Method and devices for monitoring access to a vehicle, and temporally configurable relay attack defense system
Patent Information
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- CONTINENTAL AUTOMOTIVE TECHNOLOGIES GMBH
- Filing Date
- 2024-06-07
- Publication Date
- 2026-05-06
AI Technical Summary
Existing vehicle access control systems are vulnerable to relay attacks and lack efficient power management and temporal performance optimization.
Implementing a time-configurable relay attack defense system that uses UWB technology for precise distance determination between a mobile device transceiver and vehicle transceivers, with dynamically set time windows for UWB communication to enhance security and reduce power consumption, while allowing only authorized access based on predetermined distance criteria.
Effectively protects against relay attacks by ensuring secure access through precise distance determination and optimizing power consumption and temporal performance by limiting UWB transmission and reception windows, thereby enhancing the overall security and efficiency of the access control system.
Smart Images
Figure DE2024200052_02012025_PF_FP_ABST
Abstract
Description
[0001] Description
[0002] "Methods and devices for controlling access to a vehicle; Time-configurable Relay Attack Defense System"
[0003] The application concerns methods and devices for controlling access to a vehicle.
[0004] To control access to a vehicle, a position (e.g. in the form of at least a two-dimensional (x,y) position and / or a distance) of a mobile device transceiver (e.g. smartphone, smartwatch, ID transmitter (e.g.
[0005] Vehicle key, key fob)) relative to at least one vehicle transceiver, for example
[0006] -via UWB with a ToF distance determination (ToF: Time of Flight; UWB according to Wikipedia: transmission with a bandwidth e.g. greater than 500MHz and / or a bandwidth of more than 20% of a center frequency) e.g. in a so-called “UWB Ranging Session”
[0007] -and / or by means of LF localization with messages on a LF frequency, according to Wikipedia LF = 30-300KHz), and / or e.g. with a message signal strength measurement (RSS) e.g. of an RF signal etc.
[0008] Vehicle access control systems are known, for example, from DE11 2014 006 819, DE10 2019 215 535.9, DE 10 2019 211 792.9 and DE 10 2021 207 725.
[0009] One object of the invention is to optimize the control of access to a vehicle. This object is achieved by the subject matter of the independent patent claims. Some particularly advantageous embodiments of the invention are specified in the subclaims and the description.
[0010] Embodiments of the invention can provide alternatives to existing solutions for effectively securing a vehicle access system against relay attacks. With adjustable time windows on both sides (suitable for matching, overlapping, or identical settings in the vehicle and mobile device transceiver), power consumption and temporal performance of the access system can be optimized.
[0011] UWB transmit and receive windows can be kept short to reduce power consumption. UWB transmit and receive windows can be selected independently of the respective operating mode to achieve optimal temporal performance.
[0012] Some embodiments of the invention according to the subclaims:
[0013] For example, according to embodiments of the invention, a time window can be set by a mobile device transceiver or by the vehicle and / or specified by a message.
[0014] For example, during the time window the mobile device transceiver and / or the vehicle is switched to receive and / or transmit mode.
[0015] Further features and advantages of some advantageous embodiments of the invention emerge from the further subclaims and the following description of some embodiments of the invention with reference to the drawing.
[0016] To illustrate some possible embodiments of the invention, the following is a simplified schematic diagram:
[0017] Fig. 1 shows a transmission of messages between a mobile device transceiver and vehicle transceivers for LF distance determination and UWB distance determination (UWB distance measured with a UWB frequency and / or UWB transceivers),
[0018] Fig. 2 shows an embodiment of a UWB distance determination based on the exchange of, for example, three messages and possibly also of transmission-reception times and / or propagation times in a simple ranging session,
[0019] Fig. 3-5 inventive embodiments of a control of access to a vehicle with a start of the determination of a UWB position of a mobile device transceiver relative to a vehicle within a predetermined time window.
[0020] Fig. 1 shows, by way of example and using suitable processes, how communication takes place between one (TRX1) of several vehicle transceivers (TRX1, TRX2, TRX3, TRX4, TRX5, TRX6) of a (motor) vehicle 7 and a mobile device transceiver 8a, 8b (e.g.
