Control device for a motor vehicle access or localization system and procedure

Abstract

Control device (100) for a motor vehicle access or localization system (200), configured for: Identifying a received signal that has traveled from a transmitter to a receiver of the control device along the strongest signal path, peak path, as a peak path signal; Determining the signal propagation time (ToF) of the peak path signal; Determining a time interval, δ, from the signal propagation time of the peak path signal; Determining a threshold, T, for the reliability of a first path search as a function of δ; Performing the first path search at δ taking the threshold into account, and configured for: Decide that no first path signal was detected if the threshold, T, was not exceeded; Determining a new threshold, Tneu, for the reliability of a renewed first path search depending on a new time interval, δ- Δ or δ+ Δ, from the signal propagation time of the peak path signal; Performing a new First Path search at the new time interval, δ- Δ or δ+ Δ, taking into account the new threshold, where the new threshold, Tneu, is less than or equal to the original threshold, T, if the time interval from the signal propagation time of the Peak Path signal has decreased.

Description

[0001] The invention relates to motor vehicle access and localization systems. In particular, the invention relates to a control device for a motor vehicle access or localization system, a vehicle having such a control device, an access or localization system having such a control device and a radio key, and a method for operating a motor vehicle access or localization system.

[0002] US 2019 / 0 004 155 A1 concerns a localization system.

[0003] Wireless transmission technologies can be used in access or localization systems, for example, in conjunction with so-called radio keys. To prevent misuse, various methods can be used to assess with sufficient certainty that proper use is taking place.

[0004] It is an object of the invention to further develop access or localization systems.

[0005] This object is achieved by the subject matter of the independent patent claims. Further developments of the invention emerge from the subclaims and the following description of embodiments.

[0006] A first aspect of the invention relates to a control device, in particular for a A motor vehicle access or location system configured to identify a received signal that has traveled from a transmitter, such as a remote key fob or a mobile phone, to a receiver of the control device, such as a motor vehicle's antenna system, along the strongest signal path, the so-called peak path. This signal is then considered a peak path signal.

[0007] The control device is also configured to determine the time of flight (ToF) of the peak path signal. Likewise, a time interval δ from the signal propagation time is determined, if necessary depending on the determined signal propagation time of the peak path signal. A threshold value T for the reliability of a first path search is then determined as a function of δ. The "reliability" of the first path search corresponds to the threshold value applied during the first path search. This can involve determining the similarity of the preamble of the received signal with the expected preamble, if necessary depending on the signal-to-noise ratio of the received signal.

[0008] Then the first path search is performed at δ taking the threshold into account.

[0009] According to one embodiment, δ may be the maximum permitted time interval, δ max, act. In this case, longer time intervals are not examined for the presence of a first path signal.

[0010] According to one embodiment, a signal detected in the first path search is classified as a so-called first path signal if the threshold T has been exceeded. The first path search is then terminated because the first path signal has been found and identified.

[0011] According to a further embodiment, the control device is configured to decide that no first path signal was detected at δ, namely when the threshold value T was not exceeded. Thereafter, a new threshold value, T neu, for the reliability of a renewed first path search as a function of an increased or decreased time interval, δ - Δ or δ + Δ, is determined from the signal propagation time of the peak path signal. The first path search is then performed again at the increased or decreased time interval, δ - Δ or δ + Δ, taking the new threshold into account.

[0012] If the first path search is unsuccessful here as well, the time interval for the next first path search can be increased or decreased again, followed by a new threshold determination. These steps can be repeated until a first path signal is detected. After that, the first path search is terminated.

[0013] According to one embodiment, the new threshold value, T neu, less than or equal to the original threshold, T, and less than or equal to the previously determined threshold if the time interval to the peak path signal has been reduced.

[0014] It is therefore a monotonically decreasing curve that describes the dependence of the time interval of the current first path search on the “security margin” to be met.

[0015] According to a further embodiment, the control device is configured for function-dependent, installation position-dependent, location-dependent and / or time-dependent adaptation of the threshold value, T, and / or the new threshold value, T neu .

[0016] A further aspect relates to a vehicle with a control device as described above and below.

[0017] A further aspect relates to an access or localization system with a control device as described above and below and a radio key.

[0018] A further aspect relates to a method for operating a motor vehicle access or localization system, comprising the steps: Identifying a received signal that has traveled from a transmitter to a receiver of a control device along the strongest signal path, peak path, as a peak path signal; Determine the signal propagation time, ToF, of the peak path signal; determine a (possibly maximum permissible) time interval, δ (max) , from the signal propagation time of the peak path signal; determining a threshold, T, for the reliability of a first path search as a function of δ (max) ; and Performing the first path search at δ (max) ; taking into account the threshold.

[0019] A further aspect relates to a program element which, when executed on a control device of a motor vehicle access or localization system, instructs the control device to perform the steps described above and below.

