least one distance.

FIG. 55 shows an example passive tone switching and phase detection system 6100 . System 6100 includes a phase locked loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and an antenna module 6110. Antenna module 6110 may be similar to antenna module 40 of FIG. Transmitter 6106 transmits a first tone, which is the output of PLL 6102 and is reflected by reflector 6112 back to receiver 6108 . The output of the PLL and the reflected tone signal are provided to phase module 6104 . A phase module 6104 determines the phase difference between the output of the PLL and the reflected tone signal. Phase module 6104 or other modules disclosed herein determine the distance between transmitter 6106 and reflector 6112 based on the phase difference. The topology module 6104 or other modules disclosed herein can prevent access to the interior of the vehicle and/or control the motion of the vehicle based on the determined distance.

FIG. 56 shows an example active tone exchange and phase detection system 6200 . System 6200 operates similarly to system 6100 of FIG. Transmitter and receiver 6106 , 6108 are represented by box 6202 . Reflector 6112 in FIG. 55 can be replaced with responder device 6204 for active exchange of tones. Responder device 6204 can receive a first tone signal including the first one or more tones from transmitter 6106 and respond with a second tone signal. The second tone signal may include one or more tones and/or one or more other tones. A second tone signal is sent back to the receiver 6108 .

FIG. 57 shows an initiator packet 6300 and a response packet 6302 used for RSSI and time-of-flight measurements. Initiator packet 6300 includes a preamble, a synchronization access word (e.g., a pseudo-random synchronization access word), a data field containing data, a cyclic redundancy check (CRC) field containing CRC bits, and a continuous wave (CW) tone field containing CW tones. It can contain multiple fields such as Response packet 6302 may include a CW tone field, a preamble, a sync access word, a data field, and a CRC field.

An initiator device can send an initiator packet 6300, which can be received at a responder device. The responder device can then generate a response packet 6302 and send the response packet back to the initiator device. This can be done for tone swapping, phase difference determination, round trip timing measurements, and the like. The distance between devices can then be determined. These measurements and calculations can be performed to detect range extender type relay station attacks. In one embodiment, the initiator and responder pre-negotiate what the synchronization access word will be based on a predetermined list. The synchronous access word contains an access address. An initiator may, for example, measure the length of time it takes to receive (i) a response packet after sending an initiator packet, and/or (ii) a synchronization access word. The length of time and the synchronous access word can be compared with a predetermined length of time and a predetermined synchronous access word. If the comparisons performed yield matching results, then a range extender type relay station attack has not occurred. However, if the received synchronization access words do not match and/or the length of time differs from the expected value by more than a predetermined amount, a range extender type relay station attack may be occurring.

In one embodiment, the initiator and responder exchange a given key, a list of synchronous access words, and the times at which each of the synchronous access words should be transmitted. When first created, the Synchronization Access Word can be randomly selected. This allows the responder to know the appropriate key and/or synchronization access word to respond to when it receives the initiator packet. The key can be included in the response packet. In another embodiment, the initiator and response packets do not contain preambles, as shown in FIG. In one embodiment, the CW tones are 4-10 μs in length.

In another embodiment, the initiator packet and response packet have the same format as shown in FIG. Each packet contains a first CW tone as the first field, a sync access word, a data field, a CRC field, and a second CW tone as the last field. Another example of initiator and response packets with the same format is shown in FIG. 60, where each packet has the first CW tone as the first field, a sync word containing PACRMBI, a PDU field containing the PDU, a medium It contains an access controller (MAC) field, a CRC field, and a second CW tone as the last field. The CW tones in FIGS. 57-60 are cryptographically random length tones that may be examined by the initiator upon receipt. For example, if the CW tone received from the responder is incorrect, a range extender type relay station attack may have occurred. In the embodiments of FIGS. 59-60, the round trip timing of the sync word prevents the CW tone exchange from wrapping beyond an uncertain range (eg, 75 meters) with a channel tone step of 2 MHz. The above initiator and responder packets may be transmitted on the same frequency. By having the initiator and responder packets in the same format, an attacking device cannot distinguish which packets are initiator packets and which are responder packets. In one embodiment, no CW tones are included at the end of the packet.

In one embodiment, the timing, frequency, length, power level, amplitude, and content of CW tones and synchronization access words of initiator and responder packets are checked at the initiator and responder for correctness and/or consistency. to identify if an attack is taking place. In one embodiment, a pseudorandom number of packets is switched on a first frequency before changing to the next frequency and switching another pseudorandom number of packets.

Because attack devices typically include filters (eg, low-pass filters, band-pass filters) and mixers (eg, down-converters, up-converters), attack devices introduce delays when relaying signals. In order for an attack by an attacking device to go undetected, the attacking device should retransmit the received signal without detectable delay. This makes it difficult for attack devices to go undetected. An attacking device may delay a signal by 500 ns, which may delay the signal by 500 feet (ft) in space. The attacking device may need to know in advance what is being sent so that the attacking device can hasten sending the tone or start sending the tone at the appropriate time. This is impossible. This is especially true when using a heterodyne receiver to receive the relay signal. A heterodyne receiver transforms the packets/tones into the in-phase (I)-quadrature (Q) domain and captures them in the IQ domain. A phase difference is detected in the IQ domain. If there is an attack, the delay due to the attack can be detected in the IQ domain based on the phase difference. If the tone is shortened by the attacking device so that the corresponding synchronization access word arrives at the correct time, the timing and length of the CW tone are incorrect and will be detected by the initiator.

In one embodiment, the initiator divides the received CW tones transmitted from the responder into (i) length relative to the start position of the transmitted synchronous access word, (ii) before the synchronous access word and consistent with respect to the synchronous access word. and (iii) consistent tones throughout the synchronous access word. A consistent tone may refer to consistent frequency, power level, amplitude, and the like. In another embodiment, the start and end times of the synchronous access word relative to the beginning of the first CW tone of the transmitted packet are known to be within a predetermined time (eg ±10 ns range). So, if the start and end times are within a predetermined range of the beginning of the first CW tone of the packet, there is no attack, otherwise an attack may be occurring.

As another example, an initiator's PLL that transmits tones may, on a given channel, have three different tones that the PLL can generate: a center tone, a high tone at a first frequency (e.g., 250 KHz), and a It can have a low tone at a second predetermined frequency (eg -250 KHz). The tones to be transmitted may be selected and transmitted according to a predetermined and agreed upon random sequence and/or pattern of tones. This can be agreed between the initiator and the responder. The initiator's and attacking device's PLLs may not be aligned with each other. If there is a frequency difference between the signal transmitted by the initiator and the signal received in response that exceeds a predetermined threshold, the initiator can determine that an attack is taking place.

In one embodiment, the responder can measure what phase lag it detects with respect to the received signal and respond with data. This can be based on the timing at which the responder received the packet's tail-end CW tone from the initiator. The responder generates (i) the tail-end (or end) CW tone of packets received from the initiator and (ii) the front-end (or first leading CW tone) of packets being transmitted by the responder in response to packets received from the initiator. ) can be measured. The initiator can calculate the total two-way round-trip time of the packet from the initiator to the responder and from the responder back to the initiator.

In addition to detecting signal delays, the initiator can also detect when the attacking device has amplified the signal (or tone). Signal/tone amplification can also delay transmission, which can be detected. During the relaying of the tone at the attacking device, the tone may be distorted and/or a different tone than the originally transmitted tone may be transmitted.

