Passive entry / passive start system implementing carrier phase based ranging with music style eigenvalue decomposition for distance determinations

Abstract

To provide an access system for vehicles.SOLUTION: An access system includes antennas and an access module. The antennas are configured to each receive a signal transmitted from a portable access device to a vehicle. The signal is transmitted on a 2.4 gigahertz frequency. The access module is configured to: down-convert the received signal to generate an in-phase signal and a quadrature phase signal; perform carrier phase based ranging including implementing a music algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine angles of arrival of the received signal received at the antennas; determine a location of the portable access device relative to the vehicle based on the distance and the angles of arrival; and permit access to the vehicle based on the location.SELECTED DRAWING: Figure 71

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to U.S. Patent Application No. 16 / 824,444, filed March 19, 2020, which is a continuation-in-part of U.S. Application No. 16 / 598,191, filed October 10, 2019, which claims the benefit of U.S. Provisional Application No. 62 / 744,814, filed October 12, 2018, U.S. Provisional Application No. 62 / 801,392, filed February 5, 2019, and U.S. Provisional Application No. 62 / 826,212, filed March 29, 2019. This application also claims priority to U.S. Provisional Application No. 62 / 850,055, filed March 20, 2019. [Technical Field]

[0002] The present disclosure relates to a passive entry / passive start system. [Background technology]

[0003] The background art discussion provided herein is intended to generally present the context for the present disclosure. The inventor's work to the extent described in this background art section, as well as any portions of the discussion that may not be considered prior art at the time of filing, are not admitted, expressly or impliedly, as prior art to the present disclosure.

[0004] A conventional passive entry / passive start (PEPS) system allows keyless entry, including providing the user access to various vehicle functions, when the user possesses a key fob paired with an onboard PEPS electronic control unit (or PEPS module). As an example, a user possessing a key fob may approach a vehicle equipped with a PEPS module. The key fob communicates with the PEPS module, and if the key fob is authenticated, the PEPS module can unlock the vehicle doors. The PEPS module (i) performs an authentication process to determine whether the key fob is authorized to access the vehicle and (ii) determines the location of the key fob relative to the vehicle. The authentication process may include the exchange of an encrypted password or signature. If the password or signature is correct, the key fob is determined to be authorized. The location of the key fob may be determined based, for example, on the strength of a signal received from the key fob. If the key fob is authenticated and located within an authorized zone of the vehicle, access to the interior of the vehicle is granted without the use of a traditional key.

[0005] As another example, a user possessing a key fob can activate a vehicle function by pressing a button on the key fob. In response to the button press, the key fob communicates with the PEPS module, and if the key fob is authenticated and within a predetermined distance of the vehicle, the PEPS module performs a specified function associated with the button press on the key fob (e.g., start the vehicle, open a door, sound an alarm, etc.). Two example communications performed may include the key fob and the PEPS module performing a one-way low frequency (LF) wake-up function and a one-way or two-way radio frequency (RF) authentication function.

[0006] A Phone-as-a-Key (PAK) vehicle access system can operate similarly to the described PEPS system, except that a mobile phone rather than a key fob is used to access the vehicle. As an example, the mobile phone can communicate with a PAK module or telematics control unit (TCU) in the vehicle to initiate an access pairing process. The mobile phone and either the PAK module or the TCU execute the access pairing process to establish a trust relationship. The pairing process can include Bluetooth pairing, whereby security information is exchanged directly between the mobile phone and the vehicle; the mobile phone's address, mobile phone identity resolution key, reservation identifier, and / or encryption key are exchanged over a cloud-based network; and / or the mobile phone presents a certificate to the vehicle, where the certificate is signed by (i) the mobile phone, (ii) a trusted security signing authority such as the vehicle's manufacturer, and / or (iii) a trusted third party. In the case of a certificate, the certificate may include an identifier of the person authorized to access the vehicle, an identifier of the cloud-based network authorized to transfer the certificate, an identifier of the vehicle rental or lease agreement, an identifier of the vehicle, dates and periods during which the authorized person is authorized to use the vehicle, and / or other restrictions, and / or access / license information.

[0007] For passive entry, some user action is typically required to initiate the process of waking up the key fob or cell phone (referred to as the portable access device). For example, this includes the user approaching the vehicle with the portable access device and / or touching and / or pulling the door handle. When a PEPS module or PAK module, referred to as the access module, detects this action, the access module performs a location process and begins searching for and waking up the key fob. In a one-way RF system, an LF downlink signal (e.g., a 125 kilohertz (kHz) signal) is sent from the access module to the key fob to wake it up and send commands and data to it for authentication purposes. The key fob then sends a response signal to the access module via an RF uplink. The response signal may be at an ultra-high frequency (e.g., 315 megahertz (MHz) or 433 MHz). In a two-way RF system, an LF downlink signal is sent from the access module to the key fob to wake it up and establish a two-way RF link between the access module and the key fob. The two-way RF link can transmit signals at UHF frequencies (e.g., 315 MHz, 422 MHz, 868 MHz, or 915 MHz) and is used to authenticate the key fob. The key fob contains a microcontroller that remains in a sleep mode (or low-power listening mode) constantly checking for a valid LF signal. If a valid LF signal containing the correct vehicle-specific wake-up identifier is found, the microcontroller generates a signal to wake up the PEPS controller to communicate with the vehicle's access module.

[0008] A vehicle may have, for example, four to six LF antennas that generate LF magnetic fields. The key fob's controller measures the LF signal levels during communication with the access module. The controller determines a received signal strength indicator (RSSI) and provides the RSSI to the access module. The access module then determines the key fob's location based on the RSSI. The key fob includes three separate antenna coils or one 3D coil that are used to determine x-, y-, and z-axis values that indicate the key fob's location.

[0009] Smartphones, wearable devices, and / or other smart portable network devices can function as key fobs and enable various vehicle functions such as passive welcome lighting, distance boundaries in remote parking applications, and long-range distance capabilities. Summary of the Invention

[0010] A vehicle access system is provided. The access system includes an antenna and an access module. The antenna is configured to receive signals transmitted from a portable access device to a vehicle, respectively. The signals are transmitted at a frequency of 2.4 gigahertz. The access module is configured to downconvert the received signals to generate in-phase and quadrature-phase signals and perform carrier-phase based ranging, including executing a MUSIC algorithm, to (i) determine a distance between the portable access device and the vehicle, and (ii) determine an angle of arrival of the received signals received at the antenna, determine a position of the portable access device relative to the vehicle based on the distance and angle of arrival, and grant access to the vehicle based on the position.

[0011] In other features, the antenna is positioned on the vehicle such that a received signal has a plurality of corresponding bounce paths between the portable access device and the antenna.

[0012] In other features, the antenna is disposed within a metal structure of the vehicle.

[0013] In other features, the antenna is positioned so that there is no line of sight between the antenna and the portable access device.

[0014] In other features, the access system further includes sensors, each of the sensors including two or more antennas, and the sensors are positioned on the vehicle such that a received signal has multiple corresponding bounce paths between the portable access device and each sensor.

[0015] In other features, the access module is configured to monitor a received signal, generate a received signal strength indicator based on the received signal, determine whether the portable access device is inside or outside the vehicle based on the received signal strength indicator, and, if the portable access device is outside the vehicle, determine a distance between the portable access device and the vehicle.

[0016] In other features, at least one of the antennas is a circularly polarized antenna.

[0017] In other features, the antenna includes a circularly polarized antenna including a conductive ring-shaped body having an inner bore, a circular isolator connected to the conductive ring-shaped body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular isolator and extending outwardly from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to a radius of the circularly polarized antenna.

[0018] In other features, the access module is configured, while executing the MUSIC algorithm, to collect analytical signal samples of signals received at each antenna to generate a received data matrix, estimate a data covariance matrix based on the received data matrix, determine an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to 2, determine a number of incident signals, divide the M×M matrix into matrices, calculate a MUSIC spectrum based on one of the matrices, and perform a peak search of the MUSIC spectrum to determine an angle of arrival.

[0019] In other features, the receiver includes a phase locked loop and is phase locked with a transmitter of the portable access device. The access module is configured to perform a tone exchange with the transmitter and determine at least one of a range or an angle of arrival based on the tone exchange.

[0020] In other features, the receiver includes a phase-locked loop and is phase-locked with a transmitter of the portable access device. The access module is configured to perform a tone exchange with the transmitter, determine round-trip time-of-flight information based on the tone exchange, and determine distance based on the round-trip time-of-flight information.

[0021] In other features, a vehicle is provided, the vehicle including an access system, a body, and a roof, a center console, a floor, or an at least partially enclosed metal structure, wherein an antenna is mounted to at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.

[0022] In other features, a method is provided, the method including receiving signals transmitted from a portable access device to a vehicle at each of a plurality of antennas, the signals being transmitted at a frequency of 2.4 gigahertz, downconverting the received signals to generate in-phase and quadrature-phase signals, performing carrier phase based ranging including executing a MUSIC algorithm to (i) determine a distance between the portable access device and the vehicle and (ii) determine an angle of arrival of the received signals received at the antennas, determining a position of the portable access device relative to the vehicle based on the distance and the angle of arrival, and granting access to the vehicle based on the position.

[0023] In other features, the antenna is positioned on the vehicle such that a received signal has a plurality of corresponding bounce paths between the portable access device and the antenna.

[0024] In other features, the antenna is positioned so that there is no line of sight between the antenna and the portable access device.

[0025] In other features, the pair of antennas are implemented as part of each sensor, the sensors being positioned on the vehicle such that a received signal has multiple corresponding bounce paths between the portable access device and each sensor.

[0026] In other features, the method further includes monitoring the received signal and generating a received signal strength indicator based on the received signal, determining whether the portable access device is inside or outside the vehicle based on the received signal strength indicator, and if the portable access device is outside the vehicle, determining a distance between the portable access device and the vehicle.

[0027] In other features, at least one of the antennas is a circularly polarized antenna.

[0028] In other features, the method further includes, while executing the MUSIC algorithm, collecting analytical signal samples of signals received at each antenna to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to two; determining a number of incident signals; dividing the M×M matrix into multiple matrices; calculating a MUSIC spectrum based on one of the matrices; and performing a peak search on the MUSIC spectrum to determine an angle of arrival.

[0029] In other features, the method further includes performing a tone exchange with a transmitter of the portable access device and determining at least one of a range or an angle of arrival based on the tone exchange. A receiver of the portable access device performing the tone exchange includes a phase locked loop and is phase locked with the transmitter of the portable access device.

[0030] In other features, the method further includes performing a tone exchange with the transmitter, determining round trip time of flight information based on the tone exchange, and determining distance based on the round trip time of flight information. A receiver of the portable access device performing the tone exchange includes a phase locked loop and is phase locked with the transmitter of the portable access device.

[0031] A vehicle access system is provided. The access system includes a receiver and an access module. The receiver is configured to receive a signal transmitted from a portable access device to the vehicle. The access module is configured to generate a differentiated signal based on the received signal, upsample the differentiated signal to generate a first upsampled signal, obtain or generate an expected signal, upsample the expected signal to generate a second upsampled signal, cross-correlate the first upsampled signal and the second upsampled signal to generate a cross-correlation signal, determine a phase difference between the first upsampled signal and the second upsampled signal based on the cross-correlation signal, determine a round-trip time of the signal received by the receiver, and grant access to the vehicle based on the round-trip time.

[0032] In other features, the access module is configured to downconvert the signal to generate a downconverted signal, sample the downconverted signal to generate a sampled signal, perform an arctangent of the sampled signal to generate an arctangent signal, and differentiate the arctangent signal to generate a differentiated signal.

[0033] In other features, the access module is configured to determine at least one of a location or a distance of the portable access device relative to the vehicle based on the round trip time, and grant access to the vehicle based on at least one of the location or the distance.

[0034] In other features, the access module includes a first upsampler configured to upsample the differential signal to generate a first upsampled signal and a second upsampler configured to upsample the expected signal to generate a second upsampled signal, wherein the upsampling rate of the first upsampler is the same as the sampling rate of the second upsampler.

[0035] In other features, the access module includes a code module configured to determine a code of the differentiated signal, and a bit pattern module configured to generate the expected signal based on the code of the differentiated signal.

[0036] In other features, the access module is configured to obtain an expected signal, the expected signal being a predetermined signal obtained by the access module prior to receiving the received signal.

[0037] In other features, the access module is configured to perform an iterative process including multiplying bits of the first upsampled signal and the second upsampled signal to generate resultant products, summing the resultant products to generate a sum-of-products value, and shifting the second upsampled signal relative to the first upsampled signal. The iterative process provides the sum-of-products value. The access module is configured to determine a phase difference based on the sum-of-products value.

[0038] In other features, the access module is configured to reconstruct a signal transmitted from the portable access device to the vehicle based on a zero crossing of a portion of the cross-correlation signal associated with a maximum value of the sum of products.

[0039] In other features, the access module includes an upsampler configured to upsample the differentiated signal to generate a first upsampled signal; a code module configured to determine a sign of the first upsampled signal; and a bit pattern module configured to generate the expected signal based on the sign of the first upsampled signal.

[0040] In another feature, a portable access device for a vehicle access system is provided. The portable access device includes a receiver and a control module. The receiver is configured to receive a signal transmitted from a vehicle access module to the portable access device. The control module is configured to generate a differential signal based on the received signal, upsample the differential signal to generate a first upsampled signal, obtain or generate an expected signal, upsample the expected signal to generate a second upsampled signal, cross-correlate the first upsampled signal with the second upsampled signal to generate a cross-correlation signal, determine a phase difference between the first upsampled signal and the second upsampled signal based on the cross-correlation signal, determine a round-trip time of the signal received by the receiver, and transmit the round-trip time to the vehicle to gain access to the vehicle based on the round-trip time, or determine at least one of a position or a distance between the portable access device and the vehicle and transmit at least one of the position or the distance to the vehicle to gain access to the vehicle.

[0041] In other features, the control module is configured to downconvert the signal to generate a downconverted signal, sample the downconverted signal to generate a sampled signal, perform an arctangent of the sampled signal to generate an arctangent signal, and differentiate the arctangent signal to generate a differentiated signal.

[0042] In other features, the control module is configured to determine at least one of a position or a distance of the portable access device relative to the vehicle based on the round trip time, and to transmit at least one of the position or the distance to the vehicle to obtain access to the vehicle based on the at least one of the position or the distance.

[0043] In other features, the control module includes a first upsampler configured to upsample the differentiated signal to generate a first upsampled signal and a second upsampler configured to upsample the expected signal to generate a second upsampled signal, wherein an upsampling rate of the first upsampler is the same as a sampling rate of the second upsampler.

[0044] In other features, the control module includes a sign module configured to determine a sign of the differentiated signal, and a bit pattern module configured to generate the expected signal based on the sign of the differentiated signal.

[0045] In other features, the control module is configured to obtain an expected signal, the expected signal being a predetermined signal obtained by the access module prior to receiving the received signal.

[0046] In other features, the control module is configured to perform an iterative process including multiplying bits of the first upsampled signal and the second upsampled signal to generate resultant products, summing the resultant products to generate a sum-of-products value, and shifting the second upsampled signal relative to the first upsampled signal. The iterative process provides the sum-of-products value. The control module is configured to determine a phase difference based on the sum-of-products value.

[0047] In other features, the control module is configured to reconstruct a signal transmitted from the vehicle access module to the portable access device based on a zero crossing of a portion of the cross-correlation signal associated with a maximum value of the sum of products.

[0048] In other features, the control module includes an upsampler configured to upsample the differentiated signal to generate a first upsampled signal; a code module configured to determine a code of the first upsampled signal; and a bit pattern module configured to generate the expected signal based on the code of the first upsampled signal.

[0049] A vehicle access system is provided, including antennas and an access module. The antennas are configured to receive signals transmitted from portable access devices to the vehicle, one of the antennas being a circularly polarized antenna. The access module is configured to downconvert the received signals to generate in-phase and quadrature-phase signals, execute a MUSIC algorithm to determine an angle of arrival of the received signals received at the antennas, determine a distance between the portable access device and the vehicle based on the angle of arrival, and grant access to the vehicle based on the distance.

[0050] In other features, the antenna includes a circularly polarized antenna including a conductive ring-shaped body having an inner bore, a circular isolator connected to the conductive ring-shaped body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular isolator and extending outwardly from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to a radius of the circularly polarized antenna.

[0051] In other features, the access module is configured, while executing the MUSIC algorithm, to collect analytical signal samples of signals received at each antenna to generate a received data matrix, estimate a data covariance matrix based on the received data matrix, determine an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to two, determine a number of incident signals, divide the M×M matrix into multiple matrices, calculate a MUSIC spectrum based on one of the matrices, and perform a peak search of the MUSIC spectrum to determine an angle of arrival.

[0052] In other features, the access module is configured to perform a covariance smoothing method to generate a modified covariance matrix and to determine an M×M matrix based on the modified covariance matrix using an eigenvalue decomposition process.

[0053] In other features, the access module is configured to convert the in-phase and quadrature-phase sample vectors to phase angle vectors while generating the received data matrix, generate the recreated in-phase and quadrature-phase sample vectors for each antenna based on the phase angle vectors, and generate the received data matrix based on the recreated in-phase and quadrature-phase sample vectors for each antenna.

[0054] In other features, the access module is configured to create a time vector corresponding to the in-phase and quadrature-phase sample vectors, discard some analysis signal samples acquired near antenna switching times, unwrap each repeating portion of the remaining samples by a step size of π, average the sinusoidal frequencies of the remaining samples, find an average slope of the remaining samples, measure a standard deviation of the average slope, determine which antennas are misaligned based on the measured standard deviation, and, for each antenna, perform a straight line interpolation of the points on the time vector to generate a reconstructed phase angle vector.

[0055] In other features, the access module is configured to check which one of the antennas has an incorrect alignment if the standard deviation is greater than a predetermined threshold, and re-measure the standard deviation of the average gradient for that one of the antennas.

[0056] In other features, the access module is configured to perform a clean method that includes performing an iterative process that includes removing source signals one at a time using a calibrated array manifold that includes the antennas and forcing the positions of the source signals to offset positions and recalculating the angles of arrival of the remaining signals, wherein the access module converges to a new set of incident angles of arrival during the iterative process.

[0057] In other features, a vehicle is provided, the vehicle including a body and a roof, a center console, a floor, or an at least partially enclosed metal structure, wherein an antenna is mounted to at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.

[0058] In other features, the antenna includes a multi-axially polarized RF antenna assembly, the multi-axially polarized RF antenna assembly including a circularly polarized antenna and oriented at the roof.

[0059] In other features, a method is provided that includes receiving a signal transmitted from a portable access device to a vehicle at each of a plurality of antennas, where one of the antennas is a circularly polarized antenna, downconverting the received signal to generate an in-phase signal and a quadrature-phase signal, executing a MUSIC algorithm to determine an angle of arrival of the received signal received at the antenna, determining a distance between the portable access device and the vehicle based on the angle of arrival, and granting access to the vehicle based on the distance.

[0060] In other features, performing the MUSIC algorithm includes collecting analytical signal samples of signals received at each antenna to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to two; determining a number of incident signals; dividing the M×M matrix into multiple matrices; calculating a MUSIC spectrum based on one of the matrices; and performing a peak search on the MUSIC spectrum to determine the angle of arrival.

[0061] In other features, the method further includes performing a covariance smoothing method to generate a modified covariance matrix, and determining an M×M matrix based on the modified covariance matrix using an eigenvalue decomposition process.

[0062] In other features, the method further includes converting the in-phase and quadrature-phase sample vectors to phase angle vectors while generating the received data matrix, generating recreated in-phase and quadrature-phase sample vectors for each antenna based on the phase angle vectors, and generating the received data matrix based on the recreated in-phase and quadrature-phase sample vectors for each antenna.

[0063] In other features, the method further includes creating a time vector corresponding to the in-phase and quadrature-phase sample vectors, discarding some analysis signal samples acquired near antenna switching times, unwrapping each repeating portion of the remaining samples by a step size of π, averaging sinusoidal frequencies of the remaining samples, determining an average slope of the remaining samples, measuring a standard deviation of the average slope, determining which antennas are misaligned based on the measured standard deviation, and, for each antenna, linearly interpolating points on the time vector to generate a reconstructed phase angle vector.

[0064] In other features, the method further includes checking which one of the antennas has an incorrect alignment if the standard deviation is greater than a predetermined threshold, and re-measuring the standard deviation of the average gradient for that one of the antennas.

[0065] In other features, the method further includes performing a clean method that includes removing source signals one at a time using a calibrated array manifold that includes the antennas, and performing an iterative process that includes forcing the positions of the source signals to offset positions and recalculating the angles of direction of arrival of the remaining signals, and converging to a new set of incident angles of arrival while performing the iterative process.

[0066] In other features, the vehicle includes (i) a body and (ii) a roof, a center console, a floor, or an at least partially enclosed metal structure, and the antenna is mounted to at least one of the roof, the center console, the floor, or the at least partially enclosed metal structure.

[0067] In other features, the antenna includes a multi-axially polarized RF antenna assembly. The multi-axially polarized RF antenna assembly includes a circularly polarized antenna and is oriented at the roof.

[0068] A multi-axially polarized RF antenna assembly is provided, the multi-axially polarized RF antenna assembly including a circularly polarized antenna, a circular isolator, and a linearly polarized antenna. The circularly polarized antenna includes a conductive ring-shaped body having an inner hole. The circular isolator is connected to the conductive ring-shaped body. The linearly polarized antenna is connected to the circularly polarized antenna and the circular isolator and extends outward from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to a radius of the circularly polarized antenna.

[0069] In other features, the conductive element is a wire. In other features, the sleeve is formed of polytetrafluoroethene. The conductive element is formed of copper.

[0070] In other features, the linearly polarized antenna is configured to extend downwardly from the circularly polarized antenna in use.

[0071] In other aspects, the circularly polarized antenna is a dual-axis antenna, and the linearly polarized antenna is a single-axis antenna.

[0072] In other features, the multi-axially polarized RF antenna assembly further includes a ground plane, and circular isolators are disposed on the ground plane between the conductive element and the ground plane and between the circularly polarized antenna and the ground plane.

[0073] In other features, the circularly polarized antenna includes two feed points offset in phase by 90 degrees and is configured to receive signals that are 90 degrees out of phase with each other.

[0074] In another aspect, a vehicle is provided, the vehicle including a body and a roof, the roof including a multi-axially polarized RF antenna assembly, the multi-axially polarized RF antenna assembly being oriented on the roof such that a linearly polarized antenna extends downward from a circularly polarized antenna.

[0075] In another feature, a vehicle system is provided, the vehicle system including a multi-polarized RF antenna assembly, a second multi-polarized RF antenna assembly, and an access module. The multi-polarized RF antenna assembly is a first multi-polarized RF antenna assembly configured to be mounted on a vehicle. The second multi-polarized RF antenna assembly is configured to be mounted on a vehicle and includes a second circularly polarized antenna including a second conductive ring-shaped body having a second inner hole, a second circular isolator connected to the second conductive ring-shaped body, and a second linearly polarized antenna connected to the second circular isolator and extending outward from the second circular isolator. The second linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. The second linearly polarized antenna extends perpendicular to a radius of the second circularly polarized antenna. The access module is connected to the first multi-axially polarized RF antenna assembly and the second multi-axially polarized RF antenna assembly and configured to communicate with the portable access device via the first multi-axially polarized RF antenna assembly and the second multi-axially polarized RF antenna assembly.

[0076] In other features, at any one time, the linearly polarized antenna or at least one of the first multi-axially polarized RF antenna assembly is not cross-polarized with an antenna of the second multi-axially polarized RF antenna assembly.

[0077] In other features, the access module is configured to perform passive entry passive start or phone-as-key operations, including transmitting and receiving radio frequency signals via a first one of the multi-axially polarized RF antenna assemblies and a second one of the multi-axially polarized RF antenna assemblies.

[0078] In other features, the access module is configured to grant access to the vehicle based on a radio frequency signal.

[0079] In other features, the access module is configured to execute an algorithm to determine which antenna pair, the first one of the multi-axially polarized RF antenna assemblies and the second one of the multi-axially polarized RF antenna assemblies, should be used for communication with the portable access device. In other features, the portable access device is a key fob or a mobile phone.

[0080] In another feature, a method for communicating with a portable access device is provided. The method includes repeatedly executing an algorithm via an access module of a vehicle, the algorithm including a series of operations including selecting a frequency from among frequencies, selecting an antenna pair from among possible antenna pairs, the antennas of the possible antenna pair including antennas having different polarization axes, transmitting a packet to the portable access device via the selected antenna pair, receiving a first received signal strength indicator (RSSI) and a response signal from the portable access device, the first RSSI corresponding to the transmission of the packet, and measuring a second RSSI of the response signal. Based on the first RSSI and the second RSSI, a best antenna pair from among the possible antenna pairs is selected as the best one of the frequencies. One or more additional packets are transmitted using the selected best frequency and the selected best antenna pair.

[0081] In other features, each selected antenna pair includes one linearly polarized antenna and one circularly polarized antenna.

[0082] In other features, the method of claim 1 further includes transmitting one or more additional packets to officially authorize the portable access device, determining whether the portable access device is authorized to access the interior of the vehicle, and, if the portable access device is authorized, granting access to the interior of the vehicle.

[0083] In other features, the method further includes measuring a time of flight of the one or more additional packets, the time including a time to transmit the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device, and estimating a distance between the vehicle and the portable access device based on the measured time of flight.

[0084] In other features, the estimated distance is used to detect whether another device is attempting to perform a range extender type relay station attack. In other features, the method of claim 4 further includes implementing a countermeasure if another device is attempting to perform a range extender type relay station attack, the countermeasure including preventing access to the interior of the vehicle. In other features, the countermeasure includes notifying an owner of the vehicle of the range extender type relay station attack.

[0085] In other features, the method further includes exchanging a plurality of pairs of unmodulated carrier tones at a plurality of frequencies with the portable access device, the pairs of unmodulated carrier tones including a received tone and a transmitted tone, measuring the phase of the received tone relative to the transmitted tone and collecting frequency data, and estimating a distance between the vehicle and the portable access device based on the measured phase and frequency data.

[0086] In other features, the method includes determining whether another device is attempting to perform a range extender type relay attack based on the estimated distance. In other features, each selected antenna pair includes a linearly polarized antenna.

[0087] In other features, the algorithm includes switching between possible antenna pairs between consecutively transmitted packets. In other features, the algorithm includes switching between possible antenna pairs during transmission of a portion of the packets. In other features, the portion of the packets are continuous wave tones.

[0088] In another feature, a particular pair of possible antenna pairs includes two co-located antennas.

[0089] In other features, the method further includes transmitting a packet to the portable access device; measuring a time-of-flight value of the packet based on a response signal received from the portable access device, the response signal transmitted based on the packet; determining whether another device is performing a range extender type relay station attack based on the time-of-flight value; and preventing access to an interior of the vehicle in response to detecting the range extender type relay station attack.

[0090] In other features, the portable access device is a key fob or a mobile phone. In other features, the method further includes encrypting an identifier of the best antenna pair. The transmission of the one or more additional packets includes the encrypted identifier of the best antenna pair.

[0091] In another feature, a vehicle system for communicating with a portable access device is provided. The vehicle system includes antennas having different polarization axes and an access module. The access module is configured to repeatedly execute an algorithm. The algorithm includes a series of operations including selecting a frequency from a plurality of frequencies, selecting an antenna pair from antennas having different polarization axes, transmitting a packet to the portable access device via the selected antenna pair, receiving a first RSSI and a response signal from the portable access device, the first RSSI corresponding to the transmission of the packet, and measuring a second RSSI of the response signal. The access module is configured to select a best one of the frequencies and a best antenna pair from the antenna pairs based on the first RSSI and the second RSSI, and then transmit one or more additional packets using the selected best frequency and the selected best antenna pair.

[0092] In other features, the access module is configured to measure a time of flight of the one or more additional packets, including a time to transmit the one or more additional packets to the portable access device and a time to receive one or more responses from the portable access device, and estimate a distance between the vehicle and the portable access device based on the measured time of flight.

