Pure hardware car-grade key system

Abstract

The application discloses a pure hardware vehicle regulation level key system, all core security logic is realized by pure hardware circuit, without central processing unit, without software, without firmware participation. The system comprises a hardware security chip, at least one wireless communication module and a one-time programmable storage unit, and is paired with a vehicle only when leaving the factory, and the identity identification is physically solidified and cannot be modified. The time-of-flight ranging circuit solves the relay attack threat from the physical layer, the quantum computing risk is solved by using the national secret algorithm hardware engine, a multi-scene emergency unlocking system composed of a near field communication passive chip, a mechanical keyhole, a physical emergency interface and a super capacitor is constructed, and the hierarchical permission management and the blacklist mechanism of the hardware solidification are supported. The application eliminates software vulnerabilities and remote attack risks from the root, prolongs the battery life to more than ten years, and significantly improves the safety and reliability of the automobile key system.

Description

Technical Field

[0001] This invention relates to the field of automotive electronic safety technology, specifically to a pure hardware automotive-grade key system without a central processing unit, software, or firmware, applicable to identity authentication and vehicle control of passenger vehicles, commercial vehicles, and special vehicles. Background Technology

[0002] Existing car key systems are generally based on a "central processing unit + embedded software" architecture. After years of development, a relatively mature technology system has been formed. However, with the increasing intelligence of automobiles and the advancement of attack techniques, existing systems have exposed the following fundamental security vulnerabilities that are difficult to solve through software upgrades: First, relay attacks are difficult to eradicate. Attackers use signal relay devices to forward the key signal from the car owner to the vehicle, misleading the vehicle into thinking the key is nearby, thus illegally unlocking the doors and starting the engine. Existing protection schemes based on timestamps and distance measurements are insufficient to defend against high-precision time synchronization relay attacks—when attackers use nanosecond-level synchronization devices to forward signals, timestamp verification cannot distinguish between the original signal and the forwarded signal.

[0003] Second, emergency unlocking capabilities are insufficient. Existing digital keys rely on the phone's battery, while physical keys rely on an internal battery. When both are out of power, users will find it difficult to open the door and start the vehicle. Although some vehicles are equipped with near-field communication (NFC) emergency unlocking functionality, the NFC antenna is usually integrated into the digital key, meaning the NFC function will also fail when the digital key's battery is depleted.

[0004] Third, there is a lack of multi-key management permissions. The existing system assigns the same authorization level to all keys, making it difficult to differentiate the different usage permissions of the car owner, family members, and designated drivers. If a key is lost, it must be reprogrammed at an authorized service center, which is cumbersome and poses security risks within a time window.

[0005] Fourth, encryption algorithms face threats from quantum computing. Existing systems mostly employ 128-bit Advanced Encryption Standard (AES) algorithms, which were secure in the classical computing era. However, quantum computer algorithms can significantly shorten the time required to brute-force crack them. Automotive chips typically have a design lifespan exceeding ten years, while quantum computers are expected to reach practical application within the next 10-15 years. Existing systems may face the risk of quantum computing attacks during their lifespan.

[0006] Fifth, power consumption and battery life are significant issues. The battery life of existing physical keys is typically around two years, and the continuous background operation of digital keys on the phone also consumes a considerable amount of power. Frequent battery replacements or charging negatively impact the user experience. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a pure hardware automotive-grade key system that solves the relay attack threat from a physical level, enables emergency unlocking in multiple scenarios, supports multi-key hierarchical access control, and upgrades the encryption algorithm to meet the long-term security needs of the quantum computing era.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: A pure hardware automotive-grade key system, in which all core security logic is implemented by pure hardware circuits, without the participation of a central processing unit, software, or firmware; including a hardware security chip, which is used to uniquely pair with the vehicle's security module at the factory, with the identity identifiers of both parties being fixed in a one-time programmable storage unit; and also including at least one wireless communication module for encrypted communication with the vehicle.

[0009] Furthermore, the one-time programmable storage unit performs a fuse-off function after pairing is completed, permanently preventing the addition of new keys.

