Passive access / passive start systems that implement a music algorithm based on arrival angle determinations for signals received via circularly polarized antennas.

Abstract

Access system (28) for a vehicle (30, 200, 108, 5200, 7800, 790), wherein the access system comprises: a plurality of antennas (414, 1102, 1104, 1410, 1424, 1428, 1438, 1440, 1502, 1504, 3102, 3104, 5300, 5302, 5304, 5306, 5412, 7000, 7602) configured to each receive a signal transmitted from a portable access device (32, 34, 400, 5206) to the vehicle (30, 200, 108, 5200, 7800, 7900), one of the plurality of antennas being a circularly polarized antenna (1104, 1428); and an access module (36, 210) that is configured to Down-conversion of the received signal to generate an in-phase signal and a quadrature-phase signal, Executing a Music algorithm to determine the arrival angles of the received signal as received by the multitude of antennas, where "Music" stands for "Multiple Signal Classification", Determining a distance between the portable access device and the vehicle based on the arrival angles, and Allowing access to the vehicle based on distance, where the access module (36, 210) is configured during execution of the Music algorithm, to: Collecting analytical signal samples of the signal received at each of the multitude of antennas to generate a received data matrix; Estimating a data covariance matrix based on the received data matrix; Using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; Determining a number of incoming signals; Splitting the MxM matrix into a multitude of matrices; Calculating a music spectrum based on one of the many matrices; and Performing a peak search on the music spectrum to determine the arrival angles, the access module (36, 210) is further configured to: Generating a time vector corresponding to the in-phase and quadrature-phase sampling vector; Discarding some of the analytical signal samples taken near antenna switching times; Unwinding each repeat portion of remaining samples with a step size π; Averaging a frequency of sine waves from the remaining samples; Finding an average slope of the remaining samples; Measuring a standard deviation of the average slope; Determine which of the many antennas is misaligned, based on the measured standard deviation; For each of the multitude of antennas, interpolating a straight line of points on a time vector to generate a reconstructed phase angle vector; If the standard deviation is greater than a predetermined threshold, check which of the many antennas has an inaccurate alignment; and for one of the many antennas, remeasuring the standard deviation of the average slope.

Description

AREA

[0001] This disclosure relates to passive access / passive start systems. BACKGROUND

[0002] The background information provided here serves the purpose of presenting the general context of the disclosure. The work of the inventors mentioned herein, to the extent described in this background section, as well as aspects of the description that do not otherwise qualify as prior art at the filing date, are neither expressly nor implicitly recognized as prior art in relation to the present disclosure.

[0003] Conventional passive access / passive start (PEPS) systems enable keyless access, including providing user access to various vehicle functions, when the user possesses a key fob that has been paired with a vehicle-based PEPS electronic control unit (or PEPS module). For example, the user in possession of the key fob can approach a vehicle equipped with the PEPS module. The key fob communicates with the PEPS module, and, if the key fob is authenticated, the PEPS module can unlock the vehicle's doors. The PEPS module (i) performs an authentication process to determine if the key fob is authorized to access the vehicle, and (ii) determines the key fob's location relative to the vehicle. The authentication process may involve the exchange of an encrypted password or signature.If the password or signature is correct, the system determines that the key fob is authorized. The key fob's location can be determined, for example, based on the strength of a signal received by the key fob. Once the key fob is authenticated and located within an authorized zone of the vehicle, access to the vehicle's interior is granted without the use of a traditional key.

[0004] As another example, the user in possession of the key fob can activate a vehicle function by pressing a button on the key fob. In response to the button press, the key fob communicates with the PEPS module, and, if the key fob is authenticated and within a predetermined distance of the vehicle, the PEPS module performs the function associated with the button pressed on the key fob (e.g., it starts the vehicle, opens a door, disarms an alarm, etc.). The communication used in these two examples can involve the key fob and the PEPS module performing a one-way low-frequency (LF) wake-up function and a one-way or two-way high-frequency / radio-frequency (RF) authentication function.

[0005] A Phone-as-a-Key (PAK) vehicle access system can operate similarly to the aforementioned PEPS system, except that access to the vehicle is granted using a mobile phone instead of a key fob. For example, the mobile phone can communicate with a PAK module or a telematics control unit (TCU) in the vehicle to initiate an access pairing process. The mobile phone and either the PAK module or the TCU then perform the access pairing process to establish a trust relationship.The pairing process may involve Bluetooth® pairing, whereby: security information is directly exchanged between the mobile phone and the vehicle; a mobile phone address, mobile phone identity resolution key, reservation identifier and / or encryption key is exchanged via a cloud-based network; and / or the mobile phone presents a certificate to the vehicle, the certificate being signed by (i) the mobile phone, (ii) a trusted security signing authority such as the vehicle manufacturer and / or (iii) a trusted third party.In the case of a certificate, the certificate may include an identifier of a person authorized to access a vehicle, an identifier of a cloud-based network authorized to transmit the certificate, an identifier of a rental or leasing agreement for the vehicle, an identifier of the vehicle, a date and time period during which the vehicle is permitted for use by the authorized person, and / or other restrictions and / or access / licensing information.

[0006] Passive access typically requires some user action to initiate a process for waking up a key fob or mobile phone (referred to as portable access devices). For example, this might involve a user approaching the vehicle with a portable access device and / or touching and / or pulling on a door handle. When a PEPS module or a PAK module, referred to as an access module, detects this behavior, the access module performs a localization process to begin searching for and waking up the key fob. In a one-way RF system, a low-frequency downlink signal (e.g., a 125 kilohertz (kHz) signal) is transmitted from the access module to the key fob to wake it up so it can send commands and data for authentication purposes.The key fob then transmits a response signal to the access module via an uplink RF link. The response signal can be an ultra-high frequency (e.g., 315 megahertz (MHz) or 433 MHz). In a two-way RF system, an LF downlink signal is transmitted from the access module to the key fob to wake it up and establish a bidirectional RF link between the access module and the key fob. The bidirectional RF link can transmit signals at a UHF frequency (e.g., 315 MHz, 422 MHz, 868 MHz, or 915 MHz). The bidirectional RF link is then used to authenticate the key fob. The key fob includes a microcontroller that remains in a sleep mode (or low-power listening mode) that continuously checks for a valid LF signal.Once a valid LF signal is present that contains a correct vehicle-specific wake-up identifier, the microcontroller generates a signal to wake up a PEPS control unit to communicate with the vehicle's access module.

[0007] A vehicle might have, for example, 4-6 LF antennas that generate an LF magnetic field. A control unit in the key fob measures an LF signal level during communication with the access module. The control unit determines a received signal strength indicator (RSSI) and sends the RSSI to the access module. The access module then determines the key fob's location based on the RSSI. The key fob includes three discrete antenna coils or a 3D coil, which are used to determine x, y, and z-axis values ​​that are indicative of the key fob's location.

[0008] A smartphone, wearable device, and / or other smart wearable network device can function as a key fob. These smart wearable network devices can enable various vehicle functions and long-range features, such as passive welcome lighting, distance binding / limitation for remote parking applications, etc.

[0009] US Patent 6,353,406 B1 describes a system for locating an object associated with a tag, wherein an external power source is physically separate from the receiving part of the receiver, such that a first tag would not be powered by the external power source if the external power source were located at the receiving part. FR 3060766 A1 discloses a method for evaluating the distance between an identifier and a vehicle, wherein an autocorrelation matrix is ​​generated based on measured amplitudes and phases, and the distance is determined by processing the autocorrelation matrix. Furthermore, KR 10 2011 0 005 917 A discloses a double-polarized antenna with an omnidirectional conical radiation pattern.Furthermore, JP 2000 / 196540 A discloses a transmitting device which emits a two-phase modulated transmit signal with a PN code sequence from a transmitting antenna, and an array antenna which receives the transmit signal sent by this transmitting device with multiple antenna elements, wherein a signal selection device selects and extracts a signal from this array antenna. SUMMARY

[0010] It is an object of the invention to provide an improved passive access / passive start (PEPS) system that addresses the disadvantages of the prior art.

[0011] The object of the invention is achieved by an access system for a vehicle according to claim 1, a vehicle according to claim 6, and a method according to claim 8. Further features and advantageous embodiments are shown in the dependent claims.

[0012] A vehicle access system is provided, comprising antennas and an access module. The antennas are configured to each receive a signal transmitted to the vehicle from a portable access device. One of the antennas is a circularly polarized antenna. The access module is configured to: step down the received signal to generate an in-phase signal and a quadrature-phase signal; execute a Music algorithm to determine the arrival angles of the received signal as it is received at the antennas; determine a distance between the portable access device and the vehicle based on the arrival angles; and allow access to the vehicle based on this distance.

[0013] Further characteristics of the antennas include: a circularly polarized antenna with a conductive ring-shaped body containing an inner hole; a circular insulator connected to the conductive ring-shaped body; and a linearly polarized antenna connected to the circularly polarized antenna and the circular insulator, extending outwards from the circular insulator. The linearly polarized antenna comprises a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

[0014] In further features, the access module is configured during / when executing the Music algorithm to: collect or acquire analytical signal samples of the signal received at each of the antennas to generate a receive data matrix; estimate a data covariance matrix based on the receive data matrix; use an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determine a number of incident / arriving signals; split the MxM matrix into multiple matrices; compute a Music spectrum based on one of the matrices; and perform a peak search on the Music spectrum to determine the arrival angles.

[0015] In further features, the access module is configured to: perform a covariance smoothing procedure to generate a modified covariance matrix; and use the eigenvalue decomposition process to determine the MxM matrix based on the modified covariance matrix.

[0016] In further features, the access module is configured, during / when generating the receive data matrix, to: convert an in-phase and quadrature phase sampling vector into a phase angle vector; generate, based on the phase angle vector, a newly generated in-phase and quadrature phase sampling vector for each of the antennas; and generate the receive data matrix based on the newly generated in-phase and quadrature phase sampling vector for each of the antennas.

[0017] In further features, the access module is configured to: generate a time vector corresponding to the in-phase and quadrature-phase sampling vector; discard some of the analytical signal samples taken near antenna switching times; unwind each repeat portion of remaining samples with a step size π; average a frequency of sine waves from the remaining samples; find an average slope of the remaining samples; measure a standard deviation of the average slope; determine which of the antennas is misaligned based on the measured standard deviation; and interpolate, for each of the antennas, a straight line of points on a time vector to generate a reconstructed phase angle vector.

[0018] In other features, the access module is configured to: if the standard deviation is greater than a predetermined threshold, check which of the antennas has an inaccurate alignment; and remeasure the standard deviation of the average slope for one of the antennas.

[0019] In further features, the access module is configured to perform a cleaning / purging procedure, comprising: performing an iterative process comprising: eliminating or removing source signals, one by one, using a calibrated array manifold including the antennas; and forcing a source signal position to an offset location and recalculating the arrival angle direction of a remaining signal. During / as the iterative process is performed, the access module converges to a new set of incident / impacting arrival angles.

[0020] Further features include a vehicle comprising a body; and a roof, center console, floor, or at least partially enclosed / surrounded metal structure. The antennas are implemented in at least one of the metal structures, including the roof, center console, floor, or at least partially enclosed / surrounded metal structure.

[0021] Further features of the antennas include a multi-axially polarized RF antenna array, wherein the multi-axially polarized RF antenna array includes the circularly polarized antenna and is oriented in the roof.

[0022] Further features provide a method comprising: receiving a signal transmitted from a portable access device to the vehicle at each of several antennas, one of which is a circularly polarized antenna; down-converting the received signal to generate an in-phase signal and a quadrature-phase signal; executing a Music algorithm to determine the arrival angles of the received signal as received at the antennas; determining a distance between the portable access device and the vehicle based on the arrival angles; and permitting access to the vehicle based on the distance.

[0023] Further features of executing the Music algorithm include: collecting analytical signal samples of the signal received at each antenna to generate a receive data matrix; estimating a data covariance matrix based on the receive data matrix; using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determining a number of incident signals; splitting the MxM matrix into multiple matrices; calculating a Music spectrum based on one of the matrices; and performing a peak search on the Music spectrum to determine the arrival angles.

[0024] In further features, the procedure additionally includes: performing a covariance smoothing procedure to generate a modified covariance matrix; and using the eigenvalue decomposition process to determine the MxM matrix based on the modified covariance matrix.

[0025] Further features of the method include, during / in the generation of the received data matrix: converting an in-phase and quadrature phase sampling vector into a phase angle vector; generating, based on the phase angle vector, a newly generated in-phase and quadrature phase sampling vector for each of the antennas; and generating the received data matrix based on the newly generated in-phase and quadrature phase sampling vector for each of the antennas.

[0026] In further features, the method additionally includes: generating a time vector corresponding to the in-phase and quadrature-phase sampling vector; discarding some of the analytical signal samples taken near antenna switching times; unwinding each repeat portion of the remaining samples with a step size π; averaging a frequency of sine waves from the remaining samples; determining an average slope of the remaining samples; measuring a standard deviation of the average slope; determining which of the antennas is misaligned or misdirected based on the measured standard deviation; and interpolating, for each of the antennas, a straight line of points on a time vector to generate a reconstructed phase angle vector.

[0027] In further features, the procedure additionally includes: if the standard deviation is greater than a predetermined threshold, checking which of the antennas has an inaccurate alignment; and remeasuring the standard deviation of the average slope for one of the antennas.

[0028] In further features, the method additionally includes performing a cleaning / purging procedure, comprising: performing an iterative process, comprising eliminating or removing source signals, one after the other, using a calibrated array manifold comprising the antennas, and forcing a position of a source signal to an offset location and recalculating an arrival angle direction of a remaining signal; and converging to a new set of incident / impact arrival angles during / as the iterative process is performed.

[0029] In further terms, the vehicle comprises (i) a body or chassis and (ii) a roof, center console, floor, or a metal structure that is at least partially enclosed. The antennas are implemented in at least one of the metal structures that is at least partially enclosed.

[0030] Further features of the antennas include a multi-axially polarized RF antenna array. This array comprises a circularly polarized antenna and is oriented towards the roof.

[0031] An access system for a vehicle is provided. The access system comprises a receiver and an access module. The receiver is configured to receive a signal transmitted to the vehicle from a portable access device. The access module is configured to: generate a differentiated signal based on the received signal; upsample the differentiated signal to generate a first upsample signal; receive or generate an expected signal; upsample the expected signal to generate a second upsample signal.upsampling of the signal; cross-correlation of the first upsampling signal and the second upsampling signal to generate a cross-correlation signal; determination, based on the cross-correlation signal, of a phase difference between the first upsampling signal and the second upsampling signal; determination of a round-trip time of the signal received by the receiver; and allowing access to the vehicle based on the round-trip time.

[0032] In further features, the access module is configured to: down-convert the signal to generate a down-convert signal; sample the down-convert signal to generate a sampled signal; perform arctangent operations on or with respect to the sampled signal to generate an arctangent signal; and differentiate the arctangent signal to generate the differentiated signal.

[0033] In further features, the access module is configured to: determine at least one location or distance of the portable access device relative to the vehicle based on the orbital period; and allow access to the vehicle based on the at least one location or distance.

[0034] The access module further comprises: a first upsampler configured to upsample the differentiated signal to generate the first upsampling signal; and a second upsampler configured to upsample the expected signal to generate the second upsampling signal. The upsampling rate of the first upsampler is the same as that of the second upsampler.

[0035] In further features, the access module includes: a sign module configured to determine the sign of the differentiated signal; and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.

[0036] In further features, the access module is configured to: receive the expected signal; and the expected signal is a predetermined signal that is received by the access module before receiving the received signal.

[0037] In further features, the access module is configured to perform an iterative process comprising: multiplying bits of the first and second up-sampling signals to generate resulting products; summing the resulting products to generate a product sum value; and shifting the second up-sampling signal relative to the first up-sampling signal. The iterative process provides product sum values. The access module is configured to determine the phase difference based on these product sum values.

[0038] In further features, the access module is configured to reconstruct the signal transmitted from the portable access device to the vehicle, based on zero crossings of a portion of the cross-correlation signal in conjunction with a maximum of the product sum values.

[0039] In further features, the access module includes: an upsampler configured to upsample the differentiated signal to generate the first upsampling signal; a sign module configured to determine the sign of the first upsampling signal; and a bit pattern module configured to generate the expected signal based on the sign of the first upsampling signal.

[0040] Further features describe a portable access device for a vehicle's access system. The portable access device comprises a receiver and a control module. The receiver is configured to receive a signal transmitted from a vehicle's access module to the portable access device. The control module is configured to: generate a differentiated signal based on the received signal; upsample the differentiated signal to generate a first upsample signal; receive or generate an expected signal; and upsample the expected signal to generate a second upsample signal.upsampled signal; cross-correlation of the first upsampling signal and the second upsampling signal to generate a cross-correlation signal; determination, based on the cross-correlation signal, of a phase difference between the first upsampling signal and the second upsampling signal; determination of a round-trip time of the signal received by the receiver; and either transmitting the round-trip time to the vehicle to gain access to the vehicle based on the round-trip time, or determining at least one of a location or distance between the portable access device and the vehicle and transmitting at least one of that location or distance to the vehicle to gain access to the vehicle.

[0041] In further features, the control module is configured to: step down the signal to generate a step-down signal; sample the step-down signal to generate a sampled signal; perform arctangent operations on the sampled signal to generate an arctangent signal; and differentiate the arctangent signal to generate the differentiated signal.

[0042] In further features, the control module is configured to: determine at least one location or distance of the portable access device relative to the vehicle based on the orbital period; and transmit that at least one location or distance to the vehicle to gain access to the vehicle based on that location or distance.

[0043] In further features, the control module includes: a first upsampler configured to upsample the differentiated signal to generate the first upsampling signal; and a second upsampler configured to upsample the expected signal to generate the second upsampling signal, wherein the upsampling rate of the first upsampler is the same as that of the second upsampler.

[0044] In further features, the control module includes: a sign module configured to determine the sign of the differentiated signal; and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.

[0045] In further features, the control module is configured to: receive the expected signal; and the expected signal is a predetermined signal that is received by the control module before receiving the received signal.

[0046] In further features, the control module is configured to perform an iterative process comprising: multiplying bits of the first and second up-sampling signals to generate resulting products; summing the resulting products to generate a product sum value; and shifting the second up-sampling signal relative to the first up-sampling signal. The iterative process provides product sum values. The control module is configured to determine the phase difference based on these product sum values.

[0047] In further features, the control module is configured to reconstruct the signal transmitted from the vehicle's access module to the portable access device, based on zero crossings of a portion of the cross-correlation signal in conjunction with a maximum of the product sum values.

[0048] Further features of the control module include: an upsampler configured to upsample the differentiated signal to generate the first upsampling signal; a sign module configured to determine the sign of the first upsampling signal; and a bit pattern module configured to generate the expected signal based on the sign of the first upsampling signal.

[0049] A vehicle access system is provided. The access system includes antennas and an access module. The antennas are configured to each receive a signal transmitted to the vehicle from a portable access device. The signal is transmitted at a 2.4 GHz frequency. The access module is configured to: step down the received signal to generate an in-phase signal and a quadrature-phase signal; perform a carrier-phase-based distance measurement, comprising implementing a Music algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine the arrival angles of the received signal as received at the antennas; determine a location of the portable access device relative to the vehicle based on the distance and the arrival angles; and grant access to the vehicle based on the location.

[0050] In other features, the antennas in the vehicle are arranged in such a way that the received signal has several corresponding bounce paths between the portable access device and the antennas.

[0051] In other features, the antennas are integrated into a metal structure of the vehicle.

[0052] In other features, the antennas are positioned in such a way that there is no line of sight or connection between the antennas and the portable access device.

[0053] In further features, the access system additionally includes sensors, each of which comprises two or more of the antennas, and the sensors are arranged in the vehicle such that the received signal has several corresponding bounce paths between the portable access device and each of the sensors.

[0054] In other features, the access module is configured to: monitor the received signal and generate a received signal strength indicator based on the received signal; determine whether the portable access device is inside or outside the vehicle based on the received signal strength indicator; and determine the distance between the portable access device and the vehicle when the portable access device is outside the vehicle.

[0055] In other characteristics, at least one of the antennas is a circularly polarized antenna.

[0056] Further features of the antennas include: a circularly polarized antenna with a conductive ring-shaped body containing an inner hole; a circular insulator connected to the conductive ring-shaped body; and a linearly polarized antenna connected to the circularly polarized antenna and the circular insulator, extending outwards from the circular insulator. The linearly polarized antenna comprises a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

[0057] In further features, the access module is configured during / during implementation of the Music algorithm to: collect or acquire analytical signal samples of the signal received at each of the antennas to generate a receive data matrix; estimate a data covariance matrix based on the receive data matrix; use an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determine a number of incident signals; decompose the MxM matrix into matrices; compute a Music spectrum based on one of the matrices; and perform a peak search on the Music spectrum to determine the arrival angles.

[0058] In addition, the receiver includes a phase-locked loop and is phase-locked / phase-locked to a transmitter of the portable access device. The access module is configured to perform tone exchanges with the transmitter and determine at least one of the distances or arrival angles based on these tone exchanges.

[0059] In addition, the receiver includes a phase-locked loop and is phase-locked / phase-locked to a transmitter of the portable access device. The access module is configured to: perform tone exchanges with the transmitter and determine a round-trip time of flight information based on the tone exchanges; and determine the distance based on the round-trip time of flight information.

[0060] Further features include a vehicle comprising: the access system; a body or chassis; and a roof, center console, floor, or at least partially enclosed / surrounded metal structure. The antennas are implemented in at least one of the metal structures enclosed / surrounded by the roof, center console, floor, or at least partially enclosed / surrounded.

[0061] Further features provide a method comprising: receiving a signal transmitted from a portable access device to the vehicle at each of several antennas, the signal being transmitted at a 2.4 gigahertz frequency; down-converting the received signal to generate an in-phase signal and a quadrature-phase signal; performing a carrier-phase-based distance measurement, comprising implementing a Music algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine arrival angles of the received signal as received at the antennas; determining a location of the portable access device relative to the vehicle based on the distance and the arrival angles; and permitting access to the vehicle based on the location.

[0062] In other features, the antennas in the vehicle are arranged in such a way that the received signal has several corresponding bounce paths between the portable access device and the antennas.

[0063] In other features, the antennas are positioned in such a way that there is no line of sight or connection between the antennas and the portable access device.

[0064] In other features, the antenna pairs are implemented as part of their respective sensors. The sensors are arranged in the vehicle such that the received signal has several corresponding bounce paths between the portable access device and each sensor.

[0065] Further features of the method include: monitoring the received signal and generating a received signal strength indicator based on the received signal; determining whether the portable access device is inside or outside the vehicle, based on the received signal strength indicator; and determining the distance between the portable access device and the vehicle when the portable access device is outside the vehicle.

[0066] In other characteristics, at least one of the antennas is a circularly polarized antenna.

[0067] Further features of the procedure, during implementation of the Music algorithm, include: collecting analytical signal samples of the signal received at each antenna to generate a receive data matrix; estimating a data covariance matrix based on the receive data matrix; using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; determining a number of incident signals; splitting the MxM matrix into multiple matrices; calculating a Music spectrum based on one of the matrices; and performing a peak search on the Music spectrum to determine the arrival angles.

[0068] Further features of the method include: performing tone exchanges with a transmitter of the portable access device; and determining at least one of the distances or arrival angles based on the tone exchanges. A receiver of the portable access device, which performs the tone exchanges, includes a phase-locked loop and is phase-locked / phase-interlocked with a transmitter of the portable access device.

[0069] The method further includes: performing tone exchanges with the transmitter and determining a round-trip time of flight information based on these tone exchanges; and determining the distance based on the round-trip time of flight information. A receiver of the portable access device, which performs the tone exchanges, includes a phase-locked loop and is phase-locked to a transmitter of the portable access device.

[0070] A multi-axially polarized RF antenna array is provided, comprising a circularly polarized antenna, a circular insulator, and a linearly polarized antenna. The circularly polarized antenna includes a conductive ring-shaped body with an internal hole. The circular insulator is connected to the conductive ring-shaped body. The linearly polarized antenna is connected to the circularly polarized antenna and the circular insulator and extends outward from the circular insulator. The linearly polarized antenna includes a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

[0071] In other characteristics, the conductive element is a wire. In other characteristics, the casing is made of polytetrafluoroethylene. The conductive element is made of copper.

[0072] In other features, the linearly polarized antenna is configured so that it extends downwards from the circularly polarized antenna when in use.

[0073] In other respects, the circularly polarized antenna is a two-axis antenna. The linearly polarized antenna is a single-axis antenna.

[0074] In further features, the multi-axially polarized RF antenna array additionally includes a ground plane. The circular insulator is positioned on the ground plane, between the conductive element and the ground plane, and between the circularly polarized antenna and the ground plane.

[0075] In other features, the circularly polarized antenna includes two feed points that are 90° phase-shifted and configured to receive signals that are 90° out of phase with each other.

[0076] Further specifications describe a vehicle comprising a body and a roof. The roof incorporates the multi-axially polarized RF antenna array. This array is oriented within the roof such that the linearly polarized antenna extends downwards from the circularly polarized antenna.

[0077] Further features include a vehicle system comprising a multi-axis polarized RF antenna array, a second multi-axis polarized RF antenna array, and an access module. The first multi-axis polarized RF antenna array is configured for implementation in a vehicle. The second multi-axis polarized RF antenna array is configured for implementation in the vehicle and comprises: a second circularly polarized antenna with a second conductive annular body having a second internal hole; a second circular insulator connected to the second conductive annular body; and a second linearly polarized antenna connected to the second circular insulator and extending outward from the second circular insulator.The second linearly polarized antenna comprises a shell and a conductive element extending through the shell. The second linearly polarized antenna extends orthogonally to a radius of the second circularly polarized antenna. The access module is connected to the first multiaxially polarized RF antenna array and the second multiaxially polarized RF antenna array and is configured to communicate with a portable access device via the first and second multiaxially polarized RF antenna arrays.

[0078] In further features, at any given time at least one of the linearly polarized antennas or the first multi-axially polarized RF antenna array is not cross-polarized with an antenna of the second multi-axially polarized RF antenna array.

[0079] In further features, the access module is configured to perform passive access / passive start operations or phone-as-a-key operations, encompassing the transmission and reception of high / radio frequency signals via the first of the multi-axis polarized RF antenna arrays and the second of the multi-axis polarized RF antenna arrays.

[0080] In other features, the access module is configured to allow access to the vehicle based on high / radio frequency signals.

[0081] In further features, the access module is configured to execute an algorithm to determine which antenna pair from the first and second multi-axis polarized RF antenna arrays should be used for communication with the portable access device. In further features, the portable access device is a key fob or a cellular / mobile phone.

[0082] Further features provide a method for communicating with a portable access device. The method comprises iteratively executing an algorithm via a vehicle access module, the algorithm comprising a sequence of operations including: selecting a frequency from frequencies; selecting an antenna pair from possible antenna pairs, wherein the antennas of the possible antenna pairs include antennas with differently polarized axes; transmitting a packet to the portable access device via the selected antenna pair; receiving a first receive signal strength indicator (RSSI) and a response signal from the portable access device, the first RSSI corresponding to the packet transmission; and measuring a second RSSI of the response signal. Based on the first and second RSSIs, a best frequency and a best antenna pair from the possible antenna pairs are selected.One or more additional packets will be transmitted using the selected best frequency and the selected best antenna pair.

[0083] In other characteristics, each selected antenna pair includes one linearly polarized antenna and one circularly polarized antenna.

[0084] In further features, the procedure additionally includes: transmitting the one or more additional packages for authorizing the portable access device; determining whether the portable access device is authorized to access an interior of the vehicle; and permitting access to an interior of the vehicle if the portable access device is authorized.

[0085] In further features, the method additionally includes: measuring a flight time of the one or more additional packets, comprising a time to transmit from the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device; and estimating a distance between the vehicle and the portable access device based on the measured flight time.

[0086] Further features describe the use of the estimated distance to detect whether another device is attempting to carry out a range extender-type relay station attack. Further features describe the method as additionally including, if the other device attempts to carry out a range extender-type relay station attack, taking countermeasures, including preventing access to the vehicle's interior. Further features describe the countermeasures as including notifying the vehicle's owner of the range extender-type relay station attack.

[0087] Further features of the method include: exchanging multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, wherein the pairs of unmodulated carrier tones comprise received tones and transmitted tones; measuring a phase of received tones relative to transmitted tones and acquiring or obtaining frequency data; and estimating a distance between the vehicle and the portable access device based on the measured phases and the frequency data.

[0088] Further features of the method include determining whether another device is attempting to carry out a range extender-type relay station attack, based on the estimated distance. Further features include each selected antenna pair comprising linearly polarized antennas.

[0089] Further features of the algorithm include switching between possible antenna pairs between successively transmitted packets. Further features of the algorithm include switching between possible antenna pairs during the transmission of a portion of a packet. Further features specify that the portion of the packet is a continuous wave tone.

[0090] In other characteristics, some of the possible antenna pairs include two antennas that are colocated or arranged together.

[0091] Further features of the method include: transmitting packets to the portable access device; measuring time-of-flight values ​​for the packets based on response signals received by the portable access device, with the response signals being transmitted based on the packets; determining whether the other device is carrying out a range extender-type relay station attack, based on the time-of-flight values; and preventing access to an interior of the vehicle in response to detection of the range extender-type relay station attack.

