A passive entry / passive start system that performs carrier phase-based distance measurement using MUSIC-style eigenvalue decomposition for distance determination.

Abstract

To provide an access system for vehicles.SOLUTION: An access system includes antennas and an access module. The antennas are configured to each receive a signal transmitted from a portable access device to a vehicle. The signal is transmitted on a 2.4 gigahertz frequency. The access module is configured to: down-convert the received signal to generate an in-phase signal and a quadrature phase signal; perform carrier phase based ranging including implementing a music algorithm to (i) determine a distance between the portable access device and the vehicle, and (ii) determine angles of arrival of the received signal received at the antennas; determine a location of the portable access device relative to the vehicle based on the distance and the angles of arrival; and permit access to the vehicle based on the location.SELECTED DRAWING: Figure 71

Description

Cross - References to Related Applications

[0001] This application claims priority to U.S. Patent Application No. 16 / 824,444, filed Mar. 19, 2020, which claims the benefit of U.S. Provisional Application No. 62 / 744,814, filed Oct. 12, 2018, U.S. Provisional Application No. 62 / 801,392, filed Feb. 5, 2019, and U.S. Provisional Application No. 62 / 826,212, filed Mar. 29, 2019, and is a partial continuation of U.S. Application No. 16 / 598,191, filed Oct. 10, 2019. This application also claims priority to U.S. Provisional Application No. 62 / 850,055, filed Mar. 20, 2019.

Technical Field

[0002] The present disclosure relates to a passive entry / passive start system.

Background Art

[0003] The description of the background art provided herein is for the purpose of generally presenting the context of the present disclosure. The research of the inventors within the scope described in this background art section, as well as portions of the description that may not be regarded as prior art at the time of filing, are not admitted as prior art to the present disclosure, either expressly or implicitly.

[0004] Conventional passive entry / passive start (PEPS) systems permit keyless entry, which includes providing user access to various vehicle functions when the user possesses a key fob paired with an in-vehicle PEPS electronic control unit (or PEPS module). As an example, a user possessing a key fob may approach a vehicle equipped with a PEPS module. The key fob communicates with the PEPS module, and when the key fob is authenticated, the PEPS module can unlock the vehicle's doors. The PEPS module (i) executes an authentication process to determine whether the key fob is permitted access to the vehicle, and (ii) determines the position of the key fob relative to the vehicle. The authentication process may include an exchange of encrypted passwords or signatures. If the password or signature is correct, the key fob is determined to be permitted. The position of the key fob may be determined, for example, based on the strength of the signal received from the key fob. If the key fob is authenticated and located within the vehicle's permission zone, access to the interior of the vehicle is permitted without using a conventional key.

[0005] As another example, a user possessing a key fob can activate vehicle functions by pressing a button on the key fob. In response to pressing the button, the key fob communicates with the PEPS module, and if the key fob is authenticated and within a predetermined distance from the vehicle, the PEPS module executes the specified function associated with the button press on the key fob (e.g., start the vehicle, open the doors, sound an alarm, etc.). The communication executed in both examples may include the key fob and the PEPS module performing a one-way low-frequency (LF) wake-up function and a one-way or two-way radio frequency (RF) authentication function.

[0006] A phone-as-a-key (PAK) vehicle access system can operate similarly to the described PEP system, except that it uses a mobile phone instead of a key fob to access the vehicle. For example, the mobile phone can communicate with the PAK module or telematics control unit (TCU) in the vehicle to initiate the access pairing process. The mobile phone and either the PAK module or TCU then perform the access pairing process to establish a trust relationship. The pairing process may include Bluetooth® pairing, which allows security information to be directly exchanged between the mobile phone and the vehicle, with the mobile phone's address, mobile phone's ID resolution key, reserved identifier, and / or encryption key being exchanged via a cloud-based network, and / or the mobile phone presenting a certificate to the vehicle, which is signed by (i) the mobile phone, (ii) a trusted security signing authority such as the vehicle manufacturer, and / or (iii) a trusted third party. In the case of a certificate, the certificate may include an identifier for the person authorized to access the vehicle, an identifier for the cloud-based network authorized to transfer the certificate, an identifier for the vehicle rental or lease agreement, a vehicle identifier, the date and duration for which the authorized person is permitted to use the vehicle, and / or other restrictions and / or access / license information.

