WO2020198335A1 - Up-sampling and cross-correlation for time of arrival determinations in passive entry/passive start systems - Google Patents

Up-sampling and cross-correlation for time of arrival determinations in passive entry/passive start systems Download PDF

Info

Publication number
WO2020198335A1
WO2020198335A1 PCT/US2020/024672 US2020024672W WO2020198335A1 WO 2020198335 A1 WO2020198335 A1 WO 2020198335A1 US 2020024672 W US2020024672 W US 2020024672W WO 2020198335 A1 WO2020198335 A1 WO 2020198335A1
Authority
WO
WIPO (PCT)
Prior art keywords
signal
vehicle
module
antenna
access
Prior art date
Application number
PCT/US2020/024672
Other languages
English (en)
French (fr)
Inventor
Raymond Michael Stitt
John Videtich
Original Assignee
Denso International America, Inc.
Denso Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US16/598,191 external-priority patent/US10991182B2/en
Priority claimed from US16/824,280 external-priority patent/US11428799B2/en
Application filed by Denso International America, Inc., Denso Corporation filed Critical Denso International America, Inc.
Priority to DE112020001498.3T priority Critical patent/DE112020001498T5/de
Priority to CN202080023785.8A priority patent/CN113614568A/zh
Priority to JP2021557345A priority patent/JP7380706B2/ja
Publication of WO2020198335A1 publication Critical patent/WO2020198335A1/en

Links

Classifications

    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S13/00—Systems using the reflection or reradiation of radio waves, e.g. radar systems; Analogous systems using reflection or reradiation of waves whose nature or wavelength is irrelevant or unspecified
    • G01S13/74—Systems using reradiation of radio waves, e.g. secondary radar systems; Analogous systems
    • G01S13/76—Systems using reradiation of radio waves, e.g. secondary radar systems; Analogous systems wherein pulse-type signals are transmitted
    • G01S13/765—Systems using reradiation of radio waves, e.g. secondary radar systems; Analogous systems wherein pulse-type signals are transmitted with exchange of information between interrogator and responder
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/2072—Means to switch the anti-theft system on or off with means for preventing jamming or interference of a remote switch control signal
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/24—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user
    • B60R25/245—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user where the antenna reception area plays a role
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S19/00—Satellite radio beacon positioning systems; Determining position, velocity or attitude using signals transmitted by such systems
    • G01S19/38—Determining a navigation solution using signals transmitted by a satellite radio beacon positioning system
    • G01S19/39—Determining a navigation solution using signals transmitted by a satellite radio beacon positioning system the satellite radio beacon positioning system transmitting time-stamped messages, e.g. GPS [Global Positioning System], GLONASS [Global Orbiting Navigation Satellite System] or GALILEO
    • G01S19/42—Determining position
    • G01S19/51—Relative positioning
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S3/00—Direction-finders for determining the direction from which infrasonic, sonic, ultrasonic, or electromagnetic waves, or particle emission, not having a directional significance, are being received
    • G01S3/02—Direction-finders for determining the direction from which infrasonic, sonic, ultrasonic, or electromagnetic waves, or particle emission, not having a directional significance, are being received using radio waves
    • G01S3/04—Details
    • G01S3/043—Receivers
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S3/00—Direction-finders for determining the direction from which infrasonic, sonic, ultrasonic, or electromagnetic waves, or particle emission, not having a directional significance, are being received
    • G01S3/02—Direction-finders for determining the direction from which infrasonic, sonic, ultrasonic, or electromagnetic waves, or particle emission, not having a directional significance, are being received using radio waves
    • G01S3/74—Multi-channel systems specially adapted for direction-finding, i.e. having a single antenna system capable of giving simultaneous indications of the directions of different signals
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S5/00—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations
    • G01S5/02—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations using radio waves
    • G01S5/0284—Relative positioning
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S5/00—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations
    • G01S5/02—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations using radio waves
    • G01S5/06—Position of source determined by co-ordinating a plurality of position lines defined by path-difference measurements
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q1/00—Details of, or arrangements associated with, antennas
    • H01Q1/27—Adaptation for use in or on movable bodies
    • H01Q1/32—Adaptation for use in or on road or rail vehicles
    • H01Q1/3208—Adaptation for use in or on road or rail vehicles characterised by the application wherein the antenna is used
    • H01Q1/3233—Adaptation for use in or on road or rail vehicles characterised by the application wherein the antenna is used particular used as part of a sensor or in a security system, e.g. for automotive radar, navigation systems
    • H01Q1/3241—Adaptation for use in or on road or rail vehicles characterised by the application wherein the antenna is used particular used as part of a sensor or in a security system, e.g. for automotive radar, navigation systems particular used in keyless entry systems
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q1/00—Details of, or arrangements associated with, antennas
    • H01Q1/27—Adaptation for use in or on movable bodies
    • H01Q1/32—Adaptation for use in or on road or rail vehicles
    • H01Q1/325—Adaptation for use in or on road or rail vehicles characterised by the location of the antenna on the vehicle
    • H01Q1/3275—Adaptation for use in or on road or rail vehicles characterised by the location of the antenna on the vehicle mounted on a horizontal surface of the vehicle, e.g. on roof, hood, trunk
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q13/00—Waveguide horns or mouths; Slot antennas; Leaky-waveguide antennas; Equivalent structures causing radiation along the transmission path of a guided wave
    • H01Q13/10—Resonant slot antennas
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q21/00—Antenna arrays or systems
    • H01Q21/24—Combinations of antenna units polarised in different directions for transmitting or receiving circularly and elliptically polarised waves or waves linearly polarised in any direction
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q21/00—Antenna arrays or systems
    • H01Q21/28—Combinations of substantially independent non-interacting antenna units or systems
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q9/00—Electrically-short antennas having dimensions not more than twice the operating wavelength and consisting of conductive active radiating elements
    • H01Q9/04—Resonant antennas
    • H01Q9/0407—Substantially flat resonant element parallel to ground plane, e.g. patch antenna
    • H01Q9/0428—Substantially flat resonant element parallel to ground plane, e.g. patch antenna radiating a circular polarised wave
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q9/00—Electrically-short antennas having dimensions not more than twice the operating wavelength and consisting of conductive active radiating elements
    • H01Q9/04—Resonant antennas
    • H01Q9/0407—Substantially flat resonant element parallel to ground plane, e.g. patch antenna
    • H01Q9/0464—Annular ring patch
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01Q—ANTENNAS, i.e. RADIO AERIALS
    • H01Q9/00—Electrically-short antennas having dimensions not more than twice the operating wavelength and consisting of conductive active radiating elements
    • H01Q9/04—Resonant antennas
    • H01Q9/30—Resonant antennas with feed to end of elongated active element, e.g. unipole
    • H01Q9/32—Vertical arrangement of element
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/023—Services making use of location information using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S13/00—Systems using the reflection or reradiation of radio waves, e.g. radar systems; Analogous systems using reflection or reradiation of waves whose nature or wavelength is irrelevant or unspecified
    • G01S13/74—Systems using reradiation of radio waves, e.g. secondary radar systems; Analogous systems
    • G01S13/82—Systems using reradiation of radio waves, e.g. secondary radar systems; Analogous systems wherein continuous-type signals are transmitted
    • G01S13/84—Systems using reradiation of radio waves, e.g. secondary radar systems; Analogous systems wherein continuous-type signals are transmitted for distance determination by phase measurement
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S2205/00—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations
    • G01S2205/01—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations specially adapted for specific applications
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G07C2009/00555—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks comprising means to detect or avoid relay attacks
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C2209/00—Indexing scheme relating to groups G07C9/00 - G07C9/38
    • G07C2209/60—Indexing scheme relating to groups G07C9/00174 - G07C9/00944
    • G07C2209/63—Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Definitions