[0020] A further aspect relates to a computer-readable medium on which a program element as described above is stored.

[0021] Embodiments of the invention are described below with reference to the figures. The representations in the figures are schematic and not to scale. Short description of the characters Fig. Figure 1 shows the distribution of ranging errors for LOS and NLOS conditions. Fig. Figure 2 shows a path loss model for UWB (free space and ground bounce) at 6.5 GHz and 8.0 GHz. Fig. 3 shows numerical examples for first path dynamic requirements. Fig. Figure 4 shows a characteristic curve for first path search, which requires a higher security margin the larger the time difference (δ) between first path and peak path is. Fig. Figure 5 shows an example of an implementation of the first path search with δ-dependent security margin. Fig. 6 shows a motor vehicle access or location system. Detailed description of embodiments

[0022] UWB (Ultrawide Band) Secure Ranging is used in vehicle access systems. Two-way ranging is used for distance determination (“ranging”), typically double-sided two-way ranging, which places lower demands on the accuracy of the quartz crystals.

[0023] Double-sided two-way ranging describes a communication sequence in which the communication partners generate timestamps for sent and received packets. The collected timestamps can then be used to calculate the signal's propagation time, the "time of flight" (ToF). ToF and the distance between the communication partners can be converted into one another using the speed of light, assuming that the ToF represents the direct path between the communication partners (and not a reflection).

[0024] For high accuracy, it is crucial that the receiver determines the time of arrival (the signal arrival time, i.e., the reception timestamp) for each packet as precisely as possible. This task is not trivial, especially in reflective environments with multipath propagation, because the direct path of interest can be obscured by reflections with stronger signal levels.

[0025] The receiver can perform signal acquisition based on the strongest signal path (the so-called "peak path") and determine an image of the channel by correlating known symbols or sequences and accumulating across multiple symbols. This is referred to as "Channel Impulse Response" (CIR). In a backward search, starting at the peak path, post-processing checks whether any lower-level signal paths exist before the peak path. The goal is to identify the earliest time of signal arrival, the first path, and use this time as the reception timestamp.

[0026] The first path search presents a threshold problem, as the algorithm must distinguish between noise and a valid path. Furthermore, the highest possible dynamic range, for example, 30 dB, between the peak path and the first path is desirable in order to be able to detect the first path even in scenarios with body shadows.

[0027] The introduction of UWB technology in vehicle access systems is motivated, among other things, by security considerations, as the ToF measurement prevents potential "relay attacks" (radio link extension) in today's passive access systems. However, it is important that the ToF measurement is designed to be tamper-proof to prevent the system from being compromised by an attack on the ToF measurement, possibly in combination with radio link extension. In addition to cryptographic measures during the data transmission of the measured timestamps, it is crucial that the timestamp determination itself cannot be influenced to an attacker's advantage.

[0028] In "secure ranging," a sequence known only to the communication partners is used. The term "secure training sequence" (STS) is also used in this context. Based on this sequence, the receiver performs the correlation and accumulation for the CIR. Assuming that the attacker has no other information about the STS used, a ToF manipulation must be based on an attack with a guessed STS. For example, the attacker can extend a valid signal and attempt to fake an earlier first path by inserting a guessed STS ("STS injection"). The resulting manipulation of the ToF measurement is called "distance gain." The probability with which an attacker guesses an STS that results in a valid path in the CIR represents the security level of an implementation.

[0029] During the first path search, a conflict of objectives arises regarding threshold setting: To minimize the probability of an attack succeeding, the threshold for a valid path should be set as high as possible. A high threshold means that first path detection only accepts paths that are very reliably based on an actual signal (no noise, no guessed signal), thus requiring the path to be as clearly expressed as possible in the CIR. This contradicts the goal of achieving the highest possible first path dynamics or first path sensitivity, which requires the lowest possible threshold setting (even poorly expressed paths or paths close to the noise limit are still accepted). This conflict of objectives exists regardless of the specific implementation of the first path decision threshold.

[0030] As a solution to this conflict of objectives, the determination of two (or more) timestamps can be planned, with one optimized for performance (dynamics) and a second optimized for security. This ultimately yields two ToF results based on a ranging process: a highly reliable (security) but possibly inaccurate result, and a very accurate (performance) but possibly manipulated result, whose use can be decided at the functional level.

[0031] For example, the security value could be used for "Relay Attack Defense" (high security requirements, low accuracy and update rate requirements) and the performance value for localization (high accuracy and update rate requirements). However, if, for example, only one or a few communication cycles can be performed and no ranging reaches the security threshold (i.e., no security result is available), this can lead to problems.

[0032] In addition to this trade-off, the implementation of the first path search itself considers other parameters, such as the actual signal amplitude or the signal-to-noise ratio. It is advantageous to resolve the "security versus performance" trade-off that arises during first path determination as transparently as possible in a ToF result and integrate it into the first path search.