The above example allows for more accurate range measurements with a smaller number of packets each having both a synchronous access word and a CW tone. The synchronous access word protects the CW tone from being altered by an attacking device without being detected, and vice versa. A two-way randomized communication is performed that protects both the synchronous access word and the CW tone.

The initiator PLL disclosed herein may be a phase predictable PLL that allows the initiator to predict the phase of the signal when the frequency of the signal is changed. This eliminates the need to check whether the timings of the CW tones transmitted by the initiator and the CW tones transmitted by the responder are correct. The responder measures, for example, the time at which the tail-end CW tone from the initiator is received, determines the corresponding phase delay of the tail-end CW tone relative to the generation of the front-end CW tone by the responder for the response signal, and This information can be sent to the initiator along with the CW tone. The initiator can then calculate the total round trip time based on the received information.

In one embodiment, the initiator is one of the vehicle or the portable access device and the responder is the other one of the vehicle and the portable access device. The order in which the vehicle and portable access device transmit and respond is pseudo-randomly altered. Also, packets and/or tone signals can be sent as responses and then used as initiator packets and/or initiator tone signals. In one embodiment, the order in which vehicles and portable access devices transmit and respond is not changed for short periods of exchange (e.g., exchange periods less than a predetermined period) and long exchange periods (e.g., exchange periods greater than or equal to a predetermined period). exchange period). The order can be switched periodically. In these examples, bi-directional data is exchanged using antenna polarization diversity to provide correct timing measurements.

Processing is performed to provide accurate measurements of when CW tones and sync access words begin and end. The Correlation and Protocol module 3920 maintains a circular queue of bits and compares the CW tones of transmitted (initiator) packets and the start and end times and lengths of the synchronization access words to the CW tones of received (responder) packets. and can be locked in for comparison with the start and end times and lengths of the synchronous access words. Correlation and protocol module 3920 can interpolate where the zero crossing points are located. Post-processing of the I and Q data associated with the synchronous access word may be performed for clock recovery to interpolate when the synchronous access word arrives. The I data and Q data can have different transition/spin rates. Interpolation can be performed to determine where the center point of the transition is to obtain the correct timing of the clock recovery. Multiple zero-crossing points can be detected and aligned for timing purposes. Also, the I and Q data may be oversampled as described further below in order to best fit/align to one or more bits.

FIG. 61 shows an antenna routing system 6700 for network devices each having an antenna module. The antenna module exhibits polarization diversity. In this example, two polarization axes for each antenna module are shown. Each antenna module includes a vertical antenna and a horizontal antenna. The possible channel vectors h _VV , h _VH , h _HV and h _HH are shown. A ranging module 6710 is shown. A ranging module 6710 determines the range (or distance) between corresponding antennas of network devices based on each one of the channel vectors h _VV , h _VH , h _HV , and h _HH . A ranging module may execute a ranging algorithm to determine ranges r _VV , r _VH , r _HV and r _HH . The determined ranges r _VV , r _VH , r _HV and r _HH are provided to minimum module 6712 which determines which range r _VV , r _VH , r _HV and r _HH is the shortest. The shortest route can be chosen.

Each channel vector may be generated for one or more selected frequencies. When compared, ranges can be generated for channel vectors of the same frequency or different frequencies. As an example, vectors are generated for at least some of 80 different tones within the 2.4 GHz industrial, scientific, and medical (ISM) band with 1 MHz frequency steps between adjacent tones. obtain. A frequency associated with the shortest range can be selected. Other factors such as signal strength, amplitude, voltage, parameter consistency, etc. may also be taken into account in the selection. This route selection may be performed by any of the initiators, responders, modules, network devices, etc. disclosed herein and used for round trip timing measurements. This allows the optimal antenna path to be selected for bi-directional packet and/or tone signal exchange to determine round trip time.

38 and 62, FIG. 62 illustrates the structure, function and operation of BLE radio 3900 (and/or a modified version of BLE radio 3900) and RF channels and corresponding RF circuitry of FIG. A corresponding example radio model 6800 is shown. The radio model 6800 includes a first sampling module 6802, a time offset module 6804, a Gaussian low pass filter 6806, an integrator 6808, a first upsampler 6810, an amplifier 6812, a summer 6814, a modulator 6816, a second sampling module 6818, phase and frequency offset module 6820, first mixer 6822, phase delay device 6823, second mixer 6824, phase delay module 6826, second low pass filter 6828, resample module 6830, arctangent module 6832, differentiation 6834 , sign determination module 6836 , bit pattern module 6838 , second upsampler 6840 , third upsampler 6842 , crosscorrelation module 6844 , and peak detector 6846 . Devices 6802, 6804, 6806, 6808, 6810, 6812 illustrate an example of the transmitter portion of BLE radio 3900 or another BLE radio. Adder 6814 represents a channel between (i) another BLE radio and (ii) BLE radio 3900 , which includes devices 3907 , 3906 , 3908 , 3932 , and 3910 . Since the receiving BLE radio is not phase-locked to the transmitting BLE radio, there may be phase and frequency offsets between the receiving BLE radio and the transmitting BLE radio. Devices 6816, 6818, 6820, 6822, 6824, 6828, 6830 correspond to the receiver portion of the BLE radio and relate to the RF sampling rate. Devices 6830, 6832, 6834, 6836, 6838 also correspond to the receiver portion and perform processing on the baseband signals. Resample module 6830 functions as an analog-to-digital converter. Devices 6840, 6842, 6844, and 6846 also correspond to the receiver portion and are involved in interpolation to determine phase.

When recovering the bitstream, the zero crossings of the reconstructed signal from differentiator 6834 can be determined. There can be a significant amount of jitter at the zero-crossings, which adversely affects time-of-flight determinations based on the timing of the zero-crossings. A small amount of jitter adversely affects the determination of transmit and receive times.

Upsamplers 6840, 6842 and cross-correlation module 6844 are implemented to reduce jitter associated with sampling and zero-crossing determinations. Upsamplers 6840, 6842 perform signal processing to interpolate and inject data points between existing received data points to provide finer temporal resolution.

In one embodiment, the transmitted bitstream is known a priori to the BLE receiver and is provided to upsampler 6842 as indicated by arrow 6843 . In this example, sign determination module 6836 and bit pattern module 6838 are not included. In another embodiment, the transmitted bitstream is not known and a code determination module 6836 and a bit pattern module 6838 are included to provide an estimated bitstream to the upsampler 6842. As an example, a transmitted bitstream may be an access address that indicates which device is transmitting. An estimated bitstream can be determined based on the criteria. For example, the criteria can be a preamble and/or sequence of bits received before the bitstream is estimated. The preamble and/or sequence of bits provide a temporal reference based on which probable bitstream is generated. An estimated bitstream is generated based on the known clock frequency of the transmitter and related to the transmitted signal and the clock frequency of the receiver.

Cross-correlation module 6844 performs cross-correlation between the outputs of up-samplers 6840 , 6842 and/or between the output of up-sampler 6840 and the output of bit pattern module 6838 . Cross-correlation is performed to match the envelopes of the signals provided to the cross-correlator and determine the phase difference. Cross-correlation may involve performing a product of the output signals, including taking the product of corresponding data points of the two output signals and summing the products. Repeating this sum-of-products operation, each iteration gradually shifting one of the outputs relative to the other one of the outputs by one data point in time yields multiple results of sum-of-products values. can get. The maximum sum of products value refers to when the two outputs are synchronized (or aligned) so that the waveforms match and are aligned in time. Based on this information, the phase offset (or difference) between the two outputs is determined.

