Passive entry / passive start communication system utilizing selected antennas with multiple polarization axes

Abstract

A method of communicating with a portable access device (400) includes iteratively executing an algorithm via an access module (210) of a vehicle (200). The algorithm includes a series of operations, including: selecting a frequency from a plurality of frequencies; selecting an antenna pair from a plurality of possible antenna pairs, wherein the antennas (1102, 1104) in the possible antenna pair include antennas (1102, 1104) with different polarization axes; sending a packet to the portable access device (400) via the selected antenna pair; receiving a first RSSI and a response signal from the portable access device (400), the first RSSI corresponding to the transmission of the packet; and measuring a second RSSI of the response signal; based on the first RSSI and the second RSSI, the best frequency among the frequencies and the best antenna pair among the possible antenna pairs are selected. One or more additional packets are sent using the selected best frequency and the selected best antenna pair.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Patent Application No. 16 / 598,224, filed on October 10, 2019, and also claims the benefit of U.S. Provisional Application No. 62 / 744,814, filed on October 12, 2018, U.S. Provisional Application No. 62 / 801,392, filed on February 5, 2019, and U.S. Provisional Application No. 62 / 826,212, filed on March 29, 2019. The entire disclosures of the above-mentioned applications are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to a passive entry / passive start system. Background Art

[0004] The background description provided here is to generally present the context of the present disclosure. To the extent described in this background section, all aspects of the description currently claimed as work of the inventor and which may not be considered prior art at the time of filing are neither explicitly nor implicitly admitted as prior art to the present disclosure.

[0005] Conventional passive entry / passive start (PEPS) systems allow keyless entry, including providing a user with access to various vehicle functions if the user possesses a key fob that has been paired with an onboard PEPS electronic control unit (or PEPS module). As an example, a user possessing a key fob can access a vehicle having a PEPS module. The key fob communicates with the PEPS module, and if the key fob is authenticated, the PEPS module can unlock the vehicle's doors. The PEPS module (i) performs an authentication process to determine whether the key fob is authorized to access the vehicle, and (ii) determines the location of the key fob relative to the vehicle. The authentication process may include the exchange of an encrypted password or signature. If the password or signature is correct, the key fob is determined to be authorized. The location of the key fob may be determined based on, for example, the strength of a signal received from the key fob. If the key fob is authenticated and is within an authorized area of ​​the vehicle, the interior of the vehicle may be accessed without the use of a conventional key.

[0006] As another example, a user in possession of a key fob may activate a vehicle function by pressing a button on the key fob. In response to pressing the button, the key fob communicates with the PEPS module, and if the key fob is authenticated and within a predetermined distance of the vehicle, the PEPS module performs the function associated with the button pressed on the key fob (e.g., starting the vehicle, unlocking a door, setting an alarm, etc.). The communications performed for both examples may include the key fob and the PEPS module performing a one-way low frequency (LF) wake-up function and a one-way or two-way radio frequency (RF) authentication function.

[0007] A phone-as-a-key (PAK) vehicle access system may operate similarly to the PEPs system, except that a mobile phone is used to access the vehicle instead of a key fob. For example, a mobile phone may communicate with a PAK module or a telematics control unit (TCU) in the vehicle to begin an access pairing process. The mobile phone and PAK module or TCU perform an access pairing process to establish a trust relationship. The pairing process may include Pairing, whereby: secure information is exchanged directly between the mobile phone and the vehicle; mobile phone addresses, mobile phone identity resolution keys, reserved identifiers, and / or encryption keys are exchanged via a cloud-based network; and / or the mobile phone presents a certificate to the vehicle, where the certificate is authenticated by (i) the mobile phone, (ii) a trusted security signing authority (such as the manufacturer of the vehicle), and / or (iii) a trusted third party. In the case of a certificate, the certificate may include an identifier of a person authorized to access the vehicle, an identifier of a cloud-based network authorized to transmit the certificate, an identifier of a rental agreement for the vehicle, an identifier of the vehicle, dates and time periods during which the authorized person is permitted to use the vehicle, and / or other restrictions and / or access / permission information.

[0008] For passive entry, some user action is usually required to initiate the process of waking up the key fob or mobile phone (referred to as a portable access device). For example, this can include a user approaching the vehicle with a portable access device and / or touching and / or pulling a door handle. When the PEPS module or PAK module (referred to as an access module) detects this behavior, the access module performs a localization process to begin searching for and waking up the key fob. In a one-way RF system, for the purpose of authenticating the key fob, an LF downlink signal (e.g., a 125 kilohertz (kHz) signal) is sent from the access module to the key fob to wake up the key fob to send commands and data. The key fob then sends a response signal to the access module via an RF uplink. The response signal can be at an ultra-high frequency (e.g., 315 megahertz (MHz) or 433MHz). In a two-way RF system, an LF downlink signal is sent from the access module to the key fob to wake up the key fob and establish a two-way RF link between the access module and the key fob. The two-way RF link can send signals at UHF frequencies (e.g., 315MHz, 422MHz, 868MHz, or 915MHz). The key fob is then authenticated using a two-way RF link. The key fob includes a microcontroller that remains in a sleep mode (or low-power listening mode) that continuously checks for a valid LF signal. Once a valid LF signal contains the correct vehicle-specific wake-up identifier, the microcontroller generates a signal to wake up the PEPS controller to communicate with the vehicle's access module.

[0009] The vehicle may have, for example, 4-6 LF antennas that generate LF magnetic fields. The controller of the key fob measures the LF signal level during communication with the access module. The controller determines a received signal strength indicator (RSSI) and provides the RSSI to the access module. The access module then determines the location of the key fob based on the RSSI. The key fob includes three discrete antenna coils or a 3D coil that are used to determine x, y, and z axis values ​​that indicate the location of the key fob.

[0010] Smartphones, wearable devices, and / or other smart portable network devices can act as key fobs. Smart portable network devices can enable various vehicle functions and long-range ranging features, such as passive welcome lighting, distance limits on remote parking applications, etc. Summary of the invention

[0011] A multi-axis polarized RF antenna assembly is provided, and includes a circular polarized antenna, a circular isolator, and a linear polarized antenna. The circular polarized antenna includes a conductive annular body having an inner hole. The circular isolator is connected to the conductive annular body. The linear polarized antenna is connected to the circular polarized antenna and the circular isolator, and extends outward from the circular isolator. The linear polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linear polarized antenna extends orthogonal to the radius of the circular polarized antenna.

[0012] In other features, the conductive element is a wire. In other features, the sleeve is formed of polytetrafluoroethylene. The conductive element is formed of copper.

[0013] In other features, the linearly polarized antenna is configured to extend downwardly from the circularly polarized antenna in use.

[0014] Among other features, the circularly polarized antenna is a 2-axis antenna. The linearly polarized antenna is a single-axis antenna.

[0015] In other features, the multi-axis polarized RF antenna assembly further includes a ground plane. A circular isolator is disposed on the ground plane, between the conductive element and the ground plane and between the circular polarized antenna and the ground plane.

[0016] In other features, the circularly polarized antenna includes two feed points that are phase-shifted by 90° and is configured to receive signals that are 90° out of phase with each other.

[0017] In other features, a vehicle is provided, the vehicle including a vehicle body and a roof. The roof includes a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly is oriented in the roof such that a linearly polarized antenna extends downwardly from a circularly polarized antenna.

[0018] In other features, a vehicle system is provided, which includes a multi-axis polarized RF antenna assembly, a second multi-axis polarized RF antenna assembly, and an access module. The multi-axis polarized RF antenna assembly is a first multi-axis polarized RF antenna assembly and is configured to be implemented in a vehicle. The second multi-axis polarized RF antenna assembly is configured to be implemented in a vehicle and includes: a second circular polarized antenna, including a second conductive annular body having a second inner hole; a second circular isolator, connected to the second conductive annular body; and a second linear polarized antenna, connected to the second circular isolator and extending outward from the second circular isolator. The second linear polarized antenna includes a sleeve and a conductive element extending through the sleeve of the second linear polarized antenna. The second linear polarized antenna extends orthogonal to the radius of the second circular polarized antenna. The access module is connected to the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly, and is configured to communicate with a portable access device via the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly.

[0019] In other features, at any time, at least one of the linearly polarized antenna or the first multi-axis polarized RF antenna assembly is not cross-polarized with an antenna of the second multi-axis polarized RF antenna assembly.

[0020] In other features, the access module is configured to perform a passive entry passive start operation or a phone-as-a-key operation including sending and receiving radio frequency signals via a first one of the multi-axis polarized RF antenna assemblies and a second one of the multi-axis polarized RF antenna assemblies.

[0021] In other features, the access module is configured to grant access to the vehicle based on the radio frequency signal.

[0022] In other features, the access module is configured to execute an algorithm to determine which antenna pair having a first one of the multi-axis polarized RF antenna assemblies and a second one of the multi-axis polarized RF assemblies to use for communicating with the portable access device. In other features, the portable access device is a key fob or a cellular phone.

[0023] In other features, a method for communicating with a portable access device is provided. The method includes iteratively executing an algorithm via an access module of a vehicle, wherein the algorithm includes a series of operations including: selecting a frequency from frequencies; selecting an antenna pair from possible antenna pairs; wherein the antennas in the possible antenna pairs include antennas with different polarization axes; sending a packet to the portable access device via the selected antenna pair; receiving a first received signal strength indicator RSSI and a response signal from the portable access device, wherein the first RSSI corresponds to the transmission of the packet; and measuring a second RSSI of the response signal. Based on the first RSSI and the second RSSI, select a best frequency from the frequencies and a best antenna pair from the possible antenna pairs. Send one or more additional packets using the selected best frequency and the selected best antenna pair.

[0024] In other features, each selected antenna pair includes one of the linearly polarized antennas and one of the circularly polarized antennas.

[0025] In other features, the method further comprises: sending the one or more additional packets to authorize the portable access device; determining whether the portable access device is authorized to access the interior of the vehicle; and granting access to the interior of the vehicle if the portable access device is authorized.

[0026] In other features, the method further includes: measuring a flight time of the one or more additional packets, including: a time to send the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device; and estimating a distance between the vehicle and the portable access device based on the measured flight time.

[0027] In other features, the estimated distance is used to detect whether another device is attempting to perform a range extender type relay station attack. In other features, the method further includes: if the other device is attempting to perform a range extender type relay station attack, executing a countermeasure including blocking access to an interior of the vehicle. In other features, the countermeasure includes notifying an owner of the vehicle of the range extender type relay station attack.

[0028] In other features, the method further includes: exchanging a plurality of unmodulated carrier tone pairs with the portable access device at a plurality of frequencies, wherein the unmodulated carrier tone pairs include received tones and transmitted tones; measuring the phase of the received tones relative to the transmitted tones and collecting frequency data; and estimating the distance between the vehicle and the portable access device based on the measured phase and frequency data.

[0029] In other features, the method includes determining whether another device is attempting to perform a range extender-type relay attack based on the estimated distance. In other features, each selected antenna pair includes a linearly polarized antenna.

[0030] In other features, the algorithm includes switching between possible antenna pairs between consecutively transmitted packets. In other features, the algorithm includes switching between possible antenna pairs during transmission of a portion of a packet. In other features, the portion of the packet is a continuous wave tone.

[0031] In other features, some of the possible antenna pairs include two antennas that are co-located.

[0032] In other features, the method further includes sending a packet to a portable access device; measuring a time-of-flight value for the packet based on a response signal received from the portable access device, wherein the response signal is sent based on the packet; determining whether another device is performing a range extender type relay attack based on the time-of-flight value; and blocking access to an interior of the vehicle in response to detecting a range extender type relay attack.

[0033] In other features, the portable access device is a key fob or a cellular telephone. In other features, the method further comprises encrypting an identifier of the best antenna pair. The sending of the one or more additional packets includes the encrypted identifier of the best antenna pair.

[0034] In other features, a vehicle system for communicating with a portable access device is provided. The vehicle system includes an access module and antennas with different polarization axes. The access module is configured to iteratively execute an algorithm. The algorithm includes a series of operations, including: selecting a frequency from a plurality of frequencies; selecting an antenna pair from antennas with different polarization axes; sending a packet to the portable access device via the selected antenna pair; receiving a first RSSI and a response signal from the portable access device, wherein the first RSSI corresponds to the sending of the packet; and measuring a second RSSI of the response signal. The access module is configured to: based on the first RSSI and the second RSSI, select a best frequency among the frequencies and a best antenna pair among the antenna pairs; and send one or more additional packets using the selected best frequency and the selected best antenna pair.

[0035] In other features, the access module is configured to: measure the flight time of the one or more additional packets, including: the time to send the one or more additional packets to the portable access device and the time to receive one or more responses from the portable access device; and estimate the distance between the vehicle and the portable access device based on the measured flight time.

[0036] In other features, the access module is configured to: exchange multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, wherein the unmodulated carrier tones include receive tones and transmit tones; measure the phase of the receive tones relative to the transmit tones; collect the measured phase and frequency data; and estimate the distance between the vehicle and the portable access device using the measured phase and frequency data.

[0037] In other features, the access module is configured to detect whether the portable access device is attempting to perform a range extender-type relay attack based on the estimated distance.

[0038] In other features, the access module is configured to detect whether the device is attempting to perform a range extender-type relay attack based on the estimated distance.

[0039] In other features, the access module is configured to execute countermeasures including blocking access to an interior of the vehicle if the portable access device is attempting to perform a range extender relay attack.

[0040] In other features, the countermeasure includes notifying an owner of the vehicle of the range extender relay attack. In other features, the portable access device is a key fob or a cellular telephone.

[0041] In other features, the portable access device is configured to encrypt an identifier of the best antenna pair. The sending of the one or more additional packets includes the encrypted identifier of the best antenna pair.

[0042] In other features, a system for detecting an extended-range relay attack is provided. The system includes a first transmitter, a receiver, and a first module. The first transmitter is configured to transmit a first radio frequency signal from one of a vehicle and a portable access device to the other of the vehicle and the portable access device. The receiver is configured to receive a first response signal in response to the first radio frequency signal from one of the vehicle and the portable access device. The first module is configured to: monitor or generate one or more parameters associated with the transmission of the first radio frequency signal and the reception of the first response signal; based on the one or more parameters, detect an extended-range relay attack performed by an attacking device to obtain at least one of access to a vehicle or operational control of the vehicle, wherein at least one of the following exists: (i) the first radio frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) the first response signal is relayed from the portable access device to the vehicle via the attacking device; and execute countermeasures in response to detecting an extended-range relay attack.

[0043] In other features, the first module is implemented at a vehicle. In other features, the first module is implemented at a portable access device.

[0044] In other features, the first module is configured to: measure a round trip time of the first radio frequency signal; and detect an extended range relay attack based on the round trip time.

[0045] In other features, the first module is configured to: send a second RF signal and receive a second response signal before sending the first RF signal and receiving the first response signal; monitor at least one of the following: a first received signal strength indicator of the second RF signal or a second received signal strength indicator of the second response signal; and determine at least one of a path, frequency, channel, or antenna pair for sending the first RF signal and receiving the first response signal based on at least one of the first received signal strength indicator or the second received signal strength indicator.

[0046] In other features, the first module is configured to: send a second RF signal and receive a second response signal before sending the first RF signal and receiving the first response signal; monitor the antenna polarization state corresponding to at least one of the second RF signal or the second response signal; and determine at least one of a path, frequency, channel, or antenna pair used for sending the first RF signal and receiving the first response signal based on the antenna polarization state of at least one of the first RF signal or the first response signal.

[0047] In other features, the first module is configured to transmit the first radio frequency signal upon receiving the first response signal or the second radio frequency signal from one of the vehicle and the portable access device.

[0048] In other features, the first module is configured to receive the first response signal upon receiving the second radio frequency signal from one of the vehicle and the portable access device.

[0049] In other features, the first module is configured to: determine a series of randomly selected frequencies or channels; share the series of randomly selected frequencies or channels with one of a vehicle and a portable access device; and send a first radio frequency signal and receive a first response signal based on the randomly selected frequencies or channels.

[0050] In other features, the first module is configured to: randomize an access address for a vehicle or a portable access device; share the randomized access address with the portable access device; and generate the first radio frequency signal to include one of the access addresses.

[0051] In other features, the first module is configured to: measure a length of at least one bit of the first response signal; and detect an extended-range relay attack based on the length of the at least one bit.

[0052] In other features, the first module is configured to: monitor slopes of rising and falling edges of the first response signal; and detect an extended-range relay attack based on the slopes.

[0053] In other features, the first module is configured to align the first response signal with an idealized Gaussian waveform for a known bit pattern and bit rate using a sliding correlation function (including scaling the peak and aligning the zero offset), and detect an extended-range relay attack based on the alignment.

[0054] In other features, the first module is configured to: accumulate a portion of a predetermined waveform of the first response signal just after a zero crossing and before a next peak; determine an average based on the accumulated portion; and detect an extended-range relay attack based on the average.

[0055] In other features, the first module is configured to: accumulate a portion of the first response signal after a peak of the predetermined waveform and before a next zero crossing; determine an average based on the accumulated portion; and detect an extended-range relay attack based on the average.

[0056] In other features, the first module is configured to randomize a direction of travel of the first radio frequency signal, including whether the first radio frequency signal is transmitted from the vehicle to the portable access device or from the portable access device to the vehicle.

[0057] In other features, the countermeasure includes at least one of preventing access to the vehicle or exercising operational control of the vehicle.

[0058] In other features, the system further includes a second transmitter configured to transmit a dummy signal when the first transmitter transmits the first radio frequency signal or the receiver receives the first response signal.

[0059] In other features, the method includes: a first module implemented at a vehicle; and a portable access device including a second module. The first module is configured to send a first radio frequency signal to the portable access device and receive a first response signal from the portable access device. The second module is configured to send a second radio frequency signal to the vehicle and receive a second response signal from the vehicle. The first module sends the first radio frequency signal and the second module sends the first response signal or the second radio frequency signal, or the first module receives the first response signal and the second module sends the second radio frequency signal.

[0060] In other features, the first module and the second module are configured to: exchange at least three pairs of radio signals containing portions of unmodulated carrier tones, wherein the unmodulated carrier tones include receive tones and transmit tones; and measure the phase of the receive tones relative to the transmit tones. One or more of the first module and the second module are configured to: collect frequency and phase information; and estimate the distance between the first module and the second module based on the phase and frequency information.

[0061] In other features, one or more of the first module and the second module are configured to detect an extended-range relay attack using the estimated distance.

[0062] In other features, a method for detecting an extended-range relay attack is provided. The method includes: transmitting a radio frequency signal from one of a vehicle and a portable access device to the other of the vehicle and the portable access device via a transmitter; receiving a response signal in response to the radio frequency signal from one of the vehicle and the portable access device via a receiver; monitoring or generating one or more parameters associated with the transmission of the radio frequency signal and the reception of the response signal; and based on the one or more parameters, detecting an extended-range relay attack performed by an attacking device to gain access to a vehicle or at least one of operational control of the vehicle. There is at least one of the following: (i) a first radio frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) a first response signal is relayed from the portable access device to the vehicle via the attacking device. The method also includes: executing a countermeasure in response to detecting the extended-range relay attack; measuring a round-trip time of the radio frequency signal; monitoring at least one of a first received signal strength indicator of the radio frequency signal or a second received signal strength indicator of the response signal; and detecting the extended-range relay attack based on the round-trip time.

[0063] In other features, a system for accessing a vehicle or providing operational control of a vehicle is provided. The system includes a master device, the master device including: a first antenna module including a first antenna having a different polarization axis; a transmitter configured to send a challenge signal from the vehicle to a slave device via the first antenna module, wherein the slave device is a portable access device; and a first receiver configured to receive a response signal from the slave device in response to the challenge signal. The system also includes a first sniffer device, including: a second antenna module including a second antenna having a different polarization axis; and a second receiver configured to receive the challenge signal from the transmitter and the response signal from the slave device via the second antenna module. The first sniffer device is configured to measure when the challenge signal and the response signal arrive at the first sniffer device to provide an arrival time. The master device or the first sniffer device is configured to (i) estimate at least one of a distance from the vehicle to the slave device or a position of the slave device relative to the vehicle based on the arrival time, and (ii) based on at least one of the estimated distance or position, prevent at least one of access to the vehicle or operational control of the vehicle.

[0064] In other features, the master device or the first sniffer device is configured to: determine a round trip time associated with the transmission of the challenge signal based on the arrival time; and detect an extended-range relay attack performed by an attack device to gain at least one of access to a vehicle or operational control of the vehicle based on the round trip time. The response signal is relayed from the slave device to the vehicle by the attack device and is altered by the attack device. The master device is configured to execute a countermeasure in response to detecting the extended-range relay attack.

[0065] In other features and at any time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0066] In other features and at any time, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

[0067] In other features, the master device or the first sniffer device is configured to: determine a first amount of time that the first sniffer device receives the challenge signal and a second amount of time that the sniffer device receives the response signal; and estimate the distance based on the first amount of time and the second amount of time.

[0068] In other features, the system also includes a second sniffer and a third sniffer. The second sniffer device includes a third antenna module and a third receiver, the third antenna module includes a third antenna, and the third receiver is configured to receive a questioning signal from the transmitter and a response signal from the slave device via the third antenna module. The third sniffer device includes a fourth antenna module and a fourth receiver, the fourth antenna module includes a fourth antenna, and the fourth receiver is configured to receive a questioning signal from the transmitter and a response signal from the slave device via the fourth antenna module. The second sniffer device is configured to measure when the questioning signal and the response signal arrive at the second sniffer device to provide an arrival time. The third sniffer device is configured to measure when the questioning signal and the response signal arrive at the third sniffer device to provide an arrival time. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the arrival time provided by the first sniffer device, the arrival time provided by the second sniffer device, and the arrival time provided by the third sniffer device.

[0069] In other features, the first sniffer device is configured to determine a first amount of time for the first sniffer device to receive a response signal. The second sniffer device is configured to determine a second amount of time for the second sniffer device to receive a response signal. The third sniffer device is configured to determine a third amount of time for the third sniffer device to receive a response signal. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate a location based on the first amount of time, the second amount of time, and the third amount of time.

[0070] In other features, the master device is configured to periodically send a challenge signal or other challenge signal to the slave device and receive a corresponding response signal from the slave device. The first sniffer device is configured to measure when the challenge signal and the response signal arrive at the first sniffer device to provide corresponding arrival times. The master device or the first sniffer device is configured to (i) update at least one of the distance or the position based on the arrival time associated with the challenge signal and the response signal, and (ii) based on at least one of the updated distance or the updated position, prevent at least one of access to the vehicle or operational control of the vehicle.

[0071] In other features, a method for accessing a vehicle or providing operational control of a vehicle is provided. The method includes: sending a challenge signal from a master device of the vehicle to a slave device via a first antenna module, wherein the first antenna module includes a first antenna with a different polarization axis; receiving a response signal from the slave device in response to the challenge signal at a first receiver; receiving the challenge signal from the master device and the response signal from the slave device at a first sniffer device via a second antenna module and a second receiver, wherein the second antenna module includes a second antenna with a different polarization axis; measuring when the challenge signal and the response signal are received at the first sniffer device to provide an arrival time via the first sniffer device; estimating at least one of a distance from the vehicle to the slave device or a position of the slave device relative to the vehicle based on the arrival time; and blocking at least one of access to the vehicle or operational control of the vehicle based on at least one of the estimated distance or position.

[0072] In other features, the method includes: determining a round-trip time associated with the transmission of the challenge signal based on the arrival time; detecting an extended-range relay attack performed by an attacking device to gain at least one of access to a vehicle or operational control of the vehicle based on the round-trip time, wherein a response signal is relayed from a slave device to the vehicle by the attacking device and altered by the attacking device; and executing a countermeasure in response to detecting the extended-range relay attack.

[0073] In other features and at any time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0074] In other features and at any time, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

[0075] In other features, the method further includes determining a first amount of time for the first sniffer device to receive the challenge signal and a second amount of time for the sniffer device to receive the response signal; and estimating the distance based on the first amount of time and the second amount of time.

