WO2016063717A1

WO2016063717A1 - Keyless entry device

Info

Publication number: WO2016063717A1
Application number: PCT/JP2015/078286
Authority: WO
Inventors: 宮澤　明
Original assignee: アルプス電気株式会社
Priority date: 2014-10-22
Filing date: 2015-10-06
Publication date: 2016-04-28

Abstract

[Problem] To provide a keyless entry device that has excellent communication speed and that can prevent a relay attack with a simple configuration. [Solution] A vehicle-side device 10 has a vehicle-side transmitter 11 that transmits a request signal, a vehicle-side receiver 12 that receives an answer signal, a vehicle-side control unit 15, and a vehicle-side electronic oscillator 16. A mobile unit 20 has a mobile unit-side receiver 22 that receives the request signal, a mobile unit-side transmitter that transmits the answer signal, and a mobile unit-side control unit 25. The vehicle-side electronic oscillator 16 can vary the carrier frequency of a carrier signal, and the request signal contains a plurality of frames each having a different carrier frequency. The mobile unit-side control unit 15 measures the reception strength of each frame and causes the mobile unit-side transmitter 21 to transmit the answer signal containing information based on the measured reception strength. The vehicle-side control unit 25 determines whether to perform the prescribed control with respect to the vehicle on the basis of the answer signal.

Description

Keyless entry device

The present invention relates to a keyless entry device that locks or unlocks a vehicle door by performing wireless communication between a vehicle-side device and a portable device, and more particularly, a keyless entry device that can prevent a relay attack with a simple configuration. About.

In moving vehicles such as automobiles, door locks are provided on the doors of automobiles to prevent them from being stolen when the automobile is not in use, or from being damaged by internal devices. ing. Conventionally, the door lock is locked or unlocked by inserting a key for starting the engine into a key hole provided in the door. However, from the viewpoint of convenience, the key is inserted into the key hole. If the user operates the request switch of the portable device, a request signal is transmitted from the vehicle-side device, and then an answer signal is transmitted from the portable device to the vehicle-side device, so that the door lock is unlocked / locked. A keyless entry device is used. Furthermore, in recent years, a so-called passive keyless entry device that automatically unlocks and locks the door lock by touching the vehicle with the hand while holding the portable device without operating the switch of the portable device. Is used.

The operation of the passive keyless entry device includes an activation signal transmitted from the vehicle-side device when a person holding a portable device already registered in the vehicle-side device mounted on the vehicle is approaching the vehicle. After receiving the request signal which is a low frequency signal (LF), the portable device responds and transmits an answer signal which is a high frequency signal (RF) including a command signal. And if a vehicle side apparatus receives the answer signal, it will control the to-be-controlled device according to the command signal contained in an answer signal. The control is, for example, unlocking the door of the automobile or starting the engine of the automobile, so that the driver can drive the automobile.

As described above, in the wireless communication in the passive keyless entry device, an LF signal (several hundred KHz) with a narrow communication range is transmitted from the vehicle, while an RF signal (several hundred MHz) with a wide communication range is transmitted from the portable device. Is done. The LF signal reaches only within a range of several meters from the vehicle, while the RF signal reaches a range of tens to hundreds of meters from the portable device.

In passive keyless entry devices, there is concern that a relay attack using a repeater may be performed that exploits the mechanism. The relay attack prepares two unauthorized repeaters, and one repeater is arranged in the vicinity of the vehicle and receives a request signal from the vehicle. Based on this request signal, a false request signal is transmitted from the other repeater placed at an isolated position among the two repeaters, and an answer signal is transmitted to the vehicle from the portable device that has received the request signal. The vehicle receives this and the vehicle door is unlocked where the vehicle owner does not intend.

In order to detect and prevent such relay attacks, various methods have been considered. As a passive keyless entry device corresponding to the relay attack, for example, there is a wireless key system 900 described in Patent Document 1. The configuration of the wireless key system 900 is shown in FIG.

In the wireless key system 900, the transmission / reception frequency between the in-vehicle wireless device 902 and the wireless key 903 is notified by both messages, and dynamically changed and transmitted. The in-vehicle wireless device 902 compares the RSSI value in each transmission / reception frequency signal with the threshold value, and if the RSSI value of the message in all transmission / reception frequency signals exceeds the threshold value, the relay amplifier 905 disguises the RSSI value. If the user 904 enters the vehicle vicinity area 907, the vehicle 901 is prepared for boarding, such as unlocking the door of the vehicle 901.

In the wireless key system 900, transmission / reception is performed while dynamically changing the frequency used for communication for each communication from among a plurality of frequencies by notifying the frequency to be changed by a message between the wireless key and the wireless device of the vehicle. Do. Therefore, in order to perform relay attack, the telegram is temporarily decoded at the time of relay amplification, the contents are analyzed and the changed frequency is grasped, and the frequency band in which the relay amplifier can be amplified is switched according to the changed frequency. A configuration or a configuration capable of relaying and amplifying the entire frequency band that can be transmitted and received by the wireless key or the wireless device of the vehicle is required.

Therefore, the configuration for performing the relay attack becomes very complicated, and it becomes difficult to perform the relay attack.

JP 2008-240315 A

However, in the wireless key system 900 described in Patent Document 1, before the transmission / reception between the in-vehicle wireless device 902 and the wireless key 903 for distance measurement is performed, notification that the transmission / reception frequency is changed is notified. is required. As a result, the wireless key system 900 has a problem that the communication time becomes long and the communication speed becomes slow.

The present invention has been made in view of such a technical background, and an object of the present invention is to provide a keyless entry device that is excellent in communication speed and can prevent a relay attack with a simple configuration.