[0010] Furthermore, it also includes a time-of-flight ranging circuit for directly measuring the physical distance between the key and the vehicle; unlocking the door is allowed when the distance is less than a first threshold, and starting the engine is allowed when the distance is less than a second threshold. The time-of-flight ranging circuit accurately calculates the distance between the key and the vehicle by emitting electromagnetic waves and measuring the round-trip time, with a measurement accuracy down to the centimeter level. Based on the principle that the speed of electromagnetic wave propagation is a fixed physical constant, relay devices cannot accelerate or delay signal propagation.

[0011] Furthermore, it also includes a passive near-field communication chip and a concealed mechanical keyhole. The passive near-field communication chip is a battery-free chip that utilizes electromagnetic induction. When the key is brought close to the vehicle's near-field communication antenna, the electromagnetic waves emitted by the antenna provide power and complete authentication, enabling emergency unlocking. The mechanical keyhole provides a physical safety net, allowing the door to be opened mechanically when the vehicle is completely powered off and all electronic systems fail.

[0012] Furthermore, it includes a key permission hardware table that supports hierarchical authorization for multiple keys. Permission levels include at least: the owner's key can use all functions and authorize other keys; family members' keys can use driving functions but cannot authorize others; the designated driver's key has speed limits and restricted function access within a specified time range; and temporary keys have a preset expiration date. All permission information is permanently stored in a one-time programmable storage unit, making it difficult to tamper with by software or firmware, and difficult to modify via remote updates.

[0013] Furthermore, it includes a multi-stage wake-up circuit. Normally, only the low-power oscillator operates, consuming less than one microamp. The main circuit is only awakened when a vehicle signal is detected, and after authentication, it immediately enters sleep mode. Battery life can be extended to over ten years.

[0014] Furthermore, it also includes a key blacklist hardware list, allowing car owners to add lost keys to the blacklist using other legitimate keys. Keys added to the blacklist are difficult to authenticate.

[0015] Furthermore, it also includes a hardware backup execution module deployed on the vehicle. When the key signal is lost for more than a preset time during a remote summoning process, it automatically triggers a safe pull-over, engages the electronic parking brake, activates the hazard warning lights, and sends an alarm notification to the vehicle owner.

[0016] Furthermore, it also includes a hardware-based security information display anti-tampering circuit deployed in the vehicle. This circuit is used to overlay a hardware-generated security information watermark onto the vehicle's display device, superimposed on top of the software display screen. The software cannot easily modify, cover, or hide this watermark, so even if the onboard software system malfunctions, the driver can still obtain critical safety information such as vehicle speed, gear position, and braking status through the watermark.

[0017] Furthermore, the hardware security chip employs a Chinese national cryptographic algorithm hardware engine, with all keys being at least 256 bits long. It simultaneously supports both Chinese national cryptographic algorithms and advanced encryption standard algorithms, using the Chinese national cryptographic algorithm by default, providing long-term security for the quantum computing era.

[0018] Furthermore, the at least one wireless communication module includes an RF direct-connect communication module and a Bluetooth Low Energy communication module. The RF direct-connect communication module is used for long-distance direct-connect communication, independent of any base station, with a maximum communication distance exceeding several hundred meters. The Bluetooth Low Energy communication module is used for near-field communication and has strong resistance to multipath interference. The RF channel and Bluetooth channel are monitored simultaneously, and switching is automatically determined by a hardware comparator based on signal strength, eliminating the need for software scheduling.

[0019] Furthermore, the key also integrates an ultrasonic pulse transmitting module. This module is used for near-field guidance, emitting ultrasonic pulses with a unique coded sequence. The vehicle-side ultrasonic sensor array identifies the key's code through a hardware matched filter, achieving centimeter-level relative positioning to guide the vehicle to park next to the owner.

[0020] Furthermore, a temperature sensor is integrated into the key. When the temperature is below a preset threshold, it automatically enters a low-temperature mode: the satellite positioning module switches from continuous tracking to single-positioning, the Bluetooth and ultrasonic modules are turned off by default and only turned on in standby mode, and the radio frequency transmission power is reduced to extend battery life.

[0021] Furthermore, the key also integrates a physical emergency interface and a supercapacitor backup power supply. The physical emergency interface is implemented through hidden physical contacts; when the key is completely out of power, the owner can insert the key into the hidden interface on the vehicle's exterior to complete authentication and command transmission via a physical contact channel. The supercapacitor can still keep the security chip and radio frequency transmitter operational for at least tens of seconds even when the battery is completely depleted.