[0021] Mobile phone, smartphone, smartwatch, watch, ID transmitter, vehicle key, key fob etc.) of a user (9) some messages 10,11,12 are exchanged via UWB (e.g. on a UWB / UltraWideBand frequency and / or with a UWB bandwidth) in order to determine at least a distance d1 from the mobile device transceiver 8 to the vehicle transceiver TRX1 of a vehicle 7 representing position d1 (e.g. distance d1).
[0022] (As shown schematically in Fig. 3, several mobile device transceivers 8a, 8b may also attempt to gain access to a (different or the same) vehicle.)
[0023] Accordingly, messages 13, 14, 15 with (e.g. UWB / UltraWideBand) can be exchanged between a further (TRX2) of several (also referred to as anchor) vehicle transceivers of the (motor) vehicle 7 and the mobile device transceiver 8, if necessary, in order to determine a position d2 representing a distance d2 from the mobile device transceiver 8 to the vehicle transceiver TRX2 (e.g. distance d2 or message propagation time).
[0024] Accordingly, a distance value d3 representing a distance d3 from the mobile device transceiver 8 to the vehicle transceiver TRX3 (e.g. distance d3 or message propagation times) can be determined if necessary.
[0025] From one or two or more distance values d1, d2, d3 etc., the position of the mobile device transceiver 8 relative to at least one vehicle transceiver TRX1 and / or to / in the vehicle 7 (or to the vehicle center point or a vehicle transceiver) can be determined (e.g. by triangulation), e.g. by a control unit SG1, which control unit SG1 can receive, for example, information on signal propagation times (such as the ToF or some / all of the T_rnd1, T_rsp1, T_rnd2, T_rsp2..etc in Fig. 2) or distance values d1, d2, .. from vehicle transceivers TRX1, TRX2, TRX3, TRX4, etc. and / or mobile transceivers.
[0026] A position determination may, for example, include determining whether the mobile device transceiver 8 is located outside the vehicle 7 or inside the vehicle 7. For example, to only allow a vehicle start if the mobile device transceiver 8 is located inside the vehicle 7.
[0027] Access, e.g., in the form of opening (or closing) at least one door 111, 112 and / or starting the vehicle 7, etc., can be granted, for example, if one or more distances d1, d2, etc. fall below a certain value (or exceed it for closing) and / or distances decrease over time and / or other criteria are met. If at least one criterion is not met, access to the vehicle can be denied, e.g., a door may remain closed or the vehicle may not start, etc.
[0028] Communications with different vehicle transceivers and / or different mobile device transceivers may be distinguishable, for example, based on IDs or headers received in messages that vary depending on the transceiver and / or based on predetermined time slots or otherwise.
[0029] A determination of a distance between vehicle transceivers by a vehicle and / or a mobile device transceiver by a so-called TimeOfFlight (ToF) method is described, for example, in DE 10 2021 207 725.0 (202104661) or DE102019211152, which are incorporated by reference into the disclosure of this application.
[0030] As shown in Fig. 2, for example, a calculation (e.g. in a vehicle transceiver and / or in a mobile device transceiver or in a control unit SG1) of (message) propagation times (T_rnd1, T_rnd2, T_rsp1, T_rsp2) and / or (message) propagation time ratios (Time-Of-Flight) ToF and possibly thus (d1 = c * ToF etc.) of distances d1, d2 etc. can be carried out - and / or based on the times (ToF1, ToF2, ToF3, ToF4, ToF5, ToF6) at which the individual messages 10, 11, 12 etc. (correspondingly other messages) were sent and received, and / or based on time periods between transmission times and reception times such as T_rnd1, T_rsp1, T_rnd2, Trsp2, in particular if (some / Mutual transmission and / or reception times between the mobile device transceiver 8 and at least one vehicle transceiver TRX1 are communicated. The messages 10, 11, 12 are also referred to as Poll, Response, Final.