[0092] In further features, the portable access device is a key fob or a cellular / mobile phone. In further features, the method additionally includes encrypting an identifier of the best antenna pair. The transmission of one or more additional packets includes the encrypted identifier of the best antenna pair.

[0093] Further features describe a vehicle system for communicating with a portable access device. The vehicle system includes antennas with differently polarized axes and an access module. The access module is configured to iteratively execute an algorithm. The algorithm comprises a sequence of operations, including: selecting a frequency from several frequencies; selecting an antenna pair from the antennas with differently polarized axes; transmitting a packet to the portable access device via the selected antenna pair; receiving an initial RSSI and a response signal from the portable access device, the initial RSSI corresponding to the packet transmission; and measuring a second RSSI of the response signal.The access module is configured to: select one of the best frequencies and one of the best antenna pairs based on the first RSSIs and the second RSSIs; and transmit one or more additional packets using the selected best frequency and the selected best antenna pair.

[0094] In further features, the access module is configured to: measure a flight time of the one or more additional packets, comprising a time to transmit from the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device; and estimate a distance between the vehicle and the portable access device based on the measured flight time.

[0095] In further features, the access module is configured to: exchange multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, the unmodulated carrier tones comprising received and transmitted tones; measure the phases of the received tones relative to the transmitted tones; acquire or obtain the measured phase and frequency data; and estimate a distance between the vehicle and the portable access device using the measured phase and frequency data.

[0096] In other features, the access module is configured to detect whether the portable access device is attempting to perform a range extender-type relay station attack, based on the estimated distance.

[0097] In other features, the access module is configured to detect whether a device is attempting to carry out a range extender-type relay station attack, based on the estimated distance.

[0098] In other features, the access module is configured to take countermeasures if the portable access device attempts to carry out a range extender-type relay station attack, including preventing access to the interior of the vehicle.

[0099] Further features of the countermeasure include notifying the vehicle owner about the range extender-type relay station attack. Further features include the portable access device being a key fob or a cellular / mobile phone.

[0100] In addition, the portable access device is configured to encrypt an identifier of the best antenna pair. The transmission of one or more additional packets includes the encrypted identifier of the best antenna pair.

[0101] Further features include a system for detecting a range-extending relay attack. The system comprises a first transmitter, a receiver, and a first module. The first transmitter is configured to transmit an initial high-frequency / radio frequency signal from one vehicle and portable access device to another vehicle and portable access device. The receiver is configured to receive an initial response signal from one of the vehicles and portable access devices in reply to the initial high-frequency / radio frequency signal.The first module is configured to: monitor or generate one or more parameters related to the transmission of the initial high / radio frequency signal and the reception of the initial response signal; detect, based on the one or more parameters, the range-enhancing relay-type attack carried out by an attacking device to obtain at least one of access to or operational control from the vehicle, wherein at least one of: (i) the initial high / radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the initial response signal is relayed via the attacking device from the portable access device to the vehicle; and perform a countermeasure in response to detection of the range-enhancing relay-type attack.

[0102] The first module is implemented in the vehicle in further features. The first module is implemented in the portable access device in further features.

[0103] In other features, the first module is configured to: measure the round-trip time of the first high / radio frequency signal; and detect the range-enhancing relay attack based on the round-trip time.

[0104] In further features, the first module is configured to: transmit a second high / radio frequency signal and receive a second response signal prior to transmitting the first high / radio frequency signal and receiving the first response signal; monitor at least one of the first received signal strength indicators of the second high / radio frequency signal or the second received signal strength indicator of the second response signal; and determine, based on at least one of the first received signal strength indicators or the second received signal strength indicator, at least one of a path, frequency, channel, or antenna pair for transmitting the first high / radio frequency signal and receiving the first response signal.

[0105] In further features, the first module is configured to: transmit a second high / radio frequency signal and receive a second response signal prior to transmitting the first high / radio frequency signal and receiving the first response signal; monitor an antenna polarization state corresponding to at least one of the second high / radio frequency signal or the second response signal; and determine, based on the antenna polarization state of at least one of the first high / radio frequency signal or the first response signal, at least one of a path, frequency, channel, or antenna pair for transmitting the first high / radio frequency signal and receiving the first response signal.

[0106] In further features, the first module is configured to transmit the first high / radio frequency signal, while the first response signal or a second high / radio frequency signal is received by one of the vehicle and the portable access device.

[0107] In other features, the first module is configured to receive the first response signal, while a second high / radio frequency signal is received from one of the vehicle and the portable access device.

[0108] In further features, the first module is configured to: determine a sequence of randomly selected frequencies or channels; share the sequence of randomly selected frequencies or channels with a vehicle and portable access device; and transmit the first high / radio frequency signal and receive the first response signal based on the randomly selected frequencies or channels.

[0109] In further features, the first module is configured to: randomize access addresses for the vehicle or portable access device; share the randomized access addresses with the portable access device; and generate the first high / radio frequency signal so that it includes one of the access addresses.

[0110] In further features, the first module is configured to: measure a length of at least one bit of the first response signal; and detect the range-enhancing relay attack based on the length of the at least one bit.

[0111] In other features, the first module is configured to: monitor the slopes of the rising and falling edges of the first response signal; and detect the range-enhancing relay attack based on the slopes.

[0112] In further features, the first module is configured to: use a sliding correlation function to align or match the first response signal with an idealized Gaussian waveform for a known bit pattern and bit rate, including scaling of peaks or peak values ​​and aligning or matching zero-point shifts; and detect the range-enhancing type relay attack based on the alignment or match.

[0113] In further features, the first module is configured to: accumulate portions of the initial response signal that occur early after a zero crossing and before the next peak of a predetermined waveform; determine an average based on the accumulated portions; and detect the range-enhancing relay attack based on the average.

[0114] In further features, the first module is configured to: accumulate portions of the initial response signal that are late after a peak and before the next zero crossing of a predetermined waveform; determine an average based on the accumulated portions; and detect the range-enhancing relay attack based on the average.

[0115] In further features, the first module is configured to randomize the propagation direction of the first high / radio frequency signal, which includes whether the first high / radio frequency signal is transmitted from the vehicle to the portable access device or from the portable access device to the vehicle.

[0116] Further features of the countermeasure include preventing at least one unauthorized access to or control of the vehicle's operation.

[0117] In other features, the system also includes a second transmitter configured to transmit a dummy signal while the first transmitter transmits the first high / radio frequency signal or the receiver receives the first response signal.

[0118] Further features of the system include: the first module, which is implemented in the vehicle; and the portable access device, which includes a second module. The first module is configured to transmit the first radio frequency signal to the portable access device and receive the first response signal from the portable access device. The second module is configured to transmit a second radio frequency signal to the vehicle and receive a second response signal from the vehicle. At least one of the following occurs: the first module transmits the first radio frequency signal while the second module transmits the first response signal or the second radio frequency signal, or the first module receives the first response signal while the second module transmits the second radio frequency signal.

[0119] In further features, the first and second modules are configured to: exchange at least three pairs of radio signals containing sections of unmodulated carrier tones, where the unmodulated carrier tones comprise received and transmitted tones; and measure the phases of the received tones relative to the transmitted tones. One or more of the first and second modules are configured to: acquire frequency and phase information; and estimate the distance between the first and second modules based on the phase and frequency information.

[0120] In further features, one or more of the first module and the second module are configured to use the estimated distance to detect a range-enhancing relay-type attack.

[0121] Further features provide a method for detecting a range-extending relay attack. The method comprises: transmitting, via a transmitter, a high / radio frequency signal from one vehicle and portable access device to another vehicle and portable access device; receiving, via a receiver, a response signal from one vehicle and portable access device in reply to the high / radio frequency signal; monitoring or generating one or more parameters related to the transmission of the high / radio frequency signal and the reception of the response signal; and detecting, based on the one or more parameters, the range-extending relay attack carried out by an attacking device to obtain at least one access to or operational control of the vehicle.At least one of the following occurs: (i) the radio / high frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attacking device. The method further comprises: taking a countermeasure in response to detection of the range-extending relay-type attack; measuring a round-trip time of the radio / high frequency signal; monitoring at least one of a first received signal strength indicator of the radio / high frequency signal or a second received signal strength indicator of the response signal; and detecting the range-extending relay-type attack based on the round-trip time.

[0122] Further features describe a system for accessing or providing operational control from a vehicle. The system comprises a master device, including: a first antenna module with first antennas with differently polarized axes; a transmitter configured to transmit a challenge signal via the first antenna module from the vehicle to a slave device, the slave device being a portable access device; and a first receiver configured to receive a response signal in reply to the challenge signal from the slave device. The system further includes a first sniffer or...A sniffer device comprising: a second antenna module with second antennas having differently polarized axes; and a second receiver configured to receive, via the second antenna module, the challenge signal from the transmitter and the response signal from the slave device. The first sniffer device is configured to measure when the challenge signal and the response signal arrive at the first sniffer device in order to provide arrival times. The master device or the first sniffer device is configured to (i) estimate at least one of a distance from the vehicle to the slave device or a location of the slave device relative to the vehicle based on the arrival times, and (ii) prevent at least one of access to or operational control of the vehicle based on the estimated one of the distance or location.

[0123] In further features, the master device or first sniffer device is configured to: determine a round-trip time associated with the transmission of the challenge signal, based on the arrival times; and detect, based on the round-trip time, a range-extending relay attack carried out by an attacking device to gain at least one access to or operational control of the vehicle. The response signal is relayed by the attacking device from the slave device to the vehicle and modified by the attacking device. The master device is configured to perform a countermeasure in response to the detection of the range-extending relay attack.

[0124] In further characteristics and at every point in time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0125] In other characteristics and at every point in time, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

[0126] In further features, the master device or first sniffer device is configured to: determine a first time value for the first sniffer device to receive the challenge signal and a second time value for the sniffer device to receive the response signal; and estimate the distance based on the first time value and the second time value.

[0127] The system also includes a second and a third sniffer. The second sniffer comprises a third antenna module with third antennas and a third receiver configured to receive, via the third antenna module, the challenge signal from the transmitter and the response signal from the slave device. The third sniffer comprises a fourth antenna module with fourth antennas and a fourth receiver configured to receive, via the fourth antenna module, the challenge signal from the transmitter and the response signal from the slave device. The second sniffer is configured to measure when the challenge signal and the response signal arrive at the second sniffer in order to provide arrival times.The third sniffer device is configured to measure when the challenge signal and the response signal arrive at the third sniffer device in order to provide arrival times. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the arrival times provided by the first sniffer device, the arrival times provided by the second sniffer device, and the arrival times provided by the third sniffer device.

[0128] In further features, the first sniffer device is configured to determine a first time value for receiving the response signal. The second sniffer device is configured to determine a second time value for receiving the response signal. The third sniffer device is configured to determine a third time value for receiving the response signal. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the first, second, and third time values, respectively.

[0129] In further features, the master device is configured to periodically send the challenge signal or further challenge signals to the slave device and receive the respective response signals from the slave device. The first sniffer device is configured to measure when the challenge signals and the response signals arrive at the first sniffer device in order to provide corresponding arrival times. The master device or the first sniffer device is configured to (i) update the distance or location of at least one device based on the arrival times associated with the challenge signals and the response signals, and (ii) prevent at least one device from accessing or controlling the operation of the vehicle based on the updated distance or location.

[0130] Further features describe a method for accessing or providing operational control from a vehicle. The method comprises: transmitting a challenge signal via a first antenna module from a master device of the vehicle to a slave device, wherein the first antenna module comprises first antennas with differently polarized axes; receiving, at a first receiver, a response signal in reply to the challenge signal from the slave device; receiving, at a first sniffer device, via a second antenna module and a second receiver, the challenge signal from the master device and the response signal from the slave device, wherein the second antenna module comprises second antennas with differently polarized axes;Measuring when the challenge signal and the response signal are received at the first sniffer device to provide arrival times via the first sniffer device; estimating at least one distance from the vehicle to the slave device or a location of the slave device relative to the vehicle based on the arrival times; and preventing at least one access to or operational control of the vehicle based on the estimated distance or location.

[0131] Further features of the method include: determining a round-trip time associated with the transmission of the challenge signal based on the arrival times; detecting, based on the round-trip time, a range-enhancing relay-type attack carried out by an attacking device to obtain at least one access to or operational control signal from the vehicle, wherein the response signal is relayed via the attacking device from the slave device to the vehicle and modified by the attacking device; and carrying out a countermeasure in response to the detection of the range-enhancing relay-type attack.

[0132] In further characteristics and at every point in time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0133] In other characteristics and at every point in time, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

[0134] In further features, the procedure additionally includes: determining a first time value for the first sniffer device to receive the challenge signal and a second time value for the sniffer device to receive the response signal; and estimating the distance based on the first time value and the second time value.

[0135] The method further comprises: receiving, at a third receiver of a second sniffer device, via a third antenna module, the challenge signal from the transmitter and the response signal from the slave device, wherein the third antenna module comprises third antennas with differently polarized axes; and receiving, at a fourth receiver of a third sniffer device, via a fourth antenna module, the challenge signal from the transmitter and the response signal from the slave device. The fourth antenna module comprises fourth antennas with differently polarized axes.The procedure additionally includes: measuring when the challenge signal and the response signal arrive at the second sniffer device to provide arrival times via the second sniffer device; measuring when the challenge signal and the response signal arrive at the third sniffer device to provide arrival times via the third sniffer device; and estimating the location based on the arrival times provided by the first sniffer device, the arrival times provided by the second sniffer device, and the arrival times provided by the third sniffer device.

[0136] In further features, the procedure additionally includes: determining a first time value for the first sniffer device to receive the response signal; determining a second time value for the second sniffer device to receive the response signal; determining a third time value for the third sniffer device to receive the response signal; and estimating the location based on the first time value, the second time value, and the third time value.

[0137] Further features include the periodic transmission of the challenge signal or further challenge signals from the master device to the slave device and the receipt of respective response signals from the slave device; measuring, at the first sniffer device, when the challenge signals and the response signals arrive at the first sniffer device in order to provide corresponding arrival times; updating of at least one of the distance or location based on the arrival times associated with the challenge signals and the response signals; and preventing at least one of the vehicle from accessing or controlling its operation based on the updated distance or location.

[0138] Further features describe a system for accessing or providing operational control from a vehicle. The system comprises a first network device and a control module. The first network device includes a first antenna module, a transmitter, and a receiver. The first antenna module includes antennas with differently polarized axes. The transmitter is configured to transmit a sequence of tones from the vehicle to a second network device via the first antenna module, changing the frequencies of the tones during transmission. At any given time, at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device. The receiver is configured to receive the sequence of tones from the second network device.The control module is configured to (i) determine differences in phase of successive tones versus differences in frequency of successive tones, (ii) determine a distance between the first network device and the second network device based on the differences in phase and the differences in frequency, and (iii) prevent at least one unauthorized access to or operational control of the vehicle based on the distance.

[0139] In other features, the control module is configured to: change, for each of the tones, a corresponding frequency during / during transmission of that tone; generate curves for each of the tones that relate changes in phase of each of the tones to changes in frequency; determine slopes of the curves; and determine the distance based on the slopes of the curves.

[0140] In other features, the control module randomizes a channel selected for the transmission of the sequence of tones.

[0141] In further features, the control module randomizes the direction in which tones are transmitted between the first network device and the second network device. The tones comprise one or more of the tones in the sequence of tones.

[0142] In other features, the control module is configured to: transmit and receive a sequence of tones via the transmitter and receiver; and determine the distance based on differences in phase and corresponding differences in frequency of the sequence of tones.

[0143] In further features, the system additionally includes a second network device. The first network device comprises a first tone exchange responder and a first tone exchange initiator. The first tone exchange initiator is the transmitter. The first tone exchange responder is the receiver. The second network device comprises a second tone exchange responder and a second tone exchange initiator. The second tone exchange responder responds to the sequence of tones by transmitting the sequence of tones or a second sequence of tones back to the first tone exchange initiator. The second tone exchange initiator transmits a third sequence of tones to the first tone exchange responder.

[0144] In further features, the control module is configured to determine the distance based on at least one of (i) differences in phases of the second sequence of tones versus differences in frequencies of the second sequence of tones or (ii) differences in phases of the third sequence of tones versus differences in frequencies of the third sequence of tones.

[0145] In other features, the first network device is implemented within the vehicle. The second network device is a portable access device.

[0146] In further features, the first network device simultaneously transmits two symbols on two different frequencies to the second network device. The two symbols are each less than or equal to 1 µs in length to prevent a successful attack.

[0147] In further features, the clock timings of the first and second network devices are synchronized. The first network device transmits a first symbol to the second network device at a first frequency. The second network device transmits a second symbol to the first network device simultaneously with the transmission of the first symbol from the first network device to the second network device. The first and second symbols are each less than or equal to 1 µs in length to prevent a successful attack.

[0148] Further features describe a method for accessing and providing operational control from a vehicle. The method comprises: transmitting a sequence of tones from a first network device via a transmitter and a first antenna module to a second network device; changing the frequencies of the tones during / in the transmission of the sequence of tones, wherein the first antenna module comprises antennas, and wherein at any given time at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device; receiving, at a receiver in the vehicle, the sequence of tones from the second network device; and determining differences in the phases of the sequence of tones versus differences in the frequencies of the sequence of tones.Determining a distance between the first network device and the second network device based on the phase and frequency differences; and preventing at least one unauthorized access to or operational control of the vehicle based on that distance.

[0149] In further features, the method additionally includes: changing, for each of the tones, a corresponding frequency during / at the transmission of that tone; generating curves for each of the tones that relate changes in phase of each of the tones to changes in frequency; determining the slopes of the curves; and determining the distance based on the slopes of the curves.

[0150] In other features, the method also includes randomizing a channel selected for transmitting the sequence of tones.

[0151] In further features, the method additionally includes randomizing the direction in which tones are transmitted between the first network device and the second network device. The tones comprise one or more of the tones in the sequence of tones.

[0152] In further features, the method additionally includes: transmitting and receiving a sequence of tones via the transmitter and receiver; and determining the distance based on differences in phases and corresponding differences in frequencies of the sequence of tones.

[0153] In further features, the method additionally includes: responding to the sequence of tones via a second tone exchange responder of the second network device by transmitting the sequence of tones or a second sequence of tones back to a first tone exchange initiator of the first network device, wherein the first tone exchange initiator comprises the sender; and transmitting a third sequence of tones via a second tone exchange initiator of the second network device to a first tone exchange responder of the first network device, wherein the first tone exchange responder comprises the receiver.

[0154] In further features, the method additionally includes determining the distance based on at least one of (i) differences of phases of the second sequence of tones versus differences of frequencies of the second sequence of tones or (ii) differences of phases of the third sequence of tones versus differences of frequencies of the third sequence of tones.

[0155] In other features, the first network device is implemented in the vehicle. The second network device is a portable access device.

[0156] Further features describe a system for accessing or providing operational control from a vehicle. The system comprises an initiator device and a sniffer device. The initiator device comprises: a first antenna module with multiple or multi-polarized antennas; a transmitter configured to transmit a first audio signal via the first antenna module from the vehicle to a responder device, the responder device being a portable access device; and a first receiver configured to receive a second audio signal from the responder device in response to the first audio signal. The sniffer device comprises: a second antenna module with multiple or multi-polarized antennas; a transmitter configured to transmit a first audio signal via the first antenna module from the vehicle to a responder device, the responder device being a portable access device; and a first receiver configured to receive a second audio signal from the responder device in response to the first audio signal.Multi-polarized antennas; and a second receiver configured to receive, via the second antenna module, the first tone signal from the transmitter and the second tone signal from the responder device. The sniffer device is configured to determine the states of the first tone signal and the second tone signal, including their respective phase delays. The initiator device or the sniffer device is configured to (i) estimate at least one access point from a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the first tone signal and the second tone signal, including their respective phase delays, and (ii) prevent at least one access point to or operational control of the vehicle based on the estimated access point from the first distance or the second distance.

[0157] In further features, the initiator device or sniffer device is configured to estimate the first distance and the second distance and to prevent at least one unauthorized access to or operational control of the vehicle based on the first distance and the second distance.

[0158] In further features, the initiator device or sniffer device is configured to detect, based on at least one of the first or second distances, a range-enhancing relay-type attack carried out by an attacking device to gain at least one access to or operational control of the vehicle. The second tone signal is relayed by the responder device to the vehicle and modified by the attacking device. The initiator device is configured to perform a countermeasure in response to the detection of the range-enhancing relay-type attack.

[0159] In further characteristics and at every point in time, at least one of the multiple or multiply polarized antennas of the first antenna module is not cross-polarized with at least one of the multiple or multiply polarized antennas of the second antenna module.

[0160] In other characteristics and at every point in time, at least one of the multiple or multiply polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

[0161] In further features, the initiator device or the sniffer device is configured to: determine, based on the state of the first tone signal when it is received at the responder device, a first time value for the first tone signal to propagate from the initiator device to the responder device; determine, based on the state of the second tone signal when it is received at the sniffer device, a second time value for the second tone signal to propagate from the responder device to the sniffer device; and estimate the first distance and the second distance based on the first time value and the second time value.

[0162] In further features, the initiator device or the sniffer device is configured to: generate a first representation of the first tone signal when it is received at the responder device, in the form of a natural logarithm; generate a second representation of the first tone signal when it is received at the sniffer device, in the form of a natural logarithm; generate a third representation of the second tone signal when it is received at the sniffer device, in the form of a natural logarithm; and estimate the first distance and the second distance based on the first representation, the second representation, and the third representation.

[0163] Further features describe a method for accessing or providing operational control from a vehicle. The method comprises: transmitting a first audio signal via a first antenna module from an initiator device of the vehicle to a responder device, wherein the first antenna module comprises multiple or multi-polarized antennas, and wherein the responder device is a portable access device; receiving, at the initiator device, a second audio signal from the responder device in response to the first audio signal; receiving, at a sniffer device and via a second antenna module, the first audio signal from the transmitter and the second audio signal from the responder device, wherein the second antenna module comprises multiple or multi-polarized antennas.comprising multiply polarized antennas; determining, at the sniffer device, the states of the first tone signal and the second tone signal, including their respective phase delays; estimating at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the first tone signal and the second tone signal, including their respective phase delays; and preventing at least one of access to or operational control from the vehicle based on the estimated at least one of the first distance or the second distance.

[0164] Further features of the method include: estimating the first distance and the second distance; and preventing at least one unauthorized access to or operational control of the vehicle based on the first distance and the second distance.

[0165] In further features, the method additionally includes: detecting, based on at least one of the first distances or the second distances, a range-enhancing relay-type attack carried out by an attacking device to obtain at least one of the access to or operational control of the vehicle, wherein the second tone signal is relayed from the responder device to the vehicle and modified by the attacking device; and carrying out a countermeasure in response to the detection of the range-enhancing relay-type attack.

[0166] In further characteristics and at every point in time, at least one of the multiple or multiply polarized antennas of the first antenna module is not cross-polarized with at least one of the linearly polarized antennas or the multiple or multiply polarized antennas.

[0167] In other characteristics and at every point in time, at least one of the multiple or multiply polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

[0168] In further features, the method additionally includes: determining, based on the state of the first tone signal when it is received at the responder device, a first time value for the first tone signal to propagate from the initiator device to the responder device; determining, based on the state of the second tone signal when it is received at the sniffer device, a second time value for the second tone signal to propagate from the responder device to the sniffer device; and estimating the first distance and the second distance based on the first time value and the second time value.

[0169] Further features describe a system for accessing or providing operational control from a vehicle. The system comprises a first network device and a control module. The first network device comprises a first antenna module and a control module. The first antenna module comprises multiple or multi-polarized antennas; a transmitter configured to transmit an initiator packet via the first antenna module from the vehicle to the second network device, wherein the initiator packet comprises a synchronization access word and a first continuous-wave (CW) tone; one of the first network devices and the second network device are implemented within the vehicle, and the other of the first and second network devices is a portable access device; and at any given time, at least one of the multiple or multi-polarized antennas is active.The multi-polarized antennas of the first antenna module are not cross-polarized with an antenna of the second network device; and a receiver configured to receive a response packet from the second network device, the response packet comprising the synchronization access word and the first CW tone. The control module is configured to (i) determine that a difference in round-trip time between the initiator packet and the response packet is greater than a predetermined threshold, (ii) detect, based on a time difference greater than the predetermined threshold, a range-extension-type relay attack being carried out by an attacking device to obtain at least one access to or operational control from the vehicle, and (iii) prevent at least one access to or operational control from the vehicle in response to detection of the range-extension-type relay attack.

[0170] In other features, the control module is configured to: determine, based on the initiator package, a start time and an end time for the synchronization access word; and detect the time difference based on the start time and the end time.

[0171] In other features, the control module is configured to: determine, based on the initiator packet, a start time and an end time for the synchronization access word relative to the first CW tone of the response packet; determine whether the start time and end time of the response packet's synchronization access word match the specified start time and end time; and detect the time difference if the start time and end time of the response packet's synchronization access word do not match the specified start time and end time.

[0172] In further features, the control module is configured to: determine a first length of the synchronization access word of the initiator packet; compare the first length with a second length of the synchronization access word of the response packet; and detect the range-extension-type relay attack when a difference between the first length is greater than a predetermined amount that differs from the second length.

[0173] In further features, the control module is configured to: determine a first length of the first CW tone of the initiator packet; compare the first length with a second length of the first CW tone of the response packet; and detect the range-enhancing relay attack when a difference between the first length and the second length is greater than a predetermined amount.

[0174] In other features, the first CW tone of the initiator packet is located at one end of the initiator packet; and the first CW tone of the response packet is located at one beginning of the response packet.

[0175] In addition, the initiator packet includes a second CW tone. The response packet also includes the second CW tone.

[0176] In other characteristics, the first CW tone of the initiator packet is located at the beginning of the initiator packet. The second CW tone of the initiator packet is located at the end of the initiator packet. The first CW tone of the response packet is located at the beginning of the response packet. The second CW tone of the response packet is located at the end of the response packet.

[0177] In other respects, the initiator packet and the response packet have the same format.

[0178] In further terms, the response packet denotes the magnitude of a phase difference between the second CW tone of the initiator packet and the first CW tone of the response packet. The first CW tone of the response packet is phase-locked to a phase-controlled loop of the responder.

[0179] In further features, the control module is configured to determine the phase difference between the first CW tone of the response packet and the second CW tone of the initiator packet. The second CW tone of the initiator packet is in phase with a phase-locked loop of the initiator. The first device and the second device are configured to determine a phase difference for a second frequency and a phase difference for a third frequency. The control module is configured to determine a distance between the devices based on (i) the phase difference between the first and second CW tones, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency.

[0180] In further features, the control module is configured to compare the frequency, power levels, bits, and amplitudes of a portion of a received signal comprising the response packet with the frequency, power levels, bits, and amplitudes of a portion of a transmitted signal comprising the initiator packet, and to determine whether the range-extending relay attack has occurred based on resulting differences.

[0181] Further features describe a method for accessing and providing operational control from a vehicle. The method comprises: transmitting an initiator packet from the vehicle to a second network device via a first antenna module of a first network device, wherein the first antenna module comprises multiple or multi-polarized antennas, wherein the initiator packet comprises a synchronization access word and a first continuous-wave (CW) tone, wherein one of the first network device and the second network device is implemented within the vehicle, and wherein the other of the first and second network devices is a portable access device, and wherein at any given time at least one of the multiple or multi-polarized antennas is active.The multi-polarized antennas of the first antenna module are not cross-polarized with an antenna of the second network device; receive a response packet from the second network device, the response packet comprising the synchronization access word and the first CW tone; determine that a time difference between the initiator packet and the response packet is greater than a predetermined threshold; detect, based on the fact that a time difference is greater than the predetermined threshold, a range-enhancing-type relay attack being carried out by an attacking device to obtain at least one access to or operational control from the vehicle; and prevent at least one access to or operational control from the vehicle in response to detection of the range-enhancing-type relay attack.

[0182] In further features, the procedure additionally includes: determining, based on the initiator package, a start time and an end time for the synchronization access word; and detecting the time difference based on the start time and the end time.

[0183] In further features, the method additionally includes: determining, based on the initiator packet, a start time and end time for the synchronization access word relative to the first CW tone of the response packet; determining whether a start time and end time of the response packet's synchronization access word match the determined start time and end time; and detecting the time difference if the start time and end time of the response packet's synchronization access word do not match the determined start time and end time.

[0184] In other features, the first CW tone of the initiator packet is located at one end of the initiator packet; and the first CW tone of the response packet is located at one beginning of the response packet.

[0185] In other characteristics, the initiator packet includes a second CW tone. The reply packet includes the second CW tone. The first CW tone of the initiator packet is located at the beginning of the initiator packet. The second CW tone of the initiator packet is located at the end of the initiator packet. The first CW tone of the reply packet is located at the beginning of the reply packet. The second CW tone of the reply packet is located at the end of the reply packet.

[0186] Further features of the method include determining the round-trip time of the initiator packet based on a phase delay. The response packet represents the phase delay between the first CW tone of the initiator packet and the first CW tone of the response packet.