[0022] Furthermore, after the key system is paired at the factory, each vehicle can be paired with a preset number of keys. Once the maximum number of pairs is reached, the one-time programmable storage unit automatically shuts off the new pairing channel, physically preventing the addition of any new keys.

[0023] Furthermore, all authentication processes of the key system are implemented entirely by hardware circuitry, with no central processing unit, software, or firmware involved in the core security logic. All security rules and permission parameters are fixed at the factory, making them difficult to modify during operation and resistant to remote attacks or malicious software tampering.

[0024] Furthermore, it also includes a satellite positioning module for obtaining the current location of the key, and the positioning data is sent after being hardware encrypted at the key end.

[0025] Furthermore, the key system also includes a multi-connection collaborative scheduling circuit deployed on the vehicle. This circuit performs hardware self-tests on all wireless connection channels simultaneously after the vehicle is powered on, with all channels starting in parallel. After each channel completes its self-test, it marks its status as ready, pending recovery, or faulty. When the owner initiates a remote summoning request, the connection channels are tried sequentially according to a preset priority order: satellite positioning plus RF direct connection is the first priority, Bluetooth near-field connection is the second priority, ultrasonic near-field guidance is the third priority, and visual autonomous search is the fourth priority. When the current channel is unavailable, the hardware comparator automatically switches to the next available channel within microseconds, without any waiting or repair attempts. When multiple channels are available simultaneously, the positioning data is fused according to confidence level weights, and the system automatically switches to the second-highest confidence channel when the highest confidence channel fails.

[0026] Furthermore, the key system also includes a real-time call status feedback circuit deployed on the vehicle. During the remote call process, this circuit sends the vehicle's real-time location, current speed, remaining distance, estimated arrival time, current driving status, and any road problems encountered to the owner's terminal at a preset frequency. All status information is directly generated and encrypted by the vehicle's hardware, bypassing the onboard software system, making it difficult for the software to intercept, modify, or forge the status data.

[0027] Furthermore, the key system also includes a multimodal fusion positioning circuit deployed in the vehicle. This circuit simultaneously integrates four positioning signals: satellite positioning, Bluetooth signal strength, ultrasonic ranging, and visual recognition. When the satellite positioning signal is strong, satellite positioning is used; when the satellite positioning signal is weak, it automatically switches to Bluetooth plus ultrasonic joint positioning; when the distance to the vehicle owner is less than a preset distance, it automatically switches to visual positioning, achieving accurate positioning by recognizing features on the vehicle owner's terminal screen or facial features. Beneficial effects

[0028] Compared with the prior art, the present invention has the following significant advantages: 1. Solving relay attacks at the physical level. The time-of-flight ranging circuit directly measures the round-trip time of electromagnetic waves between the key and the vehicle, calculating the physical distance. The propagation speed of electromagnetic waves is a fixed physical constant, difficult to accelerate or delay by relay devices, making it difficult for attackers to forge distance information through signal forwarding. This protection solution is effective against various types of relay attacks, including nanosecond-level high-precision time synchronization relay attacks.

[0029] 2. Enables multi-scenario emergency unlocking. The near-field communication passive chip can still complete authentication and unlocking by being powered by the vehicle antenna when the key battery is depleted. The mechanical keyhole provides a physical backup when the vehicle is completely powered off, and the physical emergency interface provides a contact authentication channel when the key malfunctions. Users will not be locked out of the vehicle due to key problems in various situations, and the emergency unlocking coverage is high.

[0030] 3. Supports multi-key hierarchical access control. Car owners can set different access permissions for family members, designated drivers, and temporary users, including driving range, maximum speed, and function access scope. All permission information is fixed in hardware and difficult to tamper with by software. If a key is lost, the car owner can immediately add the lost key to the blacklist using another valid key, without having to go to a service center, significantly reducing security response time.

[0031] 4. The encryption algorithm has been upgraded to quantum security level. It employs a national cryptographic algorithm hardware engine with a key length of no less than 256 bits, ensuring the chip's security throughout its design lifespan and meeting the security requirements for long-term automotive use.

[0032] 5. Significantly extended battery life. The multi-level wake-up mechanism ensures extremely low power consumption in standby mode, with a static current of less than 1 microamp. Battery life is extended from approximately 2 years in traditional solutions to over 10 years, which is superior to existing key systems.