[0076] In other features, the method further includes: receiving the challenge signal from the transmitter and the response signal from the slave device at a third receiver of the second sniffer device via a third antenna module, wherein the third antenna module includes a third antenna having a different polarization axis; and receiving the challenge signal from the transmitter and the response signal from the slave device at a fourth receiver of the third sniffer device via a fourth antenna module. The fourth antenna module includes a fourth plurality of antennas having different polarization axes. The method further includes: measuring when the challenge signal and the response signal arrive at the second sniffer device to provide an arrival time via the second sniffer device; measuring when the challenge signal and the response signal arrive at the third sniffer device to provide an arrival time via the third sniffer device; and estimating the location based on the arrival time provided by the first sniffer device, the arrival time provided by the second sniffer device, and the arrival time provided by the third sniffer device.

[0077] In other features, the method further includes determining a first amount of time to receive a response signal for the first sniffer device; determining a second amount of time to receive a response signal for the second sniffer device; determining a third amount of time to receive a response signal for the third sniffer device; and estimating a location based on the first amount of time, the second amount of time, and the third amount of time.

[0078] In other features, a challenge signal or other challenge signal is periodically sent from a master device to a slave device, and a corresponding response signal is received from the slave device; when the challenge signal and the response signal arrive at the first sniffer device is measured at the first sniffer device to provide corresponding arrival times; at least one of the distance or the location is updated based on the arrival times associated with the challenge signal and the response signal; and at least one of access to the vehicle or operational control of the vehicle is blocked based on at least one of the updated distance or the updated location.

[0079] In other features, a system for accessing a vehicle or providing operational control of a vehicle is provided. The system includes a first network device and a control module. The first network device includes a first antenna module, a transmitter, and a receiver. The first antenna module includes antennas with different polarization axes. The transmitter is configured to send a series of tones from the vehicle to a second network device via the first antenna module, and change the frequency of the tones during the transmission of the series of tones. At any time, at least one of the antennas of the first antenna module is not cross-polarized with the antenna of the second network device. The receiver is configured to receive the series of tones from the second network device. The control module is configured to (i) determine a comparison between a phase difference of the series of tones and a frequency difference of the series of tones, (ii) determine a distance between the first network device and the second network device based on the phase difference and the frequency difference, and (iii) based on the distance, prevent at least one of access to the vehicle or operational control of the vehicle.

[0080] In other features, the control module is configured to: for each tone in the tones, change the corresponding frequency during the transmission of the tone; generate a curve for each tone that relates the phase change of each tone in the tones to the frequency change; determine the slope of the curve; and determine the distance based on the slope of the curve.

[0081] In other features, the control module randomizes the channel selected for transmitting the series of tones.

[0082] In other features, the control module randomizes the direction in which tones are sent between the first network device and the second network device. The tones include one or more tones in the series of tones.

[0083] In other features, the control module is configured to: transmit and receive a series of tones via the transmitter and the receiver; and determine the distance based on a phase difference and a corresponding frequency difference of the series of tones.

[0084] In other features, the system also includes a second network device. The first network device includes a first tone exchange responder and a first tone exchange initiator. The first tone exchange initiator includes a transmitter. The first tone exchange responder includes a receiver. The second network device includes a second tone exchange responder and a second tone exchange initiator. The second tone exchange responder responds to the series of tones by sending the series of tones or the second series of tones back to the first tone exchange initiator. The second tone exchange initiator sends a third series of tones in response to the first tone exchange.

[0085] In other features, the control module is configured to determine the distance based on at least one of: (i) a phase difference of the second series of tones and a frequency difference of the second series of tones, or (ii) a phase difference of the third series of tones and a frequency difference of the third series of tones.

[0086] In other features, the first network device is implemented within a vehicle.The second network device is a portable access device.

[0087] In other features, the first network device simultaneously sends two symbols to the second network device at two different frequencies, and the length of the two symbols is less than or equal to 1 us to prevent successful attacks.

[0088] In other features, clock timing of the first network device and the second network device are synchronized. The first network device sends a first symbol to the second network device at a first frequency. Simultaneously with the first network device sending the first symbol to the second network device, the second network device sends a second symbol to the first network device. The length of the first symbol and the second symbol are both less than or equal to 1 us to prevent a successful attack.

[0089] In other features, a method of accessing a vehicle or providing operational control of a vehicle is provided. The method includes: transmitting a series of tones from a first network device to a second network device via a transmitter and a first antenna module, and changing the frequency of the tones during the transmission of the series of tones, wherein the first antenna module includes an antenna, and wherein, at any time, at least one of the antennas of the first antenna module is not cross-polarized with the antenna of the second network device; receiving the series of tones from the second network device at a receiver in the vehicle; determining a phase difference of the series of tones and a frequency difference of the series of tones; determining a distance between the first network device and the second network device based on the phase difference and the frequency difference; and preventing at least one of access to the vehicle or operational control of the vehicle based on the distance.

[0090] In other features, the method also includes: for each tone in the tones, changing the corresponding frequency during the transmission of the tone; generating a curve for each tone that relates the phase change of each tone to the frequency change; determining the slope of the curve; and determining the distance based on the slope of the curve.

[0091] In other features, the method further comprises randomizing a channel selected for transmitting the series of tones.

[0092] In other features, the method further comprises randomizing a direction in which tones are sent between the first network device and the second network device. The tones include one or more tones in the series of tones.

[0093] In other features, the method further includes transmitting and receiving a series of tones via the transmitter and the receiver; and determining the distance based on a phase difference and a corresponding frequency difference of the series of tones.

[0094] In other features, the method further includes: responding to the series of tones via a second tone exchange responder of the second network device by sending the series of tones or the second series of tones back to the first tone exchange initiator of the first network device, wherein the first tone exchange initiator includes a transmitter; and sending a third series of tones via the second tone exchange initiator of the second network device to the first tone exchange responder of the first network device, wherein the first tone exchange responder includes a receiver.

[0095] In other features, the method further comprises determining the distance based on at least one of: (i) a phase difference of the second series of tones and a frequency difference of the second series of tones, or (ii) a phase difference of the third series of tones and a frequency difference of the third series of tones.

[0096] In other features, the first network device is implemented in a vehicle.The second network device is a portable access device.

[0097] In other features, a system for accessing a vehicle or providing operational control of a vehicle is provided. The system includes an initiator device and a sniffer device. The initiator device includes: a first antenna module including a plurality of polarized antennas; a transmitter configured to transmit a first tone signal from the vehicle to a responder device via the first antenna module, wherein the responder device is a portable access device; a first receiver configured to receive a second tone signal from the responder device in response to the first tone signal. The sniffer device includes: a second antenna module including a plurality of polarized antennas; and a second receiver configured to receive the first tone signal from the transmitter and the second tone signal from the responder device via the second antenna module. The sniffer device is configured to determine a state of the first tone signal and the second tone signal including corresponding phase delays. The initiator device or the sniffer device is configured to (i) estimate at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on states of the first tone signal and the second tone signal including corresponding phase delays; and (ii) block at least one of access to the vehicle or operational control of the vehicle based on at least one of the estimated first distance or the second distance.

[0098] In other features, the initiator device or the sniffer device is configured to estimate the first distance and the second distance and to prevent at least one of access to the vehicle or operational control of the vehicle based on the first distance and the second distance.

[0099] In other features, the initiator device or the sniffer device is configured to detect an extended-range relay attack performed by an attack device to gain at least one of access to a vehicle or operational control of the vehicle based on at least one of the first distance or the second distance. The second tone signal is relayed from the responder device to the vehicle and is altered by the attack device. The initiator device is configured to execute a countermeasure in response to detecting the extended-range relay attack.

[0100] In other features and at any time, at least one polarized antenna of the plurality of polarized antennas of the first antenna module is not cross-polarized with at least one polarized antenna of the plurality of polarized antennas of the second antenna module.

[0101] In other features and at any time, at least one polarized antenna of the plurality of polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

[0102] In other features, the initiator device or the sniffer device is configured to: determine a first amount of time for the first tone signal to travel from the initiator device to the responder device based on a state of the first tone signal when received at the responder device; determine a second amount of time for the second tone signal to travel from the responder device to the sniffer device based on a state of the second tone signal when received at the sniffer device; and estimate a first distance and a second distance based on the first amount of time and the second amount of time.

[0103] In other features, the initiator device or the sniffer device is configured to: generate a first representation of the first tone signal when received at the responder device in natural logarithm form; generate a second representation of the first tone signal when received at the sniffer device in natural logarithm form; generate a third representation of the second tone signal when received at the sniffer device in natural logarithm form; and estimate the first distance and the second distance based on the first representation, the second representation and the third representation.

[0104] In other features, a method for accessing a vehicle or providing operational control of a vehicle is provided. The method includes: sending a first tone signal from an initiator device of the vehicle to a responder device via a first antenna module, wherein the first antenna module includes multiple polarized antennas, and wherein the responder device is a portable access device; receiving a second tone signal from the responder device in response to the first tone signal at the initiator device; receiving the first tone signal from the transmitter and the second tone signal from the responder device at the sniffer device and via a second antenna module, wherein the second antenna module includes multiple polarized antennas; determining at the sniffer a state of the first tone signal and the second tone signal including corresponding phase delays; estimating at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the state of the first tone signal and the second tone signal including corresponding phase delays; and blocking at least one of access to the vehicle or operational control of the vehicle based on at least one of the estimated first distance or the second distance.

[0105] In other features, the method includes estimating a first distance and a second distance and at least one of preventing access to the vehicle or exercising operational control of the vehicle based on the first distance and the second distance.

[0106] In other features, the method further includes: based on at least one of the first distance or the second distance, detecting an extended-range relay attack performed by an attacking device to gain at least one of access to a vehicle or operational control of the vehicle, wherein a second tone signal is relayed from a responder device to the vehicle and altered by the attacking device; and executing a countermeasure in response to detecting the extended-range relay attack.

[0107] In other features and at any time, at least one polarized antenna of the plurality of polarized antennas of the first antenna module is not cross-polarized with the linearly polarized antenna or at least one polarized antenna of the plurality of polarized antennas.

[0108] In other features and at any time, at least one polarized antenna of the plurality of polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

[0109] In other features, the method further includes determining a first amount of time for the first tone signal to travel from the initiator device to the responder device based on a state of the first tone signal when received at the responder device; determining a second amount of time for the second tone signal to travel from the responder device to the sniffer device based on a state of the second tone signal when received at the sniffer device; and estimating a first distance and a second distance based on the first amount of time and the second amount of time.

[0110] In other features, a system for accessing a vehicle or providing operational control of a vehicle is provided. The system includes a first network device and a control module. The first network device includes a first antenna module and a control module. The first antenna module includes: a plurality of polarized antennas; a transmitter configured to send an initiator packet from the vehicle to a second network device via the first antenna module, wherein the initiator packet includes a synchronization access word and a first continuous wave (CW) tone, wherein one of the first network device and the second network device is implemented within the vehicle, and wherein the other of the first network device and the second network device is a portable access device, and wherein at any time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with an antenna of the second network device; a receiver configured to receive a response packet from the second network device, wherein the response packet includes a synchronization access word and a first CW tone. The control module is configured to: (i) determine that a round-trip timing difference between an initiator packet and a response packet is greater than a predetermined threshold; (ii) detect an extended-range relay attack performed by an attack device to gain at least one of access to a vehicle or operational control of the vehicle based on the round-trip timing difference being greater than the predetermined threshold; and (iii) in response to detecting the extended-range relay attack, prevent at least one of access to the vehicle or operational control of the vehicle.

[0111] In other features, the control module is configured to: determine a start time and an end time of the synchronization access word based on the initiator packet; and detect a timing difference based on the start time and the end time.

[0112] In other features, the control module is configured to: determine, based on the initiator packet, a start time and an end time of a first CW tone for a synchronization access word relative to a response packet; determine whether the start time and the end time of the synchronization access word of the response packet matches the determined start time and the end time; and detect a timing difference if the start time and the end time of the synchronization access word of the response packet do not match the determined start time and the end time.

[0113] In other features, the control module is configured to: determine a first length of a synchronization access word of the initiator packet; compare the first length to a second length of the synchronization access word of the response packet; and detect an extended-range relay attack if a difference between the first length and the second length is greater than a predetermined amount.

[0114] In other features, the control module is configured to: determine a first length of a first CW tone of the initiator packet; compare the first length to a second length of the first CW tone of the response packet; and detect an extended-range relay attack if a difference between the first length and the second length is greater than a predetermined amount.

[0115] In other features, the first CW tone of the initiator packet is at the end of the initiator packet; and the first CW tone of the response packet is at the beginning of the response packet.

[0116] In other features, the initiator packet includes a second CW tone.The response packet includes a second CW tone.

[0117] In other features, the first CW tone of the initiator packet is at the beginning of the initiator packet. The second CW tone of the initiator packet is at the end of the initiator packet. The first CW tone of the response packet is at the beginning of the response packet. The second CW tone of the response packet is at the end of the response packet.

[0118] Among other features, the initiator packet and the response packet have the same format.

[0119] In other features, the response packet indicates an amount of phase difference between a second CW tone of the initiator packet and a first CW tone of the response packet. The first CW tone of the response packet has a phase relationship with a phase locked loop of the responder.

[0120] In other features, the control module is configured to determine a phase difference between a first CW tone of the response packet and a second CW tone of the initiator packet. The second CW tone of the initiator packet is in a phase relationship with a phase locked loop of the initiator. The first device and the second device are configured to determine a phase difference of the second frequency and a phase difference of the third frequency. The control module is configured to determine a distance between the devices based on (i) the phase difference between the first CW tone and the second CW tone, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency.

[0121] In other features, the control module is configured to compare the frequency, power level, bit, and amplitude of a portion of the received signal including the response packet with the frequency, power level, bit, and amplitude of a portion of the transmitted signal including the initiator packet, and based on the resulting difference, determine whether an extended-range relay attack has occurred.

[0122] In other features, a method for accessing a vehicle or providing operational control of a vehicle is provided. The method includes: sending an initiator packet from the vehicle to a second network device via a first antenna module of a first network device, wherein the first antenna module includes a plurality of polarized antennas, wherein the initiator packet includes a synchronization access word and a first continuous wave (CW) tone, wherein one of the first network device and the second network device is implemented within the vehicle, and wherein the other of the first network device and the second network device is a portable access device, and wherein at any time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with an antenna of the second network device; receiving a response packet from the second network device, the response packet including the synchronization access word and the first CW tone; determining that a timing difference between the initiator packet and the response packet is greater than a predetermined threshold; based on the timing difference being greater than the predetermined threshold, detecting an extended-range relay attack performed by an attacking device to obtain at least one of access to the vehicle or operational control of the vehicle; and in response to detecting the extended-range relay attack, blocking at least one of access to the vehicle or operational control of the vehicle.

[0123] In other features, the method further comprises determining a start time and an end time of the synchronization access word based on the initiator packet; and detecting a timing difference based on the start time and the end time.

[0124] In other features, the method further includes determining, based on the initiator packet, a start time and an end time of a synchronization access word relative to a first CW tone of a response packet; determining whether the start time and the end time of the synchronization access word of the response packet matches the determined start time and the end time; and detecting a timing difference if the start time and the end time of the synchronization access word of the response packet do not match the determined start time and the end time.

[0125] In other features, the first CW tone of the initiator packet is at the end of the initiator packet; and the first CW tone of the response packet is at the beginning of the response packet.

[0126] In other features, the initiator packet includes a second CW tone. The response packet includes a second CW tone. The first CW tone of the initiator packet is at the beginning of the initiator packet. The second CW tone of the initiator packet is at the end of the initiator packet. The first CW tone of the response packet is at the beginning of the response packet. The second CW tone of the response packet is at the end of the response packet.

[0127] In other features, the method further comprises determining a round trip time of the initiator packet based on the amount of phase delay.The response packet indicates an amount of phase delay between a first CW tone of the initiator packet and a first CW tone of the response packet.

[0128] In other features, a system for detecting an extended-range relay attack is provided. The system includes a transmitter, a receiver, and a control module. The transmitter is configured to send a radio frequency signal from one of a vehicle and a portable access device to the other of the vehicle and the portable access device. The receiver is configured to receive a response signal in response to the radio frequency signal from one of the vehicle and the portable access device. The control module is configured to: convert the response signal into an in-phase signal and an orthogonal signal; based on the radio frequency signal, the in-phase signal, and the orthogonal signal, detect an extended-range relay attack performed by an attacking device to obtain at least one of access to the vehicle or operational control of the vehicle, wherein at least one of the following exists: (i) a first radio frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) a first response signal is relayed from the portable access device to the vehicle via the attacking device; and execute countermeasures in response to detecting an extended-range relay attack.

[0129] In other features, the system further includes an antenna module. The antenna module is implemented at one of the vehicle and the portable access device where the transmitter and the receiver are implemented. The antenna module includes a plurality of polarized antennas. At any time, at least one of the plurality of polarized antennas of the antenna module is not cross-polarized with an antenna of the other of the vehicle and the portable access device.

[0130] In other features, the control module is implemented at the vehicle. In other features, the control module is implemented at the portable access device.

[0131] In other features, the control module is configured to: determine a phase difference based on the in-phase signal and the quadrature-phase signal; measure a round-trip time of the radio frequency signal based on the phase difference; and detect an extended-range relay attack based on the round-trip time.

[0132] In other features, the control module is configured to: sample the in-phase signal and the quadrature signal; and determine the received bit based on the in-phase signal and the quadrature signal.

[0133] In other features, the control module is configured to: upsample the received bits based on the in-phase signal and the orthogonal phase signal; upsample another signal; cross-correlate the result of upsampling the received bits based on the in-phase signal and the orthogonal phase signal with the result of upsampling the other signal; and determine the phase based on the result of the cross-correlation.

[0134] In other features, the other signal includes a reference bit pattern. The control module is configured to determine a sign of the differential inverse tangent signal and generate the reference bit pattern based on the sign. In other features, the other signal includes a radio frequency signal filtered via a Gaussian low pass filter.

[0135] In other features, a method for detecting an extended-range relay attack is provided. The method includes: transmitting a radio frequency signal from one of a vehicle and a portable access device to the other of the vehicle and the portable access device via a transmitter; receiving a response signal in response to the radio frequency signal from one of the vehicle and the portable access device via a receiver; converting the response signal into an in-phase signal and an orthogonal signal via a control module; based on the radio frequency signal, the in-phase signal, and the orthogonal signal, detecting via the control module an extended-range relay attack performed by an attacking device to at least one of gain access to the vehicle or to exercise operational control over the vehicle, wherein at least one of the following exists: (i) relaying the radio frequency signal from the vehicle to the portable access device via the attacking device, or (ii) relaying the response signal from the portable access device to the vehicle via the attacking device; and executing countermeasures in response to detecting the extended-range relay attack.

[0136] In other features, the antenna module is implemented at one of the vehicle and the portable access device in which the transmitter and the receiver are implemented. The antenna module includes a plurality of polarized antennas. At any time, at least one of the plurality of polarized antennas of the antenna module is not cross-polarized with an antenna of the other of the vehicle and the portable access device.

[0137] In other features, the control module is implemented at the vehicle. In other features, the control module is implemented at the portable access device.

[0138] In other features, the method further includes determining a phase difference based on the in-phase signal and the quadrature-phase signal; measuring a round trip time of the radio frequency signal based on the phase difference; and detecting an extended-range relay attack based on the round trip time.

[0139] In other features, the method further comprises: sampling the in-phase signal and the quadrature signal; and determining a received bit based on the in-phase signal and the quadrature signal.

[0140] In other features, the method further comprises: upsampling the received bits based on the in-phase signal and the quadrature signal; cross-correlating the result of upsampling the received bits with the result of upsampling another signal; and determining the phase based on the result of the cross-correlation. In other features, the other signal comprises a reference bit pattern. In other features, the other signal comprises a radio frequency signal filtered by a Gaussian low-pass filter.

[0141] Further areas of applicability of the present disclosure will become apparent from the detailed description, claims and drawings.The detailed description and specific examples are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0142] The present disclosure will be more fully understood through the detailed description and accompanying drawings, in which:

[0143] Figure 1 is a side view of the object, illustrating the RF main higher power signal traveling along the bounce path due to the cross polarization of the RF antenna;

[0144] Figure 2 is a functional block diagram of an example of a vehicle access system including an access module, an RF antenna, and a portable access device according to an embodiment of the present disclosure;

[0145] Figure 3 According to an embodiment of the present disclosure, Figure 2 An example functional block diagram of an access module for a vehicle;

[0146] Figure 4 According to the embodiment of the present disclosure Figure 2 A functional block diagram of an example of an access module;

[0147] Figure 5 is a functional block diagram of an example of an RF antenna module for a vehicle according to an embodiment of the present disclosure;

[0148] Figure 6 is a functional block diagram of an example of a portable network device according to an embodiment of the present disclosure;

[0149] Figure 7 is an example of a polarization axis diagram illustrating an example arrangement of polarization diversity according to an embodiment of the present disclosure;

[0150] Figure 8 is an example of a polarization axis diagram illustrating another example arrangement of polarization diversity according to an embodiment of the present disclosure;

[0151] Fig. 9 are example electric field graphs and polar plots illustrating the electric field pattern and nulls of a linear antenna;

[0152] Fig.10 is an example voltage-electric field plot for a linearly polarized antenna;

[0153] Fig.11A is a top perspective view of an example of at least a portion of a multi-axis polarized RF antenna assembly including a linearly polarized antenna and a circularly polarized antenna according to an embodiment of the present disclosure;

[0154] Fig. 11B yes Fig.11A a bottom perspective view of the at least a portion of the multi-axis polarized RF antenna assembly;

[0155] Fig.12 is with Figures 11A-11B Example polar plot of radiated power associated with a linearly polarized antenna;

[0156] Fig.13 is with Figures 11A-11B Example polar plot of radiated power associated with a circularly polarized antenna;

[0157] Fig.14 is a functional block diagram of an example of an RF circuit and a portion of a portable access device according to an embodiment of the present disclosure;

[0158] Fig.15 is a block diagram of an example of a portion of a key fob having two linearly polarized slot antennas, a metal trim, and a spare key according to an embodiment of the present disclosure;

[0159] Fig.16 yes Fig.15 A block diagram of an example of a portion of a key fob without metal trim and spare key but with an x-axis linear polarized slot antenna and a y-axis linear polarized slot antenna;

[0160] Fig.17 is with Fig.16 An example polar plot of radiated power associated with an x-axis linearly polarized slot antenna of the portion of the key fob;

[0161] Fig.18 is with Fig.16 An example polar plot of radiated power associated with a y-axis linearly polarized slot antenna of the portion of the key fob;

[0162] Fig.19 yes Fig.16 An example of a return loss-frequency plot for a linearly polarized slot antenna.

[0163] Fig. 20 yes Fig.15 A block diagram of an example of a portion of a key fob without metal trim but including a spare key;

[0164] Fig.21 is with Fig. 20 An example polar plot of radiated power associated with an x-axis linearly polarized slot antenna of the portion of the key fob;

[0165] Fig. 22 is with Fig. 20 An example polar plot of radiated power associated with a y-axis linearly polarized slot antenna of the portion of the key fob;

[0166] Fig.23 yes Fig. 20 An example of a return loss-frequency plot for a linearly polarized slot antenna.

[0167] Fig.24 yes Fig.15 A block diagram of an example of a portion of a key fob having a portion of a metal trim piece and a spare key;

[0168] Fig.25 is with Fig.24 An example polar plot of radiated power associated with an x-axis linearly polarized slot antenna of the portion of the key fob;

[0169] Fig.26 is with Fig.24 An example polar plot of radiated power associated with a y-axis linearly polarized slot antenna of the portion of the key fob;

[0170] Fig. 27 yes Fig.24 An example of a return loss-frequency plot for a linearly polarized slot antenna.

[0171] Fig.28 is with Fig.15 An example polar plot of radiated power associated with an x-axis linearly polarized slot antenna of the portion of the key fob;

[0172] Fig.29 is with Fig.15 An example polar plot of radiated power associated with a y-axis linearly polarized slot antenna of the portion of the key fob;

[0173] Fig.30 yes Fig.15 An example of a return loss-frequency plot for a linearly polarized slot antenna.

[0174] Fig.31 is a block diagram of an example of a portion of a key fob having a closed linear polarization slot antenna, an open linear polarization slot antenna, a metal trim, and a spare key according to an embodiment of the present disclosure;

[0175] Fig.32 is with Fig.31An example polar plot of radiated power associated with an x-axis linearly polarized slot antenna of the portion of the key fob;

[0176] Fig.33 is with Fig.31 An example polar plot of radiated power associated with a y-axis linearly polarized slot antenna of the portion of the key fob;

[0177] Fig.34 yes Fig.31 An example of a return loss-frequency plot for a linearly polarized slot antenna.