[0187] Further features include a system for detecting a range-extending relay attack. The system comprises a transmitter, a receiver, and a control module. The transmitter is configured to transmit a high / radio frequency signal from one vehicle and portable access device to another. The receiver is configured to receive a response signal from the vehicle and portable access device in reply to the high / radio frequency signal.The control module is configured to: convert the response signal into an in-phase signal and a quadrature-phase signal; detect, based on the high / radio frequency signal, the in-phase signal, and the quadrature-phase signal, the range-enhancing relay attack carried out by an attacking device to obtain at least one of access to or operational control from the vehicle, wherein at least one of: (i) the high / radio frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attacking device; and perform a countermeasure in response to detection of the range-enhancing relay attack.

[0188] The system also includes an antenna module. This module is implemented on one of the vehicle and the portable access device, where the transmitter and receiver are located. The antenna module comprises multiple, or multi-polarized, antennas. At any given time, at least one of the antennas in the module is not cross-polarized with an antenna on the other vehicle or portable access device.

[0189] In other features, the control module is implemented in the vehicle. In other features, the control module is implemented in the portable access device.

[0190] In other features, the control module is configured to: determine a phase difference based on the in-phase signal and the quadrature phase signal; measure a round-trip time of the high / radio frequency signal based on the phase difference; and detect the range-enhancing relay attack based on the round-trip time.

[0191] In other features, the control module is configured to: sample the in-phase signal and the quadrature phase signal; and determine received bits based on the in-phase signal and the quadrature phase signal.

[0192] In further features, the control module is configured for: upward sampling of the received bits on the in-phase signal and the quadrature-phase signal; upward sampling of another signal; cross-correlation of the results of upward sampling of the received bits based on the in-phase signal and the quadrature-phase signal with the results of upward sampling of the other signal; and determination of the phase based on the results of the cross-correlation.

[0193] In further features, the other signal includes a reference bit pattern. The control module is configured to determine the sign of the differentiated arctangent signal and generate the reference bit pattern based on that sign. In further features, the other signal includes the high / radio frequency signal after it has been filtered through a Gaussian low-pass filter.

[0194] Further features provide a method for detecting a range-extending relay attack. The method comprises: transmitting, via a transmitter, a high / radio frequency signal from one vehicle and portable access device to another vehicle and portable access device; receiving a response signal via a receiver from one vehicle and portable access device in reply to the high / radio frequency signal; converting, via a control module, the response signal into an in-phase signal and a quadrature-phase signal;Detecting, based on the high / radio frequency signal, the in-phase signal, and the quadrature-phase signal, via the control module, the range-enhancing relay attack carried out by an attacking device to obtain at least one of access to or operational control from the vehicle, wherein at least one of: (i) the high / radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle; and carrying out a countermeasure in response to detection of the range-enhancing relay attack.

[0195] Further features include an antenna module implemented on one side of the vehicle and the portable access device, where the transmitter and receiver are located. The antenna module comprises multiple or multi-polarized antennas. At any given time, at least one of the multiple or multi-polarized antennas of the antenna module is not cross-polarized with an antenna on the other side of the vehicle and the portable access device.

[0196] In other features, the control module is implemented in the vehicle. In other features, the control module is implemented in the portable access device.

[0197] In further features, the method additionally includes: determining a phase difference based on the in-phase signal and the quadrature phase signal; measuring a round-trip time of the high / radio frequency signal based on the phase difference; and detecting the range-enhancing type relay attack based on the round-trip time.

[0198] In further features, the method additionally includes: sampling the in-phase signal and the quadrature phase signal; and determining received bits based on the in-phase signal and the quadrature phase signal.

[0199] In further features, the method additionally includes: upsampling the received bits based on the in-phase signal and the quadrature-phase signal; cross-correlating the results of upsampling the received bits with the results of upsampling the other signal; and determining the phase based on the results of the cross-correlation. In further features, the other signal includes a reference bit pattern. In further features, the other signal includes the high / radio frequency signal after it has been filtered through a Gaussian low-pass filter.

[0200] Further areas of application of the present disclosure will become apparent from the detailed description, the claims, and the drawings. The detailed description and specific examples are provided for illustrative purposes only and are not intended to limit the scope of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0201] The present revelation becomes more fully understandable through the detailed description and accompanying drawings, whereby the following applies: Fig. Figure 1 is a side view of an object illustrating a higher-power primary RF signal propagating along a bounce path due to cross-polarization of RF antennas; Fig. Figure 2 is a functional block diagram of an example of a vehicle access system comprising an access module, RF antennas and portable access devices according to an embodiment of the present disclosure; Fig. Figure 3 is a functional block diagram of an example of a vehicle with the access module from Fig. 2 according to an embodiment of the present disclosure; Fig. Figure 4 is a functional block diagram of an example of the access module of Fig. 2 according to an embodiment of the present disclosure; Fig. Figure 5 is a functional block diagram of an example of an RF antenna module of a vehicle according to an embodiment of the present disclosure; Fig. Figure 6 is a functional block diagram of an example of a portable network device according to an embodiment of the present disclosure; Fig. Figure 7 is an example of a polarization axis diagram illustrating an example of an arrangement or configuration of / for polarization diversity according to an embodiment of the present disclosure; Fig. Figure 8 is an example of a polarization axis diagram illustrating a further example of an arrangement or design of / for polarization diversity according to an embodiment of the present disclosure; Fig. Figure 9 is an example of an electric field diagram and a polar coordinate diagram illustrating electric field patterns and zeros or zeros for a linear antenna; Fig. Figure 10 is an example of a representation of voltage versus electric field for a linearly polarized antenna; Fig. Figure 11A is a perspective top view of an example of at least one part of a multi-axis polarized RF antenna arrangement comprising a linearly polarized antenna and a circularly polarized antenna according to an embodiment of the present disclosure; Fig. Figure 11B is a perspective bottom view of at least part of the multi-axis polarized FR antenna array of Fig. 11A; Fig. Figure 12 is an example of a polar coordinate diagram of radiated power associated with the linearly polarized antenna of Fig. 11A-B; Fig. Figure 13 is an example of a polar coordinate diagram of radiated power associated with the circularly polarized antenna of Fig. 11A-B; Fig. Figure 14 is a functional block diagram of an example of RF circuits and part of a portable access device according to an embodiment of the present disclosure; Fig. 15 is a block diagram of an example of a part of a key fob with two linearly polarized slotted antennas, metal casing and spare / replacement key according to an embodiment of the present disclosure; Fig. Figure 16 is a block diagram of an example of a part of the key fob. Fig. 15 without metal casing and spare / replacement key, which has a slotted antenna linearly polarized with respect to an x-axis and a slotted antenna linearly polarized with respect to a y-axis; Fig. 17 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to an x-axis of the part of the key fob of Fig. 16; Fig. Figure 18 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to a y-axis of the part of the key fob. Fig. 16; Fig. Figure 19 is an example of a return loss-frequency diagram for the linearly polarized slot antennas of Fig. 16; Fig. Figure 20 is a block diagram of an example of a part of the key fob. Fig. 15 without metal cladding and with spare / replacement key; Fig. 21 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to an x-axis of the part of the key fob. Fig. 20; Fig. Figure 22 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to a y-axis of the part of the key fob. Fig. 20; Fig. Figure 23 is an example of a return loss-frequency diagram for the linearly polarized slot antennas of Fig. 20; Fig. Figure 24 is a block diagram of an example of a part of the key fob. Fig. 15 with part of the metal cladding and spare / replacement key; Fig. Figure 25 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to an x-axis of the part of the key fob. Fig. 24; Fig. 26 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to a y-axis of the part of the key fob. Fig. 24; Fig. Figure 27 is an example of a return loss-frequency diagram for the linearly polarized slot antennas of Fig. 24; Fig. 28 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to an x-axis of the part of the key fob. Fig. 15; Fig. 29 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to a y-axis of the part of the key fob. Fig. 15; Fig. Figure 30 is an example of a return loss-frequency diagram for the linearly polarized slot antennas of Fig. 15; Fig. Figure 31 is a block diagram of an example of a part of a key fob comprising a closed linearly polarized slotted antenna, an open linearly polarized slotted antenna, metal casing and spare / replacement key according to an embodiment of the present disclosure; Fig. Figure 32 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to an x-axis of the part of the key fob. Fig. 31; Fig. Figure 33 is an example of a polar coordinate diagram of radiated power associated with a slotted antenna linearly polarized with respect to a y-axis of the part of the key fob. Fig. 31; Fig. Figure 34 is an example of a return loss-frequency diagram for the linearly polarized slot antennas of Fig. 31; Fig. 35 illustrates a method for determining which antenna combination is to be used for exchanging packets between RF antenna modules of a vehicle and a portable access device for round-trip time-of-flight measurements, according to an embodiment of the present disclosure; Fig. 36 illustrates a further method for determining which antenna combination is to be used for exchanging packets between RF antenna modules of a vehicle and a portable access device for orbit-flight-time measurements, according to an embodiment of the present disclosure; Fig. 37 is a diagram for measuring flight time; Fig. Figure 38 is a functional block diagram of an example of a BLE radio unit comprising a superheterodyne receiver and a transmitter according to an embodiment of the present disclosure; Fig. Figure 39 is an example of a GFSK parameter definition diagram; Fig. Figure 40 is a functional block diagram of a system for transmitting BLE packets; Fig. Figure 41 shows exemplary preambles and access addresses for BLE packages of different types; Fig. Figure 42 is an example diagram of BLE packet signals illustrating the corresponding bits; Fig. Figure 43 is another example diagram of other BLE packet signals illustrating the corresponding bits; Fig. Figure 44 is an overlap diagram of BLE packet signals from Fig. 44, wherein one of the BLE packet signals was shifted relative to the other of the BLE packet signals; Fig. Figure 45 illustrates an exemplary method for detecting a range-enhancing relay-type attack according to an embodiment of the present disclosure; Fig. 46 is a functional block diagram of an example of a vehicle and a portable access device with respective cycle time initiators and cycle time responders according to an embodiment of the present disclosure; Fig. Figure 47 is a functional block diagram of the vehicle and portable access device of Fig. 46, which illustrates high-frequency signal transmission via appropriate antennas; Fig. Figure 48 is a functional block diagram of the vehicle and portable access device of Fig. 46, who are subjected to an attack by an attacking relay device of the range extension type; Fig. Figure 49 is a functional block diagram of two examples of BLE radio units according to an embodiment of the present disclosure; Fig. 50 is a functional block diagram of an exemplary location and distance determination system with a period-of-flight sniffer according to an embodiment of the present disclosure; Fig. 51 is a functional block diagram of an exemplary location and distance determination system with multiple orbital time sniffers according to an embodiment of the present disclosure; Fig. 52 is a functional block diagram of exemplary network devices configured to perform tone exchange for distance determination and attack detection, according to an embodiment of the present disclosure; Fig. 53 is a functional block diagram of an exemplary location determination system with a tone exchange sniffer according to an embodiment of the present disclosure; Fig. 54 illustrates a method for determining distances between an initiator and a responder and between a responder and a sniffer according to an embodiment of the present disclosure; Fig. Figure 55 is a functional block diagram of an exemplary passive tone exchange and phase difference detection system according to an embodiment of the present disclosure; Fig. Figure 56 is a functional block diagram of an example of an active tone exchange and phase difference detection system according to an embodiment of the present disclosure; Fig. 57 is a representation of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, wherein the packets comprise a continuous wave (CW) tone and a preamble, according to an embodiment of the present disclosure; Fig. 58 is a representation of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, wherein the packets include a CW tone and no preamble, according to an embodiment of the present disclosure; Fig. 59 is a representation of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, wherein the packets are in the same format and include multiple CW tones and no preamble, according to an embodiment of the present disclosure; Fig. Figure 60 is a representation illustrating exemplary initiator and responder packets with the same format according to a further embodiment of the present disclosure; Fig. Figure 61 is a functional block diagram of an antenna path determination system for network devices with respective antenna modules according to a further embodiment of the present disclosure; Fig. Figure 62 is an exemplary radio unit model according to the structure, function, and operation of the BLE radio unit of Fig. 38; Fig. 63 illustrates a method for exchanging packets between RF antenna modules of BLE radio units for detecting a range-enhancing relay-type attack according to a further embodiment of the present disclosure; Fig. Figure 64A is an exemplary diagram of signals generated by a sampling module, a Gaussian LPF, and an integrator of the model of Fig. 62 will be issued; Fig. Figure 64B is an example diagram of signals generated by a resample module of the model of Fig. 62 will be issued; Fig. 64C is an example diagram of a signal generated by an arctangent module of the model of Fig. 62 is issued; Fig. 64D is an example diagram of a signal output by a differentiator, shown over the signal generated by the Gaussian LPF of the model of Fig. 62 is issued; Fig. Figure 65 illustrates a representation of different pairs of antenna axis arrangements, each of which comprises two linear polarization antennas, according to a further embodiment of the present disclosure; Fig. Figure 66 illustrates a perspective view of a pair of antenna axis arrangements with an equal number of antennas, one of which is arranged in a metal box and the other of which is arranged outside the metal box, according to a further embodiment of the present disclosure; Fig. Figure 67 illustrates a perspective view of another pair of antenna axis arrangements with a different number of antennas, one of which is arranged in a metal box and the other of which is arranged outside the metal box, according to a further embodiment of the present disclosure; Fig. 68 is a representation illustrating distance binding / limitation during / in the execution of a fast bit exchange, where a proof sequence can be cryptographically secure and pre-known, independent of a verifier sequence; Fig. Figure 69 is a representation illustrating that / how it is prevented that a response bit is sent too early during / when performing a fast bit exchange, where a proof sequence can be cryptographically secure and dependent on a verifier sequence; Fig. Figure 70 is a side view of several antennas illustrating an arrival angle; Fig. 71 illustrates an AOA procedure, comprising the use of a Music algorithm, according to the present disclosure; Fig. Figure 72 is an example of a diagram of covariance according to the present disclosure; Fig. Figure 73 is an example of a diagram of eigenvectors and field manifold response according to the present disclosure; Fig. Figure 74 is another example of a diagram of eigenvectors and field manifold response according to the present disclosure; Fig. Figure 75 is an example of a diagram of a music performance spectrum according to the present disclosure; Fig. Figure 76 is a functional block diagram of an antenna selection system according to the present disclosure; Fig. 77 illustrates an exemplary reconstruction procedure according to the present disclosure; Fig. Figure 78A is a top view of a vehicle illustrating an exemplary placement of a sensor according to the present disclosure; Fig. 78B is a side view of the vehicle from Fig. 78A; Fig. 78C is a rear view of the vehicle from Fig. 78A, illustrating the bounce reflections and corresponding paths of a transmitted signal detected at the sensor according to the present disclosure; Fig. Figure 79A is a top view of a vehicle illustrating a further example of the placement of a sensor in accordance with the present disclosure; Fig. 79B is a side view of the vehicle from Fig. 79A; and Fig. 79C is a rear view of the vehicle from Fig. 79A, illustrating the bounce reflections and corresponding paths of a transmitted signal detected at the sensor, according to the present disclosure.

[0202] Reference symbols may be reused in the drawings to denote similar and / or identical elements. DETAILED DESCRIPTION

[0203] RF devices can measure distances by exchanging unmodulated carrier tones. For example, US Patent No. 8,644,768 B2, incorporated herein by reference, provides a system and method for measuring distances between two nodes of a radio network using unmodulated carrier tone exchange.

[0204] RF devices can measure or bind / limit distances by measuring the round-trip time of a rapid exchange of cryptographically secure messages. For example, in "Distance-Bounding Protocols (Extended abstract)" by Brands and Chaum in Workshop on the theory and application of cryptographic techniques on Advances in cryptology (EUROCRYPT '93), which is also referenced here, sequences of rapid bit exchanges between a verifier and a prover are used. The prover sequence can be cryptographically secure and pre-known, independent of the verifier sequence, as demonstrated by Fig. 68 illustrates that the proof sequence can be cryptographically secure and dependent on the verifier sequence. Fig. 69 is illustrated.

[0205] RF devices that measure distance by orbital time are susceptible to early detection and later confession attacks, as described in "Attacks on Time-of-Flight Distance Bounding Channels" by Hancke and Kuhn in Proceedings of the first ACM conference on Wireless network security (WiSec '08), which is referenced herein. RF devices that measure distance by unmodulated carrier tone exchange are susceptible to signal delay extension attacks, as described in "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan, and Capkun from IACR Cryptology ePrint Archive 2016, which is also referenced herein.

[0206] Although conventional PEPS systems allow keyless entry and start of a vehicle, they can be vulnerable to range extender-type relay station attacks. A range extender-type relay station attack can involve an attacker using a relay device to detect, amplify, and relay signals between a key fob (or other smart wearable network device) and a vehicle, causing the vehicle's access module to operate as if the key fob has approached and is in close proximity to the vehicle. For example, if the attacker touches a vehicle door handle with their hand and / or the relay device, the access module can generate and transmit a low-frequency (LF) wake-up signal.As a result, the relay device is detected, and the access module transmits the LF wake-up signal to the key fob, which is received by the relay device. The relay device receives, amplifies, and forwards (or retransmits) the LF wake-up signal to the key fob itself. The key fob might be located inside a house, for example, while the vehicle could be parked outside or in front of the house. The key fob can receive the amplified wake-up signal and generate a response signal and / or initiate communication via an RF link. The response signal and / or RF communication signals are amplified and relayed between antennas on the vehicle and one or more antennas on the key fob. This can be done via the relay device.As a result, the relay device is considered by the access module to be the key fob, and it “deceives” the access module into operating as if the key fob were located at the relay device, causing the access module to provide unauthorized access to the vehicle's interior.

[0207] Furthermore, the antenna systems of current PEPS systems can prevent the PEPS system from accurately estimating the distance between the key fob and the vehicle, and from accurately estimating the key fob's location relative to the vehicle, as described in more detail below. The distance and location can be determined based on a time-of-flight measurement. Time of flight and corresponding received signal strengths are measured. A received signal strength indicator (RSSI) with the highest value typically corresponds to a direct or shortest distance between the key fob and the vehicle. A time-of-flight measurement associated with the highest RSSI is used to calculate the distance between the key fob and the vehicle.

[0208] The examples presented herein include a combined LF and RF PEPS key fob that uses RF round-trip time (RTT) measurements to prevent range extender-type relay station attacks. Other examples include RTT measurements, carrier-phase-based distance measurement, and a combination of RTT measurements and carrier-phase-based distance measurement in PEPS systems. The examples also demonstrate numerous other features, which are described in more detail below.

[0209] Fig. Figure 1 shows an example of when / how antenna cross-polarization can cause inaccurate distance measurements between a first RF antenna on a key fob and a second RF antenna on a vehicle. If the first RF antenna on the key fob is positioned relative to the second RF antenna on the vehicle such that the first RF antenna is cross-polarized with the second, the measured distance corresponds to a bounce path rather than a direct path. The antennas are cross-polarized, for example, when their polarizations are perpendicular to each other. An example of this is shown in Figure 1. Fig. 1 shown.

[0210] Fig. Figure 1 shows an object 10 and polarization axes 12 and 14 of respective RF antennas. The antennas are linearly polarized. The first RF antenna has a first polarization axis 12 and is located in a vehicle. The second RF antenna has a second polarization axis 14 and is located in a key fob. Due to the relative positions of the first RF antenna, the second RF antenna, and the object 10, RF signals 16 transmitted by the antennas can bounce off the object 10. The signal energy (or voltage) corresponding to the bounce path is greater than the signal energy (or voltage) corresponding to a direct path 18 between the antennas. This is due to cross-polarization of the RF antennas.An access module that determines a distance between the antennas based on a signal path that has the most / greatest signal energy or voltage may inaccurately determine the distance between the antennas as the length of the bounce path 16 instead of a length of the direct path 18.

[0211] Aligning or matching the zeros or nulls in a copolarized antenna array also causes a bounce path to be used. This occurs when the first and second RF antennas point in the same direction. The antennas can be positioned such that a line extends longitudinally through them. This is related to Fig. Sections 9 to 10 are described in more detail.

[0212] The examples presented here include polarization diversity for RF signal transmission between RF antennas on a vehicle and RF antennas on portable access devices (e.g., key fobs, mobile phones, wearables, etc.). The examples also include pseudorandom bidirectional data exchanges. Polarization diversity is provided to ensure that at any given time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized but reasonably copolarized with a polarization axis of at least one receiving antenna, copolarized without collinear zeros or nulls.As used herein, the phrase "at any time" means at all times while the relevant devices are communicating with each other, and / or at all times while one or more signals are being transmitted between the devices, and while one or more signals are being received by one or more of the devices. In addition to enabling accurate distance determination, this also helps prevent range extender-type relay station attacks. Pseudo-random bidirectional data exchanges, as described below, also help prevent range extender-type relay station attacks.

[0213] Exemplary implementations are now described in more detail with reference to the accompanying drawings.

[0214] Fig. Figure 2 shows a vehicle access system 28 that operates as a PEPS system and a PAK system. The vehicle access system 28 comprises a vehicle 30 and may include a key fob 32, a mobile phone 34, and / or other portable access devices, such as a wearable, a laptop computer, or other portable networking device. The portable access devices may be, for example, a Bluetooth®-enabled communication device, such as a smartphone, a smartwatch, a wearable electronic device, a key fob, a tablet device, or any other device associated with a user of the vehicle 30. The user may be an owner, driver, or passenger of the vehicle 30 and / or a technician for the vehicle 30.

[0215] The vehicle 30 comprises an access module 36, LF antenna modules 38, and RF antenna modules 40. The access module 36 can wirelessly transmit LF signals to the portable network devices via the LF antenna modules 38 and communicate wirelessly with the portable access devices via the RF antenna modules 40. The RF antenna modules 40 provide polarization diversity between each of the antennas of the portable network devices and the antennas of the RF antenna modules 40. Polarization diversity, as further described below, provides a minimum number, combination, and arrangement of polarization axes on the portable network devices and the vehicle 30 to ensure that at any given time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized with a polarization axis of at least one receiving antenna.In other words, at any given time, at least one RF antenna of the vehicle has at least one polarization axis that is not cross-polarized with a polarization axis of at least one RF antenna of each of the portable access devices. Although specific numbers of LF antenna modules and RF antenna modules are shown, any number of each can be used.

[0216] The access module 36 can communicate wirelessly and / or via a vehicle interface 45 with the LF antenna modules 38 and the RF antenna modules 40. For example, the vehicle interface 45 can include a Controller Area Network (CAN) bus, a Local Interconnect Network (LIN) for lower data rate communication, a Clock Extension Peripheral Interface (CXPI) bus, and / or one or more other vehicle interfaces.

[0217] The LF antenna modules 38 can be located at various points on the vehicle and transmit low-frequency signals (e.g., 125 kHz signals). Each LF antenna module includes an LF antenna and may include a control module and / or other circuitry for LF signal transmission. The RF antenna modules 40 can also be located at various points on the vehicle and transmit RF signals, such as Bluetooth Low Energy (BLE) signals according to BLE communication protocols. Alternatively, the RF antenna modules 40 can communicate according to other wireless communication protocols, such as Wireless Fidelity (Wi-Fi). An example of the antennas is shown in Fig. 11 (the collective on Fig. 11A and Fig. 11B refers to) shown.

[0218] In one embodiment, and to improve signal coverage relative to the vehicle and enhance transmission and reception characteristics, the RF antenna modules 40 are located in a roof 46 of the vehicle 30. As an example, each of the RF antenna modules 40 can comprise a pair of RF antennas, a linearly polarized antenna and a circularly polarized antenna. The number and positions of the RF antenna modules can be preselected based on the size and shape of the vehicle 30. In one embodiment, two RF antenna modules are included and spaced apart from each other, as shown in Fig. Figure 2 shows that the corresponding electric fields overlap to extend in a 360° pattern around the vehicle and beyond its outer circumference. The electric fields provide a resultant electric field, as shown in Fig. Figure 1 shows what is represented by the dashed circles 48. The dashed circles provide an overall shape that is "rectangular". In larger vehicles, more antenna modules 40 can be added to make the shape more "rectangular". In a small vehicle, only one of the RF antenna modules 40 can be included.

[0219] A different number of antennas with a different number of antenna polarizations can be used. Fig. Figures 65 to 67 illustrate some further exemplary antenna implementations. Fig. Sections 65 to 67 cover fewer antennas and antenna polarizations used for measuring or limiting distances when a diverse set of frequencies and / or RF channels are used to measure or limit distances and / or reflections from metal in a vehicle. This is done to create virtual polarization diversity. The antenna systems are capable of tolerating a certain rate or degree of measurement error due to cross-polarization and / or alignment or zeroing. Fig. References 65 to 67 refer to antenna axis arrangements with two polarized axes, 7100A-7100I to antenna axis arrangements with two polarized axes, and 7100J to an antenna axis arrangement with a single polarized axis. The numerical designations 7101A-7101I and 7102A-7102I refer to polarized antenna axes of arrangements with two polarized antenna axes. The numerical designation 7101J refers to a single, or singly polarized, axis of 7100J. The numerical designations 7103AB, 7103CD, 7103EF, 7103GH, and 7103JI refer to RF paths between a pair of antenna arrangements. Between the antenna axes there are many RF paths, some with more distance or connection reserve or leeway, some with less, some with more phase shift time delay, and some with less.Various round-trip time and unmodulated tone exchange distance measurement algorithms disclosed, described, and / or referenced herein have the ability to find or measure shortest paths that are a few decibels (dB) higher or lower in path margin compared to the path with the highest path margin, which cannot be the shortest. The greater the number of round-trip time or tone exchange measurements performed across more frequencies (or channels), and the more mathematically complex and time-consuming the algorithm, the smaller the path margin can be on the shortest indirect path found.

[0220] The additional antenna axes provide polarization diversity on RF paths between the antenna axis arrays, thus providing path diversity. Numerical identifier 7200 refers to an open, three-sided metal box or container and / or a simplified representation of a vehicle body or chassis for RF radio waves in the gigahertz or multigigahertz range. Numerical identifier 7201 refers to a metal plate and / or lid for the container and / or a simplified representation of the roof of a vehicle for RF radio waves in the gigahertz or multigigahertz range. Fig. 66 and Fig. Figure 67 can also be viewed upside down, where 7200 is a simplified representation of the open concave shape of the roof of a vehicle and 7201 is a simplified representation of the floor of a vehicle.

[0221] The RF link along RF path 7101AB, between 7100A and 7100B, is strong because both pairs of antenna axes are copolarized between the antenna axis arrays. For arbitrarily oriented pairs of dual-axis antennas, or two antenna axes, this condition is rare, even if the copolarized zones are wide, approximately 5 degrees outside of a 90-degree rotation, with a spread margin about 6 dB higher than the median spread margin. This is because it takes three angular rotations to manipulate an arbitrarily oriented pair of antenna axis arrays into this configuration, and because the antenna axes are symmetrical every 90 degrees, which will occur arbitrarily with a temporal fraction of approximately (5 / 90)*(5 / 90)*(5 / 90) or 1.71E-4.The RF link along RF path 7101CD, between 7100C and 7100D, is not as strong as 7101AB, but is good because no antenna path is copolarized or cross-polarized, and the zeros are not aligned. The RF link along RF path 7101EF, between 7100E and 7100F, is weak because every antenna path between individual antenna axes is either cross-polarized or involves the zero of at least one antenna. This condition is rare because it again requires three angular rotations to manipulate a pair of arbitrarily oriented antenna axis pairs into this configuration. Again, for arbitrarily oriented antenna pairs of two-axis antennas, with, for example, zones of 5 degrees for cross-polarization and zero alignment, it requires...-adjustment, for example 20 dB or pow2db(sin(pi*5 / 180)^2) lower in the link margin, three angular rotations to manipulate / bring an arbitrarily oriented antenna pair into this configuration, and the antenna axes are symmetrical every 90 degrees, which will occur arbitrarily / randomly for a time fraction of approximately (5 / 90)*(5 / 90)*(5 / 90) or 1.71E-4

[0222] When considering Fig. In sections 7-8, it is clear that with three mostly orthogonal axes of polarization on one side and two mostly orthogonal axes of polarization on the other, it is impossible for the zeros to be aligned when cross-polarized. With three mostly orthogonal axes of polarization on one side and one polarized axis on the other, zeros can be aligned via two rotations, thus achieving an arbitrary alignment.

[0223] In general, the more antenna axes there are on each side of a link, the lower the probability of a direct path with low margin. Preventing or reducing the probability of direct paths with low margin is advantageous because round-trip distance measurement and unmodulated carrier-to-wave distance measurement tend to measure the direct path the greater the margin on the direct path relative to reflected paths. Conversely, the lower the margin on the direct path relative to reflected paths, the more likely these distance measurement techniques are to measure the distance along the reflected path.

[0224] In Fig. Section 66 applies if: the size of the metal box is sufficiently large relative to the decision boundary regarding the measured distances; the change in distances is measured based on the different reflected paths within the metal box; and one side of the distance-measuring link is placed within the metal box, planning with few direct paths can reduce the number of polarized axes necessary to obtain reasonable measurement results. If one of the antenna axes of 7100G is oriented such that the zero point along the strongest and / or shortest reflected path towards 7100H, the other antenna axis in 7100G will find a bounce path with a strong margin of error to one of the antenna axes 7101H or 7102H. This is especially true when averaging over multiple channels, such as the 37 data channels within a BLE data link.Some of the channel and antenna axis path combinations may weaken rapidly due to multipath behavior / propagation, but not most of them. In any orientation of the 7100G antenna axis pair, the path margin to a 7100H antenna axis pair is approximately the same, and the distances measured along the reflected paths 7103IJ will be approximately the same. How the reflected paths 7103GH bounce off the roof 7201 or the side walls of 7200 will change, but the overall path change will be limited by the size and position of components 7200 and 7201. This path change limit will change if 7100G is raised to a height where there is a direct path that will shorten the measured distance by eliminating reflections from the 7103GH path.The distance measured between 7100G and 7100H along reflected paths or shorter direct paths will establish a comparison boundary, indicating that 7100G, which may be part of the portable device, is within a distance threshold of 7100H. 7100H may be part of the PEPS module 211 or the PAKM module 212. These distance measurements between a pair of 7100 modules can be performed and compared to determine that they are less than a boundary. The measurements, distance, and / or the results of the comparisons can be used as part of "if-then-else" comparisons in a software decision tree to indicate that the portable access device 400 is within an approach zone, an unlocking zone, and / or a mobilization zone of a vehicle.