[0033] 6. The remote summoning function is safe and reliable. Multi-connection collaborative scheduling ensures reliable communication channels in various environments, with channel switching time of less than 1 microsecond, more than 1000 times faster than software systems. The vehicle automatically and safely pulls over after signal loss, with the entire process implemented in hardware without software intervention, reducing the risk of software failure or tampering.

[0034] 7. Display security and tamper-proof. Hardware security information watermarks are superimposed on the software display. Even if the vehicle software system is attacked or malfunctions, the driver can still obtain critical safety information such as vehicle speed, gear position, and braking status, ensuring driving safety.

[0035] 8. Significantly improved vehicle location accuracy. Multimodal fusion positioning improves accuracy from meters to decimeters compared to single-satellite positioning, ensuring vehicles are accurately parked next to their owners with minimal pickup error.

[0036] 9. The pure hardware architecture eliminates security risks at the source. All core security logic has no central processing unit, no software, and no firmware, reducing the risk of software vulnerabilities, remote attacks, and malicious code injection. Security parameters are physically fixed at the factory and are difficult to modify during operation, achieving a high level of security comparable to automotive-grade standards.

[0037] 10. It simultaneously protects the complete systems of both the key and vehicle ends, including hardware structure, communication methods, and security mechanisms, making it convenient to provide evidence when protecting rights and providing comprehensive protection. Detailed Implementation

[0038] The present invention will now be described in detail with reference to specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0039] Example 1: Key System Hardware Architecture The pure hardware automotive-grade key system in this embodiment consists of two parts: the key end and the vehicle end. All core security logic is implemented by pure hardware circuits without the participation of any central processing unit, software or firmware.

[0040] The key-end hardware architecture includes: a hardware security chip, a satellite positioning module, an RF direct-connect communication module, a Bluetooth Low Energy communication module, an ultrasonic pulse transmission module, a time-of-flight ranging circuit, a near-field communication passive chip, a temperature sensor, a multi-level wake-up circuit, a supercapacitor backup power supply, a physical emergency interface, and a human-machine interface.

[0041] The hardware security chip is the core security unit at the key terminal. It integrates a Chinese national cryptographic algorithm hardware engine, supporting the SM2 / SM3 / SM4 national cryptographic algorithms and the advanced encryption standard AES-256, with a key length of 256 bits. At the factory, the hardware security chip is uniquely paired with the vehicle's security module. Both exchange public keys and permanently store them in a one-time programmable fuse storage unit. After pairing, the one-time programmable storage unit physically fuses, permanently preventing the addition of new keys. Each vehicle can be paired with a maximum of four keys; once this limit is reached, any further pairing is physically blocked.

[0042] The satellite positioning module supports parallel reception of multiple systems including BeiDou, Global Positioning System, GLONASS, and Galileo. The initial positioning time for a cold start is no more than 30 seconds, and for a warm start, no more than one second. Positioning data is encrypted within the hardware security chip at the key terminal before transmission, and positioning accuracy is marked with levels including centimeter, decimeter, meter, and 10-meter.

[0043] The RF direct-connect communication module uses the Sub-1GHz band for long-distance direct communication, with a maximum communication distance exceeding several hundred meters, without relying on any base station or network infrastructure. The Bluetooth Low Energy communication module adopts the latest standard for near-field communication, with a maximum communication distance exceeding tens of meters and strong resistance to multipath interference. Both the RF and Bluetooth channels simultaneously monitor signals from the vehicle; switching is automatically determined by a hardware comparator based on signal strength, requiring no software scheduling, and the switching time is less than 1 microsecond.

[0044] The ultrasonic pulse transmitting module is used for near-field guidance, with a maximum working distance exceeding ten meters. This module emits ultrasonic pulses with a unique coded sequence, generated and fixed at the factory by a hardware true random number generator, ensuring that each key's coded sequence is globally unique. The vehicle's ultrasonic sensor array identifies the key's code through a hardware matched filter, achieving centimeter-level relative positioning to guide the vehicle to park next to the owner.

[0045] The time-of-flight ranging circuit directly measures the physical distance between the key and the vehicle. This circuit emits an electromagnetic pulse and measures the round-trip time. The distance is obtained by multiplying this time by the electromagnetic wave propagation speed and dividing by two, with a measurement accuracy of ±10 centimeters. Unlocking the car door is allowed when the distance is less than a preset threshold, and starting the engine is allowed when the distance is less than an even smaller preset threshold. The ranging principle of this circuit is based on the fundamental physical law that the electromagnetic wave propagation speed is a fixed physical constant. Relay attack devices introduce additional delays into the signal path, which are accurately detected by the time-of-flight ranging circuit and identified as an attack.