[0031] For example, a calculation of running times or distances d1 etc. can be carried out using the formula given in Fig. 2:
[0032] ToF= (T_rnd1 * T_rnd2 - T_rsp1 * T_rsp2) / (T_rnd1 + T_rnd2 + T_rsp1 +T_rsp2) The distance d1 is e.g. d1 = c * ToF (c = speed of light in air)
[0033] This distance calculation can be particularly suitable for preventing illegal door-opening attempts. Such a method, for example, with at least three messages, is also called "ranging" or "time-of-flight ranging," or UWB ranging, or UWB positioning, or UWB distance determination.
[0034] The three messages 10, 11, 12 transmitted, for example in Fig. 2 (between a mobile device transceiver 8 and a vehicle transceiver TRX1), which enable a calculation of a distance value d1, are referred to, for example, as a session with a session index Sl.
[0035] In Fig. 1 , 2 , for example, the messages 10, 11, 12 (first mobile device transceiver 8) form a (UWB) session with a session index Sl.
[0036] 3-5 show, by way of example and as an embodiment of the invention, a schematically simplified control of access 111, 112 to a vehicle 7, wherein a time window Za or Zb, for example (respectively), is communicated to a mobile device transceiver 8, 8a, 8b by the vehicle 7 with a time window message “Za” (or vice versa), and wherein a determination (10, 11, 12, TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a UWB position / UWB distance x11WB3, yUWB3; dUWB3 of the mobile device transceiver 8 relative to the vehicle 7 can be started (10) within the communicated time window Za. A time window indication “Za” can, for example, indicate the start and end of the time window.
[0037] A time window Za, Zb can be defined, for example, by the vehicle, in particular taking into account different operating modes of a vehicle control unit SG1, and / or depending on whether an access use case (the requested access from 8a or 8b to 7) is in “low power mode” (e.g. power saving mode and / or mode with low transmission power) or in “high power mode” (e.g. power saving mode and / or mode with higher transmission power).
[0038] As schematically illustrated in Fig. 3, in addition to the mobile device transceiver 8a, other mobile device transceivers 8b, etc., may also attempt to gain access to a (same or different) vehicle 7. This can be improved and / or made more temporally defined and / or secure, for example, by using different time windows Za, Zb for each mobile device transceiver 8, 8a, 8b and / or the communication of the vehicle 7 with each of the mobile device transceivers 8, 8a, 8b.
[0039] A vehicle 7, for example, only releases access 111, 112 to the vehicle, for example, if (a controller SG1 or) the vehicle 7 has checked that the user 9 of a mobile device transceiver 8 (e.g. mobile phone, smartphone, smartwatch, watch, ID transmitter, vehicle key, key fob, etc.) is requesting access to the vehicle 7, i.e. that an illegal unauthorized person is not requesting access to the vehicle 7 with one or more relays R using a relay attack. An access control can, as shown schematically in Fig. 3, comprise one or more further conditions, e.g. that the vehicle 7 only grants access to the vehicle 7 if an authentication check has authenticated / identified the mobile device transceiver 8, e.g. via RF and / or Bluetooth and / or LF and / or NFC communication with messages etc., and / or that an additional BT / RF / LF position determination (e.g. with measurement of the RSS signal strength, e.g. of a message and if applicable) is also carried out.Transmission to the vehicle 7, etc.) results in a position or distance (mobile device transceiver 8 - vehicle 7) within a specified range of, for example, 3 m, etc.
[0040] An access test can comprise a test in the form of a (LF) position (x,y position xLF1, yLF1 and / or LF distance dLF1 determined with LF transceivers TR-LF-1; TR-LF-2 and / or on an LF frequency) determined by LF (with an LF frequency), e.g., by signal strength measurement RSS or otherwise. An access test can also comprise a more secure test in the form of a position (x,y position xUWB3, yUWB3 and / or distance dUWB3) determined by UWB localization with, e.g., one or more transceivers TRXI, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2 (with a UWB frequency).
[0041] (Alternatively or in addition to a (LF) position determination, another position determination could be carried out before a UWB position determination, e.g. by RF (on an RF frequency) e.g. by signal strength measurement RSS.)
