Access system and method for operating access system
Patent Information
- Application Number
- JP2024010716
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-02-28
- Filing Date
- 2024-01-29
- Publication Date
- 2025-02-12
- Estimated Expiration
- 2044-01-29
AI Technical Summary
Existing vehicle access systems are vulnerable to relay attacks, allowing unauthorized access without active key intervention.
An access system with a first and second communication unit on the object and key, respectively, that determines a value indicating the likelihood of authorized use based on multiple factors, and unlocks only if the value exceeds a threshold.
Enhances security by reducing false positives and negatives, ensuring reliable authorization through a probabilistic assessment of user intent.
Smart Images
Figure 00000010_0000 
Figure 00000010_0001 
Figure 00000010_0002
Abstract
Description
[Background technology]
[0001] The present invention relates to an access system, in particular a vehicle access system, and to a method of operating an access system.
[0002] Objects such as vehicles can often be unlocked without the active use of a (vehicle) key. Carrying the key is sufficient, and the user does not need to actively activate the key. For example, the object broadcasts one or more request signals having a certain range, periodically or in response to a defined triggering event. If the key is within said range, it receives the request signal and sends a corresponding response signal back to the object. If based on the response signal the key is recognized as being associated with the object, the object becomes unlocked. However, such systems can be attacked relatively easily by so-called relay attacks. There is therefore a need for an access system that is protected as effectively as possible against unwanted relay attacks by unauthorized persons. Summary of the Invention [Means for solving the problem]
[0003] An access system is proposed, comprising a first communication unit arranged on the object and a second communication unit arranged on a key associated with the object, the first communication unit configured to broadcast a first request signal, the second communication unit configured to receive the first request signal and to transmit a first response signal to the first communication unit after receiving the first request signal, the first communication unit further configured to transmit a request for a value to the second communication unit, the second communication unit configured to determine a value upon receiving the request and transmit the value to the first communication unit, the value being an indication of how likely it is that the object will be used by an authorized user. The object is configured to use the first response signal to check if the key is the key associated with the object and to compare the value received from the second communication unit with a defined threshold, the object being unlocked if the key is recognized as associated with the object and the value is equal to or greater than the threshold.
[0004] Further, a method of operating an access system for an object is proposed, comprising: broadcasting a first request signal by a first communication unit arranged on the object; receiving the first request signal by a second communication unit arranged on a key associated with the object, and broadcasting a first response signal by the second communication unit to the first communication unit after receiving the first request signal; broadcasting a request for a value to the second communication unit by the first communication unit; determining a value in the key upon receiving the request and transmitting the value by the second communication unit to the first communication unit, the value being an indication of how high the probability is that the object will be used by an authorized user; checking by the object based on the first response signal whether the key is a key associated with the object; and comparing the value received from the second communication unit with a defined threshold; the object is unlocked if the key is recognized as associated with the object and the value is equal to or greater than the threshold.
[0005] Embodiments and further developments of the inventive concept are the subject of the dependent claims.
[0006] The invention will now be explained in more detail with reference to the embodiments shown in the drawings, in which identical or similar elements are provided with the same reference numerals. The present invention provides, for example, the following: (Item 1) An access system comprising a first communication unit arranged on an object (10) and a second communication unit arranged on a key (20) associated with said object (10), the first communication unit is configured to broadcast a first request signal; The second communication unit is configured to receive the first request signal and to send a first response signal to the first communication unit after receiving the first request signal; the first communication unit is further configured to send a request for a value to the second communication unit; the second communication unit is configured to determine the value upon receiving the request and to transmit it to the first communication unit, the value being an indication of how likely it is that the object (10) will be used by an authorized user; the object (10) is configured to use the first response signal to check whether the key (20) is a key associated with the object (10); The object (10) is further configured to compare the value received from the second communication unit with a defined threshold value; The object (10) is unlocked if the key (20) is recognized as being associated with the object (10) and the value is greater than or equal to the threshold value. (Item 2) The access system described in the preceding item, wherein the first communication unit is configured to transmit the request for the value to the second communication unit if the key (20) is recognized to be within a required range around the object (10). (Item 3) The access system of any one of the preceding claims, wherein the first communication unit is further configured to send a third request signal to the second communication unit when the value is less than the threshold, the third request signal including a request for user consent. (Item 4) The second communication unit is further configured to transmit a third response signal to the first communication unit after receiving the third request signal, the third response signal including information