[0007] In the case of passive entry, some user action is usually required to initiate the process of waking up a key fob or mobile phone (referred to as a portable access device). For example, this may include the user approaching the vehicle with the portable access device and / or touching and / or pulling the door handle. When a PEPS module or PAK module, called an access module, detects this action, the access module performs a positioning process to initiate the search for and wake-up of the key fob. In a one-way RF system, an LF downlink signal (e.g., a 125 kHz signal) is sent from the access module to the key fob to wake it up and send commands and data to the key fob for authentication purposes. The key fob then sends a response signal to the access module via the RF uplink. The response signal may be an ultra-high frequency (e.g., 315 MHz or 433 MHz). In a two-way RF system, an LF downlink signal is sent from the access module to the key fob to wake it up and establish a two-way RF link between the access module and the key fob. A bidirectional RF link can transmit signals on UHF frequencies (e.g., 315MHz, 422MHz, 868MHz, or 915MHz). The bidirectional RF link is used to authenticate the key fob. The key fob includes a microcontroller that remains in sleep mode (or low-power listening mode) while constantly checking for a valid LF signal. If the valid LF signal contains the correct vehicle-specific wake-up identifier, the microcontroller generates a signal to wake up the PEPS controller in order to communicate with the vehicle's access module.

[0008] The vehicle may have, for example, four to six LF antennas that generate an LF magnetic field. The key fob controller measures the LF signal level during communication with the access module. The controller determines the Received Signal Strength Indicator (RSSI) and provides the RSSI to the access module. The access module then determines the key fob's position based on the RSSI. The key fob includes three separate antenna coils or one 3D coil, which are used to determine the x, y, and z axis values ​​indicating the key fob's position.

[0009] Smartphones, wearable devices, and / or other smart portable network devices can function as key fobs. Smart portable network devices can enable various vehicle functions, such as passive welcome lighting and distance boundaries in remote parking applications, as well as long-range distance functions. [Overview of the project]

[0010] A vehicle access system is provided. The access system includes an antenna and an access module. The antenna is configured to receive signals transmitted from a portable access device to the vehicle. The signals are transmitted at a frequency of 2.4 gigahertz. The access module is configured to perform carrier phase-based ranging, which includes down-converting the received signals to generate in-phase and quadrature-phase signals and running a MUSIC algorithm, to (i) determine the distance between the portable access device and the vehicle, and (ii) determine the angle of arrival of the received signals received by the antenna, to determine the position of the portable access device relative to the vehicle based on the distance and angle of arrival, and to grant access to the vehicle based on the position.

[0011] In other features, the antenna is positioned in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and the antenna.

[0012] In other features, the antenna is located within the vehicle's metal structure.

[0013] In addition, the antenna is positioned so that there is no line of sight between the antenna and the portable access device.

[0014] Other features include the inclusion of sensors, each of which includes two or more antennas, and the sensors are positioned in the vehicle such that the received signals have multiple corresponding bounce paths between the portable access device and each sensor.

[0015] Other features include the access module being configured to monitor the received signal, generate a received signal strength indicator based on the received signal, determine whether the portable access device is inside or outside the vehicle based on the received signal strength indicator, and, if the portable access device is outside the vehicle, determine the distance between the portable access device and the vehicle.

[0016] Another feature is that at least one of the antennas is a circularly polarized antenna.

[0017] Other features include an antenna comprising a circularly polarized antenna including a conductive ring-shaped body with an internal bore, a circular isolator connected to the conductive ring-shaped body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular isolator, extending outward from the circular isolator. The linearly polarized antenna comprises a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

[0018] In other features, the access module is configured to collect analytical signal samples of the signals received by each antenna while executing the MUSIC algorithm, generate a received data matrix, estimate a data covariance matrix based on the received data matrix, determine an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, determine the number of incident signals, partition the M×M matrix into matrices, compute the MUSIC spectrum based on one of the matrices, and perform a peak search of the MUSIC spectrum to determine the angle of arrival.

[0019] Other features include a receiver that includes a phase-locked loop and is phase-locked with the transmitter of the portable access device. The access module is configured to perform tone exchange with the transmitter and determine at least one of distance or angle of arrival based on the tone exchange.

[0020] Other features include a receiver that includes a phase-locked loop and is phase-locked with the transmitter of the portable access device. The access module is configured to perform tone exchange with the transmitter, determine round-trip flight time information based on the tone exchange, and then determine distance based on the round-trip flight time information.