[0033] Peak path detection can be performed with a very high level of security without compromising sensitivity or performance. For proper implementation, it is assumed that an attacker cannot fake a peak path by guessing an STS. The peak path is assumed to be trustworthy.

[0034] Furthermore, the following correlations can be observed: 1. Security risk

[0035] For an attacker, achieving the highest possible distance gain is attractive because it allows them to conceal larger radio link extensions. The severity of the damage is therefore greater the greater the achievable distance gain. To limit the risk, the probability of achieving a high distance gain can be reduced. The distance gain is proportional to the time difference between the detected first path and the peak path in the CIR.

[0036] Conversely, the damage is low when the distance gain is small, i.e., the distance between the first path and the peak path in the CIR is small. In this case, a slightly higher probability of success is acceptable for the attacker. Numerical values:

[0037] A reasonable distance gain for the attacker is several meters, for example, at least 3 meters. Otherwise, even borderline attack scenarios such as the so-called front-door attack (only a small radio link extension required) are theoretically impossible. It should also be considered that the distance gain requirements for practical implementation are significantly higher, as any equipment used by the attacker introduces latency into the signal path. 2. Accuracy improvement

[0038] Even with small time differences between first path and peak path compared to 1, a more precise first path detection can result in a relevant improvement in accuracy, because the desired accuracy is at least one order of magnitude below the distance gain for a relevant attack.

[0039] Furthermore, practice shows that in the majority of multipath scenarios the time difference between first path and peak path is small, and large differences corresponding to a range of several meters are very rare. Numerical values:

[0040] For vehicle access systems, the target accuracy is + / - 10 cm. This is necessary to ensure precise zone detection upon approach and to enable reliable indoor / outdoor detection.

[0041] In many multi-path scenarios, the resulting error due to failure to recognize the actual direct path is a few meters, usually less than 1.5 m, cf. Fig. 1. 3. Performance requirement First Path Dynamics

[0042] From practical considerations, it can be deduced that the requirements for the first path dynamics decrease when the time difference between peak path and first path increases: For a given scenario, the first path reception level always remains the same (for example, given distance and body attenuation), while the reception level for the peak path (= reflected signal) decreases with increasing difference (= longer reflection path), so that the level ratio for first path to peak path decreases.

[0043] An example of this is the so-called back-pocket scenario of Fig. 2 and Fig. 3 shown.

[0044] Fig. Figure 2 shows a path loss model for UWB (free space and ground bounce) at 6.5 GHz and 8.0 GHz. Fig. 3 shows a numerical example of first path dynamic requirements.

[0045] For example, the user is standing 2 m in front of the car. The direct path (2 m) is significantly attenuated by body shadows (35 dB). However, the reflected signal (e.g., from the garage wall) is very strong.

[0046] The attenuation of the direct path is according to the UWB Path Loss Model ( Fig. 2) 55 dB for a distance of 2 m. The total attenuation, including 35 dB of body shadowing, is 90 dB.

[0047] Assuming that the reflection path is only slightly longer (garage wall very close), for example 1 m longer than the direct path (row 25 in the table Fig. 3), the reflected path attenuation is 59 dB and thus the necessary first path dynamics are 31 dB (= 90 dB - 59 dB).

[0048] Assuming a longer reflection path (garage wall further away), for example 10 m longer than the direct path (see line 30 in the table Fig. 3), the attenuation of the reflected path is already 71 dB and the necessary first path dynamics is only 19 dB (= 90 dB - 71 dB).

[0049] The above observations lead to the following solution approach: 1. Implementation of a characteristic curve with a variable security margin for the threshold in the first path search. 2. The security margin is increasing or monotonically increasing with increasing δ. δ denotes the time difference between the signal propagation time of the peak path signal and a point in the CIR, see also Fig. 4. 3. From a certain distance δ max First Path is no longer accepted. 4. The characteristic curve has a minimum safety margin M1, which can also be 0. 5. The characteristic curve has a maximum safety margin M2, which is already before δ max can be achieved. 6. The exact nature of the characteristic curve can be defined by functional specifications or a table (LUT, “Look Up Table”).

[0050] Fig. Figure 4 shows an example of a characteristic curve for such a security margin.

[0051] As can be seen from the characteristic curve of the Fig. As can be seen in Figure 4, the greater the time difference between the first path and the peak path, the higher the security margin required for the first path search. However, sections of this curve can also be horizontal or have a positive slope. The exact shape of the curve can depend on the application.