[0225] Fig. 67 is similar to Fig. 66, except that the antenna axis arrangement 7100J comprises a single, or singly polarized, antenna axis 7101J. In one embodiment, the antenna axis arrangement 7100J comprises only a single, or singly polarized, antenna axis. It is possible to orient 7101J so that the null is oriented along the strongest and / or shortest reflected path toward 7100H. In this case, the round-trip time and unmodulated carrier-tone exchange techniques would tend to measure a distance along a path (not shown) that lies off the box 7200 and then bounces back toward the box. It takes two rotations to orient an arbitrarily oriented antenna axis into this orientation, with, for example, a null-alignment zone.-Adjustment with a width of 5 degrees, at, for example, 20 dB or pow2db(sin(pi*5 / 180)^2) lower in the path margin, since it takes two angular rotations to manipulate / bring an arbitrarily oriented antenna pair into this configuration, and since the antennas are symmetrical every 90 degrees. The orientation occurs arbitrarily / randomly for a temporal fraction of approximately (5 / 90)*(5 / 90) or 3E-3. Apart from an increased temporal fraction in which a completely different indirect path is measured due to a higher power path reflected off a distant object, this configuration can be used to make distance measurements between a pair of 7100 modules and compare that one measurement is smaller than a limit.The measurements, distance and / or results of the comparison can be used as part of one or more "if-then-else" comparisons in a software decision tree to indicate that the portable access device 400 is within the approach zone, unlock zone and / or mobilization zone of a vehicle.

[0226] Different antenna polarizations can be used to generate polarization diversity. Multiple polarized antennas (or antenna axes) create polarization diversity. One linear axis and another linear axis, one linear axis and two linear axes comprising a circularly polarized antenna, or three independent linear axes (linearly polarized antennas) are all possible. This is especially true when there is nearby metal to create virtual polarization diversity.

[0227] The 7101H or 7101J antenna axis pair can be placed deep or at the bottom of a metal box that is the vehicle body or chassis, or high or at the top of the metal box that is the vehicle roof, to achieve these virtual antenna axis arrangement effects.

[0228] Fig. Figure 3 shows a vehicle 200, which is an example of the vehicles 108 from Fig. 1. The vehicle 200 comprises a PAK system 202, which includes a vehicle control module 204, an infotainment module 206, and other control modules 208 (e.g., a body control module). The modules 204, 206, and 208 can be connected via a controller area network (CAN) bus 209 and / or another vehicle interface (e.g., the vehicle interface 45 of Fig. 2) communicate with each other. The vehicle control module 204 can control the operation of vehicle systems. The vehicle control module 204 can control a PEPS module 211, a PAK module 212, and a parameter adaptation module 213, as well as other modules that are in Fig. 4 not shown. The vehicle control module 204 may also include one or more processors configured to execute instructions stored in / on a non-temporary computer-readable medium, such as the memory 218, which may include read-only memory (ROM) and / or random-access memory (RAM).

[0229] The PEPS module 211 can perform PEPS operations to provide access to the vehicle's interior and allow the vehicle to be started and / or operated. The PAK module 212 works in cooperation with the PEPS module 211 and performs PAK operations as described herein. The PEPS module 211 can include the PAK module 212, or the modules 211 and 212 can be implemented as a single module. The parameter adjustment module 213 can be used to adjust or set parameters of the vehicle 200.

[0230] The PAK system 202 may additionally include: a memory 218; a display 220; an audio system 221; and one or more transceivers 222, comprising the LF antenna modules 38 and the RF antenna modules 40. The RF antenna modules 40 may include and / or be connected to RF circuits 223. The PAK system 202 may additionally include: a telematics module 225; sensors 226; and a navigation system 227, comprising a global positioning system (GPS) receiver 228. The RF circuits 223 may be used to communicate with a mobile device (e.g., the mobile device 102 of Fig. 1) To communicate, including the transmission of Bluetooth® signals at 2.4 gigahertz (GHz). The RF circuits 223 can include BLE radio units, transmitters, receivers, etc. for transmitting and receiving RF signals.

[0231] The one or more transceivers 222 can include an RF transceiver comprising the RF circuits 223 and implement an access application with a code for checking time-stamped data received and transmitted by the RF antenna modules 40. The access application can confirm or verify whether the RF antenna modules, for example, received correct data at the correct time. The access application can be stored in the memory 218 and implemented by the PEPS module 211 and / or the PAK module 212. Other exemplary operating procedures of the access application are described in more detail below.

[0232] The access application can implement a Bluetooth® protocol stack configured to provide a channel map, access identifier, next channel, and next channel time. The access application is configured to output time signals for timestamps of signals transmitted and received via the RF antenna modules 40. The access application can receive channel map and time information and share this information with other modules in the vehicle.

[0233] The telematics module 225 can communicate with a server via a cellular / mobile network base station. This can include the transmission of certificates, license information, and / or time information, including global clock time information. The telematics module 225 is configured to generate location information and / or location information errors related to the vehicle 200. The telematics module 225 can be implemented by a navigation system 227.

[0234] The sensors 226 may include sensors used for PEPS and PAK operations, cameras, object detection sensors, temperature sensors, accelerometers, vehicle speed sensors, and / or other sensors. The sensors 226 may include a touch sensor to detect, for example, that a person is touching a door handle in order to initiate a process for waking up a portable access device. The sensors 226 may be connected to the other control modules 208, such as the body control module, which may communicate with LF and RF antenna circuits and / or modules disclosed herein. The GPS receiver 228 may provide vehicle speed and / or direction (or orientation or course) and / or global clock time information.

[0235] Memory 218 can store sensor data and / or parameters 230, certificates 232, connection information 234, time information 236, tokens 237, keys 238, and applications 239. Applications 239 can include applications executed by modules 38, 40, 204, 206, 208, 210, 211, 212, 223, and / or transceivers 222. For example, the applications can include the access application, a PEPS application, and / or a PAK application executed by transceivers 222 and modules 210, 211, and / or 212. Although memory 218 and vehicle control module 204 are shown as separate devices, memory 218 and vehicle control module 204 can be implemented as a single device. The individual device may comprise one or more other devices that are in Fig. 2 are shown.

[0236] The vehicle control module 204 can control the operation of a machine or internal combustion engine 240, a converter / generator 242, a transmission 244, a window / door system 250, a lighting system 252, a seating system 254, a mirror system 256, a braking system 258, electric motors 260, and / or a steering system 262 according to parameters set by modules 204, 206, 208, 210, 211, 212, and 213. The vehicle control module 204 can perform PEPS and / or PAK operations, which may involve setting some of the parameters. The PEPS and PAK operations can be based on signals received by sensors 226 and / or transceivers 222. The vehicle control module 204 can receive or absorb power from a power source 264, which is supplied to the machine or...Internal combustion engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seat system 254, mirror system 256, brake system 258, electric motors 260 and / or steering system 262, etc., can be provided. Some of the PEPS and PAK operations may include unlocking doors of the window / door system 250, enabling fuel supply and ignition of the machine or internal combustion engine 240, starting the electric motors 260, supplying power to any of the systems 250, 252, 254, 256, 258, 262, and / or performing other operations as further described herein.

[0237] The engine 240, the converter / generator 242, the transmission 244, the window / door system 250, the lighting system 252, the seat system 254, the mirror system 256, the brake system 258, the electric motors 260, and / or the steering system 262 may include actuators controlled by the vehicle control module 204 to adjust, for example, fuel supply, ignition, airflow, steering wheel angle, throttle position, pedal position, door locks, window position, seat angle, etc. This control may be based on the outputs of the sensors 226, the navigation system 227, the GPS 228, and the aforementioned data and information stored in the memory 218.

[0238] Fig. Figure 4 shows the access module 210. The access module 210 comprises the PEPS module 211, the PAK module 212, the parameter adjustment module 213, and may additionally include a route or link authentication module 300, a connection information distribution module 302, a timing control module 304, a sensor processing and localization module 306, a data management module 308, and a security filtering module 310. The PAK module 212 may include an RTC 312, which maintains a local clock time.

[0239] The route authentication module 300 can be used with portable access devices from Fig. 2. Authenticate and establish the secure communication link. For example, the link authentication module 300 can be configured to implement challenge-response authentication or other cryptographic verification algorithms to authenticate the portable access devices.

[0240] The connection information distribution module 302 is configured to communicate with some of the sensors 226 of Fig. 3 and to supply the sensors with communication information necessary for them to locate and then track or monitor the secure communication link. This can occur once the sensors are synchronized with a communication gateway, which may be included in or implemented by one of the transmitter-receivers 222. For example, the vehicle 200 and / or the PAK system 202 may include any number of sensors located anywhere on the vehicle 200 for detecting and monitoring mobile devices. The link information distribution module 302 is configured to receive information according to the communication channels and channel switching parameters of a communication link and to transmit the information to the sensors 226.In response to the fact that the sensors 226 receive the information from the connection information distribution module 302 via the vehicle interface 45 and the sensors 226 are synchronized with the communication gateway, the sensors 226 can locate and track or listen to the communication path.

[0241] The 304 timing module can: maintain the RTC and / or a currently stored date or time if this is not handled by the 212 PAK module; propagate current time information with the sensors; generate timestamps for incoming and outgoing messages, requests, signals, certificates, and / or other elements; calculate round-trip times; etc. Round-trip time can refer to the amount or duration between a time at which a request is generated and / or transmitted and a time at which a response to the request is received. The 304 timing module can obtain time information corresponding to a communication link when the 300 link authentication module performs challenge-response authentication.The time control module 302 is also configured to provide time information to the sensors 226 via the vehicle interface 209.

[0242] After route authentication is established, the data management module 308 collects the current location of the vehicle 108 from the telematics module 225 and shares this location with the portable access devices. The portable access devices optionally include GPS modules and application software which, when executed, compares the estimated relative locations of the portable access devices to the vehicle 108. Based on these estimated positions relative to the vehicle 108, the portable access devices can send signals to one of the transceivers 222 to request that the vehicle perform specific actions. For example, the data management module 308 is configured to receive vehicle information obtained from one of the modules (e.g., location information obtained from a telematics module 225) and transmit this information to the portable access devices.

[0243] The Security Filtering Module 310 detects violations of a physical layer and a protocol and filters data accordingly before providing information to the Sensor Processing and Localization Module 306. The Security Filtering Module 310 identifies or marks data as injected or injected / inoculated, so that the Sensor Processing and Localization Module 306 is able to discard data and alert the PEPS Module 211.The data from the sensor processing and localization module 306 are passed on / together to the PEPS module 211, which configures the PEPS module 211 to read vehicle state information from the sensors to detect a user intent to access a feature and to compare the location of the mobile device 102 with a set of locations that authorize certain vehicle features, such as unlocking a door or trunk of the vehicle and / or starting the vehicle.

[0244] Fig. Figure 5 is a functional block diagram of the RF antenna module 40, which includes a control module 350 connected to a multi-axis polarized RF antenna array or assembly 352. The multi-axis polarized RF antenna array 352 can include a linearly polarized antenna, additional linearly polarized antennas, and / or a circularly polarized antenna (e.g., a right-hand circularly polarized antenna or a left-hand circularly polarized antenna). An example of the multi-axis polarized RF antennas is shown in Figure 5. Fig. Figure 11 shows that the control module 350 may include or be part of a BLE communication chipset. Alternatively, the control module 350 may include or be part of a Wi-Fi or Wi-Fi Direct communication chipset. The multi-axis polarized RF antenna assembly 352 may be included as part of the RF antenna module 40 or may be located remotely from the control module 350. Some or all of the operations of the control module 350 may be performed by one or more of the modules 204, 210, 211, 212 of the control module 350. Fig. 3 will be implemented.

[0245] The control module 350 (or one or more of the modules 204, 210, 211, 212 of Fig. 3) can establish a secure communication link with a portable access device (e.g., one of the portable access devices 32, 34 of Fig. 2) establish. For example, the Control Module 350 can establish a secure communication link using the BLE communication protocol, which may involve transmitting and / or receiving time and synchronization information. The time and synchronization information may include information related to the secure communication link, such as the time of the next communication link event, time intervals between communication link events, communication channels for the next communication link event, a channel map, a channel hop interval or offset, communication latency information, communication fluctuation information, etc. The Control Module 350 can detect (or "listen in on") packets sent by the portable access device to the Vehicle Control Module 204 and measure signal information of the signals received from the portable access device.The channel hop interval or offset can be used to calculate a channel for a subsequent communication link event.

[0246] The control module 350 can measure the received signal strength of a signal received from the portable access device and generate a corresponding RSSI value. Additionally or alternatively, the control module 350 can perform other measurements of received signals from the portable access device, such as angle of arrival, time of arrival, time difference, etc. The control module 350 can then send the measured information to the vehicle control module 204, which can then determine the location of and / or distance to the portable access device relative to the vehicle 30 based on the measured information. The location and distance information can be based on similar information received from one or more other RF antenna modules and / or other sensors.

[0247] As an example, the vehicle control module 204 can determine the location of the portable access device based on the patterns of RSSI values ​​corresponding to signals received by the RF antenna modules 40 from the portable access device. A strong (or high) RSSI value indicates that the portable access device is near the vehicle 30, and a weak (or low) RSSI value indicates that the portable access device is farther away from the vehicle 30. By analyzing the RSSI values, the control module 204 can determine the location of and / or distance to the portable access device relative to the vehicle 30. Additionally or alternatively, the arrival / incidence angle, exit angle, orbital time, unmodulated carrier tone exchange, or time difference between arrival and departure can also be determined.Incidence measurements of the signals transmitted between the portable access device and the control module 204 are used by the control module 204 or the portable access device to determine the location of the portable access device. Additionally or alternatively, the RF antenna modules 40 can determine the location of and / or the distance to the portable access device based on the measured information and communicate the location or distance to the control module 204.

[0248] Based on the determined location of or the determined distance to the portable access device relative to the vehicle 30, the modules 211, 212 of Fig. 3 then authorize and / or perform a vehicle function, such as unlocking a door of vehicle 30, unlocking a trunk of vehicle 30, starting vehicle 30, and / or allowing vehicle 30 to be started. As another example, if the portable access device is less than a first predetermined distance from vehicle 30, modules 211 and 212 can activate interior or exterior lights of vehicle 30. If the portable access device is less than a second predetermined distance from vehicle 30, modules 211 and 212 can unlock doors or a trunk of vehicle 30. If the portable access device is inside vehicle 30, modules 211 and 212 can allow vehicle 30 to be started.

[0249] Referring again to Fig. 5. The control module 350 can comprise a physical layer (PHY) module 356, a media access control (MAC) module 358, a time synchronization module 360, and a channel map reconstruction module 362. The PHY module 356 receives BLE signals via the multi-axis polarized RF antenna array 352. The control module 350 can monitor received physical layer BLE messages and obtain measurements of the physical properties of the corresponding signals, including, for example, the received signal strengths, using a channel map generated by the channel map reconstruction module 362. The control module 350 can communicate with the control modules of other RF antenna modules and / or the modules 204, 210, 211, 212 via the vehicle interface 45 to determine arrival or incidence time differences, arrival or incidence time, arrival or incidence angle and / or other time information.In one embodiment, the control module 350 includes a portion of the RF circuits 223 of . Fig. 3.

[0250] A time synchronization module 360 ​​is configured to accurately measure the reception times of signals / messages at the vehicle interface 45. The control module 350 can synchronize the PHY module 356 to a specific channel at a specific time based on channel map information, reception times, and / or other timing information. Furthermore, the control module can monitor received PHY messages and data that comply with a Bluetooth® Physical Layer specification, such as Bluetooth® Specification Version 5.1. The data, timestamps, and measured signal strengths can be reported by the control module 350 to the control module 204 via the vehicle interface 45.

[0251] Fig. Figure 6 shows an example of a portable access device 400, which is an example of one of the portable access devices 32, 34 of Fig. 2. The portable access device 400 can include a control module 402, a user interface 404, a memory 406, sensors 407, and a transceiver 408. The transceiver 408 can include a MAC module 410, a PHY module 412, and several linearly polarized antennas 414.

[0252] The control module 402 can include or be part of a BLE communication chipset. Alternatively, the control module 402 can include or be part of a Wi-Fi or Wi-Fi Direct communication chipset. The memory 406 can store application code that is executable by the control module 402. The memory 406 can be a non-temporary, computer-readable medium comprising read-only memory (ROM) and / or random-access memory (RAM).

[0253] The control module 402 communicates with the vehicle's modules 204 and 350 and performs authentication and other operational procedures, as further described below. The control module 402 can transmit information regarding the portable access device 400, such as location and / or speed information obtained from one or more of the sensors 407 (e.g., a global navigation satellite system (GPS) sensor, an accelerometer, and / or an angular velocity sensor). The user interface 404 may include a keypad, a touchscreen, a voice-activated interface, and / or another user interface.

[0254] Fig. Figure 7 shows a polarization axis diagram illustrating an example of an arrangement or configuration for polarization diversity. In the example shown, two 3-axis antennas located inside a vehicle communicate with a 2-axis antenna located in a portable access device (or a mobile access network device). With sufficient antenna axes, this antenna topology can prevent cross-polarization between either of the 3-axis antennas and the 2-axis antenna. The system can also be configured with sufficient antenna axes such that there is at least one pair of antennas where a zero does not exist in (or is not directed towards) a direct signal path. Heuristic RSSI measurements on continuous-wave (CW) tone segments of packets can be performed while measuring the round-trip time and phase delay of the packets.This can be repeated across multiple frequencies. This can be done at a vehicle access module and / or the portable access device. Round-trip time and / or unmodulated carrier tone exchange can be used to ensure or guarantee distance measurement. RSSI and change (or delta) phase per frequency can be used.

[0255] Fig. Figure 8 shows a polarization axis diagram illustrating another example of an arrangement or configuration for polarization diversity. In the example shown, two single-axis antennas located inside a vehicle communicate with a three-axis antenna located in a portable access device (or a mobile access network device). With sufficient antenna axes, this antenna topology can also prevent cross-polarization between one of the single-axis antennas and the three-axis antenna. Furthermore, with sufficient antenna axes, the system can be configured so that there is at least one pair of antennas where a zero does not exist in (or is not directed towards) a direct signal path.Heuristic RSSI measurements on continuous-wave (CW) tone segments of packets can be performed while measuring the packet round-trip time and phase delay. This can be repeated across multiple frequencies. This can be done on a vehicle access module and / or the portable access device. Round-trip time is used to ensure distance measurement. RSSI and change (or delta) phase per frequency can be used. The example of... Fig. 7 may be more practical than the example of Fig. 8. This is because it can be difficult to integrate or incorporate a 3-axis antenna into certain portable access devices, such as a key fob.

[0256] Fig. Figure 9 shows an electric field diagram 900 and a polar coordinate diagram 902, illustrating the electric field patterns and zeros 906 for a linear antenna. The linear antenna is positioned along the vertical axis 908. The linear antenna has a doughnut-shaped or ring-shaped radiation pattern. When zeros between the transmitting and receiving antennas are aligned or in line (copolarized antennas with collinear or nearly collinear zeros), the bounce-off path of a transmitted signal is measured. The examples presented herein prevent this situation from existing between at least one transmitting antenna and at least one receiving antenna at any given time. An algorithm is presented here for determining which transmitting and receiving antennas to use at any given time in order to prevent the use of antennas that are cross-polarized and / or copolarized.Once the appropriate antenna pair has been selected, a time-of-flight measurement is performed to determine the distance between the transmitter and the receiver and / or between the vehicle and the portable access device. Fig. Figure 10 shows a diagram 1000 of voltage versus electric field for a linearly polarized antenna 1002.

[0257] Fig. Figures 11A-B show at least part of an example of a multi-axially polarized RF antenna arrangement or assembly 1100 with a linearly polarized antenna 1102 and a circularly polarized antenna 1104. The antennas 1102 and 1104 are colocated or arranged together. The linearly polarized antenna 1102 extends linearly axially outward from the center of the circularly polarized antenna 1104. The antennas 1102 and 1104 can transmit with a 90° phase shift from each other. The linearly polarized antenna 1102 can include a conductive element (e.g., a straight wire or a spiral) 1110 that extends within a sheath 1112. The circularly polarized antenna 1104 can be ring-shaped.

[0258] The linearly polarized antenna 1102 is a monopole antenna. The casing 1112 is made of a dielectric material, such as Teflon. Both antennas 1102 and 1104 are concentric with a disc-shaped non-conductor or insulating material 1106 and a disc-shaped base plate 1108. The annular insulator 1106 is stacked or layered as the uppermost layer on the base plate 1108 (or the lower or bottom layer). The circularly polarized antenna 1104 is located on / in the base plate 1108 within an inner recessed area 1114 of the insulator 1106. The inner recessed area 1114 of the insulator is situated between the circularly polarized antenna 1104 and the base plate 1108.

[0259] The circularly polarized antenna has two feed points 1120 and 1122, and the linearly polarized antenna 1102 has a single feed point 1124. RF signals are transmitted and / or received via feed points 1120, 1122, and 1124. The RF signals are transmitted between antennas 1102 and 1104 and the RF circuit 1114 via coaxial cables. The coaxial cables comprise inner conductors 1130, 1132, and 1134 and outer ground shields (not shown). The ground shields are connected to the base plate 1108. Conductors 1130, 1132, and 1134 are connected to feed points 1120, 1122, and 1124, respectively.

[0260] During transmission, a signal or voltage is supplied between the base plate 1108 and the conductive element 1110 via feed point 1124, which is connected to the conductive element 1110 and, via another conductive element 1140, to the base plate 1108. One or more RF signals or voltages are also applied between the base plate 1108 and feed points 1120 and 1122 for the circularly polarized antenna 1104. Feed points 1120 and 1122 are located on a surface of the antenna 1104 at a 90° offset and are 90° out of phase with each other. The 90° electrical phase shift, combined with the 90° geometric phase shift, causes the circularly polarized antenna 1104 to radiate circularly polarized signals. The feed points 1120, 1122 are connected from the base plate 1108 via the insulator 1106 to the circularly polarized antenna 1104.A hole 1142 in the center of the base plate 1108 and a hole 1144 in the center of the circularly polarized antenna 1104 are large enough to allow the linearly polarized antenna 1102 to radiate without a short circuit to / with the base plate 1108.

[0261] The antennas 1102, 1104 can be formed from a conductive material, while the circular insulator 1106 can be formed from a non-conductive (or electrically insulating) material. In one embodiment, the linearly polarized antenna 1102 can be implemented as a straight wire, while the sheath 1112 can be formed from polytetrafluoroethylene (PTFE) and the conductive element 1110 can be formed from copper. In another embodiment, the linearly polarized antenna 1102 is implemented as a spiral, with the wire wound around a cylindrically shaped object made of PTFE. Fig. Figure 12 shows a polar coordinate diagram 1200 of radiated power in association with the linearly polarized antenna 1102. Fig. 11. Fig. Figure 13 shows a polar coordinate diagram of radiated power associated with the circularly polarized antenna 1104. Fig. 11. The antennas 1102, 1104 can be connected to an RF circuit 1114, such as one of the RF circuits 223 from Fig. 3, connected, and can be configured to be installed in the roof of a vehicle. Antennas 1102 and 1104 can be used for time-of-flight measurements between a vehicle and a portable access device, while other LF antennas in a vehicle can be used for authenticating portable access devices.

[0262] Although antenna arrangements or assemblies are mainly described as having a circularly polarized antenna and a linearly polarized antenna, which may be installed or arranged, for example, in the roof of a vehicle, two linearly polarized antennas can be used instead. This applies to each of the examples disclosed herein. The two linearly polarized antennas can be located deeper inside the vehicle, such as in the floor, the dashboard, or the center console.

[0263] Fig. Figure 14 shows a first RF circuit 1400, a second RF circuit 1401, and part 1403 of a portable access device (e.g., one of the portable access devices described above). Although a specific number of RF circuits is shown, any number of RF circuits can be included and communicate with the portable access device. The first RF circuit 1400 includes a serial transmission module 1402, an RF transceiver module 1404, a switch 1406, a splitter 1408, a uniaxially polarized (or monopole) antenna 1410, a delay module 1412, and a circularly polarized antenna array 1414. The antennas 1410 and 1414 can be considered the multiaxially polarized RF antenna array of Fig. 11. Although the RF circuits are each shown to have a single-axis antenna and a circularly polarized antenna to provide three polarization axes, the RF circuits can each only include two single-axis polarized antennas. Many permutations of linearly and circularly polarized antenna axes are possible to achieve polarization diversity in a module, preventing cross-polarization and / or collinear alignment of zeros. If the RF circuits include two single-axis antennas, then the portable access device includes a three-axis antenna or three single-axis antennas that are orthogonal to each other, corresponding to the x, y, and z axes.

[0264] The serial transmission module 1402 can communicate with one or more vehicle modules (e.g., the vehicle control module or the access module disclosed above) via a serial bus according to a Serial Peripheral Interconnect (SPI) protocol. Discrete signals (or universal I / O or I / O signals) can be transmitted between modules 1402 and 1404, and between the RF transceiver module 1404 and the switch 1406. The RF transceiver module 1404 can be used with the PEPS module 211 (from Fig. 3) communicate. The switch 1406 switches between antennas 1410 and 1414. The splitter 1408 can split a signal received by the RF transceiver module 1404 and supply the signal to antennas 1410 and 1414, and / or combine signals received by antennas 1410 and 1414. The splitter 1408 can be a 90° splitter and split a single signal into two signals 90° out of phase, supplying the signals to two feed points (e.g., feed points 1120 and 1122). Fig. 11) at the circularly polarized antenna. The splitter 1408 can supply signals to or receive signals from the antenna 1414 via the delay module 1412.

[0265] The second RF circuit 1401 comprises a switch 1420, a splitter 1422, a uniaxially polarized (or monopole) antenna 1424, a delay module 1426, and a circularly polarized antenna 1428. The antennas 1424 and 1428 can be considered the multiaxially polarized RF antenna array of Fig. 11. Devices 1420, 1422, 1424, 1426, 1428 can operate similarly to devices 1406, 1408, 1410, 1412, 1414. Switch 1420 can communicate with RF transceiver module 1404. Switch 1406 can also connect splitter 1408, uniaxially polarized antenna 1410, and / or switch 1420 to RF transceiver module 1404. Switch 1420 can connect uniaxially polarized antenna 1424 or splitter to switch 1406 or RF transceiver module 1404.

[0266] Part 1403 comprises a 3-axis LF antenna 1430, an LF module 1432, an RF module 1434, a user interface 1436, a first uniaxially polarized antenna 1438, a second uniaxially polarized antenna 1440, and a switch 1442. The LF module 1432 transmits and receives LF signals via the 3-axis LF antenna 1430. The RF module 1434 transmits and receives RF signals via the switch 1442 and the antennas 1438 and 1440. The switch 1442 connects one or more of the antennas 1438 and 1440 to the RF module 1434. Discrete signals and Serial Peripheral Interconnect (SPI) signals can be transmitted between the LF module 1432 and RF module 1434 can transmit data. Discrete signals can be transmitted between RF module 1434 and switch 1442.

[0267] RF signals are transmitted between (i) antennas 1410, 1414, 1424, 1428 and (ii) antennas 1438, 1440. For example, antennas 1410 and 1424 can be associated with a z-axis, while antennas 1414 and 1428 can each be associated with the x- and y-axes. Antennas 1438 and 1440, for instance, can be slot antennas associated with the x- and y-axes. The 3-axis LF antenna 1430 can communicate with the LF antennas on the corresponding vehicle, as described above. The LF antennas can be used for wake-up purposes or uses on down-track sections. The RF antennas can be used for authentication and communication.

[0268] Antennas 1410 and 1414 can be used to communicate with antennas 1438 and 1440, or antennas 1424 and 1428 can be used to communicate with antennas 1438 and 1440. Alternatively, one of antennas 1410 or 1424 and / or one of antennas 1414 or 1428 can be used to communicate with antennas 1438 and 1440. One or more of the antennas in circuit 1400 can be used, while one or more of the antennas in circuit 1401 can be used. By using a monopole (or linearly polarized) RF antenna and a dipole (or multi-axis polarized) RF antenna, such as a circularly polarized antenna, the number of RF switching lanes for querying is reduced from 3 down to 2. Heuristic measurements of RSSI on continuous-wave tones of packets can be performed while measuring the round-trip times and phase delays of the packets. This can be repeated across multiple frequencies.