In order to solve this problem, a keyless entry device of the present invention includes a vehicle-side device that transmits a request signal, and a portable device that transmits an answer signal corresponding to the request signal when the request signal is received. A keyless entry device, wherein the vehicle-side device includes a first resonance circuit, a vehicle-side transmission unit that transmits the request signal via the first resonance circuit, and a vehicle-side reception that receives the answer signal. A vehicle-side control unit that performs a predetermined in-vehicle control, and a vehicle-side oscillation circuit that generates a carrier signal for the request signal, and the portable device includes a second resonance circuit, and A portable device-side receiver that receives the request signal via a second resonance circuit; a portable device-side transmitter that transmits the answer signal; and the answer signal And the vehicle-side oscillation circuit can change the carrier frequency of the carrier signal, and the request signal includes a plurality of frames having different carrier frequencies. The portable device side control unit measures the reception strength for each of the plurality of frames, causes the portable device side transmission unit to transmit the answer signal including information based on the measured reception strength, and performs the vehicle side control. The unit has a feature of determining whether to perform predetermined control on the vehicle based on the answer signal.

Since the keyless entry device configured as described above includes a plurality of frames having different carrier frequencies in the request signal, it transmits or receives a signal having a carrier frequency different from the resonance frequency of the first resonance circuit or the second resonance circuit. As a result, the transmission / reception strength decreases due to the carrier frequency being out of the resonance frequency. Therefore, when transmission / reception is repeated by the relay attack, a difference in reception intensity between the frames appears more greatly. As a result, it can be easily determined that the relay attack is going to be performed. In addition, since it is not necessary to notify the portable device of changes in the carrier frequency in advance, the communication time can be shortened. Therefore, it is possible to provide a keyless entry device that is excellent in communication speed and can prevent a relay attack with a simple configuration.

In the above configuration, the first resonance circuit and / or the second resonance circuit have a resonance frequency equal to any one of the different carrier frequencies.

The keyless entry device thus configured has the same resonance frequency of the first resonance circuit and / or the second resonance circuit as one of the different carrier frequencies, and this frequency is used as a reference so that other different carrier waves can be used. When comparing the difference in reception intensity with a frequency signal, the reference level can be set in a region where the reception intensity is high, so that it is possible to detect fraud even if the signal is far away.

Further, in the above configuration, the plurality of frames include a distance measurement frame and an illegal relay determination frame having different carrier frequencies, and the illegal relay determination frame of the distance measurement frame has a transmission strength with respect to the transmission strength of the distance measurement frame. When the ratio of the reception intensity is smaller than a predetermined threshold value, it is determined that the ratio is incorrect and it is determined that predetermined control for the vehicle is not performed.

Since the keyless entry device configured in this way only needs to obtain the ratio of the reception strength in the fraud relay determination frame to the distance measurement frame in the request signal, it is possible to determine whether the fraud is simple or not. Become.

In the above configuration, the first resonance circuit and the second resonance circuit can each change a resonance frequency, and at least one of the vehicle-side transmission unit and the portable device-side reception unit is The resonance frequency is changed according to the carrier frequency.

In the keyless entry device configured as described above, since at least one of the vehicle-side transmitter and the portable device-side receiver has a resonance frequency that matches the reference carrier frequency, other different carrier frequencies The difference in the received intensity with the signal can be compared in a region where the received intensity is higher. For this reason, it is possible to detect fraud with a higher probability even for signals that are far away. Moreover, since the SN ratio of the transmission signal from the vehicle side transmission unit or the reception signal of the portable device side reception unit is also increased, the determination accuracy is increased.

Since the keyless entry device of the present invention includes a plurality of frames having different carrier frequencies in the request signal, a signal having a carrier frequency different from the resonance frequency of the first resonance circuit or the second resonance circuit is transmitted or received. The transmission / reception strength decreases due to the carrier frequency deviating from the resonance frequency. Therefore, when transmission / reception is repeated by the relay attack, a difference in reception intensity between the frames appears more greatly. As a result, it can be easily determined that the relay attack is going to be performed. In addition, since it is not necessary to notify the portable device of changes in the carrier frequency in advance, the communication time can be shortened. Therefore, it is possible to provide a keyless entry device that is excellent in communication speed and can prevent a relay attack with a simple configuration.

It is a top view which shows schematic structure of a keyless entry apparatus. It is a block diagram which shows the structure of each principal part of a vehicle side apparatus and a portable device. It is a block diagram when a relay attack is performed. It is a figure which shows the structure of LF transmission format of a request signal. It is a circuit diagram of the 1st resonance circuit and the 2nd resonance circuit. It is a graph which shows each antenna impedance of transmission and reception. It is a graph which shows the change of transmission intensity and reception intensity. It is a circuit diagram of the 1st resonance circuit and the 2nd resonance circuit which can change a resonance frequency. It is a graph which shows each antenna impedance of transmission and reception. It is a graph which shows the change of transmission intensity and reception intensity. It is a block diagram which shows the structure of the wireless key system which concerns on a prior art example.

[First Embodiment]
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings.

First, a schematic configuration of the keyless entry device 100 will be described with reference to FIG. Moreover, the structure of each principal part of the vehicle side apparatus 10 and the portable device 20 and its function are demonstrated using FIG.

FIG. 1 is a diagram showing a schematic configuration of the keyless entry device 100, and is a plan view when a vehicle user 55 having the vehicle-side device 10 and the portable device 20 are viewed from above.

The vehicle-side device 10 is mounted on a vehicle 50, and includes a vehicle-side device body 10a, a vehicle-side transmission antenna element 19a, and a vehicle-side reception antenna element 12a. In the keyless entry device 100, the vehicle-side transmitting antenna element 19a is composed of one antenna element arranged at a predetermined position in the vehicle 50, and one vehicle-side receiving antenna element 12a is in the vicinity of the vehicle-side device body 10a. Is arranged. However, the arrangement of the vehicle-side transmitting antenna element 19a and the vehicle-side receiving antenna element 12a mentioned here is an example, and other arrangements may be used. In addition, it is sufficient that at least one vehicle-side transmitting antenna element 19a is provided, and a plurality of vehicle-side transmitting antenna elements 19a may be provided. The vehicle-side transmitting antenna element 19a and the vehicle-side receiving antenna element 12a described above are connected to the vehicle-side device body 10a through wiring not shown.