Cross-correlation improves resolution by upsampling performed by upsamplers 6840,6842. The cross-correlation module 6846 correlates with a finer resolution signal than was originally received and interpolates finer the arrival times of the received packets in the received signal. Higher correlation resolution reduces the signal-to-noise ratio and bit length of the message and allows interpolation with finer resolution. The phase offset can be used to determine time of flight as described herein. A peak detection module 6846 evaluates the cross-correlation results to indicate (i) when coincident peaks occurred and/or (ii) phase offsets. In one embodiment, the cross-correlation module 6844 receives digital values and the peak detection module 6846 determines if the cross-correlation output (or sum of products value) reaches a predetermined threshold. If a predetermined threshold is reached, the peak detection module indicates "signal found" and the determined phase.

In one embodiment, the output of upsampler 6840 is provided to sign determination module 6836 and cross-correlation module 6844 and upsampler 6842 is not included. In this example, the output of bit pattern module 6838 is provided directly to cross correlation module 6844 .

The devices of FIGS. 38 and 62 are further described with respect to the method of FIG. The following process of FIG. 63 is primarily described with respect to the embodiments of FIGS. be able to. The process can be performed repeatedly.

The method can start at 6900. At 6902 , a sampling module 6802 of a first network device (eg, a network device implemented in a vehicle as part of an in-vehicle system or a portable access device) receives a bitstream transmitted from processing module 3922 . A sampling module 6802 samples the bitstream.

At 6904, a time offset module 6804 can receive the output of sampling module 6802 and introduce a time offset (or delay). Sampling module 6802 and time offset module 6804 may be implemented by protocol module 3924 . At 6906, a Gaussian low pass filter (LPF) 6806 receives the output of the time offset module 6804, and the Gaussian LPF 6806 may contain the bitstream that is filtered and converts the square wave to a sine wave. Gaussian LPF 6806 processing may be implemented by GFSK modulator 3926 . At 6908 an integrator 6808 integrates the output of Gaussian LPF 6806 and may be implemented by a D/A low pass filter 3928 . Examples of signals 7000, 7002, 7004 output from sampling module 6802, Gaussian LPF 6806, and integrator 6808, respectively, are shown in FIG. 64A.

At 6910, an upsampler 6810 upsamples the output of integrator 6808 to include additional points per sample. Upsampler 6810 may be implemented by upconverter 3930 . At 6912, an amplifier 6812 provides gain for frequency deviation. At 6914 , sampling module 6818 receives RF tones that may be provided by PLL 3940 . The output of sampling module 6818 is provided to both modulator 6816 and phase and frequency offset module 6820 . At 6916, a modulator 6816 modulates the output of sampling module 6818 based on the output of amplifier 6812 to provide an initiator signal. Modulator 6816 may be implemented at least in part by upconverter 3930 .

At 6918, the initiator signal from modulator 6816 may be provided to power amplifier 3932 and transmitted to the second network device. The second network device may be a network device or a portable access device implemented in the vehicle as part of an in-vehicle system. The initiator signal may be any of the initiator signals, initiation tone signals, master device transmission signals, and/or the like disclosed herein.

At 6920, low noise amplifier 3910 receives a response signal responsive to the initiator signal. The response signal may contain Gaussian noise included in the received response signal, as represented by summer 6814 . At 6922, mixers 6822, 6824 receive the response signal from the low noise amplifier 3910 and downconvert the response signal to in-phase (I) and quadrature (Q) baseband signals. The quadrature baseband signal may be phase delayed by 90° through phase delay device 6823 . This can be accomplished with downconverter 3912 .

At 6924, an LPF 6828 filters the baseband signal to remove high frequency components. LPF 6828 may include multiple LPFs, one for each downconverted signal. LPF 6828 may be replaced and/or implemented by bandpass filter and amplifier 3914 . At 6926, a resampling module 6830 samples the filtered baseband signal with sample jitter. Resampling module 6830 may be implemented by A/D converter 3916 . An example of signals 7006, 7008 from resampling module 6830 is shown in FIG. 64B.

At 6928, arctangent module 6832 determines the arctangent of the baseband signal to generate an arctangent signal. An example of signal 7010 from arctangent module 6832 is shown in FIG. 64C. At 6930 , differentiator 6834 differentiates the arctangent signal from arctangent module 6832 . An example of the signal 7012 from the differentiator 6834 shown superimposed on the original Gaussian filtered signal 7002 is shown in FIG. 64D.

At 6932 , sign module 6836 performs a sign function to determine the sign of the output of differentiator 6834 . At 6934 , the bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of sign module 6836 . After the processing of low pass filter 6828 and arctangent module 6832 are applied, an idealized bit pattern is obtained that matches the bit pattern from Gaussian LPF 6806 or any other bit pattern with the received bit pattern. This is done so that the upsampled values are similar to the noise-free resampled data.

At 6936, upsamplers 6840, 6842 upsample the outputs of differentiator 6834 and bit pattern module 6838, respectively. At 6938, the outputs of the upsamplers 6840, 6842 are correlated by a cross-correlation module 6844 to produce correlated signals. Devices 6832 , 6834 , 6836 , 6838 , 6840 , 6842 may be implemented by demodulator 3918 . At 6940 , peak detector 6846 determines the phase of the correlation signal obtained from cross-correlation module 6844 . Cross-correlation module 6844 and peak detector 6846 may be implemented by correlation and protocol module 3920 . In one embodiment, peak detector 6846 is implemented as a 3-point parabolic peak interpolator on top of upsampled cross-correlation module 6844 . Two points near (within a given distance) to the detected peak are selected and a 3-point parabolic interpolation of the upsampled result is obtained.

At 6942, determine distance, position, round trip time, and/or other parameters based on the phase (or 3-point parabolic interpolation of the upsampled result). The distance may be the distance between the first network device and the second network device. The location may be of the second network device relative to the first network device. The round trip time is the time for the initiator signal to travel to the second network device and the first network device to receive the response signal, and the time for the second network device to generate the response signal after receiving the initiator signal. including.

At 6944, the processing module 3922 can determine whether a range extension type relay attack is occurring based on the phase, distance, location, round trip time, and/or other parameters determined at 6942. . If a range extension type relay attack is occurring, process 6946 is performed, otherwise the method may end at 6948 . At 6946, processing module 3922 performs a countermeasure such as any of the countermeasures disclosed herein.

The above processes of FIGS. 35, 36, 45, 54, and 63 are intended to be illustrative examples. The processes can be performed sequentially, synchronously, simultaneously, consecutively, during overlapping periods, or in different orders, depending on the application. Also, any process may not be performed or skipped depending on the implementation and/or order of events.

There is a variation in transmission timing between (i) the time the generated waveform reaches the antenna to be transmitted and (ii) the corresponding time measured by the timer. Factors that can contribute to this include clock domain crossings, clock period variations, power amplifier propagation delays due to power amplifier gain settings, temperature, and process propagation delays. Variations in process, temperature, and amplifier gain settings can be calibrated out from timing measurements.

