Access system and method of operation thereof

Abstract

According to a first aspect of the present disclosure, there is provided an access system for obtaining access to a vehicle, the access system comprising: a communication unit configured to establish a communication channel with an external device and receive at least one credential from the external device through the communication channel; a secure element configured to perform verification of the credential and to grant or deny access to the vehicle depending on a result of the verification of the credential. According to other aspects of the present disclosure, a corresponding method of operating an access system for obtaining access to a vehicle is conceived, as well as a computer program for performing the method.

Description

Technical Field

[0001] The present disclosure relates to an access system for obtaining access to a vehicle. Furthermore, the present disclosure relates to a corresponding method of operating an access system for obtaining access to a vehicle. Background Art

[0002] An access system for a vehicle may authenticate a device used to gain access to the vehicle before the access system grants access (e.g., before the access system unlocks the vehicle). This authentication is typically performed by a secure element, which verifies credentials provided by the device. Another component of the access system, such as a general purpose processor (e.g., a microcontroller), then decides whether to grant access to the vehicle, typically based on the results of the authentication performed by the secure element. Summary of the invention

[0003] According to a first aspect of the present disclosure, there is provided an access system for obtaining access to a vehicle, the access system comprising: a communication unit configured to establish a communication channel with an external device and receive at least one credential from the external device through the communication channel; a security element configured to perform verification of the credential and grant or deny access to the vehicle depending on a result of the verification of the credential.

[0004] In one or more embodiments, the secure element is further configured to send a message to a controller included in the vehicle upon or after a positive verification of the credential, wherein the message contains instructions to unlock the vehicle.

[0005] In one or more embodiments, the message is a Controller Area Network (CAN) message.

[0006] In one or more embodiments, the communication unit is a near field communication (NFC) unit.

[0007] In one or more embodiments, the credential is an application identifier (AID) sent by the external device.

[0008] In one or more embodiments, the communication unit is a Bluetooth Low Energy (BLE) communication unit.

[0009] In one or more embodiments, the access system includes another communication unit configured to perform one or more ultra-wideband (UWB) ranging operations in conjunction with the external device.

[0010] In one or more embodiments, the secure element is further configured to grant or deny access to the vehicle depending on a result of the verification of the credential and depending on a result of the ranging operation performed by the further communication unit.

[0011] In one or more embodiments, the credentials are received in response to a BLE advertising message sent by the BLE communication unit.

[0012] In one or more embodiments, a vehicle includes an access system of the type set forth.

[0013] According to a second aspect of the present disclosure, a method for operating an access system for obtaining access to a vehicle is conceived, the method comprising: a communication unit included in the access system establishing a communication channel with an external device and receiving at least one credential from the external device through the communication channel; a security element included in the access system performing verification of the credential and granting or denying access to the vehicle depending on the result of the verification of the credential.

[0014] In one or more embodiments, the secure element sends a message to a controller included in the vehicle upon or after a positive verification of the credential, wherein the message contains instructions to unlock the vehicle.

[0015] In one or more embodiments, the message is a Controller Area Network (CAN) message.

[0016] According to a third aspect of the present disclosure, there is provided a computer program comprising executable instructions which, when executed by a security element included in an access system for obtaining access to a vehicle, cause the security element to perform verification of credentials received from an external device and to grant or deny access to the vehicle depending on the result of the verification of the credentials. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The embodiments will be described in more detail with reference to the accompanying drawings.

[0018] Figure 1 An illustrative embodiment of an access system is shown.

[0019] Figure 2 An illustrative embodiment of a method of operating an access system is shown.

[0020] Figure 3 An example of accessing the system is shown.

[0021] Figure 4 Another illustrative embodiment of an access system is shown.

[0022] Figure 5 Another example of accessing the system is shown.

[0023] Figure 6 Another illustrative embodiment of an access system is shown.

[0024] Figure 7 An example of a method of operating a vehicle access system is shown.

[0025] Figure 8 An illustrative embodiment of a method of operating a vehicle access system is shown.

[0026] Fig. 9 Another example of a method of operating a vehicle access system is shown.