regarding a decision by the user as to whether the object (10) should be unlocked, and the object (10) is unlocked if the third response signal includes information that the user agrees to the unlocking. (Item 5) An access system according to any one of the preceding claims, wherein the key (20) is a mobile phone having an application installed thereon, the application allowing the mobile phone to function as a key for the object (10). (Item 6) 2. The access system of claim 1, wherein the mobile phone determines the value taking into account a number of different factors. (Item 7) The different factors include: - information about whether the mobile phone is charging; - whether the mobile phone is moving; - Whether the mobile phone is connected to a known Wi-Fi; - whether the Wi-Fi connection available to the mobile phone at least partially matches the Wi-Fi connection available to the object (10); - whether the mobile phone at least partially detects the same external device in the vicinity of the object (10); - whether the location pointed at the mobile phone is in the vicinity of the location pointed at the object (10); - whether said request for said value occurs at the time when one of one or more authorized users normally uses or enters said object (10); - whether the distance between the object (10) and the mobile phone determined by the mobile phone matches a specific distance between the object (10) and the mobile phone determined by the object (10); - how long ago the most recent interaction between the object (10) and the mobile phone occurred; and / or - whether the mobile phone's movement profile matches the changes in position of the mobile phone determined by the object (10); 2. The access system according to claim 1, comprising one or more of the following: (Item 8) 2. The access system according to claim 1, wherein the object (10) is a vehicle, a building, or an obstacle. (Item 9) 1. A method of operating an access system for an object (10), comprising the steps of: broadcasting a first request signal by a first communication unit located on the object (10); receiving the first request signal by a second communication unit disposed on a key (20) associated with the object (10), and broadcasting a first response signal by the second communication unit to the first communication unit after receiving the first request signal; broadcasting a request for a value by the first communication unit to the second communication unit; determining a value in the key (20) upon receiving the request and transmitting said value by said second communication unit to said first communication unit, said value being an indication of how likely it is that said object (10) will be used by an authorized user; checking, by the object (10), using the first response signal, whether the key (20) is the key associated with the object (10); comparing, by the object (10), the value received from the second communication unit with a defined threshold value; Including, The object (10) is unlocked if the key (20) is recognized as being associated with the object (10) and the value is greater than or equal to the threshold value. (Summary) The access system has a first communication unit arranged on the object and a second communication unit arranged on a key associated with the object, the first communication unit configured to broadcast a first request signal, the second communication unit configured to receive the first request signal and to send a first response signal to the first communication unit after receiving the first request signal, the first communication unit further configured to send a request for a value to the second communication unit, the second communication unit configured to determine a value upon receiving the request and to send the value to the first communication unit, the value being an indication of how likely it is that the object will be used by an authorized user. The object is configured to use the first response signal to check if the key is the key associated with the object and to compare the value received from the second communication unit with a defined threshold, the object is unlocked if the key is recognized as associated with the object and the value is equal to or greater than the threshold. [Brief description of the drawings]
[0007] [Figure 1] 1 illustrates diagrammatically the principle of an unintentional relay attack on a keyless entry system; [Diagram 2] A method according to an embodiment of the present disclosure is illustrated in a sequence diagram. [Diagram 3] A method according to a further embodiment of the present disclosure is illustrated in a sequence diagram. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0008] The underlying idea of this disclosure is to use an additional query of a value (usage probability) to estimate how likely it is that an authorized user actually wants to unlock the object and is not an unauthorized person. To determine the value, various information can be taken into account.
[0009] An access system according to an embodiment of the present disclosure will now be described in more detail with respect to a vehicle access system, where the term vehicle includes various types of vehicles such as cars, trucks, motorcycles, tractors, airplanes, boats, etc. However, the disclosed access system can be used in the same or similar manner with any other objects and applications (e.g., buildings, obstacles, etc.).
[0010] FIG. 1 shows diagrammatically the principle of an unintentional attack on a keyless entry system. The vehicle 10 broadcasts one or more request signals, usually periodically or in response to a certain triggering event. The request signals are usually electromagnetic signals, for example in the LF (low frequency) or HF (high frequency) range. The triggering event is, for example, touching or manipulating a door handle. The request signals broadcast by the vehicle 10 are sent in encrypted form and have a defined range, for example of a few meters (for example 10 meters). However, in principle, shorter or longer ranges are also possible. If the vehicle key 20 is within the above-mentioned defined range, the vehicle key 20 receives the request signals, evaluates them and sends a corresponding response signal back to the vehicle 10. The response signal broadcast by the vehicle key 20 is also usually sent in encrypted form. Based on this response signal, the vehicle 10 can recognize whether it is an authorized vehicle key 20 or not. The vehicle 10 is only unlocked if the vehicle key 20 is recognized as being associated with the vehicle 10.