[0021] Other features include a vehicle, which includes an access system, body, and a roof, center console, floor, or at least partially enclosed metal structure. The antenna is mounted on at least one of the roof, center console, floor, or at least partially enclosed metal structure.

[0022] Other features include a method which includes receiving a signal transmitted from a portable access device to a vehicle at each of several antennas, the signal being transmitted at a frequency of 2.4 gigahertz, down-converting the received signal to generate in-phase and quadrature-phase signals, performing carrier-phase-based ranging which includes running a MUSIC algorithm to (i) determine the distance between the portable access device and the vehicle, and (ii) determine the angle of arrival of the received signal received by the antenna, determining the position of the portable access device relative to the vehicle based on the distance and angle of arrival, and granting access to the vehicle based on the position.

[0023] In other features, the antenna is positioned in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and the antenna.

[0024] In other features, the antenna is positioned so that there is no line of sight between the antenna and the portable access device.

[0025] In other features, the antenna pair is implemented as part of each sensor. The sensors are positioned in the vehicle such that the received signal has multiple corresponding bounce paths between the portable access device and each sensor.

[0026] Other features of the method further include monitoring the received signal and generating a received signal strength indicator based on the received signal, determining whether the portable access device is inside or outside the vehicle based on the received signal strength indicator, and, if the portable access device is outside the vehicle, determining the distance between the portable access device and the vehicle.

[0027] Another feature is that at least one of the antennas is a circularly polarized antenna.

[0028] Other features of the method further include: collecting analytical signal samples of the signals received by each antenna while running the MUSIC algorithm to generate a received data matrix; estimating a data covariance matrix based on the received data matrix; determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process, where M is an integer greater than or equal to 2, and determining the number of incident signals; partitioning the M×M matrix into multiple matrices; calculating the MUSIC spectrum based on one of the matrices; and performing a peak search of the MUSIC spectrum to determine the angle of arrival.

[0029] In other features, the method further includes performing tone exchange with a transmitter of a portable access device, and determining at least one of distance or angle of arrival based on the tone exchange. The receiver of the portable access device performing the tone exchange includes a phase-locked loop and is phase-locked with the transmitter of the portable access device.

[0030] Other features of the method further include performing tone exchange with the transmitter, determining round-trip flight time information based on the tone exchange, and determining distance based on the round-trip flight time information. The receiver of the portable access device performing the tone exchange includes a phase-locked loop and is phase-locked with the transmitter of the portable access device.

[0031] A vehicle access system is provided. The access system includes a receiver and an access module. The receiver is configured to receive signals transmitted to the vehicle from a portable access device. The access module is configured to generate a differential signal based on the received signal, upsample the differential signal to generate a first upsampled signal, acquire or generate an expected signal, upsample the expected signal to generate a second upsampled signal, cross-correlate the first and second upsampled signals to generate a cross-correlation signal, determine the phase difference between the first and second upsampled signals based on the cross-correlation signal, determine the round-trip time of the signals received by the receiver, and grant access to the vehicle based on the round-trip time.

[0032] In other features, the access module is configured to downconvert a signal to generate a downconverted signal, sample the downconverted signal to generate a sampled signal, perform the arctangent operation on the sampled signal to generate an arctangent signal, and then differentiate the arctangent signal to generate a differentiated signal.

[0033] In other features, the access module is configured to determine at least one of the location or distance of the portable access device to the vehicle based on round-trip time, and to grant access to the vehicle based on at least one of the location or distance.

[0034] Other features include an access module comprising a first upsampler configured to upsample a differential signal to generate a first upsampled signal, and a second upsampler configured to upsample an expected signal to generate a second upsampled signal. The upsampling rate of the first upsampler is the same as that of the second upsampler.

[0035] In other features, the access module includes a sign module configured to determine the sign of a differential signal, and a bit pattern module configured to generate an expected signal based on the sign of the differential signal.

[0036] In other features, the access module is configured to acquire an expectant signal, which is a predetermined signal acquired by the access module before receiving an incoming signal.

[0037] In other features, the access module is configured to perform an iterative process that includes multiplying the bits of the first upsampling signal and the second upsampling signal to produce a resulting product, summing the resulting products to produce a sum-of-products value, and shifting the second upsampling signal relative to the first upsampling signal. The iterative process provides the sum-of-products value. The access module is configured to determine the phase difference based on the sum-of-products value.