[0027] Fig.10 Another illustrative embodiment of a method of operating a vehicle access system is shown. DETAILED DESCRIPTION

[0028] In a secure access system, particularly in a system for obtaining access to a vehicle, the decision to grant or deny access is typically made by a general purpose processor (e.g., a microcontroller) that interacts with a secure element. It should be noted that a secure element can be defined as a tamper-resistant integrated circuit with an installed or pre-installed application that has a specified function and a specified security level. In addition, the secure element can implement security functions, such as cryptographic functions and authentication functions. The secure element can verify the credentials provided by the access device. Depending on the result of the verification, the general purpose processor can then decide to grant or deny access to the vehicle. General purpose processors are not as secure as secure elements because secure elements are typically authenticated devices that must meet strict security requirements. However, secure elements are typically added only as dedicated "security companion" devices, acting only as peripherals or client nodes. This opens a backdoor for attackers because the actual decision operation (e.g., opening the door, starting the engine) may still be manipulated in an unsafe operating environment (i.e., a less secure general purpose processor). In addition, due to additional redundant checks, secure elements increase system complexity. More specifically, in a system containing both a secure element and a microcontroller, messages will typically be sent from the microcontroller to the secure element and from the secure element to the microcontroller. On both devices, a redundancy check of the message is typically performed via a cyclic redundancy check (CRC). In addition, a security integrity check or similar mechanism must typically be implemented.

[0029] An access system for gaining access to a vehicle, and a corresponding method of operating an access system for gaining access to a vehicle, are now discussed, the access system and method facilitating increased resistance to attacks on the system.

[0030] Figure 1An illustrative embodiment of an access system 100 is shown. The access system 100 includes a communication unit 102 and a safety element 104 coupled to each other in an operational manner. The communication unit 102 is configured to establish a communication channel with an external device (not shown) and receive at least one credential from the external device through the communication channel. Specifically, the external device can be an access device of the above type. In addition, the safety element 104 is configured to perform verification of the credential and grant or deny access to the vehicle depending on the result of the verification of the credential. Since the safety element 104 performs verification and also decides to grant or deny access to the vehicle, the resistance to attacks on the access system can be increased. In addition, the complexity of the access system can be reduced. It should be noted that, in addition to unlocking the vehicle, granting access to the vehicle may also include granting access to components (e.g., engines or communication systems) embedded in the vehicle or to access to functions performed by one or more components in the vehicle or its components (e.g., connectivity functions or infotainment functions).

[0031] In one or more embodiments, the security element is further configured to send a message to a controller included in the vehicle upon or after positive verification of the credential, wherein the message contains instructions to unlock the vehicle. In this way, the vehicle can be unlocked in an easy but secure manner. In a practical implementation, the message is a controller area network (CAN) message. In this way, the access system can be easily integrated into existing vehicle control systems based on CAN.

[0032] In one or more embodiments, the communication unit is a near field communication (NFC) unit. In this way, an increased level of security can be provided in NFC-based vehicle access systems. In a practical implementation, the credential is an application identifier (AID) sent by the external device.

[0033] In one or more embodiments, the communication unit is a low power Bluetooth (BLE) communication unit. In this way, an increased level of security can be provided in a BLE-based vehicle access system. In one or more embodiments, the access system includes another communication unit, which is configured to perform one or more ultra-wideband (UWB) ranging operations in conjunction with the external device. In this way, in particular, by verifying whether the location of the external device matches the expected location, the level of security can be further increased. In one or more embodiments, the security element is additionally configured to grant or deny access to the vehicle depending on the result of the verification of the credential and depending on the result of the ranging operation performed by the other communication unit. Thus, the level of security can be further increased because the decision to grant or deny access is based on two criteria and is made in a secure environment. In a practical implementation scheme, the credential is received in response to a BLE notification message sent by a BLE communication unit.

[0034] Figure 2 An illustrative embodiment of a method 200 of operating an access system is shown. The method 200 includes the following steps. At 202, a communication unit included in the access system establishes a communication channel with an external device and receives at least one credential from the external device via the communication channel. Furthermore, at 204, a security element included in the access system performs a verification of the credential and grants or denies access to a vehicle depending on the result of the verification of the credential. As mentioned above, since the security element performs the verification and also decides to grant or deny access to the vehicle, resistance to attacks on the access system can be increased. Furthermore, the complexity of the access system can be reduced.

[0035] The currently disclosed access system and corresponding operation method contribute to increasing the security level because the decision to grant or deny access can be made in a secure environment. In addition, the currently disclosed access system and corresponding operation method contribute to reducing system complexity. For example, no additional redundant check may be required. More specifically, compared with a typical system containing both a security element and a microcontroller, less overhead may be required, and only messages within the security environment itself may need to be checked. In addition, in the case where the access system includes multiple so-called anchors, enhanced security protocols between those anchors may not be required. In addition, the complexity of integrated circuits used for communication (e.g., NFC, BLE, UWB) can be reduced because the integrated circuits may require fewer security features. In addition, such integrated circuits with fewer security features may be cheaper. In addition, reduced end-to-end latency can be achieved because data may no longer need to be forwarded from a general processor to a separate security element. Finally, the user experience can be improved due to faster communication and the resulting faster opening of the door and starting of the engine.