[0011] However, such a system can be attacked relatively easily, as shown by way of example in Fig. 1. Fig. 1 shows a typical situation where a user parks a vehicle 10 in front of a house and leaves the associated vehicle key 20 inside the house near the entrance. The distance d12 between the vehicle 10 and the vehicle key 20 is large enough that the vehicle key 20 cannot receive a request signal from the vehicle 10. In a so-called relay attack, a first device 30 is placed within a required range around the vehicle 10 (shown in Fig. 1 by a dashed circle). The first device 30 receives a request signal from the vehicle 10 and forwards the request signal (possibly extending the range) to a second device 32, which is also located within a required range around the vehicle key 20 (shown in Fig. 1 by a dashed circle). The second device 32 then forwards the request signal to the vehicle key 20, which then broadcasts a corresponding response signal. The response signal is sent again (this time in the opposite direction) to the vehicle 10 by the arrangement from the first device 30 and the second device 32. Since the response signal is actually broadcast by the vehicle key 20 associated with the vehicle 10, it is correctly recognized by the vehicle 10 and the vehicle key 20 is recognized as associated with the vehicle 10, so that the vehicle 10 can be unlocked and opened. It may also be possible to start the vehicle 10 as well. This means that the vehicle can be opened and / or started by unauthorized persons even if the vehicle key 20 is not present within the required range around the vehicle 10. The arrangement from the first device 30 and the second device 32 allows the signal to be properly amplified to bridge distances of up to several hundred meters.
[0012] The vehicle key 20 may be a dedicated vehicle key. However, nowadays, mobile phones are increasingly taking over the functions of the vehicle key. That is to say, the vehicle key 20 may be a mobile phone (smartphone) with a corresponding application (app) installed. According to an embodiment of the present disclosure, in addition to the usual request signal from the vehicle 10, a request for a value is sent to the vehicle key 20. The request value is an indication of the likelihood that the vehicle 10 will actually be used by an authorized user. Then, based on this value, which the vehicle key 20 determines upon request and sends to the vehicle 10, the vehicle 10 decides whether to actually perform the desired action (unlock, start) or not. It thus means that the decision is not only based on the reception of a correct response signal, but also on the level of probability of use (based on the determined value). For example, the vehicle 10 may be unlocked if the correct response signal has been received and the request value also corresponds to or exceeds a predefined threshold value. This threshold value may, for example, be set by the vehicle manufacturer. However, in principle, it is also possible for the user to set this threshold value individually according to the user's needs.
[0013] The vehicle 10 can directly send a request for a value (usage probability) in the request signal. This means that the vehicle 10 can only broadcast a signal to which the vehicle key 20 responds with a response signal. The request value can be transmitted in the response signal. However, the vehicle 10 can also broadcast two separate request signals. The vehicle key 20 can also transmit the desired value in the response signal or transmit two separate signals to the vehicle 10.
[0014] According to an embodiment of the present disclosure, a request for a value to the vehicle key 20 is broadcast by the vehicle 10 only upon receipt of a correct response signal by the vehicle key 20. This is illustrated by way of example in the sequence diagram of FIG. 2. This request for a value (hereinafter also referred to as second request signal) may be transmitted over the same connection as the first request signal or over a different connection. For example, contrary to the first request signal, the second request signal may be transmitted to the vehicle key 20 over a Bluetooth® connection or a Bluetooth® Low Energy (BLE) connection. However, other secure transmission channels are also possible.
[0015] The vehicle 10 may, for example, broadcast the second request signal immediately after receiving the first response signal. However, instead, the vehicle 10 may wait until it recognizes that the vehicle key 20 is within a defined range around the vehicle 10 after receiving the first response signal before broadcasting the second request signal (shown by the dashed line in FIG. 2). For example, the location of the vehicle key 20 and / or its distance from the vehicle 10 may be tracked by the vehicle 10. After receiving the second request signal, the vehicle key 20 determines a value (probability of use by an authorized user) and transmits it back to the vehicle 10. The vehicle 10 compares the value received from the vehicle key 20 with a defined threshold. If the value is equal to or greater than the threshold, the vehicle 10 is unlocked. If the value is less than the threshold, the vehicle 10 remains locked.