[0042] A distance xLF1, yLF1, dLF1, dUWB3a of a mobile device transceiver 8 relative to a vehicle 7 can be determined repeatedly and / or at predetermined intervals, and it can be checked in each case whether this is greater than the current (predetermined or reduced) UWB determination maximum radius U3 of e.g. 3m or U2 of e.g. 2m around the vehicle 7.
[0043] A (LF) distance xLF1, yLF1, dLF1 can be determined or used, for example, as a distance value dLF1 or a coordinate pair xLF1, yLF1 (from which a distance value dLF1 can be determined, for example, as the root of the sum of the squares). An LF position (xl_F1, yLF1; dLF1) and / or a UWB position (xllWB3, yUWB3; dUWB3; xllWB3, yUWB3; dUWB3), in the form of an x, y position or distance, can be determined by the mobile device transceiver 8a, 8b and sent to the vehicle 7, and / or determined by the vehicle 7, SG1, in particular based on received RSS or ToF information, etc.
[0044] For example, after receiving an LF polling command p requesting the determination of a position xLF1, yLF1; dLF1; xUWB3, yllWB3; dUWB3, a determination of an LF position (in particular LF distance) xLF1, yLF1; dLF1 of the mobile device transceiver 8 can be carried out repeatedly for e.g. a predetermined time and / or for a predetermined number of determinations.
[0045] A UWB access check can, for example, (only) be performed if an LF position xLF1, yLF1; dLF1 is within a predetermined or reduced UWB determination maximum radius U3 of, for example, 3 m or U2 of 2 m around the vehicle 7 (and if, in addition, access is requested with an action such as pulling the door handle of a door 111, 112 of the vehicle 7, or pressing a radio key opening button on the mobile device transceiver 8, etc.).
[0046] A UWB access check can also be carried out (only), if, in addition or alternatively, a LF position xLF1 , yLF1 ; dLF1 is permanently (for at least a time t and / or for a predetermined number of LF position determinations) within a UWB determination maximum radius U3 of, for example, 3m or U2 of 2m around the vehicle 7,
[0047] For example, a UWB access check can also (only) be performed if, in addition or alternatively, a UWB access check is requested with a message.
[0048] The LF route (for LF localization) can be virtually shortened by means of one or two (illegal) relay stations R to, for example, an apparent (<=) 3m or 2m etc. distance (of the mobile device transceiver 8 to the vehicle 7), which 3m distance can be the access area in which the vehicle 7 grants vehicle access, wherein if the mobile device transceiver 8 (also) measures a UWB position, in particular UWB distance dUWB3R less than 3m (inapplicable) with a UWB position determination, the access system in this case releases access and unlocks the vehicle (e.g. a vehicle door 111, 112) for the relay attacker R.
[0049] Time-configurable Relay Attack Defense System (Relay Attack Defense procedure):
[0050] After the mobile transceiver ( / ID transmitter) localization and authentication using, for example, conventional LF and RF etc. radio technology, a Relay Attack Defense System uses, for example, additional communication using UWB technology / UWB frequencies to carry out reliable distance determinations with (ranging) propagation time measurements.
[0051] Fig. 4 shows an embodiment of the invention which, for example, as a measure against a relay attack R for controlling access 111, 112 to a vehicle 7, proposes (at least) a predetermined time window Za (or Za, Zb) for the start of a UWB position determination (10, 11, 12).
[0052] In Fig. 4, an identification and / or (further / earlier) distance determination of the mobile device transceiver 8a by the vehicle is initially carried out conventionally (with or without a predetermined time window) in a period ZLFRF, e.g. with LF frequencies and / or RF frequencies and / or Bluetooth frequencies and / or NFC frequencies (and / or UWB frequencies), etc.
[0053] A time window Za is specified (e.g. only if the mobile device transceiver 8a is close enough to the vehicle 7 and / or is identified, e.g. with crypto algorithms and / or crypto chipsets in the vehicle and transceiver) (from the mobile device transceiver 8 or vehicle transceiver TRX1, TRX2, e.g. by a message), in which time window Za a UWB communication is to be started (for distance determination with (ranging) messages 10-12; 13-15 exchanged between a mobile device transceiver 8, 8a, 8b and at least one vehicle transceiver TRF TRX1, TRX2).