A second BLE device (eg, BLE device (or radio) 3900B) that is similar or identical to the first BLE device (eg, BLE device (or radio) 3900A in FIG. 38) is shown in FIG. may be added or implemented in the vehicle to represent such reflective (or responder) devices. Each of the BLE radios 3900 may be implemented on a separate system-on-chip (SOC). A first BLE radio 3900A may transmit an initiator signal that may be received by a receiver portion of a second BLE device.

When the first bitstream is generated and/or provided to the protocol module 3924A of the first BLE radio 3900A to generate the initiator signal to be transmitted from the first BLE radio 3900A: A time T1 may be generated, determined by timer 3938A. Time T2, determined by timer 3938B, may be when the correlation and protocol module 3920B of the second BLE radio 3900B receives the first bitstream. A first calibration constant CAL1 is set equal to or equal to the difference between when timer 3938A detects generation of the first bitstream and when the corresponding initiator signal is transmitted from antenna 3907A. can be determined based on the difference. A second calibration constant CAL2 may be set equal to or determined based on the difference between when timer 3938B detects reception of the first bitstream at correlation and protocol module 3920B. The flight time of the first bitstream from protocol module 3924A to correlation and protocol module 3920B is (T2-CAL2)-(T1-CAL1).

同様の情報を収集し、較正値を追加する。

時間測定値から較正値を分離する。

Similarly, a second bitstream corresponding to the first bitstream is generated and/or provided to protocol module 3924B to generate a response signal to be transmitted from second BLE radio 3900B. About when, time T3 may be generated, as determined by timer 3938B. A response signal is generated in response to the initiator signal. Time T4, determined by timer 3938A, may be when correlation and protocol module 3920A receives the second bitstream. A third calibration constant CAL3 is set equal to or equal to the difference between when timer 3938B detects generation of the second bitstream and when the corresponding response signal is transmitted from antenna 3907B. can be determined based on the difference. A fourth calibration constant CAL4 may be set equal to or determined based on the difference between when timer 3938A detects reception of the second bitstream at correlation and protocol module 3920A. The flight time of the second bitstream from protocol module 3924B to correlation and protocol module 3920A is (T4-CAL4)-(T3-CAL3). The average flight time, distance between the first and second BLE radios 3900 can be determined using Equations 33-35, where Equation 33 is based on Equation 32 and is described. timing variations are taken into account and therefore contain corresponding calibration values.

Collect similar information and add calibration values.

Separate the calibration value from the time measurement.

A timer 3938B can be started with a processing agreement and/or fine-tuning the transmission time in the second BLE radio 3900B to minimize reporting for T2-T3.

PLLs 3940A, 3942A of first BLE radio 3900A may be implemented as a single PLL. Similarly, the PLLs 3940B, 3942B of the second radio 3900B may be implemented as a single PLL. The two PLLs allow for the capture of the initiator signal transmission time using the same BLE circuitry used to capture the response signal reception time, while hardware for the transmitter and receiver parts are on the same SoC. ware can be implemented.

According to the present teachings, a multi-axis polarized RF antenna assembly includes a circularly polarized antenna including a conductive ring-shaped body having an inner bore, a circular isolator connected to the conductive ring-shaped body, and a circularly polarized antenna. A linearly polarized antenna is connected to the circular isolator and extends outwardly from the circular isolator. A linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. A linearly polarized antenna extends perpendicular to the radius of a circularly polarized antenna.

According to the present teachings, a multi-axis polarized RF antenna can include conductive elements as wires.

In accordance with the present teachings, the sleeve can be formed of polytetrafluoroethene and the conductive elements can be formed of copper.

In accordance with the present teachings, a linearly polarized antenna can be configured to extend downwardly from a circularly polarized antenna when in use.

According to the present teachings, the circularly polarized antenna can be a dual axis antenna and the linearly polarized antenna can be a single axis antenna.

According to the present teachings, the multi-axis polarized RF antenna assembly can further include a ground layer, wherein the circular isolator is between the conductive element and the ground plane and between the circular polarized antenna and the ground plane. , can be placed on the ground plane.

In accordance with the present teachings, a circularly polarized antenna can include two feed points that are 90° phase offset and can be configured to receive signals that are 90° out of phase with each other.

According to the present teachings, a vehicle may include a body and a roof that includes a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly can be oriented at the roof such that the linearly polarized antenna extends downward from the circularly polarized antenna.

According to the present teachings, a vehicle may include a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly includes a first multi-axis polarized RF antenna assembly configured to be mounted on the vehicle and a second multi-axis polarized RF antenna assembly configured to be mounted on the vehicle and having a second bore. a second circularly polarized antenna comprising a conductive ring-shaped body of; a second circular isolator connected to the second conductive ring-shaped body; and a second circular isolator connected to the second circular isolator and a second multi-axis polarized RF antenna assembly including a second linearly polarized antenna extending outwardly from. The second linearly polarized antenna can include a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. The second linearly polarized antenna can extend orthogonally to the radius of the second circularly polarized antenna, and the access module includes the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly. It can be connected to the antenna assembly and configured to communicate with the portable access device via the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly.

According to the present teachings, at any time at least one of the linearly polarized antenna or the first multi-axis polarized RF antenna assembly is not cross-polarized with the antenna of the second multi-axis polarized RF antenna assembly.

According to the present teachings, an access module includes a passive entry passive module that transmits and receives radio frequency signals via a first one of the multi-axis polarized RF antenna assemblies and a second one of the multi-axis polarized RF antenna assemblies. It can be configured to perform a start action or a phone-as-a-key action.

According to the present teachings, the access module can be configured to grant access to the vehicle based on the radio frequency signal.

According to the present teachings, the access module is configured such that any antenna pair of the first one of the multi-axis polarized RF antenna assemblies and the second one of the multi-axis polarized RF antenna assemblies is used for communication with the portable access device. It can be configured to run an algorithm to determine which should be used.

According to the present teachings, the portable access device can be a key fob or cell phone.

In one embodiment, the phone as key system described herein uses the cell phone's BLE radio to microlocate the phone's position relative to a set of receiving sensors. A sensor is located in the vehicle. Sensors are used to detect whether the phone is close enough to the vehicle to allow access to the vehicle (eg, unlock the doors and/or start the vehicle). The vehicle access module uses the angle of arrival (AOA) principle. By knowing the angles of arrival of signals transmitted from the BLE radio to at least two separate sensors in the vehicle, the source (ie, the BLE radio) can be located on a two-dimensional plane. In this case, a phased antenna array is used to measure the angle of arrival of the incoming signal. A phased antenna array includes multiple antennas that receive transmitted signals. Each sensor on the vehicle includes one or more antennas. Each sensor has a three-antenna interleaved circular polarization (CP) receiver with a single radio receiver, a six-antenna interleaved linear polarization (LP) receiver with a single radio receiver, a single It may be a phased array sensor including a three-antenna interleaved CP receiver with one radio receiver and a three-antenna interleaved printed antenna CP receiver with a single radio receiver.

The access module detects the direction of the incoming AOA signal taking into account multipath effects. As an example, two sinusoidal RF signals transmitted to reach the sensor array are summed at the antenna of the sensor array. The sum of the two sinusoidal RF signals is a sinusoid with a different phase and amplitude depending on the phase angles and amplitudes of the two source sinusoids. Mathematical models used to predict AOA directions can exhibit errors. This error can be very large and unstable in a dynamic multipath environment. To prevent this error, the MUSIC algorithm disclosed herein can be used to identify source signals along with potentially strong multipath reflected signals. Direct path signals are accurately tracked from mobile phones. This tracking identifies any additional reflected signals. Reflected signals may be identified and discarded.