The portable device 20 is carried by the vehicle user 55 and is operated by the built-in battery 28. In the keyless entry device 100, after the portable device 20 receives a request signal from the vehicle-side device 10 mounted on the vehicle 50, it transmits an answer signal corresponding to the request signal and wirelessly communicates with the vehicle-side device 10. It has a function to perform communication. The portable device 20 is normally in a standby state so that the request signal can be received.

The keyless entry device 100 has a function of performing wireless communication between the vehicle-side device 10 and the portable device 20 by the vehicle user 55 operating the request switch of the portable device 20, and unlocking / locking the door lock. Have. In addition, authentication using data such as an ID code is performed by automatically touching the vehicle while holding the portable device without operating the switch of the portable device, and the door lock is automatically released. It also has a so-called passive function for locking and locking. This passive function transmits a distance measurement signal from the vehicle side device 10 together with an ID code, calculates a distance based on the reception strength of the distance measurement signal in the portable device 20, and places the distance information on the answer signal to the vehicle. It may be configured to send back to the side device 10 and lock and unlock the vehicle depending on whether or not the distance is within a predetermined distance range.

FIG. 2 is a block diagram showing a main configuration of each of the vehicle-side device 10 and the portable device 20 used in the keyless entry device 100.

As shown in FIG. 2, the vehicle-side device 10 is composed of the vehicle-side transmitting antenna element 19a, the vehicle-side receiving antenna element 12a, and the vehicle-side device body 10a. The vehicle-side device body 10a includes a vehicle-side transmission unit 11 (LF-TX), a vehicle-side reception unit 12 (RF-RX), a vehicle-side control unit 15 (CPU), and a vehicle-side oscillation circuit 16 (LF-OSC). ), A vehicle-side storage unit 17 (MEM), and a drive signal transmission unit 18 (DS-TX). In the vehicle side apparatus main body 10 a, the vehicle side control unit 15 is located in the center and controls each unit connected to the vehicle side control unit 15.

The 1st resonance circuit 13 is provided in the inside of the vehicle side transmission part 11, and the 1st resonance circuit 13 is connected to the vehicle side transmission antenna element 19a. The first resonance circuit 13 is integrated with the vehicle-side transmission antenna element 19a to form the vehicle-side transmission antenna 19, and forms a predetermined antenna impedance. The configuration of the first resonance circuit 13 will be described later. The vehicle-side receiving unit 12 has an input end connected to the vehicle-side receiving antenna element 12 a and an output end connected to the vehicle-side control unit 15. The vehicle-side oscillation circuit 16 generates a request signal carrier wave signal LF, and an output terminal for outputting the carrier wave signal LF is connected to the vehicle-side controller 15. The vehicle-side storage unit 17 stores a first ID assigned to the vehicle-side device 10 and a second ID assigned to the portable device 20 used together with the vehicle-side device 10. The end is connected to the vehicle-side control unit 15. In addition, the drive signal transmission unit 18 has an input end connected to the vehicle-side control unit 15.

The carrier wave signal LF output from the vehicle-side oscillation circuit 16 is supplied to the vehicle-side control unit 15. When the carrier signal LF is supplied, the vehicle-side control unit 15 reads the first ID from the vehicle-side storage unit 17, adds necessary information including the read first ID to the carrier signal LF, A request signal is formed according to the format. The request signal format will be described later. Next, when the transmission timing of the request signal is set, the request signal is supplied to the vehicle-side transmission unit 11 under the control of the vehicle-side control unit 15. In the vehicle-side transmitter 11, the supplied request signal is amplified to a signal level suitable for transmission, and the amplified request signal is supplied to the first resonance circuit 13. The request signal is wirelessly transmitted from the vehicle-side transmission antenna element 19a.

The vehicle-side receiving unit 12 receives an answer signal including the second ID and command signal of the portable device 20 wirelessly transmitted from the portable device 20 via the vehicle-side receiving antenna element 12a, and receives the received answer signal. Is amplified to a predetermined signal level by an amplifier circuit (not shown), and the amplified answer signal is supplied to the vehicle-side control unit 15. The vehicle-side control unit 15 authenticates the second ID included in the answer signal using the second ID read from the vehicle-side storage unit 17, and when the authentication is established, the command included in the answer signal A drive signal is formed from the signal, and this drive signal is supplied to the drive signal transmitter 18. When the drive signal is supplied, the drive signal transmission unit 18 drives the motor (not shown) that locks and unlocks the corresponding door lock or a controlled mechanism (not shown) such as an engine start circuit. A signal is transmitted and the controlled mechanism is controlled according to the drive signal.

For example, an LF or VLF carrier signal is used as the request signal, and an RF (several hundred MHz) carrier signal is used as the answer signal. Further, the communication distance of the request signal, that is, the detection area of the request signal is about 1 to 2 m from the vehicle-side transmission antenna element 19a, and the communication distance of the answer signal, that is, the detection area of the answer signal is the portable-device-side transmission antenna element. It is about 5 to 10 m from 21a.

On the other hand, as shown in FIG. 2, the portable device 20 includes a portable device-side transmitter 21 (RF-TX) including a portable device-side transmitting antenna element 21a and a portable device-side receiving device including a portable device-side receiving antenna element 29a. Unit 22 (LF-RX), portable device side control unit 25 (CPU), portable device side oscillation circuit 26 (RF-OSC), portable device side storage unit 27 (MEM), and battery 28 for power supply ( BAT). In the portable device 20, the portable device side control unit 25 is located in the center and controls each unit connected to the portable device side control unit 25.

The portable device side transmission unit 21 has an input terminal connected to the portable device side control unit 25 and an output terminal connected to the portable device side transmission antenna element 21a. The portable device side receiving unit 22 has an input end connected to the portable device side receiving antenna element 29 a and an output end connected to the portable device side control unit 25. The output terminal of the portable device side oscillation circuit 26 is connected to the portable device side control unit 25. The portable device storage unit 27 has an input / output terminal connected to the portable device control unit 25. The battery 28 is connected to each part in the portable device 20 described above, and supplies power to the portable device-side transmitter 21, the portable device-side receiver 22, the portable device-side controller 25, and the like.