[0093] In other features, the access module is configured to exchange multiple pairs of unmodulated carrier tones at multiple frequencies with the portable access device, the unmodulated carrier tones including a receive tone and a transmit tone, measure the phase of the receive tone relative to the transmit tone, collect the measured phase and frequency data, and use the measured phase and frequency data to estimate a distance between the vehicle and the portable access device.

[0094] In other features, the access module is configured to detect whether the portable access device is attempting to perform a range extender type relay station attack based on the estimated distance.

[0095] In other features, the access module is configured to detect whether a device is attempting to perform a range extender type relay attack based on the estimated distance.

[0096] In other features, the access module is configured to perform countermeasures including preventing access to the interior of the vehicle if the portable access device attempts to perform a range extender type relay station attack.

[0097] In other features, the countermeasures include notifying the vehicle owner of a range extender type relay attack. In other features, the portable access device is a key fob or a mobile phone.

[0098] In other features, the portable access device is configured to encrypt an identifier of the best antenna pair. The transmission of the one or more additional packets includes the encrypted identifier of the best antenna pair.

[0099] In another feature, a system for detecting a range extender type relay attack is provided. The system includes a first transmitter, a receiver, and a first module. The first transmitter is configured to transmit a first radio frequency signal from one of the vehicle and the portable access device to another of the vehicle and the portable access device. The receiver is configured to receive a first response signal from the one of the vehicle and the portable access device in response to the first radio frequency signal. The first module is configured to monitor or generate one or more parameters associated with the transmission of the first radio frequency signal and the reception of the first response signal, and to detect a range extension type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle based on the one or more parameters, where (i) the first radio frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) the first response signal is relayed from the portable access device to the vehicle via the attacking device. The system is configured to implement countermeasures in response to detecting the range extension type relay attack.

[0100] In other features, the first module is implemented in a vehicle.In other features, the first module is implemented in a portable access device.

[0101] In other features, the first module is configured to measure a round trip time of the first radio frequency signal and detect a range extension type relay attack based on the round trip time.

[0102] In other features, the first module is configured to transmit a second radio frequency signal and receive the second response signal before transmitting the first radio frequency signal and receiving the first response signal, monitor at least one of a first received signal strength indicator of the second radio frequency signal or a second received signal strength indicator of the second response signal, and determine at least one of a path, a frequency, a channel, or an antenna pair for transmitting the first radio frequency signal and receiving the first response signal based on the at least one of the first received signal strength indicator or the second received signal strength indicator.

[0103] In other features, the first module is configured to transmit a second radio frequency signal and receive the second response signal before transmitting the first radio frequency signal and receiving the first response signal, monitor an antenna polarization state corresponding to at least one of the second radio frequency signal or the second response signal, and determine at least one of a path, a frequency, a channel, or an antenna pair for transmitting the first radio frequency signal and receiving the first response signal based on the antenna polarization state of the at least one of the first radio frequency signal or the first response signal.

[0104] In other features, the first module is configured to transmit a first radio frequency signal while receiving a first response signal or a second radio frequency signal from one of the vehicle and the portable access device.

[0105] In other features, the first module is configured to receive the first response signal while receiving the second radio frequency signal from one of the vehicle and the portable access device.

[0106] In other features, the first module is configured to determine a randomly selected series of frequencies or channels, share the randomly selected series of frequencies or channels with one of the vehicle and the portable access device, and transmit a first radio frequency signal and receive a first response signal based on the randomly selected frequencies or channels.

[0107] In other features, the first module is configured to randomize an access address of the vehicle or the portable access device, share the randomized access address with the portable access device, and generate a first radio frequency signal including one of the access addresses.

[0108] In other features, the first module is configured to measure a length of at least one bit of the first response signal and detect a range extension type relay attack based on the length of the at least one bit.

[0109] In other features, the first module is configured to monitor slopes of rising and falling edges of the first response signal and detect a range extension type relay attack based on the slopes.

[0110] In other features, the first module is configured to align the first response signal to an idealized Gaussian waveform of known bit pattern and bit rate using a sliding correlation function, including peak scaling and zero offset adjustment, and detect a range extension type relay attack based on the alignment.

[0111] In other features, the first module is configured to accumulate an early portion of the first response signal after a zero crossing of the predetermined waveform and before a next peak, determine an average based on the accumulated portion, and detect a range extension type relay attack based on the average.

[0112] In other features, the first module is configured to accumulate a late portion of the first response signal after a peak of the predetermined waveform and before a next zero crossing, determine an average based on the accumulated portion, and detect a range extension type relay attack based on the average.

[0113] In other features, the first module is configured to randomize a direction of travel of the first radio frequency signal, including whether the first radio frequency signal is transmitted from the vehicle to the portable access device or from the portable access device to the vehicle.

[0114] In other features, the countermeasures include preventing at least one of access to or operational control of the vehicle.

[0115] In other features, the system further includes a second transmitter configured to transmit a dummy signal while the first transmitter transmits the first radio frequency signal or while the receiver receives the first response signal.

[0116] In other features, a system includes a first module mounted on a vehicle and a portable access device having a second module. The first module is configured to transmit a first radio frequency signal to the portable access device and receive a first response signal from the portable access device. The second module is configured to transmit a second radio frequency signal to the vehicle and receive a second response signal from the vehicle. The first module transmits the first radio frequency signal while the second module transmits the first response signal or the second radio frequency signal, or the first module receives the first response signal while the second module transmits the second radio frequency signal.

[0117] In other features, the first module and the second module are configured to exchange at least three pairs of radio signals, each pair including a section of an unmodulated carrier tone, the unmodulated carrier tone including a received tone and a transmitted tone, and measure a phase of the received tone relative to the transmitted tone. One or more of the first module and the second module are configured to collect frequency and phase information and estimate a distance between the first module and the second module based on the phase and frequency information.

[0118] In other features, one or more of the first module and the second module are configured to use the estimated distance to detect a range extension type relay attack.

[0119] In another feature, a method for detecting a range extension type relay attack is provided. The method includes transmitting a radio frequency signal from one of a vehicle and a portable access device to another of the vehicle and the portable access device via a transmitter; receiving a response signal from one of the vehicle and the portable access device responsive to the radio frequency signal via a receiver; monitoring or generating one or more parameters associated with the transmission of the radio frequency signal and the reception of the response signal; and detecting a range extension type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle based on the one or more parameters. (i) The radio frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attacking device. The method further includes performing countermeasures in response to detecting the range extension type relay attack, measuring a round trip time of the radio frequency signal, monitoring at least one of a first received signal strength indicator of the radio frequency signal or a second received signal strength indicator of the response signal, and detecting the range extension type relay attack based on the round trip time.

[0120] In another feature, a system for accessing or providing operational control of a vehicle is provided. The system includes a master device including a first antenna module having a first antenna with a different polarization axis, a transmitter configured to transmit a challenge signal from the vehicle to a slave device via the first antenna module, the slave device being a portable access device, and a first receiver configured to receive a response signal from the slave device in response to the challenge signal. The system further includes a first sniffer device including a second antenna module having a second antenna with a different polarization axis, and a second receiver configured to receive the challenge signal from the transmitter and the response signal from the slave device via the second antenna module. The first sniffer device is configured to measure when the challenge signal and the response signal arrive at the first sniffer device to provide a time of arrival. The master device or the first sniffer device is configured to (i) estimate at least one of a distance from the vehicle to the slave device or a position of the slave device relative to the vehicle based on the time of arrival, and (ii) prevent at least one of access to or operational control of the vehicle based on at least one of the estimated distance or position.

[0121] In other features, the master device or the first sniffer device is configured to determine a round-trip time associated with transmitting the challenge signal based on the arrival time, and to detect a range extension type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle based on the round-trip time. The response signal is relayed from the slave device to the vehicle by the attacking device and modified by the attacking device. The master device is configured to perform countermeasures in response to detecting the range extension type relay attack.

[0122] In other features, at any one time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0123] In other features, at any one time, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

[0124] In other features, the master device or the first sniffer device is configured to determine a first length of time for the first sniffer device to receive the challenge signal and a second length of time for the sniffer device to receive the response signal, and estimate the distance based on the first length of time and the second length of time.

[0125] In other features, the system further includes a second sniffer and a third sniffer. The second sniffer device includes a third antenna module including a third antenna and a third receiver configured to receive a challenge signal from the transmitter and a response signal from the slave device via the third antenna module. The third sniffer device includes a fourth antenna module including a fourth antenna and a fourth receiver configured to receive a challenge signal from the transmitter and a response signal from the slave device via the fourth antenna module. The second sniffer device is configured to measure when the challenge signal and the response signal arrive at the second sniffer device to provide a time of arrival. The third sniffer device is configured to measure when the challenge signal and the response signal arrive at the third sniffer device to provide a time of arrival. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate a location based on a time of arrival provided by the first sniffer device, a time of arrival provided by the second sniffer device, and a time of arrival provided by the third sniffer device.

[0126] In other features, the first sniffer device is configured to determine a first length of time for the first sniffer device to receive the response signal. The second sniffer device is configured to determine a second length of time for the second sniffer device to receive the response signal. The third sniffer device is configured to determine a third length of time for the third sniffer device to receive the response signal. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate a location based on the first length of time, the second length of time, and the third length of time.

[0127] In other features, the master device is configured to periodically transmit a challenge signal or other challenge signals to the slave devices and receive respective response signals from the slave devices. The first sniffer device is configured to measure when the challenge signal and the response signal arrive at the first sniffer device to provide corresponding times of arrival. The master device or the first sniffer device is configured to (i) update at least one of a distance or a location based on the times of arrival associated with the challenge signal and the response signal, and (ii) prevent at least one of access to or operational control of the vehicle based on at least one of the updated distance or the updated location.

[0128] In another feature, a method for accessing or providing operational control of a vehicle is provided, the method including: transmitting a challenge signal from a master device to a slave device of the vehicle via a first antenna module, the first antenna module including a first antenna having a different polarization axis, receiving at a first receiver a response signal from the slave device responsive to the challenge signal, receiving at a first sniffer device via a second antenna module and a second receiver the challenge signal from the master device and the response signal from the slave device, the second antenna module including a second antenna having a different polarization axis, measuring when the challenge signal and the response signal are received at the first sniffer device to provide a time of arrival via the first sniffer device, estimating at least one of a distance from the vehicle to the slave device or a location of the slave device relative to the vehicle based on the time of arrival, and preventing at least one of access to or operational control of the vehicle based on at least one of the estimated distance or location.

[0129] In other features, the method includes determining a round trip time associated with transmitting the challenge signal based on the arrival time; detecting a range extension type relay attack performed by the attacking device to gain at least one of access to or operational control of the vehicle based on the round trip time; the response signal being relayed from the slave device to the vehicle via the attacking device and modified by the attacking device; and performing countermeasures in response to detecting the range extension type relay attack.

[0130] In other features, at any one time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0131] In other features, at any one time, at least one of the first antennas of the first antenna module is not cross-polarized with an antenna of the slave device.

[0132] In other features, the method further includes determining a first length of time for the first sniffer device to receive the challenge signal and a second length of time for the sniffer device to receive the response signal, and estimating the distance based on the first length of time and the second length of time.

[0133] In other features, the method further includes receiving, at a third receiver of the second sniffer device via a third antenna module, the challenge signal from the transmitter and the response signal from the slave device, the third antenna module including a third antenna having a different polarization axis, and receiving, at a fourth receiver of the third sniffer device via a fourth antenna module, the fourth antenna module including a fourth antenna having a different polarization axis. The method further includes measuring when the challenge signal and the response signal arrive at the second sniffer device to provide times of arrival via the second sniffer device, measuring when the challenge signal and the response signal arrive at the third sniffer device to provide times of arrival via the third sniffer device, and estimating a location based on the times of arrival provided by the first sniffer device, the times of arrival provided by the second sniffer device, and the times of arrival provided by the third sniffer device.

[0134] In other features, the method further includes determining a first length of time for the first sniffer device to receive the response signal, determining a second length of time for the second sniffer device to receive the response signal, determining a third length of time for the third sniffer device to receive the response signal, and estimating the location based on the first length of time, the second length of time, and the third length of time.

[0135] In other features, the master device periodically transmits a challenge signal or other challenge signals to the slave devices and receives respective response signals from the slave devices; measures, at a first sniffer device, when the challenge signal and the response signal arrive at the first sniffer device to provide corresponding times of arrival; updates at least one of a distance or a location based on the times of arrival associated with the challenge signal and the response signal; and prevents at least one of access to or operational control of the vehicle based on the updated distance or the updated location.

[0136] In another feature, a system for accessing or providing operational control of a vehicle is provided. The system includes a first network device and a control module. The first network device includes a first antenna module, a transmitter, and a receiver. The first antenna module includes antennas having different polarization axes. The transmitter is configured to transmit a series of tones from the vehicle to a second network device via the first antenna module and vary the frequency of the tones during transmission of the series of tones. At any one time, at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device. The receiver is configured to receive the series of tones from the second network device. The control module is configured to (i) determine a phase difference of the series of tones relative to a frequency difference of the series of tones, (ii) determine a distance between the first network device and the second network device based on the phase difference and the frequency difference, and (iii) prevent at least one of access to or operational control of the vehicle based on the distance.

[0137] In other features, the control module is configured to, for each of the tones, vary a corresponding frequency during transmission of that tone, generate a curve for each tone relating a change in phase of each of the tones to the change in frequency, determine a slope of the curve, and determine distance based on the slope of the curve.

[0138] In other features, the control module randomizes the channels selected for transmission of the sequence of tones.

[0139] In other features, the control module randomizes a direction in which the tones are transmitted between the first network device and the second network device. The tones include one or more tones in the sequence of tones.

[0140] In other features, the control module is configured to transmit and receive a series of tones via the transmitter and receiver and determine distance based on a phase difference and a corresponding frequency difference of the series of tones.

[0141] In other features, the system further includes a second network device. The first network device includes a first tone exchange responder and a first tone exchange initiator. The first tone exchange initiator includes a transmitter. The first tone exchange responder includes a receiver. The second network device includes a second tone exchange responder and a second tone exchange initiator. The second tone exchange responder responds to the series of tones by sending the series of tones or a second series of tones back to the first tone exchange initiator. The second tone exchange initiator sends a third series of tones to the first tone exchange responder.

[0142] In other features, the control module is configured to determine the distance based on at least one of (i) a difference in phase of the second series of tones relative to a difference in frequency of the second series of tones, or (ii) a difference in phase of the third series of tones relative to a difference in frequency of the third series of tones.

[0143] In other features, the first network device is implemented in a vehicle and the second network device is a portable access device.

[0144] In other features, the first network device simultaneously transmits two symbols on two different frequencies to the second network device, each of the two symbols being 1 μs or less in duration to prevent a successful attack.

[0145] In other features, clock timing of the first network device and the second network device are synchronized. The first network device transmits a first symbol to the second network device at a first frequency. The second network device transmits a second symbol to the first network device simultaneously with the first network device's transmission of the first symbol to the second network device. To prevent a successful attack, the first symbol and the second symbol each have a duration of 1 μs or less.

[0146] In another feature, a method for providing access to or operational control of a vehicle is provided, the method including transmitting a series of tones from a first network device to a second network device via a transmitter and a first antenna module and varying a frequency of the tones during transmission of the series of tones, the first antenna module including an antenna, wherein at least one of the antennas of the first antenna module is not cross-polarized with an antenna of the second network device at any one time, receiving the series of tones from the second network device at a receiver in the vehicle, determining a phase difference of the series of tones relative to a frequency difference of the series of tones, determining a distance between the first network device and the second network device based on the phase difference and the frequency difference, and preventing at least one of access to or operational control of the vehicle based on the distance.

[0147] In other features, the method further includes, for each of the tones, varying a corresponding frequency during transmission of that tone, generating a curve for each of the tones relating a change in phase of each of the tones to a change in frequency, determining a slope of the curve, and determining a distance based on the slope of the curve.

[0148] In other features, the method further includes randomizing channels selected for transmission of the sequence of tones.

[0149] In other features, the method further includes randomizing a direction in which the tones are transmitted between the first network device and the second network device. The tones include one or more tones in the series of tones.

[0150] In other features, the method further includes transmitting and receiving the series of tones via the transmitter and the receiver, and determining the distance based on a phase difference and a corresponding frequency difference of the series of tones.

[0151] In other features, the method further includes responding to the series of tones via a second tone exchange responder of the second network device by sending the series of tones or a second series of tones back to the first tone exchange initiator of the first network device, the first tone exchange initiator including a transmitter, and transmitting a third series of tones via the second tone exchange initiator of the second network device to the first tone exchange responder of the first network device, the first tone exchange responder including a receiver.

[0152] In other features, the method further includes determining the distance based on at least one of (i) a difference in phase of the second series of tones relative to a difference in frequency of the second series of tones, or (ii) a difference in phase of the third series of tones relative to a difference in frequency of the third series of tones.

[0153] In other features, the first network device is implemented in a vehicle and the second network device is a portable access device.

[0154] In another feature, a system for accessing or providing operational control of a vehicle is provided. The system includes an initiator device and a sniffer device. The initiator device includes a first antenna module including a plurality of polarized antennas and a transmitter configured to transmit a first tone signal from the vehicle to a responder device via the first antenna module. The responder device is a portable access device and includes a first receiver configured to receive a second tone signal from the responder device in response to the first tone signal. The sniffer device includes a second antenna module including a plurality of polarized antennas and a second receiver configured to receive the first tone signal from the transmitter and the second tone signal from the responder device via the second antenna module. The sniffer device is configured to determine states of the first tone signal and the second tone signal, including their respective phase delays. The initiator device or the sniffer device is configured to (i) estimate at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the first tone signal and the second tone signal, each including a phase delay, and (ii) prevent at least one of access to the vehicle or operational control of the vehicle based on at least one of the estimated first distance or second distance.

[0155] In other features, the initiator device or the sniffer device is configured to estimate the first distance and the second distance and prevent at least one of access to the vehicle or operational control of the vehicle based on the first distance and the second distance.

[0156] In other features, the initiator device or the sniffer device is configured to detect a range extension type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle based on at least one of the first distance or the second distance. The second tone signal is relayed and modified by the attacking device from the responder device to the vehicle. The initiator device is configured to execute countermeasures in response to detecting the range extension type relay attack.

[0157] In other features, at any one time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with at least one of the plurality of polarized antennas of the second antenna module.

[0158] In other features, at any one time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

[0159] In other features, the initiator device or the sniffer device is configured to determine a first length of time for the first tone signal to travel from the initiator device to the responder device based on a state of the first tone signal when received at the responder device, determine a second length of time for the second tone signal to travel from the responder device to the sniffer device based on a state of the second tone signal when received at the sniffer device, and estimate a first distance and a second distance based on the first length of time and the second length of time.

[0160] In other features, the initiator device or the sniffer device is configured to generate a first representation of the first tone signal as received at the responder device in a natural logarithm format, generate a second representation of the first tone signal as received at the sniffer device in a natural logarithm format, generate a third representation of the second tone signal as received at the sniffer device in a natural logarithm format, and estimate the first distance and the second distance based on the first representation, the second representation, and the third representation.

[0161] In another aspect, a method for accessing or providing operational control of a vehicle is provided. The method includes transmitting a first tone signal from an initiator device of the vehicle to a responder device via a first antenna module, the first antenna module having multiple polarized antennas, the responder device being a portable access device, receiving at the initiator device a second tone signal from the responder device responsive to the first tone signal; receiving the first tone signal from the transmitter and the second tone signal from the responder device via a sniffer device, the second antenna module having multiple polarized antennas, determining at the sniffer device states of the first tone signal and the second tone signal, including respective phase delays; estimating at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the first tone signal and the second tone signal, including their respective phase delays; and preventing at least one of access to the vehicle or operational control of the vehicle based on at least one of the estimated first distance or second distance.

[0162] In other features, the method includes estimating a first distance and a second distance, and preventing at least one of access to the vehicle or operational control of the vehicle based on the first distance and the second distance.

[0163] In other features, the method further includes detecting a range extension type relay attack performed by the attacking device to gain at least one of access to or operational control of the vehicle based on at least one of the first distance or the second distance, the second tone signal being relayed from the responder device to the vehicle and modified by the attacking device, and executing countermeasures in response to detecting the range extension type relay attack.

[0164] In other features, at any one time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with the linearly polarized antenna or at least one of the plurality of polarized antennas.

[0165] In other features, at any one time, at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with an antenna of the responder device.

[0166] In other features, the method further includes determining a first length of time for the first tone signal to travel from the initiator device to the responder device based on a state of the first tone signal when received at the responder device, determining a second length of time for the second tone signal to travel from the responder device to the sniffer device based on a state of the second tone signal when received at the sniffer device, and estimating a first distance and a second distance based on the first length of time and the second length of time.

[0167] In another feature, a system for accessing or providing operational control of a vehicle is provided, the system including a first network device and a control module. The first network device includes a first antenna module and the control module. The first antenna module includes a plurality of polarized antennas and a transmitter configured to transmit an initiator packet from the vehicle to a second network device via the first antenna module, the initiator packet including a synchronization access word and a first continuous wave (CW) tone, one of the first network device and the second network device being implemented in the vehicle and the other of the first network device and the second network device being a portable access device, wherein at any one time at least one of the plurality of polarized antennas of the first antenna module is not cross-polarized with an antenna of the second network device; and a receiver configured to receive a response packet from the second network device, the response packet including the synchronization access word and the first CW tone. The control module is configured to (i) determine that a round-trip timing difference between the initiator packet and the response packet is greater than a predetermined threshold, (ii) detect a range extension type relay attack performed by the attacking device to gain at least one of access to or operational control of the vehicle based on the timing difference being greater than the predetermined threshold, and (iii) prevent at least one of access to or operational control of the vehicle in response to detecting the range extension type relay attack.

[0168] In other features, the control module is configured to determine a start time and an end time of the synchronization access word based on the initiator packet, and detect a timing difference based on the start time and the end time.

[0169] In other features, the control module is configured to determine, based on the initiator packet, a start time and an end time of a synchronization access word for the first CW tone of the response packet; determine whether the start time and end time of the synchronization access word of the response packet match the determined start time and end time; and detect a timing difference if the start time and end time of the synchronization access word of the response packet do not match the determined start time and end time.

[0170] In other features, the control module is configured to determine a first length of the synchronization access word of the initiator packet, compare the first length to a second length of the synchronization access word of the response packet, and detect a range extension type relay attack if a difference between the first length and the second length is greater than a predetermined amount.

[0171] In other features, the control module is configured to determine a first length of the first CW tone of the initiator packet, compare the first length to a second length of the first CW tone of the response packet, and detect a range extension type relay attack if a difference between the first length and the second length is greater than a predetermined amount.

[0172] In other features, the first CW tone of the initiator packet is at the end of the initiator packet and the first CW tone of the response packet is at the beginning of the response packet.

[0173] In other features, the initiator packet includes a second CW tone, and the response packet includes the second CW tone.

[0174] In other features, the first CW tone of the initiator packet is at the beginning of the initiator packet, the second CW tone of the initiator packet is at the end of the initiator packet, the first CW tone of the response packet is at the beginning of the response packet, and the second CW tone of the response packet is at the end of the response packet.

[0175] In another feature, the initiator packet and the response packet have the same format.

[0176] In other features, the response packet indicates an amount of phase difference between the second CW tone of the initiator packet and the first CW tone of the response packet, the first CW tone of the response packet being in phase with a phase-locked loop of the responder.

[0177] In other features, the control module is configured to determine a phase difference between a first CW tone of the response packet and a second CW tone of the initiator packet. The second CW tone of the initiator packet is in a phase relationship with the initiator's phase-locked loop. The first device and the second device are configured to determine a phase difference for a second frequency and a phase difference for a third frequency. The control module is configured to determine a distance between the devices based on (i) the phase difference between the first CW tone and the second CW tone, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency.

[0178] In other features, the control module is configured to compare the frequency, power level, bits, and amplitude of a portion of the received signal that includes the response packet with the frequency, power level, bits, and amplitude of a portion of the transmitted signal that includes the initiator packet, and determine, based on the resulting differences, whether a range extension type relay attack is being performed.

[0179] In another feature, a method for accessing or providing operational control of a vehicle is provided, the method comprising transmitting an initiator packet from the vehicle to a second network device via a first antenna module of a first network device, the first antenna module including multiple polarized antennas, the initiator packet including a synchronization access word and a first continuous wave (CW) tone, one of the first network device and the second network device being implemented within the vehicle, and the other of the first network device and the second network device being a portable access device, and at any one time at least one of the multiple polarized antennas of the first antenna module being cross-polarized with an antenna of the second network device. receiving a response packet from the second network device, the response packet including a synchronization access word and a first CW tone, determining that a timing difference between the initiator packet and the response packet is greater than a predetermined threshold; detecting a range extension type relay attack performed by the attacking device to gain at least one of access to or operational control of the vehicle based on the timing difference being greater than the predetermined threshold; and preventing at least one of access to or operational control of the vehicle in response to detecting the range extension type relay attack.

[0180] In other features, the method further includes determining a start time and an end time of the synchronization access word based on the initiator packet, and detecting a timing difference based on the start time and the end time.

[0181] In other features, the method further includes determining, based on the initiator packet, a start time and an end time of a synchronization access word for the first CW tone of the response packet; determining whether the start time and end time of the synchronization access word of the response packet match the determined start time and end time; and detecting a timing difference if the start time and end time of the synchronization access word of the response packet do not match the determined start time and end time.

[0182] In other features, the first CW tone of the initiator packet is at the end of the initiator packet and the first CW tone of the response packet is at the beginning of the response packet.

[0183] In other features, the initiator packet includes a second CW tone. The response packet includes a second CW tone. The first CW tone of the initiator packet is at the beginning of the initiator packet. The second CW tone of the initiator packet is at the end of the initiator packet. The first CW tone of the response packet is at the beginning of the response packet. The second CW tone of the response packet is at the end of the response packet.

[0184] In other features, the method further includes determining a round trip time of the initiator packet based on the amount of phase delay, wherein the response packet indicates an amount of phase delay between the first CW tone of the initiator packet and the first CW tone of the response packet.

[0185] In another feature, a system for detecting a range extension type relay attack is provided. The system includes a transmitter, a receiver, and a control module. The transmitter is configured to transmit a radio frequency signal from one of the vehicle and the portable access device to another of the vehicle and the portable access device. The receiver is configured to receive a response signal from the one of the vehicle and the portable access device in response to the radio frequency signal. The control module converts the response signal into an in-phase signal and a quadrature-phase signal, and detects a range extension type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle based on the radio frequency signal, the in-phase signal, and the quadrature-phase signal, where the control module is configured to detect at least one of (i) the radio frequency signal being relayed from the vehicle to the portable access device via the attacking device, or (ii) the response signal being relayed from the portable access device to the vehicle via the attacking device, and to perform countermeasures in response to detecting the range extension type relay attack.

[0186] In other features, the system further includes an antenna module implemented in one of the vehicle and the portable access device in which the transmitter and receiver are implemented, the antenna module including a multi-polarized antenna, and at any one time, at least one of the multi-polarized antennas of the antenna module is not cross-polarized with an antenna of another one of the vehicle and the portable access device.

[0187] In other features, the control module is implemented in a vehicle.In other features, the control module is implemented in a portable access device.

[0188] In other features, the control module is configured to determine a phase difference based on the in-phase signal and the quadrature-phase signal, measure a round-trip time of the radio frequency signal based on the phase difference, and detect a range extension type relay attack based on the round-trip time.

[0189] In other features, the control module is configured to sample the in-phase and quadrature signals and determine the received bits based on the in-phase and quadrature signals.

[0190] In other features, the control module is configured to upsample received bits based on the in-phase signal and the quadrature-phase signal, upsample another signal, cross-correlate a result of upsampling the received bits based on the in-phase signal and the quadrature-phase signal with a result of upsampling the other signal, and determine a phase based on a result of the cross-correlation.