  • the pairing process can include Bluetooth® pairing whereby: security information is exchanged between the mobile phone and the vehicle directly; a mobile phone address, a mobile phone identity resolving key, a reservation identifier and/or an encryption key are exchanged via a cloud-based network; and/or the mobile phone presents a certificate to the vehicle, where the certificate is signed by (i) the mobile phone, (ii) a trusted security signing authority such as a manufacturer of the vehicle, and/or (iii) a trusted third party.
  • Bluetooth® pairing whereby: security information is exchanged between the mobile phone and the vehicle directly; a mobile phone address, a mobile phone identity resolving key, a reservation identifier and/or an encryption key are exchanged via a cloud-based network; and/or the mobile phone presents a certificate to the vehicle, where the certificate is signed by (i) the mobile phone, (ii) a trusted security signing authority such as a manufacturer of the vehicle, and/or (iii) a trusted third party.
  • the certificate can include an identifier of a person authorized to access a vehicle, an identifier of a cloud-based network authorized to transfer the certificate, an identifier of a rental or lease agreement of the vehicle, an identifier of the vehicle, a date and time period during which the vehicle is permitted for use by the authorized person, and/or other restrictions and/or access/license information.
  • the access module is configured to: downconvert the signal to generate a downconverted signal; sample the downconverted signal to generate a sampled signal; perform an arctangent of the sampled signal to generate an arctangent signal; and differentiate the arctangent signal to generate the differentiated signal.
  • the access module is configured to reconstruct the signal transmitted from the portable access device to the vehicle based on zero-crossings of a portion of the cross-correlation signal associated with a maximum of the product-sum values.
  • a portable access device for an access system of a vehicle.
  • the portable access device includes a receiver and a control module.
  • the receiver is configured to receive a signal transmitted from an access module of a vehicle to the portable access device.
  • the control module is configured to: generate a differentiated signal based on the received signal; up-sample the differentiated signal to generate a first up-sampled signal; obtain or generate an expected signal; up-sample the expected signal to generate a second up-sampled signal; cross-correlate the first up-sampled signal and the second up-sampled signal to generate a cross-correlation signal; based on the cross-correlation signal, determine a phase difference between the first up-sampled signal and the second up-sampled signal; determine a round trip time of the signal received by the receiver; and either transmit the round trip time to the vehicle to gain access to the vehicle based on the round trip time, or determine at least one of a location or a distance between the portable access device and
  • control module is configured to: determine at least one of a location or a distance of the portable access device relative to the vehicle based on the round trip time; and transmit the at least one of the location or the distance to the vehicle to gain access to the vehicle based on the at least one of the location or the distance.
  • control module includes: a sign module configured to determine a sign of the differentiated signal; and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.
  • control module is configured to reconstruct the signal transmitted from the access module of the vehicle to the portable access device based on zero-crossings of a portion of the cross-correlation signal associated with a maximum of the product-sum values.
  • control module includes: an up-sampler configured to up sample the differentiated signal to generate the first up-sampled signal; a sign module configured to determine a sign of the first up-sampled signal; and a bit pattern module configured to generate the expected signal based on the sign of the first up-sampled signal.
  • antennas include: the circular polarized antenna including a conductive ring-shaped body having an inner hole; a circular isolator connected to the conductive ring-shaped body; and a linear polarized antenna connected to the circular polarized antenna and the circular isolator and extending outward from the circular isolator.
  • the linear polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linear polarize antenna extends orthogonal to a radius of the circular polarized antenna.
  • the access module is configured to, while executing the music algorithm: collect analytic signal samples of the signal received at each of the antennas to generate a received data matrix; estimate a data covariance matrix based on the received data matrix; use an eigenvalue decomposition process to determine a MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determine a number of impinging signals; separate the MxM matrix into multiple matrices; compute a music spectrum based on one of the matrices; and perform a peak search on the music spectrum to determine the angles of arrival.
  • the method further includes: creating a time vector corresponding to the in-phase and quadrature phase sample vector; discarding some of the analytic signal samples taken near antenna switching times; unwrapping each repetition portion of remaining samples with a step size of p; averaging frequency of sinusoids of the remaining samples; determining average slope of the remaining samples; measuring standard deviation of the average slope; determining which of the antennas is misaligned based on measured standard deviation; and for each of the antennas, interpolating a straight line of points on a time vector to generate a reconstructed phase angle vector.
  • the vehicle includes (i) a body and (ii) a roof, a center console, a floor or an at least partially enclosed metal structure.
  • the antennas are implemented in at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.
  • the antennas include a multi-axis polarized RF antenna assembly.
  • the multi-axis polarized RF antenna assembly includes the circular polarized antenna and is oriented in the roof.
  • An access system for a vehicle includes antennas and an access module.
  • the antennas are configured to each receive a signal transmitted from a portable access device to the vehicle.
  • the signal is transmitted on a 2.4 gigahertz frequency.
  • the access module is configured to: downconvert the received signal to generate an in-phase signal and a quadrature phase signal; perform carrier phase based ranging including implementing a music algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine angles of arrival of the received signal as received at the antennas; determine a location of the portable access device relative to the vehicle based on the distance and the angles of arrival; and permit access to the vehicle based on the location.
  • the antennas are disposed in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and the antennas.
  • the access module is configured to: monitor the received signal and generates a received signal strength indicator based on the received signal; determine whether the portable access device is inside or outside the vehicle based on the received signal strength indicator; and when the portable access device is outside the vehicle, determine the distance between the portable access device and the vehicle.
  • the access module is configured to, while implementing the music algorithm: collect analytic signal samples of the signal received at each of the antennas to generate a received data matrix; estimate a data covariance matrix based on the received data matrix; use an eigenvalue decomposition process to determine a MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determine a number of impinging signals; separate the MxM matrix into matrices; compute a music spectrum based on one of the matrices; and perform a peak search on the music spectrum to determine the angles of arrival.
  • the receiver includes a phase lock loop and is phase locked with a transmitter of the portable access device.
  • the access module is configured to: perform tone exchanges with the transmitter and based on the tone exchanges determine round trip time of flight information; and based on the round trip time of flight information, determine the distance.
  • a vehicle in other features, includes: the access system; a body; and a roof, a center console, a floor or an at least partially enclosed metal structure.
  • the antennas are implemented in at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.
  • the antennas are disposed in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and the antennas.
  • the method further includes: performing tone exchanges with a transmitter of the portable access device; and based on the tone exchanges, determining at least one of the distance or the angles of arrival.
  • a receiver of the portable access device, performing the tone exchanges includes a phase lock loop and is phase locked with a transmitter of the portable access device.
  • the method further includes: performing tone exchanges with the transmitter and based on the tone exchanges determining round trip time of flight information; and based on the round trip time of flight information, determining the distance.
  • a receiver of the portable access device, performing the tone exchanges includes a phase lock loop and is phase locked with a transmitter of the portable access device.
  • the conductive element is a wire.
  • the sleeve is formed of polytetrafluoroethene.
  • the conductive element is formed of copper.
  • the circular polarized antenna is a 2-axis antenna.
  • the linear polarize antenna is a single axis antenna.
  • the multi-axis polarized RF antenna assembly further includes a ground layer.
  • the circular isolator is disposed on the ground plane, between the conductive element and the ground plane, and between the circular polarized antenna and the ground plane.
  • the circular polarized antenna includes two feed points 90 ° phase offset and configured to receive signal 90 ° out of phase from each other.
  • the access module is configured to execute an algorithm to determine which antenna pair of the first one of the multi-axis polarized RF antenna assembly and the second one of the multi-axis polarized RF antenna assembly to use for communication with the portable access device.
  • the portable access device is a key fob or a cellar phone.
  • each selected antenna pair includes one of the linear polarized antennas and one of the circular polarized antennas.
  • the estimated distance is used to detect whether another device is attempting to perform a range extender type relay station attack.
  • the method of claim 4 further includes, if the another device is attempting to perform a range extender type relay station attack, performing a countermeasure including preventing access to the interior of the vehicle.
  • the countermeasure includes notifying an owner of the vehicle of the range extender type relay station attack.
  • the method includes determining whether another device is attempting to perform a range extender type relay station attack based on the estimated distance.
  • the each selected antenna pair includes linear polarized antennas.
  • the algorithm includes switching between the possible antenna pairs between consecutively transmitted packets. In other features, the algorithm includes switching between the possible antenna pairs during transmission of a portion of a packet. In other features, the portion of the packet is a continuous wave tone.
  • the method further includes: transmitting packets to the portable access device; measuring time-of-flight values for the packets based on response signals received from the portable access device, where the response signals are transmitted based on the packets; based on the time-of-flight values, determining whether the another device is performing a range extender type relay station attack; and preventing access to an interior of the vehicle in response to detecting the range extender type relay station attack.
  • the portable access device is a key fob or a cellar phone.
  • the method further includes encrypting an identifier of the best antenna pair.
  • the transmission of the one or more additional packets includes the encrypted identifier of the best antenna pair.
  • a vehicle system for communicating with a portable access device includes antennas with different polarized axes and an access module.
  • the access module is configured to iteratively perform an algorithm.
  • the algorithm includes a series of operations including: selecting a frequency from multiple frequencies; selecting an antenna pair from the antennas with different polarized axes; transmitting a packet to the portable access device via the selected antenna pair; receiving a first RSSI and a response signal from the portable access device, where the first RSSI corresponds to the transmission of the packet; and measuring a second RSSI of the response signal.
  • the access module is configured to: based on the first RSSIs and the second RSSIs, select a best one of the frequencies and a best antenna pair of the antenna pairs; and transmit one or more additional packets using the selected best frequency and the selected best antenna pair.
  • the access module is configured to: exchange multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, where the unmodulated carrier tones include received tones and transmitted tones; measure the phases of the received tones relative to the transmitted tones; gather the measured phases and frequency data; and estimate distance between the vehicle and the portable access device using the measured phases and the frequency data.
  • the access module is configured to detect whether a device is attempting to perform a range extender type relay station attack based upon the estimated distance.
  • the access module is configured to, if the portable access device is attempting to perform a range extender type relay station attack, perform a countermeasure including preventing access to the interior of the vehicle.
  • the countermeasure includes notifying an owner of the vehicle of the range extender type relay station attack.
  • the portable access device is a key fob or a cellar phone.
  • the first module is implemented at the vehicle. In other features, the first module is implemented at the portable access device.
  • the first module is configured to: transmit a second radio frequency signal and receive a second response signal, prior to transmission of the first radio frequency signal and reception of the first response signal; monitor an antenna polarization status corresponding to at least one of the second radio frequency signal or the second response signal; and based on the antenna polarization status of the at least one of the first radio frequency signal or the first response signal, determine at least one of a path, a frequency, a channel, or an antenna pair for transmission of the first radio frequency signal and reception of the first response signal.
  • the first module is configured to receive the first response signal while receiving a second radio frequency signal from one of the vehicle and the portable access device.
  • the first module is configured to: randomize access addresses for the vehicle or the portable access device; share the randomized access addresses with the portable access device; and generate the first radio frequency signal to include one of the access addresses.
  • the first module is configured to: measure a length of at least one bit of the first response signal; and detect the range extension type relay attack based on the length of the at least one bit.
  • the first module is configured to: monitor slopes of the rising and falling edges of the first response signal; and detect the range extension type relay attack based on the slopes.
  • the countermeasure includes preventing at least one of access to or operation control of the vehicle.
  • system further includes a second transmitter configured to transmit a dummy signal while the first transmitter transmits the first radio frequency signal or the receiver receives the first response signal.
  • the system includes: the first module implemented at the vehicle; and the portable access device including a second module.
  • the first module is configured to transmit the first radio frequency signal to the portable access device and receive the first response signal from the portable access device.
  • the second module is configured to transmit a second radio frequency signal to the vehicle and receive a second response signal from the vehicle. At least one of the first module transmits the first radio frequency signal while the second module transmits the first response signal or the second radio frequency signal, or the first module receives the first response signal while the second module transmits the second radio frequency signal.
  • the first module and second module are configured to: exchange at least three pairs of radio signals containing sections of unmodulated carrier tones, where the unmodulated carrier tones include received tones and transmitted tones; and measure phases of the received tones relative to the transmit tones.
  • One or more of the first module and the second module is configured to: gather frequency and phase information; and estimate the distance between the first module and the second module based upon the phase and frequency information.
  • a method of detecting a range extension type relay attack includes: transmitting, via a transmitter, a radio frequency signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device; receiving, via a receiver, a response signal from one of the vehicle and the portable access device in response to the radio frequency signal; monitoring or generating one or more parameters associated with the transmission of the radio frequency signal and the reception of the response signal; and based on the one or more parameters, detecting the range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle.
  • At least one of (i) the radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle.
  • the method further includes: performing a countermeasure in response to detecting the range extension type relay attack; measuring a round trip time of the radio frequency signal; monitoring at least one of a first received signal strength indicator of the radio frequency signal or a second received signal strength indicator of the response signal; and based on the round trip time, detecting the range extension type relay attack.
  • a system for accessing or providing operational control of a vehicle includes a master device including: a first antenna module including first antennas with different polarized axes; a transmitter configured to transmit a challenge signal via the first antenna module from the vehicle to a slave device, where the slave device is a portable access device; and a first receiver configured to receive a response signal in response to the challenge signal from the slave device.
  • the system further includes a first sniffer device including: a second antenna module including second antennas with different polarized axes; and a second receiver configured to receive, via the second antenna module, the challenge signal from the transmitter and the response signal from the slave device.
  • the first sniffer device is configured to measure when the challenge signal and the response signal arrive at the first sniffer device to provide arrival times.
  • the master device or the first sniffer device is configured to (i) estimate at least one of a distance from the vehicle to the slave device or a location of the slave device relative to the vehicle based on the arrival times, and (ii) prevent at least one of access to or operation control of the vehicle based on the estimated at least one of the distance or the location.
  • the master device or the first sniffer device is configured to: determine a round trip time associated with the transmission of the challenge signal based on the arrival times; and based on the round trip time, detect a range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle.
  • the response signal is relayed by the attacking device from the slave device to the vehicle and altered by the attacking device.
  • the master device is configured to perform a countermeasure in response to detecting the range extension type relay attack.
  • At least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.
  • At least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.
  • the master device or the first sniffer device is configured to: determine a first amount of time for the first sniffer device to receive the challenge signal and a second amount of time for the sniffer device to receive the response signal; and based on the first amount of time and the second amount of time, estimate the distance.
  • the master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the arrival times provided by the first sniffer device, the arrival times provided by the second sniffer device, and the arrival times provided by the third sniffer device.
  • the first sniffer device is configured to determine a first amount of time for the first sniffer device to receive the response signal.
  • the second sniffer device is configured to determine a second amount of time for the second sniffer device to receive the response signal.
  • the third sniffer device is configured to determine a third amount of time for the third sniffer device to receive the response signal.
  • the master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the first amount of time, the second amount of time and the third amount of time.
  • the master device is configured to periodically send the challenge signal or other challenge signals to the slave device and receive respective response signals from the slave device.
  • the first sniffer device is configured to measure when the challenge signals and the response signals arrive at the first sniffer device to provide corresponding arrival times.
  • the master device or the first sniffer device is configured to (i) update the at least one of the distance or the location based on the arrival times associated with the challenge signals and the response signals, and (ii) prevent at least one of access to or operation control of the vehicle based on the at least one of the updated distance or the updated location.
  • a method for accessing or providing operational control of a vehicle includes: transmitting a challenge signal via a first antenna module from a master device of the vehicle to a slave device, where the first antenna module includes first antennas with different polarized axes; receiving at a first receiver a response signal in response to the challenge signal from the slave device; receiving at a first sniffer device, via a second antenna module and a second receiver, the challenge signal from the master device and the response signal from the slave device, where the second antenna module includes second antennas with different polarized axes; measuring when the challenge signal and the response signal are received at the first sniffer device to provide arrival times via the first sniffer device; estimating at least one of a distance from the vehicle to the slave device or a location of the slave device relative to the vehicle based on the arrival times; and preventing at least one of access to or operation control of the vehicle based on the estimated at least one of the distance or the location.
  • At least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.
  • At least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.
  • the method further includes: determining a first amount of time for the first sniffer device to receive the challenge signal and a second amount of time for the sniffer device to receive the response signal; and based on the first amount of time and the second amount of time, estimating the distance.
  • the method further includes: receiving at a third receiver of a second sniffer device, via a third antenna module, the challenge signal from the transmitter and the response signal from the slave device, where the third antenna module includes a third antennas with different polarized axes; and receiving at a fourth receiver of a third sniffer device, via a fourth antenna module, the challenge signal from the transmitter and the response signal from the slave device.
  • the fourth antenna module includes fourth antennas with different polarized axes.
  • the method further includes: measuring when the challenge signal and the response signal arrive at the second sniffer device to provide arrival times via the second sniffer device; measuring when the challenge signal and the response signal arrive at the third sniffer device to provide arrival times via the third sniffer device; and estimating the location based on the arrival times provided by the first sniffer device, the arrival times provided by the second sniffer device, and the arrival times provided by the third sniffer device.
  • the method further includes: determining a first amount of time for the first sniffer device to receive the response signal; determining a second amount of time for the second sniffer device to receive the response signal; determining a third amount of time for the third sniffer device to receive the response signal; and estimating the location based on the first amount of time, the second amount of time and the third amount of time.
  • a system for accessing or providing operational control of a vehicle includes a first network device and a control module.
  • the first network device includes a first antenna module, a transmitter and a receiver.
  • the first antenna module includes antennas with different polarized axes.
  • the transmitter is configured to transmit a series of tones via the first antenna module from the vehicle to a second network device and change the frequencies of the tones during the transmission of the series of tones.
  • at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device.
  • the receiver is configured to receive the series of tones from the second network device.