The portable device side oscillation circuit 26 oscillates a high frequency signal, and the oscillated high frequency signal is supplied to the portable device side control unit 25. At this time, the portable device-side control unit 25 uses the high-frequency signal as a carrier wave and adds a necessary information signal such as a second ID or a command signal by applying modulation to form an answer signal. This answer signal is supplied to the portable device-side transmitter 21. The portable device-side storage unit 27 stores a first ID assigned to the vehicle-side device 10, a second ID assigned to the own portable device 20, and various command signals. Under the control of the machine control unit 25, the first ID or the second ID and various command signals are appropriately read out.

When the portable device-side transmission unit 21 is supplied with a high-frequency signal, ie, an answer signal, including the second ID or command signal from the portable device-side control unit 25, the answer signal is amplified to a signal level suitable for wireless transmission. Then, the amplified answer signal is wirelessly transmitted via the portable device-side transmitting antenna element 21a.

The second resonance circuit 23 is provided inside the portable device side receiving unit 22, and the portable device side reception antenna element 29 a is connected to the second resonance circuit 23. The second resonance circuit 23 is integrated with the portable device-side receiving antenna element 29a to form the portable device-side receiving antenna 29, and forms a predetermined antenna impedance. The configuration of the second resonance circuit 23 will be described later. The portable device side receiving unit 22 receives the request signal including the first ID wirelessly transmitted from the vehicle side device 10 via the portable device side reception antenna element 29a and the second resonance circuit 23, and receives the received request. The signal is supplied to the portable device side control unit 25.

Next, an example of a relay attack that exploits the mechanism of the passive keyless entry device will be described with reference to FIG. FIG. 3 is a block diagram when a relay attack is performed.

As shown in FIG. 3, the relay attack prepares two unauthorized repeaters, a first repeater 60 and a second repeater 70, and the first repeater 60 is arranged in the vicinity of the vehicle 50, A request signal from the vehicle 50 is received. Based on this request signal, the second repeater 70 arranged at the isolated position transmits a false request signal, and the portable device 20 that has received the request transmits an answer signal to the vehicle, and the vehicle 50 receives it. Thus, the vehicle door is unlocked where the vehicle user 55 does not intend.

As described above, in the relay attack, in the communication between the original vehicle-side device 10 and the portable device 20, communication via the first repeater 60 and the second repeater 70 is added. . The present invention uses the fact that the reception strength in the portable device 20 is reduced by adding the number of communications in such a relay attack and switching the carrier frequency of the request signal to determine whether or not a relay attack has been performed. Judgment.

Next, the configuration of the transmission format of the request signal transmitted from the vehicle-side device 10 and the change in the reception intensity in the portable device 20 when the carrier frequency is switched will be described with reference to FIGS.

FIG. 4 is a diagram showing the configuration of the LF transmission format of the request signal. 4A shows the configuration of the conventional LF transmission format of the request signal, and FIGS. 4B and 4C show the configuration of the LF transmission format of the request signal of the present invention. FIG. 5A is a circuit diagram showing the first resonance circuit 13, and FIG. 5B is a circuit diagram showing the second resonance circuit 23. FIG. 6A is a graph showing the transmission antenna impedance of the vehicle-side transmission unit 11, and FIG. 6B is a graph showing the reception antenna impedance of the portable device-side reception unit 22. FIG. 7 is a graph showing reception strength or transmission strength. Of these, FIG. 7A shows a portable device in which the carrier frequency is switched when relay attack is not performed (normal time). 20 is a graph showing a reception intensity (B2) at 20; Also, FIG. 7B shows the reception strength (in the first repeater 60 and the portable device 20 shown in FIG. 3 when the carrier wave frequency is switched when the relay attack is performed (in the case of fraud) ( D2, B2), and the transmission intensity E2 in the 2nd repeater 70 are graphs. In FIG. 7, signal attenuation due to distance is omitted for easy understanding.

As shown in FIG. 4A, the LF transmission format of the conventional request signal includes information including the first ID assigned to the vehicle-side device 10 and the second ID assigned to the portable device 20 described above. The frame includes a frame and a distance measuring frame for measuring the distance between the vehicle-side device 10 and the portable device 20. The carrier frequency of the information frame and the distance measurement frame is the same carrier frequency f1. The portable device side control unit 25 measures the reception strength of the distance measurement frame, creates an answer signal based on the measured reception strength, and causes the portable device side transmission unit 21 to transmit the created answer signal. The vehicle-side control unit 15 that has received the answer signal can measure the distance between the vehicle 50 and the portable device 20 shown in FIG. 1 based on the reception strength of the distance measurement frame in the portable device 20.

In the LF transmission format of the request signal of the present invention, as shown in FIGS. 4B and 4C, an illegal relay determination frame is added after the distance measurement frame of the LF transmission format of the conventional request signal. It has a configuration.

As shown in FIG. 4B, the carrier frequency of the fraud determination frame is a carrier frequency f2 different from the carrier frequency f1 of the distance measurement frame. The portable device control unit 25 measures the reception strength for each of a plurality of frames, that is, the reception strength of the distance measurement frame and the reception strength of the fraud relay determination frame. Then, an answer signal is created based on the two measured received intensities, and the created answer signal is transmitted to the portable device-side transmitter 21. And the vehicle side control part 15 which received the answer signal determines whether predetermined | prescribed control with respect to the vehicle 50 is performed based on an answer signal. Details of this determination method will be described later.

In the first embodiment of the present invention, f2 is set to be lower than f1 (f1> f2), but the reception strength is measured at a frequency higher than f1 when the portable device 20 makes an unauthorized relay determination (f1 <f1). f2) may be set as follows.

The LF transmission format of the request signal of the present invention may have a configuration in which a plurality of unauthorized relay determination frames are added instead of one as shown in FIG. In this case, f1> f2> fN is set. Note that when the reception strength at the time of the unauthorized relay determination of the portable device 20 is performed at a frequency higher than f1, f1 <f2 <fN may be set.