The access module and control module disclosed herein may implement any MUSIC algorithm referenced and/or disclosed herein. Direction finding methods can generally be divided into two categories, sometimes referred to as classical methods and modern methods. Classical methods include various beamforming methods. Modern methods are commonly called subspace methods. The MUSIC algorithm is classified as a super-resolution parameter estimation algorithm using subspace separation methods. The subspace method may require a specific array placement of two identical but physically shifted arrays. Other methods include maximum likelihood estimation and beamforming.

FIG. 70 shows a side view of multiple antennas 7000 in an array showing the angle of arrival θ. An array of antennas is sometimes called an array manifold. Each antenna 7000 may be configured the same and/or similar to any of the antennas disclosed herein. In one embodiment, the one or more antennas are quadrifilar helix antennas.

The MUSIC algorithm uses a model of the array manifold that describes the response of the array manifold to one or more incident AOA signals. A uniform linear array (ULA) of antennas can be defined as shown in FIG. 70, where m is the antenna index into the array starting at 1, M is the total number of antennas, and d is the distance between antenna elements. The interval, θ, is the angle of the incident signal. The response of an array element m to an incident signal s can be expressed in Equation 37, where r is the received signal, a is the complex array manifold response, s is the source signal, and m is the antenna of interest as stated. is the index number of the element, .theta. is the physical angle of the incident source signal as stated, .lambda. is the wavelength of the signal, and n(t) is the noise in the receiver channel. It shows the effect of phase delay as a function of the physical position of the elements of the receive sensor array, with d=λ/2 and a full 180° phase shift. Also shown is the phase shift as a function of angle of incidence θ.

The array steering vector a _m is defined by Equation 38 for a given source signal n at an angle of incidence θ _n at antenna element m for an antenna with 1≦m≦M. This assumes an amplitude response of 1 at each antenna and an ideal phase response of the ULA to antenna 1 .

For N incident signals, the received signal r(t) is the sum of the source signals through the array manifold and can be expressed in Equation 39.

In vector notation, the array manifold response parameters a and A are defined by equations 40 and 41. vector a describes the array response of each element to a single source signal n, A describes the response of all M array elements to all N source signals, is an M×N matrix, Here, M and N are each an integer of 2 or more. The N source signals sampled at time instants t are represented as N×1 vectors S(t), as represented by Equation 42.

アレイマニホールドモデルのこの数学的構造は、ＭＵＳＩＣアルゴリズムを導出するために使用され、テスト環境のシミュレーションとモデリングにも使用され得る。 Through the antenna array response manifold model A for a received (measured) data vector r(t) containing channel noise n(t), various source angles of arrival represented in the signal S(t) at a given time t 43 may be used to map the N source tones, where r(t) is the M×1 vector of data received at each antenna element.

This mathematical structure of the array manifold model is used to derive the MUSIC algorithm and can also be used to simulate and model the test environment.

FIG. 71 shows an exemplary AOA method involving use of the MUSIC algorithm. Although the processing is primarily described as being performed by a vehicle's access module, such as one of the access modules disclosed herein, the processing may also be performed by the portable access device's control module. good. Note that the H operator indicates a Hermitian transpose or a conjugate transpose operation. The method may begin at 7400. At 7402, the access module collects T analysis signal samples from each antenna simultaneously, as denoted by {r(t)} ^T _t=1 .

At 7404, the access module estimates the data covariance matrix R, as expressed in Equation 44.

The covariance matrix estimate is calculated according to Equation 44 and an example covariance is shown in FIG. For interpretation purposes, each arrow represents the covariance between the antenna numbers listed on the X and Y axes at the base of the arrow. The middle top arrow represents the covariance of antenna number 1 with respect to antenna number 2 (c ₁₂ ), while the middle left arrow represents the covariance of antenna number 2 with respect to antenna number 1 (c ₂₁ ), which is c ₁₂ complex conjugates. The direction of the arrow is the complex plane representation of magnitude and direction (the X axis is the real axis and the Y axis is the imaginary axis).

Note that the diagonal line (top left to bottom right) represents the autocovariance, which has a magnitude of 1 and an imaginary value of zero. Also note that the matrix is Hermitian, meaning c _ij =c ^* for all i and j, where * is the complex conjugate. Thus, all useful information is either (i) c ₁₂ , c ₂₃ , and c ₁₃ , or (ii) c ₂₁ , c ₃₂ , and c ₃₁ (upper right corner or lower left corner). This can be expected to save data storage and reduce transmission size.

At 7406, the access module uses singular value decomposition (SVD) or another eigenvalue decomposition technique to compute the M×M matrix U as expressed in Equation 45.

After eigenvalue decomposition of the covariance matrix estimate R, the resulting complex eigenvectors are provided, an example of which is shown in FIG. FIG. 73 shows visualization of eigenvectors by array manifold response at 35°. FIG. 74 shows visualization of the eigenvectors by the array manifold response at 0°.

As shown in FIG. 72, the arrow magnitude and direction indicate the real and imaginary components of each point corresponding to the real number on the X-axis and the imaginary number on the Y-axis. Solid and short dashed arrows represent a 3×3 array of eigenvectors. The vector columns (X-axis) are sorted by the eigenvalues of the eigenvectors, from largest (left) to smallest (right). Thus, the leftmost column number 1 represents the signal subspace, while columns 2 and 3 represent the noise subspace.

At 7408, the access module estimates or otherwise determines the number of incident signals N. At 7410, the access module separates the matrix U into an M×N signal subspace matrix U _s and a noise subspace estimate M×(MN) matrix U _e to satisfy Equation 46.

The response of the array manifold at the angle of interest (35°) is shown by the long dashed arrows, along with the eigenvalue vectors. This is derived from Equation 40.

At 7412, the access module computes the MUSIC spectrum P(θ) for the θ range of interest at a given resolution, as expressed in Equation 47.

At this point, the noise subspace eigenvectors of the covariance matrix estimate should be perfectly orthogonal to the array manifold response. The denominator result of Equation 47 is a small number compared to the results at various test angles θ.

Figure 74 presents the same information as Figure 73, except that the array manifold response is shown at 0° AOA. Note that the eigenvalue vector remains the same as it is derived from the measured data. The array manifold response is rotated and shows the expected response for a directly incident signal, implying no phase shift at the antenna elements. In this case, the denominator result of Equation 47 is much larger than that obtained in the case of FIG.

At 7414, the access module performs a peak search on P(θ) to determine the angle of arrival. The value of θ at the maximum value of P(θ) is the angle of arrival of the N incident signals.

After processing Equation 47 for θ over the range −90° to +90°, the resulting MUSIC power spectrum P(θ) is shown in FIG. 76 for the 35° source signal AOA. Note the distinct peak at the test AOA at 35°. The actual angle is indicated by the vertical dashed line. The resolution of θ is 1°.

A covariance smoothing method may be used. As an example, a forward-backward method can be used. The forward-backward approach is implemented using Equations 48 and 49, where R is the modified covariance matrix estimate and J is the M×M inverse identity matrix (transfer matrix). .