[0038] In other features, the access module is configured to reconstruct the signals transmitted from the portable access device to the vehicle based on some zero-crossings of the cross-correlation signals related to the maximum value of the sum-of-products.

[0039] Other features include an access module comprising an upsampler configured to upsample a differential signal to generate a first upsampled signal, a coding module configured to determine the sign of the first upsampled signal, and a bit pattern module configured to generate an expected signal based on the sign of the first upsampled signal.

[0040] In other features, a portable access device for a vehicle access system is provided. The portable access device includes a receiver and a control module. The receiver is configured to receive signals transmitted from the vehicle access module to the portable access device. The control module is configured to generate a differential signal based on the received signal, upsample the differential signal to generate a first upsampled signal, acquire or generate an expected signal, upsample the expected signal to generate a second upsampled signal, cross-correlate the first and second upsampled signals to generate a cross-correlation signal, determine the phase difference between the first and second upsampled signals based on the cross-correlation signal, determine the round-trip time of the signals received by the receiver, and transmit the round-trip time to the vehicle to obtain access to the vehicle based on the round-trip time, or determine at least one of the location or distance between the portable access device and the vehicle and transmit at least one of the location or distance to the vehicle to obtain access to the vehicle.

[0041] In other features, the control module is configured to downconvert a signal to generate a downconverted signal, sample the downconverted signal to generate a sampled signal, perform the arctangent operation on the sampled signal to generate an arctangent signal, and then differentiate the arctangent signal to generate a differentiated signal.

[0042] In other features, the control module is configured to determine at least one of the location or distance of the portable access device to the vehicle based on round-trip time, and to transmit at least one of the location or distance to the vehicle in order to obtain access to the vehicle based on the location or distance.

[0043] In other features, the control module includes a first upsampler configured to upsample a differential signal to generate a first upsampled signal, and a second upsampler configured to upsample an expected signal to generate a second upsampled signal, wherein the upsampling rate of the first upsampler is the same as that of the second upsampler.

[0044] In other features, the control module includes a coding module configured to determine the sign of a differential signal, and a bit pattern module configured to generate an expected signal based on the sign of the differential signal.

[0045] In other features, the control module is configured to acquire an expectant signal, which is a predetermined signal acquired by the access module before receiving the received signal.

[0046] In other features, the control module is configured to perform an iterative process that includes multiplying the bits of the first upsampling signal and the second upsampling signal to produce a resulting product, summing the resulting products to produce a sum-of-products value, and shifting the second upsampling signal relative to the first upsampling signal. The iterative process provides the sum-of-products value. The control module is configured to determine the phase difference based on the sum-of-products value.

[0047] In other features, the control module is configured to reconfigure the signals transmitted from the vehicle's access module to the portable access device based on some zero-crossings of the cross-correlation signals related to the maximum value of the sum-of-products.

[0048] Other features include a control module comprising an upsampler configured to upsample a differential signal to generate a first upsampled signal, a coding module configured to determine the sign of the first upsampled signal, and a bit pattern module configured to generate an expected signal based on the sign of the first upsampled signal.

[0049] A vehicle access system is provided, including an antenna and an access module. The antenna is configured to receive signals transmitted from a portable access device to the vehicle. One of the antennas is a circularly polarized antenna. The access module is configured to downconvert the received signals to generate in-phase and quadrature-phase signals, run a MUSIC algorithm to determine the angle of arrival of the received signals received by the antenna, determine the distance between the portable access device and the vehicle based on the angle of arrival, and then grant access to the vehicle based on the distance.

[0050] Other features include an antenna comprising a circularly polarized antenna including a conductive ring-shaped body with an internal bore, a circular isolator connected to the conductive ring-shaped body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular isolator, extending outward from the circular isolator. The linearly polarized antenna comprises a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

[0051] In other features, the access module is configured to collect analytical signal samples of the signals received by each antenna while executing the MUSIC algorithm, generate a received data matrix, estimate a data covariance matrix based on the received data matrix, determine an M×M matrix based on the covariance matrix using an eigenvalue decomposition process where M is an integer greater than or equal to 2, determine the number of incident signals, divide the M×M matrix into multiple matrices, compute the MUSIC spectrum based on one of the matrices, and perform a peak search of the MUSIC spectrum to determine the angle of arrival.

[0052] In other features, the access module is configured to perform a covariance smoothing method to generate a modified covariance matrix, and then use an eigenvalue decomposition process to determine an M×M matrix based on the modified covariance matrix.