Next, the circuit configuration of the first resonance circuit 13 in the vehicle-side transmission unit 11, the circuit configuration of the second resonance circuit 23 in the portable device-side reception unit 22, the antenna transmission impedance of the vehicle-side transmission unit 11, and the portable device side The antenna reception impedance of the receiving unit 22 will be described.

As shown in FIG. 5A, the first resonance circuit 13 is configured by a series connection circuit in which one end of a capacitor C11 and one end of an inductor L11 included in the vehicle-side transmitting antenna element 19a are connected. An antenna 19 including the first resonance circuit 13 is configured. Further, the other end of the capacitor C11 and the other end of the inductor L11 are connected to other portions of the vehicle-side transmission unit 11.

The first resonance circuit 13 has a resonance frequency equal to one of the different carrier frequencies of the carrier frequency f1 and the carrier frequency f2 of the distance measurement frame described above. In the keyless entry device 100, the resonance frequency of the first resonance circuit 13 is set to the carrier frequency f1 of the distance measurement frame, which is the same as the information frame. The carrier frequency f1 is determined by the capacitance of the capacitor C11 and the inductance of the inductor L11.

The transmission antenna impedance of the first resonance circuit 13 between the other end of the capacitor C11 and the other end of the inductor L11, that is, the input end of the first resonance circuit 13, is a carrier frequency as shown in FIG. z1 at f1 and z12 at the carrier frequency f2. The transmission antenna impedance z11 at the carrier frequency f1 is set to a predetermined impedance value, and is an optimum value in the frequency range before and after the carrier frequency f1. Therefore, the request signal can be transmitted most efficiently at the carrier frequency f1. Accordingly, the transmission intensity of the vehicle-side transmission unit 11 is maximum (A1) at the carrier frequency f1, as shown in FIG. As described above, the attenuation due to the distance is omitted in FIG.

As shown in FIG. 5B, the second resonance circuit 23 is configured by a circuit in which a capacitor C21 and an inductor L21 included in the portable device-side receiving antenna element 29a are connected in parallel. Further, both ends of each of the capacitor C21 and the inductor L21 are connected to other parts of the portable device side receiving unit 22. An antenna 29 including the second resonance circuit 23 is configured. Similar to the first resonance circuit 13, the resonance frequency of the second resonance circuit 23 is set to the carrier frequency f 1 of the distance measurement frame of the request signal transmitted from the vehicle-side transmission unit 11. f1 is determined by the capacitance of the capacitor C21 and the inductance of the inductor L21.

The reception antenna impedance of the second resonance circuit 23 to which the portable device-side reception antenna element 29a is connected, as viewed from both ends of the capacitor C21 and the inductor L21, that is, from the output end of the second resonance circuit 23, is shown in FIG. Thus, the carrier frequency f1 is z21, and the carrier frequency f2 is z22. The receiving antenna impedance z21 at the carrier frequency f1 is set to a predetermined impedance value, and is an optimal value in the frequency range before and after the carrier frequency f1. Therefore, the request signal can be received most efficiently at the carrier frequency f1. Therefore, as shown in FIG. 7A, the reception intensity of the portable device side receiving unit 22 is maximum (B1) at the carrier frequency f1.

By the way, as described above, the LF transmission format of the request signal of the present invention has a configuration in which an illegal relay determination frame is added after the distance measurement frame shown in FIG. The carrier frequency of the distance measurement frame is f1, but the carrier frequency of the unauthorized relay determination frame is f2 different from f1 (f1> f2).

In the LF transmission format, when the distance measurement frame is changed to the fraudulent relay determination frame, that is, when the carrier frequency is f2, the transmission antenna impedance z12 of the vehicle-side transmission unit 11 is as shown in FIG. , Becomes larger than the transmission antenna impedance z11 when the carrier frequency is f1 (z12> z11). In the keyless entry device 100, for example, z12 becomes z12 = 1.3 * z11. Further, when the carrier frequency is f2, the reception antenna impedance z22 of the portable device-side receiver 22 is smaller than the transmission antenna impedance z21 when the carrier frequency is f1, as shown in FIG. 6B. (Z22 <z21) For example, z22 becomes z22 = 0.8 * z21.

When the transmission antenna impedance of the vehicle side transmission unit 11 is changed from z11 to z12 as shown in FIG. 6 (a), the transmission intensity of the vehicle side transmission unit 11 is transmitted as shown in FIG. 7 (a). It decreases from A1 to A2 as the antenna impedance changes. A2 at this time can be expressed by A2 = A1 * (z11 / z12). Therefore, for example, when z12 = 1.3 * z11, A2 is A2 = A1 / 1.3.

Further, the reception intensity B1 at f1 of the portable device side receiving unit 22 becomes the maximum value when the resonance frequency of the second resonance circuit 23 is set to f1. On the other hand, the reception antenna impedance of the mobile device side receiving unit 22 is received by the mobile device side receiving unit 22 when the frequency becomes f2, that is, when z21 changes to z22 as shown in FIG. The intensity decreases at a rate of z22 / z21 as the receiving antenna impedance changes.

Therefore, for example, when z22 = 0.8 * z21, when the request signal transmitted from the vehicle-side transmitting unit 11 is received by the portable device-side receiving unit 22, the reception intensity B2 shown in FIG. It can be seen that 0.8 * A2 = (0.8 / 1.3) * A1 = 0.615 * A1.

On the other hand, if a relay attack is performed between the vehicle-side device 10 and the portable device 20 as shown in FIG. 3, the first repeater 60 and the second repeater are provided between the vehicle-side device 10 and the portable device 20. 70 will enter. In this case, the transmission / reception strength drop caused by the change in the transmission antenna impedance and the change in the reception antenna impedance occurs twice more than in the normal case where no relay attack is performed. As a result, as shown in FIG. 7 (b), the transmission intensity A2 of the vehicle-side transmission unit 11 at the carrier frequency f2 of the vehicle-side device 10 decreases to the reception intensity D2 at the time of reception by the first repeater 60, It decreases to the reception strength E2 at the time of transmission of the second repeater 70, and decreases to the reception strength B2 at the time of reception of the portable device side receiving unit 22.