[0046] The passive near-field communication (NFC) chip is a battery-free chip that operates using the principle of electromagnetic induction. When the key is brought close to the NFC antenna in the door handle, the chip obtains energy from the electromagnetic waves emitted by the antenna and completes authentication, enabling emergency unlocking. Furthermore, this NFC antenna also supports reverse power supply—when the key battery is depleted, bringing the key close to the antenna allows the vehicle to recharge the key battery. The charging time is sufficient to complete a full unlocking and starting authentication process, providing the owner with additional emergency protection.

[0047] The temperature sensor is used to detect ambient temperature, and the measurement range meets automotive-grade temperature requirements. When the temperature is below a preset threshold, it automatically enters a low-temperature mode: the satellite positioning module switches from continuous tracking to single-positioning mode, and positioning is only initiated when the button is pressed; the Bluetooth and ultrasonic modules are turned off by default and are only turned on as backups when other channel authentication fails; the RF transmission power is reduced to extend battery life.

[0048] A multi-stage wake-up circuit is used to reduce standby power consumption. Normally, only the low-power crystal oscillator operates, resulting in extremely low quiescent current. When a specific wake-up signal emitted from the vehicle is detected, the hardware security chip is first woken up for pre-authentication. After successful authentication, the main circuit is then woken up, and the circuit immediately enters sleep mode upon completion of authentication. Battery life is extended from approximately two years in traditional solutions to over ten years.

[0049] The supercapacitor backup power supply provides emergency power when the battery is completely depleted, maintaining the operation of the security chip and radio frequency transmitter for at least tens of seconds, ensuring the owner can complete the final unlocking operation before the battery runs out. The supercapacitor automatically prompts the owner to perform charge-discharge cycles at preset intervals to maintain its capacity. When the capacity falls below a certain percentage of its nominal value, the vehicle automatically notifies the owner to replace the key the next time it communicates with the key, ensuring the backup power supply remains reliable.

[0050] The physical emergency interface is implemented through hidden physical contacts at the bottom of the key, which are gold-plated to prevent oxidation. When the key is completely out of power and the supercapacitor is depleted, the owner can insert the key into the hidden interface on the vehicle's exterior to complete authentication and command transmission via a physical contact channel. If authentication fails, the vehicle automatically triggers safety alarms, including honking the horn and flashing lights.

[0051] The human-machine interface includes a call button, a duress button, and LED status indicators. Pressing the call button for a preset duration triggers the remote call function. Pressing the duress button sends an encrypted abort frame, which has the same format as a normal call frame. This makes it difficult for attackers to distinguish duress operations by frame format, ensuring that the vehicle owner can covertly trigger the security mechanism when duressed. A flashing green LED indicates that positioning is ready, a flashing blue LED indicates that communication with the vehicle is in progress, and a solid red LED indicates that the battery is low.

[0052] Example 2: Multi-connection cooperative scheduling This embodiment describes the workflow of the vehicle-side multi-connection collaborative scheduling circuit.

[0053] After the vehicle is powered on, the dispatch circuit performs hardware self-tests on all wireless connection channels simultaneously, starting them all in parallel without waiting or queuing. The satellite positioning module performs antenna connectivity testing and satellite signal search; the RF direct connection channel performs background noise testing and signal gain calibration; the Bluetooth channel performs module self-tests and communication tests; the ultrasonic channel transmits test pulses channel by channel via sensors and detects echoes; and the visual channel performs camera lens obstruction detection and image quality checks. After the self-test is completed, each channel marks its status as ready, pending recovery, or faulty.

[0054] When the vehicle owner initiates a remote summon request, the dispatch circuit attempts to connect to each channel sequentially according to a preset priority order. Satellite positioning plus direct radio frequency connection is the first priority, Bluetooth near-field connection is the second priority, ultrasonic near-field guidance is the third priority, and visual autonomous search is the fourth priority. If the current channel is available, it is used directly. If the current channel is unavailable, the hardware comparator automatically switches to the next available channel within microseconds, without any waiting or repair attempts.