[0191] In other features, the other signal includes a reference bit pattern. The control module is configured to determine a sign of the differentiated arctangent signal and generate the reference bit pattern based on the sign. In other features, the other signal includes the radio frequency signal after being filtered through a Gaussian low pass filter.

[0192] In another feature, a method for detecting a range extension type relay attack is provided, the method including: transmitting a radio frequency signal from one of a vehicle and a portable access device to another of the vehicle and the portable access device via a transmitter; receiving a response signal from the one of the vehicle and the portable access device responsive to the radio frequency signal via a receiver; converting the response signal into an in-phase signal and a quadrature-phase signal via a control module; detecting, via the control module, a range extension type relay attack performed by an attacking device to gain at least one of access to or operational control of the vehicle based on the radio frequency signal, the in-phase signal, and the quadrature-phase signal, where the range extension type relay attack is at least one of (i) the radio frequency signal is relayed from the vehicle to the portable access device via the attacking device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attacking device; and performing countermeasures in response to detecting the range extension type relay attack.

[0193] In other features, an antenna module is implemented in one of the vehicle and the portable access device in which the transmitter and receiver are implemented, the antenna module including a multi-polarized antenna, and at any one time at least one of the multi-polarized antennas of the antenna module is not cross-polarized with another antenna of the vehicle and the portable access device.

[0194] In other features, the control module is implemented in a vehicle.In other features, the control module is implemented in a portable access device.

[0195] In other features, the method further includes determining a phase difference based on the in-phase signal and the quadrature-phase signal, measuring a round-trip time of the radio frequency signal based on the phase difference, and detecting a range extension type relay attack based on the round-trip time.

[0196] In other features, the method further includes sampling the in-phase signal and the quadrature signal, and determining the received bits based on the in-phase signal and the quadrature signal.

[0197] In other features, the method further includes upsampling the received bits based on the in-phase signal and the quadrature-phase signal, cross-correlating a result of upsampling the received bits with a result of upsampling another signal, and determining a phase based on a result of the cross-correlation. In other features, the other signal includes a reference bit pattern. In other features, the other signal includes a radio frequency signal after being filtered through a Gaussian low pass filter.

[0198] Further areas of applicability of the present disclosure will become apparent from the detailed description, claims, and drawings. The detailed description and specific examples are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure. [Brief explanation of the drawings]

[0199] The present disclosure will become more fully understood from the detailed description and the accompanying drawings, wherein: [Figure 1] FIG. 1 is a side view of an object showing an RF primary high power signal traveling along a bounce path due to cross polarization of an RF antenna. [Figure 2] FIG. 2 is a functional block diagram of an example vehicle access system including an access module, an RF antenna, and a portable access device, according to one embodiment of the present disclosure. [Figure 3] FIG. 3 is a functional block diagram of an example vehicle including the access module of FIG. 2 in accordance with one embodiment of the present disclosure. [Figure 4] FIG. 3 is a functional block diagram of an example of the access module of FIG. 2, in accordance with one embodiment of the present disclosure. [Figure 5] FIG. 2 is a functional block diagram of an example of a vehicle RF antenna module, in accordance with one embodiment of the present disclosure. [Figure 6] FIG. 2 is a functional block diagram of an example of a portable network device, according to one embodiment of the present disclosure. [Figure 7] 1 is an example of a polarization axis diagram illustrating an exemplary arrangement of polarization diversity, according to one embodiment of the present disclosure. [Figure 8] 1 is an example of a polarization axis diagram illustrating another exemplary polarization diversity arrangement, according to an embodiment of the present disclosure. [Figure 9] 1 is an exemplary electric field diagram and polar plot showing the field pattern and nulls of a linear antenna; [Figure 10] FIG. 2 is an exemplary voltage versus electric field diagram for a linearly polarized antenna. [Figure 11A] 1 is a top perspective view of an example of at least a portion of a multi-axially polarized RF antenna assembly including a linearly polarized antenna and a circularly polarized antenna, according to one embodiment of the present disclosure. [Figure 11B] FIG. 11B is a bottom perspective view of at least a portion of the multi-axially polarized RF antenna assembly of FIG. 11A. [Figure 12] 11A-B are exemplary polar plots of radiated power associated with the linearly polarized antenna of FIGS. [Figure 13] 11A-B are exemplary polar plots of radiated power associated with the circularly polarized antenna of FIGS. [Figure 14] FIG. 2 is a functional block diagram of an example of an RF circuit and a portion of a portable access device, according to one embodiment of the present disclosure. [Figure 15] FIG. 1 is a block diagram of an example of a portion of a key fob having two linearly polarized slot antennas, metal trim, and a spare key, according to one embodiment of the present disclosure. [Figure 16] FIG. 16 is a block diagram of an example portion of the key fob of FIG. 15 having an x-axis linearly polarized slot antenna and a y-axis linearly polarized slot antenna, without metal trim and without a spare key. [Figure 17] 17 is an exemplary polar plot of radiated power associated with an x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 16. [Figure 18] 17 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 16. [Figure 19] 17 is an example of a return loss versus frequency plot for the linearly polarized slot antenna of FIG. 16. [Figure 20] FIG. 16 is a block diagram of an example portion of the key fob of FIG. 15 including a spare key and without metal trim. [Figure 21] 21 is an exemplary polar plot of radiated power associated with an x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 20. [Figure 22] 21 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 20. [Figure 23] 21 is an example of a return loss versus frequency plot for the linearly polarized slot antenna of FIG. 20. [Figure 24] FIG. 16 is a block diagram of an example portion of the key fob of FIG. 15 with a portion of metal trim and a spare key. [Figure 25] 25 is an exemplary polar plot of radiated power associated with an x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 24. [Figure 26]25 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 24. [Figure 27] 25 is an example of a return loss versus frequency plot for the linearly polarized slot antenna of FIG. 24. [Figure 28] 16 is an exemplary polar plot of radiated power associated with an x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 15; [Figure 29] 16 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 15; [Figure 30] 16 is an example of a return loss versus frequency plot for the linearly polarized slot antenna of FIG. 15. [Figure 31] FIG. 1 is a block diagram of an example portion of a key fob having a closed linearly polarized slot antenna, an open linearly polarized slot antenna, metal trim, and a spare key, according to one embodiment of the present disclosure. [Figure 32] 32 is an exemplary polar plot of radiated power associated with an x-axis linearly polarized slot antenna of a portion of the key fob of FIG. 31. [Figure 33] 32 is an exemplary polar plot of radiated power associated with a y-axis linearly polarized slot antenna of a portion of the key fob of FIG. 31. [Figure 34] 32 is an example of a return loss versus frequency plot for the linearly polarized slot antenna of FIG. 31. [Figure 35] 1 illustrates a method for determining which antenna combination to use for exchanging packets between RF antenna modules of a vehicle and a portable access device for round trip time-of-flight measurements, according to one embodiment of the present disclosure. [Figure 36] 10 illustrates another method for determining which antenna combination to use for exchanging packets between the vehicle and the RF antenna module of the portable access device for round trip time-of-flight measurements, according to one embodiment of the present disclosure. [Figure 37] FIG. 1 is a time-of-flight measurement diagram. [Figure 38]FIG. 1 is a functional block diagram of an exemplary BLE radio with a superheterodyne receiver and transmitter, in accordance with one embodiment of the present disclosure. [Figure 39] 1 is an exemplary GFSK parameter definition plot. [Figure 40] FIG. 1 is a functional block diagram of a system for transmitting BLE packets. [Figure 41] 1 illustrates exemplary preambles and access addresses for different types of BLE packets. [Figure 42] 1 is an example plot of a BLE packet signal showing corresponding bits. [Figure 43] 10 is another example plot of another BLE packet signal showing the corresponding bits. [Figure 44] 45 is an overlap plot of the BLE packet signals of FIG. 44, where one of the BLE packet signals is shifted relative to another one of the BLE packet signals. [Figure 45] 1 illustrates an exemplary method for detecting a range extension type relay attack, according to one embodiment of the present disclosure. [Figure 46] FIG. 2 is a functional block diagram of an example vehicle and portable access device including a round trip time initiator and a round trip time responder, respectively, in accordance with one embodiment of the present disclosure. [Figure 47] FIG. 47 is a functional block diagram of the vehicle and portable access device of FIG. 46, illustrating radio frequency signal transmission via corresponding antennas. [Figure 48] FIG. 47 is a functional block diagram of the vehicle and portable access device of FIG. 46 under attack by a range extension type relay attack device. [Figure 49] FIG. 2 is a functional block diagram of two exemplary BLE radios, according to one embodiment of the disclosure. [Figure 50] FIG. 1 is a functional block diagram of an exemplary position and distance determination system including a round trip time sniffer, in accordance with one embodiment of the present disclosure. [Figure 51]FIG. 1 is a functional block diagram of an exemplary position and distance determination system including multiple round trip time sniffers, in accordance with one embodiment of the present disclosure. [Figure 52] FIG. 2 is a functional block diagram of an example network device configured to perform tone exchange for distance determination and attack detection, according to one embodiment of the present disclosure. [Figure 53] FIG. 1 is a functional block diagram of an exemplary location determination system including a tone-switched sniffer, according to one embodiment of the present disclosure. [Figure 54] 1 illustrates a method for determining the distance between an initiator and a responder, and between a responder and a sniffer, according to one embodiment of the present disclosure. [Figure 55] FIG. 1 is a functional block diagram of an exemplary passive tone switching and differential phase detection system, in accordance with one embodiment of the present disclosure. [Figure 56] FIG. 1 is a functional block diagram of an example of an active tone switching and phase difference detection system, in accordance with one embodiment of the present disclosure. [Figure 57] 1 is a diagram of an exemplary initiator and responder packet used for RSSI and time-of-flight measurements, the packet including a continuous wave (CW) tone and a preamble, according to one embodiment of the present disclosure. [Figure 58] 1 is a diagram of an exemplary initiator and responder packet used for RSSI and time-of-flight measurements, the packet including a CW tone and no preamble, according to one embodiment of the present disclosure. [Figure 59] 1 is a diagram of exemplary initiator and responder packets used for RSSI and time-of-flight measurements, the packets having the same format, including multiple CW tones, and no preamble, according to one embodiment of the present disclosure. [Figure 60] 10A-10C illustrate exemplary initiator and response packets having the same format according to another embodiment of the present disclosure. [Figure 61] FIG. 2 is a functional block diagram of an antenna routing system for network devices having respective antenna modules according to another embodiment of the present disclosure. [Figure 62] 39 is an exemplary radio model corresponding to the structure, functionality, and operation of the BLE radio of FIG. [Figure 63] 10 illustrates a method for exchanging packets between RF antenna modules of a BLE radio to detect range extension type relay attacks according to another embodiment of the present disclosure. [Figure 64A] 63 is an exemplary plot of the signals from the sampling module, the Gaussian LPF, and the integrator of the model of FIG. 62. [Figure 64B] 63 is an exemplary plot of a signal from the resampling module of the model of FIG. 62. [Figure 64C] 63 is an exemplary plot of a signal from the arctangent module of the model of FIG. 62. [Figure 64D] 63 is an exemplary plot of the signal from the differentiator superimposed on the signal from the Gaussian LPF of the model of FIG. 62. [Figure 65] 10A-10C show diagrams illustrating different pairs of antenna shaft assemblies, each including two linearly polarized antennas, according to another embodiment of the present disclosure. [Figure 66] FIG. 10 illustrates a perspective view of a pair of antenna shaft assemblies having the same number of antennas, one disposed within the metal can and the other external to the metal can, according to another embodiment of the present disclosure. [Figure 67] 10A-10C show perspective views of another pair of antenna shaft assemblies having different numbers of antennas, one disposed within the metal can and the other external to the metal can, according to another embodiment of the present disclosure. [Figure 68] FIG. 1 illustrates distance bounds while performing high-speed bit swapping, where the prober sequence can be cryptographically secure and known independently of the verifier sequence. [Figure 69] FIG. 10 illustrates preventing response bits from being sent too early while performing a fast bit exchange, where the prober sequence is cryptographically secure and may depend on the verifier sequence. [Figure 70] FIG. 1 is a side view of multiple antennas showing angles of arrival. [Figure 71] 1 illustrates an AOA method including the use of the MUSIC algorithm according to the present disclosure. [Figure 72] 1 is an example of a covariance plot according to the present disclosure. [Figure 73] 10 is an example plot of eigenvectors and array manifold response according to the present disclosure. [Figure 74] 10 is another example plot of eigenvectors and array manifold response according to the present disclosure. [Figure 75] 1 is an example of a MUSIC power spectrum plot according to the present disclosure. [Figure 76] FIG. 1 is a functional block diagram of an antenna selection system according to the present disclosure. [Figure 77] 1 illustrates an exemplary reconstruction method according to the present disclosure. [Figure 78A] FIG. 1 is a top view of a vehicle showing an example arrangement of sensors according to the present disclosure. [Figure 78B] FIG. 78B is a side view of the vehicle of FIG. 78A. [Figure 78C] 78B is a rear view of the vehicle of FIG. 78A showing the bounce reflections and corresponding paths of the transmitted signal detected by a sensor according to the present disclosure. [Figure 79A] FIG. 1 is a top view of a vehicle showing another example of a sensor arrangement according to the present disclosure. [Figure 79B] FIG. 79B is a side view of the vehicle of FIG. 79A. [Figure 79C] 79B is a rear view of the vehicle of FIG. 79A showing bounce reflections and corresponding paths of transmitted signals detected by a sensor according to the present disclosure. In the drawings, reference numbers may be reused to identify similar and / or identical elements. DETAILED DESCRIPTION OF THE INVENTION

[0200] RF devices can measure distance by exchanging unmodulated carrier tones. For example, in U.S. Patent No. 8,644,768, which is incorporated herein by reference, a system and method for distance measurement between two nodes of a wireless network using unmodulated carrier tone exchange is provided.

[0201] RF devices can measure or bound distance by timing the round-trip of rapid exchanges of cryptographically secure messages. For example, "Distance-Bounding Protocols (Extended abstract)" by Brans and Chaum, Workshop on Theory and Applications of Cryptography for the Advancement of Cryptography (EUROCRYPT '93), incorporated herein by reference, uses a sequence of rapid bit exchanges between a verifier and a prober. The prober sequence can be cryptographically secure and known independently of the verifier sequence, as shown in Figure 68. The prober sequence can be cryptographically secure and dependent on the verifier sequence, as shown in Figure 69.

[0202] RF devices that measure distance by round-trip timing are subject to early detection and late commit attacks, as described in "Attacks on Time-of-Flight Distance Bounding Channels" by Hancke and Kuhn, in Proceedings of the 1st ACM Conference on Wireless Network Security (WiSec'08), which is incorporated herein by reference. RF devices that measure distance by unmodulated carrier tone exchange are subject to signal delay rollover attacks, as described in "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan, and Capkun, in the IACR Cryptology ePrint Archive 2016, which is incorporated herein by reference.

[0203] Conventional PEPS systems enable keyless entry and vehicle starting, but they can be susceptible to range extender-type relay attacks. A range extender-type relay attack refers to an attacker using a relay device to detect, amplify, and relay signals between a key fob (or other smart portable network device) and a vehicle, causing the vehicle's access module to act as if the key fob is approaching and in the vehicle's vicinity. For example, when an attacker touches the vehicle's door handle with their hand and / or the relay device, the access module may generate and transmit an LF wake-up signal. As a result, the relay device is actually detected, and the access module transmits an LF wake-up signal to the key fob, which is received by the relay device. The relay device receives, amplifies, and forwards (or rebroadcasts) the LF wake-up signal to the actual key fob. The key fob may be located inside a residence, for example, while the vehicle is parked outside or in front of the residence. The key fob may receive the amplified wake-up signal and generate a response signal and / or initiate communication over the RF link. The response signal and / or RF communication signal is amplified and relayed between the vehicle's antenna and one or more antennas on the key fob. This may be done through a relay device. As a result, the relay device is identified by the access module as the key fob and "trick" the access module into operating as if the key fob were located at the relay device, which provides the access module with unauthorized access to the interior of the vehicle.

[0204] Additionally, the antenna systems of current PEPS systems can prevent the PEPS system from accurately estimating the distance between the key fob and the vehicle and the position of the key fob relative to the vehicle, as described further below. Distance and position can be determined based on time-of-flight measurements. The time-of-flight and corresponding received signal strength are measured. The received signal strength indicator (RSSI) with the largest magnitude typically corresponds to the direct, or shortest, distance between the key fob and the vehicle. The time-of-flight measurement associated with the largest RSSI is used to calculate the distance between the key fob and the vehicle.

[0205] Examples described herein include a combined LF and RF PEPS key fob that uses RF round-trip timing (RTT) measurements to prevent range extender-type relay attacks. Other examples include RTT measurements, carrier phase-based ranging, and a combination of RTT measurements and carrier phase-based ranging in a PEPS system. These examples also demonstrate many other features, which are described further below.

[0206] Figure 1 shows an example of when antenna cross-polarization can cause inaccurate distance determination between a first RF antenna on a key fob and a second RF antenna on a vehicle. If the first RF antenna on a key fob is positioned relative to the second RF antenna on a vehicle so that the first RF antenna is cross-polarized with the second RF antenna, the determined distance will correspond to a bounce path rather than a direct path. Antennas are cross-polarized, for example, when the antenna polarizations are perpendicular to each other. An example of this is shown in Figure 1.

[0207] FIG. 1 illustrates an object 10 and the polarization axes 12, 14 of its respective RF antennas. The antennas are linearly polarized. A first RF antenna has a first polarization axis 12 and is located in a vehicle. A second RF antenna has a second polarization axis 14 and is located in a key fob. Depending on the relative positions of the first RF antenna, the second RF antenna, and the object 10, an RF signal 16 transmitted from the antennas may bounce off the object 10. The signal energy (or voltage) corresponding to the bounce path is greater than the signal energy (or voltage) corresponding to the direct path 18 between the antennas. This is due to cross-polarization of the RF antennas. An access module that determines the distance between the antennas based on the signal path with the greatest signal energy or voltage may erroneously determine the distance between the antennas to be the length of the bounce path 16 rather than the length of the direct path 18.

[0208] Co-polarized antenna placement can also result in the use of bounce paths when nulls align. This occurs when the first and second RF antennas are pointing in the same direction. Antennas can be positioned so that a line runs longitudinally through the antenna. This is further explained in Figures 9-10.

[0209] Examples described herein include polarization diversity for RF signal transmission between a vehicle's RF antenna and a portable access device's (e.g., key fob, cell phone, wearable device, etc.) RF antenna. Additionally, these examples include pseudo-random two-way data exchange. Polarization diversity is provided to ensure that, at any given time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized with, but somewhat co-polarized with, the polarization axis of at least one receiving antenna, and that is co-polarized and free of collinear nulls. As used herein, the phrase "at any given time" means at all times while corresponding devices are communicating with each other and / or while one or more signals are being transmitted between the devices and received by one or more devices. In addition to enabling accurate distance determination, this also helps prevent range extender-type relay attacks. The pseudo-random two-way data exchange described below also helps prevent range extender-type relay attacks.

[0210] Exemplary embodiments will now be described in more detail with reference to the accompanying drawings.

[0211] 2 illustrates a vehicle access system 28 that functions as a PEPS system and a PAK system. The vehicle access system 28 includes a vehicle 30 and may include a key fob 32, a mobile phone 34, and / or other portable access devices, such as a wearable device, a laptop computer, or other portable network device. The portable access device may be, for example, a Bluetooth-enabled communication device, such as a smartphone, a smart watch, a wearable electronic device, a key fob, a tablet device, or other device associated with a user of the vehicle 30. The user may be the owner, driver, or passenger of the vehicle 30, and / or a mechanic for the vehicle 30.

[0212] Vehicle 30 includes an access module 36, an LF antenna module 38, and an RF antenna module 40. Access module 36 can wirelessly transmit LF signals to portable network devices via LF antenna module 38 and can wirelessly communicate with portable access devices via RF antenna module 40. RF antenna module 40 provides polarization diversity between the antennas of the portable network device and each of the antennas of RF antenna module 40. Polarization diversity, as described further below, provides a minimum number, combination, and arrangement of polarization axes on the portable network device and vehicle 30 to ensure that, at any given time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized with the polarization axis of at least one receiving antenna. In other words, at any given time, at least one RF antenna on the vehicle has at least one polarization axis that is not cross-polarized with the polarization axis of at least one RF antenna on each portable access device. Although a specific number of LF and RF antenna modules are shown, any number of each may be utilized.

[0213] The access module 36 may communicate with the LF antenna module 38 and the RF antenna module 40 wirelessly and / or via a vehicle interface 45. By way of example, the vehicle interface 45 may include a Controller Area Network (CAN) bus, a Local Interconnect Network (LIN) for lower data rate communication, a Clock Enhanced Peripheral Interface (CXPI) bus, and / or one or more other vehicle interfaces.

[0214] LF antenna modules 38 are located at various locations in the vehicle and can transmit low-frequency signals (e.g., 125 kHz signals). Each of the LF antenna modules includes an LF antenna and can include a control module and / or other circuitry for LF signal transmission. RF antenna modules 40 are also located at various locations in the vehicle and can transmit RF signals, such as Bluetooth Low Energy (BLE) signals that comply with the BLE communication protocol. Alternatively, the RF antenna modules 40 may communicate according to other wireless communication protocols, such as Wi-Fi. Example antennas are shown in FIG. 11 (which collectively refers to FIGS. 11A and 11B).

[0215] In one embodiment, RF antenna modules 40 are positioned on the roof 46 of the vehicle 30 to increase signal coverage for the vehicle and improve transmission and reception characteristics. By way of example, each RF antenna module 40 may include a pair of RF antennas, one linearly polarized antenna, and one circularly polarized antenna. The number and location of the RF antenna modules may be preselected based on the size and shape of the vehicle 30. In one embodiment, two RF antenna modules are included and spaced apart from one another as shown in FIG. 2 so that their corresponding electric fields overlap each other and extend beyond the vehicle's perimeter in a 360° pattern around the vehicle. The electric fields provide a resulting field as shown in FIG. 1, represented by dashed circle 48. The dashed circle provides an overall "rectangle-like" shape. In larger vehicles, more antenna modules 40 may be added to make the shape more "rectangle-like." In smaller vehicles, only one RF antenna module 40 may be included.

[0216] Different numbers of antennas with different numbers of antenna polarizations may be used. Figures 65-67 show some other exemplary antenna embodiments. Figures 65-67 include fewer antennas and antenna polarizations that are used to measure or limit distance when a diverse set of frequencies and / or RF channels is used to measure or limit distance and / or reflections from vehicle metal. This is done to create virtual polarization diversity. The antenna system can tolerate some erroneous measurements due to cross-polarization and / or null alignment. In Figures 65-67, 7100A-J refer to antenna shaft assemblies, 7100A-7100I refer to antenna shaft assemblies with two polarization axes, and 7100J refers to an antenna shaft assembly with one polarization axis. Numerical designators 7101A-7101I and 7102A-7102I refer to the polarized antenna axes of a dual-polarized antenna shaft assembly. Numerical designator 7101J refers to a single polarization axis of 7100J. Numerical designators 7103AB, 7103CD, 7103EF, 7103GH, and 7103JI refer to RF paths between pairs of antenna assemblies. Many RF paths exist between antenna axes, some with large link margins and some with small link margins and some with large and small phase rotation time delays. The various round-trip timing and unmodulated carrier tone exchange ranging algorithms disclosed, described, and / or referenced herein have the ability to find or measure shorter paths that may not be the shortest, but that may have a link margin that is several decibels (dB) higher or lower than the path with the highest link margin. The more frequencies (or channels) and round-trip timing or tone exchange measurements are made, and the more mathematically complex and time-consuming the algorithm, the smaller the link margin of the shorter, indirect paths found may be.

[0217] The additional antenna shafts provide polarization diversity for the RF paths between the antenna shaft assemblies, which provides path diversity. Numerical designator 7200 refers to a simplified representation of an open, three-sided metal box and / or vehicle body for RF radio waves in the gigahertz or multi-gigahertz range. Numerical designator 7201 refers to a simplified representation of a metal sheet and / or lid to the box and / or vehicle roof for RF radio waves in the gigahertz or multi-gigahertz range. Figures 66 and 67 can also be viewed upside down, where 7200 is a simplified representation of the open, concave shape of the vehicle roof and 7201 is a simplified representation of the vehicle floor.

[0218] The RF connection between 7100A and 7100B along RF path 7101AB is strong because both pairs of antenna axes between the antenna axis assemblies are co-polarized. Even though the co-polarization zone is wide, and a rotation of approximately 5° from 90° increases the link margin by approximately 6 dB from the median link margin, this condition is rare for any given pair of dual-axis antennas. This is because a rotation of three degrees is required to manipulate any given pair of antenna axis assemblies into this configuration, and the antenna axes are symmetrical at every 90°, so the configuration occurs arbitrarily in approximately (5 / 90)*(5 / 90)*(5 / 90), or 1.71E-4, time fractions. The RF connection between 7100C and 7100D along RF path 7101CD is not as strong as 7101AB, but is still good because there are no co-polarized or cross-polarized antenna paths and the nulls are not aligned. The RF connection between 7100E and 7100F along RF path 7101EF is weak because each antenna path between the individual antenna axes is cross-polarized or contains at least one antenna null. Again, this condition is rare because three degrees of rotation is required to operate any pair of antenna axes in this configuration. Furthermore, for example, for any orientation of a dual-axis antenna pair with a 5° cross-polarization and null-aligned zone where the link margin drops by 20 dB or pow2db (sin(pi*5 / 180)∧2), three degrees of rotation is required to operate any pair of antenna axes in this configuration, and because the antenna axes are symmetrical every 90 degrees, this configuration occurs arbitrarily in approximately (5 / 90)*(5 / 90)*(5 / 90), or 1.71E-4 time segments.

[0219] Looking at Figures 7-8, it is clear that with three nearly orthogonal polarization axes on one side and two nearly orthogonal polarization axes on the other side, the nulls cannot be aligned while being cross-polarized. With three nearly orthogonal polarization axes on one side and one polarization axis on the other side, the nulls can be aligned via two rotations and generated arbitrarily.

[0220] Generally, the more antenna axes there are on each side of a connection, the less likely a direct path with a low link margin will occur. Preventing or reducing the likelihood of a direct path with a low link margin is beneficial because round-trip timing ranging and unmodulated carrier tone exchange ranging tend to measure the direct path with a larger link margin than the reflected path. Conversely, the lower the link margin of the direct path compared to the reflected path, the more likely the ranging technique will measure the distance along the reflected path.

[0221] In Figure 66, if the size of the metal box is adequate for the distance determination range, distance variations are measured based on various reflection paths within the metal box, and one side of the ranging connection is placed inside the metal box, planning a small number of direct paths can reduce the number of polarization axes required to obtain reasonable measurements. If one of the antenna axes of the 7100G is oriented so that the null is directed along the strongest and / or shortest reflection path toward the 7100H, the other antenna axis of the 7100G will find a bounce path with a strong link margin to one of the antenna axes 7101H or 7102H. This is especially true when averaging across multiple channels, such as the 37 data channels in a BLE data link. Some of the channel and antenna axis path combinations may fade rapidly due to multipath, but not most. At any orientation of the antenna axis pair 7100G, the link margin at the antenna axis pair 7100H is approximately the same, and the distance measured along the reflected path of 7103IJ is approximately the same. How the reflected path 7103GH bounces off the roof 7201 or sidewalls of 7200 changes, but the overall path variation is limited by the size and location of the components of 7200 and 7201. This path variation limit changes when 7100G is elevated to a height where a direct path exists, which shortens the measured distance by removing reflections from path 7103GH. The range measured between 7100G and 7100H along the reflected path or the shorter direct path establishes a comparison boundary that indicates that 7100G, which may be part of a portable device, is within the distance threshold of 7100H. 7100H may be part of a PEPS module 211 or a PAKM module 212. These distance range measurements between a pair of 7100 modules may be taken and compared to be less than a boundary. The results of the measurements, distances, and / or comparisons may be used as part of an "if-then-else" comparison in a software decision tree to indicate that the portable access device 400 is within an approach zone, an unlock zone, and / or a vehicle mobilization zone.