The effective number of resolvable coherent tones is N≤2M/3 sources. For a three-antenna array, up to two coherent tones can be resolved. This method can be used for a 3-antenna phased array of phased antenna array receiver boards. The method may end at 7416.

As another example, spatial smoothing methods may be used. Spatial smoothing is a technique that involves dividing the array into multiple subarrays and averaging the results of the covariance matrices of the subarrays. As a result, the number of antenna array elements is effectively reduced.

A forward-backward spatial smoothing (FBSS) method, which combines spatial smoothing with a forward-backward approach, may be used. It also reduces the number of antenna elements required. As yet another example, the Toeplitz completion method may be used and is suitable for NLA.

Variations of the MUSIC algorithm may be implemented. A derivative of the MUSIC algorithm called Root-MUSIC can be used for the ULA to find the incident signal AOA without having to calculate results at all potential angles. This reduces the computational power required. The reduced computational complexity results from not having to perform the MUSIC algorithm operations 7412, 7414, including computing the MUSIC spectrum over a large set of θ values and finding the resulting peaks.

Another derivative, called Spectral-MUSIC, is a generalized version of Root-MUSIC that applies to any array arrangement but is generally applied to wideband non-coherent sources. Yet another derivative called Smooth-MUSIC refers to various methods of smoothing the covariance matrix of the MUSIC algorithm and is applied between operations 7404 and 7406 in FIG.

Another derivative, called the CLEAN method, involves reconstructing a model of the source signal from the known array manifold once the source signal is identified in a given direction. This reconstructed signal model is subtracted from the measured incident signal to remove the incident signal, thereby "cleaning" the measured data of unwanted source signals and allowing consideration of other sources. .

One problem that arises when implementing the MUSIC algorithm on non-ideal antenna arrays is that in forward-backward covariance smoothing, two coherent sources can lead to erroneous position measurements. . Standard array calibration techniques do not solve this, as the covariance matrix itself leads to false subspace separation. To combat this, a variation of the CLEAN method was performed for multiple coherent sources, which uses the MUSIC algorithm to identify the source signals, uses a calibrated array manifold to identify the source signals. Using the CLEAN method to remove one at a time, forcing the position of the source signal to be offset (instead of the position it was originally measured from) and recalculating the AOA directions for the remaining signals. , repeating operations 7404 and 7406 of FIG. 71 to verify convergence to a new set of incident angles of arrival if they are not the same as the original angles of arrival, and, optionally, operation 7402 of FIG. including replacing with a priori knowledge from . For example, while tracking the position of the source signal, it can be assumed that the AOA does not change significantly between subsequent readings.

FIG. 76 shows antenna selection system 7600 including antenna 7602, switch 7604, and radio receiver 7606. FIG. Radio receiver 7606 selects one of the antennas to receive the signal via switch 7604 . Antenna selection system 7600 may be implemented in any of the systems disclosed herein. In one embodiment, antenna selection system 7600 is implemented in a vehicle and an access module disclosed herein controls operation of radio receiver 7606 .

Antenna selection system 7600 is implemented in a PAK AOA system to achieve BLE AOA data reception. Some of the BLE radio packets received by one of the antennas 7602 contain CW tones. The radio receiver 7606 samples the CW tone and provides quadrature analytic signals, meaning two sine waves with a phase difference of 90°, called in-phase and quadrature signals (I and Q signals). . The I and Q signals are sampled simultaneously and combined to form a complex analysis sample r, where r=iI+Q, i is an imaginary constant and i=√2. The received data is therefore sliced into interleaved samples from each of the antennas over multiple iterations.

FIG. 77 shows an exemplary reconstruction method for reconstructing IQ data. The interleaved data are interpolated to form the received data matrix r(t) for use in the MUSIC algorithm. The reconfiguration method can be performed by any of the access modules disclosed herein. A signal reconstruction method may start at 7700 .

At 7702, the access module converts the analysis IQ sample vector r to a phase angle vector Φ using the arctangent function. At 7704, the access module creates a time vector t corresponding to the sample vector r based on the data sampling rate.

At 7706, the access module discards samples acquired near the antenna switching time. At 7708, the access module unwraps each repeated portion of the data points with a step size of π. At 7710, the access module measures the average slope. This is the average frequency of the sine wave.

At 7712, for each antenna, the access module a) locates the intercept of the first iteration of the sampled data, b) predicts the location of the next iteration of the sampled data, and c) the expected location. d) adding or subtracting 2π; e) repeating determining the average difference and adding or subtracting 2π until the average difference is less than π; Repeat processes c and d, f) find the average slope of all already aligned points, and g) use the new slope for the next signal iteration and repeat processes bg.

At 7714, the access module measures the standard deviation of the average slope for each antenna.

At 7716, the access module checks which antennas may be misaligned by selecting antenna i based on Equation 50 if the standard deviation exceeds the threshold do.

At 7718, the access module repeats processes 7712-7718 for the antenna selected at 7716 until the low standard deviation or maximum retry counter expires.

At 7720, for each antenna m, the access module interpolates a straight line of points on the original time vector t to obtain the reconstructed phase angle vector Φ _m . This can be based on the phase angle vector Φ determined at 7702 .

At 7722, the access module recreates the IQ sample vector r _m for each antenna m using Equation 51, where g is the average magnitude of a valid subset of the original sample vector r. Following operation 7722, the method may end at 7724.

In one embodiment, the above method is implemented in a vehicle access system and/or PAK system with circularly polarized antennas disclosed herein. The signal is received with a circularly polarized antenna. The IQ data is determined based on the received signal and the angle of arrival is determined using the MUSIC algorithm, as described above.

78A-C show example placements of sensors 7802 that may be implemented as part of any PAK system disclosed herein and connected to any access module disclosed herein. A vehicle 7800 is shown. FIG. 78C shows an example of bounce returns and corresponding paths of signals transmitted from a key fob 7804 or other portable access device and detected by sensor 7802. FIG. In this example, sensor 7802 is located high and centrally on vehicle 7800 . Sensor 7802 may be located, for example, in headliner 7803 of vehicle 7800 . The sensor 7802 is arranged to cause multiple bounce paths of the transmitted signal before being received at the sensor 7802 . Key fob 7804 is shown low relative to the vehicle for purposes of illustration, but may be positioned higher.

79A-C show a vehicle 7900 showing another example placement of sensors 7902. FIG. FIG. 79C shows an example of bounce returns and corresponding paths for signals transmitted from a key fob 7904 or other portable access device and detected by sensor 7902. FIG. In this example, sensor 7902 is located low and centrally on vehicle 7900 . The sensor 7902 can be located on the floor 7903 or center console 7905 of the vehicle. The sensor 7902 is arranged to cause multiple bounce paths of the transmitted signal before being received at the sensor 7902 . Key fob 7904 is shown low relative to the vehicle for purposes of illustration, but may be positioned higher.