Therefore, in this case, the reception intensity B2 at the portable device side receiving unit 22 is B2 <0.615 * A1 with respect to B2 = 0.615 * A1 when the relay attack is not performed. In other words, when a relay attack is performed between the vehicle-side device 10 and the portable device 20, the reception intensity B2 in the portable device-side receiving unit 22 decreases more than usual. If the antenna impedance of the resonance circuit in each of the first repeater 60 and the second repeater 70 is the same as the antenna impedance of the resonance circuit of the keyless entry device 100, for example, the reception intensity at the first repeater 60 D2 is D2 = 0.8 * A2 = 0.8 * (1 / 1.3) * A1 = 0.615 * A1. Also, the transmission intensity E2 at the second repeater 70 is E2 = (1 / 1.3) * D2 = (0.615 / 1.3) * A1, and the reception intensity B2 at the portable device side receiving unit 22 Is B2 = 0.8 * E2 = 0.615 * 0.615 * A1 = 0.378 * A1, and it is clear that B2 <0.615 * A1.

As described above, fraud is performed when the ratio of the reception strength B2 at the carrier frequency f2 in the portable device side receiver 22 to the transmission strength A1 of the vehicle side transmitter 11 at the carrier frequency f1 is smaller than a predetermined threshold. It is determined that That is, when the ratio of the reception strength of the unauthorized relay determination frame to the transmission strength of the distance measurement frame is smaller than a predetermined threshold value, it is determined to be unauthorized and it is determined that the predetermined control for the vehicle 50 is not performed. The predetermined threshold can be, for example, (0.8 / 1.3) = 0.615, but the threshold is set to 0.615 * 0.8 = 0.492 in order to have a 20% margin. Is desirable.

In the description so far, as shown in FIG. 4B, the transmission format of the request signal is such that one unauthorized relay determination frame is added after the distance measurement frame of the carrier frequency f1. As shown in FIG. 4 (c), a plurality of fraudulent relay determination frames may be added after the distance measurement frame of the carrier frequency f1. By adding a plurality of fraud relay determination frames, it is possible to more accurately determine that the relay attack has been performed. In particular, it is desirable to add four fraudulent relay determination frames, that is, to perform determination based on five frames together with the distance measurement frame.

As described above, since the keyless entry device 100 according to the first embodiment of the present invention includes a plurality of frames having different carrier frequencies in the request signal, it differs from the resonance frequency of the first resonance circuit 13 or the second resonance circuit 23. A signal having a carrier frequency is transmitted or received, and the transmission / reception strength is reduced due to the carrier frequency being out of the resonance frequency. Therefore, when transmission / reception is repeated by the relay attack, a difference in reception intensity between the frames appears more greatly. As a result, it can be easily determined that the relay attack is going to be performed. Further, since it is not necessary to notify the portable device 20 of the change in the carrier frequency in advance, the communication time can be shortened. Therefore, it is possible to provide the keyless entry device 100 that has an excellent communication speed and can prevent a relay attack with a simple configuration.

Further, by making one of the different carrier frequencies the same as the resonance frequency of the first resonance circuit 13 and / or the second resonance circuit 23, and using this frequency as a reference, the reception intensity with signals of other different carrier frequencies Can be compared in a region where the reception intensity is high, so that it is possible to detect fraud even with signals that are far apart.

Further, since it is only necessary to obtain the ratio of the reception strength in the illegal relay determination frame to the reception strength in the distance measurement frame in the request signal, it is possible to determine whether or not it is illegal by simple calculation.

[Second Embodiment]
Next, the operation of the keyless entry device 200 according to the second embodiment of the present invention will be described with reference to FIGS. The difference between the keyless entry device 100 and the keyless entry device 200 is that the resonance frequency of each of the first resonance circuit 13 and the second resonance circuit 23 of the keyless entry device 100 is fixed, whereas the keyless entry device 200. The only difference is that the resonance frequency of each of the first resonance circuit 14 and the second resonance circuit 24 is variable. Therefore, all other configurations are the same. Therefore, description of items other than those related to the first resonance circuit 14 and the second resonance circuit 24 is omitted.

FIG. 8A is a circuit diagram of the first resonance circuit 14 whose resonance frequency can be varied, and FIG. 8B is a circuit diagram of the second resonance circuit 24 whose resonance frequency can be varied. FIG. 9A is a graph showing the transmission antenna impedance of the vehicle-side transmission unit 11 when the resonance frequency is changed, and FIG. 9B is a graph of the portable device-side reception unit 22 when the resonance frequency is changed. It is a graph which shows a receiving antenna impedance. FIG. 10 is a graph showing the reception intensity when only the resonance frequency of the second resonance circuit 24 is changed, for example. FIG. 10A shows the case where the relay attack is not performed (normal time). ) Is a graph showing the reception intensity B2 in the portable device 20 when the carrier frequency is switched. FIG. 10B shows the reception strength (D2, B2) at the first repeater 60 and the portable device 20 when the carrier frequency is switched when a relay attack is performed (when illegal), 4 is a graph showing transmission intensity E2 in the second repeater 70. In FIG. 10, signal attenuation due to distance is omitted for easy understanding.

The first resonance circuit 14 with variable resonance frequency shown in FIG. 8A has a capacitor C12 and a switch SW11 between both ends of the capacitor C11 with respect to the configuration of the first resonance circuit 13 shown in FIG. And the other configuration is the same as that of the first resonance circuit 13. An antenna 19 including the first resonance circuit 14 is configured.

In the first resonance circuit 14, the resonance frequency when the switch SW11 is turned off is the same frequency as the carrier frequency of the request signal distance measurement frame f1, and the resonance frequency when the switch SW11 is turned on is f1. The frequency is set to be the same frequency as f2, which is a lower carrier frequency of the fraud relay determination frame. f2 is determined by the total capacitance of the capacitor C11 and the capacitor C12 and the inductance of the inductor L11.