  • the control module is configured to (i) determine differences in phases of the series of tones versus differences in frequencies of the series of tones, (ii) based on the differences in the phases and the differences in the frequencies, determine a distance between the first network device and the second network device, and (iii) prevent at least one of access to or operation control of the vehicle based on the distance.
  • control module is configured to: for each of the tones, change a corresponding frequency during transmission of that tone; generate curves respectively for the tones relating changes in phases of each of the tones to changes in frequencies; determine slopes of the curves; and determine the distance based on the slopes of the curves.
  • control module randomizes a channel selected for the transmission of the series of tones.
  • control module randomizes a direction that tones are transmitted between the first network device and the second network device.
  • the tones include one or more of the tones in the series of tones.
  • control module is configured to: transmit and receive series of tones via the transmitter and the receiver; and based on differences in phases and corresponding differences in frequencies of the series of tones, determine the distance.
  • the system further includes the second network device.
  • the first network device includes a first tone exchange responder and a first tone exchange initiator.
  • the first tone exchange initiator includes the transmitter.
  • the first tone exchange responder includes the receiver.
  • the second network device includes a second tone exchange responder and a second tone exchange initiator.
  • the second tone exchange responder responds to the series of tones by transmitting the series of tones or a second series of tones back to the first tone exchange initiator.
  • the second tone exchange initiator transmits a third series of tones to the first tone exchange responder.
  • control module is configured to determine the distance based on at least one of (i) differences in phases of the second series of tones versus differences of frequencies of the second series of tones, or (ii) differences in phases of the third series of tones versus differences of frequencies of the third series of tones.
  • the first network device is implemented within the vehicle.
  • the second network device is a portable access device.
  • the first network device simultaneously transmits two symbols on two different frequencies to the second network device.
  • the two symbols are each less than or equal to 1 ps in length to prevent a successful attack.
  • clock timing of the first network device and the second network device are synchronized.
  • the first network device transmits a first symbol to the second network device on a first frequency.
  • the second network device transmits a second symbol to the first network device simultaneously with the transmission of the first symbol by the first network device to the second network device.
  • the first symbol and the second symbol are each less than or equal to 1 ps in length to prevent a successful attack.
  • a method of accessing or providing operational control of a vehicle includes: transmitting a series of tones from a first network device via a transmitter and a first antenna module to a second network device and change the frequencies of the tones during the transmission of the series of tones, where the first antenna module including antennas, and where, at any moment in time, at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device; receiving at a receiver in the vehicle the series of tones from the second network device; determining differences in phases of the series of tones versus differences in frequencies of the series of tones; based on the differences in the phases and the differences in the frequencies, determining a distance between the first network device and the second network device; and preventing at least one of access to or operation control of the vehicle based on the distance.
  • the method further includes: for each of the tones, changing a corresponding frequency during transmission of that tone; generating curves respectively for the tones relating changes in phases of each of the tones to changes in frequencies; determining slopes of the curves; and determining the distance based on the slopes of the curves.
  • the method further includes randomizing a channel selected for the transmission of the series of tones.
  • the method further includes randomizing a direction that tones are transmitted between the first network device and the second network device.
  • the tones include one or more of the tones in the series of tones.
  • the method further includes: transmitting and receiving a series of tones via the transmitter and the receiver; and based on differences in phases and corresponding differences in frequencies of the series of tones, determining the distance.
  • the method further includes: responding to the series of tones via a second tone exchange responder of the second network device by transmitting the series of tones or a second series of tones back to a first tone exchange initiator of the first network device, where the first tone exchange initiator includes the transmitter; and transmitting a third series of tones via a second tone exchange initiator of the second network device to a first tone exchange responder of the first network device, where the first tone exchange responder includes the receiver.
  • the method further includes determining the distance based on at least one of (i) differences in phases of the second series of tones versus differences of frequencies of the second series of tones, or (ii) differences in phases of the third series of tones versus differences of frequencies of the third series of tones.
  • the first network device is implemented in the vehicle.
  • the second network device is a portable access device.
  • a system for accessing or providing operational control of a vehicle includes an initiator device and a sniffer device.
  • the initiator device includes: a first antenna module including multiple polarized antennas; a transmitter configured to transmit a first tone signal via the first antenna module from the vehicle to a responder device, where the responder device is a portable access device; a first receiver configured to receive a second tone signal from the responder device in response to the first tone signal.
  • the sniffer device includes: a second antenna module including multiple polarized antennas; and a second receiver configured to receive, via the second antenna module, the first tone signal from the transmitter and the second tone signal from the responder device.
  • the sniffer device is configured to determine states of the first tone signal and the second tone signal including respective phase delays.
  • the initiator device or the sniffer device is configured to (i) estimate at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the first tone signal and the second tone signal including respective phase delays, and (ii) prevent at least one of access to or operation control of the vehicle based on the estimated at least one of the first distance or the second distance.
  • the initiator device or the sniffer device is configured to based on at least one of the first distance or the second distance, detect a range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle.
  • the second tone signal is relayed from the responder device to the vehicle and altered by the attacking device.
  • the initiator device is configured to perform a countermeasure in response to detecting the range extension type relay attack.
  • At least one of the multiple polarized antennas of the first antenna module is not cross-polarized with at least one of the multiple polarized antennas of the second antenna module.
  • at least one of the multiple polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.
  • the initiator device or the sniffer device is configured to: generate a first representation of the first tone signal when received at the responder device in natural logarithmic form; generate a second representation of the first tone signal when received at the sniffer device in natural logarithmic form; generate a third representation of the second tone signal when received at the sniffer device in natural logarithmic form; and based on the first representation, the second representation and the third representation, estimate the first distance and the second distance.
  • a method for accessing or providing operational control of a vehicle includes: transmitting a first tone signal via a first antenna module from an initiator device of the vehicle to a responder device, where the first antenna module including multiple polarized antennas, and where the responder device is a portable access device; receiving at the initiator device a second tone signal from the responder device in response to the first tone signal; receiving at a sniffer device and via a second antenna module, the first tone signal from the transmitter and the second tone signal from the responder device, where the second antenna module including multiple polarized antennas; determining at the sniffer device states of the first tone signal and the second tone signal including respective phase delays; estimating at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the first tone signal and the second tone signal including respective phase delays; and preventing at least one of access to or operation control of the vehicle based on the estimated at least one of the first
  • At least one of the multiple polarized antennas of the first antenna module is not cross-polarized with at least one of the linear polarized antenna or the multiple polarized antennas.
  • the method further includes: based on the state of the first tone signal when received at the responder device, determining a first amount of time for the first tone signal to travel from the initiator device to the responder device; based on the state of the second tone signal when received at the sniffer device, determining a second amount of time for the second tone signal to travel from the responder device to the sniffer device; and based on the first amount of time and the second amount of time, estimating the first distance and the second distance.
  • a system for accessing or providing operational control of a vehicle includes a first network device and a control module.
  • the first network device includes a first antenna module and a control module.
  • the first antenna module includes multiple polarized antennas; a transmitter configured to transmit an initiator packet via the first antenna module from the vehicle to a second network device, where the initiator packet includes a synchronization access word and a first continuous wave (CW) tone, where one of the first network device and the second network device is implemented within the vehicle, and where the other one of the first network device and the second network device is a portable access device, and where, at any moment in time, at least one of the multiple polarized antennas of the first antenna module is not cross-polarized with an antenna of the second network device; and a receiver configured to receive a response packet from the second network device, where the response packet includes the synchronization access word and the first CW tone.
  • CW continuous wave
  • the control module is configured to (i) determine a difference in round trip timing between the initiator packet and the response packet to be greater than a predetermined threshold, (ii) based on difference in timing being greater than the predetermined threshold, detect a range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle, and (iii) in response to detecting the range extension type relay attack, prevent at least one of access to or operation control of the vehicle.
  • control module is configured to: determine a first length of the synchronization access word of the initiator packet; compare the first length to a second length of the synchronization access word of the response packet; and if a difference between the first length is more than a predetermined amount different than the second length, detect the range extension type relay attack.
  • control module is configured to: determine a first length of the first CW tone of the initiator packet; compare the first length to a second length of the first CW tone of the response packet; and if a difference between the first length is more than a predetermined amount different than the second length, detect the range extension type relay attack.
  • the first CW tone of the initiator packet is at an end of the initiator packet; and the first CW tone of the response packet is at a beginning of the response packet.
  • the initiator packet includes a second CW tone.
  • the response packet includes the second CW tone.
  • the initiator packet and the response packet have a same format.
  • the response packet indicates an amount of phase difference between the second CW tone of the initiator packet and the first CW tone of the response packet.
  • the first CW tone of the response packet is in a phase relationship with a phase locked loop of the responder.
  • control module is configured to determine the phase difference between the first CW tone of the response packet and the second CW tone of the initiator packet.
  • the second CW tone of the initiator packet is in a phase relationship with a phase locked loop of the initiator.
  • the first device and second device are configured to determine a phase difference for a second frequency and a phase difference for a third frequency.
  • the control module is configured to determine a distance between the devices based on (i) the phase difference between the first CW tone and the second CW tone, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency.
  • control module is configured to compare a frequency, power levels, bits and amplitudes of a portion of a received signal including the response packet to a frequency, power levels, bits and amplitudes of a portion of a transmitted signal including the initiator packet, and based on resultant differences, determine if the range extension type relay attack has occurred.
  • the first CW tone of the initiator packet is at an end of the initiator packet; and the first CW tone of the response packet is at a beginning of the response packet.
  • the initiator packet includes a second CW tone.
  • the response packet includes the second CW tone.
  • the first CW tone of the initiator packet is at a beginning of the initiator packet.
  • the second CW tone of the initiator packet is at an end of the initiator packet.
  • the first CW tone of the response packet is at a beginning of the response packet.
  • the second CW tone of the response packet is at an end of the response packet.
  • the method further includes determining a round trip time of the initiator packet based on an amount of phase delay.
  • the response packet indicates the amount of phase delay between the first CW tone of the initiator packet and the first CW tone of the response packet.
  • a system for detecting a range extension type relay attack includes a transmitter, a receiver and a control module.
  • the transmitter is configured to transmit a radio frequency signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device.
  • the receiver is configured to receive a response signal from one of the vehicle and the portable access device in response to the radio frequency signal.
  • the control module is configured to: convert the response signal to an in-phase signal and a quadrature- phase signal; based on the radio frequency signal, the in-phase signal and the quadrature-phase signal, detect the range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle, where at least one of (i) the radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle; and perform a countermeasure in response to detecting the range extension type relay attack.
  • the system further includes an antenna module.
  • the antenna module is implemented at the one of the vehicle and the portable access device where the transmitter and the receiver are implemented.
  • the antenna module includes multiple polarized antennas. At any moment in time, at least one of the multiple polarized antennas of the antenna module is not cross-polarized with an antenna of the other one of the vehicle and the portable access device.
  • control module is implemented at the vehicle. In other features, the control module is implemented at the portable access device.
  • control module is configured to: determine a difference in phase based on the in-phase signal and the quadrature-phase signal; measure a round trip time of the radio frequency signal based on the difference in phase; and based on the round trip time, detect the range extension type relay attack.
  • control module is configured to: up-sample the received bits on the in-phase signal and the quadrature-phase signal; up-sample another signal; cross-correlate results of the up-sampling the received bits based on the in-phase signal and the quadrature-phase signal with results of up-sampling the another signal; and determine the phase based on the results of the cross-correlation.
  • the another signal includes a reference bit pattern.
  • the control module is configured to determine a sign of the differentiated arctangent signal, and based on the sign generate the reference bit pattern.
  • the another signal includes the radio frequency signal after being filtered via a Gaussian low pass filter.
  • a method for detecting a range extension type relay attack includes: transmitting via a transmitter a radio frequency signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device; receiving a response signal via a receiver from one of the vehicle and the portable access device in response to the radio frequency signal; converting via a control module the response signal to an in-phase signal and a quadrature-phase signal; based on the radio frequency signal, the in-phase signal and the quadrature-phase signal, detecting via the control module the range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle, where at least one of (i) the radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle; and performing a countermeasure in response to detecting the range extension type relay attack.
  • an antenna module is implemented at the one of the vehicle and the portable access device where the transmitter and the receiver are implemented.
  • the antenna module includes multiple polarized antennas. At any moment in time, at least one of the multiple polarized antennas of the antenna module is not cross-polarized with an antenna of the other one of the vehicle and the portable access device.
  • control module is implemented at the vehicle. In other features, the control module is implemented at the portable access device.
  • the method further includes: determining a difference in phase based on the in-phase signal and the quadrature-phase signal; measuring a round trip time of the radio frequency signal based on the difference in phase; and based on the round trip time, detecting the range extension type relay attack.
  • the method further includes: sampling the in-phase signal and the quadrature-phase signal; and determining received bits based on the in-phase signal and the quadrature-phase signal.
  • the method further includes: up-sampling the received bits based on the in-phase signal and the quadrature-phase signal; cross-correlating results of the up-sampling the received bit with results of up-sampling the another signal; and determining the phase based on the results of the cross-correlation.
  • the another signal includes a reference bit pattern.
  • the another signal includes the radio frequency signal after being filtered via a Gaussian low pass filter.
  • FIG. 2 is a functional block diagram of an example of a vehicle access system including an access module, RF antennas, and portable access devices in accordance with an embodiment of the present disclosure
  • FIG. 3 is a functional block diagram of an example of a vehicle including the access module of FIG. 2 in accordance with an embodiment of the present disclosure
  • FIG. 4 is a functional block diagram of an example of the access module of FIG. 2 in accordance with an embodiment of the present disclosure
  • FIG. 5 is a functional block diagram of an example of a RF antenna module of a vehicle in accordance with an embodiment of the present disclosure
  • FIG. 6 is a functional block diagram of an example of a portable network device in accordance with an embodiment of the present disclosure
  • FIG. 7 is an example of a polarization axes diagram illustrating a polarization diversity example arrangement in accordance with an embodiment of the present disclosure
  • FIG. 8 is an example of a polarization axes diagram illustrating another polarization diversity example arrangement in accordance with an embodiment of the present disclosure
  • FIG. 9 is an example electric field diagram and polar coordinate plot illustrating electric field patterns and nulls for a linear antenna
  • FIG. 10 is an example voltage versus electric field diagram for a linearly polarized antenna
  • FIG. 1 1 A is a top perspective view of an example of at least a portion of a multi axis polarized RF antenna assembly including a linear polarized antenna and a circular polarized antenna in accordance with an embodiment of the present disclosure
  • FIG. 1 1 B is a bottom perspective view of the at least a portion of the multi-axis polarized RF antenna assembly of FIG. 1 1 A;
  • FIG. 12 is an example polar coordinate plot of radiated power associated with the linear polarized antenna of FIGs. 1 1 A-B;
  • FIG. 13 is an example polar coordinate plot of radiated power associated with the circular polarized antenna of FIGs. 11 A-B;
  • FIG. 14 is a functional block diagram of an example of RF circuits and a portion of a portable access device in accordance with an embodiment of the present disclosure
  • FIG. 15 is a block diagram of an example of a portion of a key fob having two linear polarized slot antennas, metal trim and a spare key in accordance with an embodiment of the present disclosure
  • FIG. 16 is a block diagram of an example of a portion of the key fob of FIG. 15 without metal trim and a spare key having an x-axis linear polarized slot antenna and a y-axis linear polarized slot antenna;
  • FIG. 19 is an example of return loss versus frequency plot for the linear polarized slot antennas of FIG. 16;
  • FIG. 20 is a block diagram of an example of a portion of the key fob of FIG. 15 without metal trim and including the spare key;
  • FIG. 21 is an example polar coordinate plot of radiated power associated with a x-axis linear polarized slot antenna of the portion of the key fob of FIG. 20;
  • FIG. 22 is an example polar coordinate plot of radiated power associated with a y-axis linear polarized slot antenna of the portion of the key fob of FIG. 20;
  • FIG. 24 is a block diagram of an example of a portion of the key fob of FIG. 15 with a portion of the metal trim and the spare key;
  • FIG. 25 is an example polar coordinate plot of radiated power associated with a x-axis linear polarized slot antenna of the portion of the key fob of FIG. 24;
  • FIG. 26 is an example polar coordinate plot of radiated power associated with a y-axis linear polarized slot antenna of the portion of the key fob of FIG. 24;
  • FIG. 27 is an example of return loss versus frequency plot for the linear polarized slot antennas of FIG. 24;
  • FIG. 28 is an example polar coordinate plot of radiated power associated with a x-axis linear polarized slot antenna of the portion of the key fob of FIG. 15;
  • FIG. 29 is an example polar coordinate plot of radiated power associated with a y-axis linear polarized slot antenna of the portion of the key fob of FIG. 15;
  • FIG. 30 is an example of a return loss versus frequency plot for the linear polarized slot antennas of FIG. 15;
  • FIG. 31 is a block diagram of an example of a portion of a key fob having a closed linear polarized slot antenna, an open linear polarized slot antenna, metal trim and a spare key in accordance with an embodiment of the present disclosure
  • FIG. 32 is an example polar coordinate plot of radiated power associated with a x-axis linear polarized slot antenna of the portion of the key fob of FIG. 31 ;
  • FIG. 33 is an example polar coordinate plot of radiated power associated with a y-axis linear polarized slot antenna of the portion of the key fob of FIG. 31 ;
  • FIG. 35 illustrates a method of determining which antenna combination to use for exchanging packets between RF antenna modules of a vehicle and a portable access device for round trip time-of-flight measurements in accordance with an embodiment of the present disclosure
  • FIG. 36 illustrates another method of determining which antenna combination to use for exchanging packets between RF antenna modules of a vehicle and a portable access device for round trip time-of-flight measurements in accordance with an embodiment of the present disclosure
  • FIG. 37 is a time-of-flight measurement diagram
  • FIG. 38 is a functional block diagram of an example BLE radio with a superheterodyne receiver and a transmitter in accordance with an embodiment of the present disclosure
  • FIG. 42 is an example plot of BLE packet signals illustrating corresponding bits
  • FIG. 51 is a functional block diagram of an example location and distance determination system including multiple round trip time sniffers in accordance with an embodiment of the present disclosure
  • FIG. 61 is a functional block diagram of an antenna path determining system for network devices having respective antenna modules in accordance with another embodiment of the present disclosure
  • FIG. 73 is an example plot of eigenvectors and an array manifold response in accordance with the present disclosure
  • FIG. 74 is another example plot of eigenvectors and an array manifold response in accordance with the present disclosure.
  • FIG. 75 is an example music power spectrum plot in accordance with the present disclosure.
  • FIG. 76 is a functional block diagram of an antenna selection system in accordance with the present disclosure.
  • FIG. 77 illustrate an example reconstruction method in accordance with the present disclosure
  • FIG. 79A is a top view of a vehicle illustrating another example placement of a sensor in accordance with the present disclosure
  • FIG. 79B is a side view of the vehicle of FIG. 79A.