[0178] Fig.35 A method of determining which antenna combination to use to exchange packets between a vehicle's RF antenna module and a portable access device for round-trip time-of-flight measurements is illustrated in accordance with an embodiment of the present disclosure;

[0179] Fig.36 Another method of determining which antenna combination to use to exchange packets between a vehicle's RF antenna module and a portable access device for round-trip time-of-flight measurements according to an embodiment of the present disclosure is illustrated;

[0180] Fig.37 It is a time-of-flight measurement graph.

[0181] Fig.38 is a functional block diagram of an exemplary BLE radio with a superheterodyne receiver and transmitter according to an embodiment of the present disclosure;

[0182] Fig.39 is an example GFSK parameter definition diagram;

[0183] Fig.40 is a functional block diagram of a system for sending a BLE packet;

[0184] Fig.41 Example preambles and access addresses for different types of BLE packets are shown;

[0185] Fig.42 is an example diagram of a BLE packet signal, illustrating the corresponding bits;

[0186] Fig.43 is another example diagram of other BLE packet signals, illustrating corresponding bits;

[0187] Fig.44 yes Fig.43 Overlay of BLE packet signals, where one BLE packet signal has been shifted relative to another BLE packet signal;

[0188] Fig.45 An example method of detecting an extended-range relay attack according to an embodiment of the present disclosure is illustrated;

[0189] Fig.46 is a functional block diagram of an example of a vehicle and a portable access device including a corresponding round trip time initiator and a round trip time responder according to an embodiment of the present disclosure;

[0190] Fig.47 yes Fig.46 A functional block diagram of a vehicle and a portable access device, illustrating transmission of radio frequency signals through corresponding antennas;

[0191] Fig.48 It was attacked by an extended-range relay attack device. Fig.46 Functional block diagram of the vehicle and portable access device;

[0192] Fig.49 is a functional block diagram of two example BLE radios according to an embodiment of the present disclosure;

[0193] Fig.50 is a functional block diagram of an example position and distance determination system including a round trip time sniffer according to an embodiment of the present disclosure;

[0194] Fig.51 is a functional block diagram of an example position and distance determination system including multiple round trip time sniffers according to an embodiment of the present disclosure;

[0195] Fig.52 is a functional block diagram of an example network device configured to perform tone exchange for distance determination and attack detection according to an embodiment of the present disclosure;

[0196] Fig.53 is a functional block diagram of an example position determination system including a tone sniffer according to an embodiment of the present disclosure;

[0197] Fig.54 A method of determining the distance between an initiator and a responder and between a responder and a sniffer according to an embodiment of the present disclosure is illustrated;

[0198] Fig.55 is a functional block diagram of an example passive tone exchange and phase difference detection system according to an embodiment of the present disclosure;

[0199] Fig.56 is a functional block diagram of an example of an active tone swapping and phase difference detection system according to an embodiment of the present disclosure;

[0200] Fig.57 is a diagram of example initiator and responder packets for RSSI and time-of-flight measurements according to an embodiment of the present disclosure, wherein the packets include a continuous wave (CW) tone and a preamble;

[0201] Fig.58 is a diagram of example initiator and responder packets for RSSI and time of flight measurements according to an embodiment of the present disclosure, wherein the packets include a CW tone but do not include a preamble;

[0202] Fig.59 is a diagram of example initiator and responder packets for RSSI and time of flight measurements according to an embodiment of the present disclosure, wherein the packets have the same format and include multiple CW tones but do not include a preamble;

[0203] Fig.60 is a diagram illustrating example initiator and response packets having the same format according to another embodiment of the present disclosure;

[0204] Fig.61 is a functional block diagram of an antenna path determination system for a network device having a corresponding antenna module according to another embodiment of the present disclosure;

[0205] Fig.62 is with Fig.38 An example radio model corresponding to the structure, functionality, and operation of a BLE radio;

[0206] Fig.63 A method of exchanging packets between RF antenna modules of a BLE radio to detect an extended-range relay attack according to another embodiment of the present disclosure is illustrated;

[0207] Fig.64A They are respectively from Fig.62 Example diagram of the signal of the sampling module, Gaussian LPF and integrator of the model;

[0208] Fig.64B Is from Fig.62 Example plot of the signal from the resampling module of the model;

[0209] Fig.64C Is from Fig.62 Example plot of the signal of the inverse tangent module of the model;

[0210] Fig.64D is a graph showing the signal from the differentiator relative to the Fig.62 Example graph of a signal of a Gaussian LPF model;

[0211] Fig.65 illustrates a representation of a different pair of antenna axis assemblies, each antenna axis assembly including two linearly polarized antennas, according to another embodiment of the present disclosure;

[0212] Fig.66A perspective view of a pair of antenna shaft assemblies having the same number of antennas according to another embodiment of the present disclosure is illustrated, wherein one antenna is disposed in a metal container and the other antenna is located outside the metal container;

[0213] Fig.67 illustrates a perspective view of another pair of antenna shaft assemblies having a different number of antennas according to another embodiment of the present disclosure, wherein one antenna is disposed in a metal container and the other antenna is located outside the metal container;

[0214] Fig.68 is a diagram illustrating distance constraints while performing fast bit swapping, where the prover sequence can be cryptographically secure and known independently of the verifier sequence; and

[0215] Fig.69 is a diagram illustrating preventing response bits from being emitted prematurely while performing fast bit exchange, where the prover sequence can be cryptographically secure and dependent on the verifier sequence.

[0216] In the drawings, reference numerals may be repeated to identify similar and / or identical elements. DETAILED DESCRIPTION

[0217] RF devices can measure distances by exchanging unmodulated carrier tones. For example, in U.S. Pat. No. 8,644,768 B2, which is incorporated herein by reference, a system and method for distance measurement between two nodes of a radio network is provided, which uses unmodulated carrier tone exchanges.

[0218] RF devices can measure or constrain distances by round-trip timing of rapid exchanges of cryptographically secure messages. For example, in "Distance-Bounding Protocols (Extended abstract)" presented by Brands and Chaum at the Symposium on Cryptographic Techniques Theory and Applications for Advances in Cryptography (EUROCRYPT'93), which is also incorporated herein by reference, a sequence of rapid bit exchanges between the verifier and the prover is used. Fig.68 As shown, the prover sequence can be cryptographically secure and known, independent of the verifier sequence. Fig.69 As shown, the prover sequence can be cryptographically secure and dependent on the verifier sequence.

[0219] RF devices that measure distance by round-trip timing are subject to early discovery and subsequent launch attacks as described in "Attacks on Time-of-Flight Distance Bounding Channels" by Hancke and Kuhn, presented at the 1st ACM Conference on Wireless Network Security (WiSec'08), which is also incorporated herein by reference. RF devices that measure distance by exchanging unmodulated carrier tones are subject to signal delay flip attacks as described in "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan, and Capkun, presented at IACR Cryptology ePrint Archive 2016, which is also incorporated herein by reference.

[0220] Although conventional PEPS systems allow keyless entry and starting of vehicles, conventional PEPS systems may be vulnerable to range extender-type relay station attacks. A range extender-type relay station attack may refer to an attacker using a relay device to detect, amplify, and relay signals between a key fob (or other smart portable network device) and a vehicle, so that the vehicle's access module operates as if the key fob has approached the vehicle and is very close to the vehicle. For example, when an attacker touches the door handle of the vehicle with his hand and / or using a relay device, the access module may generate and send an LF wake-up signal. As a result, a valid relay device is detected, and the access module sends an LF wake-up signal to the key fob, which is received at the relay device. The relay device receives, amplifies, and forwards (or rebroadcasts) the LF wake-up signal to the actual key fob. For example, the key fob may be located inside a residence, while the vehicle may be parked outside or in front of the residence. The key fob may receive the amplified wake-up signal and generate a response signal and / or begin communicating on an RF link. The response signal and / or the RF communication signal is amplified and relayed between an antenna on the vehicle and one or more antennas of the key fob. This can be done via a relay device. As a result, the relay device is seen by the access module as a key fob, and the relay device "tricks" the access module into operating as if the key fob were in the relay device's place, which causes the access module to provide unauthorized access to the vehicle interior.

[0221] Additionally, as further described below, the antenna systems of current PEPS systems may prevent the PEPS system from accurately estimating the distance between the key fob and the vehicle and accurately estimating the position of the key fob relative to the vehicle. The distance and position may be determined based on time of flight measurements. The time of flight and the corresponding received signal strength are measured. The received signal strength indicator (RSSI) with the largest magnitude generally corresponds to the direct or shortest distance between the key fob and the vehicle. The time of flight measurement associated with the largest RSSI is used to calculate the distance between the key fob and the vehicle.

[0222] Examples described herein include a combined LF and RF PEPS key fob that uses RF round trip timing (RTT) measurements to prevent range extender relay attacks. Other examples include RTT measurements, carrier phase-based ranging, and a combination of RTT measurements and carrier phase-based ranging in a PEPS system. These examples also describe many other features, which are further described below.

[0223] Figure 1 An example is shown of when cross-polarization of the antennas can lead to an inaccurate distance determination between a first RF antenna of a key fob and a second RF antenna of a vehicle. If the first RF antenna of the key fob is positioned relative to the second RF antenna of the vehicle such that the first RF antenna is cross-polarized with the second RF antenna, the determined distance corresponds to a bounce path, rather than a direct path. For example, the antennas are cross-polarized when the polarizations of the antennas are perpendicular to each other. Figure 1 An example of this is shown in .

[0224] Figure 1 An object 10 and the polarization axes 12, 14 of the corresponding RF antennas are shown. The antennas are linearly polarized antennas. The first RF antenna has a first polarization axis 12 and is in the vehicle. The second RF antenna has a second polarization axis 14 and is in the key fob. Due to the relative positions of the first RF antenna, the second RF antenna, and the object 10, an RF signal 16 sent from the antennas may bounce off the object 10. The signal energy (or voltage) corresponding to the bounce path is greater than the signal energy (or voltage) corresponding to the direct path 18 between the antennas. This is due to the cross-polarization of the RF antennas. An access module that determines the distance between the antennas based on the signal path with the maximum signal energy or voltage may incorrectly determine the distance between the antennas as the length of the bounce path 16 rather than the length of the direct path 18.

[0225] Aligning the null in a co-polarized antenna arrangement also results in the bounce path being used. This occurs when the first and second RF antennas point in the same direction. The antennas can be positioned so that the line extends longitudinally through the antennas. Figure 9-10 This is further described.

[0226] Examples described herein include polarization diversity for RF signal transmission between an RF antenna of a vehicle and an RF antenna of a portable access device (e.g., a key fob, a mobile phone, a wearable device, etc.). In addition, the example includes a pseudo-random two-way data exchange. Polarization diversity is provided to ensure that, at any time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized, but slightly co-polarized with the polarization axis of at least one receiving antenna, without co-linear zero co-polarization. As used herein, the phrase "at any time" refers to all times when corresponding devices communicate with each other and / or all times when one or more signals are sent between devices and one or more signals are received by one or more devices. In addition to allowing accurate distance determination, this also helps prevent range extender type relay station attacks. Pseudo-random two-way data exchanges as described below also help prevent range extender type relay station attacks.

[0227] Example embodiments will now be described more fully with reference to the accompanying drawings.

[0228] Figure 2 A vehicle access system 28 is shown for use as a PEPS system and a PAK system. The vehicle access system 28 includes a vehicle 30 and may include a key fob 32, a mobile phone 34, and / or other portable access devices, such as a wearable device, a laptop computer, or other portable network device. The portable access device may be, for example, a device that supports A communication device such as a smart phone, smart watch, wearable electronic device, key fob, tablet device or other device associated with a user of the vehicle 30. The user may be the owner, driver or passenger of the vehicle 30 and / or a technician for the vehicle 30.

[0229] The vehicle 30 includes an access module 36, an LF antenna module 38, and an RF antenna module 40. The access module 36 can wirelessly transmit LF signals to a portable network device via the LF antenna module 38, and can wirelessly communicate with a portable computer via the RF antenna module 40. The RF antenna module 40 provides polarization diversity between each antenna of the portable network device and the antenna of the RF antenna module 40. The polarization diversity described further below provides a minimum number of polarization axes, combinations of polarization axes, and arrangements of polarization axes at the portable network device and the vehicle 30 to ensure that at any time at least one transmitting antenna has at least one polarization axis that is not cross-polarized with the polarization axis of at least one receiving antenna. In other words, at any time, at least one RF antenna of the vehicle has at least one polarization axis that is not cross-polarized with the polarization axis of at least one RF antenna of each portable access device. Although a specific number of LF antenna modules and RF antenna modules are shown, any number of LF antenna modules and RF antenna modules may be used.

[0230] The access module 36 may communicate with the LF antenna module 38 and the RF antenna module 40 wirelessly and / or via a vehicle interface 45. As examples, the vehicle interface 45 may include a controller area network (CAN) bus, a local interconnect network (LIN) for lower data rate communications, a clock extension peripheral interface (CXPI) bus, and / or one or more other vehicle interfaces.

[0231] The LF antenna modules 38 may be located at various locations on the vehicle and transmit low frequency signals (e.g., 125 kHz signals). Each LF antenna module includes a LF antenna and may include a control module and / or other circuitry for LF signal transmission. The RF antenna modules 40 may also be located at various locations on the vehicle and transmit RF signals, such as Bluetooth Low Energy (BLE) signals, according to a BLE communication protocol. Alternatively, the RF antenna modules 40 may communicate according to other wireless communication protocols such as Wireless Fidelity (Wi-Fi). An example of an antenna is shown in FIG. 11 (collectively referred to as FIG. Fig.11A and 11B ).

[0232] In one embodiment, in order to improve signal coverage relative to the vehicle and improve transmission and reception characteristics, the RF antenna module 40 is located in the roof 46 of the vehicle 30. As an example, each RF antenna module 40 may include a pair of RF antennas, a linear polarization antenna and a circular polarization antenna. The number and location of the RF antenna modules may be pre-selected based on the size and shape of the vehicle 30. In one embodiment, two RF antenna modules are included and the two RF antenna modules are spaced apart from each other, such as Figure 2 As shown, the corresponding electric fields overlap each other, extending around the vehicle in a 360° pattern and passing through the periphery of the vehicle. The electric field provides Figure 1 The resultant electric field is shown, represented by the dashed circle 48. The dashed circle provides an overall "rectangular-like" shape. In larger vehicles, more antenna modules 40 may be added to make the shape more "rectangular-like." In smaller vehicles, only one of the RF antenna modules 40 may be included.

[0233] Different numbers of antennas with different numbers of antenna polarizations may be utilized. Figure 65-Figure 67 Some other example antenna implementations are illustrated. Figure 65-Figure 67 Includes fewer antennas and antenna polarizations that are used to measure or constrain distance when a different set of frequencies and / or RF channels are used to measure or constrain distance and / or reflections from metal in the vehicle. This is done to create virtual polarization diversity. The antenna system can tolerate a certain rate of erroneous measurements due to cross-polarization and / or null alignment. Figure 65-Figure 67, 7100A-J refers to antenna axis assemblies, 7100A-71001 refers to antenna axis assemblies with two polarization axes, and 7100J refers to antenna axis assemblies with one polarization axis. Reference numerals 7101A-71011 and 7102A-7102I refer to polarization antenna axes of two polarization antenna axis assemblies. Reference numeral 7101J refers to a single polarization axis of 7100J. Reference numerals 7103AB, 7103CD, 7103EF, 7103GH, and 7103JI refer to RF paths between a pair of antenna assemblies. There are many RF paths between antenna axes, some with more link margin, some with less link margin, some with more phase rotation time delay, and some with less phase rotation time delay. The various round trip timing and unmodulated carrier tone exchange ranging algorithms disclosed, described and / or referenced herein have the ability to find or measure shorter paths that have a link margin that is a few decibels (dB) up or down compared to the highest link margin path (which may not be the shortest). The more round trip timing or tone exchange measurements are made across more frequencies (or channels), the more mathematically complex the algorithm is and the more time consuming the timing is, the smaller the link margin in the shorter indirect path that is found.

[0234] The additional antenna shafts provide polarization diversity in the RF path between the antenna shaft assemblies, which provides path diversity. Reference numeral 7200 refers to a simplified representation of an open three-sided metal box and / or vehicle body for RF radio waves in the gigahertz or several gigahertz range. Reference numeral 7201 refers to a simplified representation of a metal sheet and / or box cover and / or roof of a vehicle for RF radio waves in the gigahertz or several gigahertz range. Fig.66 and Fig.67 It can also be viewed upside down, where 7200 is a simplified representation of the open concave shape of the vehicle's roof, and 7201 is a simplified representation of the vehicle's floor.

[0235] The RF connection between 7100A and 7100B along RF path 7101AB is strong because both pairs of antenna axes between the antenna axis assemblies are co-polarized. For multiple pairs of two-axis antennas arbitrarily oriented, even though the area of ​​co-polarization is wider, there may be 5 degrees of 90 degree rotation angle, and the link margin may be 6dB higher than the intermediate link margin, which is rare. This is because three angle rotations are required to manipulate the arbitrarily oriented pair of antenna axis assemblies into this configuration, and because the antenna axes are symmetrical every 90 degrees, this occurs arbitrarily at approximately (5 / 90)*(5 / 90)*(5 / 90) or 1.71E-4 parts of the time. The RF connection between 7100C and 7100D along RF path 7101CD is not as strong as 7101AB, but it is good because no antenna paths are co-polarized or cross-polarized and the nulls are misaligned. The RF connection between 7100E and 7100F along RF path 7101EF is weak because each antenna path between the various antenna axes is either cross-polarized or involves a null for at least one antenna. This is rare because again 3 angular rotations are required to steer an arbitrarily oriented pair of antenna axes into this configuration. In addition, for an arbitrarily oriented antenna pair of two axis antenna pairs, for example with 5 degrees of cross-polarization and an aligned null zone, such as 20dB below the link margin or pow2db(sin(pi*5 / 180)A2), three angular rotations are required to steer the arbitrarily oriented antenna pair into this configuration, and the antenna axes are symmetrical every 90 degrees, which will occur approximately at (5 / 90)*(5 / 90)*(5 / 90) or 1.71E-4 parts of the time.

[0236] See Figure 7-Figure 8 , it is clear that with three mostly orthogonal polarization axes on one side and two mostly orthogonal polarization axes on the other side, the nulls cannot be aligned when cross polarized. With three mostly orthogonal polarization axes on one side and one polarization axis on the other side, the nulls can be aligned via two rotations to occur arbitrarily.

[0237] In general, the more antenna axes there are on each side of the connection, the lower the likelihood of a low link margin direct path. Preventing or reducing the likelihood of a low link margin direct path is beneficial because round trip timing ranging and unmodulated carrier tone exchange ranging tend to measure the direct path, where the link margin is greater relative to the reflected path. Conversely, the lower the link margin in the direct path relative to the reflected path, the more likely the ranging technique is to measure distance along the reflected path.

[0238] exist Fig.66, when: the size of the metal box is reasonably sized relative to the decision constraints of the range being measured; the variation in distance is measured based on different reflection paths within the metal box; and one side of the ranging connection is placed within the metal box, so planning on several direct paths may reduce the number of polarization axes required to obtain reasonable measurements. When one of the antenna axes of the 7100G is oriented so that the null is pointed along the strongest and / or shortest reflection path toward the 7100H, the other antenna axis in the 7100G will find a bounce path that has a strong link margin to one of the antenna axes 7101H or 7102H. This is especially true when averaging across multiple channels, such as the 37 data channels within a BLE data link. Some of the combinations of channels and antenna axis paths may fade quickly due to multipath, but not most combinations will. At any arbitrary orientation of the antenna axis pair 7100G, the link margin to the antenna axis pair 7100H is approximately the same, and the distance measured along the 7103IJ reflection path is approximately the same. The way the reflected path 7103GH bounces off the roof 7201 or sidewalls of the 7200 will change, but the overall path change will be limited by the size and location of the 7200 and 7201 components. This path change limit will change when the 7100G is raised to a height where a direct path exists, which will shorten the measured distance by eliminating the reflection of the path 7103GH. The range measured between 7100G and 7100H along the reflected path or the shorter direct path will set a comparison constraint that indicates that 7100G (which may be part of a portable device) is within the distance threshold of 7100H. 7100H can be part of the PEPS module 211 or the PAKM module 212. These ranging measurements between a pair of 7100 modules can be obtained and compared to be less than the constraints. The results of the measurements, distances, and / or comparisons can be used as part of an "if-then-else" comparison in a software decision tree to indicate that the portable access device 400 is within the vehicle's engagement zone, unlocking zone, and / or movement zone.

[0239] Fig.67 and Fig.66Similar, except that antenna shaft assembly 7100J includes a single polarized antenna shaft 7101J. In an embodiment, antenna shaft assembly 7100J includes only a single polarized antenna shaft. 7101J can be oriented so that the null is oriented along the strongest and / or shortest reflection path toward 7100H. In this case, the round trip timing and unmodulated carrier tone switching techniques will tend to measure distance along a path (not depicted) away from box 7200 and then rebounding back to the box. Two rotations are required to orient the arbitrarily oriented antenna axis to this orientation, for example with a 5 degree wide alignment null region, for example, a link margin down 20 dB or pow2db(sin(pi*5 / 180)A2, because two angular rotations are required to steer the arbitrarily oriented antenna pair into this configuration, and because the antennas are symmetrical every 90 degrees. This orientation will occur arbitrarily at approximately (5 / 90)*(5 / 90) or 3E-3 parts of the time. In addition to increasing the time to measure a completely different indirect path due to a higher power path reflected from a distant object, this configuration can also be used to make distance ranging measurements between a pair of 7100 modules and compare the measurements to be less than the constraints. The results of the measurements, distances and / or comparisons can be used as part of one or more "if-then-else" comparisons and software decision trees to indicate that the portable access device 400 is within the vehicle's approach zone, unlock zone and / or movement zone.

[0240] Different polarizations of antennas can be used to generate polarization diversity. Multiple polarized antennas (or antenna axes) will generate polarization diversity. A linear axis and another linear axis, a linear axis and two linear axes including a circularly polarized antenna, or three independent linear axes (linearly polarized antennas) are all possible. In particular, virtual polarization diversity will be generated if there is metal nearby.

[0241] The 7101H or 7101J antenna axis pair can be placed lower in a metal box that is the body of the vehicle, or higher in a metal box that is the roof of the vehicle to achieve these virtual antenna axis array effects.

[0242] Figure 3 Shown as Figure 1 108 of the vehicle 108. The vehicle 200 includes a PAK system 202, which includes a vehicle control module 204, an infotainment module 206, and other control modules 208 (e.g., a body control module). The modules 204, 206, 208 can be connected via a controller area network (CAN) bus 209 and / or other vehicle interfaces (e.g., Figure 2 The vehicle control module 204 can control the operation of the vehicle system. The vehicle control module 204 can include Figure 4The PEPS module 211, PAK module 212 and parameter adjustment module 213 and other modules shown in the vehicle control module 204 may also include one or more processors configured to execute instructions stored in a non-transitory computer-readable medium, such as a memory 218 that may include a read-only memory (ROM) and / or a random access memory (RAM).

[0243] The PEPS module 211 may perform PEPS operations to provide access to the interior of the vehicle and allow startup and / or operation of the vehicle. As described herein, the PAK module 212 operates in conjunction with the PEPS module 211 and performs PAK operations. The PEPS module 211 may include the PAK module 212, or the modules 211, 212 may be implemented as a single module. The parameter adjustment module 213 may be used to adjust parameters of the vehicle 200.

[0244] The PAK system 202 may also include: a memory 218; a display 220; an audio system 221; and one or more transceivers, including a LF antenna module 38 and an RF antenna module 40. The RF antenna module 40 may include and / or may be connected to a RF circuit 223. The PAK system 202 may also include: a telematics module 225; a sensor 226; and a navigation system 227 including a global positioning system (GPS) receiver 228. The RF circuit 223 may be used to communicate with a mobile device (e.g., Figure 1 The mobile device 102) communicates with the mobile device 102, including transmitting at 2.4 gigahertz (GFIz) The RF circuit 223 may include a BLE radio, a transmitter, a receiver, etc. for sending and receiving RF signals.