[0269] Fig. Figure 15 shows part 1500 of a key fob with two linearly polarized slot antennas 1502, 1504, a metal casing 1506, and a spare / backup key 1508. The metal in a key fob can short-circuit fields that would otherwise stabilize along a longitudinal (or y-dimension) of the key fob. As a result, it can be difficult to design an efficient radiator with structures that would otherwise include properly functioning antennas. Antenna 1502 is a slot antenna linearly polarized with respect to an x-axis. Antenna 1504 is a slot antenna linearly polarized with respect to a y-axis. The metal casing 1506 may be a cast decorative casing. The key fob may also include an LF coil antenna 1510, a processor (not shown), a battery 1512, and a metal plate (or conductive layer) 1514.An RF signal is fed to the metal plate 1514, and the openings of the slotted antennas 1502, 1504 emit electromagnetic waves.

[0270] Fig. 16 shows part 1600 of the key ring from Fig. 15 without the metal casing 1506 and the spare / replacement key 1508. Part 1600 comprises the slotted antenna 1502, linearly polarized with respect to an x-axis, and the slotted antenna 1504, linearly polarized with respect to a y-axis. Removing the metal casing 1506 and the spare key 1508 supports or promotes radiation from the slotted antennas 1502 and 1504. Although this configuration is designed to operate with nearby metal, such as the metal casing and the spare key, the diagrams of Fig. 17 and Fig. Figure 18 shows that are twisted or distorted compared to the diagrams when the metal casing and the spare / replacement key are included. Fig. Figure 17 shows a polar coordinate diagram of radiated power in relation to the slotted antenna 1502, which is linearly polarized with respect to an x-axis, of part 1600 of the key fob. Fig. 16. Fig. Figure 18 shows an exemplary polar coordinate diagram of radiated power in connection with the slotted antenna 1504 of part 1600 of the key fob, which is linearly polarized with respect to a y-axis. Fig. 16. Fig. Figure 19 shows a diagram of return loss or reflection loss (in decibels (dB)) versus frequency for the linearly polarized slot antennas 1502, 1504. Fig. 16, where curve S1,1 is reflective power or reflection power / loss for the first port or antenna 1502 of a first radio unit (or transmitter) and S2,2 is reflective power or reflection power for the second port or antenna 1504 of a second radio unit (or transmitter). The structure of a key fob can be provided to supply S1,1 or S2,2 diagrams, wherein the 'sink' or minimum return loss for the S1,1 and S2,2 curves is at the same frequency or within a predetermined range of each other to provide improved performance.

[0271] Return loss is a way of measuring how well an antenna converts an electrical voltage at its terminals into an electric field in space, or how well the antenna converts the electric field in space into an electrical voltage at its terminals. Return loss is a decibel measure of how much power is reflected at the terminals. For example, if the return loss is 0 dB, all the power is reflected and no power is transmitted to the terminals. As another example, a return loss of -10 dB means that approximately 10% of the power is reflected and 90% is transmitted. If a return loss graph shows a curve that drops to a reasonable or acceptable level (e.g., -6 dB) at an operating frequency, the corresponding antenna is performing well. If the return loss drops to -10 dB, the antenna is then considered to be performing well.Return loss is measured as an S-parameter. S1,1 is the return loss of port 1. S2,2 is the return loss of port 2.

[0272] Fig. 20 shows part 2000 of the key ring from Fig. 15 without the metal casing 1506 and with the replacement / spare key 1508. Fig. Figure 21 shows a polar coordinate diagram of radiated power in relation to the slotted antenna 1502, which is linearly polarized with respect to an x-axis, of part 2000 of the key fob. Fig. 20. Fig. Figure 22 shows a polar coordinate diagram of radiated power in relation to the slotted antenna 1504 of part 2000 of the key fob, which is linearly polarized with respect to a y-axis. Fig. 20. Adding the spare key may negatively affect the y-polarization, but is acceptable for operation. Fig. Figure 23 shows a diagram of return loss versus frequency for the linearly polarized slot antennas 1502, 1504. Fig. 20, where S1,1 represents antenna 1502 and S2,2 represents antenna 1504.

[0273] Fig. 24 shows part 2400 of the key ring from Fig. 15 with part of the metal casing 2402 and the spare / replacement key 1508. Adding the metal casing 2402 near the spare key 1508 can negatively affect operation, as shown by the diagrams and curves of Fig. shown in numbers 25 to 27. Fig. Figure 25 shows a polar coordinate diagram of radiated power in relation to the slotted antenna 1502, which is linearly polarized with respect to an x-axis, of part 2400 of the key fob. Fig. 24. Fig. Figure 26 shows a polar coordinate diagram of radiated power in relation to the slotted antenna 1504, which is linearly polarized with respect to a y-axis, of the part of the key fob. Fig. 24. Fig. 27 shows a diagram of return loss versus frequency for the linearly polarized slot antennas of Fig. 24, where S1,1 represents antenna 1502 and S2,2 represents antenna 1504. Fig. 19, Fig. 23 and Fig. 27 show that the antennas work reasonably well in the frequency range of interest (e.g. 2.4-2.8 GHz).

[0274] Referring to part 1500 of Fig. 15, where the full metal casing 1506 is present, the operation of the antennas is further negatively affected, as can be seen in figures, diagrams and curves of Fig. 28 to 30 is shown. Fig. Figure 28 shows a polar coordinate diagram of radiated power in connection with the slotted antenna 1502 of part 1500, which is linearly polarized with respect to an x-axis. Fig. Figure 29 shows a polar coordinate diagram of radiated power in association with the slotted antenna 1504 of part 1500, which is linearly polarized with respect to a y-axis. Fig. Figure 30 shows a diagram of return loss versus frequency for the linearly polarized antennas 1502, 1504, where S1,1 represents antenna 1502 and S2,2 represents antenna 1504.

[0275] The slot antennas 1502, 1504, which are linearly polarized with respect to a y-axis, are open slot antennas, since each of the antennas 1502, 1504 has an open end. Fig. Figure 31 shows part 3100 of a key fob with an open linearly polarized slotted antenna 3102, a closed linearly polarized slotted antenna 3104, a metal casing 3106 and a spare / replacement key 3108. Fig. Figure 32 shows a polar coordinate diagram of radiated power in association with the slotted antenna 3102 of part 3100, which is linearly polarized with respect to an x-axis. Fig. Figure 33 shows a polar coordinate diagram of radiated power associated with the slotted antenna 3104 of part 3100, which is linearly polarized with respect to a y-axis. Fig. Figure 34 shows a diagram of return loss versus frequency for the linearly polarized slot antennas 3102, 3104 of Fig. 31. Fig. Figure 34 shows that the antenna measured at port S2,2 is performing poorly.

[0276] If a portable access device has multiple orthogonal antennas, as described above, removing a decorative metal casing provides improved orbital time performance, the larger the portable access device is compared to a comparable physical metal key and the larger the portable access device is compared to the palm of a hand. Improved orbital time performance improves the accuracy of distance measurements.

[0277] The systems disclosed herein can be operated using numerous procedures and methods described herein. A few exemplary procedures and methods for determining which antenna combination to use are given in Fig. 35 and Fig. 36 illustrated. Fig. 35 and Fig. 36 illustrate procedures or methods for determining which antenna combination to use for exchanging packets between RF antenna modules (or RF circuits) of a vehicle and a portable access device for orbit-flight-time measurements. Fig. 35 and Fig. Figure 37 describes the procedure from the perspective of the initiator or initiating device of the round-trip time-of-flight measurements. In one embodiment, this is the vehicle. In another embodiment, this is the portable access device. The reflector / responder or reflecting / responding device would perform the obvious steps corresponding to initiator steps in the process. Round-trip time-of-flight measurements can be used to prevent range extender-type relay station attacks, as further described below. Fig. Figure 35 illustrates an approach to switching antennas between packets. Fig. Figure 36 illustrates an approach to switching antennas during a transmission of packets and / or continuous wave (CW) tones.

[0278] Although the following operational processes are mainly based on the implementations of Fig. As described in Sections 2-6, 11, and 14, the operational procedures can be easily modified to apply to other implementations of this disclosure. The operational procedures can be performed iteratively.

[0279] The procedure can begin at 3500. The following operating operations can generally be initiated by the control module 402 in a portable access device 400 and by modules located on the vehicle, for example, by the access module 210, the PEPS module 211, and / or the PAK module 212. Fig. 4. These steps are performed simultaneously. There can be many ways in which the frequencies and antenna combinations to be tried can be selected in order to identify the best frequencies (or channels) and antenna axes. Optionally, at step 3501, the modules negotiate the initial frequencies (or channels) and antenna combinations for use in frequency and antenna sounding. This step can be based on an a priori agreement, negotiated between the modules based on a posteriori data, and / or instructed by a module based on a posteriori data. At step 3502, a frequency (or channel) is selected on which to transmit a first (or next) packet.

[0280] At 3504, an antenna pair is selected for transmitting and receiving the packet. This could be, for example, two of the antennas of the vehicle's RF circuitry. Fig. 11. At 3506, the packet is transmitted from a first (or transmitting) antenna on the selected frequency to a portable access device. The portable access device measures the RSSI of the transmission and transmits the packet and a first RSSI back to the second (or receiving) antenna of the selected antenna pair.

[0281] At 3508, the second antenna receives the packet and / or a response to the packet transmission and the first RSSI. At 3512, a second RSSI is measured for the second transmission of the packet. At 3514, the first and second RSSIs are stored in a memory associated with the packet, the selected frequency, and the selected antenna pair.

[0282] In operation 3516, if another antenna pair needs to be selected, process 3504 is executed; otherwise, process 3518 is executed. This allows each antenna pair permutation to be cyclically iterated for each selected frequency. The antenna pair permutations can be cyclically iterated in a pseudorandom and / or predefined order.

[0283] At 3518, if another frequency (or channel) needs to be selected, operation 3502 is performed; otherwise, operation 3520 is performed. This allows each frequency (or channel) to be cycled through. This allows the RSSIs of each frequency (or channel) to be determined. Rapid multipath propagation loss can cause some frequencies to have lower power levels (or RSSI values). As an example, the frequencies of 37 BLE data channels can be cycled through in a pseudorandom and / or predefined order to determine the best frequency and / or channel and antenna pair for transmitting further packets.

[0284] Optionally, at 3519, after cyclically iterating through a predetermined, negotiated, and / or agreed-upon set of frequencies and antenna axis pairs, the algorithm can include the nodes (control modules) optionally exchanging antenna and / or channel RSSI results. Due to RF channel reciprocity, the modules can use a heuristic to select the antenna axes used by the modules without sharing antenna RSSI measurements taken by the modules. Alternatively, due to RF channel reciprocity, the modules can use a heuristic to select channels (frequencies) without considering results from other channels, or they can use an algorithm that selects channels based on results from the other channel. In this case, the algorithm and the system are less susceptible to interference from other nearby transmitters.

[0285] At step 3520, after cyclically iterating through a predetermined number of frequencies and antenna pairs, the antenna axis combination and / or frequencies (channels) with the best RSSIs are selected for transmitting the remaining packets. The antenna axis combinations with the highest RSSIs are considered best. For frequencies (or channels), those that have neither low nor high RSSIs are considered best. At step 3522, an identifier or label of the selected antenna pair and / or frequencies (channels) can be encrypted. At step 3524, the selected antenna axis pair and / or frequencies (channels), which are encrypted, can be transmitted to the other nodes. At step 3526, packets are transmitted and responses are received using the selected frequencies (channels) and antenna pair. The process can terminate at step 3528.

[0286] Although the following operational processes of Fig. 36 mainly with reference to the implementations of Fig. As described in Sections 2-6, 11, and 14, the operational procedures can be easily modified to apply to other implementations of the present disclosure. The operational procedures can be performed iteratively.

[0287] The procedure can begin at 3700. The following operating processes can generally be initiated by the control module 402 in a portable access device 400 and by modules located on the vehicle, for example the PEPS module 211 and / or the PAK module 212. Fig. 4. These steps are performed simultaneously. Several different techniques can be used to select the frequencies and antenna combinations to be tried in order to identify the best frequencies (or channels) and antenna axes. Optionally, at 3701, the modules negotiate the initial frequencies (or channel) and antenna combinations for use in frequency and antenna sounding. This step can be based on an a priori agreement, negotiated between modules based on a posteriori data, or instructed by a module based on a posteriori data. At 3702, a frequency (or channel) is selected on which to transmit a first (or next) packet.

[0288] At 3704, an antenna pair is selected for transmitting and receiving the packet. This could be, for example, two of the antennas of the vehicle's RF circuitry. Fig. 11. At 3706, the packet is transmitted from a first (or transmit) antenna on the selected frequency to a portable access device. The vehicle switches between a negotiated set of antenna axes with dwell / hold times during the CW tone portion of the packet. The portable access device switches between a negotiated set of antenna axes with dwell / hold times within each of the "switching and dwell / hold times" of a vehicle antenna axis for periods within the CW tone, measures the RSSIs of a transmit and receive antenna axis permutation during reception, and transmits the packet and a first set of measured RSSIs back to the vehicle. It then switches between a negotiated set of antenna axes with dwell / hold times during the CW tone portion of the packet and a selected pair of antennas.

[0289] At 3708, the vehicle receives the packet and / or a response to the packet transmission and the first set of RSSIs. At 3712, a second RSSI is measured for the second transmission of the packet. At 3714, the first and second RSSIs are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

[0290] At 3716, if another packet needs to be transmitted, operation 3718 is performed; otherwise, operation 3726 can be performed. At 3718, if another antenna pair needs to be selected, operation 3720 is performed; otherwise, operation 3724 is performed. This allows each antenna pair permutation to be cyclically iterated for each selected frequency. The antenna pair permutations can be cyclically iterated in a pseudorandom and / or predefined order.

[0291] At 3720, the first transmission of the next packet is started using the previous transmitting antenna of the previously selected antenna pair.

[0292] Operation 3722 involves switching between the previous antenna pair and the next selected antenna pair. This can occur during a CW tone of the currently transmitted packet or during another part of the currently transmitted packet, so that the remainder of the packet is transmitted via the transmitting antenna of the next selected antenna pair. Operation 3708 can be performed following operation 3722.

[0293] At 3724, if another frequency (or channel) needs to be selected, operation 3704 is performed; otherwise, operation 3718 is performed. This allows each frequency (or channel) to be cycled through. This allows the RSSIs of each frequency (or channel) to be determined. Rapid multipath propagation loss can cause some frequencies to have lower power levels (or RSSI values). As an example, frequencies of 37 BLE data channels can be cycled through in a pseudorandom and / or predefined order to determine the best frequency and / or channel and antenna pair for transmitting further packets. At 3725, antenna and RSSI result values ​​can be exchanged, as described above at 3519.

[0294] At 3726, after a cyclical iteration of a predetermined number of frequencies and antenna pairs, the antenna combination and the frequency and / or channel with the best RSSIs for transmitting remaining packets are selected.

[0295] At 3728, an identifier of the selected antenna pair can be encrypted. At 3730, each remaining packet can be encapsulated to include the encrypted identifier or modified to include the encrypted identifier or identifier. At 3732, using the selected frequency, channel, and antenna pair, the encapsulated or modified packets are transmitted and responses are received. The procedure can terminate at 3734.

[0296] In the methods described above, the packets transmitted to determine the best frequency, channel, and antenna pair can be discarded. The discarded packets are used only for measuring the RSSI values. In another embodiment, CW tones are captured at the end of packets, and antenna switching occurs during these tones. In yet another embodiment, a predetermined time (e.g., 4 µs) is allocated for each antenna permutation, CW tones are captured at the end of packets, and the antenna pair with the best RSSI (or best power) is selected. The selected frequency, channel, and / or antenna pair can be changed if another nearby network device is transmitting and / or receiving data in the same frequency range.In one embodiment, the pattern in which frequencies are used during the process is . Fig. 35 and Fig. 36 are selected, previously known and shared or jointly used between the vehicle's access module and the portable access device.

[0297] Operations 3526 and 3732 can be performed to authorize a portable access device, detect range extender-type relay station attacks by the portable access device, provide access to the interior of a vehicle, and / or perform other PEPS and / or PAK system operations. For example, packets can be transmitted to authorize the portable access device, and access to the vehicle's interior can be provided when the portable access device and / or a suitable user is determined to be authorized to access the vehicle. This may include permitting the vehicle to operate. The packets can also be transmitted to perform time-of-flight measurements, including the time required to transmit the packets to the portable access device and the time required to respond and receive appropriate responses from the portable access device.Based on the measured flight time values, the vehicle's access module (e.g., the PEPS module or the PAK module) can determine whether the portable access device is attempting a range extender-type relay station attack. If the portable access device is attempting a range extender-type relay station attack, the access module will take one or more countermeasures, including preventing access to the vehicle's interior. The countermeasures may include notifying the vehicle owner of the range extender-type relay station attack. This can be done, for example, via a text message or email transmitted by the access module to one or more of the owner's network devices. One or more alarm signals may be generated, and a central monitoring station and / or authorities or agencies may be notified of the attack.

[0298] Fig. Figure 37 shows a diagram 3800 of a time-of-flight measurement comprising an initiating and measuring device 3802 and a reflecting (or responding) device 3804. The initiating and measuring device 3802 transmits a radio message (e.g., a packet) to the reflecting device 3804, which then responds and sends the radio message back to the initiating and measuring device 3802. The time of flight (or total time for transmitting and receiving these signals) is equal to the sum of (T2-T1), (T3-T2), and (T4-T3), where: T2-T1 is the amount of time for the radio message to propagate from the initiating and measuring device 3802 to the reflecting device 3804; T3-T2 is the amount or quantity of time for the reflecting device 3804 to respond; and T4-T3 is the amount or quantity of time for the reflecting device 3804 to respond.The amount of time for the radio message to propagate from the reflecting device 3804 to the initiating and measuring device 3802. Exemplary average flight time and distance calculations can be carried out according to equations 1-4, where the distance refers to the distance between the initiating and measuring device 3802 and the reflecting device 3804. Average flight time = (Total time − Response time)² Average flight time = (T4 − T1) + (T3 − T2)² Distance = (Rate) (Time) Distance=(c)(T4−T1)+(T3−T2)2

[0299] If a timer is used to time or stop the response time T3-T2, the amount of time information can be reduced to adjust fine-tuning information that is measured and related to the response time. The time T3-T2 can be reported back to an initiator if the initiator is unaware of this time value.

[0300] Fig. Figure 38 shows an example of a BLE radio unit 3900 with a superheterodyne receiver 3902 and a transmitter 3904. The BLE radio unit 3900 can, for example, be used as one of the transceivers 222 from Fig. 3 and include or be part of one of the RF antenna modules 40 and the RF circuits 223. In another embodiment, the BLE radio unit 3900 is used as a transceiver in a portable access device, such as the transceiver 410 of the portable access device 400 of Fig. 6. The 3902 superheterodyne receiver uses frequency mixing to convert a received signal to a fixed intermediate frequency (IF). The superheterodyne receiver 3902 comprises an RF (e.g., bandpass) filter 3906, a switch and balun 3908, a low-noise amplifier or small-signal amplifier 3910, a step-down converter 3912, a bandpass filter and amplifier 3914, an analog-to-digital converter 3916, a demodulator 3918, and a correlation and protocol module 3920. The transmitter 3904 comprises a processing module 3922, a protocol module 3924, a Gaussian frequency-shift keying (GFSK) modulator 3926, a digital-to-analog converter and low-pass filter 3928, a step-up converter 3930, and a power amplifier 3932. One or more crystal oscillators 3934 can generate one or more clock signals that are fed to the devices 3914, 3916, 3918, 3920, 3922, 3924, 3936, 3938 and phase control loops 3940, 3942 can be distributed.For example, the processing module 3922 and the correlation and logging module 3920 can be used as a single module or as part of one or more of the modules 204, 210, 211, 212 of . Fig. 3 are implemented / will be implemented. Operational processes carried out by modules 3922 and 3920 can be carried out by one / each of modules 204, 210, 211, 212 of Fig. 3-4 can be implemented. One or more of the devices 3906, 3908, 3910, 3912, 3914, 3916, 3918, 3920, 3924, 3926, 3928, 3930, 3932, 3934, 3936, 3938, 3940 and 3942 can be implemented as part of the RF circuits 223 and / or as part of one or more of the modules 204, 210, 211, 212.

[0301] The bandpass filter 3906 can be connected to a linearly polarized antenna and / or a circularly polarized antenna (designated 3907). The step-down converter 3912 converts received signals from an RF frequency down to an IF frequency based on a signal from the phase-locked loop 3942. The step-up converter 3930 steps up IF signals to RF signals based on a signal from the phase-locked loop 3940.

[0302] The GFSK modulator 3926 and the demodulator 3918 can modulate and demodulate bits of signals according to GFSK protocols. Fig. Figure 39 shows an exemplary GFSK parameter definition diagram with a diagram of a transmit carrier frequency F. c , which illustrates zero-crossing points and errors. As an example, the transmitter frequency F can be used. cbe equal to ± 250 kHz or ± 500 kHz with a symbol time of 1 µs or 0.5 µs and a zero-crossing error of 1 / 8 of 1 µs (1 Mbps) or 1 / 8 of 0.5 µs (2 Mbps).

[0303] Fig. Figure 40 shows a functional block diagram of a System 4100 for transmitting BLE packets. An example format of the BLE packets 4101 is shown, comprising a preamble, an access address, a protocol data unit (PDU), and a cyclic redundancy check (CRC) bit field. This is an example of packets transmitted by the Correlation and Protocol Module 3940 of Fig. 38 can be received and / or generated by the processing module 3922 and / or the protocol module 3924.

[0304] The packet preambles are AA or 55, so the last bit of the preamble is different from the first bit of the access address. The access addresses for the peripheral and central devices 4102 and 4104 are the same. Sensors 4106 can be used to monitor packets. The access addresses are the same for each packet and each link interval. The access address follows BLE access address rules. Packets within the same link interval are within the same RF channel. Fig. Figure 41 shows example preambles and access addresses for BLE-1M and BLE-2M packets. The preambles are A's and 5's (AA or 55 at 1 Mbit / s, AAAA or 5555 at 2 Mbit / s), such that the last bit of the preamble is different from the first bit of the access address. This is illustrated by the bits in circles 4200.

[0305] Access addresses for announcing channel packets can be 10001110100010011011111011010110b (0x8E89BED6). Each link-layer or data link / connection layer connection between any two devices, and each periodic announcement, has a different access address. The access addresses can be 32-bit values. Each time a new access address is required, the link-layer or data link / connection layer can generate a new random value that satisfies the following rules. The access address is not an address for an existing link-layer connection at the corresponding network device.

[0306] The access address: is not an address for an enabled periodic announcement; does not have six consecutive zeros or ones; is not an announcement channel packet access address; is not a sequence that differs from an announcement channel packet access address by only one bit; and does not include four identical octets. The access address has no more than 24 transitions. The seed or initial value for the random number generator comes from a physical entropy source and has at least 20 bits of entropy. If the random number generated by the access address does not meet the aforementioned rules, new random numbers are generated until the rules are met. For an implementation that also supports a BLE-encoded physical layer (PHY), the access address may also have at least three ones in the least significant 8 bits and no more than eleven transitions in the least significant 16 bits.In typical BLE packets, the preamble reveals the first bit of the access address, and the access rules sometimes reveal the next bit (e.g., no more than six consecutive zeros or ones). This can cause distance measurement security problems, as an attacker can predict the bits. The implementations disclosed herein mitigate, eliminate, or prevent this.

[0307] Fig. Figure 42 shows an example diagram of BLE packet signals, illustrating the corresponding bits. The first BLE signal, 4300, represents a bitstream from protocol module 3924. Fig.Figure 38 shows that normal BLE packets do not return to a carrier (or midpoint level) when the bits remain at the same value. This is called non-return-to-zero recording / logging. The corresponding bits for the first curve are shown above the graph. A second BLE signal, 4302, represents a bitstream from the GFSK modulator (or Gaussian filter), 3926. The Gaussian filter adds a 1 / 2 bit time delay / shift, wasting some time during transitions or changes. The corresponding bits for the second BLE curve are shown below the second BLE curve. As an example, the carrier frequency can be 2.402 GHz, and the BLE packet signals can vary or fluctuate in frequency between 2.402250 GHz and 2.401750 GHz.

[0308] Fig. Figure 43 shows an example diagram of BLE packet signals, illustrating the corresponding bits of a stronger BLE packet signal (e.g., a BLE packet signal with a higher RSSI) after rising-edge capture and transmission with faster edges. A first BLE signal, 4400, represents a bitstream from protocol module 3924. Fig. 38. A second BLE signal 4402 represents a bitstream from the GFSK modulator (or a Gaussian filter) 3926. A third BLE signal 4404 represents the stronger BLE packet signal after rising-edge detection of Gaussian bits and subsequent transmission with faster edges. The third BLE signal 4404 can be generated by an attacking device. As can be seen, the edges are slanted, and the transition is faster than the transitions of the second BLE curve 4402. This causes the corresponding bits to appear earlier than the bits of the second curve (or an output of the GFSK modulator 3924). Regions where differences can be detected are indicated by ovals 4406. The corresponding bits for the first BLE curve 4400 are shown above the first BLE curve 4400. The corresponding bits for the second BLE curve 4402 are shown below the second BLE curve 4402.The corresponding bits for the third BLE curve 4404 are shown below the bits for the second BLE curve 4402 and shifted to the left relative to the bits of the second BLE curve 4402.

[0309] Fig. Figure 44 shows the second and third BLE curves 4402 and 4404. Fig. 43, where the third BLE curve 4404 was shifted relative to the second BLE curve 4402. The following operations can be performed to defend against a bit acceleration attack. A bit acceleration attack may refer to an attacking device accelerating or prioritizing the transmission of a BLE signal to account for or compensate for delays associated with the attacking device receiving, processing, and / or modifying and forwarding the BLE signal, such as a BLE signal transmitted by a key fob and / or other portable access device. Fig. Figure 45 shows an exemplary procedure for detecting a range-extendance-type relay attack. Although the following operating procedures of Fig. 45 mainly with reference to the implementations of Fig. As described in Sections 2-6, 11, and 14, the operational procedures can be easily modified to apply to other implementations of this disclosure. The operational procedures can be performed iteratively. For example, the following operational procedures can be performed by one or more of Modules 210, 211, and 212.

[0310] The procedure can begin at 4600. At 4602, a sliding correlation function is used to align or adjust a received input waveform with an idealized Gaussian waveform (or another suitable predetermined waveform) for a known bit pattern and bit rate, which involves scaling peaks and aligning or adjusting zero-point shifts of the received input waveform and the predetermined waveform. This can be achieved by the 3920 correlation and protocol module of Fig. 38. This can be done, for example, to identify or determine / recognize a synchronization access word. An example of this is in Fig. 44 shown.

[0311] At 4604, parts (or sections) 4605 of the received waveform that occur early in time, after a zero crossing, and before the next peak of the predetermined waveform, are integrated and accumulated (or summed). This is called positive accumulation.

[0312] At 4606, parts (or sections) 4607 of the received waveform that occur later in time, after a peak and before the next zero crossing, are integrated and accumulated. This is also called positive accumulation.

[0313] In 4608, the resulting accumulation values ​​determined in 4604 and 4606 are averaged over the number of transitions or switches used to provide a clue from one stage of a bit-acceleration attack. The accumulated values ​​can be averaged separately to provide two averages, or they can be summed and then averaged to provide a single average.

[0314] At 4610, based on one or more mean values ​​and one or more predetermined thresholds, it is determined whether an attack has occurred and / or is likely to have occurred. At 4612, if an attack has occurred and / or is likely to have occurred, operational procedure 4614 is executed; otherwise, operational procedure 4616 is executed. At 4614, a countermeasure is implemented, such as one of the aforementioned countermeasures, including preventing access to and / or operation of the vehicle in question. One or more alarms may be generated. As a further example of a countermeasure, data related to the attack may be stored in memory and / or transmitted to a network device belonging to the vehicle owner and / or a central monitoring station.At 4616, access to and / or operational control of the vehicle is permitted if an attack has not occurred and / or is unlikely to have occurred. Operational control may include, for example, unlocking or locking the vehicle's doors, remotely starting a machine or internal combustion engine, adjusting the vehicle's interior climate control, etc. At 4618, one or more averages may be discarded and / or old integrated and accumulated data may be discarded. If a sliding window is used to monitor received signals, older portions of the data may be discarded, while more recent portions may be retained for subsequent integration, accumulation, and averaging with newly received data.

[0315] Fig. Figure 46 shows a vehicle 5200 comprising a round-trip time (RTT) responder 5202 and an RTT initiator 5204, and a portable access device 5206 comprising an RTT initiator 5208 and an RTT responder 5210. As used herein, an "initiator" may refer to a network device comprising a BLE radio unit, transmitter, and / or receiver, that initiates or initiates a signal or tone exchange. As used herein, a "responder" may refer to a network device comprising a BLE radio unit, transmitter, and / or receiver, that responds or replies to a signal and / or tone received by an initiator. The RTT responders 5202, 5210 and the RTT initiators 5204, 5208 can, for example, be used by the RF antenna modules 40, the RF circuits 223 and / or the modules 210, 211, 212 of Fig. 3. The vehicle 5200 may include antenna modules with singly and circularly polarized antennas, as described above. The RTT responder 5202 and the RTT initiator 5204 may transmit and receive using the antennas. The antennas provide polarization diversity with antennas (e.g., singly polarized antennas) used by the RTT initiator 5208 and the RTT responder 5210, such that at any given time at least one of the antennas of the vehicle 5200 has at least one polarization axis that is neither cross-polarized nor co-polarized with a polarization axis of at least one of the antennas of the portable access device 5206.