[0222] Figure 67 is similar to Figure 66, except that antenna shaft assembly 7100J includes a single polarized antenna shaft 7101J. In one embodiment, antenna shaft assembly 7100J includes only a single polarized antenna shaft. 7101J can be oriented so that the null is directed along the strongest and / or shortest reflected path toward 7100H. In this case, round-trip timing and unmodulated carrier tone switching techniques tend to measure distance along the path (not shown) that bounces away from box 7200 and back toward the box. Two angle rotations are required to operate an arbitrary oriented antenna pair into this configuration, and because the antennas are symmetrical every 90 degrees, having a null-aligned zone that is, for example, 5° wide, where the link margin is down 20 dB or pow2db(sin(pi*5 / 180)∧2), for example, requires two rotations to orient an arbitrary oriented antenna shaft to this orientation. This orientation occurs arbitrarily at approximately (5 / 90)*(5 / 90), or 3E-3, portions of time. This configuration can be used to make distance range measurements between a pair of 7100 modules and compare the measurements to less than a boundary, except during the incremental portion of time when significantly different indirect paths are measured due to higher power paths reflected by distant objects. The results of the measurements, distances, and / or comparisons may be used as part of one or more "if-then-else" comparisons and software decision trees to indicate that the portable access device 400 is within an approach zone, unlock zone, and / or vehicle mobilization zone.

[0223] Different polarizations of the antennas can be used to create polarization diversity. Multiple polarized antennas (or antenna axes) create polarization diversity. Two linear axes, including a linear axis and another linear axis, a linear axis and a circularly polarized antenna, or three independent linear axes (linearly polarized antennas) are all possible, especially if there is metal nearby to create virtual polarization diversity.

[0224] The 7101H or 7101J antenna axis pair may be placed low on the metal box that is the body of the vehicle, or high on the metal box that is the roof of the vehicle to achieve these virtual antenna axis array effects.

[0225] FIG. 3 illustrates a vehicle 200, an example of the vehicle 108 of FIG. 1. The vehicle 200 includes a PAK system 202, which includes a vehicle control module 204, an infotainment module 206, and other control modules 208 (e.g., a body control module). The modules 204, 206, and 208 can communicate with each other via a controller area network (CAN) bus 209 and / or other vehicle interfaces (e.g., vehicle interface 45 of FIG. 2). The vehicle control module 204 can control the operation of vehicle systems. The vehicle control module 204 can include a PEPS module 211, a PAK module 212, and a parameter adjustment module 213, as well as other modules shown in FIG. 4. The vehicle control module 204 can also include one or more processors configured to execute instructions stored on a non-transitory computer-readable medium, such as memory 218, which can include read-only memory (ROM) and / or random access memory (RAM).

[0226] PEPS module 211 can perform PEPS operations to provide access to the interior of the vehicle and to allow starting and / or operation of the vehicle. PAK module 212 operates in conjunction with PEPS module 211 to perform the PAK operations described herein. PEPS module 211 may include PAK module 212, or modules 211, 212 may be implemented as a single module. Parameter adjustment module 213 can be used to adjust parameters of vehicle 200.

[0227] PAK system 202 may further include memory 218, a display 220, an audio system 221, and one or more transceivers 222 including an LF antenna module 38 and an RF antenna module 40. RF antenna module 40 may include and / or be connected to RF circuitry 223. PAK system 202 may further include a telematics module 225, sensors 226, and a navigation system 227 including a Global Positioning System (GPS) receiver 228. RF circuitry 223 may be used to communicate with mobile devices (e.g., mobile device 102 of FIG. 1 ) transmitting Bluetooth® signals at 2.4 gigahertz (GHz). RF circuitry 223 may include a Bluetooth Low Energy (BLE) radio, transmitter, receiver, etc. for transmitting and receiving RF signals.

[0228] One or more transceivers 222 include an RF transceiver including RF circuitry 223 and execute an access application having code for verifying time-stamped data transmitted and received by RF antenna module 40. The access application may, for example, verify that the RF antenna module received the correct data at the correct time. The access application may be stored in memory 218 and executed by PEPS module 211 and / or PAK module 212. Other example operations of the access application are described further below.

[0229] The access application may implement a Bluetooth protocol stack configured to provide a channel map, an access identifier, a next channel, and a time for the next channel. The access application is configured to output timing signals for timestamps of signals transmitted and received via the RF antenna module 40. The access application may obtain the channel map information and timing information and share this information with other modules in the vehicle.

[0230] The telematics module 225 may communicate with a server via a cell tower station, which may include transferring certificates, license information, and / or timing information, including global clock timing information. The telematics module 225 is configured to generate location information and / or location information error for the vehicle 200. The telematics module 225 may be implemented by a navigation system 227.

[0231] The sensors 226 may include sensors used for PEPS and PAK operations, cameras, object detection sensors, temperature sensors, accelerometers, vehicle speed sensors, and / or other sensors. The sensors 226 may include a touch sensor, for example, to detect a person touching a door handle to initiate a process to wake up the portable access device. The sensors 226 may be connected to a body control module and / or other control modules 208, such as those disclosed herein, that can communicate with LF and RF antenna circuitry. The GPS receiver 228 may provide vehicle speed and / or vehicle direction (i.e., heading) and / or global clock timing information.

[0232] Memory 218 can store sensor data and / or parameters 230, certificates 232, connection information 234, timing information 236, tokens 237, keys 238, and applications 239. Applications 239 can include applications executed by modules 38, 40, 204, 206, 208, 210, 211, 212, 223, and / or transceiver 222. By way of example, applications can include access applications, PEPS applications, and / or PAK applications executed by transceiver 222 and modules 210, 211, and / or 212. While memory 218 and vehicle control module 204 are shown as separate devices, memory 218 and vehicle control module 204 may be implemented as a single device. The single device can include one or more of the other devices shown in FIG. 2.

[0233] Vehicle control module 204 may control the operation of engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seating system 254, mirror system 256, braking system 258, electric motor 260, and / or steering system 262 according to parameters set by modules 204, 206, 208, 210, 211, 212, and 213. Vehicle control module 204 may perform PEPS and / or PAK operations, which may include setting several parameters. PEPS and PAK operations may be based on signals received from sensors 226 and / or transceiver 222. Vehicle control module 204 may receive power from a power source 264, which may be provided to engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seating system 254, mirror system 256, braking system 258, electric motor 260, and / or steering system 262. Some PEPS and PAK operations may include unlocking the doors of window / door system 250, enabling fuel and ignition for engine 240, starting electric motor 260, providing power to any of systems 250, 252, 254, 256, 258, 262, and / or performing other operations as further described herein.

[0234] The engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seating system 254, mirror system 256, braking system 258, electric motor 260, and / or steering system 262 may include actuators controlled by vehicle control module 204 to adjust, for example, fuel, ignition, airflow, steering wheel angle, throttle position, pedal position, door locks, window position, seat angle, etc. This control may be based on the outputs of sensors 226, navigation system 227, GPS 228, and the above data and information stored in memory 218.

[0235] 4 shows access module 210. Access module 210 includes PEPS module 211, PAK module 212, and parameter adjustment module 213, and may further include link authentication module 300, connection information distribution module 302, timing control module 304, sensor processing and location module 306, data management module 308, and security filtering module 310. PAK module 212 may include RTC 312 for maintaining local clock time.

[0236] The link authentication module 300 can authenticate and establish a secure communication link with the portable access device of Figure 2. For example, the link authentication module 300 can be configured to perform challenge-response authentication or other cryptographic verification algorithms to authenticate the portable access device.

[0237] The connection information distribution module 302 is configured to communicate with some of the sensors 226 of FIG. 3 and provide the sensors with the communication information they need to locate and track or intercept the secure communication link. This may occur once the sensors are synchronized with a communication gateway, which may be included in or implemented within one of the transceivers 222. As an example, the vehicle 200 and / or PAK system 202 may include any number of sensors located anywhere on the vehicle 200 to detect and monitor mobile devices. The connection information distribution module 302 is configured to obtain information corresponding to the communication channel and channel switching parameters of the communication link and to transmit the information to the sensors 226. In response to the sensors 226 receiving the information from the connection information distribution module 302 via the vehicle interface 45 and the sensors 226 being synchronized with the communication gateway, the sensors 226 may locate and track or intercept the communication link.

[0238] When not governed by the PAK module 212, the timing control module 304 may maintain an RTC and / or currently stored date, transmit current timing information to sensors, generate timestamps for incoming and outgoing messages, requests, signals, certificates, and / or other items, calculate round-trip times, etc. Round-trip time may refer to the length between when a request is generated and / or sent and when a response to the request is received. The timing control module 304 may obtain timing information corresponding to a communication link when the link authentication module 300 performs challenge-response authentication. The timing control module 302 is also configured to provide timing information to the sensors 226 via the vehicle interface 209.

[0239] After link authentication is established, the data management module 308 collects the current location of the vehicle 108 from the telematics module 225 and shares that location with the portable access device. The portable access device optionally includes a GPS module and application software that, when executed, compares the estimated relative location of the portable access device with the vehicle 108. Based on the estimated location of the portable access device relative to the vehicle 108, the portable access device can send a signal to one of the transceivers 222 requesting the vehicle to perform a particular action. As an example, the data management layer 308 is configured to obtain vehicle information obtained by any module (e.g., location information obtained by the telematics module 225) and transmit the vehicle information to the portable access device.

[0240] The security filtering module 310 detects physical layer and protocol violations and filters the data accordingly before providing the information to the sensor processing and location module 306. The security filtering module 310 flags the injected data so that the sensor processing and location module 306 can discard the data and alert the PEPS module 211. The data from the sensor processing and location module 306 is passed to the PEPS module 211, which is configured to read vehicle state information from sensors to detect a user's intent to access a function and compare the location of the mobile device 102 to a set of locations that allow certain vehicle functions, such as unlocking the vehicle doors or trunk and / or starting the vehicle.

[0241] FIG. 5 is a functional block diagram of the RF antenna module 40, which includes a control module 350 connected to a multi-polarized RF antenna assembly 352. The multi-polarized RF antenna assembly 352 may include a linearly polarized antenna, another linearly polarized antenna, and / or a circularly polarized antenna (e.g., a right-hand circularly polarized antenna or a left-hand circularly polarized antenna). An example of a multi-polarized RF antenna is shown in FIG. 11. The control module 350 may include or be part of a BLE communication chipset. Alternatively, the control module 350 may include or be part of a Wi-Fi or Wi-Fi Direct communication chipset. The multi-polarized RF antenna assembly 352 may be included as part of the RF antenna module 40 or may be located remotely from the control module 350. Some or all of the operations of the control module 350 may be performed by one or more of the modules 204, 210, 211, and 212 of FIG. 3.

[0242] The control module 350 (or one or more of modules 204, 210, 211, 212 of FIG. 3) can establish a secure communication connection with a portable access device (e.g., one of portable access devices 32, 34 of FIG. 2). For example, the control module 350 can establish the secure communication connection using a BLE communication protocol, which can include transmit and / or receive timing and synchronization information. The timing and synchronization information can include information directed to the secure communication connection, such as the timing of the next communication connection event, the timing interval between communication connection events, the communication channel for the next communication connection event, a channel map, a channel hop interval or offset, communication delay information, communication jitter information, etc. The control module 350 can detect (or “eavesdrop”) packets transmitted by the portable access device to the vehicle control module 204 and measure signal information of signals received from the portable access device. The channel hop interval or offset can be used to calculate the channel for the subsequent communication connection event.

[0243] The control module 350 may measure the received signal strength of signals received from the portable access device and generate a corresponding RSSI value. Additionally or alternatively, the control module 350 may make other measurements of the signals received from the portable access device, such as angle of arrival, time of arrival, time difference of arrival, etc. The control module 350 may then transmit the measured information to the vehicle control module 204, which may determine the position and / or distance of the portable access device relative to the vehicle 30 based on the measured information. The position and distance determination may be based on similar information received from one or more other RF antenna modules and / or other sensors.

[0244] As an example, the vehicle control module 204 can determine the location of the portable access device based on, for example, a pattern of RSSI values corresponding to signals received from the portable access device by the RF antenna module 40. A strong (or high) RSSI value indicates that the portable access device is close to the vehicle 30, while a weak (or low) RSSI value indicates that the portable access device is far from the vehicle 30. By analyzing the RSSI values, the control module 204 can determine the location and / or distance of the portable access device relative to the vehicle 30. Additionally or alternatively, measurements of the angle of arrival, angle of departure, round-trip timing, unmodulated carrier tone exchange, or time difference of arrival of signals transmitted between the portable access device and the control module 204 may also be used by the control module 204 or the portable access device to determine the location of the portable access device. Additionally or alternatively, the RF antenna module 40 may determine the location and / or distance of the portable access device based on the measured information and communicate the location or distance to the control module 204.

[0245] Based on the determined location or distance of the portable access device relative to the vehicle 30, the modules 211, 212 of FIG. 3 may authorize and / or perform vehicle functions, such as unlocking the doors of the vehicle 30, unlocking the trunk of the vehicle 30, starting the vehicle 30, and / or allowing the vehicle 30 to start. As another example, if the portable access device is less than a first predetermined distance from the vehicle 30, the modules 211, 212 may turn on the interior or exterior lights of the vehicle 30. If the portable access device is less than a second predetermined distance from the vehicle 30, the modules 211, 212 may unlock the doors or trunk of the vehicle 30. If the portable access device is located inside the vehicle 30, the modules 211, 212 may allow the vehicle 30 to start.

[0246] Referring again to FIG. 5 , control module 350 may include a physical layer (PHY) module 356, a medium access control (MAC) module 358, a time synchronization module 360, and a channel map reconstruction module 362. PHY module 356 receives BLE signals via multi-axis polarized RF antenna assembly 352. Control module 350 may monitor received BLE physical layer messages and obtain measurements of physical characteristics of the corresponding signals, including received signal strength, using, for example, a channel map generated by channel map reconstruction module 362. Control module 350 may communicate with control modules and / or modules 204, 210, 211, 212 of other RF antenna modules via vehicle interface 45 to determine time difference of arrival, time of arrival, angle of arrival, and / or other timing information. In one embodiment, control module 350 includes a portion of RF circuitry 223 of FIG. 3 .

[0247] The time synchronization module 360 is configured to accurately measure the time of receipt of signals / messages at the vehicle interface 45. The control module 350 can tune the PHY module 356 to a particular channel at a particular time based on the channel map information and the time of receipt and / or other timing information. Additionally, the control module can monitor received PHY messages and data that conform to a Bluetooth® physical layer specification, such as Bluetooth® Specification Version 5.1. The data, timestamp, and measured signal strength may be reported by the control module 350 to the control module 204 via the vehicle interface 45.

[0248] Figure 6 shows an exemplary portable access device 400, which is an example of one of the portable access devices 32, 34 of Figure 2. The portable access device 400 may include a control module 402, a user interface 404, a memory 406, a sensor 407, and a transceiver 408. The transceiver 408 may include a MAC module 410, a PHY module 412, and multiple linearly polarized antennas 414.

[0249] The control module 402 may include or be part of a BLE communication chipset. Alternatively, the control module 402 may include or be part of a Wi-Fi or Wi-Fi Direct communication chipset. The memory 406 may store application code executable by the control module 402. The memory 406 may be a non-transitory computer-readable medium including read-only memory (ROM) and / or random access memory (RAM).

[0250] The control module 402 communicates with the vehicle's modules 204 and 350 to perform authentication and other operations as further described below. The control module 402 may transmit information about the portable access device 400, such as position and / or velocity information obtained from one or more sensors 407 (e.g., a Global Navigation Satellite System (e.g., GPS) sensor, an accelerometer, and / or an angular rate sensor). The user interface 404 may include a keypad, a touch screen, a voice-activated interface, and / or other user interface.

[0251] FIG. 7 shows a polarization axis diagram illustrating an exemplary polarization diversity arrangement. In the illustrated example, two triaxial antennas located in a vehicle communicate with a biaxial antenna located in a portable access device (or mobile access network device). With sufficient antenna axes, this antenna topology can prevent cross-polarization between one of the triaxial antennas and the biaxial antenna. Also, with sufficient antenna axes, the system can be configured so that there is at least one pair of antennas where no null exists (or is not directed) in the direct signal path. Heuristic RSSI measurements on the continuous wave (CW) tone portion of the packet can be performed, measuring the round-trip time and phase delay of the packet. This can be repeated across multiple frequencies. This can be implemented in the vehicle access module and / or the portable access device. Round-trip timing and / or unmodulated carrier tone exchange can be used to ensure ranging. RSSI and frequency-specific delta phase changes can also be used.

[0252] FIG. 8 shows a polarization axis diagram illustrating another exemplary polarization diversity arrangement. In the illustrated example, two single-axis antennas located in a vehicle communicate with a tri-axis antenna located in a portable access device (or mobile access network device). With sufficient antenna axes, this antenna topology can also prevent cross-polarization between one of the single-axis antennas and the tri-axis antenna. With sufficient antenna axes, the system can be configured so that there is at least one pair of antennas where no null exists (or is directed away) from the direct signal path. Heuristic RSSI measurements on the continuous wave (CW) tone portion of the packet can be performed, measuring the round-trip time and phase delay of the packet. This can be repeated across multiple frequencies. This can be implemented in the vehicle access module and / or the portable access device. Round-trip timing is used to ensure ranging. RSSI and frequency-specific delta phase changes can also be used. The example of FIG. 7 may be more suitable than the example of FIG. 8 because incorporating a tri-axis antenna into certain portable access devices, such as key fobs, can be difficult.

[0253] FIG. 9 shows a field diagram 900 and a polar plot 902 illustrating the field pattern and nulls 906 of a linear antenna. The linear antenna is aligned along a vertical axis 908. A linear antenna has a "donut"-shaped radiation pattern. When the nulls are aligned between the transmit and receive antennas (co-polarized antennas with collinear or nearly collinear nulls), the bounce path of the transmitted signal is measured. The examples described herein prevent this situation from existing between at least one transmit antenna and at least one receive antenna at any time. To prevent the use of cross-polarized and / or co-polarized antennas, an algorithm is presented herein for determining which transmit and receive antennas to use at any time. Once the appropriate antenna pair is selected, time-of-flight measurements are performed to determine the distance between the transmitter and receiver and / or between the vehicle and the portable access device. FIG. 10 shows a voltage vs. field diagram 1000 for a linearly polarized antenna 1002.

[0254] 11A-B show at least a portion of an example of a multi-axially polarized RF antenna assembly 1100 including a linearly polarized antenna 1102 and a circularly polarized antenna 1104. The antennas 1102, 1104 are arranged together. The linearly polarized antenna 1102 extends axially outward from the center of the circularly polarized antenna 1104 in a straight line away from the circularly polarized antenna 1104. The antennas 1102, 1104 can transmit 90° out of phase with each other. The linearly polarized antenna 1102 can include a conductive element (e.g., a straight wire or helix) 1110 extending within a sleeve 1112. The circularly polarized antenna 1104 can be ring-shaped.

[0255] The linearly polarized antenna 1102 is a monopole antenna. The sleeve 1112 is formed of a dielectric material such as Teflon. Both antennas 1102, 1104 are concentric with a disk-shaped insulator (or isolator) 1106 and a disk-shaped ground plane 1108. The ring-shaped insulator 1106 is stacked as the top layer on the ground plane 1108 (or bottom layer). The circularly polarized antenna 1104 is positioned on the ground plane 1108 within an inner recess 1114 of the insulator 1106. The inner recess 1114 of the insulator is positioned between the circularly polarized antenna 1104 and the ground plane 1108.

[0256] The circularly polarized antenna has two feed points 1120, 1122, while the linearly polarized antenna 1102 has a single feed point 1124. RF signals are transmitted and / or received via the feed points 1120, 1122, 1124. The RF signals are transferred between the antennas 1102, 1104 and the RF circuitry 1114 via coaxial cables. The coaxial cables include inner conductive wires 1130, 1132, 1134 and an outer ground shield (not shown). The ground shield is connected to the ground plane 1108. The conductive wires 1130, 1132, 1134 are connected to the feed points 1120, 1122, 1124.

[0257] During transmission, a signal or voltage is provided between the ground plane 1108 and the conductive element 1110 via a feed point 1124, which is connected to the conductive element 1110 and the ground plane 1108 via another conductive element 1140. An RF signal or voltage is also applied between the ground plane 1108 and feed points 1120, 1122 of the circularly polarized antenna 1104. The feed points 1120, 1122 are positioned 90° offset on the face of the antenna 1104 and are 90° out of phase with each other. The 90° electrical phase shift combined with the 90° geometric phase shift causes the circularly polarized antenna 1104 to radiate a circularly polarized signal. The feed points 1120, 1122 are connected to the circularly polarized antenna 1104 from the ground plane 1108 via an insulator 1106. The hole 1142 in the center of the ground plane 1108 and the hole 1144 in the center of the circularly polarized antenna 1104 are large enough to allow the linearly polarized antenna 1102 to radiate without shorting to the ground plane 1108.

[0258] The antennas 1102, 1104 may be formed of a conductive material, while the circular isolator 1106 may be formed of a non-conductive (or electrically insulating) material. In one embodiment, the linearly polarized antenna 1102 may be implemented as a straight wire, with the sleeve 1112 formed of polytetrafluoroethene (PTFE) and the conductive element 1110 formed of copper. In another embodiment, the linearly polarized antenna 1102 is implemented as a helix, with the wire wrapped around a cylindrical object formed of PTFE. FIG. 12 shows a polar plot 1200 of the radiated power for the linearly polarized antenna 1102 of FIG. 11. FIG. 13 shows a polar plot of the radiated power for the circularly polarized antenna 1104 of FIG. 11. The antennas 1102, 1104 may be connected to an RF circuit 1114, such as one of the RF circuits 223 of FIG. 3, and configured to be mounted on the roof of a vehicle. Antennas 1102, 1104 can be used for time-of-flight measurements between the vehicle and the portable access device, while other LF antennas in the vehicle can be used for authentication of the portable access device.

[0259] Although the antenna assembly has been primarily described as having a circularly polarized antenna and a linearly polarized antenna, which may be located, for example, on the roof of the vehicle, two linearly polarized antennas may alternatively be used. This is true for each example disclosed herein. The two linearly polarized antennas may be located deeper in the vehicle, such as in the floor, instrument panel, or center console of the vehicle.

[0260] FIG. 14 illustrates a first RF circuit 1400, a second RF circuit 1401, and a portion 1403 of a portable access device (e.g., one of the portable access devices described above). While a specific number of RF circuits are shown, any number of RF circuits may be included to communicate with the portable access device. The first RF circuit 1400 includes a serial transmit module 1402, an RF transceiver module 1404, a switch 1406, a splitter 1408, a single-polarized (or monopole) antenna 1410, a delay module 1412, and a circularly polarized antenna assembly 1414. The antennas 1410 and 1414 may be implemented as the multi-polarized RF antenna assembly of FIG. 11. While the RF circuits are each shown as having a single-polarized antenna and a circularly polarized antenna to provide three axes of polarization, each RF circuit may include only two single-polarized antennas. To achieve polarization diversity of the module, various combinations of linearly and circularly polarized antenna axes can be used, which prevents cross-polarization and / or collinear nulls. If the RF circuitry includes two single-axis antennas, the portable access device includes a three-axis antenna or three single-axis antennas orthogonal to each other to correspond to the x, y, and z axes.

[0261] Serial transmit module 1402 can communicate with one or more vehicle modules (e.g., the vehicle control module or access module described above) via a serial bus according to the Serial Peripheral Interconnect (SPI) protocol. Discrete signals (or general-purpose I / O signals) can be transmitted between modules 1402, 1404 and between RF transceiver module 1404 and switch 1406. RF transceiver module 1404 can communicate with PEPS module 211 (of FIG. 3). Switch 1406 switches between antennas 1410, 1414. Splitter 1408 can split the signal received from RF transceiver module 1404 and provide the signal to antenna 1410 and antenna 1414, and / or combine the signals received from antenna 1410 and antenna 1414. Splitter 1408 is a 90° splitter that splits a single signal into two 90° out-of-phase signals and provides those signals to two feed points of a circularly polarized antenna (e.g., feed points 1120, 1122 in FIG. 11 ). Splitter 1408 can provide a signal to or receive a signal from antenna 1414 via delay module 1412.

[0262] The second RF circuit 1401 includes a switch 1420, a splitter 1422, a single-polarized (or monopole) antenna 1424, a delay module 1426, and a circularly polarized antenna 1428. The antennas 1424 and 1428 may be implemented as the multi-polarized RF antenna assembly of FIG. 11 . The devices 1420, 1422, 1424, 1426, and 1428 may operate similarly to the devices 1406, 1408, 1410, 1412, and 1414. The switch 1420 may be in communication with the RF transceiver module 1404. The switch 1406 may also connect the splitter 1408, the single-polarized antenna 1410, and / or the switch 1420 to the RF transceiver module 1404. The switch 1420 can connect a single polarized antenna 1424 or a splitter to the switch 1406 or the RF transceiver module 1404 .

[0263] Portion 1403 includes a tri-axis LF antenna 1430, an LF module 1432, an RF module 1434, a user interface 1436, a first unipolar antenna 1438, a second unipolar antenna 1440, and a switch 1442. The LF module 1432 transmits and receives LF signals via the tri-axis LF antenna 1430. The RF module 1434 transmits and receives RF signals via the switch 1442 and the antennas 1438, 1440. The switch 1442 connects one or more of the antennas 1438, 1440 to the RF module 1434. Discrete signals and serial peripheral interconnect (SPI) signals can be transmitted between the LF module 1432 and the RF module 1434. Discrete signals can be transmitted between the RF module 1434 and the switch 1442.

[0264] RF signals are transmitted between (i) antennas 1410, 1414, 1424, and 1428 and (ii) antennas 1438 and 1440. As an example, antennas 1410 and 1424 can be associated with the z-axis, and antennas 1414 and 1428 can be associated with the x-axis and y-axis, respectively. Antennas 1438 and 1440 can be, for example, slot antennas associated with the x-axis and y-axis, respectively. The tri-axis LF antenna 1430 can communicate with a corresponding vehicle LF antenna, as described above. The LF antenna can be used for downlink wake-up purposes. The RF antenna can be used for authentication and communication.

[0265] Antennas 1410 and 1414 can be used to communicate with antennas 1438 and 1440, or antennas 1424 and 1428 can be used to communicate with antennas 1438 and 1440. Alternatively, one of antennas 1410 and 1424 and one of antennas 1414 and 1428 can be used to communicate with antennas 1438 and 1440. One or more antennas in circuit 1400 can be used while one or more antennas in circuit 1401 are used. Using one monopole (or linearly polarized) RF antenna and a dipole (or multi-axially polarized) RF antenna, such as a circularly polarized antenna, reduces the number of RF switching lanes to poll from three to two. Heuristic measurements of RSSI on a packet's continuous wave tone can be made, measuring the packet's round trip time and phase delay. This can be repeated across multiple frequencies.

[0266] FIG. 15 shows a portion 1500 of a key fob with two linearly polarized slot antennas 1502, 1504, metal trim 1506, and a spare key 1508. The metal within the key fob can short out fields that would otherwise be stable along the length of the key fob (or Y-direction). As a result, it can be difficult to design an efficient radiator in a structure that would otherwise contain properly operating antennas. Antenna 1502 is an x-axis linearly polarized slot antenna. Antenna 1504 is a y-axis linearly polarized slot antenna. Metal trim 1506 can be molded decorative trim. The key fob can also include an LF coil antenna 1510, a processor (not shown), a battery 1512, and a metal plate (or conductive film) 1514. An RF signal is fed into the metal plate 1514, and openings in the slot antennas 1502, 1504 radiate electromagnetic waves.