  • RF devices that measure distance by round trip timing may be subject to early detect and late commit attacks as described in “Attacks on Time-of-Flight Distance Bounding Channels” by Flancke and Kuhn in proceedings of the first ACM conference on Wireless network security (WiSec ⁇ 8), which is also incorporated herein by reference.
  • RF devices that measure distance by unmodulated carrier tone exchange can be subject to signal delay rollover attacks described in“On the Security of Carrier Phase-based Ranging” by Olafsdotter, Ranganathan, and Capkun from IACR Cryptology ePrint Archive 2016, which is also incorporated herein by reference.
  • a range extender type relay station attack may refer to an attacker using a relay device to detect, amplify and relay signals between a key fob (or other smart portable network device) and a vehicle, such that an access module of the vehicle operates as if the key fob has approached and is in close proximity to the vehicle.
  • the attacker for example, touches a door handle of the vehicle by hand and/or with the relay device, the access module may generate and transmit a LF wake- up signal.
  • the relay device in effect is detected and the access module transmits the LF wake-up signal to the key fob, which is received at the relay device.
  • the relay device receives, amplifies and forwards (or rebroadcast) the LF wake-up signal to the actual key fob.
  • the key fob may be, for example, located within a residential home, whereas the vehicle may be parked outside or in front of the residential home.
  • the key fob may receive the amplified wake-up signal and generate a response signal and/or begin communicating on an RF link.
  • the response signal and/or RF communication signals are amplified and relayed between antennas on the vehicle and one or more antennas of the key fob. This may be done via the relay device.
  • the relay device is seen by the access module as being the key fob and“tricks” the access module into operating as if the key fob was in the location of the relay device, which causes the access module to provide unauthorized access to the interior of the vehicle.
  • antenna systems of current PEPS systems may prevent the PEPS system from accurately estimating the distance between the key fob and the vehicle and accurately estimating the location of the key fob relative to the vehicle as further described below.
  • the distance and location may be determined based on a time-of-flight measurement. Time-of-flight and corresponding received signal strengths are measured.
  • a received signal strength indicator (RSSI) having the largest magnitude typically corresponds to a direct or shortest distance between the key fob and the vehicle.
  • a time-of-flight measurement associated with the largest RSSI is used to calculate the distance between the key fob and the vehicle.
  • the examples set forth herein include combined LF and RF PEPS key fob that uses RF round trip timing (RTT) measurements to prevent range extender type relay station attacks.
  • Other examples include RTT measurements, carrier phase based ranging, and a combination of RTT measurements and carrier phase based ranging in PEPS systems.
  • RTT round trip timing
  • FIG. 1 shows an example of when cross-polarization of antennas can cause an inaccurate distance determination between a first RF antenna of a key fob and a second RF antenna of a vehicle. If the first RF antenna of the key fob is disposed relative to the second RF antenna of the vehicle, such that the first RF antenna is cross-polarized with the second RF antenna, the distance determined corresponds to a bounce path rather than a direct path.
  • the antennas are cross-polarized, for example, when polarizations of the antennas are perpendicular to each other. An example of this is shown in FIG. 1.
  • Aligning the nulls in a co-polarized antenna arrangement also causes a bounce path to be used. This occurs when the first and second RF antennas are pointed in the same direction.
  • the antennas may be positioned such that a line extends longitudinally through the antennas. This is further described with respect to FIGs. 9-10.
  • the vehicle 30 includes an access module 36, LF antenna modules 38, and RF antenna modules 40.
  • the access module 36 may wirelessly transmit LF signals via the LF antenna modules 38 to the portable network devices and may wireless communicate with the portable access devices via the RF antenna modules 40.
  • the RF antenna modules 40 provide polarization diversity between each of the antennas of the portable network devices and the antennas of the RF antenna modules 40. Polarization diversity as further described below provides a minimum number, combination and arrangement of polarization axes at the portable network devices and the vehicle 30 to assure, at any moment in time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized with a polarization axis of at least one receiving antenna.
  • the access module 36 may communicate with the LF antenna modules 38 and the RF antenna modules 40 wirelessly and/or via a vehicle interface 45.
  • the vehicle interface 45 may include a controller area network (CAN) bus, a local interconnect network (LIN) for lower data-rate communication, a clock extension peripheral interface (CXPI) bus and/or one or more other vehicle interfaces.
  • CAN controller area network
  • LIN local interconnect network
  • CXPI clock extension peripheral interface
  • the LF antenna modules 38 may be at various locations on the vehicle and transmit low frequency signals (e.g., 125 kHz signals). Each of the LF antenna modules includes an LF antenna and may include a control module and/or other circuitry for LF signal transmission.
  • the RF antenna modules 40 may also be located at various locations on the vehicle and transmit RF signals, such as Bluetooth low energy (BLE) signals according to BLE communication protocols. Alternatively, the RF antenna modules 40 may communicate according to other wireless communication protocols, such as wireless fidelity (Wi-Fi).
  • An example of the antennas is shown in FIG. 1 1 (referring to collectively FIGs. 1 1 A and 1 1 B).
  • FIGs. 65-67 illustrate some other example antenna implementations.
  • FIGs. 65-67 include fewer antennas and antenna polarizations, which are used to measure or bound distances when a diverse set of frequencies and/or RF channels are used to measure or bound distances and/or reflections off metal in a vehicle. This is done to create virtual polarization diversity.
  • the antenna systems are able to tolerate some rate of false measurement due to cross-polarization and/or alignment of nulls. In FIGs.
  • Numerical designator 7200 refers to an open three-sided metal box and/or a simplified representation of a vehicle body for RF radio waves in a giga-hertz or multi-giga-hertz range.
  • Numerical designator 7201 refers to a metal plate and/or a lid to the box and/or a simplified representation of the roof of a vehicle for RF radio waves in a giga-hertz or multi-giga-hertz range.
  • FIGs 66 and 67 may also be viewed upside down where 7200 is a simplified representation of the open concave shape of the roof of a vehicle and 7201 is a simplified representation of the floor of a vehicle.
  • the RF connection along RF path 7101 AB, between 7100A and 7100B is strong because both pairs of antenna axis between the antenna axis assemblies are co-polarized. For arbitrarily oriented pairs of two axis antennas, this condition is rare, even when the co-polarized zones are wide, perhaps 5 degrees out of 90 degrees of rotation, at perhaps 6dB up in link margin from the median link margin. This is because it takes three angular rotations to manipulate an arbitrarily oriented antenna axis assembly pair into this configuration and because the antenna axes are symmetrical every 90 degrees, which will happen arbitrarily about (5/90) * (5/90) * (5/90), or 1.71 E-4, portion of the time.
  • the RF connection along RF path 7101 CD is not as strong as 7101 AB, but is good because no antenna path is co polarized or cross-polarized and the nulls are not aligned.
  • the RF connection along RF path 7101 EF is weak because each antenna path between individual antenna axis is either cross polarized or involves the null of at least one antenna. This condition is rare, because again, it takes 3 angular rotations to manipulate a pair of arbitrarily oriented antenna axis pairs into this configuration.
  • the more antenna axes on each side of a connection the lower the probability that a low link margin direct path will occur. Preventing or reducing the probability of low link margin direct paths is beneficial because round trip timing ranging and unmodulated carrier tone exchange ranging tends to measure the direct path greater the link margin in the direct path is relative to reflected paths. Conversely, the lower the link margin in the direct path is relative to the reflected paths, the more likely the ranging techniques are to measure the distance along the reflected path.
  • the range measured between 7100G and 7100H along the reflected paths or shorter direct paths will set a comparison bound indicating that 7100G, which may be part of the portable device is within a distance threshold of 7100H.
  • 7100H may be part of the PEPS module 21 1 or PAKM module 212.
  • These distance ranging measurements between a pair of 7100 modules may be taken and may be compared to be less than a bound.
  • the measurements, distance and/or results of the comparisons may be used as part of “if-then-else” comparisons in a software decision tree to indicate that the portable access device 400 is within an approach zone, an unlock zone and/or a mobilization zone of a vehicle.
  • Different polarizations of antennas may be used to create polarization diversity.
  • Multiple polarized antennas create polarizing diversity.
  • a linear axis and another linear axis, a linear axis and two linear axes including a circular polarize antenna, or three independent linear axes (linear polarized antennas) are all possible. Especially if there is nearby metal to create virtual polarization diversity.
  • the PAK system 202 may further include: a memory 218; a display 220; an audio system 221 ; and one or more transceivers 222 including the LF antenna modules 38 and the RF antenna modules 40.
  • the RF antenna modules 40 may include and/or be connected to RF circuits 223.
  • the PAK system 202 may further include: a telematics module 225; sensors 226; and a navigation system 227 including a global positioning system (GPS) receiver 228.
  • the RF circuits 223 may be used to communicate with a mobile device (e.g., the mobile device 102 of FIG. 1 ) including transmission of Bluetooth® signals at 2.4 giga-Flertz (GFIz).
  • the RF circuits 223 may include BLE radios, transmitters, receivers, etc. for transmitting and receiving RF signals.
  • the access application may implement a Bluetooth® protocol stack that is configured to provide a channel map, access identifier, next channel, and a time for a next channel.
  • the access application is configured to output timing signals for timestamps for signals transmitted and received via the RF antenna modules 40.
  • the access application may obtain channel map information and timing information and share this information with other modules in the vehicle.
  • the telematics module 225 may communicate with a server via a cell tower station. This may include the transfer of certificates, license information, and/or timing information including global clock timing information.
  • the telematics module 225 is configured to generate location information and/or error of location information associated with the vehicle 200.
  • the telematics module 225 may be implemented by a navigation system 227.
  • the sensors 226 may include sensors used for PEPS and PAK operations, cameras, objection detection sensors, temperature sensors, accelerometers, vehicle velocity sensor, and/or other sensors.
  • the sensors 226 may include a touch sensor to detect, for example, a person touching a door handle to initiate a process of waking up a portable access device.
  • the sensors 226 may be connected to the other control modules 208, such as the body control module, which may be in communication with LF and RF antenna circuits and/or modules disclosed herein.
  • the GPS receiver 228 may provide vehicle velocity and/or direction (or heading) of the vehicle and/or global clock timing information.
  • the memory 218 may store sensor data and/or parameters 230, certificates 232, connection information 234, timing information 236, tokens 237, keys 238, and applications 239.
  • the applications 239 may include applications executed by the modules 38, 40, 204, 206, 208, 210, 211 , 212, 223 and/or transceivers 222.
  • the applications may include the access application, a PEPS application and/or a PAK application executed by the transceivers 222 and the modules 210, 21 1 , and/or 212.
  • the memory 218 and the vehicle control module 204 are shown as separate devices, the memory 218 and the vehicle control module 204 may be implemented as a single device. The single device may include one or more other devices shown in FIG. 2.
  • the vehicle control module 204 may control operation of an engine 240, a converter/generator 242, a transmission 244, a window/door system 250, a lighting system 252, a seating system 254, a mirror system 256, a brake system 258, electric motors 260 and/or a steering system 262 according to parameters set by the modules 204, 206, 208, 210, 21 1 , 212, 213.
  • the vehicle control module 204 may perform PEPS and/or PAK operations, which may include setting some of the parameters.
  • the PEPS and PAK operations may be based on signals received from the sensors 226 and/or transceivers 222.
  • the vehicle control module 204 may receive power from a power source 264 which may be provided to the engine 240, the converter/generator 242, the transmission 244, the window/door system 250, the lighting system 252, the seating system 254, the mirror system 256, the brake system 258, the electric motors 260 and/or the steering system 262, etc.
  • Some of the PEPS and PAK operations may include unlocking doors of the window/door system 250, enabling fuel and spark of the engine 240, starting the electric motors 260, powering any of the systems 250, 252, 254, 256, 258, 262, and/or performing other operations as are further described herein.
  • the access module 210 includes the PEPS module 21 1 , the PAK module 212, the parameter adjustment module 213 and may further include a link authentication module 300, a connection information distribution module 302, a timing control module 304, a sensor processing and localization module 306, a data management module 308 and a security filtering module 310.
  • the PAK module 212 may include a RTC 312 that maintains a local clock time.
  • the link authentication module 300 may authenticate the portable access devices of FIG. 2 and establish the secure communication link.
  • the link authentication module 300 can be configured to implement challenge-response authentication or other cryptographic verification algorithms in order to authenticate the portable access devices.
  • the connection information distribution module 302 is configured to communicate with some of the sensors 226 of FIG. 3 and to provide the sensors with communication information necessary for the sensors to find and then follow, or eavesdrop on, the secure communication link. This may occur once the sensors are synchronized with a communication gateway, which may be included in or implemented by one of the transceivers 222.
  • the vehicle 200 and/or the PAK system 202 may include any number of sensors disposed anywhere on the vehicle 200 for detecting and monitoring mobile devices.
  • the connection information distribution module 302 is configured to obtain information corresponding to communication channels and channel switching parameters of a communication link and transmit the information to the sensors 226. In response to the sensors 226 receiving the information from the connection information distribution module 302 via the vehicle interface 45 and the sensors 226 being synchronized with the communication gateway, the sensors 226 may locate and follow, or eavesdrop on, the communication link.
  • the timing control module 304 may: maintain the RTC and/or currently stored date if not handled by the PAK module 212; disseminate current timing information with the sensors; generate timestamps for incoming and outgoing messages, requests, signals, certificates, and/or other items; calculate round trip times; etc.
  • a round trip time may refer to the amount between when a request is generated and/or transmitted and a time when a response to the request is received.
  • the timing control module 304 may obtain timing information corresponding to a communication link when the link authentication module 300 executes challenge-response authentication.
  • the timing control module 302 is also configured to provide the timing information to the sensors 226 via the vehicle interface 209.
  • the data management module 308 collects the current location of the vehicle 108 from the telematics module 225 and shares the location with the portable access devices.
  • the portable access devices optionally include GPS modules and application software that when executed compares the estimated relative locations of the portable access devices to the vehicle 108. Based on the estimated positions of the portable access devices relative to the vehicle 108, the portable access devices can send signals to one of the transceivers 222 requesting the vehicle to perform certain actions.
  • the data management layer 308 is configured obtain vehicle information obtained by any of the modules (e.g., location information obtained by a telematics module 225) and transmit the vehicle information to the portable access devices.
  • the security filtering module 310 detects violations of a physical layer and protocol and filter data accordingly before providing information to the sensor processing and localization module 306.
  • the security filtering module 310 flags data as injected such that the sensor processing and localization module 306 is able to discard data and alert the PEPS module 21 1.
  • the data from the sensor processing and localization module 306 is passed along to the PEPS module 21 1 , whereby the PEPS module 21 1 is configured to read vehicle state information from the sensors in order to detect user intent to access a feature and to compare the location of the mobile device 102 to a set of locations that authorize certain vehicle features, such as unlocking a door or trunk of the vehicle and/or starting the vehicle.
  • FIG. 5 is a functional block diagram of the RF antenna module 40, which includes a control module 350 connected to a multi-axis polarized RF antenna assembly 352.
  • the multi-axis polarized RF antenna assembly 352 may include a linear polarized antenna, other linear polarized antennas and/or a circular polarized antenna (e.g., a right-hand circular polarized antenna or a left-hand circular polarized antenna).
  • An example of the multi-axis polarized RF antennas is shown in FIG. 11.
  • the control module 350 may include or be part of a BLE communication chipset. Alternatively, the control module 350 may include or be part of a Wi-Fi or Wi-Fi direct communication chipset.
  • the multi-axis polarized RF antenna assembly 352 may be included as part of the RF antenna module 40 or may be located remotely from the control module 350. Some or all of the operations of the control module 350 may be implemented by one or more of the modules 204, 210, 21 1 , 212 of FIG. 3.
  • the control module 350 may establish a secure communication connection with a portable access device (e.g., one of the portable access devices 32, 34 of FIG. 2).
  • a portable access device e.g., one of the portable access devices 32, 34 of FIG. 2.
  • the control module 350 may establish a secure communication connection using the BLE communication protocol this may include transmitting and/or receiving timing and synchronization information.
  • the timing and synchronization information may include information directed to the secure communication connection, such as timing of next communication connection events, timing intervals between communication connection events, communication channels for next communication connection events, a channel map, a channel hop interval or offset, communication latency information, communication jitter information, etc.
  • the control module 350 may detect (or “eavesdrop”) packets sent by the portable access device to the vehicle control module 204 and measure signal information of the signals received from the portable access device.
  • the channel hop interval or offset may be used to calculate a channel for a subsequent communication connection event.
  • the control module 350 may measure a received signal strength of a signal received from the portable access device and generate a corresponding RSSI value. Additionally or alternatively, the control module 350 may take other measurements of received signals from the portable access device, such as an angle of arrival, a time of arrival, a time difference of arrival, etc. The control module 350 may then send the measured information to the vehicle control module 204, which may then determine a location of and/or distance to the portable access device relative to the vehicle 30 based on the measured information. The location and distance determinations may be based on similar information received from one or more other RF antenna modules and/or other sensors.
  • the vehicle control module 204 may determine the location of the portable access device based on, for example, the patterns of the RSSI values corresponding to signals received from the portable access device by the RF antenna modules 40.
  • a strong (or high) RSSI value indicates that the portable access device is close to the vehicle 30 and a weak (or low) RSSI value indicates that the portable access device is further away from the vehicle 30.
  • the control module 204 may determine a location of and/or a distance to the portable access device relative to the vehicle 30.
  • angle of arrival, angle of departure, round trip timing, unmodulated carrier tone exchange, or time difference of arrival measurements for the signals sent between the portable access device and the control module 204 may also be used by the control module 204 or the portable access device to determine the location of the portable access device. Additionally or alternatively, the RF antenna modules 40 may determine the location of and/or distance to the portable access device based on the measured information and communicate the location or distance to the control module 204.
  • the modules 21 1 , 212 of FIG. 3 may then authorize and/or perform a vehicle function, such as unlocking a door of the vehicle 30, unlocking a trunk of the vehicle 30, starting the vehicle 30, and/or allowing the vehicle 30 to be started.
  • a vehicle function such as unlocking a door of the vehicle 30, unlocking a trunk of the vehicle 30, starting the vehicle 30, and/or allowing the vehicle 30 to be started.
  • the portable access device is less than a first predetermined distance from the vehicle 30, the modules 21 1 , 212 may activate interior or exterior lights of the vehicle 30. If the portable access device is less than a second predetermined distance from the vehicle 30, the modules 21 1 , 212 may unlock doors or a trunk of the vehicle 30. If the portable access device is located inside of the vehicle 30, the modules 211 , 212 may allow the vehicle 30 to be started.
  • the control module 350 may include a physical layer (PHY) module 356, a medium access control (MAC) module 358, a time synchronization module 360 and a channel map reconstruction module 362.
  • the PHY module 356 receives BLE signals via the multi-axis polarized RF antenna assembly 352.
  • the control module 350 may monitor received BLE physical layer messages and obtain measurements of physical properties of the corresponding signals, including, for example, the received signal strengths using a channel map that is produced by the channel map reconstruction module 362.
  • the control module 350 may communicate with the control modules of other RF antenna modules and/or the modules 204, 210, 21 1 , 212 via the vehicle interface 45 to determine time differences of arrival, time of arrival, angle of arrival and/or other timing information.
  • the control module 350 includes a portion of the RF circuits 223 of FIG. 3.
  • a time synchronization module 360 is configured to accurately measure the reception times of signals/messages on the vehicle interface 45.
  • the control module 350 may tune the PHY module 356 to a specific channel at a specific time based on the channel map information and the reception times and/or other timing information. Furthermore, the control module may monitor received PHY messages and data that conform to a Bluetooth® physical layer specification, such as Bluetooth® Specification version 5.1. The data, timestamps, and measured signal strengths may be reported by the control module 350 to the control module 204 via the vehicle interface 45.
  • FIG. 7 shows a polarization axes diagram illustrating a polarization diversity example arrangement.
  • two 3-axis antennas located within a vehicle are in communication with a 2-axis antenna located in a portable access device (or mobile access network device).
  • this antenna topology may prevent there from being a situation when cross-polarization exists between one of the 3-axis antennas and the 2-axis antenna.
  • the system may be configured so that there is at least one pair of antennas where a null does not exist (or is not pointed) in a direct signal path.
  • Heuristic measurements of RSSI on continuous wave (CW) tone portions of packets may be taken while measuring round trip time and phase delays of the packets. This may be repeated across multiple frequencies. This may be accomplished at a vehicle access module and/or at the portable access device. Round trip timing and/or unmodulated carrier tone exchange may be used to secure ranging.
  • RSSI and change (or delta) phase per frequency may be used.
  • FIG. 8 shows a polarization axes diagram illustrating another polarization diversity example arrangement.