[0316] Devices 5202, 5204, 5208, and 5210 can each include a control module, as described above, to perform one or each of the described operations. Devices 5202, 5204, 5208, and 5210 can transmit and receive RF signals on random channels (e.g., 40 BLE channels over an 80 MHz spectrum). Devices 5202 and 5208 can communicate with each other, including transmitting and receiving signals, while devices 5204 and 5210 can communicate with each other, including transmitting and receiving signals. Communication between devices 5202 and 5208 can occur simultaneously with communication between devices 5204 and 5210. For security reasons and to detect an attack, signals for determining RTTs can be transmitted simultaneously and bidirectionally.Devices 5202 and 5204 can share the communication frequencies with portable access device 5206. The frequencies can be designated in a predetermined order and followed by devices 5202, 5204, 5208, and 5210. When a bandpass filter is used to monitor two channels simultaneously, the filter introduces a propagation or time delay.

[0317] A typical bandpass filter delay is 0.5 per bandwidth (or 0.5 / bandwidth). Channel spacing from a protocol, randomness in channel selection, randomness in transmit direction over time, and concurrent transmissions force bandpass filters to detect bits that have group delays large compared to the measurable round-trip delay. This further increases the difficulty for an attacking device to carry out a range-extending relay-type attack. The 5200 vehicle and the 5206 portable access device can each adjust transmit power levels and transmit channel spacing such that, for example, it is impractical or impossible for an attacking device to have a filter that is wide enough to receive the signals with a sufficiently short delay for forwarding, but narrow enough to analyze the signals.

[0318] In one embodiment, signals are transmitted to measure direct flight times and to determine whether a predetermined delay (e.g., 10–500 nanoseconds (ns)) is present, which is often associated with an attacking range-extending device. An attacking range-extending device, when relaying signals between the vehicle 5200 and the portable access device 5206, can delay transmitted signals by the predetermined amount. This bidirectional and simultaneous transmission and reception makes it difficult for an attacking device to determine the frequency, channel, and direction of signals being transmitted at any given time. It is also difficult for the attacking device to prevent the transmission of signals without the predetermined delay.

[0319] Fig. Figure 47 shows the vehicle 5200, comprising the RTT responder 5202 and the RTT initiator 5204, and the portable access device 5206, comprising the RTT initiator 5208 and the RTT responder 5210. Fig. Figure 47 shows signal paths via corresponding antennas 5300, 5302, 5304, and 5306. In one embodiment, antennas 5300 and 5302 have a total of three polarizations, and antennas 5304 and 5306 have a total of two polarizations. In another embodiment, antennas 5300 and 5302 have a total of two polarizations, and antennas 5304 and 5306 have a total of three polarizations.

[0320] Fig. Figure 48 shows the vehicle 5200, comprising the RTT responder 5202 and the RTT initiator 5204, the portable access device 5206, comprising the RTT initiator 5208 and the RTT responder 5210, and a range-extending attack device 5400. The range-extending attack device 5400 comprises a control module 5402, which includes a bandpass filter 5404, a bit-signal direction detector 5406, and a bit-acceleration attack module 5408. The bandpass filter 5404 is used to detect incoming bits but has a corresponding delay. The bit-signal direction detector 5406 determines a direction in which the bits propagate (e.g., from a vehicle to a portable access device or from the portable access device to the vehicle).The 5408 bit acceleration attack module is unable to accelerate the bits without introducing a delay time in portions of symbols (or bits). This delay can be detected using a sliding correlation function aligned with an ideal waveform and averaging symbol (or bit) shapes across multiple symbols (or bits). This delay time can be detected by a vehicle access module when determining whether an attack is occurring.

[0321] As shown, the range-extending attack device 5400 comprises amplifiers 5410, such as low-noise amplifiers or small-signal amplifiers (LNAs) and power amplifiers, for receiving and transmitting purposes. The range-extending attack device 5400 may also include mixers for step-down and step-up conversion purposes. The amplifiers 5410 are connected to antennas 5412.

[0322] In addition to simultaneously performing the aforementioned communication, channels and access addresses can be selected pseudorandomly. This random selection can be performed on the vehicle and pre-shared with the portable access device. Conversely, the selection can be performed on the portable access device. Alternatively, the selection can be made using secure cryptographic techniques with key material from one or both devices, contributing to the pseudorandomly selected channel sequence and / or access address sequence. In this case, the pseudorandom sequences of access addresses serve as the cryptographically secure sequence of bits exchanged for round-trip time measurements.Because simultaneous transmission and reception operations are conducted on random channels with randomly selected access addresses, with responses on the same channel as an initiator and the response access address not being the same as the initiator's access address, range-extending attack devices have difficulty carrying out an attack without being detected by a vehicle access module and / or control modules of one or more portable access devices. The range-extending attack devices must: monitor all channels simultaneously in both directions; determine the direction of message transmission across the range-extending attack device; and detect the bits early and transmit them early in both directions with the correct timing to convince the initiators of the vehicle and the one or more portable access devices.The range-extending attack devices must convince the initiators of the vehicle and the one or more portable access devices that the portable access devices are closer than they actually are and are at the correct distances from the vehicle to allow access to and / or operational control from the vehicle. The attack device also has a small window of less than approximately 10-100 ns of early bit detection time available, using a Gaussian filter on BLE bits, to detect the bits and transmit them early.

[0323] In one embodiment, the RF signals associated with the simultaneous communication described above are transmitted by modules 210, 211, 212 of Fig. 3. The aforementioned initiators and responders monitor and / or determine the RSSI values ​​and antenna polarization states (e.g., degrees of polarization between transmitting and receiving antennas) of the signals. One or more of the modules 210, 211, and 212 determine, based on the RSSI values ​​and polarizations, the path, frequency, channel, and antenna pairs best suited for communication. The signals associated with the shortest path (or least interference), best RSSI values, most / greatest polarization, etc., are used to indicate which path, frequency, channel, and antenna pair to use. This information can also be used to determine, at any given time, which device is transmitting and which is receiving. A selection of transmit / receive chips and channels on each device can be randomized.In one embodiment, one device (connected to a vehicle or portable access device) can transmit, while the other device does not transmit but rather receives. This role can then be reversed, so that the first device receives while the second device transmits and does not receive.

[0324] Although many of the techniques described above and below involve monitoring, generating, receiving, transmitting, and / or measuring various parameters at a vehicle access module and detecting a range-extending relay-type attack based on this information, the techniques can be modified such that some or all of these operations are performed at a control module (or other module) of a portable access device, such as any of the portable access devices disclosed herein. Likewise, various operations are described as being performed at a portable access device; these operations can be performed at a vehicle access module.

[0325] Examples of different BLE-RF transmit frequencies are 2.410 gigahertz (GHz), 2.412 GHz, 2.408 GHz, and 2.414 GHz. These and other frequencies can be used by the RTT initiators and responders and / or corresponding transmitters and receivers.

[0326] In one embodiment, other transmitters of a vehicle and / or a portable access device are used to lightly load one or more channels, forcing an attacking device to have a narrow low-pass filter to detect the RF signals transmitted by the initiators and responders. The one or more channels may include or be located near channels used by the initiators and responders. The signals transmitted on the one or more channels may be dummy or pseudo-signals.

[0327] Fig. Figure 49 shows two of the BLE radio units 3900 (designated 3900A and 3900B). The first BLE radio unit 3900A operates as an initiating and measuring device. The second BLE radio unit 3900B operates as a reflecting (or responding) device. The initiating and measuring device 3900A can measure the RTT (Return Time To Transmission) for a packet to be transmitted from the first BLE radio unit 3900A to the second BLE radio unit 3900B, the time for the second BLE radio unit to respond, and the time for the packet to be transmitted from the second BLE radio unit 3900B to the first BLE radio unit 3900A.In another embodiment, the RTT comprises the time to transmit the packet from the processing module 3922A of the first BLE radio unit 3900A to the correlation and protocol module 3920B of the second BLE radio unit and back from the processing module 3922B or the protocol module 3924B to the demodulator 3918a or the correlation and protocol module 3920A. This can include measuring propagation time: from processing module 3922A; via protocol module 3924A, GFSK modulator 3926A, D / A and low-pass filter 3928A, boost converter 3920A, power amplifier 3932A, switch and balun 3908A and band-pass filter 3906A; to the BLE radio unit 3900B; via bandpass filter 3906B, switch and balun 3908B, low-noise amplifier 3910B, step-down converter 3912B, bandpass filter and amplifier 3914B, A / D 3916B and demodulator 3918B, to correlation and protocol module 3920B.The time for propagation from the demodulator 3918B or the correlation and protocol module 3920B to the protocol module 3924B or the processing module 3922B can also be determined. The time from the protocol module 3924B or the processing module 3922B via the GFSK modulator 3926B, the D / A and low-pass filter 3928B, the boost converter 3930B, the power amplifier 3932B, the switch and balun 3908B, the band-pass filters 3906B and 3906A, the switch and balun 3908A, the low-noise amplifier 3910A, the buck converter 3912A, the band-pass filter and amplifier 3914A, the A / D 3916A and the demodulator 3918A or the correlation and protocol module 3920A can also be determined. Although BLE radio unit 3900A is described as the initiator and BLE radio unit 3900B is described as the responder, operating roles can be reversed or changed so that BLE radio unit 3900B is the initiator and BLE radio unit 3900A is the responder.

[0328] The following operating procedures can be performed to establish an RTT between two BLE radio units (e.g., the BLE radio units 3900A, 3900B from Fig. 49) of a vehicle and / or between a vehicle's BLE radio unit and a portable access device's BLE radio unit. The operations are performed to prevent an attack and / or to easily detect when an attack is being carried out and / or has occurred. The following operations can be performed separately or in any combination. In one embodiment, a large predetermined number of packets are exchanged back and forth between the BLE radio units. The initiator can measure and / or estimate the RTT for a signal transmitted between the BLE radio units.This can include time T1, when the packet is transmitted from the first BLE radio unit to the second BLE radio unit, time T2 for the second BLE radio unit to respond, time T3, when the second BLE radio unit transmits the packet back to the first BLE radio unit, and time T4, when the first BLE radio unit receives the packet from the second BLE radio unit.

[0329] In one embodiment, the A / D and D / A clocks of the BLE radio units and / or phase-locked loops between packets are made to flicker or fluctuate. In addition to clock dithering, a cryptographically random variation, known to the BLE radio units, can be added, where possible, when least significant bits (LSBs) generated by a digital timer are transmitted. The cryptographically random variation is used in such a way that an attacking device is unable to predict the precise time when a transmission will occur.

[0330] In one embodiment, each packet contains a large, pre-agreed cryptographically random multiple-bit identifier (PACRMBI) of, for example, 16 to 256 bits. In another embodiment, the packet bit contents of the initiator and responder are indistinguishable to an attacking device. Based on the packet's bit contents, the attacking device is unable to identify or determine the direction from which a packet originates or whether it is an initiator or a responder packet.

[0331] In one embodiment, the channels of the BLE radio units are cryptographically randomized. In another embodiment, the determination of which BLE radio unit is the initiator or the responder is cryptographically randomized. In yet another embodiment, one or both of the BLE radio units transmit dummy or pseudo-packets, which are indistinguishable to the attacking device from other packets transmitted by the BLE radio units. The selection of whether the BLE radio units transmit the dummy packets is cryptographically randomized and can be switched randomly. This makes it difficult for the attacking device to determine which packets are valid and in which direction the packets are transmitted between the BLE radio units.

[0332] In one embodiment, the polarization of the antenna sets used by the BLE radio units is initially cryptographically randomized. A heuristic is then used to select which antenna permutations between the BLE radio units provide the best antenna-channel combination across the set of channels. This may include: using a heuristic that selects a higher received signal strength; compensating for antenna gain over frequency; monitoring across multiple channels; using an antenna combination with the highest average or median power; and / or using a Rayleigh fading estimator or a Kalman filter estimator. This can reduce the cryptographically randomized antenna patterns and concentrate on the antenna channels (combinations) that exhibit the highest power and the lowest cross-polarization.

[0333] In one embodiment, the in-phase and quadrature-phase (IQ) stream at the receiver is upsampled (or interpolated) into the correlation and protocol module of the corresponding BLE radio units before transmission of the IQ stream. This upsampled IQ stream corresponds to a PACRMBI. As an alternative to using PACRMBIs, the transmitted messages can be encrypted and, upon reception, bit-decoded and then converted into an idealized upsampled IQ stream. The two upsampled streams can be sent via the 3920 correlation and protocol module, which can check for an upsampled clock edge with sufficient correlation to correspond to PACRMBIs. The 3920 correlation and protocol module selects a maximum edge from the clock edges that constitutes a match. Other clock recovery or...Clock recovery methods can be used to interpolate subbit time into the round-trip time of bitstreams on communication channels. This can be done in combination with upsampling correlation or in combination with normal clock sampling.

[0334] In one embodiment, amplifier settings are communicated between the BLE radio units. These amplifier settings are sufficient to compensate for any frequency and gain variations in propagation or propagation delay between the BLE radio units.

[0335] In another embodiment, measured chip temperatures within the BLE radio units are communicated (or shared) between the BLE radio units to compensate for any temperature-based frequency and amplifier gain changes in the propagation or propagation delay between the BLE radio units.

[0336] Another operational procedure that can be performed is to communicate balun changes / deviations between the BLE radio units. A further operational procedure is to add a continuous-wave tone of short (e.g., 6 µs) but cryptographically random length (e.g., 4 to 8 µs) duration to packet pairs to perform a simultaneous tone exchange distance measurement while round-trip time measurements are being taken.

[0337] Fig. Figure 50 shows a location and distance determination system 5600 with an RTT initiator 5602, an RTT responder 5604, and an RTT sniffer 5606. The RTT initiator 5602 and the RTT responder 5604 can operate like any initiators, responders, BLE radio units, or RF circuits disclosed herein. The RTT sniffer 5606 can be located on a vehicle together with one of the RTT devices 5602 or 5604 and can be connected to one of the antenna modules 40 of Fig. 2, while the RTT device in the vehicle comprises the other of the antenna modules 40. The devices 5602, 5604, 5606 may each comprise a control module, as described above, to perform one / each of the described operations. Polarization diversity, as described above, is provided: between the antennas of the RTT devices 5602, 5604; and between the antennas of one of the RTT devices 5602, 5604 located in the vehicle and the RTT sniffer 5606. Polarization diversity is particularly useful when orbital time measurements are performed. Each of the RTT devices 5602, 5604 may comprise singly or circularly polarized antennas.

[0338] One of the RTT devices 5602, 5604 located in the vehicle can be referred to as the master device, while the other RTT device 5602, 5604 is referred to as the slave device. When the master device transmits a challenge signal to the slave device, the RTT sniffer 5606 acts as a listener and detects (i) when the challenge signal is transmitted to and / or received by the RTT sniffer 5606, (ii) when the slave device transmits a response signal to the challenge signal, and / or (iii) when the RTT sniffer 5606 receives the response signal. The RTT-Sniffer 5606 can then use triangulation based on the transmit and / or receive times of the challenge signal and the transmit and / or receive times of the response signal to determine the location of the slave device.The master device can also measure the orbital period associated with the challenge signal and the response signal to measure direct paths between antennas instead of a bounce path. This prevents antenna zeros from being aligned or misaligned, and avoids cross-polarization.

[0339] The master device and the RTT sniffer 5606 cooperate to estimate the distance to the slave device. The following equations 5-7 can be implemented by the master device to calculate the time amount T. MS to determine the challenge signal to be transmitted from the master device to the slave device, where: T SM is the time it takes for the response signal to be transmitted from the slave device to the master device; T RX is the time when the response signal is received at the master device; T TXis the time when the challenge signal is transmitted from the master device; T SDELAY is the time delay amount for the slave device to respond with the response signal after receiving the challenge signal; and FixedOffset1 is an initial offset time amount that can be greater than or equal to 0. TMS+TSM=TRX−TTX−TSDELAY+FixedOffset1 TMS=TSM TMS=TRX−TTX−TSDELAY+FixedOffset12

[0340] The RTT sniffer 5606 knows: when the challenge signal is received at the RTT sniffer 5606; when the response signal is received at the RTT sniffer 5606; and the number of slave clock cycles between the time at which the slave device received the challenge signal and the time at which the slave device transmitted the response signal. The RTT sniffer 5606 (or listener / listener) can detect a difference between the time T SLRX, at which the RTT sniffer 5606 receives the response signal, and a time T MLRX , to which the RTT sniffer 5606 receives the challenge signal, determine using equation 8, where: T SL is the time value for the RTT sniffer 5606 to receive the response signal; FixedOffset2 is a second offset time value that can be greater than or equal to 0; T ML is the time required for the RTT sniffer 5606 to receive the challenge signal; T SLRX is the time at which the RTT sniffer 5606 receives the response signal; and T MLRX is the time at which the RTT sniffer 5606 receives the challenge signal. TMS+TSDELAY+TSL+FixedOffset2−TML=TSLRX−TMLRX

[0341] Since the master device and the RTT sniffer 5606 cooperate, information is shared in such a way that one or more of these devices can estimate the distance to the slave device based on equations 9-11. The sum of T MS and T SL can be substituted to provide equations 9-11. TRX−TTX−TSDELAY−FixedOffset12+TSDELAY+TSL+FixedOffset2−TML=TSLRX−TMLRX TRX−TTX−TSDELAY−FixedOffset12+TSL+FixedOffset2−TML=TSLRX−TMLRX TSL=TSLRX−TMLRX−TRX−TTX+TSDELAY−FixedOffset12−TSL−FixedOffset2−TML

[0342] By measuring the arrival times of the challenge and response signals at the RTT sniffer 5606 and sharing this information between the RTT sniffer 5606 and the master device, the distance between the vehicle and the slave device can be estimated. The distance can then be calculated, for example, by the master device using the arrival times and the known time T. MS and corresponding known signal transmission rates. The RTT of the challenge signal can be determined based on the measured arrival times. The distance can then be determined based on the RTT and the known signal transmission rates.

[0343] Fig. Figure 51 shows another location and distance determination system 5700 with an RTT initiator 5702, an RTT responder 5704, and several RTT sniffers 5706. The RTT initiator 5702 and the RTT responder 5704 can operate as any of the initiators, responders, BLE radio units, or RF circuits disclosed herein. The RTT sniffers 5706 can be located on a vehicle together with one of the RTT devices 5702 or 5704 and may include an antenna module (similar to the antenna modules 40 of [reference missing]). Fig. 2) include. Devices 5702, 5704, 5706 may each include a control module as described above to perform one / each of the described operations. The RTT device in the vehicle may also include an antenna module similar to antenna modules 40 of Fig. 2. Polarization diversity is provided: between the antennas of the RTT devices 5702, 5704; and between the antennas of one of the RTT devices 5702, 5704 located in the vehicle and the RTT sniffers 5706. Polarization diversity is used particularly when orbital time measurements are performed to measure direct paths between antennas instead of a bounce path. This prevents antenna zeros from being aligned or tuned / off, and cross-polarization.

[0344] One of the RTT devices 5702, 5704 located in the vehicle can be referred to as the master device, while the other RTT device 5702, 5704 is referred to as the slave device. When the master device transmits a challenge signal to the slave device, the RTT sniffers 5706 act as listeners, detecting when the challenge signal is transmitted and when the slave device transmits a response signal to the challenge signal. The RTT devices 5702, 5704 can be used similarly to the RTT devices 5602, 5604. Fig. 50 can operate. Each of the RTT-Sniffer 5706 can operate similarly to the RTT-Sniffer 5606.

[0345] A time TAB is the time it takes for the challenge signal to be transmitted from the RTT initiator 5702 to the RTT responder 5704. A time TBA is the time it takes for the corresponding response signal to be transmitted from the RTT responder to the RTT initiator. A time TAC is the time it takes for the first RTT sniffer to receive the challenge signal. A time TBC is the time it takes for the first RTT sniffer to receive the response signal. A time TAD is the time it takes for the second RTT sniffer to receive the challenge signal. A time TBD is the time it takes for the second RTT sniffer to receive the response signal. A time TAE is the time it takes for the third RTT sniffer to receive the challenge signal. A time TBE is the time it takes for the third RTT sniffer to receive the response signal. If TAB and TAC are known, TBC can be calculated. If TAB and TAD are known, TBD can be calculated.If TAB and TAE are known, TBE can be calculated.

[0346] If enough RTT sniffers are present, time TAB can be calculated. For example, if three RTT initiators know their locations relative to the master device (or initiator), time TAB can be calculated. This can be accomplished using equations 12-17, assuming all reflections are instantaneous, where: TRxAC is the time the first RTT sniffer receives the challenge signal; TRxBC is the time the first RTT sniffer receives the response signal; TRxAD is the time the second RTT sniffer receives the challenge signal; TRxBD is the time the second RTT sniffer receives the response signal; TRxAE is the time the third RTT sniffer receives the challenge signal; TRxBE is the time the third RTT sniffer receives the response signal.deltaRxAtC is the time difference between the time at which the first RTT sniffer receives the response signal and the time at which the first RTT sniffer receives the challenge signal; deltaRxAtD is the time difference between the time at which the second RTT sniffer receives the response signal and the time at which the second RTT sniffer receives the challenge signal; deltaRxAtE is the time difference between the time at which the third RTT sniffer receives the response signal and the time at which the third RTT sniffer receives the challenge signal. The location of the slave device (or responder) can also be determined using equations 18-25, where: xa is the x-coordinate of the master device; ya is the y-coordinate of the master device; za is the z-coordinate of the master device; xb is the x-coordinate of the slave device; yb is the y-coordinate of the slave device;zb is the z-coordinate of the slave device; xc is the x-coordinate of the first RTT sniffer; yc is the y-coordinate of the first RTT sniffer; zc is the z-coordinate of the first RTT sniffer; xd is the x-coordinate of the second RTT sniffer; yd is the y-coordinate of the second RTT sniffer; zd is the z-coordinate of the second RTT sniffer; xe is the x-coordinate of the third RTT sniffer; ye is the y-coordinate of the third RTT sniffer; ze is the z-coordinate of the third RTT sniffer. The x-, y-, z-coordinates of the master device and the slave device are known, and the x-, y-, z-coordinates of the slave device are determined. TBC, TBD and TBE can be determined in a similar manner to that described above. TAB+TBC−TAC=TRxBC−TRxAC=deltaRxAtC TAB+TBD−TAD=TRxBD−TRxAD=deltaRxAtD TAB+TBE−TAE=TRxBE−TRxAE=deltaRxAtE TBC=deltaRxAtC+TAC−TAB TBD=deltaRxAtD+TAD−TAB TBE=deltaRxAtE+TAE−TAB

[0347] Equations 18-21 are trilateration equations. (xb−xa)2+(yb−ya)2+(zb−za)2=TAB2 (xb−xc)2+(yb−yc)2+(zb−zc)2=TBC2 (xb−xd)2+(yb−yd)2+(zb−zd)2=TBD2 (xb−xe)2+(yb−ye)2+(zb−ze)2=TBE2

[0348] By substituting 4 equations with 4 variables, equations 22-25 are provided. (xb−xa)2+(yb−ya)2+(zb−za)2=TAB2 (xb−xc)2+(yb−yc)2+(zb−zc)2=(deltaRxAtC+TAC−TAB)2 (xb−xd)2+(yb−yd)2+(zb−zd)2=(deltaRxAtD+TAD−TAB)2 (xb−xe)2+(yb−ye)2+(zb−ze)2=(deltaRxAtD+TAD−TAB)2

[0349] When three RTT sniffers (e.g., the RTT 5706 shown) are used, trilateration can be performed using three circles to measure distances and determine the location of the slave device relative to one of the RTT devices 5702, 5704, and / or the corresponding vehicle. This can be done at the master device and / or at one or more of the RTT sniffers. The information determined at the master device and the RTT sniffers can be shared between them. The times, distances, and / or locations can be determined periodically and thus updated.

[0350] In the vehicle, if an object (e.g., the head of a vehicle occupant) is present near and / or between the antenna modules of the master device and one or more of the RTT sniffers, causing interference with the signals transmitted by the master device, the orbital time measurements can be updated periodically. This can be done to measure the distance between the master device and the RTT sniffer in order to detect when the corresponding physical environment / system has changed.

[0351] Fig. Figure 52 shows a first network device (or vehicle) 5800 and a second network device (or portable network device) 5802. The first network device 5800 comprises a tone exchange responder 5804 and a tone exchange initiator 5806. A tone exchange is also referred to as an unmodulated carrier tone exchange or an exchange of an unmodulated carrier tone. The second network device 5802 comprises a tone exchange initiator 5808 and a tone exchange responder 5810. The devices 5804, 5806, 5808, and 5810 can be implemented as any of the other BLE radio units, RF circuits, initiators, responders, etc., disclosed herein. At least one of the devices 5804, 5808 and at least one of the devices 5806, 5808 can comprise or be connected to a singly polarized antenna and a circularly polarized antenna. The devices 5804, 5806, 5808, 5810 can each include the antenna module 40 of Fig. 2 and / or the in Fig. The 11 antennas shown are included.

[0352] Tone exchange can take place between the responder 5804 and the initiator 5808, and between the initiator 5806 and the responder 5810. RTT measurements can be transmitted in the same packets as the exchanged tones. The devices 5804, 5806, 5808, and 5810 can randomly select the channels used for packet transmission. Packet transmission and packet reception can occur simultaneously. For example, the initiator 5808 can transmit a tone to the responder 5804 on a first channel while the initiator 5808 receives a tone from the responder 5804 on a second channel. The initiator 5806 can transmit and / or receive tones while the initiator 5804 is transmitting and / or receiving tones.

[0353] The 5800 and 5802 network devices can be pre-synchronized, for example, through a sequence signal exchange (or handshake), to synchronize their clocks. This synchronization allows the network devices to transmit signals to each other simultaneously. For example, two 1 MHz signals, each carrying 1 Mbps of data, can be transmitted. The signals can be 2 MHz apart. This prevents an attacking device from carrying out attacks such as range extension attacks or attacks involving active tonal manipulation. If the attacker uses a bandpass filter with a 1 MHz bandwidth, the filter would have a significant delay and therefore would not respond quickly enough to allow an attack to occur.If the attacker uses a broadband bandpass filter, such as a 4 MHz bandpass filter, the corresponding signal eye diagram would exhibit too much noise to detect the signals transmitted by the network devices 5800 and 5802. As another example, the signals from the network devices can be transmitted at a symbol rate of less than or equal to a predetermined time interval (e.g., 1 µs per symbol). This provides fast transmission, which prevents an attack. Furthermore, the simultaneity of dual signals prevents an attacker from succeeding, as the attacker would have to detect and manipulate both signals. Both signals can be transmitted at different frequencies, through the same network device, or through different network devices, as described above.

[0354] Devices 5804, 5806, 5808, and 5810 can change the frequencies of the transmitted tones, monitor phase changes due to frequency changes, and determine a distance between network devices 5800 and 5802 based on the phase changes. This can be described as carrier-phase-based distance measurement. Alternatively, if a signal is transmitted and received as a result of the signal being reflected back to the source, a phase difference between the transmitted and received signals can be used to determine a modulo or fractional remainder of a distance between the source and the reflector. Similarly, an initiator can determine a modulo or fractional remainder of a distance between the source and the reflector.Determine a fractional distance between an initiator and a responder based on a phase difference between (i) a signal transmitted from the initiator to the responder and (ii) a corresponding response signal transmitted back from the responder to the initiator. The slope of a phase difference for a given frequency change is equal to or equal to a distance with a frequency step size limit. The smaller the frequency steps, the greater the fractional distance extension (see "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan, and Capkun, which is incorporated herein by reference).

[0355] As another example, a received signal strength indicator (RSSI) parameter can be monitored to determine if a network device is near a vehicle, and then a series of tone exchanges can be performed to measure distance. Tone exchanges can be initiated based on a user touching a door handle to ensure no attack is occurring. Multiple round-trip measurements can be taken to determine the distance of the network device relative to the vehicle.

[0356] The aforementioned distance determination techniques can be used in combination with other techniques disclosed herein for determining RTT values. The direction of sound propagation between devices 5804, 5806, 5808, and 5810 can be randomized.

[0357] In one embodiment, a control module of the first network device 5800 applies phase changes versus frequency changes for each of several tones that are exchanged to generate several linear curves. The control module determines the slopes of the curves, which provide ratios of the phase changes to the frequency changes. The slopes are then used to determine the distances between the adjacent curves, which are related to the distance between the first and the second network device 5800, 5802.

[0358] Fig. Figure 53 shows a positioning system 5900 with a tone exchange initiator 5902, a tone exchange responder 5904, and a tone exchange sniffer 5906. The tone exchange initiator 5902 and the tone exchange responder 5904 can operate like any of the initiators, responders, BLE radio units, and RF circuits disclosed herein. The tone exchange sniffer 5906 can operate similarly to the RTT sniffer 5606 of Fig. 50 work and are located together with one of the tone exchange devices 5902, 5904 on a vehicle and one of the antenna modules 40 of Fig. 2, while the tone exchange device in the vehicle comprises the other of the antenna modules 40. The devices 5902, 5904, 5906 may each comprise a control module, as described above, to perform one / each of the described operations. Polarization diversity is provided: between the antennas of the tone exchange devices 5902, 5904; and between the antennas of one of the tone exchange devices 5902, 5904 located in the vehicle and the tone exchange sniffer 5906. Polarization diversity is used in particular when round-trip time measurements are performed.