[0267] FIG. 16 shows a portion 1600 of the key fob of FIG. 15 without the metal trim 1506 and spare key 1508. The portion 1600 includes an x-axis linearly polarized slot antenna 1502 and a y-axis linearly polarized slot antenna 1504. Removing the metal trim 1506 and spare key 1508 supports radiation from the slot antennas 1502, 1504. While this arrangement is configured to work with nearby metal, such as metal trim and a spare key, the plots of FIGS. 17 and 18 are shown, which are distorted from their plots when the metal trim and spare key are included. FIG. 17 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the key fob portion 1600 of FIG. 16. FIG. 18 shows an example polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion 1600 of FIG. 16. 19 shows a plot of return loss in decibels (dB) versus frequency for the linearly polarized slot antennas 1502, 1504 of FIG. 16, where curve S1,1 is the reflected power at the first port or antenna 1502 of the first radio (or transmitter) and S2,2 is the reflected power at the second port or antenna 1504 of the second radio (or transmitter). Given the configuration of the key fob, the S1,1 and S2,2 plots can be defined where the "dip" or minimum return loss of the S1,1 and S2,2 curves are at the same frequency or within a predetermined range of each other to provide improved performance.

[0268] Return loss is a measure of how well an antenna converts voltages at its terminals into electric fields in space, or vice versa. Return loss is a decibel measurement of how much power is reflected at the terminals. For example, a return loss of 0 dB means all power is reflected and no power is transferred to the terminals. As another example, a return loss of -10 dB means that approximately 10% of the power is reflected and 90% of the power is transferred. If a plot of return loss contains a curve that drops off to a reasonable level (e.g., -6 dB) at the operating frequency, the corresponding antenna is functioning properly. If the return loss drops to -10 dB, the antenna is considered to be performing well. Return loss is measured as an S-parameter: S1,1 is the return loss at port 1. S2,2 is the return loss at port 2.

[0269] FIG. 20 shows the key fob portion 2000 of FIG. 15 including a spare key 1508 and without the metal trim 1506. FIG. 21 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the key fob portion 2000 of FIG. 20. FIG. 22 shows a polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion 2000 of FIG. 20. The addition of a spare key may adversely affect the y-polarization but will not affect operation. FIG. 23 shows a plot of return loss versus frequency for the linearly polarized slot antennas 1502, 1504 of FIG. 20, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504.

[0270] FIG. 24 shows the key fob portion 2400 of FIG. 15 with a portion of metal trim 2402 and a spare key 1508. Adding the metal trim 2402 near the spare key 1508 can adversely affect operation, as shown by the plots and curves of FIGS. 25-27. FIG. 25 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the key fob portion 2400 of FIG. 24. FIG. 26 shows a polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of the key fob portion of FIG. 24. FIG. 27 shows a plot of return loss versus frequency for the linearly polarized slot antenna of FIG. 24, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504. FIGS. 19, 23, and 27 show that the antennas function adequately in the frequency range of interest (e.g., 2.4-2.8 GHz).

[0271] Referring to portion 1500 of Figure 15, where a complete metal trim 1506 is present, antenna performance is further adversely affected, as shown in the plots and curves of Figures 28-30. Figure 28 shows a polar plot of radiated power associated with the x-axis linearly polarized slot antenna 1502 of portion 1500. Figure 29 shows a polar plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of portion 1500. Figure 30 shows plots of return loss versus frequency for the linearly polarized slot antennas 1502, 1504, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504.

[0272] The y-axis linearly polarized slot antennas 1502, 1504 are open slot antennas because each of the antennas 1502, 1504 has an open end. FIG. 31 shows a portion 3100 of a key fob with an open linearly polarized slot antenna 3102, a closed linearly polarized slot antenna 3104, metal trim 3106, and a spare key 3108. FIG. 32 shows a polar plot of the radiated power associated with the x-axis linearly polarized slot antenna 3102 of portion 3100. FIG. 33 shows a polar plot of the radiated power associated with the y-axis linearly polarized slot antenna 3104 of portion 3100. FIG. 34 shows a plot of return loss versus frequency for the linearly polarized slot antennas 3102, 3104 of FIG. 31. FIG. 34 shows that the antennas, measured at port S2,2, perform poorly.

[0273] When the portable access device has multiple orthogonal antennas as described above, the larger the portable access device is compared to a corresponding physical metal key, and the larger the portable access device is compared to the palm of a hand, the removal of decorative metal trim provides improved round trip time performance, which improves the accuracy of distance determination.

[0274] The systems disclosed herein can be operated using many of the methods described herein. Some exemplary methods for determining which antenna combination to use are shown in FIGS. 35 and 36. FIGS. 35 and 36 illustrate methods for determining which antenna combination to use to exchange packets between the RF antenna module (or RF circuitry) of a vehicle and a portable access device for round-trip time-of-flight measurements. FIGS. 35 and 37 represent the method from the perspective of the initiator of the round-trip time-of-flight measurements. In one embodiment, this is the vehicle. In another embodiment, this is the portable access device. The reflector / responder performs explicit steps corresponding to the initiator steps of the process. Round-trip time-of-flight measurements can be used to prevent range extender-type relay attacks, as described further below. FIG. 35 illustrates an approach for switching antennas between packets. FIG. 36 illustrates an approach for switching antennas during packet and / or continuous wave (CW) tone transmission.

[0275] Although the following process is described primarily with respect to the embodiments of Figures 2-6, 11, and 14, the process can be easily modified to apply to other embodiments of the present disclosure. The process can be performed iteratively.

[0276] The method may begin at 3500. The following processing may generally be performed simultaneously by the control module 402 in the portable access device 400 and by modules located in the vehicle, such as the access module 210, PEPS module 211, and / or PAK module 212 of FIG. 4. To identify the best frequency (or channel) and antenna axis, there are many ways that the frequency and antenna combinations to be sampled can be selected. Optionally, at 3501, the modules negotiate an initial frequency (or channel) and antenna combination to use for frequency and antenna sampling. This step may be pre-agreed upon, negotiated between modules based on post-event data, and / or commanded by the modules based on post-event data. At 3502, a frequency (or channel) is selected for transmitting the first (or next) packet.

[0277] At 3504, an antenna pair is selected to transmit and receive the packet, such as two of the antennas of the vehicle's RF circuitry in Figure 11. At 3506, the packet is transmitted from the first (or transmit) antenna at the selected frequency to the portable access device. The portable access device measures the RSSI of the transmission and transmits the packet back to the second (or receive) antenna of the selected antenna pair as the first RSSI.

[0278] The second antenna receives the packet and / or a response to the transmission of the packet and the first RSSI at 3508. A second RSSI is measured for the second transmission of the packet at 3512. At 3514, the first RSSI and the second RSSI are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

[0279] If another antenna pair is selected in 3516, then operation 3504 is performed; otherwise, operation 3518 is performed, thereby cycling through each antenna pair for each selected frequency. The antenna pair cycling can be pseudo-random and / or in a predefined order.

[0280] In 3518, if another frequency (or channel) is selected, operation 3502 is performed; otherwise, operation 3520 is performed. This allows each frequency (or channel) to be cycled through. This allows the RSSI of each of the frequencies (or channels) to be determined. Due to multipath fast fading, some frequencies may have low power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels may be cycled in a pseudo-random and / or predefined order to determine the best frequency and / or channel and best antenna pair for transmission of another packet.

[0281] Optionally, at 3519, after cycling through a predetermined, negotiated, and / or agreed-upon set of frequencies and antenna axis pairs, the algorithm may cause the nodes (control modules) to optionally exchange antenna and / or channel RSSI results. Exchanging RF channels allows the modules to use heuristics to select the antenna axis to be used by the modules without sharing antenna RSSI measurements obtained by the modules. While exchanging RF channels allows the modules to use heuristics to select channels (frequencies) without results from other channels, the modules may use algorithms to select channels based on results from the channels. In this case, the algorithm and system may be less susceptible to interference from other nearby transmitters.

[0282] At 3520, after cycling through a predetermined number of frequencies and antenna pairs, the antenna axis combination and / or frequency (channel) with the best RSSI is selected for transmission of the remaining packets. The antenna axis combination with the highest RSSI is optimal. A frequency (or channel) that does not have a low RSSI and / or a high RSSI is optimal. At 3522, an identifier of the selected antenna pair and / or frequency (channel) may be encrypted. At 3524, the encrypted selected antenna axis pair and / or frequency (channel) may be transmitted to other nodes. At 3526, the packet is transmitted using the selected frequency (channel) and antenna pair, and a response is received. The method may end at 3528.

[0283] The following process of Figure 36 is described primarily with respect to the embodiments of Figures 2-6, 11, and 14, but the process can be easily modified to apply to other embodiments of the present disclosure. The process can be performed iteratively.

[0284] The method may begin at 3700. The following processing may generally be performed simultaneously by the control module 402 in the portable access device 400 and by modules located in the vehicle, such as the PEPS module 211 and / or PAK module 212 of FIG. 4. A number of different techniques may be used to select the frequency and antenna combinations to be sampled and identify the best frequency (or channel) and antenna axis. Optionally, at 3701, the modules negotiate an initial frequency (or channel) and antenna combination to use for frequency and antenna sampling. This step may be pre-agreed upon, negotiated between modules based on a posteriori data, or commanded by the modules based on a posteriori data. At 3702, a frequency (or channel) for transmitting the first (or next) packet is selected.

[0285] At 3704, an antenna pair for transmitting and receiving a packet is selected, such as two of the antennas of the vehicle's RF circuitry of FIG. 11. At 3706, the packet is transmitted from the first (or transmit) antenna at the selected frequency to the portable access device. The vehicle switches between the agreed-upon set of antenna axes with state-holding periods during the CW tone portions of the packet. The portable access device switches between the agreed-upon set of antenna axes with state-holding periods during each of the vehicle antenna axis "switch and state-holding periods" within the CW tone periods, measures the RSSI of the received transmit and receive antenna axis swap, transmits the packet and the first set of measured RSSIs back to the vehicle, and switches between the agreed-upon set of antenna axes of the selected antenna pair with state-holding periods during the CW tone portions of the packet.

[0286] The vehicle receives the packet and / or a response to the transmission of the packet and a first set of RSSIs at 3708. A second RSSI is measured for a second transmission of the packet at 3712. At 3714, the first RSSI and second RSSI are stored in memory in association with the packet, the selected frequency, and the selected antenna pair.

[0287] In 3716, if another packet needs to be transmitted, operation 3718 may be performed; otherwise, operation 3726 may be performed. In 3718, if another antenna pair needs to be selected, operation 3720 may be performed; otherwise, operation 3724 may be performed. This may allow for cycling through each antenna pair per selected frequency. The antenna pair cycling may be pseudo-random and / or in a predefined order.

[0288] At 3720, a first transmission of the next packet is initiated using the previous transmit antenna of the previously selected antenna pair.

[0289] At 3722, a switch is made between the previous antenna pair and the next selected antenna pair. This can be done during the CW tones of the currently transmitted packet or during another portion of the currently transmitted packet, so that the remainder of the packet is transmitted via the transmit antenna of the next selected antenna pair. Operation 3708 may be performed following operation 3722.

[0290] In 3724, if another frequency (or channel) needs to be selected, operation 3704 is performed; otherwise, operation 3718 is performed. This allows each frequency (or channel) to be cycled through. This allows the RSSI of each of the frequencies (or channels) to be determined. Due to multipath fast fading, some frequencies may have low power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels may be cycled in a pseudo-random and / or predefined order to determine the best frequency and / or channel and best antenna pair for transmission of another packet. In 3725, the resulting antenna and RSSI values may be swapped as described above in 3519.

[0291] At 3726, after cycling through a predetermined number of frequencies and antenna pairs, the antenna combination and frequency and / or channel with the best RSSI is selected for transmission of the remaining packets.

[0292] At 3728, the identifier of the selected antenna pair may be encrypted. At 3730, each remaining packet may be encapsulated to include the encrypted identifier or modified to include the encrypted identifier. At 3732, the encapsulated or modified packet is transmitted using the selected frequency, channel, and antenna pair, and a response is received. The method may end at 3734.

[0293] In the above method, packets transmitted to determine the best frequency, channel, and antenna pair may be discarded. The discarded packets are simply used to measure RSSI values. In another embodiment, CW tones are included at the end of the packet, and antenna switching occurs during these tones. In another embodiment, a predetermined period (e.g., 4 μs) is allocated for each antenna swap, CW tones are included at the end of the packet, and the antenna pair with the best RSSI (or power value) is selected. The selected frequency, channel, and / or antenna pair may be changed if another nearby network device is transmitting and / or receiving data in the same frequency range. In one embodiment, the pattern by which frequencies are selected during the method of Figures 35 and 36 is known and shared between the vehicle's access module and the portable access device.

[0294] Processes 3526 and 3732 may be executed to authorize the portable access device, detect a range extender-type relay station attack by the portable access device, provide access to the interior of the vehicle, and / or perform other PEPS system and / or PAK system operations. As an example, a packet may be transmitted to authorize the portable access device, and access to the interior of the vehicle may be provided when it is determined that the portable access device and / or corresponding user are authorized to access the vehicle. This may include authorizing operation of the vehicle. A packet may be transmitted to perform a time-of-flight measurement, including the time to transmit the packet to the portable access device and the time to respond and receive a corresponding response from the portable access device. Based on the measured time-of-flight value, an access module (e.g., a PEPS module or a PAK module) of the vehicle can determine whether the portable access device is attempting a range extender-type relay station attack. If the portable access device is attempting a range extender-type relay station attack, the access module may implement one or more countermeasures, including preventing access to the interior of the vehicle. The countermeasures may include notifying the vehicle owner of the range extender-type relay station attack. This may be done, for example, by a text message or email sent from the access module to one or more of the owner's network devices. One or more warning signals may be generated to notify a central monitoring station and / or authorities of the attack.

[0295] 37 shows a time-of-flight measurement diagram 3800 including an initiating-measuring device 3802 and a reflecting (or responding) device 3804. The initiating-measuring device 3802 transmits a wireless message (e.g., a packet) to the reflecting device 3804, which responds by transmitting a wireless message back to the initiating-measuring device 3802. The time-of-flight (or total time to send and receive these signals) is equal to the sum of (T2-T1), (T3-T2), and (T4-T3), where T2-T1 is the length of time it takes for the wireless message to travel from the initiating-measuring device 3802 to the reflecting device 3804, T3-T2 is the length of time it takes for the reflecting device 3804 to respond, and T4-T3 is the length of time it takes for the wireless message to travel from the reflecting device 3804 to the initiating-measuring device 3802. Exemplary average time-of-flight and distance calculations can be performed according to Equations 1-4, where distance refers to the distance between the initiating and measuring device 3802 and the reflecting device 3804.

number

number

number

number

[0296] If a timer is used to time the response time T3-T2, the amount of timing information may be reduced to compensate for the fine-tuning information measured relative to the response time. If the initiator is not aware of this amount of time, the time T3-T2 may be reported to the initiator.

[0297] FIG. 38 shows an exemplary BLE radio 3900 including a superheterodyne receiver 3902 and a transmitter 3904. The BLE radio 3900 may be used, for example, as one of the transceivers 222 of FIG. 3 and may include or be part of one of the RF antenna module 40 and the RF circuitry 223. In another embodiment, the BLE radio 3900 is used as a transceiver of a portable access device, such as the transceiver 410 of the portable access device 400 of FIG. 6. The superheterodyne receiver 3902 converts the received signal to a fixed intermediate frequency (IF) using frequency mixing. The superheterodyne receiver 3902 includes an RF (e.g., bandpass) filter 3906, a switch balun 3908, a low-noise amplifier 3910, a downconverter 3912, a bandpass filter amplifier 3914, an analog-to-digital converter 3916, a demodulator 3918, and a correlation protocol module 3920. Transmitter 3904 includes a processing module 3922, a protocol module 3924, a Gaussian Frequency Shift Keying (GFSK) modulator 3926, a digital-to-analog converter and low-pass filter 3928, an upconverter 3930, and a power amplifier 3932. A crystal oscillator 3934 can generate one or more clock signals, which can be distributed to devices 3914, 3916, 3918, 3920, 3922, 3924, 3936, 3938, and phase-locked loops 3940 and 3942. As an example, processing module 3922 and correlation and protocol module 3920 can be implemented as a single module or as part of one or more of modules 204, 210, 211, and 212 of FIG. 3. The processing performed by modules 3922 and 3920 may be performed by any one of modules 204, 210, 211, and 212 of FIGS. 3 and 4. One or more of devices 3906, 3908, 3910, 3912, 3914, 3916, 3918, 3920, 3924, 3926, 3928, 3930, 3932, 3934, 3936, 3938, 3940, and 3942 may be implemented as part of RF circuitry 223 and / or as part of one or more of modules 204, 210, 211, 212.

[0298] Bandpass filter 3906 can be connected to a linearly polarized antenna and / or a circularly polarized antenna (designated 3907). Downconverter 3912 downconverts the received signal from an RF frequency to an IF frequency based on a signal from phase-locked loop 3942. Upconverter 3930 upconverts the IF signal to an RF signal based on a signal from phase-locked loop 3940.

[0299] The GPSK modulator 3926 and demodulator 3918 can modulate and demodulate bits of the signal according to the GFSK protocol. Figure 39 shows an example GFSK parameter definition plot, including a plot of the transmit carrier frequency Fc showing the zero crossing points and error. As an example, the transmit carrier frequency Fc is ±250 kHz or ±500 kHz, the symbol time is 1 μs or 0.5 μs, and the zero crossing error is 1 / 8 of 1 μs (1 Mbps) or 1 / 8 of 0.5 μs (2 Mbps).

[0300] 40 shows a functional block diagram of a system 4100 for transmitting a BLE packet. An example format of a BLE packet 4101 is shown, including a preamble, an access address, a protocol data unit (PDU), and a cyclic redundancy check (CRC) bit field. This is an example of a packet that may be received by the correlation protocol module 3940 of FIG. 38 and / or generated by the processing module 3922 and / or the protocol module 3924.

[0301] The packet preamble is AA or 55 so that the last bit of the preamble is different from the first bit of the access address. The access addresses of the peripheral and central devices 4102, 4104 are the same. A sensor 4106 can be used to monitor the packets. The access address is the same for each packet and each connection interval. The access address follows the BLE access address rules. Packets in the same connection interval are in the same RF channel. Figure 41 shows example preambles and access addresses for BLE 1M packets and BLE 2M packets. The preamble is multiple A's and multiple 5's (AA or 55 at 1 mbit / s, AAAA or 5555 at 2 mbit / s), so the last bit of the preamble is different from the first bit of the access address. This is indicated by the bits within circle 4200.

[0302] The access address of an advertising channel packet may be 10001110100010011011111011010110b (0x8E89BED6). Each link layer connection and each periodic advertisement between any two devices has a different access address. The access address may be a 32-bit value. Each time a new access address is needed, the link layer may generate a new random value that meets the following rules: The access address is not the address of an existing link layer connection on the corresponding network device. The access address is not a valid periodic advertising address, does not have six consecutive 0s or 1s, is not an advertising channel packet access address, is not a sequence that differs by only one bit from an advertising channel packet access address, and does not contain four equal octets. The access address has no more than 24 variations. The random number generator seed is from a physical entropy source with at least 20 bits of entropy. If the random number for the access address does not satisfy the above rules, a new random number is generated until the rules are satisfied. For embodiments that also support a BLE coded physical layer (PHY), the access address may have at least three 1s in the least significant 8 bits and no more than 11 variations in the least significant 16 bits. In a typical BLE packet, the preamble may reveal the first bit of the access address, and then the access rules may reveal the next bit of the access address (e.g., no more than six consecutive 0s or 1s). This can pose a ranging security issue because an attacker may be able to predict the bits, but the embodiments disclosed herein mitigate or eliminate this.

[0303] FIG. 42 shows an example plot of a BLE packet signal showing corresponding bits. A first BLE signal 4300 represents the bit stream from the protocol module 3924 of FIG. 38. A normal BLE packet does not return to the carrier (or midpoint level) when the bits remain the same value. This is called non-return to zero recording. Bits corresponding to the first plot are shown above the plot. A second BLE signal 4302 represents the bit stream from the GFSK modulator (or Gaussian filter) 3926. The Gaussian filter adds a 1 / 2 bit time lag, allowing a short amount of time during transitions. Bits corresponding to the second BLE curve are shown below the second BLE curve. As an example, the carrier frequency can be 2.402 GHz, and the BLE packet signal can vary in frequency between 2.402250 GHz and 2.401750 GHz.

[0304] FIG. 43 illustrates an example plot of a BLE packet signal showing corresponding bits of a stronger BLE packet signal (e.g., a BLE packet signal with a larger RSSI) transmitting on a faster edge after leading-edge sensing. A first BLE signal 4400 represents the bit stream from the protocol module 3924 of FIG. 38. A second BLE signal 4402 represents the bit stream from the GFSK modulator (or Gaussian filter) 3926. A third BLE signal 4404 represents a stronger BLE packet signal transmitting on a faster edge after leading-edge sensing of the Gaussian bits. The third BLE signal 4404 may be generated by an attacking device. As can be seen, the edges are sloping and transitioning faster than the transitions of the second BLE curve 4402. This causes the corresponding bits to be earlier than the bits in the second plot (or the output of the GFSK modulator 3924). The area where a difference may be detected is indicated by an oval 4406. The bits corresponding to the first BLE curve 4400 are shown above the first BLE curve 4400. The bits corresponding to the second BLE curve 4402 are shown below the second BLE curve 4402. The bits corresponding to the third BLE curve 4404 are shown below the bits of the second BLE curve 4402 and are shifted left relative to the bits of the second BLE curve 4402.

[0305] FIG. 44 shows second and third BLE curves 4402, 4404 of FIG. 43, where the third BLE curve 4404 is shifted relative to the second BLE curve 4402. To defend against bit acceleration attacks, the following process can be performed. A bit acceleration attack occurs when an attacking device accelerates the transmission of a BLE signal, such as a BLE signal transmitted from a key fob and / or other portable access device, to account for delays associated with the attacking device receiving, processing, and / or modifying the BLE signal, and forwarding it. FIG. 45 shows an example of a method for detecting a range extension type relay attack. The following process in FIG. 45 is described primarily with respect to the embodiments of FIGS. 2-6, 11, and 14, but the process can be easily modified to apply to other embodiments of the present disclosure. The process can be performed iteratively. The following process can be performed by, for example, one or more of modules 210, 211, and 212.

[0306] The method may begin at 4600. At 4602, a sliding correlation function is used to align a received input waveform to an ideal Gaussian waveform (or other suitable predetermined waveform) of known bit pattern and bit rate, scaling the peaks of the received input waveform and the predetermined waveform, or aligning a zero offset. This may be done by the correlation protocol module 3920 of FIG. 38. This may be done, for example, to identify a synchronization access word. An example of this is shown in FIG. 44.

[0307] At 4604, portions (or parts) 4605 of the received waveform that occur earlier in time after a zero crossing of the given waveform and before the next peak are integrated and accumulated (or summed), referred to as positive accumulation.

[0308] At 4606, a portion (or portions) 4607 of the received waveform that occurs later in time after the peak and before the next zero crossing is integrated and accumulated, also referred to as positive accumulation.

[0309] At 4608, the resulting accumulated values determined at 4604 and 4606 are averaged over the number of transitions used to provide an indication of the level of bit acceleration attack. The accumulated values may be averaged separately to provide two average values, or may be summed and then averaged to provide a single average value.

[0310] At 4610, it is determined whether an attack has occurred and / or is likely to have occurred based on the one or more averages and one or more predetermined thresholds. At 4612, if an attack has occurred and / or is likely to have occurred, operation 4614 is performed; otherwise, operation 4616 is performed. At 4614, an action is taken, such as one of the actions described above, including preventing access to and / or operation of the corresponding vehicle. One or more alerts may be generated. As another example of an action, data related to the attack may be stored in memory and / or transmitted to the vehicle owner's network device and / or a central monitoring station. At 4616, if an attack has not occurred and / or is likely not to have occurred, access to and / or operational control of the vehicle is permitted. Operational control may include, for example, unlocking or locking the vehicle doors, remotely starting the vehicle engine, adjusting the vehicle's interior climate controls, etc. At 4618, one or more averages may be discarded and / or older consolidated and accumulated data may be discarded. When a sliding window is used to monitor the received signal, older portions of the data may be discarded and more recent portions may be retained for subsequent integration, accumulation, and averaging with newly received data.

[0311] FIG. 46 shows a vehicle 5200 including a round trip time (RTT) responder 5202 and an RTT initiator 5204, and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210. As used herein, an "initiator" refers to a network device including a BLE radio, transmitter, and / or receiver that can initiate a signal or tone exchange. As used herein, a "responder" refers to a network device including a BLE radio, transmitter, and / or receiver that can respond to signals and / or tones received from the initiator. The RTT responders 5202, 5210 and the RTT initiators 5204, 5208 may be implemented by, for example, RF antenna module 40, RF circuitry 223, and / or modules 210, 211, 212 of FIG. 3 and may include corresponding transmit and receive circuitry. The vehicle 5200 may include an antenna module with a single circularly polarized antenna, as described above. The RTT responder 5202 and the RTT initiator 5204 can transmit and receive using the antenna. The antenna provides polarization diversity, with the antennas used by the RTT initiator 5208 and the RTT responder 5210 (e.g., single polarized antennas) such that at any one time, at least one of the illustrated antennas of the vehicle 5200 has at least one polarization axis that is not cross-polarized and not co-polarized with the polarization axis of at least one of the antennas of the portable access device 5206.

[0312] Each of the devices 5202, 5204, 5208, and 5210 includes the control module described above and can perform any of the described processes. The devices 5202, 5204, 5208, and 5210 can transmit and receive RF signals on random channels (e.g., 40 BLE channels across an 80 MHz spectrum). The devices 5202 and 5208 can communicate with each other, including transmitting and receiving signals, while the devices 5204 and 5210 can communicate with each other, including transmitting and receiving signals. Communication between the devices 5202 and 5208 can occur simultaneously with communication between the devices 5204 and 5210. Signal transmissions to determine RTT can be transmitted in both directions simultaneously for security reasons and attack detection. The devices 5202 and 5204 can share a communication frequency with the portable access device 5206. The frequencies can be presented in a predetermined order and followed by the devices 5202, 5204, 5208, and 5210. When a bandpass filter is used to monitor two channels simultaneously, the filter introduces a propagation delay.

[0313] A typical bandpass filter has a delay of 0.5 times the bandwidth (i.e., 0.5 / bandwidth). The protocol's channel spacing, randomness in channel selection, randomness in transmission direction over time, and simultaneous transmissions force the bandpass filter to detect bits with a large group delay compared to the measurable round-trip time delay. This increases the difficulty for an attacking device to perform a range extension type relay attack. The vehicle 5200 and the portable access device 5206, respectively, can set their transmit power levels and transmit channel spacing such that, for example, an attacking device cannot implement a filter that is wide enough to receive the signal for relaying with a sufficiently short delay, but not wide enough to analyze the signal.

[0314] In one embodiment, a signal is transmitted and the direct time of flight is measured to determine whether there is a predetermined amount of delay (e.g., 10 to 500 nanoseconds (ns)) that is often associated with range extender-type attacking devices. When relaying signals between the vehicle 5200 and the portable access device 5206, the range extender-type attacking device may delay the transmitted signal by the predetermined amount. The described two-way, simultaneous transmission and reception makes it difficult for an attacking device to determine the frequency, channel, and direction of a signal being transmitted at any given time. It also makes it difficult for an attacking device to avoid relaying a signal without the predetermined amount of delay.

[0315] Figure 47 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210. Figure 47 shows signal paths through corresponding antennas 5300, 5302, 5304, and 5306. In one embodiment, antennas 5300 and 5302 have a total of three polarizations, and antennas 5304 and 5306 have a total of two polarizations. In another embodiment, antennas 5300 and 5302 have a total of two polarizations, and antennas 5304 and 5306 have a total of three polarizations.