[0245] The one or more transceivers 222 may include an RF transceiver that includes an RF circuit 223 and implements an access application with code for checking the time-stamped data received and sent by the RF antenna module 40. The access application may confirm, for example, whether the RF antenna module receives the correct data at the correct time. The access application may be stored in the memory 218 and implemented by the PEPS module 211 and / or the PAK module 212. Other example operations of the access application are further described below.

[0246] Accessing the application enables A protocol stack configured to provide a channel map, an access identifier, a next channel, and a time for the next channel. The access application is configured to output a timing signal for time stamping of signals sent and received via the RF antenna module 40. The access application can obtain the channel map information and timing information and share the information with other modules in the vehicle.

[0247] The telematics module 225 can communicate with the server via a cellular tower station. This can include the transmission of certificates, license information, and / or timing information including global clock timing information. The telematics module 225 is configured to generate location information and / or errors of location information associated with the vehicle 200. The telematics module 225 can be implemented by the navigation system 227.

[0248] The sensors 226 may include sensors for PEPS and PAK operations, cameras, object detection sensors, temperature sensors, accelerometers, vehicle speed sensors, and / or other sensors. The sensors 226 may include touch sensors to detect, for example, a person touching a door handle to initiate the process of waking up the portable access device. The sensors 226 may be connected to other control modules 208, such as a body control module, which may communicate with the LF and RF antenna circuits and / or modules disclosed herein. The GPS receiver 228 may provide the vehicle's speed and / or direction (or heading) and / or global clock timing information.

[0249] The memory 218 may store sensor data and / or parameters 230, certificates 232, connection information 234, timing information 236, tokens 237, keys 238, and applications 239. The applications 239 may include applications executed by the modules 38, 40, 204, 206, 208, 210, 211, 212, 223, and / or the transceiver 222. As an example, the applications may include access applications, PEPS applications, and / or PAK applications executed by the transceiver 222 and the modules 210, 211, and / or 212. Although the memory 218 and the vehicle control module 204 are shown as separate devices, the memory 218 and the vehicle control module 204 may be implemented as a single device. The single device may include Figure 2 One or more other devices as shown.

[0250] The vehicle control module 204 can control the operation of the engine 240, the converter / generator 242, the transmission 244, the window / door system 250, the lighting system 252, the seat system 254, the rearview mirror system 256, the brake system 258, the motor 260 and / or the steering system 262 according to the parameters set by the modules 204, 206, 208, 210, 211, 212, 213. The vehicle control module 204 can perform PEPS and / or PAK operations, which can include setting some of these parameters. The PEPS and PAK operations can be based on signals received from the sensor 226 and / or the transceiver 222. The vehicle control module 204 can receive power from the power supply 264, which can be provided to the engine 240, the converter / generator 242, the transmission 244, the window / door system 250, the lighting system 252, the seat system 254, the rearview mirror system 256, the brake system 258, the motor 260 and / or the steering system 262, etc. Some of the PEPS and PAK operations may include unlocking the doors of the window / door system 250, enabling fuel and spark to the engine 240, starting the motor 260, powering any of the systems 250, 252, 254, 256, 258, 262, and / or performing other operations as further described herein.

[0251] The engine 240 , converter / generator 242 , transmission 244 , window / door system 250 , lighting system 252 , seat system 254 , mirror system 256 , brake system 258 , motor 260 , and / or steering system 262 may include actuators controlled by the vehicle control module 204 to, for example, adjust fuel, spark, air flow, steering wheel angle, throttle position, pedal position, door locks, window position, seat angle, etc. This control may be based on the output of sensors 226 , navigation system 227 , GPS 228 , and the above data and information stored in memory 218 .

[0252] Figure 4 An access module 210 is shown. The access module 210 includes a PEPS module 211, a PAK module 212, a parameter adjustment module 213, and may also include a link authentication module 300, a connection information distribution module 302, a timing control module 304, a sensor processing and positioning module 306, a data management module 308, and a security filtering module 310. The PAK module 212 may include an RTC 312 that maintains a local clock time.

[0253] The link authentication module 300 can authenticate Figure 2 The portable access device of the present invention and establish a secure communication link. For example, the link authentication module 300 can be configured to implement a challenge-response authentication or other password verification algorithm to authenticate the portable access device.

[0254] The connection information distribution module 302 is configured to Figure 3 The PAK system 202 communicates with some of the sensors 226 and provides the sensors with the communication information necessary to enable the sensors to find and then follow or eavesdrop on the secure communication link. This may occur once the sensors are synchronized with a communication gateway, which may be included in or implemented by one of the transceivers 222. As an example, the vehicle 200 and / or the PAK system 202 may include any number of sensors disposed anywhere on the vehicle 200 for detecting and monitoring mobile devices. The connection information distribution module 302 is configured to obtain information corresponding to the communication channel and channel switching parameters of the communication link and send the information to the sensor 226. In response to the sensor 226 receiving the information from the connection information distribution module 302 via the vehicle interface 45 and synchronizing the sensor 226 with the communication gateway, the sensor 226 may locate and follow or eavesdrop on the communication link.

[0255] The timing control module 304 may: maintain the RTC and / or currently stored date if they are not disposed of by the PAK module 212; propagate current timing information using sensors; generate timestamps for incoming and outgoing messages, requests, signals, certificates, and / or other items; calculate round trip times, etc. Round trip times may refer to the amount of time between the time a request is generated and / or sent and the time a response to the request is received. When the link authentication module 300 performs a challenge-response authentication, the timing control module 304 may obtain timing information corresponding to the communication link. The timing control module 302 is also configured to provide the timing information to the sensor 226 via the vehicle interface 209.

[0256] After link authentication is established, the data management module 308 collects the current location of the vehicle 108 from the telematics module 225 and shares the location with the portable access device. The portable access device optionally includes a GPS module and application software that, when executed, compares the estimated relative location of the portable access device relative to the vehicle 108. Based on the estimated location of the portable access device relative to the vehicle 108, the portable access device can send a signal to one of the transceivers 222 requesting the vehicle to perform certain actions. As an example, the data management layer 308 is configured to obtain vehicle information obtained by any module (e.g., location information obtained by the telematics module 225) and send the vehicle information to the portable access device.

[0257] The security filtering module 310 detects physical layer and protocol violations and filters the data accordingly before providing the information to the sensor processing and positioning module 306. The security filtering module 310 marks the data as injected, enabling the sensor processing and positioning module 306 to discard the data and alert the PEPS module 211. The data from the sensor processing and positioning module 306 is passed to the PEPS module 211, which is configured to read the vehicle status information from the sensors in order to detect the user's intent to access features and compare the location of the mobile device 102 to a set of locations that authorize certain vehicle features, such as unlocking the vehicle's doors or trunk and / or starting the vehicle.

[0258] Figure 5 1 is a functional block diagram of the RF antenna module 40, which includes a control module 350 connected to a multi-axis polarized RF antenna assembly 352. The multi-axis polarized RF antenna assembly 352 may include a linearly polarized antenna, other linearly polarized antennas, and / or a circularly polarized antenna (e.g., a right-handed circularly polarized antenna or a left-handed circularly polarized antenna). An example of a multi-axis polarized RF antenna is shown in FIG. 11. The control module 350 may include a BLE communication chipset or may be part of a BLE communication chipset. Alternatively, the control module 350 may include or be part of a Wi-Fi or Wi-Fi direct communication chipset. The multi-axis polarized RF antenna assembly 352 may be included as part of the RF antenna module 40, or may be located remotely from the control module 350. Some or all of the operations of the control module 350 may be performed by Figure 3 It is implemented by one or more modules among modules 204, 210, 211, and 212.

[0259] Control module 350 (or Figure 3 One or more of the modules 204, 210, 211, 212) can be connected to a portable access device (e.g., Figure 2 The control module 350 may establish a secure communication connection with one of the portable access devices 32, 34. For example, the control module 350 may establish a secure communication connection using the BLE communication protocol, which may include sending and / or receiving timing and synchronization information. The timing and synchronization information may include information for a secure communication connection, such as the timing of the next communication connection event, the timing interval between communication connection events, the communication channel of the next communication connection event, channel mapping, channel hopping interval or offset, communication delay information, communication jitter information, etc. The control module 350 may detect (or "eavesdrop") packets sent by the portable access device to the vehicle control module 204, and measure signal information of signals received from the portable access device. The channel hopping interval or offset may be used to calculate the channel for subsequent communication connection events.

[0260] The control module 350 can measure the received signal strength of the signal received from the portable access device and generate a corresponding RSSI value. Additionally or alternatively, the control module 350 can make other measurements of the signal received from the portable access device, such as angle of arrival, time of arrival, time difference of arrival, etc. The control module 350 can then send the measured information to the vehicle control module 204, which can then determine the location and / or distance of the portable access device relative to the vehicle 30 based on the measured information. The location and distance determination can be based on similar information received from one or more other RF antenna modules and / or other sensors.

[0261] As an example, the vehicle control module 204 can determine the location of the portable access device based on, for example, a pattern of RSSI values ​​corresponding to signals received by the RF antenna module 40 from the portable access device. A strong (or high) RSSI value indicates that the portable access device is very close to the vehicle 30, while a weak (or low) RSSI value indicates that the portable access device is farther away from the vehicle 30. By analyzing the RSSI values, the control module 204 can determine the location and / or distance of the portable access device relative to the vehicle 30. Additionally or alternatively, angle of arrival, angle of departure, round trip timing, unmodulated carrier tone exchange, or time difference of arrival measurements for signals sent between the portable access device and the control module 204 can also be used by the control module 204 or the portable access device to determine the location of the portable access device. Additionally or alternatively, the RF antenna module 40 can determine the location and / or distance of the portable access device based on the measured information and communicate the location or distance to the control module 204.

[0262] Based on the determined position of the portable access device relative to the vehicle 30 or the distance relative to the vehicle 30, Figure 3 The modules 211, 212 may then authorize and / or perform vehicle functions, such as unlocking the doors of the vehicle 30, unlocking the trunk of the vehicle 30, starting the vehicle 30, and / or allowing the vehicle 30 to be started. As another example, if the distance between the portable access device and the vehicle 30 is less than a first predetermined distance, the modules 211, 212 may turn on the interior or exterior lights of the vehicle 30. If the distance between the portable access device and the vehicle 30 is less than a second predetermined distance, the modules 211, 212 may unlock the doors or trunk of the vehicle 30. If the portable access device is inside the vehicle 30, the modules 211, 212 may allow the vehicle 30 to be started.

[0263] Refer again Figure 5, the control module 350 may include a physical layer (PHY) module 356, a media access control (MAC) module 358, a time synchronization module 360, and a channel map reconstruction module 362. The PHY module 356 receives BLE signals via a multi-axis polarized RF antenna assembly 352. The control module 350 can monitor the received BLE physical layer messages and use the channel map generated by the channel map reconstruction module 362 to obtain measurements of physical properties of the corresponding signals, including, for example, received signal strength. The control module 350 can communicate with control modules and / or modules 204, 210, 211, 212 of other RF antenna modules via the vehicle interface 45 to determine arrival time difference, arrival time, arrival angle, and / or other timing information. In one embodiment, the control module 350 includes Figure 3 part of the RF circuit 223 .

[0264] The time synchronization module 360 ​​is configured to accurately measure the reception time of signals / messages on the vehicle interface 45. The control module 350 can tune the PHY module 356 to a specific channel at a specific time based on the channel mapping information and the reception time and / or other timing information. In addition, the control module can monitor the received PHY messages and data, which meet the Physical layer specifications such as Specification Version 5.1. The data, timestamp, and measured signal strength may be reported by the control module 350 to the control module 204 via the vehicle interface 45 .

[0265] Figure 6 An example portable access device 400 is shown. Figure 2 The portable access device 400 may include a control module 402, a user interface 404, a memory 406, a sensor 407, and a transceiver 408. The transceiver 408 may include a MAC module 410, a PHY module 412, and a plurality of linearly polarized antennas 414.

[0266] The control module 402 may include or may be part of a BLE communication chipset. Alternatively, the control module 402 may include or be part of a Wi-Fi or Wi-Fi direct communication chipset. The memory 406 may store application code that may be executed by the control module 402. The memory 406 may be a non-transitory computer-readable medium including a read-only memory (ROM) and / or a random access memory (RAM).

[0267] The control module 402 communicates with the modules 204 and 350 of the vehicle and performs authentication and other operations as further described below. The control module 402 can send information about the portable access device 400, such as position and / or velocity information obtained from one or more sensors 407 (e.g., a global navigation satellite system (e.g., GPS) sensor, an accelerometer, and / or an angular velocity sensor). The user interface 404 can include a keyboard, a touch screen, a voice-activated interface, and / or other user interfaces.

[0268] Figure 7 A polarization axis diagram is shown, illustrating an example arrangement of polarization diversity. In the example shown, two 3-axis antennas located in the vehicle communicate with a 2-axis antenna located in a portable access device (or mobile access network device). With enough antenna axes, this antenna topology can prevent the situation where there is cross-polarization between one of the 3-axis antennas and the 2-axis antenna. In addition, with enough antenna axes, the system can be configured so that there is at least one pair of antennas in which there is no null (or the null is not pointed out) in the direct signal path. Heuristic measurements of RSSI can be made on the continuous wave (CW) tone portion of the packet while measuring the round-trip time and phase delay of the packet. This can be repeated on multiple frequencies. This can be done at the vehicle access module and / or the portable access device. Round-trip timing and / or unmodulated carrier tone exchange can be used to ensure ranging. RSSI and the changing (or incremental) phase of each frequency can be used.

[0269] Figure 8 A polarization axis diagram is shown, illustrating another polarization diversity example arrangement. In the example shown, two single-axis antennas located in the vehicle communicate with a 3-axis antenna located in a portable access device (or mobile access network device). With enough antenna axes, this antenna topology can also prevent the presence of cross-polarization between the single-axis antenna and one of the 3-axis antennas. In addition, with enough antenna axes, the system can be configured so that there is at least one pair of antennas in which there is no null (or the null is not indicated) in the direct signal path. The heuristic measurement of RSSI can be performed on the continuous wave (CW) tone portion of the packet while measuring the round-trip time and phase delay of the packet. This can be repeated on multiple frequencies. This can be done at the vehicle access module and / or the portable access device. Round-trip timing is used to ensure ranging. RSSI and the change (or incremental) phase of each frequency can be used. Figure 7 The example may be Figure 8 This is because it may be difficult to integrate a 3-axis antenna in some portable access devices (such as key cards).

[0270] Fig. 9An electric field plot 900 and a polar plot 902 are shown illustrating the electric field plot and null 906 of a linear antenna. The linear antenna is positioned along a vertical axis 908. The linear antenna has a "doughnut" shaped radiation pattern. When the null is aligned between the transmit and receive antennas (co-polarized antennas with the nulls being co-linear or nearly co-linear), the bounce path of the transmit signal is measured. The examples described herein prevent this situation from existing between at least one transmit antenna and at least one receive antenna at any time. An algorithm is described herein for determining which transmit and receive antennas to use at any time to prevent the use of cross-polarized and / or co-polarized antennas. Once the appropriate antenna pair is selected, a time of flight measurement is performed to determine the distance between the transmitter and receiver and / or between the vehicle and the portable access device. As Fig.10 A voltage versus electric field graph 1000 for a linearly polarized antenna 1002 is shown.

[0271] Figure 11A-11B At least a portion of an example of a multi-axis polarized RF antenna assembly 1100 including a linearly polarized antenna 1102 and a circularly polarized antenna 1104 is shown. The antennas 1102, 1104 are juxtaposed. The linearly polarized antenna 1102 extends linearly outwardly from the central axis of the circularly polarized antenna 1104 away from the circularly polarized antenna 1104. The antennas 1102, 1104 can transmit 90° out of phase with each other. The linearly polarized antenna 1102 can include a conductive element (e.g., a straight line or spiral) 1110 extending within a sleeve 1112. The circularly polarized antenna 1104 can be annular.

[0272] The linear polarized antenna 1102 is a monopole antenna. The sleeve 1112 is formed of a dielectric material such as polytetrafluoroethylene. The antennas 1102 and 1104 are concentric with the disc-shaped insulator (or isolator) 1106 and the disc-shaped ground plane 1108. The ring-shaped insulator 1106 is stacked as a top layer on the ground plane 1108 (or bottom layer). The circular polarized antenna 1104 is arranged on the ground plane 1108 inside the concave area 1114 of the insulator 1106. The concave area 1114 of the insulator is arranged between the circular polarized antenna 1104 and the ground plane 1108.

[0273] The circular polarized antenna has two feed points 1120, 1122, while the linear polarized antenna 1102 has a single feed point 1124. RF signals are transmitted and / or received via the feed points 1120, 1122, 1124. RF signals are transmitted between the antennas 1102, 1104 and the RF circuit 1114 via a coaxial cable. The coaxial cable includes inner conductors 1130, 1132, 1134 and an outer ground shield (not shown). The ground shield is connected to the ground plane 1108. The conductors 1130, 1132, 1134 are connected to the feed points 1120, 1122, 1124.

[0274] During transmission, a signal or voltage is provided across the ground plane 1108 and the conductive element 1110 via a feed point 1124, which is connected to the conductive element 1110 and the ground plane 1108 via another conductive element 1140. (Multiple) RF signals or (multiple) voltages are also applied across the ground plane 1108 and the feed points 1120, 1122 of the circular polarized antenna 1104. The feed points 1120, 1122 are located on the surface of the antenna 1104 with a 90° offset and are 90° out of phase with each other. The 90° electrical phase shift combined with the 90° geometric phase shift causes the circular polarized antenna 1104 to radiate a circularly polarized signal. The feed points 1120, 1122 are connected to the circular polarized antenna 1104 from the ground plane 1108 through the insulator 1106. The hole 1142 at the center of the ground plane 1108 and the hole 1144 at the center of the circular polarized antenna 1104 are large enough to allow the linear polarized antenna 1102 to radiate without being shorted to the ground plane 1108 .

[0275] The antennas 1102, 1104 may be formed of a conductive material, while the circular isolator 1106 may be formed of a non-conductive (or electrically insulating) material. In one embodiment, the linearly polarized antenna 1102 may be implemented as a straight line, wherein the sleeve 1112 is formed of polytetrafluoroethylene (PTFE) and the conductive element 1110 is formed of copper. In another embodiment, the linearly polarized antenna 1102 is implemented as a helix, wherein the line is wrapped around a cylindrical object formed of PTFE. Fig.12 A polar plot 1200 of radiated power associated with the linearly polarized antenna 1102 of FIG. 11 is shown. Fig.13 Shown with Fig.12 Polar plot of radiated power associated with the circularly polarized antenna 1104. Antennas 1102, 1104 may be connected to RF circuitry 1114, such as Figure 3 One of the RF circuits 223 of the vehicle and can be configured to be installed in the roof of the vehicle. Antennas 1102, 1104 can be used for flight time measurement between the vehicle and the portable access device, while other LF antennas in the vehicle can be used for authentication of the portable access device.

[0276] Although the antenna assembly is primarily described as having a circular polarization antenna and a linear polarization antenna, which can be arranged, for example, in the roof of the vehicle, two linear polarization antennas can be used instead. This applies to each example disclosed herein. The two linear polarization antennas can be located deeper in the vehicle, such as in the floor, dashboard, or center console of the vehicle.

[0277] Fig.14A first RF circuit 1400, a second RF circuit 1401, and a portion 1403 of a portable access device (e.g., one of the portable access devices described above) are shown. Although a certain number of RF circuits are shown, any number of RF circuits may be included and any number of RF circuits may communicate with the portable access device. The first RF circuit 1400 includes a serial transmit module 1402, an RF transceiver module 1404, a switch 1406, a separator 1408, a single-axis polarization (or monopole) antenna 1410, a delay module 1412, and a circularly polarized antenna assembly 1414. Antennas 1410, 1414 may be implemented as multi-axis polarized RF antenna assemblies of FIG. 11. Although the RF circuits are shown as having single-axis antennas and circularly polarized antennas to provide three polarization axes, the RF circuits may include only two single-axis polarized antennas, respectively. Many arrangements of linear and circularly polarized antenna axes are likely to achieve polarization diversity in the module, thereby preventing cross-polarization and / or co-linear alignment of nulls. If the RF circuit includes two single-axis antennas, the portable access device includes a triaxial antenna, or three single-axis antennas that are orthogonal with respect to each other to correspond to the x, y, and z axes.

[0278] The serial transmission module 1402 can communicate with one or more vehicle modules (e.g., the vehicle control module or access module disclosed above) via a serial bus according to the serial peripheral interconnect (SPI) protocol. Discrete signals (or general I / O signals) can be sent between the modules 1402, 1404 and between the RF transceiver module 1404 and the switch 1406. The RF transceiver module 1404 can communicate with ( Figure 3 1406 switches between antennas 1410, 1414. Splitter 1408 may split a single signal received from RF transceiver module 1404 and provide the signal to antenna 1410 and antenna 1414 and / or combine the signals received from antenna 1410 and antenna 1414. Splitter 1408 may be a 90° splitter and split the single signal into two 90° out-of-phase signals and provide the signals to two feed points on a circular polarization antenna (e.g., feed points 1120, 1122 of FIG. 11 ). Splitter 1408 may provide a signal to antenna 1414 or receive a signal from antenna 1414 via delay module 1412.

[0279] The second RF circuit 1401 includes a switch 1420, a separator 1422, a single-axis polarization (or monopole) antenna 1424, a delay module 1426, and a circular polarization antenna 1428. Antennas 1424 and 1428 may be implemented as multi-axis polarization RF antenna assemblies of FIG. 11. Devices 1420, 1422, 1424, 1426, and 1428 may operate similarly to devices 1406, 1408, 1410, 1412, and 1414. Switch 1420 may communicate with RF transceiver module 1404. Switch 1406 may also connect separator 1408, single-axis polarization antenna 1410, and / or switch 1420 to RF transceiver module 1404. Switch 1420 may connect single-axis polarization antenna 1424 or separator to switch 1406 or RF transceiver module 1404.

[0280] Portion 1403 includes a 3-axis LF antenna 1430, an LF module 1432, an RF module 1434, a user interface 1436, a first single-axis polarized antenna 1438, a second single-axis polarized antenna 1440, and a switch 1442. The LF module 1432 transmits and receives LF signals via the 3-axis LF antenna 1430. The RF module 1434 transmits and receives RF signals via the switch 1442 and antennas 1438, 1440. The switch 1442 connects one or more antennas 1438, 1440 to the RF module 1434. Discrete signals and serial peripheral interconnect (SPI) signals can be transmitted between the LF module 1432 and the RF module 1434. Discrete signals can be transmitted between the RF module 1434 and the switch 1442.

[0281] RF signals are sent between (i) antennas 1410, 1414, 1424, 1428 and (ii) antennas 1438, 1440. As an example, antennas 1410, 1424 can be associated with the z-axis, while antennas 1414, 1428 can be associated with the x-axis and y-axis, respectively. Antennas 1438, 1440 can be, for example, slot antennas associated with the x-axis and y-axis, respectively. As described above, the 3-axis LF antenna 1430 can communicate with the LF antenna on the corresponding vehicle. The LF antenna can be used for the purpose of waking up the downlink. The RF antenna can be used for authentication and communication.

[0282] Antennas 1410, 1414 may be used to communicate with antennas 1438, 1440, or antennas 1424, 1428 may be used to communicate with antennas 1438, 1440. Alternatively, one of antennas 1410, 1424 and any one of antennas 1414, 1428 may be used to communicate with antennas 1438, 1440. One or more antennas in circuit 1400 may be used when one or more antennas in circuit 1401 are used. By using a monopole (or linear polarization) RF antenna and a dipole (or multi-axis polarization) RF antenna (such as a circular polarization antenna), the number of RF switching channels to be polled is reduced from 3 to 2. When measuring the round trip time and the phase delay of the packet, a heuristic measurement of RSSI may be made for the continuous wave tone of the packet. This may be repeated across multiple frequencies.

[0283] Fig.15 A portion 1500 of a key fob is shown having two linearly polarized slot antennas 1502, 1504, a metal trim 1506, and a spare key 1508. The metal in the key fob can short-circuit fields that would otherwise stabilize along the long dimension (or Y dimension) of the key fob. As a result, it may be difficult to design an efficient radiator with a structure that would otherwise include an antenna that operates correctly. Antenna 1502 is an x-axis linearly polarized slot antenna. Antenna 1504 is a y-axis linearly polarized slot antenna. Metal trim 1506 may be a cast, decorative trim. The key fob may also include a LF coil antenna 1510, a processor (not shown), a battery 1512, and a metal plate (or conductive film) 1514. RF signals are provided to the metal plate 1514 and the openings of the slot antennas 1502, 1504 to radiate electromagnetic waves.