[0053] In other features, the access module is configured to convert in-phase and orthogonal-phase sample vectors into phase angle vectors while generating the received data matrix, generate in-phase and orthogonal-phase sample vectors that are recreated for each antenna based on the phase angle vectors, and then generate the received data matrix based on the in-phase and orthogonal-phase sample vectors that are recreated for each antenna.

[0054] Other features include the access module creating time vectors corresponding to in-phase and quadrature-phase sample vectors, discarding some analysis signal samples acquired near antenna switching time, unwrapping each repeating portion of the remaining samples with a step size of π, averaging the sinusoidal frequencies of the remaining samples, determining the average slope of the remaining samples, measuring the standard deviation of the average slope, determining which antennas are not aligned based on the measured standard deviation, and then, for each antenna, interpolating the straight lines of points on the time vector to generate a reconstructed phase angle vector.

[0055] In other features, the access module is configured to check which of the antennas has misalignment if the standard deviation is greater than a predetermined threshold, and then remeasure the standard deviation of the mean slope for that antenna.

[0056] Other features include the access module being configured to perform a clean method that involves removing source signals one at a time using a calibrated array manifold including an antenna, and then performing an iterative process that includes forcing the source signal positions to offset positions and recalculating the angle of arrival of the remaining signals. While the access module is performing the iteration, it converges to a new set of incident arrival angles.

[0057] In other features, a vehicle is provided, which includes a body and a roof, center console, floor, or at least partially enclosed metal structure. The antenna is mounted on at least one of the roof, center console, floor, or at least partially enclosed metal structure.

[0058] Other features include an antenna that includes a multi-axis polarized RF antenna assembly, which in turn includes a circularly polarized antenna that is oriented on the roof.

[0059] Other features include a method which includes receiving a signal transmitted from a portable access device to a vehicle on each of several antennas, one of which is a circularly polarized antenna, down-converting the received signal to produce in-phase and quadrature-phase signals, running a MUSIC algorithm to determine the angle of arrival of the received signal received by the antenna, determining the distance between the portable access device and the vehicle based on the angle of arrival, and granting access to the vehicle based on the distance.

[0060] Other features include performing the MUSIC algorithm, which involves analyzing the signals received by each antenna, collecting signal samples to generate a received data matrix, estimating a data covariance matrix based on the received data matrix, determining an M×M matrix based on the covariance matrix using an eigenvalue decomposition process where M is an integer greater than or equal to 2, determining the number of incident signals, splitting the M×M matrix into multiple matrices, calculating the MUSIC spectrum based on one of the matrices, and performing a peak search of the MUSIC spectrum to determine the angle of arrival.

[0061] Other features of the method include performing a covariance smoothing method to generate a modified covariance matrix, and using an eigenvalue decomposition process to determine an M×M matrix based on the modified covariance matrix.

[0062] Other features of the method include, while generating the received data matrix, converting in-phase and orthogonal-phase sample vectors into phase angle vectors, generating in-phase and orthogonal-phase sample vectors that are recreated for each antenna based on the phase angle vectors, and generating the received data matrix based on the in-phase and orthogonal-phase sample vectors that are recreated for each antenna.

[0063] Other features of the method include creating time vectors corresponding to in-phase and orthogonal-phase sample vectors, discarding some analytical signal samples acquired near antenna switching time, unwrapping each repeating portion of the remaining samples with a step size of π, averaging the sinusoidal frequencies of the remaining samples, determining the average slope of the remaining samples, measuring the standard deviation of the average slope, determining which antennas are misaligned based on the measured standard deviation, and for each antenna, interpolating the lines of points on the time vector to generate a reconstructed phase angle vector.

[0064] Other features of the method include checking which of the antennas has misalignment if the standard deviation is greater than a given threshold, and further measuring the standard deviation of the mean slope for that antenna.

[0065] Other features of the method further include performing an iterative process that involves removing source signals one at a time using a calibrated array manifold including an antenna, forcing the source signal positions to offset positions and recalculating the angle of arrival of the remaining signals, and performing a clean method that involves converging to a new set of incident arrival angles while the iterative process is running.

[0066] In other features, the vehicle includes (i) a body and (ii) a roof, center console, floor, or at least a partially enclosed metal structure. The antenna is mounted on at least one of the roof, center console, floor, or at least a partially enclosed metal structure.