[0316] FIG. 48 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210, and a range extension type relay attack device 5400. The range extension attack device 5400 includes a control module 5402 including a bandpass filter 5404, a bit signal direction detector 5406, and a bit acceleration attack module 5408. The bandpass filter 5404 is used to detect incoming bits, which have an associated delay. The bit signal direction detector 5406 determines the direction in which the bits are traveling (e.g., from the vehicle to the portable access device or from the portable access device to the vehicle). The bit acceleration attack module 5408 can accelerate bits without introducing delay into some of the symbols (or bits), which can be detected using a sliding correlation function that averages the shape of the symbols (or bits) over multiple symbols (or bits) and fits them to an ideal waveform. The described delay times can be detected by the vehicle's access module when determining whether an attack is taking place.

[0317] As shown, the range extension attack device 5400 includes an amplifier 5410, such as a low noise amplifier (LNA) and a power amplifier, for reception and transmission purposes. The range extension attack device 5400 may also include a mixer for downconversion and upconversion purposes. The amplifier 5410 is connected to an antenna 5412.

[0318] In addition to performing the described simultaneous communications, the channels can be pseudo-randomly selected and the access addresses can also be pseudo-randomly selected. This random selection can occur at the vehicle and be pre-shared with the portable access device. Conversely, the selection can occur at the portable access device. Conversely, the selection can occur via secure cryptographic techniques, with key material from either or both devices contributing to the pseudo-randomly selected sequence of channels and / or the sequence of access addresses. In this case, the pseudo-random sequence of access addresses serves as a cryptographically secure sequence of bits exchanged for round-trip timing measurements. By performing simultaneous transmission and reception on random channels using randomly selected access addresses, where the response is on the same channel as the initiator and the response access address is not the same as the initiator access address, it is difficult for a range extension attack device to perform an attack without being detected by the vehicle's access module and / or the control module of one or more portable access devices. A range extension attack device must simultaneously listen to all channels in both directions, determine which direction a message is passing through the range extension attack device, and then detect the bit early and transmit that bit early in both directions an appropriate amount of time to convince the vehicle and the initiator of one or more portable access devices that the portable access device is closer than it actually is and at an appropriate distance from the vehicle to grant access and / or operational control to the vehicle. Additionally, by using a Gaussian filter on the BLE bits, the attack device has a small window, less than the early bit detection time of approximately 10 to 100 ns, that it can use to detect the bit and transmit the bit early.

[0319] In one embodiment, RF signals associated with the above simultaneous communications are monitored by modules 210, 211, and 212 of FIG. 3, and the illustrated initiator and responder monitor and / or determine the RSSI value and antenna polarization state (e.g., the degree of polarization between the transmit and receive antennas) of the signals. Based on the RSSI value and polarization, one or more modules 210, 211, and 212 determine the best path, frequency, channel, and antenna pair for communication. Signals associated with the shortest path (or least interference), best RSSI value, maximum polarization, etc., are used to indicate which path, frequency, channel, and antenna pair should be used. This information can also be used to determine which device transmits and which device receives at any given time. The selection of transceiver chips and channels in each device may be randomized. In one embodiment, one device (either a vehicle or a portable access device) can transmit while another device is not transmitting, but rather receiving. The roles are then reversed so that the first device is receiving while the second device is transmitting and not receiving.

[0320] While many of the techniques described above and below involve monitoring, generating, receiving, transmitting, and / or measuring various parameters at a vehicle access module and detecting range extension type relay attacks based on this information, those techniques may be modified so that some or all of their processing is performed in a control module (or other module) of a portable access device, such as any of the portable access devices disclosed herein. Similarly, while various processing is described as being performed at the portable access device, those processing may also be performed at the vehicle's access module.

[0321] Examples of various BLERF transmission frequencies are 2.410 gigahertz (GHz), 2.412 GHz, 2.408 GHz, and 2.414 GHz. These and other frequencies may be used by RTT initiators and responders and / or corresponding transmitters and receivers.

[0322] In one embodiment, other transmitters on vehicles and / or portable access devices can be used to lightly load one or more channels, forcing attacking devices to have narrow low-pass filters to detect the RF signals transmitted by the initiator and responder. The one or more channels may include or be near the channels used by the initiator and responder. The signals transmitted on one or more channels may be dummy signals.

[0323] FIG. 49 shows two BLE radios 3900 (designated 3900A and 3900B). The first BLE radio 3900A acts as an initiating and measuring device. The second BLE radio 3900B acts as a reflecting (or responding) device. The initiating and measuring device 3900A can measure the RTT of a packet transmitted from the first BLE radio 3900A to the second BLE radio 3900B, the time for the second BLE radio to respond, and the time for the packet to be transmitted from the second BLE radio 3900B to the first BLE radio 3900A. In another embodiment, the RTT includes the time for a packet to be transmitted from the processing module 3922A of the first BLE radio 3900A to the correlation and protocol module 3920B of the second BLE radio and back from the processing module 3922B or protocol module 3924B to the demodulator 3918a or correlation and protocol module 3920A. This may include measuring the travel time from processing module 3922A, through protocol module 3924A, GFSK modulator 3926A, D / A and low pass filter 3928A, upconverter 3920A, power amplifier 3932A, switch and balun 3908A, and band pass filter 3906A, to BLE radio 3900B, and then through band pass filter 3906B, switch and balun 3908B, low noise amplifier 3910B, downconverter 3912B, band pass filter and amplifier 3914B, A / D 3916B, and demodulator 3918B to correlation and protocol module 3920B. The travel time from demodulator 3918B or correlation and protocol module 3920B to protocol module 3924B or processing module 3922B may also be determined. From protocol module 3924B or processing module 3922B, the time can also be determined via GFSK modulator 3926B, D / A low pass filter 3928B, upconverter 3930B, power amplifier 3932B, switch balun 3908B, band pass filters 3906B, 3906A, switch balun 3908A, low noise amplifier 3910A, downconverter 3912A, band pass filter amplifier 3914A, A / D 3916A, and demodulator 3918A or correlation protocol module 3920A.Although BLE radio 3900A is described as the initiator and BLE radio 3900B is described as the responder, the processing roles can be reversed such that BLE radio 3900B is the initiator and BLE radio 3900A is the responder.

[0324] The following processes may be performed to accurately determine the RTT between two BLE radios in a vehicle (e.g., BLE radios 3900A, 3900B in FIG. 49 ) and / or between a BLE radio in the vehicle and a BLE radio in a portable access device. The processes are performed to prevent attacks and / or to easily detect when an attack is being performed and / or has already occurred. The following processes may be performed separately or in any combination. In one embodiment, a large number of predetermined packets are exchanged between the BLE radios. The initiator may measure and / or estimate the RTT of signals transmitted between the BLE radios. This may include the time T1 when a packet is transmitted from a first BLE radio to a second BLE radio, the time T2 when the second BLE radio responds, the time T3 when the second BLE radio transmits the packet back to the first BLE radio, and the time T4 when the first BLE radio receives the packet from the second BLE radio.

[0325] In one embodiment, the A / D and D / A clocks of the BLE radio and / or phase-locked loop are dithered between packets. In addition to dithering the clocks when possible, a cryptographically random variation may be added, which is known in BLE radios for when the least significant bit (LSB) generated by a digital timer is transmitted. The cryptographically random variation is used so that an attacking device cannot predict the exact moment when a transmission will occur.

[0326] In one embodiment, each packet contains a pre-agreed large cryptographically random multi-bit identifier (PACRMBI), e.g., 16-256 bits. In another embodiment, the bit content of packets from the initiator and the responder is indistinguishable to an attacking device. An attacking device cannot determine from which direction a packet came or whether a packet is an initiator packet or a responder packet based on the bit content of the packet.

[0327] In one embodiment, the channels of the BLE radios are cryptographically randomized. In one embodiment, the determination of which of the BLE radios is the initiator or responder is cryptographically randomized. In one embodiment, one or both of the BLE radios transmit dummy packets that an attacking device cannot distinguish from other packets transmitted by the BLE radios. The selection of which BLE radio transmits the dummy packets is cryptographically randomized and can be switched randomly. This makes it difficult for an attacking device to determine which are valid packets and in which direction packets are being transmitted between the BLE radios.

[0328] In one embodiment, the polarization of the antenna sets used by the BLE radios is initially cryptographically randomized. Heuristics are used to select which antenna permutation provides the best "antenna-channel" across the set of channels between the BLE radios. This may include using heuristics to select higher received signal strength, compensating for antenna gain versus frequency and monitoring across multiple channels, using antenna combinations with the highest average or median power, and / or using Rayleigh fading or Kalman filter estimators. This reduces cryptographically random antenna patterns and focuses on "antenna-channels" with maximum power and minimum cross-polarization.

[0329] In one embodiment, the in-phase and quadrature (IQ) streams at the receiver are upsampled (or interpolated) before transmitting an idealized upsampled IQ stream matching the PACRMBI to a corresponding correlation protocol module in the BLE radio. As an alternative to using PACRMBI, the message to be transmitted may be encrypted and, upon reception, bit-decoded and converted to an ideal upsampled IQ stream. The two upsampled streams may be sent through a correlation protocol module 3920, which may monitor the upsampled clock edge for which there is sufficient correlation to match that of the PACRMBI. The correlation protocol module 3920 selects the maximum matching clock edge. Other clock recovery methods may be used to interpolate sub-bit timing in the round-trip timing of the communication channel bit stream. This may be performed in combination with upsampled correlation or in combination with regular clock sampling.

[0330] In one embodiment, amplifier settings are communicated between BLE radios, sufficient to compensate for any frequency or amplifier gain variations in propagation delay between BLE radios.

[0331] In another embodiment, the measured die temperature within the BLE radios is communicated (or shared) between the BLE radios to compensate for any temperature-based frequency or amplifier gain variations in propagation delay between the BLE radios.

[0332] Another process that can be performed is to communicate balun variations between BLE radios. Another process is to add a short (e.g., 6 μs) but cryptographically random length (e.g., 4-8 μs) continuous wave tone to the packet pair to perform round-trip timing measurements while simultaneously performing tone-exchange ranging.

[0333] FIG. 50 illustrates a position and distance determination system 5600 including an RTT initiator 5602, an RTT responder 5604, and an RTT sniffer 5606. The RTT initiator 5602 and the RTT responder 5604 may function as any of the initiators, responders, BLE radios, and RF circuitry disclosed herein. The RTT sniffer 5606 may be co-located with one of the RTT devices 5602, 5604 in a vehicle and include one of the antenna modules 40 of FIG. 2, while the RTT device in the vehicle includes another one of the antenna modules 40. Each of the devices 5602, 5604, 5606 may include a control module as described above and perform any of the described processes. The polarization diversity described above is provided between the antennas of the RTT devices 5602, 5604, and between the antenna of one of the RTT devices 5602, 5604 in the vehicle and the RTT sniffer 5606. Polarization diversity is particularly utilized when performing round-trip timing measurements. Each of the RTT devices 5602, 5604 can include a single circularly polarized antenna.

[0334] One of the RTT devices 5602, 5604 in the vehicle is referred to as the master device, while the other RTT device 5602, 5604 is referred to as the slave device. When the master device transmits a challenge signal to the slave device, the RTT sniffer 5606 acts as a listener and detects (i) when the challenge signal is transmitted and / or when the challenge signal is received by the RTT sniffer 5606, and (ii) when the slave device transmits a response signal to the challenge signal and / or (iii) when the RTT sniffer 5606 receives the response signal. The RTT sniffer 5606 can then determine the location of the slave device using triangulation based on the transmission and / or reception times of the challenge signal and the response signal. The master device can also measure the round-trip timing associated with the challenge and response signals to measure the direct path between the antennas instead of the bounce path. This aligns antenna nulls and prevents cross-polarization.

[0335] The master device and RTT sniffer 5606 work together to estimate the distance to the slave device. The following equations 5-7 are executed by the master device to estimate the length of time T during which the challenge signal is transmitted from the master device to the slave device. MS Determine where T SM is the length of time that the response signal is sent from the slave device to the master device, and T RX is the time when the response signal is received by the master device, and T TX is the time when the challenge signal is sent from the master device, and T SDELAY is the length of delay time after receiving the challenge signal before the slave device responds with a response signal, and FixedOffset1 is the length of a first offset time, which may be 0 or greater.

number

number

number

[0336] The RTT sniffer 5606 knows when the challenge signal was received at the RTT sniffer 5606, when the response signal was received at the RTT sniffer 5606, and the number of slave clock cycles between when the slave device received the challenge signal and when the slave device sent the response signal. The RTT sniffer 5606 (or listener) uses Equation 8 to determine the time T SLRX and the time T when the RTT sniffer 5606 receives the challenge signal. MLRX where T can be determined as the difference between SL is the length of time until the RTT sniffer 5606 receives a response signal, FixedOffset2 is the length of the second offset time, which may be 0 or greater, and T ML is the length of time until the RTT sniffer 5606 receives the challenge signal, and T SLRX is the time when the RTT sniffer 5606 receives the response signal, and T MLRX is the time at which the RTT sniffer 5606 receives the challenge signal.

number

[0337] Because the master device and RTT sniffer 5606 work together, information is shared so that one or more of these devices can estimate the distance to a slave device based on Equations 9-11. MS and T SL The sum of can be substituted to provide equations 9-11.

number

number

number

[0338] FIG. 51 illustrates another position and distance determination system 5700 including an RTT initiator 5702, an RTT responder 5704, and multiple RTT sniffers 5706. The RTT initiator 5702 and the RTT responder 5704 may function as any of the initiators, responders, BLE radios, or RF circuits disclosed herein. The RTT sniffer 5706 is co-located with one of the RTT devices 5702, 5704 in the vehicle and includes an antenna module (similar to antenna module 40 of FIG. 2). Each of the devices 5702, 5704, and 5706 includes a control module as described above and can perform any of the described processes. The RTT devices in the vehicle may also include an antenna module similar to antenna module 40 of FIG. 2. Polarization diversity is provided between the antennas of the RTT devices 5702, 5704, and between the antenna of one of the RTT devices 5702, 5704 in the vehicle and the RTT sniffer 5706. Polarization diversity is particularly utilized when performing round-trip timing measurements to measure the direct path between the antennas rather than the bounce path. This allows the antenna nulls to be aligned and prevents cross polarization.

[0339] One of the RTT devices 5702, 5704 in the vehicle is referred to as the master device, while the other RTT device 5702, 5704 is referred to as the slave device. When the master device sends a challenge signal to the slave device, the RTT sniffer 5706 acts as a listener to detect when the challenge signal is sent and when the slave device sends a response signal to the challenge signal. The RTT devices 5702, 5704 can operate similarly to the RTT devices 5602, 5604 in FIG. 50. Each of the RTT sniffers 5706 can operate similarly to the RTT sniffer 5606.

[0340] The time TAB is the length of time it takes for a challenge signal to be transmitted from the RTT initiator 5702 to the RTT responder 5704. The time TBA is the length of time it takes for a corresponding response signal to be transmitted from the RTT responder to the RTT initiator. The time TAC is the length of time it takes for the first RTT sniffer to receive the challenge signal. The time TBC is the length of time it takes for the first RTT sniffer to receive the response signal. The time TAD is the length of time it takes for the second RTT sniffer to receive the challenge signal. The time TBD is the length of time it takes for the second RTT sniffer to receive the response signal. The time TAE is the length of time it takes for the third RTT sniffer to receive the challenge signal. The time TBE is the length of time it takes for the third RTT sniffer to receive the response signal. If TAB and TAC are known, TBC can be calculated. If TAB and TAD are known, TBD can be calculated. If TAB and TAE are known, TBE can be calculated.

[0341] If there are enough RTT sniffers, the time TAB can be calculated. For example, if three RTT initiators know their positions relative to the master device (or initiator), the time TAB can be calculated. This can be achieved using Equations 12-17, assuming all reflections are instantaneous, where TRxAC is the time when the first RTT sniffer receives the challenge signal, TRxBC is the time when the first RTT sniffer receives the response signal, TRxAD is the time when the second RTT sniffer receives the challenge signal, TRxBD is the time when the second RTT sniffer receives the response signal, TRxAE is the time when the third RTT sniffer receives the challenge signal, and TRxBE is the time when the third RTT sniffer receives the response signal. where deltaRxAtC is the time when the first RTT sniffer receives the response signal and the first RTT sniffer receives the challenge signal, deltaRxAtD is the time difference between the time when the second RTT sniffer receives the response signal and the time when the second RTT sniffer receives the challenge signal, and deltaRxAtE is the time difference between the time when the third RTT sniffer receives the response signal and the time when the third RTT sniffer receives the challenge signal. The location of the slave device (or responder) can also be determined using Equations 18-25, where xa is the x coordinate of the master device, ya is the y coordinate of the master device, za is the z coordinate of the master device, xb is the x coordinate of the slave device, yb is the y coordinate of the slave device, zb is the z coordinate of the slave device, xc is the x coordinate of the first RTT sniffer, yc is the y coordinate of the first RTT sniffer, zc is the z coordinate of the first RTT sniffer, xd is the x coordinate of the second RTT sniffer, yd is the y coordinate of the second RTT sniffer, zd is the z coordinate of the second RTT sniffer, xe is the x coordinate of the third RTT sniffer, ye is the y coordinate of the third RTT sniffer, and ze is the z coordinate of the third RTT sniffer.The x, y, and z coordinates of the master and slave devices are known, and the x, y, and z coordinates of the slave device are determined. TBC, TBD, and TBE can be determined in the same manner as above.

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0342] When three RTT sniffers (e.g., RTT sniffer 5706 shown) are used, a trilateration can be performed using three circles to measure the distance and determine the position of a slave device relative to one of the RTT devices 5702, 5704 and / or the corresponding vehicle. This can be performed by the master device and / or one or more RTT sniffers. Information determined by the master device and the RTT sniffers can be shared with each other. Time, distance, and / or position can be determined and updated periodically.

[0343] In a vehicle, if an object (e.g., the head of a vehicle occupant) is present near and / or between the master device and one or more RTT sniffers' antenna modules such that the object interferes with the signals transmitted by the master device, the round-trip timing measurements may be periodically updated. This may be done to measure the distance between the master device and the RTT sniffers and to detect when the corresponding physical environment / system has changed.

[0344] FIG. 52 shows a first network device (or vehicle) 5800 and a second network device (or portable network device) 5802. The first network device 5800 includes a tone exchange responder 5804 and a tone exchange initiator 5806. Tone exchange is also referred to as unmodulated carrier tone exchange. The second network device 5802 includes a tone exchange initiator 5808 and a tone exchange responder 5810. The devices 5804, 5806, 5808, 5810 may be implemented as any of the other BLE radios, RF circuits, initiators, responders, etc. disclosed herein. At least one of the devices 5804, 5808 and at least one of the devices 5806, 5808 may include or be connected to a single-polarized antenna and a circularly polarized antenna. Each of the devices 5804, 5806, 5808, 5810 may include the antenna module 40 of FIG. 2 and / or the antenna shown in FIG.

[0345] Tone exchanges may be performed between the responder 5804 and the initiator 5808, and between the initiator 5806 and the responder 5810. The RTT measurements may be transmitted in the same packets as the exchanged tones. The devices 5804, 5806, 5808, 5810 may randomly select a channel to use for transmitting packets. Transmission of packets may occur simultaneously with reception of packets. For example, the initiator 5808 may transmit a tone to the responder 5804 on a first channel while the initiator 5808 receives a tone from the responder 5804 on a second channel. The initiator 5806 may transmit and / or receive a tone while the initiator 5804 is transmitting and / or receiving a tone.

[0346] The network devices 5800, 5802 may be synchronized in advance, for example, through an exchange of sequence signals (or handshake) to synchronize the clocks of the network devices 5800, 5802. This synchronization may be performed to allow the network devices to simultaneously transmit signals to each other. As an example, two 1 MHz signals may be transmitted, each transmitting data at 1 Mbps. The signals may be spaced 2 MHz apart from each other. This prevents an attacking device from being able to perform attacks such as range extension attacks or attacks involving active manipulation of tones. If an attacker uses a 1 MHz-wide bandpass filter, the delay time of the bandpass filter will be too long to respond quickly enough to allow an attack. If an attacker uses a wideband bandpass filter, such as a 4 MHz bandpass filter, the corresponding signal eye diagram will be too noisy to distinguish the signals transmitted by the network devices 5800, 5802. As another example, signals may be transmitted from the network devices at a symbol transmission rate equal to or less than a predetermined time length (e.g., 1 μs per symbol). This allows for rapid transmission and prevents attacks. Additionally, two simultaneous signals further hinder an attacker's success, as the attacker must detect and affect both signals. As noted above, both signals may be transmitted at different frequencies by the same network device or different network devices.

[0347] The devices 5804, 5806, 5808, 5810 can change the frequency of the transmitted tone, monitor the change in phase due to the frequency change, and determine the distance between the network devices 5800, 5802 based on the change in phase. This is sometimes referred to as carrier-phase-based ranging. Alternatively, if signals are transmitted and received as a result of the signal being reflected back to the source, the phase difference between the transmitted and received signals can be used to determine the modulo of the distance between the source and reflector. Similarly, the initiator can determine the modulo of the distance between the initiator and responder based on the phase difference between (i) a signal transmitted from the initiator to the responder and (ii) a corresponding response signal transmitted from the responder back to the initiator. The slope of the phase difference with respect to the amount of change in frequency corresponds to or equals the distance, limited by the frequency step size. The smaller the frequency step, the greater the modulo rollover distance (see "On the Security of Carrier Phase Based Ranging" by Olafsdotter, Ranganathan, and Capkun, which is incorporated herein by reference).

[0348] As another example, received signal strength indicator (RSSI) parameters can be monitored to determine whether a network device is close to a vehicle, and then a series of tone exchanges can be performed to measure distance. Tone exchanges can also be performed based on the user's touch of a door handle to verify the absence of an attack. Multiple round-trip timing measurements can also be performed to determine the distance of a network device relative to a vehicle.

[0349] The distance determination techniques described above may be used in combination with other techniques disclosed herein to determine RTT values. The direction of travel of tones between devices 5804, 5806, 5808, 5810 may be randomized.

[0350] In one embodiment, the control module of the first network device 5800 plots the change in phase versus the change in frequency for each of the exchanged tones to generate multiple linear curves. The control module determines the slope of the curve, which provides the rate of change in phase relative to the change in frequency. The slope is then used to determine the distance between adjacent ones of the curves, which is related to the distance between the first and second network devices 5800, 5802.

[0351] FIG. 53 shows a positioning system 5900 including a tone exchange initiator 5902, a tone exchange responder 5904, and a tone exchange sniffer 5906. The tone exchange initiator 5902 and the tone exchange responder 5904 may function as any of the initiators, responders, BLE radios, or RF circuitry disclosed herein. The tone exchange sniffer 5906 may function similarly to the RTT sniffer 5606 of FIG. 50, be co-located with one of the tone exchange devices 5902, 5904 in the vehicle, and include one of the antenna modules 40 of FIG. 2, while the tone exchange device in the vehicle includes the other one of the antenna modules 40. Each of the devices 5902, 5904, 5906 may include the control modules described above and perform any of the described processes. Polarization diversity is provided between the antennas of the tone switched devices 5902, 5904, and between the antenna of one of the tone switched devices 5902, 5904 located in the vehicle and the tone switched sniffer 5906. Polarization diversity is particularly utilized when performing round trip timing measurements.

[0352] One of the tone exchange devices 5902, 5904 in the vehicle is referred to as the master device, while the other one of the tone exchange devices 5902, 5904 is referred to as the slave device. When the master device transmits a tone to the slave device and vice versa, the tone exchange sniffer 5906 acts as a listener and detects (i) when a tone is transmitted to and / or received by the tone exchange sniffer 5906, (ii) when a slave device transmits a tone to the master device, and / or (iii) when the tone exchange sniffer 5906 receives a tone transmitted by a slave device. The slave device acts as a reflector and can transmit a tone received from the master device back to the master device. The master device and / or sniffer device can prevent at least one of access to or operational control of the vehicle based on the arrival time of the tone, round-trip timing measurements, and / or the estimated distance between the devices.

[0353] FIG. 54 illustrates a method for determining distance between an initiator and a responder, and between a responder and a sniffer. The following process of FIG. 54 is described primarily with respect to the embodiments of FIGS. 50 and 53, but the process can be easily modified to apply to other embodiments of the present disclosure, such as the embodiments of FIGS. 2-6, 11, 14, 39, and 46-49. The process can be performed iteratively. While the method is described primarily with respect to the embodiment of FIG. 53, the method can be applied to other embodiments of the present disclosure.

[0354] The method may begin at 6000. At 6002, a tone exchange initiator 5902 transmits a tone signal including a tone to a tone exchange responder 5904. The tone may be a signal e(jωt+Φ A )·τ AB where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, τ AB is the time to travel from A to B and is directly related to the distance between the tone exchange initiator 5902 and the tone exchange responder 5904, ω is the frequency, φ Ais the phase of the tone at the tone exchange initiator 5902, and t is time.

[0355] At 6004, the tone is B and received at Tone Switch Responder 5904 with delay φ C At the tone switched responder 5904, the received tone signal is downconverted to baseband, which can be expressed as Equation 26:

number

number

[0356] In 6006, tone exchange initiator 5902 receives a tone from tone exchange responder 5904, which retransmits the tone signal as a second tone signal to tone exchange initiator 5902. The tone is expressed as e(jωt+Φ A )·τ AB The received second tone signal can be expressed by Equation 28. The tone-switched sniffer 5906 also receives a second tone signal that can be expressed by Equation 29.

number

number

[0357] At 6008, tone exchange initiator 5902 receives from tone exchange responder 5904 a phase signal indicating a natural logarithm tone value comprising the difference in phase of the tones as received at tone exchange responder 5904. Thus, tone exchange responder 5904 sends the measured phase to tone exchange initiator 5902, where the values are multiplied as represented by Equation 30.

number

[0358] In 6010, the tone exchange sniffer 5906 determines, based on the received tone signals, tone values related to the difference in phase of the tone between when it was transmitted from the tone exchange initiator and when it was received at the tone exchange sniffer, and the difference in phase of the tone between when it was transmitted from the tone exchange responder and when it was received at the tone exchange sniffer. The tone values are determined as e(jωτ BC +φ B -φ C ) and e(jωτ AC +φ A -φ C )

[0359] In 6012, the initiator 5902 and / or sniffer 5906 determine the distance between the initiator 5902 and the responder 5904, and the distance between the initiator 5902 and the sniffer 5906. The distance values can be determined in a similar manner to sniffing the round trip time above, see, e.g., Equations 12 and 15 and the corresponding discussion. Instead of round trip time, phase is used. This calculation involves the use of Equation 31, where the tone value e(jωτ BC +φ B -φ C ) and e(-jωτ AC -φ A +φ C ) is measured or determined by the sniffer 5906, and e(jωτ AC ) is known a priori, and the tone values e(jωτ AB +φ A -φ B) is determined by the responder 5904.

number

[0360] FIG. 55 illustrates an example of a passive tone exchange and phase difference detection system 6100. The system 6100 includes a phase-locked loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and an antenna module 6110. The antenna module 6110 may be similar to the antenna module 40 of FIG. 2. The transmitter 6106 transmits a first tone, which is the output of the PLL 6102 and is reflected by a reflector 6112 back to the receiver 6108. The output of the PLL and the reflected tone signal are provided to the phase module 6104. The phase module 6104 determines the phase difference between the output of the PLL and the reflected tone signal. The phase module 6104, or other modules disclosed herein, may determine the distance between the transmitter 6106 and the reflector 6112 based on the phase difference. The phase module 6104 or other modules disclosed herein may prevent access to the interior of the vehicle and / or control of the vehicle's operation based on the determined distance.

[0361] FIG. 56 illustrates an example of an active tone exchange and phase difference detection system 6200. The system 6200 operates similarly to the system 6100 of FIG. 55. The transmitter and receiver 6106, 6108 are represented by a box 6202. The reflector 6112 of FIG. 55 can be replaced with a responder device 6204 for active tone exchange. The responder device 6204 can receive a first tone signal including one or more first tones from the transmitter 6106 and respond with a second tone signal. The second tone signal can include one or more tones and / or one or more other tones. The second tone signal is transmitted back to the receiver 6108.