The second resonance circuit 24 with variable resonance frequency shown in FIG. 8B has a capacitor C22 and a switch SW21 between both ends of the capacitor C21 with respect to the configuration of the second resonance circuit 23 shown in FIG. The other configuration is the same as that of the second resonance circuit 23. An antenna 29 including the second resonance circuit 23 is configured.

In the second resonance circuit 24, the resonance frequency when the switch SW21 is turned off becomes the same frequency as the carrier frequency of the request signal distance measurement frame f1, and the resonance frequency when the switch SW21 is turned on is f1. The frequency is set to be the same frequency as f2, which is a lower carrier frequency of the fraud relay determination frame. f2 is determined by the total capacitance of the capacitor C21 and the capacitor C22 and the inductance of the inductor L21.

In the keyless entry device 200, the first resonance circuit 14 and the second resonance circuit 24 can change the resonance frequency, respectively, and at least one of the vehicle-side transmission unit 11 and the portable device-side reception unit 22 matches the carrier frequency. The resonance frequency is changed. That is, when the carrier frequency is f1, the switches SW11 and SW21 are turned off so that the resonance frequencies of the first resonance circuit 14 and the second resonance circuit 24 are f1. On the other hand, when the carrier frequency becomes f2, in order to set the resonance frequency of the first resonance circuit 14 or the second resonance circuit 24 to f2, the switch SW11 or the switch SW21 is set to be turned on.

Therefore, when the request signal transmission format shown in FIG. 4B is changed from the distance measurement frame to the unauthorized relay determination frame, the resonance frequency of the first resonance circuit 14 can be simultaneously switched from f1 to f2. . When the resonance frequency is switched from f1 to f2, the transmission antenna impedance changes from z11 to z12 as shown in FIG. 9A, but the resonance frequency of the first resonance circuit 14 is f2, z12 has the same predetermined impedance value as z11. Therefore, even if the resonance frequency of the first resonance circuit 14 is switched from f1 to f2, it is an optimum value in the frequency range around the carrier frequency f2. Therefore, the request signal can be transmitted most efficiently even at the carrier frequency f2.

Further, in the transmission format of the request signal shown in FIG. 4B, the resonance frequency of the second resonance circuit 24 can be switched from f1 to f2 at the same time when the distance measurement frame is changed to the unauthorized relay determination frame. . When the resonance frequency is switched from f1 to f2, the reception antenna impedance is switched from the resonance frequency of the second resonance circuit 24 to f2. At that time, the reception antenna impedance changes from z21 to z22 as shown in FIG. 9B, but since the resonance frequency of the second resonance circuit 24 is f2, z22 is the same impedance value as z21. become. Therefore, even if the resonance frequency of the second resonance circuit 24 is switched from f1 to f2, it is an optimum value in the frequency range before and after the carrier wave frequency f2. Therefore, the request signal can be received most efficiently even at the carrier frequency f2.

Next, when the frame for distance measurement is changed to the frame for unauthorized relay determination, that is, when the carrier frequency of the request signal is changed from f1 to f2, for example, the resonance frequency of the first resonance circuit 14 of the vehicle-side transmitter 11 is set. The resonance frequency of the second resonance circuit 24 of the portable device-side receiver 22 is changed from f1 to f2 while keeping f1. The timing for switching the resonance frequency of the second resonance circuit 24 is determined in advance.

A description will be given of the reception intensity B2 in the portable device-side receiver 22 when the carrier frequency of the request signal is changed from f1 to f2. Since the resonance frequency of the first resonance circuit 14 remains f1, the transmission antenna impedance of the vehicle-side transmission unit 11 when the carrier frequency of the request signal is f1 and when the carrier frequency is f2 is as shown in FIG. As shown, z11 becomes z12 (z12> z11). Therefore, as shown in FIG. 10A, the transmission intensity of the vehicle-side transmission unit 11 is the maximum (A1) at the carrier frequency f1, and the transmission intensity is reduced to A2 at the carrier frequency f2. As described above, for example, when z12 = 1.3 * z11, A2 = A1 / 1.3.

When the carrier frequency of the request signal is switched from f1 to f2, the resonance frequency of the second resonance circuit 24 of the portable device-side receiver 22 is switched to f2, as shown in FIG. 9B. Therefore, the reception antenna impedance z22 at this time is the same as z21 and remains a predetermined characteristic impedance. Therefore, the mobile device side receiving unit 22 can receive without reducing the reception intensity. As a result, as shown in FIG. 10A, the reception sensitivity B2 in the portable device side reception unit 22 is B2 = A2. That is, when the carrier frequency is switched from f1 to f2, the reception intensity B2 of the portable device-side receiver 22 does not decrease, and B2 = A2 = A1 / 1.3. As described above, the attenuation due to the distance is omitted in FIG.

On the other hand, if the relay attack as shown in FIG. 3 is performed, the first repeater 60 and the second repeater 70 are inserted between the vehicle-side device 10 and the portable device 20. As described above, a decrease in reception strength by the portable device side receiving unit 22 does not occur, but a decrease in transmission / reception strength by the first repeater 60 and the second repeater 70 occurs.

As described above, when the relay attack is not performed, B2 = A2 = (1 / 1.3) * A1. On the other hand, a relay attack is performed. If the antenna impedance of the resonance circuit in each of the first repeater 60 and the second repeater 70 is the same as that of the keyless entry device 100, the antenna impedance in which the resonance frequency of each resonance circuit is not changed. For example, the reception intensity D2 at the first repeater 60 is D2 = 0.8 * A2 = 0.8 * (1/3) * A1 = 0.615 * A1. Further, the transmission intensity E2 at the second repeater 70 is E2 = (1 / 1.3) * D2 = (0.615 / 1.3) * A1 = 0.473 * A1. However, since the mobile device side receiving unit 22 can receive without reducing the reception strength, the reception strength B2 at the mobile device side receiving unit 22 is smaller than the transmission strength E2 at the second repeater 70. For example, B2 = E2 = (0.615 / 1.3) * A1 = 0.473 * A1 without decreasing. Therefore, clearly B2 <(1 / 1.3) * A1, and compared with the case where the resonance frequency of each resonance circuit of the keyless entry device 200 is not changed, the difference in reception intensity is in a region where the reception intensity is higher. Can be determined.