  • two single axis antennas located within a vehicle are in communication with a 3-axis antenna located in a portable access device (or mobile access network device).
  • this antenna topology may also prevent there from being a situation when cross polarization exists between one of the single axis antennas and the 3-axis antenna.
  • the system may be configured so that there is at least one pair of antennas where a null does not exist (or is not pointed) in a direct signal path. Heuristic measurements of RSSI on continuous wave (CW) tone portions of packets may be taken while measuring round trip time and phase delays of the packets.
  • CW continuous wave
  • the Example of FIG. 7 may be more feasible than the example of FIG. 8. This is because it can be difficult to incorporate a 3-axis antenna in certain portable access devices, such as in a key fob.
  • FIG. 9 shows an electric field diagram 900 and polar coordinate plot 902 illustrating electric field patterns and nulls 906 for a linear antenna.
  • the linear antenna is positioned along the vertical axis 908.
  • the linear antenna has a“doughnut” shaped radiation pattern.
  • nulls are aligned between transmit and receive antennas (co polarized antennas with the nulls co-linear or nearly co-linear)
  • the bounce path of a transmitted signal is measured.
  • the examples set forth herein prevent this situation from existing between at least one transmit antenna and at least one receive antenna at any moment in time.
  • An algorithm is set forth herein for determining which transmit and receive antennas to use at any moment in time to prevent use of antennas that are cross-polarized and/or co-polarized.
  • FIG. 10 shows voltage versus electric field diagram 1000 for a linearly polarized antenna 1002.
  • FIGS. 11 A-B show at least a portion of an example of a multi-axis polarized RF antenna assembly 1 100 including a linear polarized antenna 1102 and a circular polarized antenna 1 104.
  • the antennas 1 102, 1 104 are collocated.
  • the linear polarized antenna 1 102 extends linearly from a center of the circular polarized antenna 1104 axially outward away from the circular polarized antenna 1 104.
  • the antennas 1 102, 1 104 may transmit 90 ° out of phase from each other.
  • the linear polarized antenna 1 102 may include a conductive element (e.g., a straight wire or helix) 1 1 10 extending within a sleeve 1 1 12.
  • the circular polarized antenna 1104 may be ring-shaped.
  • the linear polarized antenna 1 102 is a monopole antenna.
  • the sleeve 1 112 is formed of a dielectric material, such as Teflon.
  • Both of the antennas 1 102, 1 104 are concentric to a disk-shaped insulator (or isolator) 1 106 and a disk-shaped ground plane 1 108.
  • the ring-shaped insulator 1 106 is stacked as a top layer on the ground plane 1 108 (or bottom layer).
  • the circular polarized antenna 1 104 is disposed on the ground plane 1 108 in inside an inner recessed area 1 1 14 of the insulator 1 106.
  • the inner recessed area 1 1 14 of the insulator is disposed between the circular polarized antenna 1 104 and the ground plane 1 108.
  • the circular polarized antenna has two feedpoints 1 120, 1 122 and the linear polarized antenna 1 102 has a single feedpoint 1124.
  • the RF signals are transmitted and/or received via the feedpoints 1120, 1 122, 1 124.
  • the RF signals are transferred between the antennas 1 102, 1104 and the RF circuit 1 1 14 via coaxial cables.
  • the coaxial cables include inner conductive lines 1 130, 1 132, 1 134 and outer ground shields (not shown).
  • the ground shields are connected to the ground plane 1 108.
  • the conductive lines 1 130, 1 132, 1134 are connected to the feedpoints 1 120, 1 122, 1 124.
  • a signal or voltage is provide across the ground plane 1 108 and the conductive element 1 1 10 via the feedpoint 1 124, which is connected to the conductive element 1 1 10 and the ground plane 1108 via another conductive element 1 140.
  • RF signal(s) or voltage(s) are also applied across the ground plane 1108 and the feedpoints 1 120, 1 122 for the circular polarized antenna 1104.
  • the feedpoints 1 120, 1 122 which are located at a 90 ° offset on the face of the antenna 1 104 and are 90 ° out of phase from each other.
  • the 90 ° electrical phase shift combined with the 90 ° geometric phase shift causes the circular polarized antenna 1104 to radiate circular polarized signals.
  • the feedpoints 1 120, 1 122 are connected from the ground plane 1 108 through the insulator 1 106 to the circular polarized antenna 1 104.
  • a hole 1 142 in the center of the ground plane 1 108 and a hole 1 144 in a center of the circular polarized antenna 1 104 are large enough to allow the linear polarized antenna 1 102 to radiate without shorting to the ground plane 1 108.
  • the antennas 1 102, 1 104 may be formed of a conductive material, whereas the circular isolator 1 106 may be formed of a non-conductive (or electrically insulating) material.
  • the linear polarized antenna 1 102 may be implemented as a straight wire, where the sleeve 1 1 12 is formed of polytetrafluoroethene (PTFE) and the conductive element 1 1 10 is formed of copper.
  • the linear polarized antenna 1 102 is implemented as a helix, where the wire is wrapped around a cylindrically-shaped object formed of PTFE.
  • FIG. 12 shows a polar coordinate plot 1200 of radiated power associated with the linear polarized antenna 1 102 of FIG. 1 1.
  • FIG. 13 shows a polar coordinate plot of radiated power associated with the circular polarized antenna 1 104 of FIG. 1 1.
  • the antennas 1 102, 1 104 may be connected to an RF circuit 1 1 14, such as one of the RF circuits 223 of FIG. 3 and may be configured to be installed in a roof of a vehicle.
  • the antennas 1 102, 1 104 may be used for time-of-flight measurements between a vehicle and a portable access device, whereas other LF antennas in a vehicle may be used for authentication of portable access devices.
  • antenna assemblies are primarily described as having a circular polarized antenna and a linear polarized antenna, which may be disposed, for example, in a roof of a vehicle, two linear polarized antennas may be used instead. This holds true for each of the examples disclosed herein.
  • the two linear polarized antennas may be located deeper in the vehicle, such as in the floor, instrument panel or center console of the vehicle.
  • FIG. 14 shows a first RF circuit 1400, a second RF circuit 1401 , and a portion 1403 of a portable access device (e.g., one of the portable access devices described above). Although a certain number of RF circuits are shown, any number of RF circuits may be included and communicate with the portable access device.
  • the first RF circuit 1400 includes a serial transmission module 1402, a RF transceiver module 1404, a switch 1406, a splitter 1408, a single axis polarized (or monopole) antenna 1410, a delay module 1412, and a circular polarized antenna assembly 1414.
  • the antennas 1410, 1414 may be implemented as the multi-axis polarized RF antenna assembly of FIG. 1 1.
  • the RF circuits are each shown as having a single axis antenna and a circular polarized antenna to provide 3 axes of polarization, the RF circuits may each include only two single axis polarized antennas. Many permutations of linear and circular polarized antenna axes are possible to achieve polarization diversity in a module, preventing cross polarization and/or co-linear alignment of nulls. If the RF circuits include two single axis antennas, then the portable access device includes a three axis antenna or three single axis antennas that are orthogonal relative to each other to correspond with x, y, and z axes.
  • the serial transmission module 1402 may communicate with one or more vehicle modules (e.g., the vehicle control module or the access module disclosed above) via a serial bus according to a serial peripheral interconnect (SPI) protocol.
  • Discrete signals (or general purpose I/O signals) may be transmitted between the modules 1402, 1404 and between the RF transceiver module 1404 and the switch 1406.
  • the RF transceiver module 1404 may communicate with the PEPS module 211 (of FIG. 3).
  • the switch 1406 switches between the antennas 1410, 1414.
  • the splitter 1408 may split a single received from the RF transceiver module 1404 and provide the signal to the antenna 1410 and the antenna 1414 and/or combine signals received from the antenna 1410 and the antenna 1414.
  • the second RF circuit 1401 includes a switch 1420, a splitter 1422, a single axis polarized (or monopole) antenna 1424, a delay module 1426, and a circular polarized antenna 1428.
  • the antennas 1424, 1428 may be implemented as the multi axis polarized RF antenna assembly of FIG. 1 1.
  • the devices 1420, 1422, 1424, 1426, 1428 may operate similarly as the devices 1406, 1408, 1410, 1412, 1414.
  • the switch 1420 may communicate with the RF transceiver module 1404.
  • the switch 1406 may also connect the splitter 1408, the single axis polarized antenna 1410, and/or the switch 1420 to the RF transceiver module 1404.
  • the switch 1420 may connect the single axis polarized antenna 1424 or the splitter to the switch 1406 or the RF transceiver module 1404.
  • the portion 1403 includes a 3-axis LF antenna 1430, a LF module 1432, a RF module 1434, a user interface 1436, a first single axis polarized antenna 1438, a second single axis polarized antenna 1440, and a switch 1442.
  • the LF module 1432 transmits and receives LF signals via the 3-axis LF antenna 1430.
  • the RF module 1434 transmits and receives RF signals via the switch 1442 and the antennas 1438, 1440.
  • the switch 1442 connects one or more of the antennas 1438, 1440 to the RF module 1434.
  • Discrete signals and serial peripheral interconnect (SPI) signals may be transmitted between the LF module 1432 and the RF module 1434.
  • Discrete signals may be transmitted between the RF module 1434 and the switch 1442.
  • RF signals are transmitted between (i) the antennas 1410, 1414, 1424, 1428 and (ii) the antennas 1438, 1440.
  • the antennas 1410, 1424 may be associated with a z-axis, whereas the antennas 1414, 1428 may each be associated with x and y axes.
  • the antennas 1438, 1440 may be, for example, slot antennas associated respectively with x and y axes.
  • the 3-axis LF antenna 1430 may communicate with the LF antennas on the corresponding vehicle, as described above.
  • the LF antennas may be used for waking up downlink purposes.
  • the RF antennas may be used for authentication and communication.
  • the antennas 1410, 1414 may be used to communicate with the antennas 1438, 1440 or the antennas 1424, 1428 may be used to communicate with the antennas 1438, 1440.
  • one of the antennas 1410, 1424 and either one of the antennas 1414, 1428 may be used to communicate with the antennas 1438, 1440.
  • One or more of the antennas in the circuit 1400 may be used while using one or more of the antennas in the circuit 1401.
  • monopole (or linear polarized) RF antenna and a dipole (or multi-axis polarized) RF antenna such as a circular polarized antenna
  • Heuristic measurements of RSSI on continuous wave tones of packets may be taken while measuring round trip times and phase delays of the packets. This may be repeated across multiple frequencies.
  • FIG. 15 shows a portion 1500 of a key fob having two linear polarized slot antennas 1502, 1504, metal trim 1506 and a spare key 1508.
  • the metal in a key fob can short out fields that would otherwise stabilize along a long dimension (or Y dimension) of the key fob. As a result, it can be difficult to design an efficient radiator with structures that would otherwise include properly operating antennas.
  • the antenna 1502 is an x-axis linear polarized slot antenna.
  • the antenna 1504 is a y-axis linear polarized slot antenna.
  • the metal trim 1506 may be cast decorative trim.
  • the key fob may also include an LF coil antenna 1510, a processor (not shown), a battery 1512 and a metal plate (or conductive film) 1514. A RF signal is supplied to the metal plate 1514 and the openings of the slot antennas 1502, 1504 radiate electromagnetic waves.
  • FIG. 16 shows a portion 1600 of the key fob of FIG. 15 without the metal trim 1506 and the spare key 1508.
  • the portion 1600 includes the x-axis linear polarized slot antenna 1502 and a y-axis linear polarized slot antenna 1504. Removing the metal trim 1506 and the spare key 1508 supports radiation from the slot antennas 1502, 1504.
  • this arrangement is configured to work with nearby metal, such as the metal trim and the spare key, the plots of FIGs. 17 and 18 are shown, which are skewed from the plots when the metal trim and the spare key are included.
  • FIG. 17 shows a polar coordinate plot of radiated power associated with the x-axis linear polarized slot antenna 1502 of the portion 1600 of the key fob of FIG. 16.
  • FIG. 18 shows an example polar coordinate plot of radiated power associated with the y-axis linear polarized slot antenna 1504 of the portion 1600 of the key fob of FIG. 16.
  • FIG. 19 shows a return loss (in decibels (dB)) versus frequency plot for the linear polarized slot antennas 1502, 1504 of FIG. 16, where the curve S1 ,1 is reflective power for the first port or antenna 1502 of a first radio (or transmitter) and S2,2 is reflective power for the second port or antenna 1504 of a second radio (or transmitter).
  • dB decibels
  • the structure of a key fob may be provided to provide S1 ,1 and S2,2 plots, where the“dip” or minimum return loss for the S1 ,1 and S2,2 curves is at a same frequency or within a predetermined range of each other to provide improved performance.
  • Return loss is a way to measure how well an antenna transforms an electric voltage on terminals of the antenna to an electric field in space or how well the antenna transforms the electric field in space to an electric voltage on the terminals.
  • Return loss is a decibel measurement of how much power is reflected at the terminals. For example, if the return loss is OdB, all of the power is reflected and none of the power is transferred at the terminals. As another example, -10 dB of return loss means about 10% of the power is reflected and 90% of the power is transferred.
  • a return loss plot includes a curve that dips to a reasonable level at operating frequency (e.g., -6 dB), then the corresponding antenna is working well. If the return loss dips to -10dB, then the antenna is considered a good working antenna.
  • Return loss is measured as an S parameter.
  • S1 ,1 is the return loss of port 1.
  • S2,2 is the return loss for port 2.
  • FIG. 20 shows a portion 2000 of the key fob of FIG. 15 without metal trim 1506 and including the spare key 1508.
  • FIG. 21 shows a polar coordinate plot of radiated power associated with the x-axis linear polarized slot antenna 1502 of the portion 2000 of the key fob of FIG. 20.
  • FIG. 22 shows a polar coordinate plot of radiated power associated with a y-axis linear polarized slot antenna 1504 of the portion 2000 of the key fob of FIG. 20. Adding the spare key can negatively affect the y polarization, but is acceptable for operation.
  • FIG. 23 shows a return loss versus frequency plot for the linear polarized slot antennas 1502, 1504 of FIG. 20, where S1 ,1 is for the antenna 1502 and S2,2 is for the antenna 1504.
  • a portable access device has multiple orthogonal antennas as described above, the larger the portable access device is compared to a corresponding physical metal key and the larger the portable access device is compared to a palm of a hand, removal of decorative metal trim provides improved round trip time performance. Improved round trip time performance improves accuracy of distance determinations.
  • FIG. 36 Although the following operations of FIG. 36 are primarily described with respect to the implementations of FIGs. 2-6, 1 1 and 14, the operations may be easily modified to apply to other implementations of the present disclosure. The operations may be iteratively performed.
  • an antenna pair is selected at which to transmit and receive the packet. Such as two of the antennas of the RF circuits of the vehicle of FIG. 1 1.
  • the packet is transmitted from a first (or transmit) antenna at the selected frequency to a portable access device. The vehicle switches between a negotiated set of antenna axes with dwells during the CW tone portion of the packet.
  • FIG. 44 shows the second and third BLE curves 4402, 4404 of FIG. 43, where the third BLE curve 4404 has been shifted relative to the second BLE curve 4402.
  • the following operations may be performed to defend against a bit acceleration attack.
  • a bit acceleration attack may refer to when an attacking device accelerates transmission of a BLE signal to account for delays associated with the attacking device receiving, processing and/or modifying and forwarding the BLE signal, such as a BLE signal transmitted from a key fob and/or other portable access device.
  • FIG. 45 shows an example method of detecting a range extension type relay attack. Although the following operations of FIG. 45 are primarily described with respect to the implementations of FIGs. 2-6, 1 1 and 14, the operations may be easily modified to apply to other implementations of the present disclosure. The operations may be iteratively performed. The following operations may be performed by, for example one or more of the modules 210, 21 1 , 212.
  • the antennas provide polarization diversity with antennas (e.g., single polarized antennas) used by the RTT initiator 5208 and RTT responder 5210 such that at any moment in time at least one of the stated antennas of the vehicle 5200 has at least one polarization axis that is not cross-polarized and not co-polarized with a polarization axis of at least one of the antennas of the portable access device 5206.
  • antennas e.g., single polarized antennas
  • channels may be pseudo randomly selected and access addresses may also be pseudo randomly selected. This random selection may occur at the vehicle and may be shared ahead of time with the portable access device. Conversely, the selection may occur at the portable access device. Conversely, the selection may occur through secure cryptographic techniques with key material from either or both the devices contributing to the pseudo random selected channel sequence and/or access address sequence. In this case the pseudo random sequences of access address serves as the cryptographically secure sequence of bits that are exchanged for round trip timing measurements.
  • the range extension attacking devices must convince the initiators of the vehicle and the one or more portable access devices that the portable access devices are closer than the portable access devices actually are and at the correct distances from the vehicle to permit access and/or operational control of the vehicle. Also, with a Gaussian filter on BLE bits, the attacking device has a small window of less than about 10-100ns of early bit detection time available to detect the bits and transmit the bit early.
  • This may include measuring travel time: from processing module 3922A; through protocol module 3924A, GFSK modulator 3926A, D/A and low pass filter 3928A, upconverter 3920A, power amplifier 3932A, switch and balun 3908A, and band pass filter 3906A; to the BLE radio 3900B; through band pass filter 3906B, switch and balun 3908B, low noise amplifier 3910B, downconverter 3912B, band pass filter and amplifier 3914B, A/D 3916B, and demodulator 3918B, to correlation and protocol module 3920B.
  • the time to travel from the demodulator 3918B or the correlation and protocol module 3920B to the protocol module 3924B or the processing module 3922B may also be determined.
  • A/D and D/A clocks of the BLE radios and/or phase lock loops are dithered between packets.
  • a cryptographically random variation may be added, which is known to the BLE radios for when least significant bits (LSBs) generated by a digital timer are transmitted.
  • the cryptographically random variation is used such that an attacking device is unable to predict a precise moment when a transmission will occur.
  • each of the packets include a large pre-agreed to cryptographically random multiple bit identifier (PACRMBI) of, for example, 16 to 256 bits.
  • PACRMBI cryptographically random multiple bit identifier
  • the packet bit contents from the initiator and the responder are indistinguishable to an attacking device. The attacking device is unable to identify which direction a packet is coming from or if the packet is an initiator or responder packet based upon the bit contents of the packet.
  • the correlation and protocol module 3920 selects a maximum edge of the clock edges that are a match.
  • Other clock recovery methods may be use to interpolate sub-bit timing in round trip timing of bit streams in communication channels. This may be performed in combination with the up-sampling correlation or in combination with normal clock sampling.
  • measured die temperatures within the BLE radios are communicated (or shared) between the BLE radios to compensate for any temperature based frequency and amplifier gain variations in the propagation delay between the BLE radios.
  • FIG. 50 shows a location and distance determination system 5600 including a RTT initiator 5602, a RTT responder 5604, and a RTT sniffer 5606.
  • the RTT initiator 5602 and the RTT responder 5604 may perform as any of the initiators, responders, BLE radios, RF circuits disclosed herein.
  • the one of the RTT devices 5602, 5604 that is in the vehicle may be referred to as the master device, whereas the other one of the RTT devices 5602, 5604 is referred to as the slave device.
  • the RTT sniffer 5606 When the master device transmits a challenge signal to the slave device, the RTT sniffer 5606 performs as a listener and detects (i) when the challenge signal is transmitted to and/or received at the RTT sniffer 5606, and (ii) when the slave device transmits a response signal to the challenge signal, and/or (iii) when the RTT sniffer 5606 receives the response signal.
  • the RTT sniffer 5606 may determine a difference between the time TSLRX that the RTT sniffer 5606 receives the response signal and time TMLRX when the RTT sniffer 5606 receives the challenge signal using equation 8, where: TSL is the amount of time for the RTT sniffer 5606 to receive the response signal; FixedOffset2 is a second amount of offset time, which may be greater than or equal to 0; TML is the amount of time for the RTT sniffer 5606 to receive the challenge signal; TSLRX is the time the RTT sniffer 5606 receives the response signal; and TMLRX is the time the RTT sniffer 5606 receives the challenge signal.
  • FIG. 51 shows another location and distance determination system 5700 including a RTT initiator 5702, a RTT responder 5704, and multiple RTT sniffers 5706.
  • the RTT initiator 5702 and the RTT responder 5704 may perform as any of the initiators, responders, BLE radios, RF circuits disclosed herein.
  • the RTT sniffers 5706 may be located along with one of the RTT devices 5702, 5704 at a vehicle and include an antenna module (similar to the antenna modules 40 of FIG. 2).
  • the devices 5702, 5704, 5706 may each include a control module as described above to perform any of the described operations.
  • the RTT device in the vehicle may also include an antenna module similar to the antenna modules 40 of FIG. 2.
  • Time TAB is the amount of time for the challenge signal to be transmitted from the RTT initiator 5702 to the RTT responder 5704.
  • Time TBA is the amount of time for the corresponding response signal to be transmitted from the RTT responder to the RTT initiator.
  • Time TAC is the amount of time for the first RTT sniffer to receive the challenge signal.
  • Time TBC is the amount of time for the first RTT sniffer to receive the response signal.
  • Time TAD is the amount of time for the second RTT sniffer to receive the challenge signal.
  • Time TBD is the amount of time for the second RTT sniffer to receive the response signal.
  • Time TAE is the amount of time for the third RTT sniffer to receive the challenge signal.
  • Time TBE is the amount of time for the third RTT sniffer to receive the response signal.
  • TBC can be calculated.
  • TBD can be calculated.
  • TAB and TAE are known, TBE can be calculated.
  • TBC deltaRxAtC + TAC - TAB
  • TBD deltaRxAtD + TAD - TAB
  • Equations 18-21 are trilateration equations.
  • trilateration may be performed using three circles to measure distances and determine the location of the slave device relative to one of the RTT devices 5702, 5704 and/or the corresponding vehicle. This may be performed at the master device and/or at one or more of the RTT sniffers. The information determined at the master device and the RTT sniffers may be shared with each other. The times, distances and/or locations may be determined and thus updated periodically.
  • FIG. 52 shows a first network device (or vehicle) 5800 and a second network device (or portable network device) 5802.
  • the first network device 5800 includes a tone exchange responder 5804 and a tone exchange initiator 5806.
  • a tone exchange is also referred to as an unmodulated carrier tone exchange.
  • the second network device 5802 includes a tone exchange initiator 5808 and a tone exchange responder 5810.
  • the devices 5804, 5806, 5808, 5810 may be implemented as any of the other BLE radios, RF circuits, initiators, responders, etc. disclosed herein.
  • At least one of the devices 5804, 5808 and at least one of the devices 5806, 5808 may include or be connected to a single polarized antenna and a circular polarized antenna.
  • the devices 5804, 5806, 5808, 5810 may each include the antenna module 40 of FIG. 2 and/or the antennas shown in FIG. 1 1 .
  • Tone exchange may be performed between the responder 5804 and the initiator 5808 and between the initiator 5806 and the responder 5810.
  • RTT measurements may be transmitted in the same packets as the tones being exchanged.
  • the devices 5804, 5806, 5808, 5810 may randomly select the channels used for the transmission of the packets.
  • the transmission of packets may occur simultaneously with the reception of packets.
  • the initiator 5808 may transmit a tone to the responder 5804 on a first channel while the initiator 5808 receives a tone from the responder 5804 on a second channel.
  • the initiator 5806 may transmit and/or receive tones while the initiator 5804 is transmitting and/or receiving tones.