[0362] 57 shows an initiator packet 6300 and a response packet 6302 used to measure RSSI and time of flight. The initiator packet 6300 may include multiple fields such as a preamble, a synchronization access word (e.g., a pseudo-random synchronization access word), a data field containing data, a cyclic redundancy check (CRC) field containing CRC bits, and a continuous wave (CW) tone field containing a CW tone. The response packet 6302 may include a CW tone field, a preamble, a synchronization access word, a data field, and a CRC field.

[0363] The initiator device can transmit an initiator packet 6300, which can be received by the responder device. The responder device can then generate a response packet 6302 and send the response packet back to the initiator device. This can be done for tone exchanges, phase difference determinations, round-trip timing measurements, etc. The distance between the devices can then be determined. These measurements and calculations can be performed to detect a range extender-type relay station attack. In one embodiment, the initiator and responder pre-negotiate what the synchronization access word will be based on a predetermined list. The synchronization access word includes an access address. The initiator can, for example, measure the length of time it takes to receive (i) a response packet after transmitting an initiator packet and / or (ii) a synchronization access word. The length of time and the synchronization access word can be compared to a predetermined length of time and a predetermined synchronization access word. If the comparison results in a match, a range extender-type relay station attack is not occurring. However, if the received synchronization access words do not match and / or the length of time differs from the expected value by more than a predetermined amount, a range extender type relay attack may be underway.

[0364] In one embodiment, the initiator and responder exchange a predetermined key, a list of synchronization access words, and the time at which each synchronization access word should be transmitted. When initially created, the synchronization access words can be randomly selected. This allows the responder to know the appropriate key and / or synchronization access word to respond to when it receives the initiator packet. The key can be included in the response packet. In another embodiment, the initiator and response packets do not include a preamble, as shown in Figure 58. In one embodiment, the CW tone is 4-10 μs in length.

[0365] In another embodiment, the initiator packet and the response packet have the same format as shown in Figure 59. Each packet includes a first CW tone as the first field, a synchronization access word, a data field, a CRC field, and a second CW tone as the last field. Another example of initiator and response packets with the same format is shown in Figure 60, where each packet includes a first CW tone as the first field, a synchronization word containing the PACRMBI, a PDU field containing the PDU, a Medium Access Controller (MAC) field, a CRC field, and a second CW tone as the last field. The CW tones in Figures 57-60 are cryptographically random-length tones that may be checked by the initiator upon reception. For example, if the CW tone received from the responder is incorrect, a range extender-type relay attack may be occurring. In the embodiment of Figures 59-60, the round-trip timing of the synchronization word prevents the CW tone exchange from wrapping beyond an uncertain range (e.g., 75 meters) in 2 MHz channel tone steps. The initiator and responder packets may be transmitted at the same frequency. By making the initiator and responder packets the same format, an attacking device cannot distinguish which packets are initiator and which packets are responder packets. In one embodiment, no CW tone is included at the end of the packets.

[0366] In one embodiment, the timing, frequency, length, power level, amplitude, and content of the CW tone and sync access word of the initiator and responder packets are checked at the initiator and responder to determine if they are correct and / or consistent to identify if an attack is occurring. In one embodiment, a pseudo-random number of packets are exchanged on a first frequency before changing to the next frequency and exchanging another pseudo-random number of packets.

[0367] Because attacking devices typically include filters (e.g., low-pass filters, band-pass filters) and mixers (e.g., downconverters, upconverters), they introduce delays when relaying signals. To avoid detection of an attack by an attacking device, the attacking device must retransmit the received signal without any detectable delay. This makes it difficult for the attacking device to remain undetected. An attacking device could delay a signal by 500 ns, which could delay the signal by 500 feet (ft) in space. In order for the attacking device to advance tone transmission or begin tone transmission at the appropriate time, the attacking device may need to know in advance what is being transmitted. This is unlikely. This is especially true when a heterodyne receiver is used to receive the relayed signal. The heterodyne receiver converts the packets / tones into the in-phase (I)-quadrature-phase (Q) domain and captures them in the IQ domain. In the IQ domain, the phase difference is detected. If there is an attack, the delay caused by the attack can be detected in the IQ domain based on the phase difference. If the tones are shortened by the attacking device so that the corresponding synchronization access word arrives at the correct time, the timing and length of the CW tones will be incorrect and will be detected by the initiator.

[0368] In one embodiment, the initiator checks the received CW tone transmitted from the responder for (i) length relative to the start of the transmitted sync access word, (ii) consistent power (or amplitude) before and relative to the sync access word, and (iii) a consistent tone throughout the sync access word. A consistent tone may refer to a consistent frequency, power level, amplitude, etc. In another embodiment, the start and end times of the sync access word relative to the start of the first CW tone of the transmitted packet are known to be within a predetermined time (e.g., within ±10 ns). Thus, if the start and end times are within a predetermined range of the start of the first CW tone of the packet, there is no attack; if not, there may be an attack in progress.

[0369] As another example, the PLL of the initiator transmitting the tones may have three different tones that the PLL can generate on a given channel: a center tone, a high tone at a first frequency (e.g., 250 KHz), and a low tone at a second predetermined frequency (e.g., −250 KHz). The tones to be transmitted may be selected and transmitted according to a predetermined and agreed-upon random sequence and / or pattern of tones, which may be agreed upon between the initiator and the responder. The PLLs of the initiator and the attacking device may not be aligned with each other. If there is a frequency difference between the signal transmitted by the initiator and the signal received in response thereto that exceeds a predetermined threshold, the initiator may determine that an attack is occurring.

[0370] In one embodiment, the responder can measure what phase delay it detects in the signal it receives and respond with data. This can be based on the timing of the responder's receipt of the tail-end CW tone of a packet from the initiator. The responder can measure the phase delay between (i) the tail-end (or ending) CW tone of the packet received from the initiator and (ii) the front-end (or initial leading CW tone) of the packet being sent by the responder in response to the packet received from the initiator. The initiator can calculate the total two-way round-trip time of the packet from the initiator to the responder and back from the responder to the initiator.

[0371] In addition to detecting signal delays, the initiator can also detect when the attacking device amplifies the signal (or tone). Amplification of the signal / tone can also delay transmission, which can be detected. During tone relay at the attacking device, the tone may become distorted and / or a different tone may be transmitted than the originally transmitted tone.

[0372] The above example allows for more accurate distance measurements with fewer packets, each containing both the sync access word and the CW tone. The sync access word protects the CW tone from being modified by an attacking device without detection, and vice versa. A two-way randomized communication is performed that protects both the sync access word and the CW tone.

[0373] The initiator PLL disclosed herein can be a phase-predictable PLL that allows the initiator to predict the phase of a signal when its frequency is changed. This can eliminate the need to verify the correct timing of the CW tone transmitted by the initiator and the CW tone transmitted by the responder. The responder can, for example, measure the time when the tail-end CW tone from the initiator is received, determine the corresponding phase delay of the tail-end CW tone relative to the responder's generation of the front-end CW tone for the response signal, and transmit this information along with the front-end CW tone to the initiator. The initiator can then calculate the total round-trip time based on the received information.

[0374] In one embodiment, the initiator is one of the vehicle or the portable access device, and the responder is the other of the vehicle and the portable access device. The order in which the vehicle and the portable access device transmit and respond is pseudo-randomly changed. Also, packets and / or tone signals can be sent in response and used as initiator packets and / or initiator tone signals. In one embodiment, the order in which the vehicle and the portable access device transmit and respond is not changed during short exchange periods (e.g., exchange periods less than a predetermined period) and is changed during long exchange periods (e.g., exchange periods greater than or equal to a predetermined period). The order can be switched periodically. In these examples, antenna polarization diversity is used to exchange bidirectional data and provide correct timing measurements.

[0375] Processing is performed to provide accurate measurements of the start and end times of the CW tone and sync access word. The correlation protocol module 3920 can maintain a circular queue of bits and lock in to compare the start and end times and lengths of the CW tone and sync access word of the transmitted (initiator) packet with the start and end times and lengths of the CW tone and sync access word of the received (responder) packet. The correlation protocol module 3920 can interpolate where the zero crossing points are located. Post-processing of the I and Q data associated with the sync access word can be performed for clock recovery to interpolate when the sync access word arrives. The I and Q data may have different transition / spin rates. Interpolation can be performed to determine where the transition center points are to obtain accurate timing for clock recovery. Multiple zero crossing points can be detected and aligned for timing purposes. The I and Q data may also be oversampled, as described further below, to optimally fit / align to one or more bits.

[0376] Figure 61 illustrates an antenna routing system 6700 for network devices each having an antenna module. The antenna modules exhibit polarization diversity. In this example, two polarization axes are shown for each antenna module. Each antenna module includes a vertically oriented antenna and a horizontally oriented antenna. The possible channel vectors h VV , h VH , h HV , and h HH A ranging module 6710 is shown. The ranging module 6710 calculates the channel vector h VV , h VH , h HV , and h HH The ranging module executes a ranging algorithm to determine the range r VV , r VH , rHV , and r HH The determined range r can be determined. VV , r VH , r HV , and r HH is any range r VV , r VH , r HV , and r HH is provided to a minimum module 6712 which determines which path is shortest. The shortest path may be selected.

[0377] Each channel vector may be generated for one or more selected frequencies. When compared, ranges may be generated for channel vectors of the same or different frequencies. As an example, vectors may be generated for at least some of the 80 different tones in the 2.4 GHz Industrial, Scientific, and Medical (ISM) band, with a 1 MHz frequency step between adjacent tones. The frequency associated with the shortest range may be selected. Other factors, such as signal strength, amplitude, voltage, and parameter consistency, may also be considered in the selection. This path selection may be performed by any of the initiators, responders, modules, network devices, etc., disclosed herein and used for round-trip timing measurements. This allows the optimal antenna path to be selected for two-way packet and / or tone signal exchange to determine round-trip time.

[0378] Referring now to FIG. 38, FIG. 62 illustrates an example radio model 6800 corresponding to the structure, functionality, and operation of the BLE radio 3900 (and / or a modified version of the BLE radio 3900) and RF channel and corresponding RF circuitry of FIG. The radio model 6800 includes a first sampling module 6802, a time offset module 6804, a Gaussian low pass filter 6806, an integrator 6808, a first upsampler 6810, an amplifier 6812, a summer 6814, a modulator 6816, a second sampling module 6818, a phase and frequency offset module 6820, a first mixer 6822, a phase delay device 6823, a second mixer 6824, a phase delay module 6826, a second low pass filter 6828, a resample module 6830, an arctangent module 6832, a differentiator 6834, a sign decision module 6836, a bit pattern module 6838, a second upsampler 6840, a third upsampler 6842, a cross-correlation module 6844, and a peak detector 6846. Devices 6802, 6804, 6806, 6808, 6810, and 6812 represent an example of the transmitter portion of BLE radio 3900 or another BLE radio. Summer 6814 represents a channel between (i) another BLE radio and (ii) BLE radio 3900, including devices 3907, 3906, 3908, 3932, and 3910. Because the receiving BLE radio is not phase-locked to the transmitting BLE radio, there may be a phase and frequency offset between the receiving BLE radio and the transmitting BLE radio. Devices 6816, 6818, 6820, 6822, 6824, 6828, and 6830 correspond to the receiver portion of the BLE radio and are related to the RF sampling rate. Devices 6830, 6832, 6834, 6836, and 6838 also correspond to the receiver portion and perform processing on the baseband signal. Resample module 6830 functions as an analog-to-digital converter. Devices 6840, 6842, 6844, and 6846 also correspond to the receiver portion and are involved in interpolation to determine the phase.

[0379] When recovering the bit stream, the zero crossings of the reconstructed signal from the differentiator 6834 can be determined. There can be a significant amount of jitter at the zero crossings, which can adversely affect the determination of time of flight based on the timing of the zero crossings. Small amounts of jitter can adversely affect the determination of transmit and receive times.

[0380] The upsamplers 6840, 6842 and cross-correlation module 6844 are implemented to reduce jitter associated with sampling and zero-crossing determination. The upsamplers 6840, 6842 perform signal processing to interpolate and inject data points between existing received data points to achieve finer temporal resolution.

[0381] In one embodiment, the transmitted bit stream is known a priori to the BLE receiver and provided to the upsampler 6842, as indicated by arrow 6843. In this example, the code determination module 6836 and the bit pattern module 6838 are not included. In another embodiment, the transmitted bit stream is unknown, and the code determination module 6836 and the bit pattern module 6838 are included and provide an estimated bit stream to the upsampler 6842. As an example, the transmitted bit stream may be an access address indicating which device is transmitting. The estimated bit stream may be determined based on a reference. For example, the reference may be a preamble and / or a series of bits received before the bit stream is estimated. The preamble and / or series of bits provides a temporal reference based on which an estimated bit stream is generated. The estimated bit stream is generated based on a known clock frequency of the transmitter and is related to the transmitted signal and the receiver clock frequency.

[0382] The cross-correlation module 6844 performs a cross-correlation between the outputs of the upsamplers 6840, 6842, and / or between the output of the upsampler 6840 and the output of the bit pattern module 6838. The cross-correlation is performed to match the envelopes of the signals provided to the cross-correlator and determine the phase difference. The cross-correlation can include performing a product of the output signals, which involves taking the product of corresponding data points of the two output signals and summing the products. This multiply-and-accumulate operation is repeated, with each iteration incrementally shifting one of the outputs by one data point in time relative to the other, resulting in multiple product-and-accumulate results. The maximum product-and-accumulate value occurs when the two outputs are synchronized (or aligned) so that their waveforms match and are aligned in time. Based on this information, the phase offset (or difference) between the two outputs is determined.

[0383] The cross-correlation achieves increased resolution through upsampling performed by upsamplers 6840, 6842. The cross-correlation module 6846 correlates with a finer resolution signal than that originally received, thereby providing a finer interpolation of the arrival time of the received packet in the received signal. The higher the correlation resolution, the lower the signal-to-noise ratio and message bit length, allowing for finer resolution interpolation. The phase offset can be used to determine time-of-flight, as described herein. The peak detection module 6846 evaluates the cross-correlation results and indicates (i) when time-aligned peaks occurred and / or (ii) the phase offset. In one embodiment, the cross-correlation module 6844 receives a digital value, and the peak detection module 6846 determines whether the cross-correlation output (or sum-of-products value) reaches a predetermined threshold. If the predetermined threshold is reached, the peak detection module indicates "signal found" and the determined phase.

[0384] In one embodiment, the output of the upsampler 6840 is provided to the sign decision module 6836 and the cross-correlation module 6844, and no upsampler 6842 is included. In this example, the output of the bit pattern module 6838 is provided directly to the cross-correlation module 6844.

[0385] The devices of Figures 38 and 62 are further described with respect to the method of Figure 63. The following process of Figure 63 is described primarily with respect to the embodiments of Figures 2-6, 11, 14, and 38, but the process can be easily modified to apply to other embodiments of the present disclosure. The process can be performed iteratively.

[0386] The method may begin at 6900. At 6902, a sampling module 6802 of a first network device (e.g., a network device implemented in a vehicle as part of an in-vehicle system or a portable access device) receives a bitstream transmitted from the processing module 3922. The sampling module 6802 samples the bitstream.

[0387] At 6904, a time offset module 6804 receives the output of the sampling module 6802 and may introduce a time offset (or delay). The sampling module 6802 and the time offset module 6804 may be implemented by a protocol module 3924. At 6906, a Gaussian low pass filter (LPF) 6806 receives the output of the time offset module 6804, which may include a bit stream that is filtered and converts a square wave to a sine wave. The processing of the Gaussian LPF 6806 may be implemented by a GFSK modulator 3926. At 6908, an integrator 6808 integrates the output of the Gaussian LPF 6806 and may be implemented by a D / A low pass filter 3928. Example signals 7000, 7002, and 7004 output from the sampling module 6802, Gaussian LPF 6806, and integrator 6808, respectively, are shown in FIG. 64A.

[0388] At 6910, an upsampler 6810 upsamples the output of the integrator 6808 to include additional points per sample. The upsampler 6810 may be realized by the upconverter 3930. At 6912, an amplifier 6812 provides a frequency offset gain. At 6914, a sampling module 6818 receives an RF tone, which may be provided by a PLL 3940. The output of the sampling module 6818 is provided to both a modulator 6816 and a phase and frequency offset module 6820. At 6916, the modulator 6816 modulates the output of the sampling module 6818 based on the output of the amplifier 6812 to provide the initiator signal. The modulator 6816 may be realized at least in part by the upconverter 3930.

[0389] At 6918, the initiator signal from the modulator 6816 may be provided to a power amplifier 3932 and transmitted to a second network device. The second network device may be a network device implemented in a vehicle as part of an in-vehicle system or a portable access device. The initiator signal may be any of the initiator signals, start tone signals, master device transmit signals, and / or the like disclosed herein.

[0390] At 6920, the low noise amplifier 3910 receives a response signal responsive to the initiator signal. The response signal may include Gaussian noise included in the received response signal, as represented by summer 6814. At 6922, mixers 6822, 6824 receive the response signal from the low noise amplifier 3910 and downconvert the response signal to in-phase (I) and quadrature-phase (Q) baseband signals. The quadrature-phase baseband signals may be phase delayed by 90° via phase delay device 6823. This may be achieved with downconverter 3912.

[0391] At 6924, an LPF 6828 filters the baseband signal to remove high frequency components. The LPF 6828 may include multiple LPFs, one for each downconverted signal. The LPF 6828 may be replaced and / or implemented by the bandpass filter amplifier 3914. At 6926, a resampling module 6830 samples the filtered baseband signal with sample jitter. The resampling module 6830 may be implemented by the A / D converter 3916. Example signals 7006, 7008 from the resampling module 6830 are shown in FIG. 64B.

[0392] At 6928, an arctangent module 6832 determines the arctangent of the baseband signal to generate an arctangent signal. An example signal 7010 from the arctangent module 6832 is shown in FIG. 64C. At 6930, a differentiator 6834 differentiates the arctangent signal from the arctangent module 6832. An example signal 7012 from the differentiator 6834 is shown in FIG. 64D, overlaid on the original Gaussian filtered signal 7002.

[0393] At 6932, a sign module 6836 performs a sign function to determine the sign of the output of the differentiator 6834. At 6934, a bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of the sign module 6836. After the processing of the low pass filter 6828 and arc tangent module 6832 is applied, an idealized bit pattern is obtained that matches the bit pattern from the Gaussian LPF 6806 or other bit pattern with the received bit pattern. This is done so that the upsampled values are similar to the noise-free resampled data.

[0394] At 6936, upsamplers 6840 and 6842 upsample the outputs of the differentiator 6834 and the bit pattern module 6838, respectively. At 6938, the outputs of the upsamplers 6840 and 6842 are correlated by a cross-correlation module 6844 to generate a correlation signal. The devices 6832, 6834, 6836, 6838, 6840, and 6842 may be implemented by the demodulator 3918. At 6940, a peak detector 6846 determines the phase of the correlation signal obtained from the cross-correlation module 6844. The cross-correlation module 6844 and the peak detector 6846 may be implemented by the correlation protocol module 3920. In one embodiment, the peak detector 6846 is implemented as a three-point parabolic peak interpolator on top of the upsampled cross-correlation module 6844. Two points close (within a given distance) to the detected peak are selected to obtain a three-point parabolic interpolation of the result that is upsampled.

[0395] At 6942, distance, location, round trip time, and / or other parameters are determined based on the phase (or a three-point parabolic interpolation of the upsampled result). The distance may be the distance between the first network device and the second network device. The location may be that of the second network device relative to the first network device. The round trip time is the time for the initiator signal to travel to the second network device and for the first network device to receive the response signal, including the time for the second network device to generate the response signal after receiving the initiator signal.

[0396] At 6944, processing module 3922 may determine whether a range extension type relay attack is occurring based on the phase, distance, location, round trip time, and / or other parameters determined at 6942. If a range extension type relay attack is occurring, operation 6946 is performed; otherwise, the method may end at 6948. At 6946, processing module 3922 performs a countermeasure such as any of the countermeasures disclosed herein.

[0397] 35, 36, 45, 54, and 63 are intended to be illustrative examples. The processes may be performed sequentially, synchronously, simultaneously, consecutively, during overlapping periods, or in a different order depending on the application. Also, any process may not be performed or may be skipped depending on the embodiment and / or the order of events.

[0398] There is a variation in transmit timing between (i) the time the generated waveform arrives at the antenna to be transmitted and (ii) the corresponding time measured by the timer. Potential contributing factors include clock domain crossings, clock period variations, power amplifier propagation delays due to power amplifier gain settings, temperature, and process propagation delays. Process, temperature, and amplifier gain setting variations can be calibrated out from the timing measurements.

[0399] A second BLE device (e.g., BLE device (or radio) 3900B) similar or identical to the first BLE device (e.g., BLE device (or radio) 3900A of FIG. 38) may be added or implemented in the vehicle to represent a reflector (or responder) device as shown in FIG. 49. Each of the BLE radios 3900 may be implemented on a separate system-on-chip (SOC). The first BLE radio 3900A can transmit an initiator signal that can be received by the receiver portion of the second BLE device.

[0400] A time T1, determined by timer 3938A, may be generated for when a first bitstream is generated and / or provided to protocol module 3924A of the first BLE radio 3900A to generate an initiator signal to be transmitted from the first BLE radio 3900A. A time T2, determined by timer 3938B, may be when correlation protocol module 3920B of the second BLE radio 3900B receives the first bitstream. A first calibration constant CAL1 may be set equal to or determined based on the difference between when timer 3938A detects generation of the first bitstream and when the corresponding initiator signal is transmitted from antenna 3907A. A second calibration constant CAL2 may be set equal to or determined based on the difference between when timer 3938B detects reception of the first bitstream at correlation protocol module 3920B. The time of flight of the first bit stream from protocol module 3924A to correlation protocol module 3920B is (T2-CAL2)-(T1-CAL1).

[0401] Similarly, a time T3, determined by timer 3938B, may be generated for when a second bitstream corresponding to the first bitstream is generated and / or provided to protocol module 3924B to generate a response signal to be transmitted from second BLE radio 3900B. The response signal is generated in response to the initiator signal. A time T4, determined by timer 3938A, may be when correlation protocol module 3920A receives the second bitstream. A third calibration constant CAL3 may be set equal to or determined based on the difference between when timer 3938B detects generation of the second bitstream and when the corresponding response signal is transmitted from antenna 3907B. A fourth calibration constant CAL4 may be set equal to or determined based on the difference between when timer 3938A detects reception of the second bitstream at correlation protocol module 3920A. The time of flight of the second bit stream from correlation protocol module 3924B to correlation protocol module 3920A is (T4-CAL4)-(T3-CAL3). The average time of flight, distance between the first and second BLE radios 3900, can be determined using Equations 33-35, where Equation 33 is based on Equation 32 and takes into account the timing variations described, and therefore includes the corresponding calibration values.

number

number

number

number

[0402] The timer 3938B may be started in the transaction agreement and / or fine-tune the transmission time in the second BLE radio 3900B to minimize reporting for T2-T3.

[0403] The PLLs 3940A and 3942A of the first BLE radio 3900A may be implemented as a single PLL. Similarly, the PLLs 3940B and 3942B of the second radio 3900B may be implemented as a single PLL. The two PLLs allow the hardware implementation of the transmitter and receiver portions on the same SoC, while still allowing the same BLE circuitry used to capture the receive time of the response signal to be used to capture the transmit time of the initiator signal.

[0404] In accordance with the present teachings, a multi-axially polarized RF antenna assembly includes a circularly polarized antenna including a conductive ring-shaped body having an inner bore, a circular isolator connected to the conductive ring-shaped body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular isolator and extending outward from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to a radius of the circularly polarized antenna.

[0405] According to the present teachings, a multi-axially polarized RF antenna can include a conductive element in the form of a wire.

[0406] In accordance with the present teachings, the sleeve can be formed from polytetrafluoroethene and the conductive element can be formed from copper.

[0407] In accordance with the present teachings, a linearly polarized antenna can be configured to extend downward from a circularly polarized antenna when in use.

[0408] According to the present teachings, a circularly polarized antenna can be a dual-axis antenna, and a linearly polarized antenna can be a single-axis antenna.

[0409] According to the present teachings, the multi-axially polarized RF antenna assembly can further include a ground plane, and circular isolators can be disposed on the ground plane between the conductive element and the ground plane and between the circularly polarized antenna and the ground plane.

[0410] In accordance with the present teachings, a circularly polarized antenna can include two feed points that are phase offset by 90 degrees and can be configured to receive signals that are 90 degrees out of phase with each other.

[0411] According to the present teachings, a vehicle can include a body and a roof including a multi-axially polarized RF antenna assembly that can be oriented on the roof such that a linearly polarized antenna extends downward from a circularly polarized antenna.

[0412] According to the present teachings, a vehicle can include a multi-axially polarized RF antenna assembly. The multi-axially polarized RF antenna assembly can include a first multi-axially polarized RF antenna assembly configured to be mounted to the vehicle, and a second multi-axially polarized RF antenna assembly configured to be mounted to the vehicle and including a second circularly polarized antenna including a second conductive ring-shaped body having a second inner hole, a second circular isolator connected to the second conductive ring-shaped body, and a second linearly polarized antenna connected to the second circular isolator and extending outward from the second circular isolator. The second linearly polarized antenna can include a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. The second linearly polarized antenna can extend perpendicular to a radius of the second circularly polarized antenna, and an access module can be connected to the first multi-axially polarized RF antenna assembly and the second multi-axially polarized RF antenna assembly and configured to communicate with a portable access device via the first multi-axially polarized RF antenna assembly and the second multi-axially polarized RF antenna assembly.

[0413] According to the present teachings, at any one time, the linearly polarized antenna or at least one of the first multi-axially polarized RF antenna assembly is not cross-polarized with the antennas of the second multi-axially polarized RF antenna assembly.

[0414] According to the present teachings, the access module can be configured to perform passive entry, passive start, or phone-as-key operations, including transmitting and receiving radio frequency signals via a first one of the multi-axially polarized RF antenna assemblies and a second one of the multi-axially polarized RF antenna assemblies.

[0415] According to the present teachings, the access module can be configured to grant access to the vehicle based on a radio frequency signal.

[0416] According to the present teachings, the access module can be configured to execute an algorithm to determine which antenna pair, a first one of the multi-axially polarized RF antenna assemblies and a second one of the multi-axially polarized RF antenna assemblies, should be used for communication with the portable access device.

[0417] In accordance with the present teachings, the portable access device can be a key fob or a mobile phone.

[0418] In one embodiment, the phone-as-a-key system described herein uses a BLE radio in a mobile phone to microlocate the phone's position relative to a set of receiving sensors. The sensors are located within the vehicle. The sensors are used to detect whether the phone is close enough to the vehicle to grant access to the vehicle (e.g., unlocking the doors and / or starting the vehicle). The vehicle's access module uses the angle-of-arrival (AOA) principle. By knowing the angle of arrival of a signal transmitted from the BLE radio to at least two separate sensors within the vehicle, the source (i.e., the BLE radio) can establish its location on a two-dimensional plane. In this case, a phased antenna array is used to measure the angle of arrival of the incoming signal. A phased antenna array includes multiple antennas that receive the transmitted signals. Each sensor in the vehicle includes one or more antennas. Each sensor may be a phased array sensor, including a three-antenna interleaved circularly polarized (CP) receiver with a single radio receiver, a six-antenna interleaved linearly polarized (LP) receiver with a single radio receiver, a three-antenna interleaved CP receiver with a single radio receiver, and a three-antenna interleaved printed antenna CP receiver with a single radio receiver.

[0419] The access module detects the direction of the incoming AOA signal, taking multipath effects into account. For example, two transmitted sinusoidal RF signals reaching the sensor array are summed at the sensor array's antenna. The sum of the two sinusoidal RF signals is a sinusoid with a different phase and amplitude that depends on the phase angle and amplitude of the two source sinusoids. Mathematical models used to predict AOA direction can exhibit errors. These errors can be very large and unstable in dynamic multipath environments. To prevent these errors, the MUSIC algorithm disclosed herein can be used to identify the source signal along with potentially strong multipath reflected signals. The direct path signal is accurately tracked from the mobile phone. This tracking identifies any additional reflected signals. The reflected signals can then be identified and discarded.