[0036] Figure 3 An example of an access system 300 is shown. The access system 300 includes a plurality of anchors 302, 304. The anchor 302 contains an NFC front end 306, a secure element 308, a general purpose microcontroller 310, and a CAN Flexible Data Rate (CAN-FD) system basis chip 312. The anchor 304 may contain the same or similar components as the anchor 302. Specifically, Figure 31 shows a typical NFC-based system for accessing a vehicle as promoted by the Car Connectivity Consortium (CCC). In a typical car access use case, a cell phone (not shown) may be connected via an NFC front end 306 of an external anchor 302 (e.g., placed in a door handle). The NFC front end 306 is connected to a generic microcontroller 310. The external anchor 302 may perform a so-called NFC Low Power Card Detection (LPCD) process. In the event that a device (e.g., a cell phone) is detected by the external anchor 302, the external anchor 302 retrieves an application identifier (AID) through the NFC front end 306. If the AID is a valid AID, the external anchor 302 may be connected to a secure element 308, which may be placed in the external anchor (e.g., Figure 3 ) or is part of different modules. Security element 308 is also connected to general microcontroller 310. In this use case, data exchange is performed between NFC front end 206 and general microcontroller 310 and between general microcontroller 310 and security element 308. If the authentication performed by security element 308 is successful, microcontroller 310 can receive notification from security element 308 and can send out CAN message to unlock the car. In this scenario, the decision to grant or deny access to the car is made in a relatively unsafe environment. Therefore, the attacker will focus on attacking the less safe microcontroller 310 rather than the security element 308, and the attacker will need less resources for attacking.

[0037] Figure 4 Another illustrative embodiment of an access system 400 is shown. The access system 400 includes a plurality of anchors 402, 404. Similar to Figure 3 In the system shown in FIG. 4 , anchor 402 includes NFC front end 306 and CAN-FD system basis chip 312. Figure 3 Compared to the system shown in FIG. 4 , anchor 402 contains an extended security element 406 that includes both general microcontroller functionality as well as security element functionality. Anchor 404 may contain the same or similar components as anchor 402. Specifically, Figure 4An NFC-based system for accessing a vehicle according to the present disclosure is shown. In a use case supported by such a system, a mobile phone (not shown) may be connected via an NFC front end 306 of an external anchor 402 (e.g., placed in a door handle). The NFC front end 306 is connected to an extended secure element 406. The external anchor 402 may perform a so-called NFC low-power card detection (LPCD) process. In the event that a device (e.g., a mobile phone) is detected by the external anchor 402, the external anchor 402 retrieves an application identifier (AID) through the NFC front end 306. If the AID is a valid AID, the external anchor 402 will execute a car access application on the extended secure element 406. In this use case, data is exchanged between the NFC front end 306 and the extended secure element 406. If the authentication performed by the extended secure element 406 is successful, the extended secure element 406 itself may send out a message (e.g., a CAN message) to directly unlock the car. Thus, in this scenario, as with reference Figure 3 The decision to grant or deny access to the car is made in a safer environment than the scenario described in FIG.

[0038] Figure 5 Another example of an access system 500 is shown. The access system 500 includes a plurality of anchors 502, 504. The anchor 502 contains a BLE device 506, a secure element 508, a general purpose microcontroller 510, a CAN-FD system basis chip 512, and a UWB device 514. The anchor 504 may contain the same or similar components as the anchor 502. Specifically, Figure 5A typical BLE / UWB-based system for accessing a vehicle as promoted by the Car Connectivity Consortium (CCC) is shown. In a typical car access use case, a cell phone (not shown) may be connected via a BLE device 506 (e.g., a shark fin antenna) of an external anchor 502. The BLE device 506 is connected to a general purpose microcontroller 510. The external anchor 502 may perform BLE advertising using the BLE device 506. In the event that the external anchor 502 detects a device (e.g., a known cell phone), the external anchor 502 opens a channel to a secure element 508. It should be noted that this channel may be established using a secure element 508 within the anchor 502 or using another secure element (which may be embedded in the anchor 504, for example). Thus, data exchange may be performed, for example, between the BLE device 506 and a general purpose microcontroller 510, between the general purpose microcontroller 510 and another general purpose microcontroller (e.g., of another anchor) via a CAN bus, and between the other general purpose microcontroller and a secure element connected to the other general purpose microcontroller. In the event of successful authentication, the UWB device 514 may be used for positioning of the cell phone. To this end, the secure element may send a ranging key to the UWB device 514. Then, if the estimated location or movement of the phone matches the expected location or movement, another general purpose microcontroller may receive a notification from the secure element and may send out a CAN message to unlock the car. In this scenario, the decision to grant or deny access to the car is made in a relatively unsecure environment.