  • the signals may be transmitted from the network devices with a symbol transmission rate of less than or equal to a predetermined amount of time (e.g., 1 ps per symbol). This provides quick transmission, which prevents an attack. Also, the simultaneous of dual signals further prevents an attacker from succeeding because the attacker would need to detect and affect both signals. Both signals may be transmitted on different frequencies, by the same network device or by different network devices, as described above.
  • the devices 5804, 5806, 5808, 5810 may change the frequencies of the tones transmitted, monitor changes in phase due to the changes in frequencies and based on the changes in phases determine distance between the network devices 5800, 5802. This may be referred to as carrier phase based ranging.
  • carrier phase based ranging As an alternative, if a signal is transmitted and received as a result of the signal being reflected back to the source, a difference in phase between the transmitted signal and the received signal may be used to determine a modulo of distance between the source and the reflector.
  • an initiator may determine a modulo of a distance between the initiator and a responder based on a difference in phase between (i) a signal transmitted from the initiator to the responder and (ii) a corresponding response signal transmitted from the responder back to the initiator.
  • a slope of phase difference for an amount of change in frequency corresponds to or is equal to distance with a frequency step size limitation. The smaller the frequency steps, the larger the modulo roll over distance (see“On the Security of Carrier Phase-based Ranging” by Olafsdotter, Ranganathan, and Capkun, which is incorporated herein by reference.
  • received signal strength indicator (RSSI) parameter may be monitored to determine if network device is close to vehicle and then perform a series of tone exchanges to measure distance. Based on a door handle touch of a user, tone exchanges may be conducted to make sure there is not an attack. Multiple round trip timing measurements may be performed to determine distance of the network device relative to the vehicle.
  • RSSI received signal strength indicator
  • the above stated distance determination techniques may be used in combination with other techniques disclosed herein for determining RTT values.
  • the direction of travel of the tones between the devices 5804, 5806, 5808, 5810 may be randomized.
  • a control module of the first network device 5800 plots changes in phase versus changes in frequency for each of multiple tones being exchanged to generate multiple linear curves.
  • the control module determines the slopes of the curves, which provide ratios of the changes in phase versus the changes in frequencies. The slopes are then used to determine the distances between the adjacent ones of the curves, which are related to the distance between the first and second network devices 5800, 5802.
  • FIG. 53 shows a location determination system 5900 including a tone exchange initiator 5902, a tone exchange responder 5904, and a tone exchange sniffer 5906.
  • the tone exchange initiator 5902 and the tone exchange responder 5904 may perform as any of the initiators, responders, BLE radios, RF circuits disclosed herein.
  • the tone exchange sniffer 5906 may perform similar to the RTT sniffer 5606 of FIG. 50 and be located along with one of the tone exchange devices 5902, 5904 at a vehicle and include one of the antenna modules 40 of FIG. 2 while the tone exchange device in the vehicle includes the other one of the antenna modules 40.
  • the devices 5902, 5904, 5906 may each include a control module as described above to perform any of the described operations.
  • Polarization diversity is provided: between the antennas of the tone exchange devices 5902, 5904; and between the antennas of one of the tone exchange devices 5902, 5904 that is in the vehicle and the tone exchange sniffer 5906. Polarization diversity is especially utilized when performing round trip timing measurements.
  • the one of the tone exchange devices 5902, 5904 that is in the vehicle may be referred to as the master device, whereas the other one of the tone exchange devices 5902, 5904 is referred to as the slave device.
  • the tone exchange sniffer 5906 performs as a listener and detects (i) when the tones are transmitted to and/or received at the tone exchange sniffer 5906, (ii) when the slave device transmits tones to the master device, and/or (iii) when the tone exchange sniffer 5906 receives tones transmitted by the slave device.
  • the slave device may operate as a reflector and transmit tones received from the master device back to the master device.
  • the master device and/or the sniffer device may prevent at least one of access to or operation control of the vehicle based on the arrival times of the tones, round trip timing measurements, and/or estimated distances between the devices.
  • FIG. 54 shows a method of determining distances between an initiator and a responder and between a responder and a sniffer.
  • the operations of FIG. 54 are primarily described with respect to the implementations of FIGs. 50 and 53, the operations may be easily modified to apply to other implementations of the present disclosure, such as the implementations of FIGs. 2-6, 1 1 , 14, 39 and 46-49. The operations may be iteratively performed. Although the method is primarily described with respect to the embodiment of FIG. 53, the method may be applied to other embodiments of the present disclosure.
  • the method may begin at 6000.
  • the tone exchange initiator 5902 transmits a tone signal including a tone to the tone exchange responder 5904.
  • the tone may be represented as where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, t AB is time to travel from A to B and is directly related to the distance between the tone exchange initiator 5902 and the tone exchange responder 5904, w is frequency, f A is the phase of the tone at the tone exchange initiator 5902, t is time.
  • the tone is received at the tone exchange responder 5904 with delay f B and the tone exchange sniffer 5906 with delay f e .
  • the receive tone signal is downconverted to baseband, which may be represented by equation 26.
  • the receive tone signal is downconverted to baseband, which may be represented by equation 27.
  • the tone exchange initiator 5902 receives the tone from the tone exchange responder 5904, which retransmitted the tone signal as a second tone signal back to the tone exchange initiator 5902.
  • the tone may be represented as e .( iw ⁇ t"+' ( T U ' 3 ⁇ 4s
  • the received second tone signal may be represented by equation 28.
  • the tone exchange sniffer 5906 also receives the second tone signal, which may be represented by equation 29.
  • the tone exchange initiator 5902 receives a phase signal from the tone exchange responder 5904 indicating a natural logarithm tone value with a difference in phase of the tone when received at the tone exchange responder 5904.
  • the tone exchange responder 5904 thus sends a measured phase to the tone exchange initiator 5902, where values are multiplied, as represented by equation 30.
  • the tone exchange sniffer 5906 determines tone values associated with: a difference in phase of the tone between when transmitted from the tone exchange initiator to when received at the tone exchange sniffer; and a difference in phase of the tone between when transmitted from the tone exchange responder to when received at the tone exchange sniffer.
  • the tone values may be represented as e ( j“ i : B c+ 0 B - 0c ) anc j 6 awt AB + q A - q B )
  • the initiator 5902 and/or the sniffer 5906 determines the distances between the initiator 5902 and the responder 5904 and between the initiator 5902 and the sniffer 5906.
  • the distance values may be determined in a similar manner as above when sniffing round trip time, see for example equations 12 and 15 and corresponding description. Instead of round trip time, phase is used.
  • This calculation may include use of equation 31 , where the tone values e ⁇ J WT Bc+ 0 B- 0 c ) anc
  • the initiator 5902 and/or the sniffer 5906 may take the inverse logarithm of the resultant of equation 31 to provide the times x BC and t AB .
  • the distances between the responder 5904 and the sniffer 5906 and between the initiator 5902 and the responder 5904 may than be determined based on these times and the known transmission rates of the tone signals.
  • the method may end at 6014.
  • the initiator 5902 or the sniffer 5906 may prevent at least one of access to or operation control of the vehicle based on the estimated at least one of the distances.
  • FIG. 55 shows an example of a passive tone exchange and phase difference detection system 6100.
  • the system 6100 includes a phase lock loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and antenna modules 61 10.
  • the antenna module 61 10 may be similar to the antenna modules 40 of FIG. 2.
  • the transmitter 6106 transmits a first tone, which may be an output of the PLL 6102 and is reflected back by a reflector 61 12 to the receiver 6108.
  • the output of the PLL and the reflected tone signal are provided to the phase module 6104.
  • the phase module 6104 determines a difference in phase between the output of the PLL and the reflected tone signal.
  • the phase module 6104 or other module disclosed herein determines a distance between the transmitter 6106 and the reflector 6112 based on the difference in phase.
  • the phase module 6104 or other module disclosed herein may prevent access to an interior of and/or operational control of a vehicle based on the determined distance.
  • FIG. 56 shows an example of an active tone exchange and phase difference detection system 6200.
  • the system 6200 operates similarly as the system 6100 of FIG. 55.
  • the transmitter and receiver 6106, 6108 are represented by box 6202.
  • the reflector 61 12 of FIG. 55 may be replaced with responder device 6204 for active exchange of tones.
  • the responder device 6204 may receive a first tone signal with a first one or more tones from the transmitter 6106 and respond with a second tone signal.
  • the second tone signal may include the one or more tones and/or one or more other tones.
  • the second tone signal is transmitted back to the receiver 6108.
  • FIG. 57 shows an initiator packet 6300 and a response packet 6302 used for RSSI and time-of-flight measurements.
  • the initiator packet 6300 may include multiple fields, such as a preamble, a synchronization access word (e.g., a pseudo-random synchronization access word), a data field including data, a cyclical redundancy check (CRC) field including CRC bits, and a continuous wave (CW) tone field including a CW tone.
  • the response packet 6302 may include a CW tone field, a preamble, a synchronization access word, a data field, and a CRC field.
  • An initiator device may transmit the initiator packet 6300, which may be received at a responder device.
  • the responder device may then generate the response packet 6302 and transmit the response packet back to the initiator device. This may be done for tone exchange, phase difference determination, round trip timing measurements, etc. Distance between the devices may then be determined. These measurements and calculations may be performed to detect a range extender type relay station attack.
  • the initiator and the responder pre-negotiate what the synchronization access words are going to be based on a predetermined list.
  • the synchronization access words include access addresses.
  • the initiator may, for example, measure the amount of time to receive (i) the response packet after transmitting the initiator packet, and/or (ii) the synchronization access word.
  • the amount of times and the synchronization access word may be compared with predetermined amounts of times and a predetermined synchronization access word. If the comparisons performed result in matches, then a range extender type relay station attack has not occurred. Flowever, if the synchronization access word received does not match and/or the amounts of time are more than a predetermined amount different than expected, then a range extender type relay station attack may have occurred.
  • the initiator and responder exchange a predetermined key, list of synchronization access words, and times when each of the synchronization access words are to be transmitted.
  • the synchronization access words when initially created may be randomly selected. This allows the responder to know the correct key and/or synchronization access word to respond with when receiving an initiator packet.
  • the key may be included in the response packet.
  • the initiator and response packets do not include the preambles, as shown in FIG. 58.
  • the CW tones are 4-1 Ops in length.
  • the initiator packet and the response packet have the same format as shown in FIG. 59.
  • Each of the packets includes: as a first field a first CW tone; a synchronization access word; a data field; a CRC field; and as a last field a second CW tone.
  • FIG. 60 Another example of initiator and response packets having the same format is shown in FIG. 60, where each packet includes: as a first field a first CW tone; a synchronization word including a PACRMBI; a PDU field including a PDU; a medium access controller (MAC) field; a CRC field, and as a last field a second CW tone.
  • 57-60 may be cryptographically random length tones and may be inspected by the initiator when received. When for example CW tones received from a responder are not correct, then a range extender type relay station attack may have occurred. With the embodiments of FIGs. 59-60, synchronization word round trip timing prevents wraps of a CW tone exchange beyond an ambiguous range (e.g., 75 meters) at 2 MFIz channel tone steps.
  • the above referred to initiator and responder packets may be transmitted at a same frequency. By having the initiator and responder packets being in the same format, an attacking device is unable to distinguish which packet is the initiator packet and which packet is the responder packet. In one embodiment, the CW tones at the end of the packets are not included.
  • the attacking device In order for an attack by an attacking device to not be detected, the attacking device needs to retransmit a received signal without detectable delay. This makes it difficult for the attacking device to go undetected.
  • An attacking device can delay a signal 500 ns, which can delay the signal in space 500 feet (ft).
  • the attacking device In order for an attacking device to advance transmission of a tone or start transmission of a tone at a correct time, the attacking device may need to know ahead of time what is being transmitted. This is unlikely. This is especially true when a heterodyne receiver is used to receive the relayed signal.
  • the heterodyne receiver translates packets/tones into an in-phase (I) - quadrature-phase (Q) domain and captures in the IQ domain. In the IQ domain phase differences are detected.
  • the initiator inspect the received CW tones transmitted from the responder for (i) length relative to a start of a transmitted synchronization access word, (ii) consistent power (or amplitude) before and relative to the synchronization access word, and (iii) consistent tone throughout the synchronization access word.
  • Consistent tone may refer to a consistent frequency, power level, amplitude, etc.
  • the start and end times of the synchronization access word relative to a beginning of a first CW tone of a transmitted packet may be known within a predetermined amount of time (e.g., ⁇ 10ns range). So if the start and end times are within predetermined ranges of a beginning of a first CW tone of the packet, then there has not been an attack, otherwise an attack may have occurred.
  • a PLL of an initiator that transmits a tone may, on a given channel, have 3 different tones which the PLL is able to generate; a center tone, a high tone at a first frequency (e.g., 250KHz), and a low tone at a second predetermined frequency (e.g., -250KHz).
  • the transmitted tones may be selected and transmitted according to a predetermined agreed to random sequence and/or pattern of tones. This may be agreed to between the initiator and the responder.
  • the PLLs of the initiator and an attacking device may not be consistent with each other. If there is a frequency difference greater than a predetermined threshold between the initiator transmitted signal and the signal received in response thereto, then the initiator may determine that an attack has occurred.
  • the responder is able to measure and respond back in data with what phase delay the responder detects for a received signal. This may be based on when the responder receives a tail end CW tone of a packet from an initiator.
  • the responder may measure a phase delay between (i) the tail end (or ending) CW tone of the packet received from the initiator and (ii) a front end (or first leading CW tone) of a packet being transmitted by the responder in response to the packet received from the initiator.
  • the initiator may calculate the total bi-directional round trip time of the packet from the initiator to the responder and then from the responder back to the initiator.
  • an initiator may also detect when an attacking device amplifies the signal (or tone).
  • the amplifying of a signal/tone can also delay transmission, which may be detected.
  • a tone can get distorted and/or another tone can get transmitted instead of the originally transmitted tone.
  • the above examples allow for more accurate distance measurements with a fewer number of packets that each have both a synchronization access word and a CW tone.
  • the synchronization access word protects the CW tone and vice versa from being modified by an attacking device without detection.
  • Bidirectional randomization communication protecting both the synchronization access words and the CW tones is performed.
  • a PLL as disclosed herein of an initiator may be a phase predictable PLL allowing the initiator to predict a phase of signal when a frequency of the signal is changed. This may eliminate a need to check if timing of a CW tone transmitted by the initiator and a CW tone transmitted by a responder are correct.
  • a responder may measure when, for example, a tail end CW tone from an initiator is received, determine the corresponding phase delay of the tail end CW tone relative to generation of a front end CW tone by the responder for a response signal, and transmit this information with the front end CW tone to the initiator. The initiator may then calculate a total round trip time based on the received information.
  • an initiator is one of a vehicle or a portable access device and a responder is the other one of the vehicle and the portable access device.
  • the order in which the vehicle and the portable access device transmit and respond is pseudo-randomly changed.
  • a packet and/or tone signal may be sent as a response and then be used as an initiator packet and/or initiator tone signal.
  • the order in which the vehicle and the portable access device transmit and respond is not changed for short periods of time (e.g., exchange periods less than a predetermined period of time) and are changed for long exchange periods (e.g., exchanged periods greater than for equal to the predetermined period of time).
  • the order may be switched periodically.
  • bi-directional data is exchanged using antenna polarization diversity to provide correct timing measurements.
  • Processing is implemented to provide accurate measurements of start and end points of CW tones and synchronization access words.
  • the correlation and protocol module 3920 may maintain a circular queue of bits and lock in to do a comparison between start and end times and lengths of CW tones and synchronization access words of transmitted (initiator) packets and start and end times and lengths of CW tones and synchronization access words of received (responder) packets.
  • the correlation and protocol module 3920 may interpolate where zero-crossing points are located. Post processing on I and Q data associated with a synchronization access word may be performed for clock recovery to interpolate when the synchronization access word arrived. I and Q data may have different transition/spin rates.
  • Interpolation may be performed to determine where center points of transitions are to obtain precise timing for clock recovery. To dial in the timing, multiple zero-crossing points may be detected and aligned. Also, I and Q data may be oversampled as described further below to best fit/align one or more bits.
  • FIG. 61 shows an antenna path determining system 6700 for network devices having respective antenna modules.
  • the antenna modules exhibit polarization diversity. In this example, two polarization axes for each antenna module are shown.
  • Each antenna module includes a vertically oriented antenna and a horizontally oriented antenna. Possible channel vectors hvv, hvH, hHv and hm-i are shown.
  • Ranging modules 6710 are shown. The ranging modules 6710, based on a respective one of the channel vectors hvv, hvH, hHv and hm-i, determines a range (or distance) between the corresponding antennas of the network devices.
  • the ranging modules may executing ranging algorithms to determine ranges rvv, fvH, mv and n-m.
  • the determined ranges rvv, rvH, fHv and GHH are provided to a minimum module 6712 that determines which of the ranges rvv, fvH, v and n-m is the shortest.
  • the path that is the shortest may be selected.
  • Each of the channel vectors may be generated for one or more selected frequencies. When compared, the ranges may be generated for channel vectors of a same frequency or different frequencies.
  • vectors may be generated for at least some of 80 different tones having a frequency step of 1 MHz between adjacent ones of the tones and being within a 2.4 GHz industrial, scientific and medical (ISM) band.
  • ISM industrial, scientific and medical
  • a frequency associated with the shortest range may be selected.
  • Other factors may also be considered when making the selection, such as signal strength, amplitude, voltage, parameter consistency, etc.
  • This path selection may be performed by any of the initiators, responders, modules, network devices, etc. disclosed herein and used for round trip timing measurements. This allows a best antenna path to be selected for bidirectional packet and/or tone signal exchange for determining a round trip time.
  • the radio model 6800 may include a first sampling module 6802, a time offset module 6804, a Gaussian low pass filter 6806, an integrator 6808, a first up-sampler 6810, an amplifier 6812, a summer 6814, a modulator 6816, a second sampling module 6818, a phase and frequency offset module 6820, a first mixer 6822, a phase delay device 6823, a second mixer 6824, a phase delay module 6826, a second low pass filter 6828, a resample module 6830, an arctangent module 6832, a differentiator 6834, a sign determining module 6836, a bit pattern module 6838, a second up-sampler 6840, a third up-sampler 6842, a cross-correlation module 6844 and a peak detector 6846.
  • the devices 6830, 6832, 6834, 6836, 6838 correspond to the receiver portion and perform operations on baseband signals.
  • the resample module 6830 performs as an analog- to-digital converter.
  • the devices 6840, 6842, 6844 and 6846 also correspond to the receiver portion and are associated with interpolation to determine a phase.
  • zero-crossings of a reconstructed signal out of the differentiator 6834 may be determined. There can be a significant amount of jitter at the zero-crossings, which negatively affects time-of-flight determinations, which are based on timing of the zero-crossings. A small amount of jitter negatively affects transmit time and receive time determinations.
  • the up-samplers 6840, 6842 and the cross-correlation module 6844 are implemented to reduce jitter associated with sampling and zero-crossing determinations.
  • the up-samplers 6840, 6842 perform signal processing to interpolate and inject data points between existing received data points to provide finer resolution in time.
  • the transmitted bit stream is pre-known by the BLE receiver and is provided to the up-sampler 6842 as shown by arrow 6843.
  • the sign-determination module 6836 and the bit pattern module 6838 are not included.
  • the transmitted bit stream is not known and the sign- determination module 6836 and the bit pattern module 6838 are included and provide an estimated bit stream to the up-sample 6842.
  • the transmitted bit stream may be an access address indicating what device is transmitting.
  • the estimated bit stream may be determined based on a reference.
  • the reference may be a preamble of and/or a series of bits received prior to the bit stream being estimated.
  • the preamble and/or series of bits provide a reference in time based on which the estimated bit stream may be generated.
  • the estimated bit stream is generated based on a known clock frequency of the transmitter and associated with the transmitted signal and a clock frequency of the receiver.
  • the cross-correlation module 6844 performs a cross-correlation between outputs of the up-samplers 6840, 6842 and/or a cross-correlation between the outputs of the up-sampler 6840 and the bit pattern module 6838.
  • the cross-correlation is performed to match envelops of signals provided to the cross-correlator and determine a phase difference.
  • the cross-correlation may include performing a product of the output signals including taking products of corresponding data points of the two output signals and summing the products. This product and sum process is iterated while incrementally shifting one of the outputs in time relative to the other one of the outputs by a data point for each iteration to provide multiple resulting product-sum values.
  • a maximum one of the product-sum values refers to when the two outputs are in synch (or aligned), such that the waveforms match and are aligned in time. Based on this information, the phase offset (or difference) between the two outputs is determined.
  • the cross-correlation has improved resolution due to the up-sampling performed by the up-samplers 6840, 6842.
  • the cross-correlation module 6846 performs correlation with finer resolution signals then that originally received to get a finer interpolation of a time of arrival of a received packet in the received signal.
  • the higher correlation resolution reduces signal noise ratios and bit lengths of messages and may include interpolating with finer resolution.