[0016] This value indicates the probability that one of the at least one authorized user wants to use the vehicle 10. If said probability is too low (value below the threshold), this means, conversely, that there is a high probability that an unauthorized user wants to use the vehicle 10. The value can be determined taking into account a variety of different factors, each of which can be determined in a variety of ways, for example by one or more sensors in the vehicle key 20, by one or more devices (peripherals) connected to the vehicle key 20, and / or based on the learned usage behavior of the authorized user(s). For example, the vehicle key 20 (e.g., a mobile phone) can determine one or more of the following characteristics: -Whether it's currently charging - whether you are currently moving (general or directed); -Whether you are connected to a known Wi-Fi (e.g. your home Wi-Fi, your work Wi-Fi, etc.) whether the Wi-Fi connection currently available to the vehicle key 20 at least partially matches a Wi-Fi connection also available to the vehicle 10 (for this purpose the vehicle 10 can, for example, transmit corresponding information in a second request signal to the vehicle key 20); whether the vehicle key 20 detects in its vicinity an external device (e.g. an available Bluetooth® device) that is at least partially identical to the vehicle 10 (for this purpose the vehicle 10 can, for example, transmit corresponding information in a second request signal to the vehicle key 20); whether the position determined for the vehicle key 20 is located in the vicinity of the position determined for the vehicle 10 (for this purpose the vehicle 10 can, for example, transmit its current position in the second request signal), - whether it is time for one or several authorized users to use the vehicle 10 as usual, whether the distance between the vehicle 10 and the vehicle key 20 determined by the vehicle key 20 matches the distance between the vehicle 10 and the vehicle key 20 determined by the vehicle 10 (for this purpose the vehicle 10 can, for example, transmit the distance between the vehicle 10 and the vehicle key 20 determined by the vehicle 10 in the second request signal), How much time has passed since the last interaction between the vehicle 10 and the vehicle key 20; and / or - Whether the movement profile of the vehicle key 20 matches the changes in position of the vehicle key 20 determined by the vehicle 10.
[0017] This means that the current situation of the vehicle key 20 is evaluated. The more different factors are taken into account when determining the value, the more accurate and reliable the system will generally be. In many cases the value can be an indication of unauthorized use if the vehicle key (mobile phone) is currently charging and connected to the home Wi-Fi. However, it is quite conceivable that the mobile phone is charged, for example, with a so-called power bank (portable charger), and that the mobile phone remains connected to the home Wi-Fi in the garage or just in front of the house. In such a case, false negative results (results in which an unauthorized use attempt is falsely detected) can be more reliably excluded if it is additionally detected, for example, that the use attempt is made in the morning, at a time when an authorized user usually leaves the house, that the vehicle 10 is also within range of the home Wi-Fi, and that the specific positions of the vehicle 10 and the vehicle key match.
[0018] The above features used to determine the value are merely examples. Additionally or alternatively, any other suitable features may be taken into account in determining the value. Different features may be weighted equally or differently.
[0019] The value may be determined just once or may be determined multiple times. One or more of the characteristics considered to determine the value may be changeable. For example, if a user moves towards the vehicle 10 with the vehicle key 20, the connection to the Wi-Fi may be lost. This will also cause the position of the vehicle key 20 to change. The vehicle key 20 may then take the change in the particular characteristic into account, for example, when determining the value. This may indicate, for example, that if the position of the vehicle key 20 remains unchanged, it is not being used by an authorized user. In such a case, the vehicle key 20 may send a further updated value to the vehicle 10.
[0020] According to the method shown in Fig. 2, if the value is equal to or greater than the threshold, the vehicle 10 is unlocked, and if the value is less than the threshold, the vehicle 10 remains locked. However, as shown by way of example in Fig. 3, the vehicle 10 can alternatively request the consent of the user if the value is less than the threshold. Fig. 3 shows only an exemplary sequence from the broadcast of the second request signal. The preceding steps, which are not explicitly shown in Fig. 3, are essentially identical to the steps already described in Fig. 2 for the first request signal and the first response signal.
[0021] Thus, the vehicle 10 can request explicit consent from the user if the value is below the threshold value. For example, the user may be shown a pop-up window on the user's smartphone screen asking the user to confirm that he or she wants to use the vehicle 10. The user can then explicitly consent to the use or reject it by selecting a corresponding button. If the user consents, the vehicle key 20 sends a corresponding response to the vehicle 10 and the vehicle 10 is unlocked. If the user does not consent, either no response is sent to the vehicle 10 or the unlocking of the vehicle 10 is explicitly rejected. In both cases, the vehicle 10 remains locked.
[0022] User actions that require the user to press a switch or button to improve user convenience are generally undesirable in hands-free applications. In the method according to FIG. 3, this is accepted if the determined value is below a threshold value. This makes it possible to nullify false negative results, where the vehicle 10 remains locked despite being used by an authorized user. It would be very inconvenient for the authorized user if the vehicle 10 were to remain completely locked in the case of a false negative result. However, the more accurately the value is determined, the rarer false negative results will be, so that active user consent is only required in a few cases and user convenience remains high.