[0055] The conditions for determining that a channel is unavailable include: the satellite positioning timeliness is marked as outdated and the radio frequency signal strength is below the minimum threshold for a continuous period exceeding the preset judgment window; the Bluetooth signal strength is below the minimum threshold and no broadcast frame of the paired key is detected for a continuous period exceeding the preset judgment window; the ultrasonic sensor self-test fails or the echo intensity drops by more than a preset ratio; the ambient light is below the minimum threshold and the infrared fill light is faulty or the camera is blocked.

[0056] Only when all channels have been tried and are all unavailable will the scheduling circuit enter the all-channel failure handling process. At this time, a notification is sent to the vehicle owner's terminal that all connection methods are temporarily unavailable. If the Bluetooth channel is still available, the vehicle's last known location coordinates are sent via Bluetooth. If all wireless channels are interrupted, the vehicle automatically activates the passive acoustic vehicle-finding mode as a last resort.

[0057] When multiple channels are available simultaneously, the multi-source signal fusion arbitrator inside the scheduling circuit weights and fuses the positioning data from all available channels according to their confidence levels. Satellite positioning has high confidence in open areas, but its confidence decreases in urban areas with tall buildings and canyons. Radio frequency signal strength gradients have high confidence indoors. Bluetooth signal strength gradients have high confidence at close range. Ultrasonic near-field guidance has the highest confidence at extremely close range. Visual facial recognition confirmation has high confidence. When the channel with the highest confidence suddenly fails, the arbitrator automatically switches to the second highest confidence channel, with a switching time of less than 1 microsecond.

[0058] The failed channel continuously performs self-checks in the background, with a preset check cycle. When a higher-priority channel is detected to have recovered, the system automatically switches back to the higher-priority channel during the current task's safe interval.

[0059] Example 3: Remote Summoning and Status Feedback This embodiment describes the workflow of the remote summoning function.

[0060] When the car owner presses the call button on the key outside the vehicle and holds it for a preset time, the key sends a remote call request frame. After the vehicle completes identity authentication, the key's satellite positioning module sends the current location coordinates to the vehicle via an encrypted channel. Upon receiving the coordinates, the vehicle first performs security checks: the destination coordinates are compared in parallel with the list of prohibited areas; if the destination falls into a prohibited area, the call will be rejected; if the straight-line distance between the destination and the vehicle's current location exceeds the maximum call range, the call will be rejected; the vehicle status self-check includes the door closing status, charging gun connection status, battery level, etc., and the call will be rejected if any of these conditions are not met.

[0061] After security verification, the vehicle sends the destination coordinates to the route planning engine to generate a driving route. Once approved by the risk assessment module, the route is executed. During the journey, the vehicle sends real-time status information to the driver's terminal at a preset frequency, including the vehicle's real-time location, current speed, remaining distance, estimated arrival time, current driving status, and any road problems encountered. All status information is directly generated and encrypted by the vehicle's hardware, bypassing the onboard software system, making it difficult for software to intercept, modify, or falsify the status data.

[0062] During remote call execution, the scheduling circuit continuously tracks the key's location through the currently available connection channels. When the deviation between the key's location and the initially planned destination coordinates exceeds a preset threshold, an automatic destination coordinate update is triggered. To prevent frequent route changes caused by satellite positioning multipath effects, the scheduling circuit maintains a sliding window of the most recent positioning data and calculates the stability of the position coordinates within the window. A destination update is only triggered when the standard deviation of the position drift is less than a preset threshold, and all position points within the window deviate from the initial destination by more than an update threshold. If the standard deviation of the position drift is greater than the threshold, it is determined to be a satellite positioning multipath effect, the destination coordinates are not updated, the vehicle continues to travel on the original path, and the driver is informed via voice prompt that the positioning signal is unstable.

[0063] When a key signal loss is detected, the dispatch circuit analyzes the signal attenuation characteristics to distinguish different situations. A significant drop in signal strength within a short period is considered rapid attenuation, corresponding to a sudden loss of key power or the owner quickly leaving the signal range. In this case, instead of immediately pulling over, a final confirmation frame is sent to the key. If the key still has residual power, it will send back a confirmation frame, and the vehicle will continue to attempt to call the vehicle. If the key does not respond, the vehicle continues along the current road at a minimum speed to the estimated pick-up point, pulls over, activates hazard lights, and simultaneously sends the last known vehicle location to the owner's terminal. A slow drop in signal strength over a longer period is considered slow attenuation, corresponding to the owner slowly moving away or the key gradually moving away. The original logic is followed to safely pull over, engage the electronic parking brake, activate the hazard warning lights, and send a warning notification to the owner.