  • the phase offset may be used for time-of-flight determinations as described herein.
  • the peak detect module 6846 evaluates results of the cross-correlation and indicates (i) when the time matched peak occurred, and/or (ii) the phase offset.
  • the output of the up-sampler 6840 is provided to the sign determining module 6836 and the cross-correlation module 6844 and the up-sampler 6842 is not included.
  • the output of the bit pattern module 6838 is provided directly to the cross-correlation module 6844.
  • FIGs. 38 and 62 are further described with respect to the method of FIG. 63. Although the following operations of FIG. 63 are primarily described with respect to the implementations of FIGs. 2-6, 1 1 , 14 and 38, the operations may be easily modified to apply to other implementations of the present disclosure. The operations may be iteratively performed.
  • the method may begin at 6900.
  • the sampling module 6802 of a first network device e.g., a network device implemented in a vehicle as part of an onboard vehicle system or a portable access device
  • the sampling module 6802 samples the bit stream.
  • the time offset module 6804 receives an output of the sampling module 6802 and may introduce a time offset (or delay).
  • the sampling module 6802 and the time offset module 6804 may be implemented by the protocol module 3924.
  • the Gaussian low pass filter (LPF) 6806 receives an output of the time offset module 6804, which may include a bit stream that is filtered and converts square wave into a sinusoidal wave. Operation of the Gaussian LPF 6806 may be implemented by the GFSK modulator 3926.
  • the integrator 6808 integrates an output of the Gaussian LPF 6806 and may be implemented by the D/A and low pass filter 3928.
  • Example signals 7000, 7002, 7004 respectively out of the sampling module 6802, the Gaussian LPF 6806, and the integrator 6808 are shown in FIG. 64A.
  • the up-sampler 6810 up-samples an output of the integrator 6808 to include additional points per sample.
  • the up-sampler 6810 may be implemented by upconverter 3930.
  • the amplifier 6812 provides frequency deviation gain.
  • the sampling module 6818 receives an RF tone, which may be provided by the PLL 3940.
  • An output of the sampling module 6818 is provided to both the modulator 6816 and the phase and frequency offset module 6820.
  • the modulator 6816 modulates an output of the sampling module 6818 based on an output of the amplifier 6812 to provide an initiator signal.
  • the modulator 6816 may be at least partially implemented by the upconverter 3930.
  • the initiator signal out of the modulator 6816 may be provided to the power amplifier 3932 and transmitted to a second network device.
  • the second network device may be a network device implemented in a vehicle as part of an onboard vehicle system or a portable access device.
  • the initiator signal may be any of the initiator signals, initiated tone signals, master device transmitted signals, and/or the like disclosed herein.
  • the low noise amplifier 3910 receives a response signal in response to the initiator signal.
  • the response signal may include Gaussian noise, which is included in the received response signal, as represented by the summer 6814.
  • the mixers 6822, 6824 receive the response signal from the low noise amplifier 3910 and downconvert the response signal to in-phase (I) and quadrature-phase (Q) baseband signals.
  • the quadrature-phase baseband signal may be phase delayed by 90 ° via the phase delay device 6823. This may be implemented at the downconverters 3912.
  • the LPF 6828 filters the baseband signals and removes high frequency content.
  • the LPF 6828 may include multiple LPFs; one for each downconverted signal.
  • the LPF 6828 may replace and/or be implemented by the bandpass filter and amplifier 3914.
  • the resampling module 6830 samples the filtered baseband signals with sample jitter.
  • the resampling module 6830 may be implemented by the A/D converter 3916.
  • Example signals 7006, 7008 out of the resampling module 6830 are shown in FIG. 64B.
  • the arctangent module 6832 determines an arctangent of the baseband signals to generate an arctangent signal.
  • An example signal 7010 out of the arctangent module 6832 is shown in FIG. 64C.
  • the differentiator 6834 differentiates the arctangent signal out of the arctangent module 6832.
  • An example signal 7012 out of the differentiator 6834 shown over the original Gaussian filtered signal 7002 is shown in FIG. 64D.
  • the sign module 6836 performs a sign function and determines a sign of the output of the differentiator 6834.
  • the bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of the sign module 6836. The idealized bit pattern is obtained to match the bit pattern out of the Gaussian LPF 6806 or other bit patterns with the received bit pattern after the operations of the low pass filter 6828 and the arctangent module 6832 have been applied. This is done such that up-sampled values are similar to noise free resampled data.
  • the up-samplers 6840, 6842 up-sample respectively the outputs of the differentiator 6834 and the bit pattern module 6838.
  • outputs of the up- samplers 6840, 6842 are correlated by the cross-correlation module 6844 to generate a correlation signal.
  • the devices 6832, 6834, 6836, 6838, 6840, 6842 may be implemented by the demodulator 3918.
  • the peak detector 6846 determines a phase of the resulting correlated signal out of the cross-correlation module 6844.
  • the cross-correlation module 6844 and the peak detector 6846 may be implemented by the correlation and protocol module 3920.
  • the peak detector 6846 is implemented as a 3 point parabolic peak interpolator on top of the up-sampled cross correlation module 6844. Two points near (within a predetermined distance of) the detected peak are selected and a 3 point parabolic interpolation of the up-sampled result is obtained.
  • the distance may be a distance between the first network device and the second network device.
  • the location may be of the second network device relative to the first network device.
  • the round trip time may be the time for the initiator signal to travel to the second network device and for the first network device to receive the response signal including time for the second network device to generate the response signal after receiving the initiator signal.
  • the processing module 3922 may determine whether a range extension type relay attack has occurred based on the phase, distance, location, roundtrip trip time, and/or other parameter determined at 6942. If a range extension type relay attack has occurred, then operation 6946 may be performed, otherwise the method may end at 6948. At 6946, the processing module 3922 performs a countermeasure, such as any of the countermeasures disclosed herein.
  • FIGs. 35, 36, 45, 54 and 63 are meant to be illustrative examples.
  • the operations may be performed sequentially, synchronously, simultaneously, continuously, during overlapping time periods or in a different order depending upon the application. Also, any of the operations may not be performed or skipped depending on the implementation and/or sequence of events.
  • the multi-axis polarized RF antenna can include the conductive element as a wire.
  • a vehicle can include the multi-axis polarized RF antenna assembly.
  • the multi-axis polarized RF antenna assembly can include a first multi-axis polarized RF antenna assembly configured to be implemented in a vehicle and a second multi-axis polarized RF antenna assembly configured to be implemented in the vehicle and including a second circular polarized antenna including a second conductive ring-shaped body having a second inner hole, a second circular isolator connected to the second conductive ring-shaped body, and a second linear polarized antenna connected to the second circular isolator and extending outward from the second circular isolator.
  • the second linear polarized antenna can include a sleeve, and a conductive element extending through the sleeve of the second linear polarized antenna.
  • the second linear polarize antenna can extend orthogonal to a radius of the second circular polarized antenna and an access module connected to the first multi axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly and configured to communicate with a portable access device via the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly.
  • the access module can be configured to perform passive entry passive start operations or phone as a key operations including transmitting and receiving radio frequency signals via the first one of the multi-axis polarized RF antenna assembly and the second one of the multi-axis polarized RF antenna assembly.
  • the access module can be configured to permit access to the vehicle based on the radio frequency signals.
  • the access module can be configured to execute an algorithm to determine which antenna pair of the first one of the multi-axis polarized RF antenna assembly and the second one of the multi-axis polarized RF antenna assembly to use for communication with the portable access device.
  • the portable access device can be a key fob or a cellar phone.
  • the phased antenna array includes multiple antennas receiving the transmitted signals.
  • Each of the sensors in the vehicle includes one or more antennas.
  • Each of the sensors may be a phased array sensor that includes: three-antenna interleaved circular polarized (CP) receiver with a single radio receiver; six-antenna interleaved linear polarized (LP) receiver with a single radio receiver; three-antenna interleaved CP receiver with a single radio receiver; three-antenna interleaved printed-antenna CP receiver with a single radio receiver.
  • CP circular polarized
  • LP linear polarized
  • the access module detects the direction of an impinging AOA signal accounting for multipath effects.
  • two sinusoidal RF signals that are transmitted and arrive at a sensor array are added together in the antennas of the sensor array.
  • the sum of two sinusoidal RF signals is a sinusoid with a different phase and amplitude that depends on phase angles and amplitudes of the two source sinusoids
  • a mathematical model that is used to predict an AOA direction can indicate an error. This error can be very large and erratic in any dynamic multipath environment.
  • a music algorithm as disclosed herein may be used to identify a source signal along with a potential strong multipath reflection signal.
  • the direct path signal is accurately tracked from the cell phone. This tracking identifies any additional reflected signal(s). Reflected signals may be identified and discarded.
  • the access modules and control modules disclosed herein may implement any of the music algorithms referred to and/or disclosed herein.
  • Direction finding methods can be generally grouped into two categories sometimes referred to as classical and modern methods.
  • Classical methods include varieties of beamforming methods.
  • Modern methods are generally labeled subspace methods.
  • a music algorithm is categorized as a superresolution parameter estimation algorithm using a subspace separation method.
  • a subspace method can require a specific array geometry of two identical, but physically shifted arrays.
  • Other methods include maximum likelihood estimating and beamforming.
  • FIG. 70 shows a side view of multiple antennas 7000 in an array illustrating an angle of arrival Q.
  • the array of antennas may be referred to as an array manifold.
  • Each of the antennas 7000 may be structured the same and/or similarly as any of the antennas disclosed herein.
  • one or more of the antennas are quadrifilar helix antennas.
  • the music algorithm uses a model of the array manifold that describes a response of the array manifold to one or more impinging AOA signals.
  • a uniform linear array (ULA) of antennas may be defined as shown in FIG. 70, where m is the antenna index into the array starting at 1 , M is the total number of antennas, d is the spacing between antenna elements, and Q is the angle of an impinging signal.
  • the response of array element m to an impinging signal s may be represented by equation 37, where r is the received signal, a is the complex array manifold response, s is the source signal, m as stated is the index number of the antenna element of interest, Q as stated is the physical angle of the impinging source signal, l is the wavelength of the signal, and n(t) represents noise in the receiver channel.
  • r is the received signal
  • a is the complex array manifold response
  • s is the source signal
  • m as stated is the index number of the antenna element of interest
  • Q as stated is the physical angle of the impinging source signal
  • l is the wavelength of the signal
  • n(t) represents noise in the receiver channel.
  • Equation 43 may be used to map N source tones, at different source angles of arrival represented in signal Sit) at a given time t, through an antenna array response manifold model A to received (measured) data vector r(t) with channel noise n(t), where r(t) is an Mx1 vector of the received data at each antenna element.
  • r(t) ASit) + n (t) (43)
  • This mathematical structure of the array manifold model is used to derive the music algorithm and may also be used for simulation and modeling of a test environment.
  • the access module uses singular value decomposition (SVD) or another eigenvalue decomposition technique and calculates the MxM matrix U, as represented by equation 45.
  • SVD singular value decomposition
  • U MxM matrix
  • FIG. 73 shows eigenvector visualization with array manifold response at 35°.
  • FIG. 74 shows eigenvector visualization with array manifold response at 0°.
  • the magnitude and direction of the arrows indicate the real and imaginary components of each point corresponding to real on the X-axis and imaginary on the Y-axis.
  • the solid and short dashed arrows represent the 3x3 array of eigenvectors.
  • the vector columns (X axis) are sorted by the eigenvalues of the eigenvectors from large (on the left) to small (on the right).
  • the left-most column number 1 represents the signal subspace
  • columns 2 and 3 represent the noise subspace.
  • the effective number of coherent tones that may be resolved is N £ sources. For a 3-antenna array, up to 2 coherent tones may be resolved. This method may be used for a 3-antenna phased array of a phased antenna array receiver board. The method may end at 7416.
  • a spatial smoothing method may be used.
  • the spatial smoothing method is a technique that includes subdividing an array into multiple subarrays and averaging the covariance matrix results of the subarrays together it results in an effectively reduced number of antenna array elements.
  • a forward-backward spatial smoothing (FBSS) method may be used and combines spatial smoothing with the forward-backward approach. It also reduces the number of required antenna elements.
  • FBSS forward-backward spatial smoothing
  • Toeplitz Completion method may be used and is suitable for NLAs.
  • Variations of the music algorithm may be implemented.
  • a derivative of the music algorithm referred to as Root-MUSIC can be used on ULAs to find the impinging signal AOA without the need to calculate results at every potential angle. This reduces the computational power required.
  • the reduction in computational complexity comes from not needing to perform operations 7412, 7414 of the music algorithm including calculating the music spectrum over a large set of Q values and finding the peak(s) of the result.
  • Spectral-MUSIC is a generalized version of Root-MUSIC that may be applied to arbitrary array geometries, but generally applies to wideband noncoherent sources.
  • Smooth- lJSIC refers to a variety of methods of smoothing the covariance matrix in the music algorithm and is applied between operations 7404 and 7406 of FIG. 71
  • Another example derivation referred to as a CLEAN method includes, once a source signal is identified at a given direction, reconstructing a model of the source signal from the known array manifold. This reconstructed signal model is subtracted from the measured impinging signal to remove the impinging signal, thus“cleaning” the measured data of the undesired source signal and allowing review of other sources.
  • One problem that occurs with implementation of the music algorithm on a non ideal antenna array is that two coherent sources with forward-backward covariance smoothing can result in erroneous position measurements. Standard array calibration techniques do not resolve this as the covariance matrix itself results in erroneous subspace separation.
  • a variation of the GLEAN method is performed for multiple coherent sources and includes: identifying source signals using the music algorithm; using the CLEAN method to remove the source signals, one at a time, using the calibrated array manifold; forcing the source signal position to an offset (not at the originally measured location) and recalculating the remaining signal AOA direction; repeating operations 7404 and 7406 of FIG.
  • FIG. 76 shows an antenna selection system 7600, which includes antennas 7602, a switch 7604 and a radio receiver 7606.
  • the radio receiver 7606 selects one of the antennas from which to receive a signal via the switch 7604.
  • the antenna selection system 7600 may be implemented in any of the systems disclosed herein. In one embodiment, the antenna selection system 7600 is implemented in a vehicle and an access module disclosed herein controls operation of the radio receiver 7606.
  • the antenna selection system 7600 is implemented in a PAK AOA system and implements BLE AOA data reception.
  • a portion of a BLE radio packet received by one of the antennas 7602 includes a CW tone.
  • the radio receiver 7606 samples the CW tone to provide a quadrature analytical signal, meaning two sinusoids with a 90° phase difference referred to as in-phase and quadrature-phase signals (I and Q signals).
  • the data that is received is therefore sliced into interleaved samples from each of the antennas with multiple repetitions.
  • FIG. 77 illustrates an example reconstruction method for reconstructing the IQ data.
  • the interleaved data is interpolated to form a received data matrix r(t) for use in the music algorithm.
  • the reconstruction method may be performed by any of the access modules disclosed herein.
  • the signal reconstruction method may begin at 7700.
  • the access module converts an analytical IG sample vector r to a phase angle vector F using the arctangent function.
  • the access module creates a time vector t corresponding to sample vector r based on the data sampling rate.
  • the access module discards samples taken near the antenna switching times.
  • the access module unwraps each repetition portion of data points with a step size of p .
  • the access module measures the average slope. This is the average frequency of the sinusoids.
  • the access module for each antenna: a) finds the intercept of the first repetition of sampled data; b) projects the positions of the next repetition of sampled data; c) determines an average difference between expected and measured actual positions; d) adds or subtracts 2p ; e) repeats operations c and d including repeating the determining of the average difference and the adding or subtracting of 2p until the average difference is less than p ; f) finds the average slope of all points already aligned; and g) repeats operations b-g using the new slope for the next signal repetition.
  • the access module measures the standard deviation of the average slope of each antenna.
  • the access module repeats operation 7712-7718 for the antenna selected at 7716, until a low standard deviation or a maximum retry counter expires.
  • the access module for each antenna m, interpolates a straight line of points on the original time vector t to get the reconstructed phase angle vector F . This may be based on the phase angle vector F determined at 7702.
  • the access module recreates an IQ sample vector f m for each antenna m using equation (51 ), where g is the average magnitude of the valid subset of original sample vector r. Subsequent to operation 7722, the method may end at 7724.
  • the above-stated method is implemented in a vehicle access system and/or PAK system, as disclosed herein, having circular polarized antennas. Signals are received at the circular polarized antennas. IQ data is determined as described above based on the received signals and angles of arrival are determined using the music algorithm.
  • FIGs. 79A-C show a vehicle 7900 illustrating another example placement of a sensor 7902.
  • FIG. 79C shows example bounce reflections and corresponding paths of a signal transmitted from a key fob 7904 or other portable access device and detected at the sensor 7902.
  • the sensor 7902 is located low and in a center of the vehicle 7900.
  • the sensor 7902 may be located in a floor 7903 or a center console 7905 of the vehicle.
  • the sensor 7902 is located to cause multiple bounce paths of the transmitted signal prior to being received at the sensor 7902.
  • the key fob 7904 is shown low relative to the vehicle for illustrations purposes, but may be located at a higher position.
  • each sensor includes two or more antennas, such as two or more of the antennas disclosed and/or referred to herein.
  • two sensors are included and each sensor includes two antennas, such that there are four antenna paths.
  • a single sensor is included, and the sensor includes three or more antennas.
  • carrier phase based ranging with use of the music algorithm or the like is implemented to determine angles of arrival of signals transmitted by the key fobs 7804, 7904. This may include eigenvalue decomposition. Distances between the key fobs 7804, 7904 and the vehicles 7800, 7900 are determined based on the angles of arrival. When the key fobs 7804, 7904 are within predetermined distances of the vehicles 7800, 7900, access is permitted. Although there is a low probability of a line of sight, there is a high probability that the transmitted signals bounce multiple times and follow multiple paths to each of the sensors 7802, 7902.
  • the direction of an arrow generally demonstrates the flow of information (such as data or instructions) that is of interest to the illustration.
  • information such as data or instructions
  • the arrow may point from element A to element B. This unidirectional arrow does not imply that no other information is transmitted from element B to element A.
  • element B may send requests for, or receipt acknowledgements of, the information to element A.
  • the module may include one or more interface circuits.
  • the interface circuits may include wired or wireless interfaces that are connected to a local area network (LAN), the Internet, a wide area network (WAN), or combinations thereof.
  • LAN local area network
  • WAN wide area network
  • the functionality of any given module of the present disclosure may be distributed among multiple modules that are connected via interface circuits. For example, multiple modules may allow load balancing.
  • a server (also known as remote, or cloud) module may accomplish some functionality on behalf of a client module.
  • code may include software, firmware, and/or microcode, and may refer to programs, routines, functions, classes, data structures, and/or objects.
  • shared processor circuit encompasses a single processor circuit that executes some or all code from multiple modules.
  • group processor circuit encompasses a processor circuit that, in combination with additional processor circuits, executes some or all code from one or more modules. References to multiple processor circuits encompass multiple processor circuits on discrete dies, multiple processor circuits on a single die, multiple cores of a single processor circuit, multiple threads of a single processor circuit, or a combination of the above.
  • shared memory circuit encompasses a single memory circuit that stores some or all code from multiple modules.
  • group memory circuit encompasses a memory circuit that, in combination with additional memories, stores some or all code from one or more modules.
  • the term memory circuit is a subset of the term computer-readable medium.
  • the term computer-readable medium does not encompass transitory electrical or electromagnetic signals propagating through a medium (such as on a carrier wave); the term computer-readable medium may therefore be considered tangible and non-transitory.
  • the computer programs include processor-executable instructions that are stored on at least one non-transitory, tangible computer-readable medium.
  • the computer programs may also include or rely on stored data.
  • the computer programs may encompass a basic input/output system (BIOS) that interacts with hardware of the special purpose computer, device drivers that interact with particular devices of the special purpose computer, one or more operating systems, user applications, background services, background applications, etc.
  • BIOS basic input/output system
  • the computer programs may include: (i) descriptive text to be parsed, such as HTML (hypertext markup language), XML (extensible markup language), or JSON (JavaScript Object Notation) (ii) assembly code, (iii) object code generated from source code by a compiler, (iv) source code for execution by an interpreter, (v) source code for compilation and execution by a just-in-time compiler, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Remote Sensing (AREA)
  • Radar, Positioning & Navigation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Mechanical Engineering (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Lock And Its Accessories (AREA)
  • Position Fixing By Use Of Radio Waves (AREA)
  • Radar Systems Or Details Thereof (AREA)
PCT/US2020/024672 2019-03-25 2020-03-25 Up-sampling and cross-correlation for time of arrival determinations in passive entry/passive start systems WO2020198335A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
DE112020001498.3T DE112020001498T5 (de) 2019-03-25 2020-03-25 Aufwärtsabtastung und Kreuzkorrelation für Ankunftszeitbestimmungen in Passivzugang/Passivstart-Systemen
CN202080023785.8A CN113614568A (zh) 2019-03-25 2020-03-25 被动进入/被动启动系统中的到达时间确定的上采样和互相关
JP2021557345A JP7380706B2 (ja) 2019-03-25 2020-03-25 パッシブエントリー／パッシブスタートシステムにおける到達時間決定のためのアップサンプリング及び相互相関