[0054] In the time window Za, the mobile device transceiver can be switched to ready to receive and / or ready to transmit (for UWB messages). In a dynamically definable time window Za (especially in the time window Za), UWB reception is started on the mobile transceiver side 8a, 8b, i.e., the UWB transceiver is switched to ready to receive and / or ready to transmit (which can consume energy and therefore may not be switched on permanently), and / or UWB communication is started.
[0055] In a time window ZS, which can be dynamically defined, for example, the UWB reception is started on the vehicle side 7, i.e. the vehicle transceiver is switched to ready to receive and / or ready to transmit (which can consume energy and therefore may not be switched on permanently).
[0056] The UWB reception start in the time window ZS can, for example, depend on the number of mobile transceivers 8, 8b (learned / known to the vehicle 7) and / or the number of vehicle transceivers etc. and / or the position / distance (which may already be determined inaccurately via LF / RF / UWB).
[0057] Reception / transmission of distance-determining (UWB and / or ranging) messages 10-12; 13-15 by (each) a vehicle transceiver TRX1, TRX2, etc. is possible, for example, in a UWB reception time window ZE, which can begin, for example, after a (communication start) time window Za and / or, as here, after a (reception start) time window ZS.
[0058] Reception / transmission of (UWB and / or ranging) messages 10-12; 13-15 serving for distance determination by (respectively) a mobile transceiver 8, 8b, etc. takes place in a UWB communication time window ZUWB, which can be, for example, after a (communication start) time window Za and / or after a (reception start) time window ZS.
[0059] A vehicle 7 only releases access 111, 112 to the vehicle, for example, if (possibly in addition to other conditions) at least a certain (10-15) distance d3, dUWB3 of the mobile device transceiver 8 to the vehicle 7 is smaller than a UWB determination maximum radius (e.g. U3 of 3m or U2 of 2m) around the vehicle 7, which makes a relay attack unlikely.
[0060] Fig. 5 shows, as an embodiment of the invention, that different time windows Za, Zb are defined for each of a plurality of mobile device transceivers 8a, 8b and / or for the UWB communication of the vehicle 7 with each of the mobile device transceivers 8a, 8b.
[0061] The start of a UWB communication between vehicle 7 and one of the mobile device transceivers 8, 8a, 8b occurs in the time window Za or Zb specified for that particular vehicle. A (UWB) communication between vehicle 7 and each of the mobile device transceivers 8a, 8b for UWB distance determination using messages 10-12; 13-15 occurs in a time window (ZUWB) specified for the respective mobile device transceiver 8a, 8b. The time windows Za, Zb can, for example, be partially or preferably completely consecutive, possibly with a time interval between the time windows.
Claims
Patent claims 1. Device (TRX1, TRX2, TRX3, TRX4, TRX5, TRX-LF1, TRX-LF2, 8, SG1) for controlling access (111, 112) to a vehicle (7), designed to -that access (111, 112) is granted or denied depending on a position or distance (x11WB3, y11WB3; dUWB3) of a mobile device transceiver (8) relative to the vehicle (7) determined by UWB-transmitted messages (10-12), and -that a determination (10-12; 13-15, TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a position or distance (xllWB3, yllWB3; dUWB3) of the mobile device transceiver (8a) relative to the vehicle (7) is started within a predetermined time window (Za; Zb).
2. Device according to claim 1, designed to -that a time window (Za) is specified to the mobile device transceiver (8a) by the vehicle (7) by means of a message, and -that a determination (TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a UWB position (xllWB3, yllWB3; dUWB3) or distance (xllWB3, yllWB3; dUWB3) of the mobile device transceiver (8a) relative to the vehicle (7) is started within the communicated time window (Za).
3. Device according to one of the preceding claims, designed to -that a determination (10-12; 13-15, TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a position or distance (xllWB3, yllWB3; dUWB3) of the mobile device transceiver (8a) relative to the vehicle (7) is started within a predetermined time window (Za; Zb) in that the mobile device transceiver (8a) is switched to ready to receive and / or ready to transmit (Za, Zb) for messages (10-12; 13-15) used for the distance determination during the time window (Za, Zb).