[0064] Example 4: Multimodal Fusion Localization and Identity Verification for Person Reception This embodiment describes the multimodal fusion positioning and identity verification process for the person receiving function.

[0065] The vehicle simultaneously receives four positioning signals: satellite positioning, Bluetooth signal strength, ultrasonic ranging, and visual recognition. When the satellite positioning signal is strong, it uses satellite positioning for navigation. When the vehicle enters an underground parking garage or a high-rise building / canyon area where the satellite positioning signal weakens, it automatically switches to a combined Bluetooth signal strength and ultrasonic ranging positioning mode. Bluetooth signal strength is used to estimate distance, while ultrasonic waves are used to accurately measure direction and distance.

[0066] When the vehicle moves within a preset distance of the owner, it automatically switches to visual positioning mode. The visual feature extraction accelerometer scans for surrounding pedestrians, matching them with the owner's facial features or recognizing features on the owner's terminal screen.

[0067] Upon arrival at the pick-up location, the system performs dual identity verification. First, a visual feature extraction accelerometer matches the facial features of the pedestrian approaching the vehicle. If the facial matching is successful, the car door is not unlocked immediately; instead, the pedestrian is prompted to say a preset confirmation phrase via the vehicle's external speaker. Simultaneously, the voiceprint authentication circuit is activated to compare the pedestrian's voice. The car door is only unlocked after both facial and voiceprint verification are successful. If the voiceprint is not registered or voiceprint authentication fails, the car door remains locked, and a notification is sent to the vehicle owner's terminal indicating that someone attempted to approach the vehicle but identity verification failed, along with a photo of the scene taken by the vehicle's front camera.

[0068] If visual recognition fails due to insufficient ambient light or camera obstruction, the system automatically downgrades to a dual confirmation method using Bluetooth signal strength and the physical key button. This involves prompting pedestrians to bring the key close to the window or press the key's unlock button via the vehicle's external speaker, and then verifying identity through Bluetooth signal strength or a key-encrypted confirmation signal.

[0069] When multiple matching users are detected simultaneously, the system confirms the target user according to a preset priority: the user with a valid remote key takes precedence over the user who most recently drove the vehicle, and the vehicle owner takes precedence. If multiple matching users all have valid keys, the system will ask the specific user via voice and wait for voiceprint confirmation.

[0070] Example 5: Passive Acoustic Vehicle Finder When all wireless connection channels fail, the vehicle automatically activates the passive acoustic vehicle-finding mode as a last resort.

[0071] This mode continuously monitors ambient sounds via the vehicle's microphone array. A hardware acoustic pattern matcher detects preset vehicle-finding acoustic patterns, such as three consecutive claps or a specific tapping rhythm. To prevent false triggering by ambient noise, a vibration sensor cross-validation mechanism is added—the passive vehicle-finding response is only triggered when the acoustic pattern matcher detects the vehicle-finding acoustic pattern and simultaneously the vehicle's accelerometer detects vibration signals from the ground around the vehicle. Simultaneously, the acoustic pattern recognition threshold is appropriately increased to further reduce the probability of false triggering.

[0072] The vehicle search response includes the vehicle emitting intermittent short horn sounds and flashing high beams via external speakers, as well as sending a notification to the owner's terminal that the vehicle search mode has been activated. The vehicle continues to respond until the owner unlocks the door with the physical key, or automatically stops after exceeding the maximum allowed duration to conserve battery power.

[0073] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A pure hardware automotive-grade key system, characterized in that, All core security logic is implemented by pure hardware circuits, without the involvement of a central processing unit, software, or firmware; It includes a hardware security chip, which is used to uniquely pair with the vehicle-side security module at the factory, and the identity identifiers of both parties are fixed in a one-time programmable storage unit; it also includes at least one wireless communication module for encrypted communication with the vehicle.