[0284] Fig.16 Shows Fig.15 1508. Portion 1600 includes x-axis linear polarized slot antenna 1502 and y-axis linear polarized slot antenna 1504. Removing metal trim 1506 and spare key 1508 supports radiation from the slot antenna. Although this configuration is configured to work with nearby metal (such as metal trim and spare key), it is still shown Fig.17 and Fig.18 's diagrams, which are tilted from the diagrams when the metal trim and spare key are included. Fig.17 Shown with Fig.16 A polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of portion 1600 of the key fob. Fig.18 Shown with Fig.17An example polar plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of portion 1600 of a key fob. Fig.19 Shows Fig.16 Graphs of return loss (in decibels (dB)) versus frequency for linearly polarized slot antennas 1502, 1504, wherein curve S1,1 is the reflected power for a first port or antenna 1502 of a first radio (or transmitter), and S2,2 is the reflected power for a second port or antenna 1504 of a second radio (or transmitter). A key fob structure may be provided to provide the S1,1 and S2,2 graphs, wherein the "dip" or minimum return loss for the S1,1 and S2,2 curves are at the same frequency or within a predetermined range as each other to provide improved performance.

[0285] Return loss is a way of measuring how well an antenna converts a voltage at the antenna's terminals into an electric field in space, or vice versa. Return loss is a decibel measurement of how much power is reflected at the terminals. For example, if the return loss is 0dB, all power is reflected and no power is transmitted at the terminals. As another example, a return loss of -10dB means that approximately 10% of the power is reflected and 90% of the power is transmitted. When a return loss graph includes a curve that dips to a reasonable level at the operating frequency (e.g., -6dB), the corresponding antenna is working well. If the return loss dips to -10dB, the antenna is considered to be a well-working antenna. Return loss is measured as an S parameter. S1,1 is the return loss of port 1. S2,2 is the return loss of port 2.

[0286] Fig. 20 Shows Fig.15 A portion 2000 of the key fob does not have the metal decorative piece 1506 but includes a spare key 1508 . Fig.21 Shown with Fig. 20 A polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of portion 2000 of the key fob. Fig. 22 Shown with Fig. 20 Polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion 2000. Adding a spare key may negatively impact the y-polarization, but may be acceptable for operation. Fig.23 Shows Fig. 20 Return loss versus frequency graph of the linearly polarized slot antennas 1502 and 1504 , where S1,1 is for antenna 1502 and S2,2 is for antenna 1504 .

[0287] Fig.24 Shows Fig.15The portion 2400 of the key card has a portion of a metal trim 2402 and a spare key 1508. Adding the metal trim 2402 near the spare key 1508 may negatively affect operation, such as Figure 25-27 As shown in the figure and curve. Fig.25 Shown with Fig.24 A polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of portion 2400 of the key fob. Fig.26 Shown with Fig.24 A polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of a portion of a key fob. Fig. 27 Shows Fig.24 Return loss versus frequency graph of a linearly polarized slot antenna, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504. Fig.19 , 23 27 show that the antenna works well in the frequency range of interest (eg, 2.4-2.8 GHz).

[0288] Reference Fig.15 1500, in the presence of the entire metal trim 1506, the operation of the antenna is further negatively affected, such as Figure 28-Figure 30 As shown in the diagram and curve. Fig.28 A polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of portion 1500 is shown. Fig.29 A polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of portion 1500 is shown. Fig.30 Return loss versus frequency graphs for linearly polarized slot antennas 1502 , 1504 are shown, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504 .

[0289] Since each of the antennas 1502, 1504 has an open end, the y-axis linear polarized slot antennas 1502, 1504 are open slot antennas. Fig.31 A portion 3100 of a key fob is shown having an open linear polarized slot antenna 3102 , a closed linear polarized slot antenna 3104 , a metal trim 3106 , and a spare key 3108 . Fig.32 A polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 3102 of portion 3100 is shown. Fig.33 A polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 3104 of portion 3100 is shown. Fig.34 Shows Fig.31 Return loss-frequency diagram of the linearly polarized slot antennas 3102 and 3104. Fig.34This indicates that the antenna measured at port S2,2 is not working properly.

[0290] When the portable access device has multiple orthogonal antennas as described above, the portable access device is larger than a corresponding physical metal key, and the portable access device is larger than the palm of a hand, the removal of decorative metal trim provides improved round trip time performance. The improved round trip time performance increases the accuracy of distance determination.

[0291] The systems disclosed herein can be operated using a variety of methods described herein. Fig.35 and Fig.36 Several example methods of determining which antenna combination to use are illustrated in FIG. Fig.35 and Fig.36 A method of determining which antenna combination to use for exchanging packets between an RF antenna module (or RF circuitry) of a vehicle and a portable access device for round-trip time-of-flight measurements is illustrated. Fig.35 and Fig.37 The method is presented from the perspective of the initiator of the round trip flight time measurement. In one embodiment, this is a vehicle. In another embodiment, this is a portable access device. The reflector / responder will perform the obvious steps corresponding to the initiator steps in the process. The round trip flight time measurement can be used to prevent range extender type relay station attacks, as further described below. Fig.35 A method of switching antennas between groups is illustrated. Fig.36 A method of switching antennas during transmission of packets and / or continuous wave (CW) tones is illustrated.

[0292] Although mainly about Figure 2-Figure 6 , Figure 11 and Fig.14 The following operations are described for implementation of , but these operations can be easily modified to apply to other implementations of the present disclosure. The operations can be performed iteratively.

[0293] The method may begin at 3500. The method may generally be performed by a control module 402 in a portable access device 400 and a module located on a vehicle (e.g., via Figure 4 The access module 210, PEPS module 211 and / or PAK module 212) simultaneously performs the following operations. There are multiple ways in which the selected frequencies and antenna combinations are sampled to subsequently identify the best frequency (or channel) and antenna axis. Optionally, at 3501, the modules negotiate the initial frequency (or channel) and antenna combination used for frequency and antenna sounding. This step can be based on a priori protocol, negotiated between modules based on a posteriori data, and / or commanded by the modules based on a posteriori data. At 3502, a frequency (or channel) is selected to send the first (or next) packet.

[0294] At 3504, an antenna pair is selected at which to transmit and receive packets. Such as two of the antennas of the RF circuit of the vehicle of FIG. 11. At 3506, the packet is transmitted from the first (or transmit) antenna to the portable access device at the selected frequency. The portable access device measures the RSSI of the transmission and transmits the packet back to the second (or receive) antenna in the selected antenna pair as the first RSSI.

[0295] At 3508, the second antenna receives the packet and / or a response to the transmission of the packet and the first RSSI. At 3512, a second RSSI is measured for the second transmission of the packet. At 3514, the first RSSI and the second RSSI are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

[0296] At 3516, if another pair of antennas is to be selected, then operation 3504 is performed, otherwise operation 3518 is performed. This allows cycling through each antenna pair arrangement for each selected frequency. Cycling through the antenna pair arrangements may be in a pseudo-random and / or predetermined order.

[0297] At 3518, if another frequency (or channel) is to be selected, operation 3502 is performed, otherwise operation 3520 is performed. This allows looping through each frequency (or channel). This allows the RSSI of each frequency (or channel) to be determined. Multipath fast fading can cause some frequencies to have lower power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels can be looped through in a pseudo-random and / or predefined order to determine the best frequency and / or channel and the best antenna pair for transmission of other packets.

[0298] Optionally, at 3519, after cycling through a set of predetermined, negotiated, and / or agreed upon frequency and antenna axis pairs, the algorithm may cause the nodes (control modules) to optionally exchange antenna and / or channel RSSI results. Due to the reciprocity of RF channels, the modules may use heuristics that select the antenna axis used by the modules without sharing antenna RSSI measurements taken by the modules. Due to the reciprocity of RF channels, the modules may use heuristics to select a channel (frequency) without results from other channels, but the modules may use an algorithm that selects a channel based on results from the channel. In this case, the algorithm and system are more immune to interference from other nearby transmitters.

[0299] At 3520, after looping through a predetermined number of frequencies and antenna pairs, the antenna axis combination and / or frequency (channel) with the best RSSI is selected for sending the remaining packets. The best is the antenna axis combination with the highest RSSI. For a frequency (or channel), the best is the antenna axis combination that does not have a low RSSI and / or does not have a high RSSI. At 3522, the identifier of the selected antenna pair and / or frequency (channel) can be encrypted. At 3524, the encrypted selected antenna axis pair and / or frequency (channel) can be sent to another node. At 3526, a packet is sent using the selected frequency (channel) and antenna pair and a response is received. The method can end at 3528.

[0300] Although mainly about Figure 2-Figure 6 , Figure 11 and Fig.14 The implementation describes Fig.36 The following operations are described below, but these operations can be easily modified to be applied to other implementations of the present disclosure. These operations can be performed iteratively.

[0301] The method may begin at 3700. The method may generally be performed by a control module 402 in a portable access device 400 and a module located on a vehicle (e.g., via Figure 4 The PEPS module 211 and / or the PAK module 212 of the present invention simultaneously perform the following operations. A variety of different techniques can be used to select the sampled frequency and antenna combination to identify the best frequency (or channel) and antenna axis. Optionally, in 3701, the modules negotiate the initial frequency (or channel) and antenna combination to be used in the frequency and antenna sounding. This step can be based on a priori agreement, negotiated between modules based on a posteriori data, or commanded by the modules based on a posteriori data. In 3702, the frequency (or channel) for sending the first (or next) packet is selected.

[0302] At 3704, an antenna pair is selected for transmitting and receiving packets. Such as two of the antennas of the RF circuit of the vehicle of Figure 11. At 3706, the packet is sent to the portable access device from the first (or transmitting) antenna at the selected frequency. The vehicle switches between a set of negotiated antenna axes using the dwell during the CW tone portion of the packet. Using the dwell within each of the vehicle antenna axis "switches" and "dwells", the portable access device switches between a set of negotiated antenna axes, measures the RSSI of the transmit and receive antenna axis arrangements during this reception for the period within the CW tone, and sends the packet and the first set of measured RSSI back to the vehicle, and then switches between a set of negotiated antenna axes using the dwell during the CW tone portion of the packet selected by the antenna pair.

[0303] At 3708, the vehicle receives the packet and / or a response to the transmission of the packet and the first set of RSSIs. At 3712, a second RSSI is measured for a second transmission of the packet. At 3714, the first RSSI and the second RSSI are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

[0304] At 3716, if another packet is to be sent, then operation 3718 is performed, otherwise operation 3726 is performed. At 3718, if another antenna pair is to be selected, then operation 3720 is performed, otherwise operation 3724 is performed. This allows for cycling through each antenna pair arrangement for each selected frequency. The antenna pair arrangements may be cycled through in a pseudo-random and / or predetermined order.

[0305] At 3720, a first transmission of the next packet begins using the previous transmit antenna in the previously selected antenna pair.

[0306] At 3722, switching occurs between the previous antenna pair and the next selected antenna pair. This may occur during the CW tone of the packet currently being transmitted or during another portion of the packet currently being transmitted, so that the remainder of the packet is transmitted via the transmit antenna of the next selected antenna pair. Operation 3708 may be performed after operation 3722.

[0307] At 3724, if another frequency (or channel) is to be spoofed, operation 3704 is performed, otherwise operation 3718 is performed. This allows the loop to go through each frequency (or channel). This allows the RSSI of each frequency (or channel) in the determined frequency (or channel) to be determined. Multipath fast fading can cause some frequencies to have lower power levels (or RSSI values). As an example, the frequencies of 37 BLE data channels can be looped in a pseudo-random and / or predefined order to determine the best frequency and / or channel and the best antenna pair for the transmission of other packets. In 3725, the antennas and RSSI result values ​​can be exchanged as described above in 3519.

[0308] At 3726, after cycling through a predetermined number of frequency and antenna pairs, the antenna combination and frequency and / or channel with the best RSSI is selected for sending the remaining packets.

[0309] At 3728, the identifier of the selected antenna pair may be encrypted. At 3730, each remaining packet may be encapsulated to include the encrypted identifier, or modified to include the encrypted identifier. At 3732, the encapsulated or modified packet may be sent using the selected frequency, channel, and antenna pair, and a response may be received. The method may end at 3734.

[0310] In the above method, packets sent to determine the best frequency, channel, and antenna pair may be discarded. The discarded packets are used only to measure RSSI values. In another embodiment, CW tones are included at the end of the packet and antenna switching occurs during these tones. In another embodiment, a predetermined time period (e.g., 4ps) is allocated for each antenna arrangement, CW tones are included at the end of the packet, and the antenna pair with the best RSSI (or power value) is selected. If another nearby network device is transmitting and / or receiving data in the same frequency range, the selected frequency, channel, and / or antenna pair may be changed. In an embodiment, in Fig.35 and Fig.36 The manner in which the frequencies are selected during the method may be known and may be shared between the access module of the vehicle and the portable access device.

[0311] Operations 3526 and 3732 may be performed to authorize a portable access device, detect a range extender relay attack by a portable access device, provide access to the interior of a vehicle, and / or perform other PEPS system and / or PAK system operations. As an example, a packet may be sent to authorize a portable access device, and when it is determined that the portable access device and / or the corresponding user is authorized to access the vehicle, access to the interior of the vehicle may be provided. This may include allowing operation of the vehicle. A packet may be sent to perform a time-of-flight measurement, including the time to send a packet to the portable access device and the time to make a response and receive a corresponding response from the portable access device. Based on the measured time-of-flight value, an access module (e.g., a PEPS module or a PAK module) of the vehicle may determine whether the portable access device is attempting to perform a range extender relay attack. If the portable access device is attempting to perform a range extender relay attack, the access module performs one or more countermeasures, including blocking access to the interior of the vehicle. The countermeasures may include notifying the owner of the vehicle of the range extender relay attack. For example, this may be accomplished via a text message or email sent from the access module to one or more network devices of the owner. One or more alarm signals may be generated and a central monitoring station and / or agency may be notified of the attack.

[0312] Fig.37A time of flight measurement graph 3800 is shown, which includes an initiating and measuring device 3802 and a reflecting (or responding) device 3804. The initiating and measuring device 3802 sends a radio message (e.g., a packet) to the reflecting device 3804, which then responds and resends the radio message back to the initiating and measuring device 3802. The time of flight (or the total time to send and receive these signals) is equal to the sum of (T2-T1), (T3-T2), and (T4-T3), where: T2-T1 is the amount of time for the radio message to travel from the initiating and measuring device 3802 to the reflecting device 3804; T3-T2 is the amount of time for the reflecting device 3804 to respond; T4-T3 is the amount of time for the radio message to travel from the reflecting device 3804 to the initiating and measuring device 3802. Example average time of flight and distance calculations can be performed according to equations 1-4, where distance refers to the distance between the initiating and measuring device 3802 and the reflecting device 3804.

[0313] Average flight time = [(total time) - (response time)] / 2 (1)

[0314] Average flight time = [(T4-T1)+(T3-T2)] / 2 (2)

[0315] Distance = speed * time (3)

[0316] Distance = c*[(T4-T1)+(T3-T2)] / 2 (4)

[0317] When a timer is used to time the response time T3-T2, the amount of timing information may be reduced to adjust the tuning information measured and associated with the response time. If the initiator does not know the amount of time, the time T3-T2 may be reported back to the initiator.

[0318] Fig.38 An example BLE radio 3900 is shown having a superheterodyne receiver 3902 and a transmitter 3904. The BLE radio 3900 may be used, for example, Figure 3One of the transceivers 222 and may include or may be part of one of the RF antenna module 40 and the RF circuit 223. The superheterodyne receiver 3902 uses mixing to convert the received signal to a fixed intermediate frequency (IF). The superheterodyne receiver 3902 includes an RF (e.g., bandpass) filter 3906, a switch and a balanced-unbalanced transformer 3908, a low noise amplifier 3910, a down converter 3912, a bandpass filter and amplifier 3914, an analog-to-digital converter 3916, a demodulator 3918, and a correlation and protocol module 3920. The transmitter 3904 includes a processing module 3922, a protocol module 3924, a Gaussian frequency shift keying (GFSK) modulator 3926, a digital-to-analog converter and a low-pass filter 3928, an up converter 3930, and a power amplifier 3932. (Multiple) crystal oscillators 3934 can generate one or more clock signals that can be distributed to devices 3914, 3916, 3918, 3920, 3922, 3924, 3936, 3938 and phase locked loops 3940, 3942. As an example, the processing module 3922 and the correlation and protocol module 3920 can be implemented as a single module and as Figure 3 The operations performed by modules 3922 and 3920 may be performed by Figure 3-4 One or more of devices 3906, 3908, 3910, 3912, 3914, 3916, 3918, 3920, 3924, 3926, 3928, 3930, 3932, 3934, 3936, 3938, 3940, and 3942 may be implemented as part of RF circuit 223 and / or as part of one or more of modules 204, 210, 211, and 212.

[0319] The bandpass filter 3906 may be connected to a linear polarized antenna and / or a circular polarized antenna (denoted as 3907). The downconverter 3912 downconverts the received signal from the RF frequency to the IF frequency based on a signal from the phase locked loop 3942. The upconverter 3930 upconverts the IF signal to the RF signal based on a signal from the phase locked loop 3940.

[0320] The GPSK modulator 3926 and demodulator 3918 may modulate and demodulate the bits of the signal according to the GFSK protocol. Fig.39 An example GFSK parameter definition diagram is shown, including a transmit carrier frequency F with zero crossings and errors illustrated. c As an example, the carrier frequency F cIt can be ±250KHz or ±500KHz, the symbol time is 1ps or 0.5ps, and the zero-crossing error is 1 / 8 of 1ps (1Mbps) or 1 / 8 of 0.5ps (2Mbps).

[0321] Fig.40 4100 for transmitting a BLE packet. An example format of a BLE packet 4101 is shown, which includes a preamble, an access address, a protocol data unit (PDU), and a cyclic redundancy check (CRC) bit field. This can be performed by Fig.37 Examples of packets received by the correlation and protocol module 3940 and / or generated by the processing module 3922 and / or the protocol module 3924.

[0322] The preamble of the packet is AA or 55, so that the last bit of the preamble is different from the first bit of the access address. The access address of the peripheral device and the central device 4102, 4104 is the same. The sensor 4106 can be used to monitor the packets. The access address is the same for each packet and each connection interval. The access address follows the BLE access address rules. Packets in the same connection interval are in the same RF channel. Fig.41 Example preambles and access addresses for BLE 1M packets and BLE 2M packets are shown. The preambles are A's preamble and 5's preamble (AA or 55 at 1 mbit / s and AAAA or 5555 at 2 mbit / s) such that the last bit of the preamble is different from the first bit of the access address. This is illustrated by the bits in circle 4200.

[0323] The access address for the advertising channel packet can be 10001110100010011011111011010110b (0x8E89BED6). Each link layer connection between any two devices and each periodic advertisement has a different access address. The access address can be a 32-bit value. Each time a new access address is needed, the link layer can generate a new random value that satisfies the following rules. The access address is not the address of an existing link layer connection on the corresponding network device. The access address: is not the address for enabled periodic advertisements; does not have six consecutive 0s or 1s; is not an advertising channel packet access address; is not a sequence that differs from the advertising channel packet access address by only one bit; and does not include four equal octets. The number of transitions of the access address does not exceed 24. The seed of the random number generator comes from a physical source of entropy and has at least 20 bits of entropy. If the random number for the access address does not meet the above rules, a new random number will be generated until these rules are met. For implementations that also support the BLE coded physical layer (PHY), the access address may also have at least three 1s in the least significant 8 bits and no more than 11 transitions in the least significant 16 bits. In a normal BLE packet, the preamble discards the first bit of the access address, and then the access rule sometimes discards the next bit of the access address (e.g., no more than 6 consecutive preambles of 0 or preambles of 1). Because an attacker can predict the bits, this may cause ranging security issues, which can be mitigated or eliminated by the implementation disclosed herein.

[0324] Fig.42 An example diagram of a BLE packet signal is shown, illustrating the corresponding bits of the first BLE signal 4300 representing the Fig.38 3924. A normal BLE packet does not return to the carrier (or midpoint level) when these bits remain the same value. This is called non-return-to-zero recording. The corresponding bits of the first graph are displayed above the graph. The second BLE signal 4302 represents a bit stream from a GFSK modulator (or Gaussian filter) 3926. The Gaussian filter adds a time lag of 1 / 2 bit and loses a little time during the transition. The corresponding bits of the second BLE curve are displayed below the second BLE curve. As an example, the carrier frequency can be 2.402GHz and the frequency of the BLE packet signal can vary between 2.402250GHz and 2.401750GHz.

[0325] Fig.43 4400 shows an example diagram of a BLE packet signal, illustrating corresponding bits of a stronger BLE packet signal (e.g., a BLE packet signal with a larger RSSI) after leading edge sensing and transmission under faster edge conditions. The first BLE signal 4400 represents a BLE packet signal from Fig.38 4404. The second BLE signal 4402 represents a bit stream from a GFSK modulator (or Gaussian filter) 3926. The third BLE signal 4404 represents a stronger BLE packet signal after being sent with a faster edge after the leading edge of the Gaussian bit is sensed. The third BLE signal 4404 can be generated by an attacking device. It can be seen that the edges are tilted and the transitions are faster than the transitions of the second BLE curve 4402. This causes the corresponding bit to be earlier than the bit of the second figure (or the output of the GFSK modulator 3924). The ellipse 4406 represents an area where differences can be detected and indicated.

[0326] The corresponding bits of the first BLE curve 4400 are displayed above the first BLE curve 4400 .

[0327] The corresponding bits of the second BLE curve 4402 are displayed below the second BLE curve 4402. The corresponding bits of the third BLE curve 4404 are displayed below the bits of the second BLE curve 4402 and are shifted to the left relative to the bits of the second BLE curve 4402.

[0328] Fig.44 Shows Fig.43 The second BLE curve 4402 and the third BLE curve 4404 are shown in Figure 4406, wherein the third BLE curve 4404 has been shifted relative to the second BLE curve 4402. The following operations may be performed to defend against a bit acceleration attack. A bit acceleration attack may refer to an attacking device accelerating the transmission of a BLE signal to account for delays associated with the attacking device receiving, processing and / or modifying and forwarding a BLE signal (such as a BLE signal sent from a key card and / or other portable access device). Fig.45 An example method for detecting an extended-range relay attack is shown. Figure 2-Figure 6 , Figure 11 and Fig.14 The implementation describes Fig.45 The following operations may be performed by one or more modules of modules 210, 211, and 212, but these operations may be easily modified to apply to other implementations of the present disclosure. These operations may be performed iteratively. For example, the following operations may be performed by one or more modules of modules 210, 211, and 212.

[0329] The method may begin at 4600. At 4602, a sliding correlation function is used to align the received input waveform with an idealized Gaussian waveform (or other suitable predetermined waveform) for a known bit pattern and bit rate, including scaling the peaks and aligning the received input waveform with the zero offset of the predetermined waveform. This may be accomplished by Fig.38The correlation and protocol module 3920 are completed. This can identify, for example, a synchronization access word. Fig.44 An example of this is shown in .

[0330] At 4604, the portion (or portions) of the received waveform that occurs just after the zero crossing in time and before the next peak of the predetermined waveform is integrated and accumulated (or summed) 4605. This is called a positive accumulation.

[0331] At 4606, the portion (or portions) of the received waveform that occurs some time after the peak in time and before the next zero crossing 4607 is integrated and accumulated. This is also called a positive accumulation.

[0332] At 4608, the resulting accumulated values ​​determined in 4604 and 4606 are averaged over the number of transitions used to provide an indication of the level of bit speeding attack. The accumulated values ​​may be averaged separately to provide two averages, or may be added and then averaged to provide a single average.