4. Device according to one of the preceding claims, designed to -that a determination (10-12; 13-15, TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a position or distance (xllWB3, yllWB3; dUWB3) of the mobile device transceiver (8a) relative to the vehicle (7) is started within a predetermined time window (Za; Zb) insofar as the vehicle (7) is switched to ready to receive and / or ready to transmit (ZS) for messages (10-12; 13-15) serving to determine the distance during the time window (Za, Zb) or during a sub-window (ZS) in the time window (Za, Zb).
5. Device according to one of the preceding claims, designed to -that a time window (ZS, Za, Zb) is determined by the vehicle (7, SG1) depending on the number of mobile device transceivers (8a, 8b) present or to be used and / or the temporal position and / or the slot of the respective localized and authenticated ID mobile device transceiver (8a, 8b).
6. Device according to one of the preceding claims, designed to - that the time window (Za, Zb) is determined by the vehicle (7, SG1 ), taking into account different operating modes of a vehicle control unit (SG1 ), in particular depending on whether the access use case was started in “low power mode” or in “high power mode”.
7. Device according to one of the preceding claims, designed to - that different time windows (ZS, Za, Zb) are defined for each of several mobile device transceivers (8, 8a, 8b) and / or the communication of the vehicle (7) with one of the mobile device transceivers (8, 8a, 8b).
8. Device according to one of the preceding claims, designed to - that a determination (TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a UWB position or UWB distance (xllWB3, yUWB3; dUWB3) of a mobile device transceiver (8a) relative to a vehicle (7) and / or a notification of a time window (Za, Zb) takes place when an authentication and / or an additional distance determination (xLF1, yLF1; dLF1) of a mobile device transceiver (8a) relative to a vehicle (7) has taken place on an LF frequency and / or an RF frequency and / or a UWB frequency and / or an NFC frequency and / or a Bluetooth frequency (ZLFRF).
9. Device according to one of the preceding claims, designed to -that within a time window (ZUWB) preferably following the predetermined time window (Za, Zb), the determination (10-12; 13-15, TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a UWB position (xUWB3, yUWB3; dUWB3) of a mobile device transceiver (8a) relative to the vehicle (7) comprises the transmission and / or reception of messages (10-12, 13-15), and the determination (T_rnd1, T_rsp1, T_rnd2, Trsp2) of a UWB position is carried out by calculation (T_rnd1, T_rsp1, T_rnd2, Trsp2) during or after the following time window.
10. Device according to one of the preceding claims, designed to -that the predetermined time window (Za, Zb) for sending and / or receiving messages (10-12; 13-15) when determining (T_rnd1, T_rsp1, T_rnd2, Trsp2) a UWB position is shorter than ten times or three times or double the time required to exchange the messages (10-12; 13-15) with one or more UWB transceivers (TRX1, TRX2, TRX3, ..), and / or is shorter than 200 milliseconds or is 100 milliseconds. 11 .Device according to one of the preceding claims, designed to -that a UWB position determination is or includes a position determination or distance determination with messages (10-12) on a UWB frequency and / or with one or more UWB transceivers (TRX1 -TRX6).
12. Device according to one of the preceding claims, -wherein enabling access to the vehicle (7) comprises opening and / or unlocking at least one vehicle door (111, 112) and / or enabling the starting of the engine of the vehicle (7).
13. Device according to one of the preceding claims, -wherein the vehicle (7) only grants access (111, 112) to the vehicle (7) if at least one further condition is met, in particular that an authentication check has identified the mobile device transceiver (8a), while if the at least one further condition is not met, the vehicle (7) refuses access (111, 112) to the vehicle (7).
14. Method for controlling access (111, 112) to a vehicle (7), in particular with a device according to one of the preceding claims, characterized in that -that a determination (10-12) TRX1, TRX2, TRX3; T_rnd1, T_rsp1, T_rnd2, Trsp2) of a UWB position or UWB distance (xllWB3, yllWB3; dUWB3) of a mobile device transceiver (8a) relative to the vehicle (7) is started within a predetermined time window (Za, Zb).