The sensors 7802, 7902 may be located within the metal structure of the vehicle with few possible direct paths from the vehicle (i.e., there is unlikely to be a line of sight between the key fob 7804, 7904 and the sensors 7802, 7902). ). A floor can include at least a portion of a metal structure, such as a frame, a metal housing, a partially enclosed metal structure, a unibody structure, etc., which is at least partially defined by dashed line 7903. can be represented. Although a single sensor is shown in each of Figures 78A-C, 79A-C, more than one sensor may be included on each vehicle. In one embodiment, each sensor includes two or more antennas, such as two or more antennas disclosed and/or referenced herein. In one embodiment, two sensors are included and each sensor includes two antennas such that there are four antenna paths. In another embodiment, a single sensor is included and the sensor includes three or more antennas. Although there may not be a direct line of sight between the key fob and the sensor, there are a few to many signal paths between the key fob and the sensor, so a short consistent distance between the key fob and the vehicle is It can be determined using the techniques disclosed herein. Distance information is used to determine whether to allow access to the vehicle.

In one embodiment, carrier phase-based ranging, such as using the MUSIC algorithm, is implemented to determine the angle of arrival of signals transmitted by the key fobs 7804,7904. This can include eigenvalue decomposition. The distance between the key fob 7804, 7904 and the vehicle 7800, 790 is determined based on the angle of arrival. If the key fob 7804,7904 is within a predetermined distance of the vehicle 7800,7900, access is granted. Although line-of-sight is unlikely, it is likely that the transmitted signal will bounce multiple times and take multiple paths to each sensor 7802,7902. This allows the corresponding access module to determine whether the key fob 7804,7904 is close to the vehicle 7800,7900. In addition to carrier phase based ranging, multipath signal processing is performed. This may include, for example, time-of-flight signal processing as described above with respect to FIGS. As an example, the access module of the vehicle 7800, 7900 may unlock the doors of the vehicle 7800, 7900 when the key fob 7804, 7904 is within a predetermined distance of the vehicle 7800, 7900.

Ranging in the indirect reflection path by forcing an indirect signaling path, exchanging a given number of tones transmitted in close proximity, and finding the eigenvalue, using BLE carrier phase-based ranging can be run as A system with a small number of sensors (called anchors) can be used by arranging the anchors so that the signals follow predominantly indirect paths rather than direct line-of-sight paths.

In one embodiment, the RSSI of the transmitted signal is determined to determine whether the key fob 7804,7904 is inside or outside the vehicle 7800,7900. If the key fob 7804,7904 is outside the vehicle, carrier phase based ranging, including eigenvalue decomposition, is performed to determine if the key fob 7804,7904 is within a predetermined distance of the vehicle 7800,7900.

The foregoing description is merely exemplary in nature and is in no way intended to limit the disclosure, its application, or uses. The broad teachings of this disclosure can be embodied in various forms. Thus, while the disclosure includes specific examples, the true scope of the disclosure is not so limited, as other modifications will become apparent upon examination of the drawings, specification, and appended claims. shouldn't. It should be understood that one or more steps in a method may be performed in a different order (or concurrently) without changing the principles of the disclosure. Furthermore, although each embodiment is described above as having particular features, any one or more of these features described with respect to any embodiment of the present disclosure may be used in any other Embodiments can be implemented and/or combined with features of any other embodiment, even if the combination is not explicitly recited. In other words, the described embodiments are not mutually exclusive, and permutation of one or more embodiments remains within the scope of the present disclosure.

Spatial and functional relationships between elements (e.g., between modules, between circuit elements, between semiconductor layers, etc.) are defined as "connected," "engaged," "coupled," "adjacent," "next to." Various terms are used to describe, including on, on, on, above, below, and located on. When the relationship between the first and second elements is described in the disclosure above, unless it is expressly stated that the relationship is "direct," the relationship includes no other intervening elements between the first and second elements. It may be a direct relationship in which there is no intervening relationship, but it may also be an indirect relationship in which there is one or more intervening elements (either spatially or functionally) between the first and second elements. As used herein, phrases with at least one of A, B, and C should be taken to mean logic (A or B or C) using non-exclusive OR. and should not be construed to mean "at least one of A, at least one of B, and at least one of C."

In the figures, the direction of arrows, indicated by arrowheads, generally indicates the flow of information (such as data or instructions) that is important to the figure. For example, elements A and B exchange various information, and an arrow may point from element A to element B if the information sent from element A to element B is relevant to the diagram. This one-way arrow does not mean that no other information is sent from element B to element A; Further, for information sent from element A to element B, element B may send element A a request for information or an acknowledgment of receipt of the information.

In this application, including the definitions below, the term "module" or the term "controller" may be replaced with the term "circuit." The term "module" includes application specific integrated circuits (ASICs), digital, analog, or mixed analog/digital discrete circuits, digital, analog, or mixed analog/digital integrated circuits, combinational logic circuits, field programmable gate arrays (FPGAs). ), processor circuitry (shared, dedicated, or grouped) that executes the code, memory circuitry (shared, dedicated, or grouped) that stores the code executed by the processor circuitry, or other suitable hardware that provides the described functionality. may refer to, be part of, or include a hardware component, or a combination of any or all of the above, such as in a system-on-chip.

A module may include one or more interface circuits. In some examples, the interface circuitry may include wired or wireless interfaces that connect to a local area network (LAN), the Internet, a wide area network (WAN), or combinations thereof. The functionality of any given module of the present disclosure may be distributed among multiple modules connected via interface circuits. For example, multiple modules may enable load sharing. In a further example, a server (also known as remote or cloud) module may perform some functions on behalf of a client module.

The term code, as used above, may include software, firmware, and/or microcode, and may refer to programs, routines, functions, classes, data structures, and/or objects. The term shared processor circuit encompasses a single processor circuit executing some or all code from multiple modules. The term group processor circuit encompasses processor circuits that execute some or all of the code from one or more modules in combination with additional processor circuits. References to multiple processor circuits include multiple processor circuits on separate dies, multiple processor circuits on a single die, multiple cores in a single processor circuit, multiple threads in a single processor circuit, or combinations thereof. The term shared memory circuit encompasses a single memory circuit that stores some or all code from multiple modules. The term group memory circuit encompasses memory circuits that store some or all of the code from one or more modules in combination with additional memory.

The term memory circuit is a subset of the term computer-readable medium. The term computer-readable medium as used herein does not include transitory electrical or electromagnetic signals propagating through a medium (such as on a carrier wave). As such, the term computer-readable medium can be considered tangible and non-transitory. Non-limiting examples of non-transitory, tangible computer readable media include non-volatile memory circuits (such as flash memory circuits, erasable programmable read-only memory circuits, or masked read-only memory circuits); ), magnetic storage media (such as analog or digital magnetic tape or hard disk drives), and optical storage media (such as CDs, DVDs, or Blu-ray discs).

The apparatus and methods described in this application may be partially or wholly implemented by a special purpose computer created by configuring a general purpose computer to perform one or more of the specified functions embodied in the computer program. can be implemented. The functional blocks, flowchart elements, and other elements described above serve as software specifications and can be translated into computer programs by the routine practice of a skilled technician or programmer.

A computer program comprises processor-executable instructions stored on at least one non-transitory, tangible computer-readable medium. Computer programs may also include or rely on stored data. A computer program may include a basic input/output system (BIOS) that interacts with the hardware of the dedicated computer, device drivers that interact with specific devices of the dedicated computer, one or more operating systems, user applications, background services, background Applications and the like may also be included.