[0333] At 4610, based on the one or more averages and one or more predetermined thresholds, it is determined whether an attack has occurred and / or may have occurred. At 4612, if the attack has occurred and / or may have occurred, operation 4614 is performed, otherwise operation 4616 is performed. In 4614, countermeasures are executed, such as one of the previously mentioned countermeasures, including blocking access to and / or operation of the corresponding vehicle. One or more alarms may also be generated. As another example countermeasure, data related to the attack may be stored in a memory and / or sent to a network device and / or a central monitoring station of the vehicle owner. In 4616, if the attack has not occurred and / or may not occur, access and / or operational control of the vehicle is allowed. Operational control may include, for example, unlocking or locking of the vehicle's doors, remote starting of the vehicle's engine, adjustment of the vehicle's interior climate control, etc. In 4618, the one or more averages may be discarded and / or previously aggregated and accumulated data may be discarded. If a sliding window is used to monitor the received signal, older portions of the data may be discarded, while more recent portions may be retained for subsequent integration, accumulation, and averaging with newly received data.

[0334] Fig.46A vehicle 5200 including a round trip time (RTT) responder 5202 and an RTT initiator 5204, and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210 are shown. As used herein, an "initiator" may refer to a network device that includes a BLE radio, a transmitter, and / or a receiver and initiates a signal or tone exchange. As used herein, a "responder" may refer to a network device that includes a BLE radio, a transmitter, and / or a receiver and responds to a signal and / or tone received from an initiator. The RTT responders 5202, 5210 and the RTT initiators 5204, 5208 may be, for example, Figure 3 The RF antenna module 40, RF circuit 223 and / or modules 210, 211, 212 are implemented and include corresponding transmission and reception circuit systems. The vehicle 5200 may include an antenna module with a single polarization antenna and a circular polarization antenna as described above. The RTT responder 5202 and the RTT initiator 5204 can use the antenna for transmission and reception. The antenna provides polarization diversity using the antenna (e.g., a single polarization antenna) used by the RTT initiator 5208 and the RTT responder 5210, so that at any time, at least one of the above-mentioned antennas of the vehicle 5200 has at least one polarization axis that is not cross-polarized and is not co-polarized with the polarization axis of at least one of the antennas of the portable access device 5206.

[0335] Devices 5202, 5204, 5208, 5210 may each include a control module as described above to perform any of the described operations. Devices 5202, 5204, 5208, 5210 may send and receive RF signals on random channels (e.g., 40 BLE channels on an 80 MHz spectrum). Devices 5202, 5208 may communicate with each other, including sending and receiving signals, and devices 5204, 5210 may communicate with each other, including sending and receiving signals. The communication between devices 5202, 5208 may be simultaneous with the communication between devices 5204, 5210. For security reasons and to detect attacks, the transmission of signals for determining RTT may be sent simultaneously and in a bidirectional manner. Devices 5202, 5204 may share a frequency for communication with a portable access device 5206. The frequencies may be indicated in a predetermined order, followed by devices 5202, 5204, 5208, 5210. If a bandpass filter is used to monitor two channels simultaneously, the filter will introduce a propagation delay.

[0336] A typical bandpass filter delay is 0.5 per bandwidth (or 0.5 / bandwidth). The channel spacing of the protocol, the randomness of channel selection, the randomness of the transmission direction over time, and simultaneous transmissions all force the bandpass filter to detect bits with group delays that are large compared to the measurable round-trip time delay. This further increases the difficulty for an attacking device to perform an extended-range relay attack. The vehicle 5200 and portable access device 5206 can each set the transmit power level and transmit channel spacing so that, for example, it is impractical for an attacking device to receive the signal with a filter wide enough to relay with a delay short enough but narrow enough to analyze the signal.

[0337] In an embodiment, a signal is sent to measure the direct flight time and determine whether there is a predetermined delay amount (e.g., 10-500 nanoseconds (ns)) that is typically associated with a range extender-type attack device. When relaying signals between the vehicle 5200 and the portable access device 5206, the range extender-type attack device may delay the transmitted signal by a predetermined amount. The above-described bidirectional and simultaneous transmission and reception makes it difficult for the attack device to determine the frequency, channel, and direction of the transmitted signal at any time. It is also difficult for the attack device to avoid relaying signals without a predetermined delay amount.

[0338] Fig.47 A vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204 , and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210 are shown. Fig.47 The signal paths through the corresponding antennas 5300, 5302, 5304, 5306 are shown. In an embodiment, the antennas 5300, 5302 have a total of three polarizations and the antennas 5304, 5306 have a total of two polarizations. In another embodiment, the antennas 5300, 5302 have a total of two polarizations and the antennas 5304, 5306 have a total of three polarizations.

[0339] Fig.48A vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210, and an extended-range relay attack device 5400 are shown. The extended-range attack device 5400 includes a control module 5402, which includes a bandpass filter 5404, a bit signal direction detector 5406, and a bit acceleration attack module 5408. The bandpass filter 5404 is used to detect incoming bits, but has an associated lag time. The bit signal direction detector 5406 determines the direction in which the bit is traveling (e.g., from the vehicle to the portable access device or from the portable access device to the vehicle). The bit acceleration attack module 5408 cannot accelerate the bit without introducing a lag time in a portion of the symbol (or bit), which can be detected using a sliding correlation function aligned with an ideal waveform and averaging the symbol (or bit) shape over multiple symbols. The above lag time can be detected by the access module of the vehicle when determining whether an attack is occurring.

[0340] As shown, the extended-range attack device 5400 includes an amplifier 5410 for receiving and transmitting purposes, such as a low noise amplifier (LNA) and a power amplifier. The extended-range attack device 5400 may also include a mixer for down-conversion and up-conversion purposes. The amplifier 5410 is connected to an antenna 5412.

[0341] In addition to performing the above-mentioned communications simultaneously, the channel can also be pseudo-randomly selected, and the access address can also be pseudo-randomly selected. This random selection can be performed on the vehicle and can be shared with the portable access device in advance. Conversely, the selection can be performed at the portable access device. Conversely, the selection can be performed by secure encryption technology, where the key material comes from one or both of the devices that contribute to the pseudo-randomly selected channel sequence and / or access address sequence. In this case, the pseudo-random sequence of the access address is used as a cryptographically secure bit sequence for round-trip timing measurement exchange. In the case of performing simultaneous transmission and reception operations on a random channel with a randomly selected access address, where the response is located on the same channel as the initiator and the response access address is different from the initiator access address, it is difficult for the extended-range attack device to perform an attack without being detected by the vehicle's access module and / or the control module of one or more portable access devices. The extended-range attack device must: listen to all channels in both directions at the same time; determine the direction in which the message passes through the extended-range attack device; and detect these bits as early as possible and send these bits in advance in both directions The appropriate amount of time to convince the vehicle's initiator and the one or more portable access devices. The extended range attack device must convince the vehicle's initiator and one or more portable access devices that the portable access device is closer than it actually is and is at the correct distance from the vehicle to allow access and / or operational control of the vehicle. Additionally, using Gaussian filtering for the BLE bits, the attack device has a small window that is less than approximately 10-100ns ahead of the bit detection time to detect the bit and transmit the bit ahead of time.

[0342] In an embodiment, the RF signal associated with the above-mentioned simultaneous communication is composed of Figure 3 The modules 210, 211, 212 monitor the signal, and the stated initiator and responder monitor and / or determine the RSSI value and antenna polarization state (e.g., the degree of polarization between the transmitting and receiving antennas) of the signal. Based on the RSSI value and polarization, one or more of the modules 210, 211, 212 determine the path, frequency, channel, and antenna pair that are optimal for communication. Signals associated with the shortest path (or minimum interference), the best RSSI value, the maximum polarization, etc. are used to indicate which path, frequency, channel, and antenna pair to use. This information can also be used to determine which device sends and which device receives at any time. The selection of transceiver chips and channels on each device can be random. In an embodiment, one device (at a vehicle or portable access device) can send while the other device does not send but receives. This role can then be switched so that the first device is receiving and the second device is sending without receiving.

[0343] Although many of the techniques described above and below include monitoring, generating, receiving, sending, and / or measuring various parameters at a vehicle access module, and detecting an extended-range relay attack based on that information, these techniques may be modified so that some or all of these operations are performed at a control module (or other module) of a portable access device (such as any of the portable access devices disclosed herein). Similarly, various operations are described as being performed at a portable access device; these operations may be performed at an access module of a vehicle.

[0344] Examples of different BLE RF transmission frequencies are 2.410 gigahertz (GHz), 2.412 GHz, 2.408 GHz, and 2.414 GHz. The RTT initiator and responder and / or the corresponding transmitter and receiver may use these and other frequencies.

[0345] In an embodiment, other transmitters of the vehicle and / or portable access device are used to lightly load one or more channels so that the attack device has a narrow low pass filter to detect the RF signals sent by the initiator and responder. The one or more channels may include channels used by the initiator and responder or may be nearby channels. The signals sent on the one or more channels may be dummy signals.

[0346] Fig.49Two of the BLE radios 3900 are shown (denoted as 3900A and 3900B). The first BLE radio 3900A is used as an initiating and measuring device. The second BLE radio 3900B is used as a reflection (or response) device. The initiating and measuring device 3900A can measure the RTT of sending a packet from the first BLE radio 3900A to the second BLE radio 3900B, the time for the second BLE radio to respond, and the time for sending a packet from the second BLE radio 3900B to the first BLE radio 3900A. In another embodiment, the RTT includes the time for sending a packet from the processing module 3922A of the first BLE radio 3900A to the correlation and protocol module 3920B of the second BLE radio and from the processing module 3922B or the protocol module 3924B back to the demodulator 3918a or the correlation and protocol module 3920A. This may include measuring the travel time: from the processing module 3922A; through the protocol module 3924A, GFSK modulator 3926A, D / A and low pass filter 3928A, up converter 3920A, power amplifier 3932A, switch and balun 3908A, and band pass filter 3906A; to the BLE radio 3900B; through the band pass filter 3906B, switch and balun 3908B, low noise amplifier 3910B, down converter 3912B, band pass filter and amplifier 3914B, A / D 3916B and demodulator 3918B, to the correlation and protocol module 3920B. The time to travel from the demodulator 3918B or the correlation and protocol module 3920B to the protocol module 3924B or the processing module 3922B may also be determined. The time from the protocol module 3924B or the processing module 3922B, through the GFSK modulator 3926B, the D / A and low pass filter 3928B, the up converter 3930B, the power amplifier 3932B, the switch and balun 3908B, the band pass filters 3906B and 3906A, the switch and balun 3908A, the low noise amplifier 3910A, the down converter 3912A, the band pass filter and amplifier 3914A, the A / D 3916A, and the demodulator 3918A or the correlation and protocol module 3920A can also be determined. Although the BLE radio 3900A is described as an initiator and the BLE radio 3900B is described as a responder, the operating roles can be switched so that the BLE radio 3900B is the initiator and the BLE radio 3900A is the responder.

[0347] The following operations can be performed to accurately determine the two BLE radios of the vehicle (e.g. Fig.49The initiator may measure and / or estimate the RTT of signals sent between BLE radios. This may include: the time T1 at which a packet is sent from a first BLE radio to a second BLE radio, the time T2 at which the second BLE radio responds, the time T3 at which the second BLE radio sends a packet back to the first BLE radio, and the time T4 at which the first BLE radio receives a packet from the second BLE radio.

[0348] In an embodiment, the A / D and D / A clocks of the BLE radio and / or phase-locked loop are jittered between packets. In addition to jittering the clocks where possible, cryptographic random variations can be added to the least significant bit (LSB) generated by a digital timer for when to send, which is known to the BLE radio. Using cryptographic random variations makes it impossible for an attacking device to predict the precise moment when a transmission occurs.

[0349] In an embodiment, each packet includes a pre-agreed cryptographically random multi-bit identifier (PACRMBI) of, for example, 16 to 256 bits in size. In another embodiment, the bit content of packets from the initiator and responder is indistinguishable to the attacking device. The attacking device cannot identify from which direction the packet came, or whether the packet is an initiator packet or a responder packet, based on the bit content of the packet.

[0350] In an embodiment, the channels of the BLE radios are cryptographically randomized. In an embodiment, the determination of which of the BLE radios is the initiator or responder is cryptographically randomized. In an embodiment, one or both of the BLE radios send dummy packets that an attacking device cannot distinguish from other packets sent by the BLE radios. The choice of whether a BLE radio sends a dummy packet is cryptographically randomized and can be switched randomly. This makes it difficult for an attacking device to determine which are valid packets and the direction in which the packets are sent between the BLE radios.

[0351] In an embodiment, the polarization of the set of antennas used by the BLE radios is initially cryptographically randomized. A heuristic is used to select which antenna arrangements between the BLE radios provide the best "antenna-channel" in the set of channels. This may include: using a heuristic to select higher received signal strength; compensating for antenna gain over frequency, monitoring multiple channels; using the antenna combination with the highest average or median power; and / or using a Rayleigh fading estimator or a Kalman filter estimator. This can reduce the cryptographically random antenna patterns and focus on the "antenna-channel" with the maximum power and minimum cross-polarization.

[0352] In an embodiment, the in-phase and quadrature phase (IQ) streams at the receiver are upsampled (or interpolated) before the IQ stream with the idealized upsampled IQ stream matching the PACRMBI is sent to the correlation and protocol module of one BLE radio of the corresponding BLE radio. As an alternative to using PACKRMBI's, the message sent can be encrypted and bit-decoded when the message is received and then converted to an idealized upsampled IQ stream. The two upsampled streams can be sent through the correlation and protocol module 3920, which can monitor the upsampled clock edges, where there is enough correlation to match the PACRMBI. The correlation and protocol module 3920 selects the maximum edge of the matched clock edge. Other clock recovery methods can be used to interpolate sub-bit timing in the round trip timing of the bit stream in the communication channel. This can be performed in conjunction with upsampled correlation or in conjunction with normal clock sampling.

[0353] In an embodiment, amplifier settings are communicated between BLE radios. The amplifier settings are sufficient to compensate for any frequency and amplifier gain variations in the propagation delay between the BLE radios.

[0354] In another embodiment, the measured die temperature in the BLE radios is communicated (or shared) between BLE radios to compensate for any temperature-based frequency and amplifier gain variations in propagation delay between the BLE radios.

[0355] Another operation that may be performed is to transmit balun changes between BLE radios.Another operation is to add a short (e.g. 6 μs) but cryptographically random length (e.g. 4 to 8 μs) continuous wave tone to the packet pairs to perform simultaneous tone exchange ranging while performing round trip timing measurements.

[0356] Fig.50A position and distance determination system 5600 is shown, which includes an RTT initiator 5602, an RTT responder 5604, and an RTT sniffer 5606. The RTT initiator 5602 and the RTT responder 5604 can be used as any of the initiators, responders, BLE radios, RF circuits disclosed herein. The RTT sniffer 5606 can be located at the vehicle together with one of the RTT devices 5602, 5604 and includes Figure 2 One of the antenna modules 40 of the vehicle, and the RTT device in the vehicle includes another of the antenna modules 40. Devices 5602, 5604, 5606 may respectively include control modules as described above to perform any of the described operations. Polarization diversity as described above is provided: between the antennas of the RTT devices 5602, 5604; and between the antenna of one of the RTT devices 5602, 5604 located in the vehicle and the RTT sniffer 5606. Polarization diversity is particularly used when performing round-trip timing measurements. Each of the RTT devices 5602, 5604 may include a single-polarization antenna and a circularly polarized antenna.

[0357] One of the RTT devices 5602 and 5604 located in the vehicle can be referred to as a master device, and the other RTT device in the RTT devices 5602 and 5604 is referred to as a slave device. When the master device sends a challenge signal to the slave device, the RTT sniffer 5606 acts as a listener and detects (i) when the challenge signal is sent to the RTT sniffer 5606 and / or when the challenge signal is received at the RTT sniffer 5606, and (ii) when the slave device sends a response signal to the challenge signal, and / or (iii) when the RTT sniffer 5606 receives the response signal. Then, the RTT sniffer 5606 can use triangulation to determine the position of the slave device based on the sending and / or receiving time of the challenge signal and the sending and / or receiving time of the response signal. The master device can also measure the round trip timing associated with the challenge signal and the response signal so as to measure the direct path between the antennas instead of the bounce path. This prevents the null position of the antenna from being aligned and cross-polarized.

[0358] The master device and RTT sniffer 5606 cooperate to estimate the distance to the slave device. The master device can implement the following equations 5-7 to determine the amount of time T for sending a challenge signal from the master device to the slave device. MS , where: T SM is the amount of time it takes for a response signal to be sent from the slave to the master; T RX is the time when the response signal is received at the master device; T TX is the time when the query signal is sent from the master device; T SDELAYis the amount of delay time for the slave device to respond with a response signal after receiving the challenge signal; and FixedOffset1 is the first offset time amount, which may be greater than or equal to 0.

[0359] T MS +T SM =T RX -T TX -T SDELAY +FixedOffset1 (5)

[0360] T MS =T SM (6)

[0361]

[0362] The RTT sniffer 5606 knows: when the challenge signal is received at the RTT sniffer 5606; when the response signal is received at the RTT sniffer 5606; and the number of slave clock cycles between when the challenge signal is received from the device and when the response signal is sent from the device. The RTT sniffer 5606 (or listener) can determine the time T when the RTT sniffer 5606 receives the response signal using Equation 8 SLRx The time T when the RTT sniffer 5606 receives the query signal MLRX The difference between, where: T SL is the amount of time that the RTT sniffer 5606 receives the response signal; FixedOffset2 is the second offset time amount, which can be greater than or equal to 0; T ML is the amount of time that the RTT sniffer 5606 takes to receive the challenge signal; T SLRx is the time when the RTT sniffer 5606 receives the response signal; and T MLRx It is the time when the RTT sniffer 5606 receives the challenge signal.

[0363] T MS +T SDELAY +T SL +FixedOffset2-T ML =T SLRX -T MLRX (8)

[0364] Since the master device and RTT sniffer 5606 are collaborative, information is shared so that one or more of these devices can estimate the distance to the slave device based on equations 9-11. MS and T SL The sum is substituted to provide Equations 9-11.

[0365]

[0366] By measuring the arrival time of the challenge signal and the response signal at the RTT sniffer 5606 and sharing this information between the RTT sniffer 5606 and the master device, the distance between the vehicle and the slave device can be estimated. The master device can use the arrival time and the known time T MS The distance can be estimated based on the measured arrival time and the corresponding known signal transmission rate. The RTT of the challenge signal can be determined based on the measured arrival time. The distance can then be determined based on the RTT and the known signal transmission rate.

[0367] Fig.51 Another position and distance determination system 5700 is shown, which includes an RTT initiator 5702, an RTT responder 5704, and a plurality of RTT sniffers 5706. The RTT initiator 5702 and the RTT responder 5704 can be used as any of the initiators, responders, BLE radios, RF circuits disclosed herein. The RTT sniffer 5706 can be located at the vehicle together with one of the RTT devices 5702, 5704, and includes an antenna module (similar to Figure 2 The RTT device in the vehicle may also include a control module similar to the control module 40. Figure 2 The antenna module 40 of the RTT device 5702 is provided with polarization diversity: between the antennas of the RTT devices 5702, 5704; and between the antenna of one of the RTT devices 5702, 5704 located in the vehicle and the RTT sniffer 5706. Polarization diversity is particularly used when performing round trip timing measurements to measure the direct path between the antennas rather than the bounce path. This prevents the nulls of the antennas from being aligned and cross polarized.

[0368] One of the RTT devices 5702 and 5704 located in the vehicle may be referred to as a master device, and the other of the RTT devices 5702 and 5704 may be referred to as a slave device. When the master device sends a challenge signal to the slave device, the RTT sniffer 5706 acts as a listener and detects when the challenge signal is sent and when the slave device sends a response signal to the challenge signal. Fig.50 Each RTT sniffer 5706 may operate similarly to the RTT sniffer 5606.

[0369] Time TAB is the amount of time it takes to send a challenge signal from the RTT initiator 5702 to the RTT responder 5704. Time TBA is the amount of time a corresponding response signal is sent from the RTT responder to the RTT initiator. Time TAC is the amount of time it takes the first RTT sniffer to receive the challenge signal. Time TBC is the amount of time it takes the first RTT sniffer to receive the response signal. Time TAD is the amount of time it takes the second RTT sniffer to receive the challenge signal. Time TBD is the amount of time it takes the second RTT sniffer to receive the response signal. Time TAE is the amount of time it takes the third RTT sniffer to receive the challenge signal. Time TBE is the amount of time it takes the third RTT sniffer to receive the response signal. When TAB and TAC are known, TBC can be calculated. When TAB and TAD are known, TBD can be calculated. When TAB and TAE are known, TBE can be calculated.

[0370] If there are enough RTT sniffers, the time TAB can be calculated. For example, if three RTT initiators know the position of the RTT initiator relative to the master device (or initiator), the time TAB can be calculated. This can be done using equations 12-17 and assuming that all reflections are instantaneous, where: TRxAC is the time when the first RTT sniffer receives the challenge signal; TRxBC is the time when the first RTT sniffer receives the response signal; TRxAD is the time when the second RTT sniffer receives the challenge signal; TRxBD is the time when the second RTT sniffer receives the response signal; TRxAE is the time when the third RTT sniffer receives the challenge signal; TRxBE is the time when the third RTT sniffer receives the response signal; deltaRxAtC is the time difference between the first RTT sniffer receiving the response signal and the first RTT sniffer receiving the challenge signal; deltaRxAtD is the time difference between the second RTT sniffer receiving the response signal and the second RTT sniffer receiving the challenge signal; deltaRxAtE is the time difference between the third RTT sniffer receiving the response signal and the third RTT sniffer receiving the challenge signal. The position of the slave device (or responder) can also be determined using equations 18-25, where: xa is the x-coordinate of the master device; ya is the y-coordinate of the master device; za is the z-coordinate of the master device; xb is the x-coordinate of the slave device; yb is the y-coordinate of the slave device; zb is the z-coordinate of the slave device; xc is the x-coordinate of the first RTT sniffer; yc is the y-coordinate of the first RTT sniffer; zc is the z-coordinate of the first RTT sniffer; xd is the x-coordinate of the second RTT sniffer; yd is the y-coordinate of the second RTT sniffer; zd is the z-coordinate of the second RTT sniffer; xe is the x-coordinate of the third RTT sniffer; ye is the y-coordinate of the third RTT sniffer; ze is the z-coordinate of the third RTT sniffer. The x, y, z-coordinates of the master and slave devices are known, and the x, y, z-coordinates of the slave device are determined. As described above, TBC, TBD, and TBE can be determined in a similar manner.

[0371] TAB+TBC-TAC=TRxBC-TRxAC=deltaRxAtC (12)

[0372] TAB+TBD-TAD=TRxBD-TRxAD=deltaRxAtD (13)

[0373] TAB+TBE-TAE=TRxBE-TRxAE=deltaRxAtE (14)

[0374] TBC=deltaRxAtC+TAC-TAB (15)

[0375] TBD=deltaRxAtD+TAD-TAB (16)

[0376] TBE=deltaRxAtE+TAE-TAB (17)

[0377] Equations 18-21 are the trilateration equations.

[0378] (xb-xa) 2 +(yb-ya) 2 +(zb-za) 2 =TAB 2 (18)

[0379] (xb-xc) 2 +(yb-yc) 2 +(zb-zc) 2 =TBC 2 (19)

[0380] (xb-xd) 2 +(yb-yd) 2 +(zb-zd) 2 =TBD 2 (20)

[0381] (xb-xe) 2 +(yb-ye) 2 +(zb-ze) 2 =TBE 2 (twenty one)

[0382] By substituting the four variables into the four equations, we obtain equations 22-25.

[0383] (xb-xa) 2 +(yb-ya) 2 +(zb-za) 2 =TAB 2 (twenty two)

[0384] (xb-xc) 2 +(yb-yc) 2 +(zb-zc) 2 =(deltaRxAtC+TAC-TAB) 2 (twenty three)

[0385] (xb-xd) 2 +(yb-yd) 2 +(zb-zd) 2 =(deltaRxAtD+TAD-TAB) 2 (twenty four)

[0386] (xb-xe) 2 +(yb-ye)2 +(zb-ze) 2 =(deltaRxAtD+TAD-TAB) 2 (25)

[0387] When three RTT sniffers are used (e.g., RTT sniffer 5706 shown), three circles can be used to perform trilateral measurement to measure distance and determine the position of the slave device relative to one of the RTT devices 5702, 5704 and / or the corresponding vehicle. This can be performed at the master device and / or at one or more RTT sniffers. Information determined at the master device and the RTT sniffer can be shared with each other. Time, distance and / or location can be determined and therefore updated periodically.