[0023] The described access system is very flexible since it can adapt to different and changing circumstances by using several features to determine the value. By considering many different features in determining the value, the access system also becomes significantly more accurate and therefore more reliable than other methods that consider only one of the features (e.g. the movement pattern of the vehicle key 20).
[0024] To transmit and receive corresponding signals, the vehicle 10 (object) may have a first communication unit (e.g., a transceiver unit) and the key 20 may have a second communication unit (e.g., a transceiver unit). An access system according to an embodiment of the present disclosure includes a first communication unit disposed on the object 10 and a second communication unit disposed on the key 20 associated with the object 10, the first communication unit configured to broadcast a first request signal, the second communication unit configured to receive the first request signal and to transmit a first response signal to the first communication unit after receiving the first request signal, the first communication unit further configured to transmit a request for a value to the second communication unit, the second communication unit configured to determine a value upon receiving the request and transmit the value to the first communication unit, the value being an indication of how high a probability the object 10 will be used by an authorized user. The object 10 is configured to use the first response signal to check whether the key 20 is a key associated with the object 10 and to compare the value received from the second communication unit with a defined threshold, and the object 10 is unlocked if the key 20 is recognized as associated with the object 10 and the value is equal to or greater than the threshold.
Claims
1. An access system having a first communication unit arranged on an object (10) and a second communication unit arranged on a key (20) associated with said object (10), the first communication unit is configured to broadcast a first request signal; The second communication unit is configured to receive the first request signal and to send a first response signal to the first communication unit after receiving the first request signal; The first communication unit is further configured to send a request for a value to the second communication unit; the second communication unit is configured to determine the value upon receiving the request and to transmit it to the first communication unit, the value being an indication of how likely it is that the object (10) will be used by an authorized user; the object (10) is configured to use the first response signal to check whether the key (20) is a key associated with the object (10); The object (10) is further configured to compare the value received from the second communication unit with a defined threshold value; The object (10) is unlocked if the key (20) is recognized as being associated with the object (10) and the value is greater than or equal to the threshold value.
2. 2. The access system of claim 1, wherein the first communication unit is configured to transmit the request for the value to the second communication unit when the key (20) is recognized to be within a required range around the object (10).
3. 3. The access system of claim 1 or claim 2, wherein the first communication unit is further configured to send a third request signal to the second communication unit when the value is less than the threshold, the third request signal including a request for user consent.
4. 4. The access system of claim 3, wherein the second communication unit is further configured to transmit a third response signal to the first communication unit after receiving the third request signal, the third response signal including information regarding a decision by the user as to whether the object (10) should be unlocked, and the object (10) is unlocked if the third response signal includes information that the user agrees to the unlocking.
5. 2. The access system of claim 1, wherein the key (20) is a mobile phone with an application installed thereon, said mobile phone being able to act as a key for said object (10) by means of said application.
6. 6. The access system of claim 5, wherein the mobile phone determines the value by taking into account a number of different factors.
7. The different factors include: - information about whether the mobile phone is charging, - whether the mobile phone is moving; - Whether the mobile phone is connected to a known Wi-Fi; - whether the Wi-Fi connection available to the mobile phone at least partially matches the Wi-Fi connection available to the object (10); - whether said mobile phone at least partially detects the same external device in the vicinity of said object (10); - whether the location pointed to the mobile phone is in the vicinity of the location pointed to the object (10); - whether said request for said value occurs at the time when one of one or more authorized users normally uses or enters said object (10); - whether the distance between the object (10) and the mobile phone determined by the mobile phone matches a specific distance between the object (10) and the mobile phone determined by the object (10); - how long ago the last interaction between the object (10) and the mobile phone occurred; and / or - whether the mobile phone's movement profile matches the changes in the mobile phone's position determined by the object (10); The access system of claim 6 , comprising one or more of:
8. The access system of claim 1 , wherein the object (10) is a vehicle, a building, or an obstacle.
9. A method of operating an access system for an object (10), comprising the steps of: broadcasting a first request signal by a first communication unit located on the object (10); receiving the first request signal by a second communication unit located on a key (20) associated with the object (10), and broadcasting a first response signal by the second communication unit to the first communication unit after receiving the first request signal; broadcasting, by the first communication unit, a request for a value to the second communication unit; determining a value in said key (20) when said request is received and transmitting said value by said second communication unit to said first communication unit, said value being an indication of how likely it is that said object (10) will be used by an authorized user; checking, by the object (10), using the first response signal, whether the key (20) is the key associated with the object (10); comparing, by the object (10), the value received from the second communication unit with a defined threshold value; Including, The object (10) is unlocked if the key (20) is recognized as being associated with the object (10) and the value is greater than or equal to the threshold value.