Applications Claiming Priority (10)

Application Number Priority Date Filing Date Title
US201962823210P 2019-03-25 2019-03-25
US62/823,210 2019-03-25
US201962826239P 2019-03-29 2019-03-29
US201962826212P 2019-03-29 2019-03-29
US62/826,212 2019-03-29
US62/826,239 2019-03-29
US16/598,191 2019-10-10
US16/598,191 US10991182B2 (en) 2018-10-12 2019-10-10 Multi-axis polarized RF antenna assemblies for passive entry/passive start systems
US16/824,280 2020-03-19
US16/824,280 US11428799B2 (en) 2018-10-12 2020-03-19 Up-sampling and cross-correlation for time of arrival determinations in passive entry/passive start systems

Publications (1)

Publication Number Publication Date
WO2020198335A1 true WO2020198335A1 (en) 2020-10-01

Family

ID=72611220

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2020/024672 WO2020198335A1 (en) 2019-03-25 2020-03-25 Up-sampling and cross-correlation for time of arrival determinations in passive entry/passive start systems

Country Status (4)

Country Link
JP (1) JP7380706B2 (zh)
CN (1) CN113614568A (zh)
DE (1) DE112020001498T5 (zh)
WO (1) WO2020198335A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100240396A1 (en) * 2009-03-17 2010-09-23 Qualcomm Incorporated Position location using multiple carriers
US8644768B2 (en) 2008-12-30 2014-02-04 Atmel Corporation System, method, and circuit for distance measurement between two nodes of a radio network
US20180138993A1 (en) * 2016-11-11 2018-05-17 Nxp B.V. Processing module and associated method
US20180194322A1 (en) * 2017-01-11 2018-07-12 Ford Global Technologies, Llc Method and apparatus to secure a system for passive unlocking of a vehicle system against relay station attacks
US20180254870A1 (en) * 2017-03-02 2018-09-06 Nxp B.V. Processing module and associated method

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3572391B2 (ja) * 1999-08-04 2004-09-29 日産自動車株式会社 距離計測装置
JP2001051048A (ja) * 1999-08-12 2001-02-23 Clarion Co Ltd 測距システム
JP2006118886A (ja) * 2004-10-19 2006-05-11 Sanyo Electric Co Ltd 距離算出システム、距離算出システムの距離算出方法
GB0426446D0 (en) * 2004-12-02 2005-01-05 Koninkl Philips Electronics Nv Measuring the distance between devices
JP5445082B2 (ja) * 2009-12-03 2014-03-19 ソニー株式会社 速度算出装置及び速度算出方法並びにナビゲーション装置及びナビゲーション機能付携帯電話機
JP6892271B2 (ja) * 2017-01-31 2021-06-23 株式会社東海理化電機製作所 伝搬距離推定装置
DE102017107832A1 (de) * 2017-04-11 2018-10-11 HELLA GmbH & Co. KGaA Verfahren, Computerprogramme und Vorrichtungen zum Bestimmen einer Position eines Mobilgerätes relativ zu einem Fahrzeug

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8644768B2 (en) 2008-12-30 2014-02-04 Atmel Corporation System, method, and circuit for distance measurement between two nodes of a radio network
US20100240396A1 (en) * 2009-03-17 2010-09-23 Qualcomm Incorporated Position location using multiple carriers
US20180138993A1 (en) * 2016-11-11 2018-05-17 Nxp B.V. Processing module and associated method
US20180194322A1 (en) * 2017-01-11 2018-07-12 Ford Global Technologies, Llc Method and apparatus to secure a system for passive unlocking of a vehicle system against relay station attacks
US20180254870A1 (en) * 2017-03-02 2018-09-06 Nxp B.V. Processing module and associated method

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
BRANDSCHAUM: "Distance-Bounding Protocols (Extended abstract", WORKSHOP ON THE THEORY AND APPLICATION OF CRYPTOGRAPHIC TECHNIQUES ON ADVANCES IN CRYPTOLOGY (EUROCRYPT '93
HANCKEKUHN: "Attacks on Time-of-Flight Distance Bounding Channels", PROCEEDINGS OF THE FIRST ACM CONFERENCE ON WIRELESS NETWORK SECURITY (WISEC '08
OLAFSDOTTERRANGANATHANCAPKUN: "On the Security of Carrier Phase-based Ranging", IACR CRYPTOLOGY EPRINT ARCHIVE, 2016

Also Published As

Publication number Publication date
DE112020001498T5 (de) 2022-01-13
CN113614568A (zh) 2021-11-05
JP7380706B2 (ja) 2023-11-15
JP2022524644A (ja) 2022-05-09

Similar Documents

Publication Publication Date Title
US11127234B2 (en) Passive entry/passive start communication systems with selected antennas having multiple polarized axes
US11714184B2 (en) Up-sampling and cross-correlation for time of arrival determinations in passive entry/passive start systems
US11217048B2 (en) Passive entry/passive start systems implementing music algorithm based angle of arrival determinations for signals received via circular polarized antennas
US11227453B2 (en) Passive entry/passive start systems implementing carrier phase based ranging with music style eigenvalue decomposition for distance determinations
JP7226585B2 (ja) 円偏波アンテナを介して受信された信号の到来角度決定に基づくｍｕｓｉｃアルゴリズムを実装するパッシブエントリー／パッシブスタートシステム
CN113678176B (zh) 利用用于距离确定的music风格特征值分解实现基于载波相位的测距的被动进入/被动启动系统
WO2020198335A1 (en) Up-sampling and cross-correlation for time of arrival determinations in passive entry/passive start systems

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20719546

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021557345

Country of ref document: JP

Kind code of ref document: A

122 Ep: pct application non-entry in european phase

Ref document number: 20719546

Country of ref document: EP

Kind code of ref document: A1