[0388] In a vehicle, if there is an object (e.g., a head of a vehicle occupant) near and / or between the antenna module of the master device and one or more RTT sniffers such that the object interferes with the signal sent by the master device, the round trip timing measurement can be updated periodically. This can be done to measure the distance between the master device and the RTT sniffer to detect when the corresponding physical environment / system has changed.

[0389] Fig.52 A first network device (or vehicle) 5800 and a second network device (or portable network device) 5802 are shown. The first network device 5800 includes a tone exchange responder 5804 and a tone exchange initiator 5806. Tone exchange is also known as unmodulated carrier tone exchange. The second network device 5802 includes a tone exchange initiator 5808 and a tone exchange responder 5810. Devices 5804, 5806, 5808, 5810 may be implemented as any of the other BLE radios, RF circuits, initiators, responders, etc. disclosed herein. At least one of devices 5804, 5808 and at least one of devices 5806, 5808 may include or be connected to a single polarization antenna and a circular polarization antenna. Devices 5804, 5806, 5808, 5810 may include Figure 2 The antenna module 40 and / or the antenna shown in FIG. 11 .

[0390] Tone exchange can be performed between responder 5804 and initiator 5808 and between initiator 5806 and responder 5810. RTT measurement can be sent in the same packet as the exchange tone. Devices 5804, 5806, 5808, 5810 can randomly select a channel for the transmission of packets. The transmission of packets can occur simultaneously with the reception of packets. For example, initiator 5808 can send a tone to responder 5804 on a first channel, and initiator 5808 receives a tone from responder 5804 on a second channel. Initiator 5806 can send and / or receive a tone while initiator 5804 is sending and / or receiving a tone.

[0391] The network devices 5800 and 5802 can be synchronized in advance, for example, by serial signal exchange (or handshake) to synchronize the clocks of the network devices 5800 and 5802. The synchronization can be performed to allow the network devices to send signals to each other at the same time. For example, two 1MHz signals that send data can be sent at 1Mbps. The signals can be 2MHz apart from each other. This prevents the attack device from being able to perform attacks, such as extended range attacks or attacks that include active manipulation of tones. If the attacker uses a 1MHz wide bandpass filter, the bandpass filter will have a large amount of lag time, so the response speed is not fast enough to attack. If the attacker uses a wideband bandpass filter (such as a 4Mhz bandpass filter), the corresponding signal eye diagram will have too much noise and the signal sent by the network devices 5800 and 5802 cannot be distinguished. As another example, a signal can be sent from a network device at a symbol transmission rate less than or equal to a predetermined amount of time (e.g., 1ps per symbol). This provides fast transmission, thereby preventing attacks. In addition, the simultaneous transmission of dual signals further prevents the attacker from being successful because the attacker will need to detect and affect both signals. As mentioned above, both signals may be sent by the same network device or by different network devices at different frequencies.

[0392] Devices 5804, 5806, 5808, 5810 can change the frequency of the transmitted tone, monitor the phase change caused by the change in frequency, and determine the distance between network devices 5800, 5802 based on the change in phase. This can be referred to as carrier phase-based ranging. Alternatively, if a signal is transmitted and received as a result of the signal being reflected back to the source, the phase difference between the transmitted signal and the received signal can be used to determine the modulus of the distance between the source and the reflector. Similarly, the initiator can determine the modulus of the distance between the initiator and the responder based on the phase difference between: (i) the signal sent from the initiator to the responder and (ii) the corresponding signal sent back from the responder to the initiator. The phase difference slope for the frequency change corresponds to or is equal to the distance with a frequency step limit. The smaller the frequency step, the greater the analog-to-digital conversion distance (see Olafsdotter, Ranganathan and Capkun, "On the Security of Carrier Phase-based Ranging, which is incorporated herein by reference).

[0393] As another example, a received signal strength indicator (RSSI) parameter may be monitored to determine if a network device is close to a vehicle, and then a series of tone exchanges may be performed to measure the distance. Based on a user's door handle touch, tone exchanges may be performed to ensure there is no attack. Multiple round trip timing measurements may be performed to determine the distance of the network device relative to the vehicle.

[0394] The above distance determination techniques may be used in conjunction with other techniques disclosed herein for determining RTT values.The direction of travel of tones between devices 5804, 5806, 5808, 5810 may be random.

[0395] In one embodiment, for each of the multiple tones that are exchanged to generate multiple linear curves, the control module of the first network device 5800 plots a graph of phase change versus frequency change. The control module determines the slope of the curve, which provides a ratio of phase change to frequency change. The slope is then used to determine the distance between adjacent curves, which is related to the distance between the first network device 5800 and the second network device 5802.

[0396] Fig.53 5900 includes a tone exchange initiator 5902, a tone exchange responder 5904, and a tone exchange sniffer 5906. The tone exchange initiator 5902 and the tone exchange responder 5904 can be used as any of the initiators, responders, BLE radios, and RF circuits disclosed herein. The tone exchange sniffer 5906 can be used with Fig.50The RTT sniffer 5606 performs similarly and may be located at the vehicle along with one of the tone exchange devices 5902, 5904, and includes Figure 2 The tone exchange device in the vehicle includes one of the antenna modules 40, and the tone exchange device in the vehicle includes another of the antenna modules 40. Devices 5902, 5904, 5906 may each include a control module as described above to perform any of the above operations. Polarization diversity is provided: between the antennas of the tone exchange devices 5902, 5904; and between the antenna of one of the tone exchange devices 5902, 5904 located in the vehicle and the tone exchange sniffer 5906. Polarization diversity is particularly used when performing round trip timing measurements.

[0397] One of the tone exchange devices 5902, 5904 located in the vehicle may be referred to as a master device, and the other of the tone exchange devices 5902, 5904 may be referred to as a slave device. When the master device sends tones to the slave device and when the slave device sends tones to the master device, the tone exchange device 5906 acts as a listener and detects (i) when a tone is sent to the tone exchange device 5906 and / or when a tone is received at the tone exchange device 5906, (ii) when a slave device sends a tone to the master device, and / or (iii) when the tone exchange device 5906 receives a tone sent by the slave device. The slave device may act as a reflector and send the tone received from the master device back to the master device. The master device and / or the sniffer device may block at least one of access or operational control of the vehicle based on the arrival time of the tone, the round trip timing measurement, and / or the estimated distance between the devices.

[0398] Fig.54 Methods for determining the distance between an initiator and a responder and between a responder and a sniffer are shown. Although mainly concerned with Fig.50 and Fig.53 The implementation describes Fig.54 The following operations, but these operations can be easily modified to apply to other implementations of the present disclosure, such as Figure 2-Figure 6 Figure 11 Fig.14 , Fig.39 and Figures 46-49 These operations can be performed iteratively. Although mainly relative to Fig.53 The method is described in detail with reference to an embodiment of the present invention, but the method can be applied to other embodiments of the present disclosure.

[0399] The method may begin at 6000. At 6002, tone exchange initiator 5902 sends a tone signal including tones to tone exchange responder 5904. The tones may be represented as: Where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, τAB is the time to travel from A to B and is directly related to the distance between the Tone Swap Initiator 5902 and the Tone Swap Responder 5904, ω is the frequency, is the phase of the tone at the tone swap initiator 5902 and t is time.

[0400] At 6004, at the tone exchange responder 5904, the delay The tone is received and at the tone exchange sniffer 5906 with a delay Receive Tone. At the audio exchange responder 5904, the received tone signal is down-converted to baseband, which can be expressed as Equation 26.

[0401]

[0402] At the audio exchange sniffer 5906, the received tone signal is down-converted to baseband, which can be expressed by Equation 27.

[0403]

[0404] At 6006, the tone exchange initiator 5902 receives a tone from the tone exchange responder 5904, which retransmits the tone signal as a second tone signal back to the tone exchange initiator 5902. The tone may be represented as The received second tone signal may be represented by Equation 28. The tone swap sniffer 5906 also receives a second tone signal, which may be represented by Equation 29.

[0405]

[0406] At 6008, the tone swap initiator 5902 receives a phase signal from the tone swap responder 5904, the phase signal indicating the natural logarithm of the tone value having the tone phase difference when received at the tone swap responder 5904. Accordingly, the tone swap responder 5904 sends the measured phase to the tone swap initiator 5902, where the values ​​are multiplied as shown in Equation 30.

[0407]

[0408] At 6010, based on the received tone signal, the tone exchange sniffer 5906 determines a tone value associated with: a tone phase difference between when sent from the tone exchange initiator and when received at the tone exchange sniffer; and a tone phase difference between when sent from the tone exchange responder and when received at the tone exchange sniffer. The tone value may be represented as and

[0409] At 6012, the initiator 5902 and / or the sniffer 5906 determine the distance between the initiator 5902 and the responder 5904 and between the initiator 5902 and the sniffer 5906. The distance values ​​may be determined in a manner similar to that described above when sniffing the round trip time, see, for example, equations 12 and 15 and their corresponding descriptions. Phase is used instead of round trip time. This calculation may include using equation 31, where the tone value is measured or determined at the sniffer 5906 and is a priori and the pitch value is determined at responder 5904

[0410]

[0411] The initiator 5902 and / or the sniffer 5906 may take the antilogarithm of the result of Equation 31 to provide the time τ BC and τ AB The distance between the responder 5904 and the sniffer 5906 and between the initiator 5902 and the responder 5904 may be determined based on the known transmission rate of these time and tone signals. The method may end at 6014. The initiator 5902 or the sniffer 5906 may at least one of prevent access to or operational control of the vehicle based on the estimated at least one distance.

[0412] Fig.55 An example of a passive tone exchange and phase difference detection system 6100 is shown. The system 6100 includes a phase locked loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and an antenna module 6110. The antenna module 6110 may be similar to Figure 2 The antenna module 40 of the embodiment of the present invention. The transmitter 6106 transmits a first tone, which may be the output of the PLL 6102 and is reflected by the reflector 6112 back to the receiver 6108. The output of the PLL and the reflected tone signal are provided to the phase module 6104. The phase module 6104 determines the phase difference between the output of the PLL and the reflected tone signal. The phase module 6104 or other modules disclosed herein determine the distance between the transmitter 6106 and the reflector 6112 based on the phase difference. The phase module 6104 or other modules disclosed herein may block access to the interior of the vehicle and / or operational control of the vehicle based on the determined distance.

[0413] Fig.56 An example of an active tone exchange and phase difference detection system 6200 is shown. The system 6200 is Fig.55The system 6100 of FIG. 6101 operates similarly. The transmitter and receiver 6106, 6108 are represented by block 6202. A responder device 6204 for active tone exchange may be utilized instead. Fig.55 The responder device 6204 may receive a first tone signal having a first one or more tones from the transmitter 6106 and respond with a second tone signal. The second tone signal may include the one or more tones and / or one or more other tones. The second tone signal is sent back to the receiver 6108.

[0414] Fig.57 An initiator packet 6300 and a response packet 6302 for RSSI and time of flight measurements are shown. The initiator packet 6300 may include multiple fields, such as a preamble, a synchronization access word (e.g., a pseudo-random synchronization access word), a data field including data, a cyclic redundancy check (CRC) field including CRC bits, and a continuous wave (CW) tone field including a CW tone. The response packet 6302 may include a CW tone field, a preamble, a synchronization access word, a data field, and a CRC field.

[0415] The initiator device may send an initiator packet 6300, which may be received at the responder device. The responder device may then generate a response packet 6302 and send the response packet back to the initiator device. This may be done for tone exchange, phase difference determination, round trip timing measurement. The distance between the devices may then be determined. These measurements and calculations may be performed to detect a range extender relay attack. In an embodiment, the initiator and responder pre-negotiate what the synchronization access word will be based on a predetermined list. The synchronization access word includes an access address. The initiator may, for example, measure the amount of time to receive (i) a response packet and / or (ii) a synchronization access word after sending the initiator packet. The amount of time and the synchronization access word may be compared to a predetermined amount of time and a predetermined synchronization access word. If the comparison performed produces a match, then a range extender relay attack has not occurred. However, if the received synchronization access word does not match and / or the difference between the amount of time and the expected amount of time is greater than a predetermined amount, then a range extender relay attack may have occurred.

[0416] In an embodiment, the initiator and responder exchange a predetermined key, a list of synchronization access words, and the time at which each synchronization access word will be sent. The synchronization access words may be randomly selected when initially created. This allows the responder to know the correct key and / or synchronization access word to respond when the initiator packet is received. The key may be included in the response packet. In another embodiment, the initiator packet and the response packet do not include a preamble, such as Fig.58 In an embodiment, the length of the CW tone is 4-10 μs.

[0417] In another embodiment, the initiator packet and the response packet have Fig.59 Each packet includes: a first CW tone as the first field; and a synchronization access word; a data field; a CRC field; and a second CW tone as the last field. Another example of an initiator packet and a response packet having the same format is shown in Fig.60 , where each packet includes: a first CW tone as the first field; and a synchronization word including PACRMBI; a PDU field including PDU; a media access controller (MAC) field; a CRC field; and a second CW tone as the last field. Figure 57-Figure 60 The CW tone may be a cryptographically random length tone and may be checked by the initiator when received. For example, when the CW tone received from the responder is incorrect, a range extender-type repeater attack may have occurred. Figures 59-60 In an embodiment, the sync word round trip timing prevents the CW tone exchange from exceeding the ambiguity range (e.g., 75 meters) with a 2 MHz channel tone step. The initiator packets and responder packets mentioned above can be sent at the same frequency. By making the initiator packets and responder packets have the same format, the attacking device cannot distinguish which packet is the initiator packet and which packet is the responder packet. In one embodiment, the CW tone at the end of the packet is not included.

[0418] In an embodiment, the timing, frequency, length, power level, amplitude and content of the CW tone and synchronization access word of the initiator packet and the responder packet are checked at the initiator and responder to determine whether they are correct and / or consistent, and to identify whether an attack has occurred. In an embodiment, the packets of pseudo-random numbers are exchanged at a first frequency before changing to the next frequency and exchanging packets of another pseudo-random number.

[0419] Since the attack device typically includes filters (e.g., low-pass filters and band-pass filters) and mixers (e.g., down-converters and up-converters), the attack device causes delays when relaying signals. In order for the attack device's attack to go undetected, the attack device needs to resend the received signal without detectable delays. This makes the attack device difficult to detect. The attack device can delay the signal by 500ns, which can delay the signal by 500 feet (ft) in space. In order for the attack device to send a tone in advance or start sending a tone at the right time, the attack device may need to know what is being sent in advance. This is impossible. This is especially true when a heterodyne receiver is used to receive the relayed signal. The heterodyne receiver converts the packet / audio into the in-phase (I)-quadrature phase (Q) domain and captures it in the IQ domain. In the IQ domain, the phase difference is detected. If there is an attack, the delay caused by the attack can be detected in the IQ domain based on the phase difference. If the attacking device shortens the tone so that the corresponding sync access word arrives at the correct time, the timing and length of the CW tone will be incorrect and will be detected by the initiator.

[0420] In an embodiment, the initiator checks the received CW tone sent from the responder for: (i) length relative to the start of the sent sync access word, (ii) consistent power (or amplitude) before the sync access and relative to the sync access word, and (iii) consistent tone throughout the sync access word. A consistent tone may refer to a consistent frequency, power level, amplitude, etc. In another embodiment, the start and end times of the sync access word relative to the start of the first CW tone of the sent packet may be known within a predetermined amount of time (e.g., a ±10ns range). Thus, if the start time and end time are within a predetermined range of the start of the first CW tone of the packet, then an attack has not occurred, otherwise an attack may have occurred.

[0421] As another example, the PLL of the initiator sending the tone may have 3 different tones that the PLL can generate on a given channel: a center tone, a high tone at a first frequency (e.g., 250KHz), and a low tone at a second predetermined frequency (e.g., -250KHz). The transmitted tones may be selected and sent according to a predetermined agreed upon random sequence and / or tone pattern. This may be agreed upon between the initiator and the responder. The PLLs of the initiator and the attacking device may not be consistent with each other. If there is a frequency difference greater than a predetermined threshold between the signal sent by the initiator and the signal received in response thereto, the initiator may determine that an attack has occurred.

[0422] In an embodiment, the responder can measure and respond with data with the phase delay detected by the responder for the received signal. This can be based on when the responder receives the end CW tone of the packet from the initiator. The responder can measure the phase delay between (i) the end (or end) CW tone of the packet received from the initiator and (ii) the front end (or first main CW tone) of the packet sent by the responder in response to the packet received from the initiator. The initiator can calculate the total two-way round trip time of the packet from the initiator to the responder and then from the responder back to the initiator.

[0423] In addition to detecting delays in the signal, the initiator may also detect when the attacking device amplifies the signal (or tone). Amplification of the signal / tone may also delay transmission, which may be detected. During the relaying of the tone at the attacking device, the tone may be distorted, and / or another tone may be sent instead of the originally sent tone.

[0424] The above example allows for more accurate distance measurements with a smaller number of packets, each with a sync access word and a CW tone. The sync access word protects the CW tone (and vice versa), preventing an attacking device from modifying the CW tone without detection. A bidirectional randomized communication is performed that protects both the sync access word and the CW tone.

[0425] The PLL of the initiator as disclosed herein may be a phase predictable PLL that allows the initiator to predict the phase of a signal when the frequency of the signal is changed. This may eliminate the need to check whether the timing of the CW tone sent by the initiator and the CW tone sent by the responder is correct. The responder may measure, for example, when the end CW tone from the initiator is received, determine the corresponding phase delay of the end CW tone relative to the front CW tone generated by the responder for the response signal, and send this information to the initiator along with the front CW tone. The initiator may then calculate the total round trip time based on the received information.

[0426] In an embodiment, the initiator is one of a vehicle or a portable access device, and the responder is the other of the vehicle and the portable access device. The order in which the vehicle and the portable access device transmit and respond is changed pseudo-randomly. In addition, packets and / or tone signals can be sent as responses and then can be used as initiator packets and / or initiator tone signals. In one embodiment, the order in which the vehicle and the portable access device transmit and respond does not change in a short time period (e.g., the exchange period is less than a predetermined time period) and changes in a long exchange period (e.g., the exchange period is greater than or equal to a predetermined time period). The order can be switched periodically. In these examples, bidirectional data is exchanged using antenna polarization diversity to provide correct timing measurements.

[0427] Processing is implemented to provide accurate measurement of the start and end points of CW tones and synchronous access words. The correlation and protocol module 3920 can maintain a circular queue of bits and lock to compare the start and end time and length of the CW tones and synchronous access words of the transmitted (initiator) packet with the start and end time and length of the CW tones and synchronous access words of the received (responder) packet. The correlation and protocol module 3920 can interpolate at the location of the zero crossing. Post-processing of the I data and Q data associated with the synchronous access word can be performed so that clock recovery is performed when the synchronous access word arrives for interpolation. I and Q data may have different conversion / spin rates. Interpolation can be performed to determine where the center point of the conversion will obtain accurate timing for clock recovery. In order to dial in timing, multiple zero crossings can be detected and aligned. In addition, I and Q data can be oversampled, as further described below, to best fit / align one or more bits.

[0428] Fig.61 An antenna path determination system 6700 for a network device having corresponding antenna modules is shown. The antenna modules exhibit polarization diversity. In this example, two polarization axes of each antenna module are shown. Each antenna module includes a vertically oriented antenna and a horizontally oriented antenna. Possible channel vectors h are shown. VV 、h VH 、h HV and h HH The ranging module 6710 is shown. The ranging module 6710 is based on the channel vector h VV 、h VH 、h HV and h HH The ranging module may execute a ranging algorithm to determine the range (or distance) between corresponding antennas of the network device. and The determined range and is provided to the minimum module 6712, which determines the range and Which range is the shortest? You can choose the shortest path.

[0429] Each channel vector may be generated for one or more selected frequencies. When compared, ranges of channel vectors may be generated for the same frequency or for different frequencies. As an example, vectors may be generated for at least some of the 80 different tones having a frequency step of 1 MHz between adjacent tones and within the 2.4 GHz Industrial, Scientific, and Medical (ISM) band. The frequency associated with the shortest range may be selected. Other factors such as signal strength, amplitude, voltage, parameter consistency, etc. may also be considered when making this selection. This path selection may be performed by any of the initiators, responders, modules, network devices, etc. disclosed herein and used for round trip timing measurements. This allows selection of the best antenna path for bidirectional packet and / or tone signal exchange to determine the round trip time.

[0430] Now refer to Fig.38 and Fig.62 , which shows that Fig.38 The structure, functionality, and operation of the BLE radio 3900 (and / or a modified version of the BLE radio 3900) of the present invention correspond to the example radio model 6800 and RF channel. The radio model 6800 includes a first sampling module 6802, a time offset module 6804, a Gaussian low pass filter 6806, an integrator 6808, a first up sampler 6810, an amplifier 6812, a summer 6814, a modulator 6816, a second sampling module 6818, a phase and frequency offset module 6820, a first mixer 6822, a phase delay device 6823, a second mixer 6824, a phase delay module 6826, a second low pass filter 6828, a resampling module 6830, an inverse tangent module 6832, a differentiator 6834, a sign determination module 6836, a bit pattern module 6838, a second up sampler 6840, a third up sampler 6842, a cross correlation module 6844, and a peak detector 6846. Devices 6802, 6804, 6806, 6808, 6810, 6812 correspond to the transmitter portion of the BLE radio. Adder 6814 represents the channel between the BLE radio and another BLE radio and devices 3907, 3906, 3908, 3932, and 3910. Devices 6816, 6818, 6820, 6822, 6824, 6828, 6830 correspond to the receiver portion of the BLE radio and are associated with the RF sampling rate. Devices 6830, 6832, 6834, 6836, 6838 also correspond to the receiver portion and perform operations on the baseband signal. Devices 6840, 6842, 6844, and 6846 also correspond to the receiver portion and are associated with interpolation to determine the phase.

[0431] Fig.38 and Fig.62 About the equipment Fig.63Although mainly about Figure 2-Figure 6 Figure 11 Fig.14 and Fig.38 The implementation describes Fig.63 The following operations are described below, but these operations can be easily modified to be applied to other implementations of the present disclosure. These operations can be performed iteratively.

[0432] The method may start at 6900. At 6902, a sampling module 6802 of a first network device (eg, a network device implemented in a vehicle as part of an in-vehicle system or a portable access device) receives a bit stream to be sent from a processing module 3922. The sampling module 6802 samples the bit stream.

[0433] At 6904, a time offset module 6804 receives the output of the sampling module 6802 and may introduce a time offset (or delay). The sampling module 6802 and the time offset module 6804 may be implemented by the protocol module 3924. At 6906, a Gaussian low pass filter (LPF) 6806 receives the output of the time offset module 6804. The operation of the Gaussian LPF 6806 may be implemented by the GFSK modulator 3926. At 6908, an integrator 6808 integrates the output of the Gaussian LPF 6806 and may be implemented by the D / A and low pass filter 3928. Fig.64A Example signals 7000, 7002, 7004 from sampling module 6802, Gaussian LPF 6806 and integrator 6808, respectively, are shown in FIG.

[0434] At 6910, an upsampler 6810 upsamples the output of the integrator 6808 to include additional points on a sample-by-sample basis. The upsampler 6810 may be implemented by an upconverter 3930. At 6912, an amplifier 6812 provides a frequency deviation gain. At 6914, a sampling module 6818 receives an RF tone that may be provided by a PLL 3940. The output of the sampling module 6818 is provided simultaneously to a modulator 6816 and a phase and frequency offset module 6820. At 6916, the modulator 6816 modulates the output of the sampling module 6818 based on the output of the amplifier 6812 to provide an initiator signal. The modulator 6816 may be implemented, at least in part, by an upconverter 3930.

[0435] At 6918, the initiator signal from the modulator 6816 may be provided to the power amplifier 3932 and sent to the second network device. The second network device may be a network device implemented in a vehicle as part of an in-vehicle system or a portable access device. The initiator signal may be any of the following disclosed herein: an initiator signal, an initiated tone signal, a signal sent by a master device, etc.

[0436] At 6920, the low noise amplifier 3910 receives a response signal in response to the initiator signal. The response signal may include Gaussian noise, which is included in the received response signal, as represented by the summer 6814. In 6922, mixers 6822, 6824 receive the response signal from the low noise amplifier 3910 and down-convert the response signal into an in-phase (I) baseband signal and a quadrature phase (Q) baseband signal. The quadrature phase baseband signal may be phase delayed by 90° via a phase delay device 6823. This may be implemented at the down converter 3912.