[0359] One of the tone exchange devices 5902, 5904 located in the vehicle can be referred to as the master device, while the other tone exchange device 5902, 5904 is referred to as the slave device. When the master device transmits tones to the slave device and vice versa, the tone exchange sniffer 5906 acts as a listener / listener, detecting (i) when tones are transmitted to and / or received by the tone exchange sniffer 5906, (ii) when the slave device transmits tones to the master device, and / or (iii) when the tone exchange sniffer 5906 receives tones transmitted by the slave device. The slave device can act as a reflector and transmit tones received from the master device back to the master device.The master device and / or the sniffer device can prevent at least one instance of access to or operational control of the vehicle based on the arrival times of the tones, round-trip time measurements and / or estimated distances between the devices.

[0360] Fig. Figure 54 shows a method for determining distances between an initiator and a responder and between a responder and a sniffer. Although the following operating procedures of Fig. 54 mainly with reference to the implementations of Fig. 50 and Fig. As described in section 53, the operational procedures can be easily modified to apply to other implementations of the present disclosure, such as the implementations of Fig. 2-6, 11, 14, 39 and 46-49. The operational processes can be carried out iteratively. Although the method is mainly based on the embodiment of Fig. As described in section 53, the method can be applied to other embodiments of the present invention.

[0361] The process can begin at 6000. At 6002, the tone exchange initiator 5902 transmits a tone signal to the tone exchange responder 5904. The tone can be expressed as e(jωt+ϕA)−τAB, where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, τ AB a propagation time from A to B and is directly related to the distance between the tone exchange initiator 5902 and the tone exchange responder 5904, ω is a frequency, ϕ A , the phase of the tone at the tone exchange initiator 5902 is, t is the time.

[0362] At 6004, the tone is sent to the tone exchange responder 5904 with a delay ϕ B and the tone exchange sniffer 5906 with delay Φ Creceived. At the tone exchange responder 5904, the received tone signal is converted down to the baseband, which can be expressed by equation 26. e(j(ωt+ϕA))e(jωτAB)e(−j(ωt+ϕB))=e(jωτAB+ϕA−ϕB)

[0363] The received audio signal is converted down to the baseband at the tone exchange sniffer 5906, which can be expressed by equation 27. e(j(ωt+ϕA))e(jωτAC)e(−j(ωt+ϕC))=e(jωτAC+ϕA−ϕC)

[0364] At 6006, the tone exchange initiator 5902 receives the tone from the tone exchange responder 5904, which transmits the tone signal back to the tone exchange initiator 5902 as a second tone signal. The tone can be expressed as e(jωt+ϕA)−τAB. The received second tone signal can be represented by equation 28. The tone exchange sniffer 5906 also receives the second tone signal, which can be represented by equation 29. e(j(ωt+ϕB))e(jωτBA)e(−j(ωt+ϕA))=e(−j(ωt+ϕA)) e(j(ωt+ϕB))e(jωτBC)e(−j(ωt+ϕC))=e(jωτBC+ϕB−ϕC)

[0365] At 6008, the tone exchange initiator 5902 receives a phase signal from the tone exchange responder 5904, which denotes a tone value of a natural logarithm with a phase difference of the tone when received at the tone exchange responder 5904. The tone exchange responder 5904 thus sends a measured phase to the tone exchange initiator 5902, where values ​​are multiplied as shown by equation 30. e(jωτAB+ϕA−ϕB)e(jωτBA+ϕB−ϕA)=e(2jωτAB)

[0366] At 6010, the tone exchange sniffer 5906 determines, based on the received tone signals, tone values ​​related to: a phase difference of the tone between a time when it is transmitted by the tone exchange initiator and a time when it is received by the tone exchange sniffer; and a phase difference of the tone between a time when it is transmitted by the tone exchange responder and a time when it is received by the tone exchange sniffer. The tone values ​​can be displayed e(jωτBC+θB−θC) and e(jωτAC+θA−θC),

[0367] In 6012, the initiator 5902 and / or the sniffer 5906 determine the distances between the initiator 5902 and the responder 5904, and between the initiator 5902 and the sniffer 5906. The distance values ​​can be determined in a similar manner to that described above if a period of rotation is detected; see, for example, Equations 12 and 15 and the corresponding description. Instead of a period of rotation, a phase is used. This calculation may involve the use of Equation 31, where the tone values e(jωτBC+ϕB−ϕC) and e(−jωτAC−ϕA+ϕC) measured or determined on the Sniffer 5906, e(jωτAC) is known a priori, and tone value e(jωτAB+ϕA−ϕB) The responder 5904 is determined. e(jωτBC+θB−θC)e(−jωτAC−θA+θC)e(jωτAC)e(jωτAB+θA−θB)=e(jωτBC+jωτAB)=ejω(τBC+τAB)

[0368] The initiator 5902 and / or the sniffer 5906 can take the inverse logarithm of the result of equation 31 to calculate the times τ BC and τ AB to provide. The distances between the responder 5904 and the sniffer 5906 and between the initiator 5902 and the responder 5904 can then be determined based on these times and the known transmission rates of the tone signals. The procedure can end at 6014. The initiator 5902 or the sniffer 5906 can prevent access to or operational control of the vehicle based on at least one of the estimated distances.

[0369] Fig. Figure 55 shows an example of a passive tone exchange and phase difference detection system 6100. The system 6100 comprises a phase-locked loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and antenna modules 6110. The antenna modules 6110 can be used similarly to the antenna modules 40 of Fig. 2. The transmitter 6106 transmits an initial tone, which may be an output from the PLL 6102 and is reflected back to the receiver 6108 by a reflector 6112. The output from the PLL and the reflected tone signal are provided to the phase module 6104. The phase module 6104 determines a phase difference between the output from the PLL and the reflected tone signal. The phase module 6104, or another module disclosed herein, determines a distance between the transmitter 6106 and the reflector 6112 based on the phase difference. The phase module 6104, or another module disclosed herein, can prevent access to the interior of and / or operational control of a vehicle based on the determined distance.

[0370] Fig. Figure 56 shows an example of an active tone exchange and phase difference detection system 6200. The system 6200 works similarly to the system 6100 from Fig. 55. The transmitter and receiver 6106, 6108 are represented by box 6202. The reflector 6112 of Fig. 55 can be replaced by responder device 6204 for active tone exchange. Responder device 6204 can receive an initial tone signal from transmitter 6106, consisting of one or more tones, and respond with a second tone signal. The second tone signal can include the same one or more tones and / or one or more other tones. The second tone signal is then transmitted back to receiver 6108.

[0371] Fig. Figure 57 shows an initiator packet 6300 and a response packet 6302, which are used for RSSI and time-of-flight measurements. The initiator packet 6300 can contain several fields, such as a preamble, a synchronization access word (e.g., a pseudorandom synchronization access word), a data field containing data, a cyclic redundancy check (CRC) field containing CRC bits, and a continuous wave (CW) tone field containing a CW tone. The response packet 6302 can contain a CW tone field, a preamble, a synchronization access word, a data field, and a CRC field.

[0372] An initiator device can transmit the initiator packet 6300, which can be received by a responder device. The responder device can then generate the response packet 6302 and transmit the response packet back to the initiator device. This can be done for tone exchange, phase difference determination, round-trip time measurements, etc. A distance between the devices can then be determined. These measurements and calculations can be performed to detect a range extender-type relay station attack. In one embodiment, the initiator and the responder negotiate in advance what the synchronization access words will be, based on a predetermined list. The synchronization access words include access addresses. The initiator can, for example, measure the time required to receive (i) the response packet after transmitting the initiator packet and / or (ii) the synchronization access word.The time value and the synchronization access word can be compared to predetermined time values ​​and a predetermined synchronization access word. If the comparisons result in matches, then a range extender-type relay station attack has not occurred. However, if the received synchronization access word does not match and / or the time values ​​differ from the predetermined value by more than expected, then a range extender-type relay station attack may have occurred.

[0373] In one embodiment, the initiator and responder exchange a predetermined key, a list of synchronization access words, and times at which each synchronization access word is to be transmitted. The synchronization access words, if initially generated, can be randomly selected. This allows the responder to know the correct key and / or synchronization access word to respond with when it receives an initiator packet. The key can be included in the response packet. In another embodiment, the initiator and response packets do not include the preambles, as described in Fig. Figure 58 shows that in one embodiment, the CW tones are 4-10 µs in length.

[0374] In another embodiment, the initiator packet and the responder packet have the same format as described in Fig. Figure 59 shows that each packet contains: a first CW tone as the first field; a synchronization access word; a data field; a CRC field; and a second CW tone as the last field. Another example of initiator and response packets with the same format is shown in Figure 59. Fig. Figure 60 shows each packet comprising: as a first field, a CW tone; a synchronization word with PACRMBI; a PDU field with a PDU; a Media Access Control (MAC) field; a CRC field; and as a last field, a second CW tone. The CW tones of Fig. 57-60 can be tones of cryptographically random length and, if received, can be examined or verified by the initiator. For example, if CW tones received by a responder are incorrect, a range extender-type repeater attack may have occurred. With the embodiments of Fig. Paragraphs 59-60 prevent synchronization word repetition / transmission of a CW tone exchange beyond an ambiguous range (e.g., 75 meters) at 2 MHz channel tone steps. The initiator and responder packets referred to above can be transmitted on the same frequency. Because the initiator and responder packets are in the same format, an attacking device is unable to distinguish which packet is the initiator packet and which packet is the responder packet. In one embodiment, the CW tones at the end of the packets are not included.

[0375] In one embodiment, the timing, frequencies, lengths, power levels, amplitudes, and contents of the CW tones and synchronization access words of the initiator and responder packets are examined at the initiator and responder to determine their correctness and / or consistency, and to identify and detect whether an attack has occurred. In another embodiment, a pseudorandom number of packets are exchanged on a first frequency before switching to the next frequency and exchanging another pseudorandom number of packets.

[0376] Since an attacking device typically includes filters (e.g., low-pass and band-pass filters) and mixers (e.g., a step-down converter and a step-up converter), it introduces delays in the transmission of a signal. For an attack to go undetected, the attacking device must retransmit a received signal without any detectable delay. This makes it difficult for the attacking device to remain undetected. An attacking device can delay a signal by 500 ns, which can delay the signal 500 feet in space. For an attacking device to pre-transmit a tone or initiate a tone transmission at the correct time, it must know in advance what is being transmitted. This is unlikely, especially if a heterodyne receiver is used to receive the transmitted signal.The heterodyne receiver translates packets / tones into an in-phase (I) - quadrature phase (Q) range and detects them within the IQ range. Phase differences are detected within the IQ range. If an attack is present, the resulting delay can be detected within the IQ range based on these phase differences. If a tone is shortened by an attacking device so that the corresponding synchronization access word arrives at the correct time, then the timing and length of the CW tone will be incorrect, and this will be detected by the initiator.

[0377] In one embodiment, the initiator examines or checks the CW tones transmitted by the responder for (i) length relative to the start of a transmitted synchronization access word, (ii) consistent power (or amplitude) before and relative to the synchronization access word, and (iii) consistent tone throughout the synchronization access word. Consistent tone can refer to a consistent frequency, consistent power level, consistent amplitude, etc. In another embodiment, the start and end times of the synchronization access word relative to the start of the first CW tone of a transmitted packet can be known within a predetermined time interval (e.g., a ±10 ns range). Thus, if the start and end times are within predetermined intervals of the start of the first CW tone of the packet, then no attack has occurred; otherwise, an attack has occurred.

[0378] As another example, a PLL from an initiator transmitting a tone can have three different tones on a given channel that the PLL can generate: a mid-tone, a high-pitched tone at a first frequency (e.g., 250 kHz), and a low-pitched tone at a second predetermined frequency (e.g., -250 kHz). The transmitted tones can be selected and transmitted according to a predetermined, agreed-upon random sequence and / or a predetermined, agreed-upon tone pattern. This can be agreed upon between the initiator and the responder. The PLLs of the initiator and an attacking device may not be consistent with each other. If there is a frequency difference greater than a predetermined threshold between the signal transmitted by the initiator and the signal received in response, the initiator can determine that an attack has occurred.

[0379] In one embodiment, the responder is able to measure the phase delay of a received signal and return this information as data. This can be based on the moment the responder receives a CW tone from the trailing end of a packet from an initiator. The responder can measure the phase delay between (i) the trailing end (or tail) CW tone of the packet received by the initiator and (ii) a leading end (or first leading / front CW tone) of a packet transmitted by the responder in response to the packet received from the initiator. The initiator can then calculate the total bidirectional round-trip time of the packet from the initiator to the responder and back again.

[0380] In addition to detecting a delay in a signal, an initiator can also detect when an attacking device amplifies the signal (or sound). Amplifying a signal / sound can also delay transmission, which can be detected. During the transmission of sounds by an attacking device, a sound may become distorted and / or a different sound may be transmitted instead of the originally transmitted sound.

[0381] The aforementioned examples enable more accurate distance measurements with a smaller number of packets, each containing both a synchronization access word and a CW tone. The synchronization access word protects the CW tone from being modified without detection by an attacking device, and vice versa. Bidirectional randomization communication is used, protecting both the synchronization access words and the CW tones.

[0382] A PLL, such as the one disclosed herein, from an initiator can be a predictable-phase PLL, which allows the initiator to predict the phase of a signal when a frequency of the signal is changed. This can eliminate the need to check whether the timing of a CW tone transmitted by the initiator and a CW tone transmitted by a responder are correct. A responder can measure, for example, when a rear-end CW tone is received by an initiator, determine the corresponding phase delay of the rear-end CW tone relative to the generation of a front-end CW tone by the responder for a response signal, and transmit this information to the initiator along with the front-end CW tone. The initiator can then calculate a total round-trip time based on the received information.

[0383] In one embodiment, an initiator is a vehicle or a portable access device, and a responder is the other, also from the vehicle and the portable access device. The order in which the vehicle and the portable access device transmit and respond is changed pseudorandomly. A packet and / or a tone signal can also be sent as a response and then used as an initiator packet and / or an initiator tone signal. In another embodiment, the order in which the vehicle and the portable access device transmit and respond is not changed for short periods (e.g., exchange periods of less than a predetermined duration) and is changed for long exchange periods (e.g., exchange periods greater than or equal to the predetermined duration). The order can be changed periodically.In these examples, bidirectional data is exchanged using antenna polarization diversity to provide accurate time measurements.

[0384] Processing is implemented to provide accurate measurements of the start and end points of CW tones and synchronization access words. The 3920 Correlation and Protocol Module can maintain and snap a circular queue of bits to compare the start and end times and lengths of CW tones and synchronization access words from transmitted (initiator) packets with those of received (responder) packets. The 3920 Correlation and Protocol Module can interpolate zero-crossing points. Post-processing on I and Q data associated with a synchronization access word can be performed for clock recovery to interpolate when the synchronization access word arrived. I and Q data can have different rotation rates.Interpolation can be performed to determine the midpoints of transitions or profiles, enabling precise timing for clock recovery. Multiple zero-crossing points can be detected and aligned for dialing into the timing. Additionally, I and Q data can be oversampled, as described in more detail below, to optimally match or align one or more bits.

[0385] Fig. Figure 61 shows an antenna path determination system 6700 for network devices with respective antenna modules. The antenna modules exhibit polarization diversity. In this example, two polarization axes are shown for each antenna module. Each antenna module comprises a vertically oriented antenna and a horizontally oriented antenna. Possible channel vectors h VV , h VH , h HV and h HHDistance measurement modules 6710 are shown. The distance measurement modules 6710 determine, based on one of the respective channel vectors h VV , h VH , h HV and h HH A distance (or range) between the corresponding antennas of the network devices. The range measurement modules can execute range measurement algorithms to calculate distances r̂ VV ,r̂ VH ,ř HV and r̂ HH to determine. The determined distances r̂ VV ,r̂ VH ,ř HV and r̂ HH are provided to a minimum module 6712, which determines which of the distances r̂ VV ,r̂ VH ,ř HV and r̂ HH The shortest route can be selected.

[0386] Each channel vector can be generated for one or more selected frequencies. When compared, distances can be generated for channel vectors of the same or different frequencies. For example, vectors can be generated for at least some of 80 different tones, each with a 1 MHz frequency step between adjacent tones and located within a 2.4 GHz ISM band (ISM: "Industrial, Scientific and Medical"). A frequency associated with the shortest distance can be selected. Other factors can also be considered when making the selection, such as signal strength, amplitude, voltage, parameter consistency, etc. This path selection can be performed by any of the initiators, responders, modules, network devices, etc., disclosed herein and used for round-trip time measurements.This allows the selection of the best antenna path for bidirectional packet and / or audio signal exchange to determine a round-trip time.

[0387] Now, reference is made to Fig. 38 and Fig. 62, which shows an exemplary radio unit model 6800, which is related to the structure, function and operating procedures of the BLE radio unit 3900 (and / or a modified version of the BLE radio unit 3900) by Fig. 38 and an RF channel and a corresponding RF circuit. The radio unit model 6800 can include: a first sampling module 6802, a time-shift module 6804, a Gaussian low-pass filter 6806, an integrator 6808, a first upsampler 6810, an amplifier 6812, a summing module 6814, a modulator 6816, a second sampling module 6818, a phase and frequency offset module 6820, a first mixer 6822, a phase delay device 6823, a second mixer 6824, a phase delay module 6826, a second low-pass filter 6828, a re-sampling module 6830, an arctangent module 6832, a differentiator 6834, a sign determination module 6836, a bit pattern module 6838, a second upsampler 6840, a third upsampler 6842, a cross-correlation module 6844, and a peak detector 6846. The devices 6802, 6804, 6806, 6808, 6810, and 6812 can be an example of the transmitter section or...The summing device 6814 represents the channel between (i) the other BLE radio unit and (ii) the BLE radio unit 3900 with devices 3907, 3906, 3908, 3932, and 3910. Phase and frequency offsets can exist between the receiving and transmitting BLE radio units because the receiving BLE radio unit cannot be phase-locked with the transmitting BLE radio unit. Devices 6816, 6818, 6820, 6822, 6824, 6828, and 6830 correspond to the receiver part or section of the BLE radio unit and are associated with an RF sampling rate. Devices 6830, 6832, 6834, 6836, and 6838 correspond to the receiver section and perform operations on baseband signals. The rescanning module 6830 functions as an analog-to-digital converter. Devices 6840, 6842, 6844, and 6846 also correspond to the receiver section.-section and are related to an interpolation to determine a phase.

[0388] When reconstructing a bitstream, zero crossings of a reconstructed signal from the 6834 differentiator can be determined. A significant amount of jitter or fluctuation at the zero crossings can negatively affect time-of-flight calculations based on zero crossing times. Even a small amount of jitter or fluctuation negatively affects transmit and receive time calculations.

[0389] The 6840 and 6842 upsamplers and the 6844 cross-correlation module are implemented to reduce jitter associated with sampling and zero-crossing determination. The 6840 and 6842 upsamplers perform signal processing to interpolate and insert data points between existing received data points, providing finer time resolution.

[0390] In one embodiment, the transmitted bitstream is pre-known by the BLE receiver and is provided to the upsampler 6842, as shown by arrow 6843. In this example, the sign determination module 6836 and the bit pattern module 6838 are not included. In another embodiment, the transmitted bitstream is unknown, and the sign determination module 6836 and the bit pattern module 6838 are included and provide an estimated bitstream to the upsampler 6842. As an example, the transmitted bitstream can be an access address that identifies which device is transmitting. The estimated bitstream can be determined based on a reference. For example, the reference can be a preamble to the estimated bitstream and / or a bit sequence received prior to the estimated bitstream.The preamble and / or the bit sequence provide a temporal reference on which the estimated bitstream can be generated. The estimated bitstream is generated based on a known clock frequency of the transmitter and in relation to the transmitted signal and a clock frequency of the receiver.

[0391] The 6844 cross-correlation module performs cross-correlation between the outputs of the 6840 and 6842 upsamplers and / or between the outputs of the 6840 upsampler and the 6838 bit pattern module. Cross-correlation is performed to align the envelopes of signals supplied to the cross-correlator and to determine any phase difference. The cross-correlation may involve performing a product of the output signals, comprising taking products from corresponding data points of the two output signals and summing the products. This product-sum process is iterated, with one of the outputs being incrementally shifted in time relative to the other output by one data point for each iteration to provide multiple resulting product sum values.A maximum of the product sum values ​​refers to a point in time when the two outputs are in synchronization (or alignment), so that the waveforms or profiles match and are temporally aligned or coordinated. Based on this information, the phase offset (or difference) between the two outputs is determined.

[0392] Cross-correlation has improved resolution due to the upsampling performed by the 6840 and 6842 upsamplers. The 6846 cross-correlation module performs correlation with signals of finer resolution than the originally received signals to obtain a more precise interpolation of the arrival time of a received packet within the received signal. The higher correlation resolution reduces signal-to-noise ratios and bit lengths of messages and can include interpolation at a finer resolution. The phase shift can be used for time-of-flight determinations, as described herein. The 6846 peak detection module evaluates cross-correlation results and indicates (i) when the time-aligned peak occurred, and / or (ii) the phase shift.In one embodiment, the cross-correlation module 6844 receives digital values, and the peak detection module 6846 determines whether the cross-correlation output (or the sum of the product values) has reached a predetermined threshold. When the predetermined threshold is reached, the peak detection module then indicates "signal found" and determines a phase.

[0393] In one embodiment, the output of the upsampler 6840 is provided to the sign determination module 6836 and the cross-correlation module 6844, and the upsampler 6842 is not included. In this example, the output of the bit pattern module 6838 is provided directly to the cross-correlation module 6844.

[0394] The devices of Fig. 38 and Fig. 62 are referred to in relation to the procedure of Fig. 63 further described. Although the following operational processes of Fig. 63 mainly with reference to the implementations of Fig. The operational procedures described in Sections 2-6, 11, 14, and 38 can be easily modified to apply to other implementations of this disclosure. The operational procedures can be performed iteratively.

[0395] The process can begin at 6900. At 6902, the sampling module 6802 of a first network device (e.g., a network device implemented in a vehicle as part of an on-board system or in a portable access device) receives a bitstream to be transmitted by the processing module 3922. The sampling module 6802 samples the bitstream.

[0396] In the 6904 version, the time-shift module 6804 receives an output from the sampling module 6802 and can introduce a time offset (or delay). The sampling module 6802 and the time-shift module 6804 can be implemented by the protocol module 3924. In the 6906 version, the Gaussian low-pass filter (LPF) 6806 receives an output from the time-shift module 6804, which can include a bitstream that is filtered, and converts a square wave into a sinusoidal wave. Operation of the Gaussian LPF 6806 can be implemented by the GFSK modulator 3926. In the 6908 version, the integrator 6808 integrates an output from the Gaussian LPF 6806, and this can be implemented by the D / A and low-pass filter 3928. Example signals 7000, 7002, 7004, which are output by the sampling module 6802, the Gaussian LPF 6806 and the integrator 6808, are shown in Fig. 64A shown.

[0397] At 6910, the upsampler 6810 upsamples an output from the integrator 6808 to include additional points per sample. The upsampler 6810 can be implemented by the boost converter 3930. At 6912, the amplifier 6812 provides frequency deviation gain. At 6914, the sampling module 6818 receives an RF tone, which can be provided by the PLL 3940. An output from the sampling module 6818 is provided to both the modulator 6816 and the phase and frequency offset module 6820. At 6916, the modulator 6816 modulates an output from the sampling module 6818 based on an output from the amplifier 6812 to provide an initiator signal. The modulator 6816 can be implemented, at least partially, by the boost converter 3930.

[0398] In device 6918, the initiator signal from modulator 6816 can be provided to power amplifier 3932 and transmitted to a second network device. The second network device can be a network device implemented in a vehicle as part of an on-board system or in a portable access device. The initiator signal can be any of the initiator signals, initiated audio signals, signals transmitted from a master device, and / or the like disclosed herein.

[0399] At 6920, the low-noise receiver 3910 amplifies a response signal in reply to the initiator signal. The response signal may include Gaussian noise, which is contained in the received response signal as represented by the summing mixer 6814. At 6922, the mixers 6822 and 6824 receive the response signal from the low-noise amplifier 3910 and downconvert it into in-phase (I) and quadrature-phase (Q) baseband signals, respectively. The quadrature-phase baseband signal can be phase-delayed by 90° via the phase delay device 6823. This can be implemented at the step-down converter 3912.

[0400] At 6924, the LPF 6828 filters the baseband signals and removes high-frequency content. The LPF 6828 can include multiple LPFs; one for each down-converted signal. The LPF 6828 can replace and / or be implemented by the bandpass filter and amplifier 3914. At 6926, the resample module 6830 samples the filtered baseband signals with sampling jitter. The resample module 6830 can be implemented by the A / D converter 3916. Example signals 7006 and 7008 from the resample module 6830 are shown in Fig. 64B shown.

[0401] At 6928, the arctangent module 6832 determines an arctangent of the baseband signals to generate an arctangent signal. An example signal 7010 from the arctangent module 6832 is shown in Fig. 64C is shown. At 6930, the differentiator 6834 differentiates the arctangent signal from the arctangent module 6832. An example signal 7012 from the differentiator 6834, shown over the original Gaussian-filtered signal 7002, is in Fig. 64D shown.

[0402] At 6932, the sign module 6836 performs a signing function and determines the sign of the output of the differentiator 6834. At 6934, the bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of the sign module 6836. The idealized bit pattern is obtained to match the bit pattern from the Gaussian low-pass filter 6806, or other bit patterns, with the received bit pattern after the operations of the low-pass filter 6828 and the arctangent module 6832 have been applied. This is done in such a way that upsampled values ​​are similar to noise-free re-sampled data.

[0403] At 6936, the upsamplers 6840 and 6842 sample the outputs of the differentiator 6834 and the bit pattern module 6838. At 6938, the outputs of the upsamplers 6840 and 6842 are correlated by the cross-correlation module 6844 to generate a correlation signal. The devices 6832, 6834, 6836, 6838, 6840, and 6842 can be implemented by the demodulator 3918. At 6940, the peak detector 6846 determines a phase of the resulting correlated signal from the cross-correlation module 6844. The cross-correlation module 6844 and the peak detector 6846 can be implemented by the correlation and protocol module 3920. In one embodiment, the peak detector 6846 is implemented as a parabolic 3-point peak interpolator on or in addition to the upward-sampled cross-correlation module 6844.Two points near (within a predetermined distance of) the detected tip are selected, and a parabolic 3-point interpolation of the upwardly sampled result is obtained.

[0404] In 6942, a distance, a location, a round-trip time, and / or other parameters are determined based on the phase (or a parabolic 3-point interpolation of the upward-sampled result). The distance can be the distance between the first network device and the second network device. The location can be the position of the second network device relative to the first network device. The round-trip time can be the time for the initiator signal to propagate to the second network device and for the first network device to receive the response signal, including the time for the second network device to generate the response signal after receiving the initiator signal.

[0405] At 6944, the processing module 3922 can determine, based on the phase, distance, location, orbital period, and / or other parameters determined at 6942, whether a range-extendance-type relay attack has occurred. If a range-extendance-type relay attack has occurred, then operation 6946 can be performed; otherwise, the procedure can terminate at 6948. At 6946, the processing module 3922 performs a countermeasure, such as any of the countermeasures disclosed herein.

[0406] The above-described operational processes of Fig. 35, Fig. 36, Fig. 45, Fig. 54 and Fig. The 63 examples are intended as illustrative illustrations. Depending on the application, the operational processes can be performed sequentially, synchronously, simultaneously, continuously, during overlapping time periods, or in any other order. Furthermore, depending on the implementation and / or a sequence of events, one of the operational processes may not be performed or may be skipped.

[0407] There are discrepancies in a transmission time between (i) the time at which a generated waveform or signal reaches antennas to be transmitted, and (ii) the corresponding time measured by a timer. Contributing factors include clock range crossing(s), clock range changes, clock period variations, power amplifier propagation delay due to gain adjustment, and temperature and process propagation delay. Process, temperature, and gain adjustment variations can be calibrated out of the timing measurement.

[0408] A second BLE device (e.g., the BLE device (or radio unit) 3900B), which is similar or identical to a first BLE device (e.g., the BLE device (or radio unit) 3900A) from Fig. 38) can be added and implemented in a vehicle to represent a reflective (or responder) device, as described in Fig. Figure 49 shows that each of the BLE radio units 3900 can be implemented on a separate system-on-chip (SoC). The first BLE radio unit 3900A can transmit an initiator signal that can be received by the receiver section of the second BLE device.

[0409] A time T1 can be generated for the point in time at which a first bitstream is generated and / or provided to the protocol module 3924A of the first BLE radio unit 3900A to generate an initiator signal to be transmitted by the first BLE radio unit 3900A, as determined by the timers 3938A. A time T2 can be the point in time at which the correlation and protocol module 3920B of the second BLE radio unit 3900B receives the first bitstream, as determined by the timers 3938B. A first calibration constant CAL1 can be set equal to, or determined based on, the difference between the point in time at which the timers 3938A detect the generation of the first bitstream and the point in time at which the corresponding initiator signal is transmitted by the antenna 3907A.A second calibration constant, CAL2, can be set to, or determined based on, the difference between the time at which the timers 3938B detect reception of the first bitstream at the correlation and protocol module 3920B. The flight time for the first bitstream from the protocol module 3924A to the correlation and protocol module 3920B is (T2 - CAL2) - (T1 - CAL1).