A computer program may contain (i) parsed descriptive text such as HTML (Hypertext Markup Language), XML (Extensible Markup Language), or JSON (Javascript Object Notation), (ii) assembly code, (iii) ) object code generated from source code by a compiler; (iv) source code for execution by an interpreter; (v) source code for compilation and execution by a just-in-time compiler; By way of example only, source code may be written in C, C++, C#, Objective-C, Swift, Haskell, Go, SQL, R, Lisp, Java®, Fortran, Perl, Pascal, Curl, OCaml, Javascript®. trademark), HTML5 (Hypertext Markup Language 5th Revision), Ada, ASP (Active Server Pages), PHP (Hypertext Preprocessor), Scala, Eiffel, Smalltalk, Erlang, Ruby, Flash (registered trademark), VisualBasic ( It can be written using the syntax of languages including TM, Lua, MATLAB, SIMULINK, and Python.

Any element recited in a claim may be identified by the phrase "a means for" or, in the case of a method claim, "a process for" or "a step for". is not intended to be a means-plus-function element within the meaning of 35 U.S.C. §112(f) unless explicitly stated using the phrase .

Claims (19)

A vehicle access system comprising:
a plurality of antennas each configured to receive a signal transmitted from the portable access device to the vehicle;
downconverting received signals to produce in-phase and quadrature signals; performing a MUSIC algorithm to determine angles of arrival of received signals received at multiple antennas; an access module configured to determine the distance between the device and the vehicle and to grant access to the vehicle based on the distance ;
The plurality of antennas includes circularly polarized antennas and linearly polarized antennas,
A linearly polarized antenna is an access system that extends perpendicular to the radius of a circularly polarized antenna . multiple antennas
a circularly polarized antenna including a conductive ring-shaped body having an inner bore;
a circular isolator connected to a conductive ring-shaped body;
a linearly polarized antenna connected to the circularly polarized antenna and the circular isolator and extending outwardly from the circular isolator;
A linearly polarized antenna is
a sleeve;
a conductive element extending through the sleeve;
2. The access system of claim 1, wherein the linearly polarized antenna extends orthogonally to the radius of the circularly polarized antenna. The access module, while executing the MUSIC algorithm, collects analytical signal samples of the signal received at each of the multiple antennas to generate a received data matrix and estimates a data covariance matrix based on the received data matrix. and using an eigenvalue decomposition process to determine an M×M matrix based on the covariance matrix, where M is an integer greater than or equal to 2, determine the number of incident signals, and divide the M×M matrix into multiple , calculate a MUSIC spectrum based on one of the plurality of matrices, and perform a peak search of the MUSIC spectrum to determine the angle of arrival. access system. The access module is configured to perform a covariance smoothing method to generate a modified covariance matrix and use an eigenvalue decomposition process to determine an M×M matrix based on the modified covariance matrix. 4. The access system of claim 3, wherein: The access module converts the in-phase and quadrature sample vectors to phase angle vectors while generating the receive data matrix, and recreates the in-phase and quadrature phases for each of the plurality of antennas based on the phase angle vectors. 4. The access system of claim 3, configured to generate a sample vector and to generate a received data matrix based on the recreated in-phase and quadrature sample vectors for each of a plurality of antennas. The access module creates a time vector corresponding to the in-phase and quadrature sample vectors, discards some analytic signal samples acquired around the antenna switching time, and repeats each repeating portion of the remaining samples with a step size of π. Unwrap, average the frequencies of the sinusoids of the remaining samples, determine the average slope of the remaining samples, measure the standard deviation of the average slope, and based on the measured standard deviation, determine which of the multiple antennas is aligned. and, for each of the plurality of antennas, interpolating a straight line of points on the time vector to produce a reconstructed phase angle vector. access system. The access module checks which one of the plurality of antennas has incorrect alignment if the standard deviation is greater than a predetermined threshold, and calculates the standard deviation of the average slope for that one of the plurality of antennas. 7. The access system of claim 6, configured to remeasure. The access module removes the source signals one at a time using a calibrated array manifold containing multiple antennas, and forces the position of the source signals to offset positions to remove the remaining signals. 2. The access system of claim 1, wherein the access system is configured to perform a clean method comprising performing an iterative process comprising recalculating the direction-of-arrival angle of . The access system of claim 1;
body and
a roof, center console, floor, or at least partially enclosed metal structure;
A vehicle in which the plurality of antennas are mounted to at least one of the roof, center console, floor, or at least partially enclosed metal structure. 10. The vehicle of claim 9, wherein the plurality of antennas includes multi-axis polarized RF antenna assemblies, the multi-axis polarized RF antenna assemblies including circularly polarized antennas oriented at the roof. Receiving a signal transmitted from the portable access device to the vehicle at each of a plurality of antennas comprising a circularly polarized antenna and a linearly polarized antenna , wherein the linearly polarized antenna is within the radius of the circularly polarized antenna. extending perpendicularly,
downconverting the received signal to produce an in-phase signal and a quadrature-phase signal;
executing the MUSIC algorithm to determine the angles of arrival of received signals received at multiple antennas;
determining the distance between the portable access device and the vehicle based on the angle of arrival; and
authorizing access to a vehicle based on distance. Running the MUSIC algorithm is
collecting analytical signal samples of signals received at each of a plurality of antennas to generate a received data matrix;
estimating a data covariance matrix based on the received data matrix;
determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to 2;
determining the number of incident signals;
dividing the M×M matrix into multiple matrices;
calculating a MUSIC spectrum based on one of a plurality of matrices; and
12. The method of claim 11, comprising performing a peak search of the MUSIC spectrum to determine the angle of arrival. performing a covariance smoothing method to generate a modified covariance matrix; and
13. The method of claim 12, further comprising determining an MxM matrix based on the modified covariance matrix using an eigenvalue decomposition process. converting the in-phase and quadrature sample vectors to phase angle vectors while generating the receive data matrix;
generating in-phase and quadrature sample vectors that are recreated for each of the plurality of antennas based on the phase angle vectors; and
13. The method of claim 12, further comprising generating a received data matrix based on recreated in-phase and quadrature sample vectors for each of the plurality of antennas. creating time vectors corresponding to the in-phase and quadrature sample vectors;
discarding some analytical signal samples acquired around the antenna switching time;
unwrapping each repeated portion of the remaining samples with a step size of π;
averaging the frequencies of the sinusoids of the remaining samples;
determining the average slope of the remaining samples;
measuring the standard deviation of the average slope;
determining which of the plurality of antennas are misaligned based on the measured standard deviation; and
13. The method of claim 12, further comprising, for each of the plurality of antennas, interpolating a straight line of points on the time vector to generate a reconstructed phase angle vector. checking which one of the plurality of antennas has incorrect alignment if the standard deviation is greater than a predetermined threshold; and
16. The method of claim 15, further comprising re-measuring the standard deviation of the mean slope for that one of the plurality of antennas. Using a calibrated array manifold containing multiple antennas to remove source signals one at a time and forcing the position of the source signal to be an offset position and the direction of arrival of the remaining signals performing an iterative process including recalculating the angles of , and performing a clean method including converging to a new set of incident arrival angles while performing the iterative process. 12. The method of claim 11, comprising: A vehicle comprises (i) a body and (ii) a roof, center console, floor, or at least partially enclosed metal structure;
12. The method of claim 11, wherein the multiple antennas are mounted to at least one of a roof, center console, floor, or at least partially enclosed metal structure. the plurality of antennas includes a multi-axis polarized RF antenna assembly;
19. The method of claim 18 , wherein the multi-axis polarized RF antenna assembly comprises a circularly polarized antenna and is oriented at the roof.

Images