[0437] At 6924, LPF 6828 filters the baseband signal. LPF 6828 may include multiple LPFs; one for each down-converted signal. LPF 6828 may be replaced by and / or implemented by bandpass filter and amplifier 3914. At 6926, resampling module 6830 samples the filtered baseband signal using sampling dithering. Resampling module 6830 may be implemented by A / D converter 3916. Fig.64B Example signals 7006, 7008 from the resampling module 6830 are shown in FIG.

[0438] At 6928, the inverse tangent module 6832 determines the inverse tangent of the baseband signal to generate an inverse tangent signal. Fig.64C An example signal 7010 from the inverse tangent module 6832 is shown in FIG. In 6930, the differentiator 6834 differentiates the inverse tangent signal from the inverse tangent module 6832. Fig.64D An example signal 7012 from the differentiator 6834 is shown above the original Gaussian filtered signal 7002.

[0439] At 6932, the sign module 6836 performs a sign function and determines the sign of the output of the differentiator 6834. At 6934, the bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of the sign module 6836. After the operations of the low pass filter 6828 and the inverse tangent module 6832 have been applied, the idealized bit pattern is obtained to match the bit pattern from the Gaussian LPF 6806 or other bit pattern with the received bit pattern. This is done so that the upsampled values ​​resemble the noise-free resampled data.

[0440] At 6936, upsamplers 6840, 6842 upsample the outputs of differentiator 6834 and bit pattern module 6838, respectively. At 6938, the outputs of upsamplers 6840, 6842 are correlated by cross-correlation module 6844 to generate a correlation signal. Devices 6832, 6834, 6836, 6838, 6844, 6842 may be implemented by demodulator 3918. At 6940, peak detector 6846 determines the phase of the resulting correlation signal from cross-correlation module 6844. Cross-correlation module 6844 and peak detector 6846 may be implemented by correlation and protocol module 3920. In one embodiment, peak detector 6846 is implemented as a 3-point parabolic peak interpolator on top of upsampled cross-correlation module 6844. Two points near the detected peak (within a predetermined distance) are selected, and a three-point parabolic interpolation of the upsampled result is obtained.

[0441] At 6942, distance, location, round trip time, and / or other parameters are determined based on the phase (or 3-point parabola interpolation of the up-sampled result). The distance may be the distance between the first network device and the second network device. The location may be the location of the second network device relative to the first network device. The round trip time may be the time for the initiator signal to travel to the second network device and the first network device to receive the response signal, including the time for the second network device to generate the response signal after receiving the initiator signal.

[0442] At 6944, the processing module 3922 may determine whether an extended-range relay attack has occurred based on the phase, distance, location, round-trip time, and / or other parameters determined at 6942. If an extended-range relay attack has occurred, operation 6946 may be performed, otherwise the method may end at 6948. At 6946, the processing module 3922 executes a countermeasure, such as any of the countermeasures disclosed herein.

[0443] Fig.35 , Fig.36 , Fig.45 , Fig.54 and Fig.63 The above operations are intended as illustrative examples. Depending on the application, these operations may be performed sequentially, synchronously, simultaneously, continuously, during overlapping time periods or in a different order. In addition, depending on the implementation and / or order of events, any operation may not be performed or skipped.

[0444] There is variation in the transmit timing between (i) the time at which the generated waveform arrives at the antenna to be transmitted and (ii) the corresponding time measured by the timer. Factors that may cause this include clock domain crossings, clock cycle variations, power amplifier propagation delays caused by power amplifier gain settings, temperature, and process propagation delays. Process, temperature, and amplifier gain setting variations can be calibrated out of timing measurements.

[0445] With the first BLE device (for example, Fig.38 A second BLE device (e.g., BLE device (or radio) 3900B) similar or identical to the BLE device (or radio) 3900A) may be added and implemented in the vehicle to represent Fig.49 The reflector (or responder) device shown. Each BLE radio 3900 can be implemented on a separate system on a chip (SoC). The first BLE radio 3900A can send an initiator signal that can be received by the receiver portion of the second BLE device.

[0446] A time T1 may be generated for a time when a first bit stream is generated and / or provided to a protocol module 3924A of a first BLE radio 3900A to generate an initiator signal, which is determined by a timer 3938A to be sent from the first BLE radio 3900A. Time T2 may be a time when the correlation and protocol module 3920B of a second BLE radio 3900B receives the first bit stream as determined by the timer 3938B. A first calibration constant CAL1 may be set equal to or determined based on the difference between the time when the timer 3938A detects the generation of the first bit stream and the time when the corresponding initiator signal is sent from the antenna 3907A. A second calibration constant CAL2 may be set equal to or determined based on the difference between the time when the timer 3938B detects the reception of the first bit stream at the correlation and protocol module 3920B. The flight time of the first bit stream from the protocol module 3924A to the correlation and protocol module 3920B is (T2-CAL2)-(T1-CAL1).

[0447] Similarly, for generating a second bit stream corresponding to the first bit stream and / or providing the second bit stream corresponding to the first bit stream to the protocol module 3924B to generate a response signal to be sent from the second BLE radio 3900B as determined by the timer 3938B, a time T3 can be generated. The response signal is generated in response to the initiator signal. Time T4 can be the time when the correlation and protocol module 3920A receives the second bit stream as determined by the timer 3938A. The third calibration constant CAL3 can be set to be equal to the time when the timer 3938B detects the generation of the second bit stream and the time when the corresponding response signal is sent from the antenna 3907B or determined based on the difference. The fourth calibration constant CAL4 can be set to be equal to the timer 3938A detects the difference between the time when the second bit stream is received at the correlation and protocol module 3920A or determined based on the difference. The flight time of the second bit stream from the protocol module 3924B to the correlation and protocol module 3920A is (T4-CAL4)-(T3-CAL3). The average flight time\distance between the first and second BLE radios 3900 may be determined using Equations 33-35, where Equation 33 is based on Equation 32 and takes into account the timing variations described above and therefore includes corresponding calibration values.

[0448] Average flight time = [(T2-T1)+(T4-T3)] / 2 (32)

[0449] Gather similar information and add calibration values:

[0450] Average flight time = [(T2-CAL2-T1+CAL1)+(T4-CAL4-T3+CAL3)] / 2 (33)

[0451] Distance = c*[(T4-CAL4-T1+CAL1)+(T3-CAL3-T2+CAL2)] / 2 (34)

[0452] Separate calibration from time measurement:

[0453] Distance = c*[(T4-T1)-(T3-T2)+(CAL1-CAL4+CAL2-CAL3)] / 2 (35)

[0454] The timer 3938B may be started in conjunction with processing the protocol and / or performing fine tuning of the transmit time at the second BLE radio 3900B to minimize reporting of T2-T3.

[0455] The PLL 3940A, 3942A of the first BLE radio 3900A may be implemented as a single PLL. Similarly, the PLL 3940B, 3942B of the second radio 3900B may be implemented as a single PLL. The two PLLs allow the hardware for the transmit and receive portions to be implemented on the same SoC while allowing the same BLE circuit used to capture the receive time of the response signal to be used to capture the transmit time of the initiator signal.

[0456] According to the present teachings, a method for communicating with a portable access device includes iteratively executing an algorithm via an access module of a vehicle. The algorithm includes a series of operations, including: selecting a frequency from a plurality of frequencies, selecting an antenna pair from a plurality of possible antenna pairs, wherein the antennas in the plurality of possible antenna pairs include antennas with different polarization axes, sending a packet to the portable access device via the selected antenna pair, receiving a first received signal strength indicator (RSSI) and a response signal from the portable access device, wherein the first RSSI corresponds to the transmission of the packet, and measuring a second RSSI of the response signal. The method also includes: selecting a best one of the plurality of frequencies and a best antenna pair of the plurality of possible antenna pairs based on the first RSSI and the second RSSI; and sending one or more additional packets using the selected best frequency and the selected best antenna pair.

[0457] In accordance with the present teachings, each selected antenna pair may include a linearly polarized antenna and a circularly polarized antenna.

[0458] According to the present teachings, the method further includes: sending the one or more additional packets to authorize the portable access device; determining whether the portable access device is authorized to access the interior of the vehicle; and granting access to the interior of the vehicle if the portable access device is authorized.

[0459] According to the present teachings, the method also includes: measuring the flight time of the one or more additional packets, including: the time when the one or more additional packets are sent to the portable access device and the time when one or more responses are received from the portable access device; and estimating the distance between the vehicle and the portable access device based on the measured flight time.

[0460] According to the present teachings, the estimated distance may be used to detect whether another device is attempting to perform a range extender-type relay attack.

[0461] According to the present teachings, the method also includes executing countermeasures including blocking access to the interior of the vehicle if another device is attempting to perform a range extender relay attack.

[0462] According to the present teachings, the countermeasure may include notifying an owner of the vehicle of the range extender relay attack.

[0463] In accordance with the present teachings, the method also includes: exchanging multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, wherein the multiple pairs of unmodulated carrier tones include received tones and transmitted tones; measuring the phase of the received tones relative to the transmitted tones and collecting frequency data; and estimating the distance between the vehicle and the portable access device based on the measured phase and frequency data.

[0464] According to the present teachings, the method also includes determining whether another device is attempting to perform a range extender-type relay attack based on the estimated distance.

[0465] In accordance with the present teachings, each selected antenna pair may include a linearly polarized antenna.

[0466] In accordance with the present teachings, the algorithm may include switching between multiple possible antenna pairs between successively transmitted packets.

[0467] In accordance with the present teachings, the algorithm may include switching between multiple possible antenna pairs during transmission of a portion of a packet.

[0468] According to the present teachings, a portion of a packet may be a continuous wave tone.

[0469] According to the present teachings, a particular plurality of antenna pairs among the plurality of possible antenna pairs may include two antennas that are co-located.

[0470] According to the present teachings, the method also includes: sending multiple packets to a portable access device; measuring flight time values ​​for the multiple packets based on a response signal received from the portable access device, wherein the response signal is sent based on the multiple packets; based on the flight time values, determining whether another device is performing a range extender-type relay station attack; and blocking access to the interior of the vehicle in response to detecting the range extender-type relay station attack.

[0471] According to the present teachings, the portable access device may be a key fob or a cellular telephone.

[0472] According to the present teachings, the method further includes encrypting an identifier of the best antenna pair, wherein the sending of the one or more additional packets includes the encrypted identifier of the best antenna pair.

[0473] According to the present teachings, a vehicle system that communicates with a portable access device includes: multiple antennas with different polarization axes; and an access module configured to iteratively execute an algorithm. The algorithm includes a series of operations, including: selecting a frequency from a plurality of frequencies, selecting an antenna pair from a plurality of antennas with different polarization axes, sending a packet to the portable access device via the selected antenna pair, receiving a first received signal strength indicator (RSSI) and a response signal from the portable access device, wherein the first RSSI corresponds to the transmission of the packet, and measuring a second RSSI of the response signal. The access module can be configured to: select the best frequency among the plurality of frequencies and the best antenna pair among the plurality of antennas based on the first RSSI and the second RSSI; and send one or more additional packets using the selected best frequency and the selected best antenna pair.

[0474] According to the present teachings, the access module can be configured to: measure the flight time of one or more additional packets, including: the time to send the one or more additional packets to the portable access device and the time to receive one or more responses from the portable access device; and estimate the distance between the vehicle and the portable access device based on the measured flight time.

[0475] In accordance with the present teachings, an access module may be configured to: exchange multiple pairs of unmodulated carrier tones with a portable access device at multiple frequencies, wherein the unmodulated carrier tones include received tones and transmitted tones; measure the phase of the received tones relative to the transmitted tones; collect measured phase and frequency data; and estimate the distance between the vehicle and the portable access device using the measured phase and frequency data.

[0476] According to the present teachings, an access module may be configured to detect whether a portable access device is attempting to perform a range extender-type relay attack based on an estimated distance.

[0477] According to the present teachings, an access module may be configured to detect whether a device is attempting to perform a range extender-type relay attack based on an estimated distance.

[0478] According to the present teachings, the access module may be configured to execute countermeasures including blocking access to the interior of the vehicle if the portable access device is attempting to perform a range extender-type relay attack.

[0479] According to the present teachings, the countermeasure may include notifying an owner of the vehicle of the range extender relay attack.

[0480] According to the present teachings, the portable access device may be a key fob or a cellular telephone.

[0481] According to the present teachings, the portable device may be configured to encrypt an identifier of the best antenna pair, and the transmission of the one or more additional packets includes the encrypted identifier of the best antenna pair.

[0482] The above description is illustrative in nature and is not intended to limit the present disclosure, application, or use. The broad teachings of the present invention can be implemented in various different forms. However, the disclosure includes specific examples, and the true scope of the disclosure should not be limited because other variations will become apparent under the study of the drawings, the specification, and the following claims. It should be understood that one or more steps in the method can be performed in different orders (or simultaneously) without changing the principles of the present disclosure. In addition, although each of the embodiments is described as having certain features above, any one or more of the features described with respect to any embodiment of the present disclosure can be implemented in the features of any other embodiment and / or combined with the features of any other embodiment, even if the combination is not explicitly described. In other words, the described embodiments are not mutually exclusive, and the replacement of one or more embodiments with each other is still within the scope of the present disclosure.

[0483] Various terms are used to describe the spatial and functional relationships between elements (e.g., modules, circuit elements, semiconductor layers, etc.), including "connected," "engaged," "coupled," "adjacent," "beside," "on," "above," "below," and "arranged." Unless explicitly described as "direct," when describing the relationship between a first element and a second element in the above disclosure, the relationship may be a direct relationship in which no other intermediate elements exist between the first element and the second element, but may also be an indirect relationship in which one or more intermediate elements exist (spatially or functionally) between the first and second elements. As used herein, the phrase "at least one of A, B, and C" should be used with a non-exclusive logic or be interpreted to mean a logical (A OR B OR C), and should not be interpreted to mean "at least one of A, at least one of B, and at least one of C."

[0484] In the drawings, as indicated by the arrows, the direction of the arrows generally illustrates the flow of information (such as data or instructions) of interest to the illustration. For example, when component A and component B exchange various information, but the information sent from component A to component B is relevant to the illustration, the arrow may point from component A to component B. This unidirectional arrow does not mean that no other information is sent from component B to component A. In addition, for information sent from component A to component B, component B may send a request for or a receipt confirmation of the information to component A.

[0485] In this application, including the following definitions, the term "module" or the term "controller" may be replaced by the term "circuit". The term "module" may refer to, may be part of, or may include: an application-specific integrated circuit (ASIC); a discrete circuit that is digital, analog, or mixed analog / digital; an integrated circuit that is digital, analog, or mixed analog / digital; a field-programmable gate array (FPGA); a processor circuit (public, dedicated, or grouped) that executes code; a memory circuit (public, dedicated, or grouped) that stores code executed by the processor circuit; other suitable hardware that provides the described functionality; or a combination of some or all of the above, such as a system on a chip.

[0486] The module may include one or more interface circuits. In some examples, the interface circuit may include a wired or wireless interface that is connected to a local area network (LAN), the Internet, a wide area network (WAN), or a combination thereof. The functionality of any given module of the present disclosure may be distributed between multiple modules connected via interface circuits. For example, multiple circuits may allow load balancing. In a further example, a server (also known as a remote or cloud) module may perform partial functionality on behalf of a client module.

[0487] The term "code" used above may include software, firmware and / or microcode, and may be a program, routine, function, class, data structure and / or object. The term "shared processor circuit" covers a single processor circuit that executes some or all code from multiple modules. The term "grouped processor circuit" covers a processor circuit that executes some or all code from one or more modules in combination with additional processor circuits. References to multiple processor circuits cover multiple processor circuits on discrete dies, multiple processor circuits on a single die, multiple cores of a single processor circuit, multiple threads of a single processor circuit, or a combination of the above. The term "shared memory circuit" covers a single memory circuit that stores some or all code from multiple modules. The term "grouped memory circuit" covers a memory circuit that stores some or all code from one or more modules in combination with additional memory.

[0488] The term "memory circuit" is a subset of the term "computer-readable medium". The term "computer-readable medium" herein does not cover transient electrical or electromagnetic signals propagated through a medium (such as, on a carrier wave); the term "computer-readable medium" may thus be considered to be tangible and non-transitory. Non-limiting examples of non-transitory tangible computer-readable media are non-volatile memory circuits (such as flash memory circuits, erasable programmable read-only memory circuits, or mask read-only memory circuits), volatile memory circuits (such as static random access memory circuits or dynamic random access memory circuits), magnetic storage media (such as analog or digital magnetic tape or hard disk drives), and optical storage media (such as CDs, DVDs, or Blu-ray discs).

[0489] The apparatus and methods described in this application may be implemented in part or in whole by a special purpose computer, which is created by configuring a general purpose computer to perform specific functions contained in a computer program. The functional blocks, flow chart components and other elements described above serve as software specifications that can be translated into a computer program by routine work of a technician or programmer.

[0490] A computer program includes processor executable instructions stored on at least one non-transitory tangible computer readable medium. A computer program may also include or rely on stored data. A computer program may include a basic input / output system (BIOS) that interacts with the hardware of a special-purpose computer, device drivers that interact with specific devices of a special-purpose computer, one or more operating systems, user applications, background services, background applications, etc.

[0491] A computer program may include: 1. a descriptive text to be parsed, such as HTML (Hypertext Markup Language), XML (Extensible Markup Language), or JSON (JavaScript Object Notation); (ii) assembly code; (iii) target code generated by a compiler from a source code; (iv) source code executed by an interpreter; (v) source code for compilation and execution by a just-in-time compiler, etc. By way of example only, source code may be written using syntax from the following languages: C, C++, C#, Objective-C, Swift, Haskell, Go, SQL, R, Lisp, Fortran, Perl, Pascal, Curl, OCaml, HTML5 (Hypertext Markup Language Version 5), Ada, ASP (Active Server Pages), PHP (PHP: Hypertext Preprocessor), Scala, Eiffel, Smalltalk, Erlang, Ruby, Lua, MATLAB, SIMULINK, and All elements recited in the claims are not intended to be means-plus-function elements within the meaning of 35 U.S.C. §112(f) unless an element is expressly recited using the phrase “means for” or, in the case of a method claim, an element is expressly recited using the phrase “operation of” or “step of”.

Claims

1. A method of communicating with a portable access device, the method comprising: An algorithm is iteratively executed via an access module of the vehicle, wherein the algorithm comprises a series of operations comprising: Select a frequency from multiple frequencies, selecting an antenna pair from a plurality of possible antenna pairs, wherein the antennas in the plurality of possible antenna pairs include antennas having different polarization axes, transmitting a packet to the portable access device via the selected pair of antennas, receiving a first received signal strength indicator RSSI and a response signal from said portable access device, wherein said first RSSI corresponds to said transmission of said packet, and Measuring a second RSSI of the response signal; Based on the first RSSI and the second RSSI, selecting (i) a best antenna pair among the plurality of possible antenna pairs having a highest RSSI value among the first RSSI and the second RSSI, and (ii) a frequency among the plurality of frequencies to provide a selected frequency and antenna pair combination; and One or more additional packets are sent using the selected frequency and antenna pair combination.

2. The method of claim 1, wherein each selected antenna pair comprises a linearly polarized antenna and a circularly polarized antenna.

3. The method according to claim 1, further comprising: sending the one or more additional packets to authorize the portable access device; determining whether the portable access device is authorized to access the interior of the vehicle; as well as If the portable access device is authorized, access to the interior of the vehicle is granted.

4. The method according to claim 3, further comprising: measuring a flight time of the one or more additional packets, the flight time comprising: a time to send the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device; and Based on the measured flight time, a distance between the vehicle and the portable access device is estimated. The method of claim 4 , wherein the estimated distance is used to detect whether another device is attempting to perform a range extender-type relay attack.

6. The method according to claim 5, further comprising: If the other device is attempting to perform a range extender relay attack, countermeasures are performed, the countermeasures including blocking access to the interior of the vehicle.

7. The method of claim 6, wherein the countermeasure comprises: An owner of the vehicle is notified of the range extender relay attack.

8. The method according to claim 3, further comprising: exchanging a plurality of unmodulated carrier tone pairs with the portable access device at a plurality of frequencies, wherein the unmodulated carrier tone pairs include received tones and transmitted tones; measuring the phase of the received tone relative to the transmitted tone and collecting frequency data; as well as Based on the measured phase and frequency data, a distance between the vehicle and the portable access device is estimated.

9. The method according to claim 8, further comprising: A determination is made based on the estimated distance whether another device is attempting to perform a range extender-type relay attack.

10. The method of any one of claims 1 to 9, wherein each selected pair of antennas comprises a linearly polarized antenna.

11. The method according to any one of claims 1 to 9, wherein the algorithm comprises: Between successively transmitted packets, switching is performed between the plurality of possible antenna pairs.

12. The method according to any one of claims 1 to 9, wherein the algorithm comprises: During transmission of a portion of a packet, switching is performed between the plurality of possible antenna pairs.

13. The method of claim 12, wherein the portion of the packet is a continuous wave tone.

14. The method of claim 12, wherein some of the plurality of possible antenna pairs include two antennas that are collocated.

15. The method according to any one of claims 1 to 9, further comprising: sending a plurality of packets to the portable access device; measuring time-of-flight values ​​for the plurality of packets based on a response signal received from the portable access device, wherein the response signal is transmitted based on the plurality of packets; determining, based on the flight time value, whether another device is performing a range extender-type relay attack; as well as In response to detecting the range-extender relay attack, access to an interior of the vehicle is blocked.

16. The method of claim 15, wherein the portable access device is a key fob or a cellular telephone.

17. The method according to any one of claims 1 to 9, further comprising: encrypting an identifier of the best antenna pair, wherein said sending of said one or more additional packets includes said encrypted said identifier of said best antenna pair.

18. A vehicle system for a vehicle for communicating with a portable access device, the vehicle system comprising: Multiple antennas with different polarization axes; as well as An access module is configured to iteratively execute an algorithm, wherein the algorithm includes a series of operations, and the series of operations includes: Select a frequency from multiple frequencies, selecting an antenna pair from the plurality of antennas having different polarization axes, transmitting a packet to the portable access device via the selected pair of antennas, receiving a first received signal strength indicator RSSI and a response signal from said portable access device, wherein said first RSSI corresponds to said transmission of said packet, and measuring a second RSSI of the response signal, The access module is configured as follows: Based on the first RSSI and the second RSSI, selecting (i) a best antenna pair among the plurality of antennas having a highest RSSI value among the first RSSI and the second RSSI, and (ii) one of the plurality of frequencies to provide a selected frequency and antenna pair combination; as well as One or more additional packets are sent using the selected frequency and antenna pair combination.

19. The vehicle system of claim 18, wherein the access module is configured to: measuring a flight time of the one or more additional packets, the flight time comprising: a time to send the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device; as well as Based on the measured flight time, a distance between the vehicle and the portable access device is estimated.

20. The vehicle system of claim 18, wherein the access module is configured to: exchanging a plurality of pairs of unmodulated carrier tones with the portable access device at a plurality of frequencies, wherein the unmodulated carrier tones include received tones and transmitted tones; measuring the phase of the received tone relative to the transmitted tone; collecting said measured phase and frequency data; as well as Using the measured phase and frequency data, a distance between the vehicle and the portable access device is estimated.

21. The vehicle system of claim 20, wherein the access module is configured to detect whether the portable access device is attempting to perform a range extender-type relay attack based on the estimated distance.

22. The vehicle system of any one of claims 19 to 21, wherein the access module is configured to detect whether a device is attempting to perform a range extender relay attack based on the estimated distance.

23. The vehicle system of any one of claims 19 to 21, wherein the access module is configured to execute countermeasures if the portable access device is attempting to perform a range extender relay attack, the countermeasures comprising blocking access to an interior of the vehicle.

24. The vehicle system of claim 23, wherein the countermeasure comprises: An owner of the vehicle is notified of the range extender relay attack.

25. The vehicle system of any one of claims 18 to 21, wherein the portable access device is a key fob or a cellular telephone.

26. The vehicle system of claim 25, wherein: The portable access device is configured to encrypt an identifier of the optimal antenna pair; and The sending of the one or more additional packets includes the encrypted identifier of the best antenna pair.

Images