[0410] Similarly, a time T3 can be generated for the point in time at which a second bitstream, corresponding to the first bitstream, is generated and / or provided to the protocol module 3924B to generate a response signal to be transmitted by the second BLE radio unit 3900B, as determined by the timers 3938B. The response signal is generated in reply to the initiator signal. A time T4 can be the point in time at which the correlation and protocol module 3920A receives the second bitstream, as determined by the timers 3938A. The third calibration constant CAL3 can be set to, or determined based on, the difference between the point in time at which the timers 3938B detect the generation of the second bitstream and the point in time at which the corresponding response signal is transmitted by the antenna 3907B.A fourth calibration constant, CAL4, can be set to or determined based on the difference between the time at which the timers 3938A detect reception of the second bitstream at the correlation and protocol module 3920A. The flight time for the second bitstream from the protocol module 3924B to the correlation and protocol module 3920A is (T4 - CAL4) - (T3 - CAL3). An average flight time, a distance between the first and second BLE radio units 3900, can be determined using equations 33-35, where equation 33 is based on equation 32 and takes into account the aforementioned time deviations, thus including the corresponding calibration values. Average flight time = (T3 − T1) + (T4 − T3)²

[0411] By capturing identical information and adding calibration values: Average flight time = (T3 − CAL3 − T2 + CAL1) + (T4 − CAL4 − T3 + CAL3)² Distance=(c)(T4−CAL4−T1+CAL1)+(T3−CAL3−T2+CAL2)2

[0412] Cutting the calibration of time values: Distance=(c)(T4−T1)−(T3−T2)+(CAL1−CAL4+CAL2+CAL3)2

[0413] The 3938B timers can start with a processing agreement and / or perform fine-tuning or coordination of the transmission time at the second BLE radio unit 3900B to minimize reporting or notification about / around T2-T3.

[0414] The PLLs 3940A and 3942A of the first BLE radio unit 3900A can be implemented as a single PLL. Similarly, the PLLs 3940B and 3942B of the second radio unit 3900B can be implemented as a single PLL. Two PLLs allow the transmit and receive hardware to be implemented on the same SoC, while enabling the acquisition of the transmit time of the initiator signal using the same BLE circuitry, which is also used to acquire the receive time of a response signal.

[0415] According to the present teachings, a multiaxially polarized RF antenna arrangement or assembly comprises a circularly polarized antenna with a conductive annular body having an inner hole, a circular insulator connected to the conductive annular body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular insulator, extending outward from the circular insulator. The linearly polarized antenna comprises a shell and a conductive element extending through the shell. The linearly polarized antenna extends orthogonally to a radius of the circularly polarized antenna.

[0416] According to the present teachings, the multi-axially polarized RF antenna can comprise the conductive element as a wire or conductor.

[0417] According to the current teachings, the shell can be made of polytetrafluoroethylene and the conductive element can be made of copper.

[0418] According to the present teachings, the linearly polarized antenna can be configured to extend downwards from the circularly polarized antenna when used.

[0419] According to the current teachings, the circularly polarized antenna can be a 2-axis antenna and the linearly polarized antenna can be a single-axis antenna.

[0420] According to the present teachings, the multiaxially polarized RF antenna can additionally include a base plate or plane, and the circular insulator can be arranged on the base plate or plane, between the conductive element and the base plate or plane, and between the circularly polarized antenna and the base plate or plane.

[0421] According to the present teachings, the circularly polarized antenna can include two feed points that have a 90° phase shift and be configured to receive signals that are 90° out of phase with each other.

[0422] According to the present teachings, a vehicle can comprise a body or chassis and a roof that includes the multi-axially polarized RF antenna array. The multi-axially polarized RF antenna array can be oriented in the roof such that the linearly polarized antenna extends downwards from the circularly polarized antenna.

[0423] According to the present teachings, a vehicle may include the multi-axis polarized RF antenna array. The multi-axis polarized RF antenna array may comprise a first multi-axis polarized RF antenna array configured to be implemented in a vehicle, a second multi-axis polarized RF antenna array configured to be implemented in the vehicle, and a second circularly polarized antenna with a second conductive annular body having a second internal hole, a second circular insulator connected to the second conductive annular body, and a second linearly polarized antenna connected to the second circular insulator and extending outwards from the second circular insulator.The second linearly polarized antenna can include a sheath and a conductive element extending through the sheath of the second linearly polarized antenna. The second linearly polarized antenna can extend orthogonally to a radius of the second circularly polarized antenna, and there can be an access module connected to the first multiaxially polarized RF antenna array and the second multiaxially polarized RF antenna array, configured to communicate with a portable access device via the first multiaxially polarized RF antenna array and the second multiaxially polarized RF antenna array.

[0424] According to the present teachings, at any given time at least one of the linearly polarized antennas or the first multi-axially polarized RF antenna array is not cross-polarized with an antenna of the second multi-axially polarized RF antenna array.

[0425] According to the teachings presented, the access module can be configured to perform passive access / passive start operations or phone-as-a-key operations, comprising transmitting and receiving high / radio / radio frequency signals via the first of the multi-axis polarized RF antenna arrays and the second of the multi-axis polarized RF antenna arrays.

[0426] According to the teachings presented, the access module can be configured to allow access to the vehicle based on radio frequency signals.

[0427] According to the present teachings, the access module can be configured to execute an algorithm to determine which pair of antennas from the first of the multi-axis polarized RF antenna arrays and the second of the multi-axis polarized RF antenna arrays is to be used for communication with the portable access device.

[0428] According to the teachings presented, the portable access device can be a key fob or a mobile phone.

[0429] In one embodiment, a Phone-as-a-Key system as disclosed herein uses a mobile phone's BLE radio unit to microlocate the phone's position relative to a set of receiving sensors. The sensors are located inside a vehicle. They are used to detect whether the phone is close enough to the vehicle to allow access (e.g., unlocking a door and / or starting the vehicle). The vehicle's access module uses an angle-of-arrival (AOA) principle. By knowing the angles of arrival of the signal transmitted by the BLE radio unit to at least two separate sensors in the vehicle, the source (i.e., the BLE radio unit) can be biangulated on a 2D plane. In this case, a phased antenna array can be used to measure the angles of arrival of the incident signal.The phased array antenna system comprises multiple antennas that receive the transmitted signals. Each sensor in the vehicle includes one or more antennas. Each sensor can be a phased array sensor comprising: a 3-antenna interleaved circular polarization (CP) receiver with a single radio receiver, a 6-antenna interleaved linear polarization (LP) receiver with a single radio receiver, a 3-antenna interleaved CP receiver with a single radio receiver, and a 3-antenna interleaved printed antenna CP receiver with a single radio receiver.

[0430] The access module detects the direction of an incident AOA signal, taking multipath propagation effects into account. As an example, two sinusoidal RF signals transmitted to and arriving at a sensor array are summed at the sensor array's antennas. The sum of the two sinusoidal RF signals is a sine wave with a different phase and amplitude, depending on the phase angles and amplitudes of the two source sine waves. A mathematical model used to predict an AOA direction can exhibit an error. This error can be very large and fluctuating or abrupt in any dynamic multipath propagation environment. To avoid this error, a Music algorithm, such as the one disclosed herein, can be used to identify a source signal accompanied by a potentially strong multipath propagation reflection signal.The mobile phone precisely tracks the direct signal. This tracking identifies any additional reflected signals. Reflected signals can then be identified and discarded.

[0431] The access and control modules disclosed herein can implement any of the Music algorithms referenced and / or disclosed herein. Bearing and direction-finding methods can generally be grouped into two categories, sometimes referred to as classical and modern methods. Classical methods include a variety of beamforming techniques. Modern methods are generally referred to as subspace methods. A Music algorithm is categorized as a super / high-resolution parameter estimation algorithm using a subspace partitioning method. A subspace method may require a specific field geometry of two identical but physically shifted or offset fields or arrays. Other methods include maximum-probability estimation and beamforming.

[0432] Fig. Figure 70 shows a side view of several antennas 7000 in a field or arrangement illustrating an angle of incidence Θ. The field of antennas can be referred to as a field manifold. Each of the antennas 7000 can be structured identically to and / or like any of the antennas disclosed herein. In one embodiment, one or more of the antennas are quadrifilalar helical antennas.

[0433] The Music algorithm uses a field manifold model, which describes the response of the field manifold to one or more incident AOA signals. A uniform linear array (ULA) of antennas can be defined as in Fig. Figure 70 shows the antenna index in the field, starting at 1, where m is the total number of antennas, d is the spacing between antenna elements, and Θ is the angle of an incident signal. The response of a field element m to an incident signal s can be represented by Equation 37, where r is the received signal, a is the complex array manifold response, s is the source signal, m is the index number of the antenna element of interest, Θ is the physical angle of the incident source signal, λ is the wavelength of the signal, and n(t) represents noise in the receiver channel. This shows the effect of a phase delay as a function of the physical position of the elements of the receiving sensor field, with a full 180° phase shift at d = λ / 2.The phase shift is also shown as a function of an angle of incidence Θ. r(t)=a⋅s(t)⋅ejπ[d⋅(m−1)2λ]sin(0)+n(t)

[0434] The field steering / field control vector a m is / is given by equation 38 for a given source signal n at an angle of incidence Θ n An antenna element m is defined for 1 ≤ m < M antennas. This assumes an amplitude response of 1 at each antenna and an ideal phase response for a ULA relative to antenna 1. am(0n)=ejπ[d*(m−1)*2 / λ]sin(0n)

[0435] For N incident / arriving signals, the received signal r(t) results in a sum of the source signals over the field manifold, and can be represented by equation 39. r(t)=∑n=1Na(Θn)sn(t)+n(t)

[0436] In vector notation, the field manifold response parameters a and A are defined by equations 40 and 41. Vector a describes the field response of each element to a single source signal n, and A describes the response of all M field elements to all N source signals and is an M x N matrix, where M and N are integers greater than or equal to 2. The N source signals, sampled at time t, are represented as an N x 1 vector S(t), as shown by equation 42. a(Θn)=[a1(Θn),a2(Θn),…aM(Θn)]T A=[a(Θ1),a(Θ2),…a(ΘN)] S(t)=[s1(t),s2(t),…sN(t)]T

[0437] Equation 43 can be used to map N source tones, at / with different source arrival angles, represented in signal S(t) at a given time t, via an antenna field response manifold model A to received (measured) data vector r(t) with channel noise n(t), where r(t) is an Mx1 vector of the received data at each antenna element. r(t)=AS(t)+n(t)

[0438] This mathematical structure of the field manifold model is used to derive the Music algorithm and can also be used to simulate and model a test environment.

[0439] Fig. Figure 71 shows an exemplary AOA procedure that includes a use of the Music algorithm. Although operations are mainly described as being performed by a vehicle access module, such as one of the access modules disclosed herein, the operations can be performed by a control module of a portable access device. Note that the H-operator denotes the Hermitian transposition or conjugation-transposition operation. The procedure can begin at Figure 7400. At Figure 7402, the access module T collects or acquires analytic signal samples simultaneously from each antenna, as illustrated by {r(t)}t=1T.

[0440] At 7404, the access module estimates the data covariance matrix R̂ as represented by equation 44. R^=∑t=1Tr(t)r(t)H=RRH

[0441] The covariance matrix estimate is calculated using equation 44, and an example of the covariance matrix is ​​given in Fig. Figure 72 shows that each arrow represents a covariance between the antenna numbers listed on the X and Y axes at the base of the arrow. The arrow at the top center represents the covariance (c 12 ) of antenna number 1 relative to antenna number 2, while the arrow on the left in the middle represents the covariance (c 21 ) of antenna number 2 relative to antenna number 1, which is the complex conjugate of c 12 The direction of the arrow is the complex-plane representation of size and direction (where the X-axis is the real axis and the Y-axis is the imaginary axis).

[0442] It should be noted that the diagonal (top left to bottom right) represents an autocovariance, which is a unit and has an imaginary value of 0. It should also be noted that the matrix is ​​Hermitian, meaning that c ij = c* for all i and j, where * is the complex conjugate. Thus, all useful information is in (i) C. 12 , c 23 and c 13 or (ii) c 21 , c 32 and c 31 (includes the top right or bottom left corner, excluding the diagonal from top left to bottom right). This leads to potential savings in data storage and reduced transmission size.

[0443] At 7406, the access module uses a singular value decomposition (SVD) or another eigenvalue decomposition technique and computes the MxM matrix U as represented by equation 45. R^=U∑UH

[0444] Following an eigenvalue decomposition of the covariance matrix estimate R̂, resulting complex eigenvectors are provided, with examples of these in Fig. 73 are shown. Fig. Figure 73 shows an eigenvector visualization with a field manifold response at 35°. Fig. Figure 74 shows an eigenvector visualization with a field manifold response at 0°.

[0445] As in Fig. Figure 72 denotes the size and direction of the arrows as the real and imaginary components of each point, corresponding to a real part on the x-axis and an imaginary part on the y-axis. The solid and dashed arrows represent the 3x3 field of eigenvectors. The vector columns (x-axis) are sorted by the eigenvalues ​​of the eigenvectors from largest (on the left) to smallest (on the right). Thus, the leftmost column, numbered 1, represents the signal subspace, while columns 2 and 3 represent the noise subspace.

[0446] In the 7408, the access module estimates or otherwise determines the number of incident / impacting signals N. In the 7410, the access module splits matrix U into an MxN signal subspace matrix Û. s and noise subspace estimation Mx(MN) matrix Û e such that equation 46 is satisfied. U=[U^s,U^e]

[0447] Together with the eigenvectors, the field manifold response at the angle of interest (35°) is shown by the arrows with long lines. This follows from equation 40.

[0448] At 7412, the access module calculates the music spectrum P(Θ) for a range Θ of interest at / with a predetermined resolution, as represented by equation 47. P(θ)=1‖a(Θ)HUe‖2

[0449] At this point, the noise subspace eigenvectors of the covariance matrix estimation should be perfectly orthogonal to the field manifold response. The result of the denominator of equation 47 is a small number relative to results at other test angles Θ.

[0450] Fig. 74 provides the same information as Fig. 73, except that the field manifold response is shown at an AOA of 0°. Note that the eigenvectors remain the same, as they are derived from the measured data. The field manifold response is rotated and shows the expected response to a directly incident signal, meaning there is no phase shift at any antenna element. In this case, the result of the denominator of equation 47 is a much larger value than that obtained in the case of Fig. 73 is reached.

[0451] At 7414, the access module performs a peak search on P(Θ) to determine the arrival angles. The values ​​of Θ at the maxima of P(Θ) are the arrival angles of the incident / impacting N signals.

[0452] After processing equation 47 for / after Θ̂ over a range from -90° to +90°, the resulting music power spectrum P(Θ) is in Fig. Figure 76 shows an AOA of 35° for a source signal. Note that there is a distinct peak at the test AOA of 35°. The actual angle is indicated by the vertically dashed line. The resolution of Θ̂ is 1°.

[0453] Covariance smoothing methods can be used. As an example, a forward-backward method can be used. The forward-backward approach is implemented using equations 48 and 49, where R̃ is the modified covariance matrix estimate and J is an inverse MxM identity matrix (transfer matrix). R^=R^+JR^HJ J=[01⋰10]

[0454] The effective number of coherent tones that can be resolved is N≤2M3 Sources. Up to 2 coherent tones can be resolved for a 3-antenna array. This method can be used for a phased array with 3 antennas from a receiver assembly of a phased antenna array. The method can terminate at 7416.

[0455] Another example is a spatial smoothing technique. Spatial smoothing involves dividing a field into several subfields and averaging the covariance matrix results of these subfields. This effectively reduces the number of antenna field elements.

[0456] A forward-backward spatial smoothing (FBSS) method can be used, combining spatial smoothing with the forward-backward approach. This also reduces the number of antenna elements required. As yet another example, a Toeplitz completion method can be used, and this is suitable for NLAs.

[0457] Variations of the Music algorithm can be implemented. A derivative of the Music algorithm, called Root-MUSIC, can be used with respect to ULAs to find the AOA of the incident / incident signal without the need to calculate results at every potential angle. This reduces the required computational power. The reduction in computational complexity comes from not having to perform operations 7412 and 7414 of the Music algorithm, which involve calculating the Music spectrum over a large set of Θ̂ values ​​and finding the peak(s) of the result.

[0458] Another exemplary derivation, called Spectral-MUSIC, is a generalized version of Root-MUSIC that can be applied to arbitrary field geometries but is generally valid for broadband non-coherent sources. A still further derivation, called Smooth-MUSIC, refers to a variety of procedures for smoothing the covariance matrix in the Music algorithm and is discussed between operations 7404 and 7406 of Fig. 71 applicable.

[0459] Another exemplary derivation, known as the CLEAN method, involves, once a source signal in a given direction has been identified, reconstructing a model of the source signal from the known field manifold. This reconstructed signal model is subtracted from the measured incident signal to remove the incident signal, thereby "cleaning" the measured data of the unwanted source signal and enabling the observation and evaluation of other sources.

[0460] One problem that arises with an implementation of the Music algorithm with respect to a non-ideal antenna field is that two coherent sources with forward-backward covariance smoothing can lead to erroneous position measurements. Standard field calibration techniques do not resolve this, as the covariance matrix itself introduces an erroneous subspace splitting. To combat this, a variation of the CLEAN procedure for multiple coherent sources is performed, which includes: identifying source signals using the Music algorithm; using the CLEAN procedure to remove the source signals sequentially using the calibrated field manifold; forcing the source signal position into an offset or shift (not the originally measured location) and recalculating the AOA direction of the remaining signal; and repeating operations 7404 and 7406 of Fig. 71, to verify convergence to a new set of incident arrival angles if these are not equal to the original arrival angles; and optional replacement of operation 7402 of Fig. 71 with a priori knowledge of the system. For example, while tracking the position of the source signal, it can be assumed that the AOA does not change significantly between successive readings.

[0461] Fig. Figure 76 shows an antenna selection system 7600 comprising antennas 7602, a switch 7604, and a radio receiver 7606. The radio receiver 7606 selects one of the antennas from which a signal is to be received via the switch 7604. The antenna selection system 7600 can be implemented in any of the systems disclosed herein. In one embodiment, the antenna selection system 7600 is implemented in a vehicle, and an access module disclosed herein controls the operation of the radio receiver 7606.

[0462] The 7600 antenna selection system is implemented in a PAK-AOA system and implements BLE-AOA data reception. Part of a BLE radio packet received by one of the 7602 antennas includes a CW tone. The 7606 radio receiver samples the CW tone to provide an analytical quadrature signal, namely two sine waves with a 90° phase difference, referred to as the in-phase and quadrature-phase signals (I and Q signals). The I and Q signals are sampled simultaneously and can be combined to form a complex analytical sample r, where r = iI + Q and i is the imaginary constant, i = √2. The received data is thus sliced ​​into nested samples from each of the antennas with multiple repetitions.

[0463] Fig. Figure 77 illustrates an example of a reconstruction procedure for reconstructing the IQ data. The nested data are interpolated to form a received data matrix r(t) for use in the Music algorithm. The reconstruction procedure can be performed on any of the access modules disclosed herein. The signal reconstruction procedure can begin at 7700.

[0464] In the 7702, the access module converts an analytical IQ sampling vector r into a phase angle vector Φ using the arctangent function. In the 7704, the access module generates a time vector t corresponding to the sampling vector r based on the data sampling rate.

[0465] In the 7706, the access module discards samples taken close to the antenna switching times. In the 7708, the access module unwinds each repeating portion of data points with a step size π. In the 7710, the access module measures the average slope. This is the average frequency of the sine waves.

[0466] At 7712, the access module performs the following operations for each antenna: a) finding the intersection point of the first repetition of sampled data; b) projecting the positions of the next repetition of sampled data; c) determining an average difference between expected and measured actual positions; d) adding or subtracting 2π; e) repeating operations c and d, comprising repeating the determination of the average difference and adding or subtracting 2π until the average difference is less than π; f) finding the average slope of all points that have already been aligned or adjusted; and g) repeating operations bg using the new slope for the next signal repetition.

[0467] At 7714, the access module measures the standard deviation of the average slope of each antenna.

[0468] At 7716, the access module checks which antenna may have an inaccurate alignment by selecting antenna i, based on equation 50, if the standard deviation is above a threshold. |f(i)−mean(f)|>max(f)−min(f)2

[0469] At 7718, the access module repeats operations 7712-7718 for the antenna selected at 7716 until a low standard deviation exists or a maximum retry counter expires.

[0470] At 7720, the access module interpolates a straight line of points on the original time vector t for each antenna m to obtain the reconstructed phase angle vector Φ. m to obtain. This can be based on the phase angle vector Φ determined at 7702.

[0471] At 7722, the access module generates an IQ sampling vector r̂ mFor each antenna m, equation (51) is recalculated, where g is the average size of the valid subset of the original sampling vector r. After operating procedure 7722, the procedure can end at 7724. r^m=gmejΦm

[0472] In one embodiment, the method described above is implemented in a vehicle access system and / or a PAK system as disclosed herein, which has circularly polarized antennas. Signals are received at the circularly polarized antennas. IQ data is determined based on the received signals, as described above, and arrival angles are determined using the Music algorithm.

[0473] Fig. References 78A-C show a vehicle 7800, illustrating an exemplary placement of a sensor 7802 which may be implemented as part of any PAK system disclosed herein and may be connected to any access module disclosed herein. Fig. Figure 78C shows exemplary bounce reflections and corresponding paths of a signal transmitted from a key fob 7804 or other portable access device and detected by the sensor 7802. In this example, the sensor 7802 is located high / above and in the center of the vehicle 7800. The sensor 7802 may, for example, be located in the sky 7803 of the vehicle 7800. The sensor 7802 is positioned such that multiple bounce paths of the transmitt...

Claims

[1] Access system (28) for a vehicle (30, 200, 108, 5200, 7800, 790), wherein the access system comprises: a plurality of antennas (414, 1102, 1104, 1410, 1424, 1428, 1438, 1440, 1502, 1504, 3102, 3104, 5300, 5302, 5304, 5306, 5412, 7000, 7602) configured to each receive a signal transmitted from a portable access device (32, 34, 400, 5206) to the vehicle (30, 200, 108, 5200, 7800, 7900), one of the plurality of antennas being a circularly polarized antenna (1104, 1428); and an access module (36, 210) that is configured to Down-conversion of the received signal to generate an in-phase signal and a quadrature-phase signal, Executing a Music algorithm to determine the arrival angles of the received signal as received by the multitude of antennas, where "Music" stands for "Multiple Signal Classification", Determining a distance between the portable access device and the vehicle based on the arrival angles, and Allowing access to the vehicle based on distance, where the access module (36, 210) is configured during execution of the Music algorithm, to: Collecting analytical signal samples of the signal received at each of the multitude of antennas to generate a received data matrix; Estimating a data covariance matrix based on the received data matrix; Using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; Determining a number of incoming signals; Splitting the MxM matrix into a multitude of matrices; Calculating a music spectrum based on one of the many matrices; and Performing a peak search on the music spectrum to determine the arrival angles, the access module (36, 210) is further configured to: Generating a time vector corresponding to the in-phase and quadrature-phase sampling vector; Discarding some of the analytical signal samples taken near antenna switching times; Unwinding each repeat portion of remaining samples with a step size π; Averaging a frequency of sine waves from the remaining samples; Finding an average slope of the remaining samples; Measuring a standard deviation of the average slope; Determine which of the many antennas is misaligned, based on the measured standard deviation; For each of the multitude of antennas, interpolating a straight line of points on a time vector to generate a reconstructed phase angle vector; If the standard deviation is greater than a predetermined threshold, check which of the many antennas has an inaccurate alignment; and for one of the many antennas, remeasuring the standard deviation of the average slope. [2] Access system according to claim 1, wherein the plurality of antennas comprise: the circularly polarized antenna (1104) with a conductive ring-shaped body with an inner hole; a circular insulator (1106) connected to the conductive ring-shaped body; and a linearly polarized antenna (1102) connected to the circularly polarized antenna and the circular insulator and extending outwards from the circular insulator, wherein the linearly polarized antenna has: a shell (1112), and a conductive element (1110) extending through the shell, wherein the linearly polarized antenna (1102) extends orthogonally to a radius of the circularly polarized antenna (1104). [3] Access system according to claim 1, wherein the access module (36, 210) is configured to: Performing a covariance smoothing procedure to generate a modified covariance matrix; and Using the eigenvalue decomposition process to determine the MxM matrix based on the modified covariance matrix. [4] Access system according to claim 3, wherein the access module (36, 210) is configured while generating the receive data matrix, to: Converting an in-phase and quadrature phase sampling vector into a phase angle vector; Generate, based on the phase angle vector, a newly generated in-phase and quadrature phase sampling vector for each of the multitude of antennas; and Generating the received data matrix based on the newly generated in-phase and quadrature-phase sampling vector for each of the multitude of antennas. [5] Access system according to any one of claims 1 to 4, wherein the access module (36, 210) is configured to perform a cleaning process, comprising: Conducting an iterative process, comprehensive Eliminating source signals, one by one, using a calibrated field manifold encompassing the multitude of antennas, and Forcing the position of a source signal to an offset point and recalculating the arrival angle direction of a remaining signal; and During the iterative process, converge to a new set of incident arrival angles. [6] Vehicle with: the access system (28) according to one of claims 1 to 5; a body; and a roof (46, 7201), a center console (7905), a floor (7903) or a metal structure at least partially enclosed, wherein the plurality of antennas are implemented in at least one of the roof (46, 7201), the center console (7905), the floor (7903) or the metal structure at least partially enclosed. [7] Vehicle according to claim 6, wherein the plurality of antennas comprise a multi-axially polarized RF antenna arrangement (352, 1100), wherein the multi-axially polarized RF antenna arrangement (352, 1100) comprises the circularly polarized antenna (1104) and is oriented in the roof (46, 4201). [8] Methods with: Receiving a signal transmitted from a portable access device (32, 34, 400, 5206) to a vehicle (30, 200, 108, 5200, 7800, 7900) at each of a plurality of antennas (414, 1102, 1104, 1410, 1424, 1428, 1438, 1440, 1502, 1504, 3102, 3104, 5300, 5302, 5304, 5306, 5412, 7000, 7602), wherein one of the plurality of antennas is a circularly polarized antenna (1104, 1428); Down-conversion of the received signal to generate an in-phase signal and a quadrature-phase signal; Executing a Music algorithm to determine the arrival angles of the received signal as received by the multitude of antennas, where "Music" stands for "Multiple Signal Classification"; Determining a distance between the portable access device and the vehicle based on the arrival angles; and Allowing access to the vehicle based on distance, where the execution of the Music algorithm exhibits: Collecting analytical signal samples of the signal received at each of the multitude of antennas to generate a received data matrix; Estimating a data covariance matrix based on the received data matrix; Using an eigenvalue decomposition process to determine an MxM matrix based on the covariance matrix, where M is an integer greater than or equal to 2; Determining a number of incoming signals; Splitting the MxM matrix into a multitude of matrices; Calculating a music spectrum based on one of the many matrices; and Performing a peak search on the music spectrum to determine the arrival angles, the procedure further exhibits: Generating a time vector corresponding to the in-phase and quadrature-phase sampling vector; Discarding some of the analytical signal samples taken near antenna switching times; Unwinding each repeat portion of remaining samples with a step size π; Averaging a frequency of sine waves from the remaining samples; Determining an average slope of the remaining samples; Measuring a standard deviation of the average slope; Determine which of the many antennas is misaligned, based on the measured standard deviation; For each of the multitude of antennas, interpolating a straight line of points on a time vector to generate a reconstructed phase angle vector; If the standard deviation is greater than a predetermined threshold, check which of the many antennas has an inaccurate alignment; and for one of the many antennas, remeasuring the standard deviation of the average slope. [9] Method according to claim 8, additionally with: Performing a covariance smoothing procedure to generate a modified covariance matrix; and Using the eigenvalue decomposition process to determine the MxM matrix based on the modified covariance matrix. [10] Method according to claim 9, additionally comprising, during generation of the received data matrix: Converting an in-phase and quadrature phase sampling vector into a phase angle vector; Generate, based on the phase angle vector, a newly generated in-phase and quadrature phase sampling vector for each of the multitude of antennas; and Generating the received data matrix based on the newly generated in-phase and quadrature-phase sampling vector for each of the multitude of antennas. [11] Method according to any one of claims 8 to 10, further comprising carrying out a cleaning method, comprising: Conducting an iterative process, comprehensive Eliminating source signals, one by one, using a calibrated field manifold encompassing the multitude of antennas, and Forcing the position of a source signal to an offset point and recalculating the arrival angle direction of a remaining signal; and During the iterative process, converge to a new set of incident arrival angles. [12] Method according to any one of claims 8 to 11, wherein: the vehicle comprises: (i) a body and (ii) a roof (46, 7201), a center console (7905), a floor (7903) or a metal structure that is at least partially enclosed; and the multitude of antennas are implemented in at least one of the roof (46, 7201), the center console (7905), the floor (7903) or the metal structure that is at least partially enclosed. [13] Method according to any one of claims 8 to 12, wherein: the multitude of antennas feature a multi-axis polarized RF antenna array (352, 1100); and the multi-axis polarized RF antenna arrangement (352, 1100) has the circularly polarized antenna (1104) and is oriented in the roof (46, 7201).

Images