[0039] Figure 6 Another illustrative embodiment of an access system 600 is shown. The access system 600 includes a plurality of anchors 602, 604. Similar to Figure 5 In the system shown in FIG. 6 , anchor 602 contains BLE device 506, CAN-FD system basis chip 512, and UWB device 514. Figure 5 Compared to the system shown in , anchor 602 contains an extended security element 606 that includes both general microcontroller functions and security element functions. Anchor 604 may contain the same or similar components as anchor 602. Specifically, Figure 6A BLE / UWB based system for accessing a vehicle according to the present disclosure is shown. In a use case supported by this system, a cell phone (not shown) can be connected via a BLE device 506 (e.g., a shark fin antenna) of an external anchor 602. The BLE device 506 is connected to an extended security element 606. The external anchor 602 performs a BLE advertisement using the BLE device 506. In the event that the external anchor 602 detects a device (e.g., a known cell phone), the external anchor 602 performs the transaction. In the event that authentication is successful, the UWB device 515 can be used to locate the cell phone. Then, if the estimated position or movement of the cell phone matches the expected position or movement, the extended security element 606 itself can send out a CAN message to unlock the car. Therefore, in this scenario, as with reference Figure 5 The decision to grant or deny access to the car is made in a safer environment than the scenario described in FIG.

[0040] Figures 7 to 10 An exemplary and illustrative embodiment of a method of operating a vehicle access system is shown. Specifically, Figure 7 Show operation Figure 3 Method 700 of system 300 shown in FIG. Figure 8 Show operation Figure 4 800 of the system 400 shown in FIG. Fig. 9 Show operation Figure 5 900 of the system 500 shown in FIG. Fig.10 Show operation Figure 6 Method 1000 of system 600 shown in FIG.

[0041] exist Figure 7 and Figure 8 In the NFC-based method shown in , an access device (i.e., a key holder device 704) interacts with a vehicle 702, 802 (e.g., a car) in which an access system is embedded. In a typical access system, a general purpose microcontroller decides whether to open the vehicle, such as Figure 7 In contrast, according to the present disclosure, this decision can be made by a security element, such as Figure 8 It should be noted that the technical standard ISO / IEC 14443 defines Figure 7 and Figure 8 The content of the message shown in (REQA, ATQA, AC, etc.).

[0042] exist Fig. 9 and Fig.10 In the BLE / UWB based method shown in , an access device (i.e., a key holder device 904) interacts with a vehicle 902, 1002 (e.g., a car) in which an access system is embedded. In a typical access system, a general purpose microcontroller decides to start ranging, executes a positioning engine, and decides whether to open the vehicle, such as Fig. 9 In contrast, according to the present disclosure, these operations may be performed by a secure element, such as Fig.10 as shown in .

[0043] The systems and methods described herein may be embodied, at least in part, by a computer program or multiple computer programs, which may exist in a single computer system or across multiple computer systems in a variety of forms, both in use and in standby. For example, these computer programs may exist as software programs in source code, object code, executable code, or other formats consisting of program instructions for performing some steps. Any of the above formats may be implemented in compressed or uncompressed form on a computer-readable medium that may include storage devices and signals.

[0044] As used herein, the term "computer" refers to any electronic device that includes a processor, such as a general-purpose central processing unit (CPU), a special-purpose processor, or a microcontroller. A computer is capable of receiving data (input), performing a series of predetermined operations on the data, and generating results (output) in the form of information or signals therefrom. Depending on the context, the term "computer" will refer specifically to a processor or more generally to a processor associated with a collection of related elements contained within a single chassis or housing.

[0045] The term "processor" or "processing unit" refers to a data processing circuit, which may be a microprocessor, a coprocessor, a microcontroller, a microcomputer, a central processing unit, a field programmable gate array (FPGA), a programmable logic circuit, and / or any circuit that manipulates signals (analog or digital) based on operating instructions stored in a memory. The term "memory" refers to a storage circuit or multiple storage circuits, such as a read-only memory, a random access memory, a volatile memory, a non-volatile memory, a static memory, a dynamic memory, a flash memory, a cache memory, and / or any circuit that stores digital information.

[0046] As used herein, "computer-readable medium" or "storage medium" can be any means that can contain, store, communicate, propagate, or transport a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium.