[0420] The access and control modules disclosed herein can implement any of the MUSIC algorithms referenced and / or disclosed herein. Direction finding methods can generally be divided into two categories, sometimes referred to as classical and modern methods. Classical methods include various beamforming methods. Modern methods are commonly referred to as subspace methods. The MUSIC algorithm is classified as a super-resolution parameter estimation algorithm that uses subspace separation techniques. Subspace methods may require a specific array placement of two identical but physically shifted arrays. Other methods include maximum likelihood estimation and beamforming.

[0421] Figure 70 shows a side view of multiple antennas 7000 in an array, showing the angle of arrival θ. An array of antennas may be referred to as an array manifold. Each antenna 7000 may be configured the same as and / or similar to any of the antennas disclosed herein. In one embodiment, one or more antennas is a quadrifilar helix antenna.

[0422] The MUSIC algorithm uses a model of the array manifold that describes the response of the array manifold to one or more incident AOA signals. A uniform linear array (ULA) of antennas can be defined as shown in Figure 70, where m is the antenna index in the array starting from 1, M is the total number of antennas, d is the spacing between antenna elements, and θ is the angle of the incident signal. The response of array element m to an incident signal s can be expressed as Equation 37, where r is the received signal, a is the complex array manifold response, s is the source signal, m is the index number of the antenna element of interest as stated, θ is the physical angle of the incident source signal as stated, λ is the wavelength of the signal, and n(t) represents the noise in the receiver channel. This shows the effect of phase delay as a function of the physical location of the elements in the receiving sensor array, with a full 180° phase shift at d=λ / 2. It also shows the phase shift as a function of the angle of incidence θ.

number

[0423] Array steering vector a m In the case of an antenna with 1≦m≦M, the incident angle θ n For a given source signal n at , it is defined by Equation 38, which assumes an amplitude response of 1 at each antenna and an ideal phase response of the ULA to antenna 1.

number

[0424] For N incident signals, the received signal r(t) is the sum of the source signals through the array manifold and can be expressed as Equation 39:

number

[0425] In vector notation, the array manifold response parameters a and A are defined by Equations 40 and 41. Vector a describes the array response of each element to a single source signal n, and A describes the response of all M array elements to all N source signals and is an M x N matrix, where M and N are each integers greater than or equal to 2. The N source signals sampled at instant t in time are represented as an N x 1 vector S(t), as expressed by Equation 42.

number

number

number

[0426] Equation 43 may be used to map N source tones at various source angles of arrival represented in a signal S(t) at a given time t through an antenna array response manifold model A to a received (measured) data vector r(t) including channel noise n(t), where r(t) is an M×1 vector of data received at each antenna element.

number

[0427] 71 illustrates an exemplary AOA method including use of the MUSIC algorithm. While the processing is primarily described as being performed by a vehicle access module, such as one of the access modules disclosed herein, the processing may also be performed by a control module of a portable access device. Note that the H operator indicates a Hermitian transpose or conjugate transpose operation. The method may begin at 7400. At 7402, the access module calculates {r(t)}T t Collect T analytical signal samples simultaneously from each antenna, as represented by =1.

[0428] At 7404, the access module estimates the data covariance matrix R as expressed in Equation 44.

number

[0429] The covariance matrix estimate is calculated according to Equation 44, and an example of the covariance is shown in Figure 72. For interpretation, each arrow represents the covariance between the antenna numbers listed on the X and Y axes at the base of the arrow. The top center arrow represents the covariance of antenna number 1 relative to antenna number 2 (c 12 ), while the arrow in the middle left represents the covariance (c 21 ), which is c12 The direction of the arrow is the complex plane representation of magnitude and direction (X axis is the real axis, Y axis is the imaginary axis).

[0430] Note that the diagonal line (from upper left to lower right) represents the autocovariance, which has magnitude 1 and imaginary value zero. Also, the matrix is Hermitian, meaning that for all i and j, c ij =c * where * denotes the complex conjugate. Thus, all useful information is (i)c 12 , c 23 , and c 13 , or (ii) c 21 , c 32 , and c 31 (The upper right corner or the lower left corner does not include the diagonal line from the top left to the bottom right.) This is expected to save data storage and reduce the transmission size.

[0431] At 7406, the access module uses singular value decomposition (SVD) or another eigenvalue decomposition technique to calculate the M×M matrix U as expressed in Equation 45.

number

[0432] After eigenvalue decomposition of the covariance matrix estimate R, the resulting complex eigenvectors are provided, examples of which are shown in Figure 73. Figure 73 shows a visualization of the eigenvectors due to the array manifold response at 35°. Figure 74 shows a visualization of the eigenvectors due to the array manifold response at 0°.

[0433] As shown in Figure 72, the magnitude and direction of the arrows indicate the real and imaginary components of each point, corresponding to real numbers on the X-axis and imaginary numbers on the Y-axis. The solid and short-dashed arrows represent a 3x3 array of eigenvectors. The vector columns (X-axis) are sorted by the eigenvalues of the eigenvectors from largest (left) to smallest (right). Thus, the leftmost column, number 1, represents the signal subspace, while columns 2 and 3 represent the noise subspace.

[0434] At 7408, the access module estimates or otherwise determines the number of incident signals N. At 7410, the access module separates the matrix U into an M×N signal subspace matrix Us and a noise subspace estimate M×(MN) matrix Ue to satisfy Equation 46.

number

[0435] The response of the array manifold at the angle of interest (35°) is shown by the long dashed arrow, along with the eigenvector, which is derived from Equation 40.

[0436] At 7412, the access module calculates the MUSIC spectrum P(θ) for the range of θ of interest at a predetermined resolution, as expressed in Equation 47.

number

[0437] At this point, the noise subspace eigenvectors of the covariance matrix estimate should be perfectly orthogonal to the array manifold response. The results in the denominator of Equation 47 are small numbers compared to the results at various test angles θ.

[0438] Figure 74 presents the same information as Figure 73, except that the array manifold response is shown at an AOA of 0°. Note that the eigenvectors remain the same because they are derived from measured data. The array manifold response is rotated to show the expected response to a directly incident signal, which means there is no phase shift in the antenna elements. In this case, the result in the denominator of Equation 47 is much larger than that obtained for Figure 73.

[0439] At 7414, the access module performs a peak search in P(θ) to determine the angles of arrival. The value of θ at the maximum value of P(θ) is the angle of arrival of the N incident signals.

[0440] After processing Equation 47 for θ ranging from -90° to +90°, the resulting MUSIC power spectrum P(θ) is shown in Figure 76 for a source signal AOA of 35°. Note the clear peak at the test AOA of 35°. The actual angle is shown by the vertical dashed line. The resolution of θ is 1°.

[0441] Covariance smoothing methods may also be used. As an example, a forward-backward approach can be used. The forward-backward approach is implemented using Equations 48 and 49, where R is the estimated modified covariance matrix and J is the MxM inverse identity matrix (transfer matrix).

number

number

[0442] The effective number of resolvable coherent tones is N≦2M / 3 sources. For a three-antenna array, up to two coherent tones can be resolved. This method may be used for a three-antenna phased array in a phased antenna array receiver board. The method may end at 7416.

[0443] As another example, spatial smoothing may be used, which involves dividing the array into multiple subarrays and averaging the resulting covariance matrices of the subarrays, effectively reducing the number of antenna array elements.

[0444] Forward-Backward Spatial Smoothing (FBSS) methods, which combine spatial smoothing with a forward-backward approach, may also be used, which also reduces the number of antenna elements required. As yet another example, Toeplitz completion methods may be used, which are suitable for NLA.

[0445] Variations of the MUSIC algorithm may also be implemented. A derivative of the MUSIC algorithm, called Root-MUSIC, can be used in the ULA to find the incident signal AOA without having to calculate the results at all potential angles. This reduces the computational power required. The reduced computational complexity results from not having to perform the MUSIC algorithm steps 7412, 7414, which involve calculating the MUSIC spectrum over a large set of θ values and finding the peaks in the results.

[0446] Another derivative, called Spectral-MUSIC, is a generalized version of Root-MUSIC that can be applied to any array configuration, but is generally applied to wideband, non-coherent sources. Yet another derivative, called Smooth-MUSIC, refers to various ways of smoothing the covariance matrix of the MUSIC algorithm and is applied between steps 7404 and 7406 in Figure 71.

[0447] Another variant, called the CLEAN method, involves reconstructing a model of the source signal from the known array manifold once the source signal has been identified in a given direction. This reconstructed signal model is subtracted from the measured incident signal to remove the incident signal, thereby "cleaning" the measurement data of unwanted source signals and allowing other sources to be considered.

[0448] One issue that arises when implementing the MUSIC algorithm on nonideal antenna arrays is that forward-backward covariance smoothing can result in erroneous location measurements for two coherent sources. Standard array calibration techniques do not solve this problem because the covariance matrix itself results in erroneous subspace separation. To counter this, a variation of the CLEAN method is implemented for multiple coherent sources. This involves using the MUSIC algorithm to identify the source signals, using the CLEAN method to remove the source signals one at a time using a calibrated array manifold, forcing the source signal locations to offsets (rather than their originally measured locations) and recalculating the AOA directions for the remaining signals, repeating steps 7404 and 7406 in Figure 71 to verify convergence to a new set of incident angles of arrival if they are not the same as the original angles of arrival, and optionally replacing step 7402 in Figure 71 with a priori knowledge from the system. For example, while tracking the source signal location, it can be assumed that the AOA does not change significantly between subsequent readings.

[0449] 76 shows an antenna selection system 7600 including an antenna 7602, a switch 7604, and a radio receiver 7606. The radio receiver 7606 selects one of the antennas from which to receive a signal via the switch 7604. The antenna selection system 7600 may be implemented in any of the systems disclosed herein. In one embodiment, the antenna selection system 7600 is implemented in a vehicle, and an access module disclosed herein controls the operation of the radio receiver 7606.

[0450] The antenna selection system 7600 is implemented in a PAK AOA system to achieve BLE AOA data reception. A portion of a BLE radio packet received by one of the antennas 7602 includes a CW tone. The radio receiver 7606 samples the CW tone to provide quadrature analysis signals, which refer to two sinusoidal waves with a 90° phase difference, called the in-phase and quadrature-phase signals (I and Q signals). The I and Q signals are simultaneously sampled and combined to form a complex analysis sample r, where r = iI + Q, where i is an imaginary constant and i = √2. The received data is therefore sliced into interleaved samples from each of the antennas in multiple iterations.

[0451] Figure 77 shows an exemplary reconstruction method for reconstructing IQ data. The interleaved data is interpolated to form a received data matrix r(t) for use in the MUSIC algorithm. The reconstruction method may be performed by any of the access modules disclosed herein. The signal reconstruction method may begin at 7700.

[0452] At 7702, the access module converts the analysis IQ sample vector r into a phase angle vector Φ using an arctangent function. At 7704, the access module creates a time vector t corresponding to the sample vector r based on the data sampling rate.

[0453] At 7706, the access module discards samples taken near the antenna switching time. At 7708, the access module unwraps each repeating portion of the data points with a step size of π. At 7710, the access module measures the average slope, which is the average frequency of the sine wave.

[0454] At 7712, the access module, for each antenna, a) locates the intercept of the first repeat of the sampled data, b) predicts the position of the next repeat of the sampled data, c) determines the average difference between the predicted position and the actual position measured, d) adds or subtracts 2π, e) repeats processes c and d, including repeating the determination of the average difference and adding or subtracting 2π until the average difference is less than π, f) finds the average slope of all points already aligned, and g) repeats processes bg using the new slope for the next signal repetition.

[0455] At 7714, the access module measures the standard deviation of the average slope for each antenna.

[0456] At 7716, the access module checks which antennas may have incorrect alignment by selecting antenna i based on Equation 50 if the standard deviation exceeds a threshold.

number

[0457] At 7718, the access module repeats processes 7712-7718 for the antenna selected at 7716 until a low standard deviation or a maximum retry counter expires.

[0458] At 7720, the access module interpolates a line of points on the original time vector t for each antenna m to generate a reconstructed phase angle vector Φ m This can be based on the phase angle vector Φ determined in 7702.

[0459] At 7722, the access module calculates the IQ sample vector r for each antenna m using Equation 51. m where g is the average size of the valid subset of the original sample vector r. Following operation 7722, the method may end at 7724.

number

[0460] In one embodiment, the above method is implemented in a vehicle access system and / or PAK system having a circularly polarized antenna, as disclosed herein. A signal is received at the circularly polarized antenna. IQ data is determined based on the received signal, as described above, and the angle of arrival is determined using the MUSIC algorithm.

[0461] 78A-C illustrate a vehicle 7800 illustrating an example placement of a sensor 7802 that may be implemented as part of any PAK system disclosed herein and that may be connected to any access module disclosed herein. FIG. 78C illustrates an example of the bounce reflection and corresponding path of a signal transmitted from a key fob 7804 or other portable access device and detected by a sensor 7802. In this example, the sensor 7802 is located high and centrally in the vehicle 7800. The sensor 7802 may be located, for example, in the headliner 7803 of the vehicle 7800. The sensor 7802 is positioned to cause multiple bounce paths for the transmitted signal before being received by the sensor 7802. The key fob 7804 is shown low relative to the vehicle for purposes of illustration, but may be located higher.

[0462] 79A-C illustrate a vehicle 7900 showing another example placement of a sensor 7902. FIG. 79C illustrates another example of bounce reflections and corresponding paths of a signal transmitted from a key fob 7904 or other portable access device and detected by a sensor 7902. In this example, the sensor 7902 is located low and centrally in the vehicle 7900. The sensor 7902 may be located on the floor 7903 or center console 7905 of the vehicle. The sensor 7902 is positioned to cause multiple bounce paths of the transmitted signal before being received by the sensor 7902. The key fob 7904 is shown low relative to the vehicle for purposes of illustration, but may be located higher.

[0463] The sensors 7802, 7902 may be located within the vehicle's metal structure with few possible direct paths from the vehicle (i.e., it is unlikely that there is line of sight between the key fob 7804, 7904 and the sensors 7802, 7902). Because the floor may include at least a portion of the metal structure, the metal structure may include a frame, metal housing, a partially enclosed metal structure, a unibody structure, etc., which may be at least partially represented by the dashed line 7903. While a single sensor is shown in each of FIGS. 78A-C, 79A-C, two or more sensors may be included in each vehicle. In one embodiment, each sensor includes two or more antennas, e.g., two or more antennas disclosed and / or referenced herein. In one embodiment, two sensors are included, each sensor including two antennas such that there are four antenna paths. In another embodiment, a single sensor is included, and the sensor includes three or more antennas. Although there may not be a direct line of sight between the key fob and the sensor, there are several to many signal paths between the key fob and the sensor, so a short and consistent distance between the key fob and the vehicle can be determined using the techniques disclosed herein. The distance information is used to determine whether to grant access to the vehicle.

[0464] In one embodiment, carrier phase-based ranging, such as using the MUSIC algorithm, is performed to determine the angle of arrival of the signal transmitted by the key fob 7804, 7904. This may include eigenvalue decomposition. The distance between the key fob 7804, 7904 and the vehicle 7800, 7900 is determined based on the angle of arrival. If the key fob 7804, 7904 is within a predetermined distance of the vehicle 7800, 7900, access is granted. While line of sight is unlikely, it is likely that the transmitted signal will bounce multiple times and follow multiple paths to each sensor 7802, 7902. This allows the corresponding access module to determine whether the key fob 7804, 7904 is close to the vehicle 7800, 7900. In addition to carrier phase-based ranging, multipath signal processing is performed. This may include time-of-flight signal processing, for example, as described above with respect to Figures 37, 52-56, and 62. As an example, when the key fob 7804, 7904 is within a predetermined distance of the vehicle 7800, 7900, the access module of the vehicle 7800, 7900 can unlock the doors of the vehicle 7800, 7900.

[0465] By forcing an indirect signal transmission path, exchanging a predetermined number of closely transmitted tones, and finding the eigenvalue, ranging in the indirect reflection path can be performed using BLE carrier phase based ranging. A system with a small number of sensors (called anchors) can be used by placing the anchors so that the signal follows primarily an indirect path rather than a direct line-of-sight path.

[0466] In one embodiment, the RSSI of the transmitted signal is determined to determine if the key fob 7804, 7904 is inside or outside the vehicle 7800, 7900. If the key fob 7804, 7904 is outside the vehicle, carrier phase based ranging including eigenvalue decomposition is performed to determine if the key fob 7804, 7904 is within a predetermined distance of the vehicle 7800, 7900.

[0467] The foregoing description is merely exemplary in nature and is in no way intended to limit the disclosure, its application, or uses. The broad teachings of the present disclosure can be embodied in a variety of forms. Accordingly, while the present disclosure includes specific examples, other modifications will become apparent upon review of the drawings, the specification, and the appended claims, and the true scope of the present disclosure should not be so limited. It should be understood that one or more steps within a method may be performed in a different order (or simultaneously) without altering the principles of the present disclosure. Furthermore, although each embodiment is described above as having specific features, any one or more of these features described with respect to any embodiment of the present disclosure may be implemented in any other embodiment and / or combined with features of any other embodiment, even if the combination is not explicitly described. In other words, the described embodiments are not mutually exclusive, and interchangeability of one or more embodiments remains within the scope of the present disclosure.

[0468] Spatial and functional relationships between elements (e.g., between modules, circuit elements, semiconductor layers, etc.) are described using various terms, including "connected," "engaged," "coupled," "adjacent," "next to," "over," "above," "below," and "disposed." When a relationship between first and second elements is described in the above disclosure, unless expressly described as "direct," the relationship can be a direct relationship where no other intervening elements exist between the first and second elements, but can also be an indirect relationship where one or more intervening elements (spatial or functional) exist between the first and second elements. As used herein, the phrase "at least one of A, B, and C" should be interpreted to mean a non-exclusive logical OR (A or B or C), and not to mean "at least one of A, at least one of B, and at least one of C."

[0469] In the drawings, the direction of the arrow, indicated by the arrowhead, generally indicates the flow of information (such as data or instructions) that is important to the diagram. For example, element A and element B exchange various information, but the arrow may point from element A to element B if the information sent from element A to element B is relevant to the diagram. This one-way arrow does not mean that other information is not sent from element B to element A. Furthermore, for information sent from element A to element B, element B may send element A a request for the information or an acknowledgment of receipt of the information.

[0470] In this application, including the definitions below, the term "module" or the term "controller" may be interchanged with the term "circuitry." The term "module" can refer to, be a part of, or include an application specific integrated circuit (ASIC), a digital, analog, or mixed analog / digital discrete circuit, a digital, analog, or mixed analog / digital integrated circuit, a combinational logic circuit, a field programmable gate array (FPGA), a processor circuit (shared, dedicated, or group) that executes code, a memory circuit (shared, dedicated, or group) that stores code to be executed by the processor circuit, other suitable hardware components that provide the described functionality, or a combination of some or all of the above, such as in a system-on-chip.

[0471] A module may include one or more interface circuits. In some examples, the interface circuit may include a wired or wireless interface connected to a local area network (LAN), the Internet, a wide area network (WAN), or a combination thereof. The functionality of any given module of the present disclosure may be distributed among multiple modules connected via interface circuits. For example, multiple modules may enable load balancing. In a further example, a server (also known as a remote or cloud) module may perform some functions on behalf of a client module.

[0472] As used above, the term code can include software, firmware, and / or microcode and may refer to programs, routines, functions, classes, data structures, and / or objects. The term shared processor circuit encompasses a single processor circuit that executes some or all of the code from multiple modules. The term group processor circuit encompasses a processor circuit that executes some or all of the code from one or more modules in combination with additional processor circuits. References to multiple processor circuits encompass multiple processor circuits on separate dies, multiple processor circuits on a single die, multiple cores of a single processor circuit, multiple threads of a single processor circuit, or combinations thereof. The term shared memory circuit encompasses a single memory circuit that stores some or all of the code from multiple modules. The term group memory circuit encompasses a memory circuit that stores some or all of the code from one or more modules in combination with additional memory.

[0473] The term "memory circuit" is a subset of the term "computer-readable medium." As used herein, the term "computer-readable medium" does not include transitory electrical or electromagnetic signals propagating through a medium (such as on a carrier wave). Thus, the term "computer-readable medium" can be considered tangible and non-transitory. Non-limiting examples of non-transitory, tangible computer-readable media are non-volatile memory circuits (such as flash memory circuits, erasable programmable read-only memory circuits, or masked read-only memory circuits), volatile memory circuits (such as SRAM circuits or DRAM circuits), magnetic storage media (such as analog or digital magnetic tape or hard disk drives), and optical storage media (such as CDs, DVDs, or Blu-ray discs).

[0474] The apparatus and methods described in this application may be implemented in part or entirely by a special-purpose computer created by configuring a general-purpose computer to perform one or more specific functions embodied in a computer program. The functional blocks, flowchart elements, and other elements described above serve as software specifications that can be converted into a computer program by the routine work of a skilled engineer or programmer.

[0475] A computer program includes processor-executable instructions stored on at least one non-transitory, tangible, computer-readable medium. A computer program may also include or rely on stored data. A computer program may include a basic input / output system (BIOS) that interacts with hardware in a special-purpose computer, device drivers that interact with specific devices in a special-purpose computer, one or more operating systems, user applications, background services, background applications, etc.

[0476] A computer program may include (i) parsed narrative text such as HTML (Hypertext Markup Language), XML (Extensible Markup Language), or JSON (Javascript Object Notation), (ii) assembly code, (iii) object code generated from source code by a compiler, (iv) source code for execution by an interpreter, (v) source code for compilation and execution by a just-in-time compiler, etc. By way of example only, source code may be written using the syntax of languages including C, C++, C#, Objective-C, Swift, Haskell, Go, SQL, R, Lisp, Java®, Fortran, Perl, Pascal, Curl, OCaml, Javascript®, HTML5 (Hypertext Markup Language Fifth Revision), Ada, ASP (Active Server Pages), PHP (Hypertext Preprocessor), Scala, Eiffel, Smalltalk, Erlang, Ruby, Flash®, Visual Basic®, Lua, MATLAB, SIMULINK, and Python®.

[0477] No element recited in a claim is intended to be a means-plus-function element within the meaning of 35 U.S.C. 112(f) unless the element is expressly recited using the phrase "means for," or, in the case of a method claim, using the phrase "process for" or "step for."

Claims

1. 1. A vehicle access system, comprising: a plurality of antennas each configured to receive a signal transmitted from the portable access device to the vehicle; The signal is transmitted at a frequency of 2.4 GHz. and an access module configured to perform carrier phase based ranging, including downconverting a received signal to generate an in-phase signal and a quadrature-phase signal, and executing a MUSIC algorithm to (i) determine a distance between the portable access device and a vehicle, and (ii) determine an angle of arrival of the received signal received at the antenna, determine a position of the portable access device relative to the vehicle based on the distance and angle of arrival, and grant access to the vehicle based on the position.

2. 10. The access system of claim 1, wherein the plurality of antennas are positioned on the vehicle such that a received signal has a plurality of corresponding bounce paths between the portable access device and the plurality of antennas.

3. The access system of claim 1 , wherein the plurality of antennas are disposed within a metal structure of the vehicle.

4. The access system of claim 1 , wherein the plurality of antennas are positioned such that there is no line of sight between the plurality of antennas and the portable access device.

5. 10. The access system of claim 1, further comprising a plurality of sensors, each of the plurality of sensors having two or more antennas, the plurality of sensors being positioned on the vehicle such that a received signal has a plurality of corresponding bounce paths between the portable access device and each of the plurality of sensors.

6. 2. The access system of claim 1, wherein the access module is configured to monitor a received signal, generate a received signal strength indicator based on the received signal, determine whether the portable access device is inside or outside the vehicle based on the received signal strength indicator, and, if the portable access device is outside the vehicle, determine a distance between the portable access device and the vehicle.

7. The access system of claim 1 , wherein at least one of the plurality of antennas is a circularly polarized antenna.

8. The multiple antennas a circularly polarized antenna having a conductive ring-shaped body with an inner hole; a circular isolator connected to a conductive ring-shaped body; a circularly polarized antenna and a linearly polarized antenna connected to the circular isolator and extending outward from the circular isolator; Linearly polarized antennas are Sleeve and a conductive element extending through the sleeve; 10. The access system of claim 1, wherein the linearly polarized antenna extends perpendicular to a radius of the circularly polarized antenna.

9. 2. The access system of claim 1, wherein the access module is configured to, while executing a MUSIC algorithm, collect analytical signal samples of signals received at each of a plurality of antennas to generate a received data matrix, estimate a data covariance matrix based on the received data matrix, determine an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to 2, determine a number of incident signals, divide the M×M matrix into a plurality of matrices, calculate a MUSIC spectrum based on one of the plurality of matrices, and perform a peak search of the MUSIC spectrum to determine an angle of arrival.

10. the receiver includes a phase-locked loop and is phase-locked with the transmitter of the portable access device; The access system of claim 1 , wherein the access module is configured to perform a tone exchange with the transmitter and determine at least one of a distance or an angle of arrival based on the tone exchange.

11. the receiver includes a phase-locked loop and is phase-locked with the transmitter of the portable access device; 10. The access system of claim 1, wherein the access module is configured to perform a tone exchange with the transmitter, determine round-trip time-of-flight information based on the tone exchange, and determine distance based on the round-trip time-of-flight information.

12. an access system according to claim 1; Body and a roof, a center console, a floor, or an at least partially enclosed metal structure; The vehicle, wherein the plurality of antennas are mounted to at least one of a roof, a center console, a floor, or an at least partially enclosed metal structure.

13. receiving, with each of a plurality of antennas, a signal transmitted from the portable access device to the vehicle; The signal is transmitted at a frequency of 2.4 GHz. down-converting the received signal to generate an in-phase signal and a quadrature-phase signal; performing carrier phase based ranging including executing a MUSIC algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine an angle of arrival of a received signal received at the multiple antennas; determining a position of the portable access device relative to the vehicle based on the distance and angle of arrival; and granting access to the vehicle based on location.

14. The method of claim 13 , wherein the multiple antennas are positioned on the vehicle such that a received signal has multiple corresponding bounce paths between the portable access device and the multiple antennas.

15. The method of claim 13 , wherein the plurality of antennas are positioned such that there is no line of sight between the plurality of antennas and the portable access device.

16. Multiple antenna pairs are implemented as part of each sensor, The method of claim 13 , wherein the sensors are positioned on the vehicle such that a received signal has multiple corresponding bounce paths between the portable access device and each sensor.

17. monitoring a received signal and generating a received signal strength indicator based on the received signal; determining whether the portable access device is inside or outside the vehicle based on the received signal strength indicator; and The method of claim 13 , further comprising determining a distance between the portable access device and the vehicle if the portable access device is outside the vehicle.

18. The method of claim 13 , wherein at least one of the plurality of antennas is a circularly polarized antenna.

19. While executing the MUSIC algorithm, collecting analytic signal samples of signals received at each of a plurality of antennas to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to 2; determining a number of incident signals; Splitting an MxM matrix into multiple matrices; calculating a MUSIC spectrum based on one of a plurality of matrices; and The method of claim 13 , further comprising performing a peak search of the MUSIC spectrum to determine the angle of arrival.

20. performing a tone exchange with a transmitter of a portable access device; and determining at least one of a distance or an angle of arrival based on the tone exchange; 14. The method of claim 13, wherein a receiver of a portable access device that performs tone exchange includes a phase-locked loop and is phase-locked with a transmitter of the portable access device.

21. performing a tone exchange with the transmitter and determining round-trip time-of-flight information based on the tone exchange; and determining distance based on round-trip flight time information; 14. The method of claim 13, wherein a receiver of a portable access device that performs tone exchange includes a phase-locked loop and is phase-locked with a transmitter of the portable access device.

Images