2. The system according to claim 1, characterized in that, It also includes a time-of-flight ranging circuit for directly measuring the physical distance between the key and the vehicle; unlocking the door is allowed when the distance is less than a first threshold, and starting the engine is allowed when the distance is less than a second threshold; the time-of-flight ranging circuit calculates the distance accurately by emitting electromagnetic waves and measuring the round-trip time, with a measurement accuracy of centimeters; any additional delay introduced by the relay device will be accurately detected and identified as an attack. The hardware security chip uses a national cryptographic algorithm hardware engine, and all keys are no less than 256 bits in length.

3. The system according to claim 1, characterized in that, It also includes a near-field communication passive chip, a hidden mechanical keyhole, a physical emergency interface, and a supercapacitor backup power supply, forming a multi-scenario emergency unlocking system; the near-field communication passive chip completes authentication and unlocking through the vehicle antenna when the key battery is depleted and supports reverse charging; the mechanical keyhole provides purely mechanical unlocking when the vehicle is completely powered off; the physical emergency interface and supercapacitor provide contact authentication and emergency power supply when the key is completely out of power.

4. The system according to claim 1, characterized in that, It also includes a key permission hardware table and a key blacklist hardware table; the key permission hardware table supports hierarchical authorization of multiple keys, and the permission levels include at least the owner's key, family key, valet key and temporary key; All permission information is stored in a one-time programmable storage unit, which is difficult to tamper with by software or firmware; the key blacklist hardware table allows car owners to add lost keys to the blacklist using a legitimate key, and keys added to the blacklist are difficult to authenticate.

5. The system according to claim 1, characterized in that, It also includes a satellite positioning module, a multi-connection collaborative scheduling circuit, and a real-time call status feedback circuit; the satellite positioning module is used to obtain the current location of the key, and the positioning data is transmitted after being encrypted by the hardware at the key end; the multi-connection collaborative scheduling circuit supports five connection channels simultaneously: satellite positioning, radio frequency direct connection, Bluetooth, ultrasonic, and vision, and automatically switches within microseconds when a channel is unavailable; the real-time call status feedback circuit generates and encrypts vehicle status information directly by hardware and transmits it without going through the vehicle software system.

6. The system according to claim 1, characterized in that, It also includes a hardware backup execution module and a hardware security information display anti-tampering circuit; the hardware backup execution module automatically triggers safe parking when the key signal is lost during remote summoning; the hardware security information display anti-tampering circuit overlays a hardware-generated security information watermark on the vehicle display device, which is difficult for software to modify, cover or hide.

7. A method for operating a purely hardware-based automotive-grade key system, characterized in that, All core security logic is executed by pure hardware circuitry, without the involvement of a central processing unit, software, or firmware; including the following steps:

1. At the factory, the hardware security chip on the key end is uniquely paired with the vehicle-side security module, and the identity identifiers of both parties are permanently stored in a one-time programmable storage unit; 2. The key terminal sends an encrypted authentication request to the vehicle via a wireless communication module; 3. The vehicle receives encrypted data and performs hardware decryption and identity authentication; 4. After successful authentication, perform the corresponding vehicle control operations.

8. The method according to claim 7, characterized in that, It also includes time-of-flight ranging (TOF) steps to prevent relay attacks: the TOF circuit directly measures the physical distance between the key and the vehicle; unlocking the door is allowed when the distance is less than a first threshold, and starting the engine is allowed when the distance is less than a second threshold; additional delays introduced by relay devices will be accurately detected and identified as an attack.

9. The method according to claim 7, characterized in that, It also includes the steps for remote summoning:

1. The vehicle-side multi-connection collaborative scheduling circuit performs hardware self-tests simultaneously on all wireless connection channels; 2. When the car owner presses the key summon button, the key sends an encrypted remote summon request frame; 3. After the vehicle completes identity authentication, it receives encrypted positioning coordinates sent by the satellite positioning module on the key terminal; 4. The scheduling circuit attempts each connection channel sequentially according to a preset priority order, and automatically switches channels within microseconds when the current channel is unavailable; 5. The vehicle-side hardware directly generates and encrypts real-time status information and sends it.

10. The method according to claim 9, characterized in that, It also includes remote call safety handling steps: when the key signal is detected to be lost for more than a preset time, it automatically triggers a safe pullover; at the same time, it integrates four signals, namely satellite positioning, Bluetooth, ultrasonic and visual signals, to perform multimodal person-getting positioning.