[0052] Fig. Figure 5 shows a flowchart of a method for operating a motor vehicle access or localization system. First, a first path search is performed, i.e., identifying a received signal that has traveled from a transmitter to a receiver of a control device along the strongest signal path, the peak path. Once this peak path signal has been identified, the search advantageously starts at the maximum possible time interval δ. max The signal propagation time of the peak path signal depends on the signal propagation time. It is possible to terminate the procedure early if the signal is successful, i.e., if the first path signal is identified.

[0053] It may be provided that the security margin M for the current search distance δ is then determined, for example, using a look-up table. The current search distance δ is set at the beginning of the procedure, for example, to δ maxand then gradually reduced until the first path or the corresponding signal propagation time has been determined.

[0054] Depending on M, the threshold T for the desired reliability of the (error-free) first path search is then determined. The determination of T may contain further dependencies, for example, the signal-to-noise ratio. If the threshold T for the reliability of the first path search is exceeded for the current search interval δ (positive criterion), this δ is declared the "first path." In this case, the search is terminated because no earlier time point for the first path can be found.

[0055] Additional optimization can be achieved if the parameters for the Fig. 4 and thus the security profile of the implementation can be adapted depending on the usage and situation.

[0056] For example, the security profile can be adapted depending on the function, for example by requiring the access function to the vehicle to meet higher security requirements than, for example, the “Welcome Lighting”.

[0057] The installation position can also influence the adaptation of the security profile. For example, transceivers installed internally receive a different characteristic curve than those installed externally, as the expected reflection behavior (and thus the requirements for first path detection) are different. Location-dependent adaptation of the security profile is also possible, for example, particularly in locations with an increased risk of theft, where the curve will be steeper and / or shifted upwards.

[0058] It is also possible to adjust the safety profile over time. For example, the curve can be shifted upwards at night compared to daytime. It is also possible to increase this safety level if the vehicle is idle for longer.

[0059] Protocol-dependent adaptations are also possible. For example, a different relay attack prevention method can be used in parallel. If, for example, other relay attack prevention mechanisms are also used, the security level can be adjusted (reduced) accordingly. Examples of such mechanisms include user recognition via lidar / radar, facial recognition, access verification using motion sensor data in the key / handset, or repeated ToF measurements.

[0060] The procedure described above allows for parametric control of the security level of an implementation. It also allows for easy integration into existing implementations (first path search).

[0061] Fig. 6 shows an access or localization system 200 with a control device 100 installed in a vehicle 103 and a radio key 102 representing the transmitter described above.

Claims

[1] Control device (100) for a motor vehicle access or localization system (200), arranged to: Identifying a received signal that has traveled from a transmitter to a receiver of the control device along the strongest signal path, peak path, as a peak path signal; Determining the signal propagation time, ToF, of the peak path signal; Determining a time offset, δ, from the signal propagation time of the peak path signal; Determining a threshold, T, for the reliability of a first path search as a function of δ; Performing the first path search at δ taking into account the threshold, and set up to: Decide that no first path signal was detected if the threshold, T, was not exceeded; Determining a new threshold value, Tnew, for the reliability of a new first path search as a function of a new time interval, δ- Δ or δ+ Δ from the signal propagation time of the peak path signal; Performing a new first path search at the new time interval, δ- Δ or δ+ Δ taking into account the new threshold, where the new threshold, Tnew, is less than or equal to the original threshold, T, if the time interval from the signal propagation time of the peak path signal has decreased. [2] Control device (100) according to claim 1, arranged to: Classifying a signal detected in the first path search as a first path signal if the threshold, T, has been exceeded; End the first path search. [3] Control device (100) according to one of the preceding claims, arranged to: function-dependent adjustment of the threshold value, T, and / or the new threshold value, Tnew. [4] Control device (100) according to one of the preceding claims, arranged to: installation position-dependent, location-dependent and / or time-dependent adjustment of the threshold value, T, and / or the new threshold value, Tnew. [5] Vehicle (103) with a control device (100) according to one of claims 1 to 4. [6] Access or localization system (200) with a control device (100) according to one of claims 1 to 4 and a radio key (102). [7] A method for operating a motor vehicle access or location system (200), comprising the steps of: Identifying a received signal that has traveled from a transmitter to a receiver of a control device along the strongest signal path, peak path, as a peak path signal; Determining the signal propagation time, ToF, of the peak path signal; Determining a time offset, δ, from the signal propagation time of the peak path signal; Determining a threshold, T, for the reliability of a first path search as a function of δ; Performing the first path search at δ taking into account the threshold, and: Decide that no first path signal was detected if the threshold, T, was not exceeded; Determining a new threshold value, Tnew, for the reliability of a new first path search as a function of a new time interval, δ- Δ or δ+ Δ from the signal propagation time of the peak path signal; Performing a new first path search at the new time interval, δ- Δ or δ+ Δ taking into account the new threshold, where the new threshold, Tnew, is less than or equal to the original threshold, T, if the time difference from the signal propagation time of the peak path signal has decreased.

Images