[0047] It should be noted that the above embodiments have been described with reference to different subject matters. Specifically, some embodiments may be described with reference to method-type claims, while other embodiments may be described with reference to apparatus-type claims. However, those skilled in the art should understand from the above that, unless otherwise indicated, any combination of features related to different subject matters (specifically, a combination of features of a method-type claim with features of an apparatus-type claim) in addition to any combination of features belonging to one type of subject matter is also considered to be disclosed with this document.

[0048] In addition, it should be noted that the drawings are schematic. In different figures, similar or identical elements are represented by the same reference numerals. In addition, it should be noted that in order to provide a concise description of the illustrative embodiments, the implementation details that belong to the customary practices of those skilled in the art may not be described. It should be understood that in the development of any such implementation, as in any engineering or design project, a large number of implementation-specific decisions must be made in order to achieve the specific goals of the developer, such as complying with system-related and business-related constraints, which may be different between different implementations. In addition, it should be understood that such development work may be complex and time-consuming, but it is nothing more than a routine task for those skilled in the art to design, manufacture and produce.

[0049] Finally, it should be noted that the skilled person should be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed in parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of other elements or steps than those listed in the claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The measures recited in the claims may be implemented by means of hardware comprising several different elements and / or by means of a suitably programmed processor. In a device claim listing several components, several of these components may be embodied by the same item of hardware. The mere fact that certain measures are recited in different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0050] List of reference numerals:

[0051] 100 Access System

[0052] 102 Communication Unit

[0053] 104 Security Element

[0054] 200 Methods of operating access system

[0055] 202 A communication unit included in the access system establishes a communication channel with an external device and receives at least one credential from the external device through the communication channel.

[0056] 204 A security element included in the access system performs a verification of the credentials and grants or denies access to the vehicle depending on the result of the verification of the credentials.

[0057] 300 Access System

[0058] 302 Anchor

[0059] 304 Anchor

[0060] 306 NFC front end

[0061] 308 Safety Element

[0062] 310 General MCU

[0063] 312 CAN-FD System Basis Chip

[0064] 400 Access System

[0065] 402 Anchor

[0066] 404 Anchor

[0067] 406 Security Element+

[0068] 500 Access System

[0069] 502 Anchor

[0070] 504 Anchor

[0071] 506 BLE Device

[0072] 508 Security Element

[0073] 510 General MCU

[0074] 512 CAN-FD System Basis Chip

[0075] 514 UWB Device

[0076] 600 Access System

[0077] 602 Anchor

[0078] 604 Anchor

[0079] 606 Safety Components+

[0080] 700 Method of operating a vehicle access system

[0081] 702 Vehicles

[0082] 704 Keyholder Device

[0083] 800 Method of operating a vehicle access system

[0084] 802 Vehicles

[0085] 900 Method of operating a vehicle access system

[0086] 902 Vehicles

[0087] 904 Keyholder Device

[0088] 1000 Method of operating a vehicle access system

[0089] 1002 Vehicles

[0090] 1004 Key holder device.

Claims

1. An access system for obtaining access to a vehicle, characterized in that include: a communication unit configured to establish a communication channel with an external device and receive at least one credential from the external device through the communication channel; A secure element is configured to perform a verification of the credentials and to grant or deny access to the vehicle depending on the result of the verification of the credentials.

2. The access system according to claim 1, characterized in that: The secure element is further configured to send a message to a controller included in the vehicle upon or after positive verification of the credential, wherein the message contains instructions to unlock the vehicle.

3. The system according to claim 2, characterized in that The message is a Controller Area Network (CAN) message.

4. An access system according to any of the preceding claims, characterized in that The communication unit is a near field communication NFC unit.

5. An access system according to any of the preceding claims, characterised in that The credential is an application identifier AID sent by the external device.

6. The access system according to any one of claims 1 to 3, characterized in that: The communication unit is a low-power Bluetooth BLE communication unit.

7. The access system according to claim 6, characterized in that: Another communication unit is included, and the other communication unit is configured to perform one or more ultra-wideband (UWB) ranging operations in conjunction with the external device.

8. A vehicle, characterized in that: Comprising an access system according to any preceding claim.

9. A method of operating an access system for obtaining access to a vehicle, characterized in that The method comprises: establishing, by a communication unit included in the access system, a communication channel with an external device and receiving at least one credential from the external device through the communication channel; A verification of the credentials is performed by a secure element included in the access system and access to the vehicle is granted or denied depending on the result of the verification of the credentials.

10. A computer program comprising executable instructions, characterized in that The executable instructions, when executed by a secure element included in an access system for obtaining access to a vehicle, cause the secure element to perform verification of credentials received from an external device and grant or deny access to the vehicle depending on a result of the verification of the credentials.

Images