As described above, when the ratio of the reception intensity B2 at the carrier frequency f2 in the portable device-side receiver 22 to the transmission intensity A1 of the vehicle-side transmitter 11 is smaller than a predetermined threshold, it is determined that fraud has been performed, and the vehicle It is determined that the predetermined control for 50 is not performed. The predetermined threshold can be set to (1 / 1.3), for example, but the threshold is set to 0.8 * (1 / 1.3) = 0.615 in order to provide a 20% margin. It is desirable.

In the above description, the case where only the resonance frequency of the second resonance circuit 24 of the portable device-side receiver 22 is changed has been described, but even if only the resonance frequency of the first resonance circuit 14 of the vehicle-side transmitter 11 is changed. It is the same. Moreover, you may make it change both the resonant frequency of the 2nd resonance circuit 24 of the portable device side receiving part 22 and the 1st resonance circuit 14 of the vehicle side transmission part 11 together. If the two resonance frequencies are changed together, the effect that the difference in the received intensity can be determined in a region where the received intensity is higher becomes greater.

In the above description, the transmission format of the request signal is one illegal relay determination frame as shown in FIG. 4B. However, as shown in FIG. A plurality of frames may be used. In that case, the series connection circuit of the capacitor C12 and the switch SW11 and the series connection of the capacitor C22 and the switch SW21 in the first resonance circuit 14 and the second resonance circuit 24 shown in FIGS. 8A and 8B. A plurality of connection circuits may be provided, and each switch may be switched in accordance with switching of the resonance frequency.

In the keyless entry device 100 configured as described above, at least one of the vehicle-side transmitter 11 and the portable device-side receiver 22 has a resonance frequency that matches the reference carrier frequency. A difference in reception intensity with signals of different carrier frequencies can be determined in a region where the reception intensity is high. For this reason, it is possible to detect fraud with a higher probability even for signals that are far away. Moreover, since the SN ratio of the transmission signal from the vehicle-side transmission unit 11 or the reception signal of the portable device-side reception unit 22 is also increased, the determination accuracy is increased. Furthermore, if both the resonance frequencies of the second resonance circuit 24 of the portable device side receiving unit 22 and the first resonance circuit 14 of the vehicle side transmission unit 11 are changed, the effect is further increased.

As described above, since the keyless entry device of the present invention includes a plurality of frames having different carrier frequencies in the request signal, it transmits a signal having a carrier frequency different from the resonance frequency of the first resonance circuit or the second resonance circuit, or As a result of reception, the transmission / reception strength decreases due to the carrier frequency deviating from the resonance frequency. Therefore, when transmission / reception is repeated by the relay attack, a difference in reception intensity between the frames appears more greatly. As a result, it can be easily determined that the relay attack is going to be performed. In addition, since it is not necessary to notify the portable device of changes in the carrier frequency in advance, the communication time can be shortened. Therefore, it is possible to provide a keyless entry device that is excellent in communication speed and can prevent a relay attack with a simple configuration.

The present invention is not limited to the description of the above embodiment, and can be implemented with appropriate modifications in a mode in which the effect is exhibited.

DESCRIPTION OF SYMBOLS 10 Vehicle side apparatus 10a Vehicle side apparatus main body 11 Vehicle side transmission part 12 Vehicle side receiving part 12a Vehicle side receiving antenna element 13 1st resonance circuit 14 1st resonance circuit 15 Vehicle side control part 16 Vehicle side oscillation circuit 17 Vehicle side memory | storage part DESCRIPTION OF SYMBOLS 18 Drive signal transmission part 19 Vehicle side transmission antenna 19a Vehicle side transmission antenna element 20 Portable machine 21 Portable machine side transmission part 21a Portable machine side transmission antenna element 22 Portable machine side reception part 23 2nd resonance circuit 24 2nd resonance circuit 25 Carrying Machine side control unit 26 Portable machine side oscillation circuit 27 Portable machine side storage unit 28 Battery 29 Portable machine side receiving antenna 29a Portable machine side receiving antenna element 100 Keyless entry device 200 Keyless entry device

Claims

A keyless entry device comprising: a vehicle side device that transmits a request signal; and a portable device that transmits an answer signal corresponding to the request signal when the request signal is received,
The vehicle-side device includes a first resonance circuit, a vehicle-side transmission unit that transmits the request signal via the first resonance circuit, a vehicle-side reception unit that receives the answer signal, and a predetermined vehicle interior A vehicle-side control unit that performs control, and a vehicle-side oscillation circuit that generates a carrier signal for the request signal,
The portable device has a second resonance circuit, and receives the request signal via the second resonance circuit, a portable device side transmission unit that transmits the answer signal, and the answer signal. A portable device side control unit that controls transmission of
The vehicle-side oscillation circuit can change a carrier frequency of the carrier signal, and the request signal includes a plurality of frames having different carrier frequencies,
The portable device side control unit measures reception strength for each of the plurality of frames, causes the portable device side transmission unit to transmit the answer signal including information based on the measured reception strength, and the vehicle side control unit Determines whether or not to perform predetermined control on the vehicle based on the answer signal.
2. The keyless entry device according to claim 1, wherein the first resonance circuit and the second resonance circuit have a resonance frequency equal to one of the different carrier frequencies.
The plurality of frames are composed of a distance measurement frame and an illegal relay determination frame each having a different carrier frequency,
Determining that the ratio of the reception strength of the unauthorized relay determination frame to the transmission strength of the distance measurement frame is smaller than a predetermined threshold value, and determining that the vehicle is not subjected to predetermined control. The keyless entry device according to claim 1 or 2, wherein the keyless entry device is characterized.
The first resonance circuit and / or the second resonance circuit can each vary a resonance frequency,
4. The resonance frequency of at least one of the vehicle-side transmitter and the portable device-side receiver is changed according to the carrier frequency. 5. Keyless entry device.