[0067] Other features include an antenna that includes a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly includes a circularly polarized antenna that is oriented on the roof.

[0068] A multi-axis polarized RF antenna assembly is provided, which includes a circularly polarized antenna, a circular isolator, and a linearly polarized antenna. The circularly polarized antenna includes a conductive ring-shaped body with an internal bore. The circular isolator is connected to the conductive ring-shaped body. The linearly polarized antenna is connected to the circularly polarized antenna and the circular isolator and extends outward from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

[0069] In other features, the conductive element is a wire. In other features, the sleeve is made of polytetrafluoroethene. The conductive element is made of copper.

[0070] Another feature is that the linearly polarized antenna is configured to extend downward from the circularly polarized antenna when in use.

[0071] In terms of other characteristics, a circularly polarized antenna is a two-axis antenna, while a linearly polarized antenna is a single-axis antenna.

[0072] In other features, the multi-axis polarized RF antenna assembly further includes a ground layer. Circular isolators are placed on the ground surface between the conductive elements and the ground surface, and between the circularly polarized antenna and the ground surface.

[0073] In other features, a circularly polarized antenna includes two feed points that are 90° phase-off, and is configured to receive signals that are 90° out of phase with respect to each other.

[0074] Other features include a vehicle, which includes a body and a roof. The roof includes a multi-axis polarization RF antenna assembly. The multi-axis polarization RF antenna assembly is oriented on the roof such that the linear polarization antennas extend downward from the circular polarization antennas.

[0075] Other features include a vehicle system, which includes a multi-axis polarized RF antenna assembly, a second multi-axis polarized RF antenna assembly, and an access module. The multi-axis polarized RF antenna assembly is a first multi-axis polarized RF antenna assembly, configured for vehicle mounting. The second multi-axis polarized RF antenna assembly, configured for vehicle mounting, includes a second circularly polarized antenna comprising a second conductive ring-shaped body having a second internal bore, a second circular isolator connected to the second conductive ring-shaped body, and a second linearly polarized antenna connected to the second circular isolator and extending outward from the second circular isolator. The second linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. The second linearly polarized antenna extends perpendicular to the radius of the second circularly polarized antenna. The access module is connected to a first multi-axis polarized RF antenna assembly and a second multi-axis polarized RF antenna assembly, and is configured to communicate with a portable access device via the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly.

[0076] In other features, at any given time, at least one of the linearly polarized antennas or the first multi-axis polarized RF antenna assembly is not cross-polarized with the antennas of the second multi-axis polarized RF antenna assembly.

[0077] In other features, the access module is configured to perform passive entry passive start operation or phon-as-a-key operation, which includes transmitting and receiving radio frequency signals via one first multi-axis polarized RF antenna assembly and one second multi-axis polarized RF antenna assembly.

[0078] In other features, the access module is configured to grant access to the vehicle based on radio frequency signals.

[0079] In other features, the access module is configured to run an algorithm that determines which antenna pair—one of the first multi-axis polarized RF antenna assemblies or one of the second multi-axis polarized RF antenna assemblies—should be used for communication with the portable access device. In other features, the portable access device is a key fob or a mobile phone.

[0080] Other features include providing a method for communicating with a portable access device. The method involves repeatedly executing an algorithm via the vehicle's access module, the algorithm including a series of processes including selecting one frequency from a set of frequencies, selecting one antenna pair from possible antenna pairs, the antennas of the possible antenna pairs including antennas with different polarization axes, transmitting packets to the portable access device via the selected antenna pair, receiving a first Received Signal Strength Indicator (RSSI) and a response signal from the portable access device, the first RSSI corresponding to the transmission of the packet, and measuring a second RSSI of the response signal. Based on the first and second RSSIs, the best of the frequencies and the best antenna pair from the possible antenna pairs are selected. One or more additional packets are transmitted using the selected best frequency and the selected best antenna pair.

[0081] Other features include the fact that each selected antenna pair includes one linearly polarized antenna and one circularly polarized antenna.

[0082] In other features, the method of claim 1 further includes sending one or more additional packets to formally authorize a portable access device, determining whether the portable access device is authorized to access the interior of the vehicle, and, if authorized, authorizing the portable access device to access the interior of the vehicle.

[0083] Other features of the method include measuring the flight time of one or more additional packets, including the time it takes to send one or more additional packets to a portable access device and the time it takes to receive one or more responses from the portable access device, and estimating the distance between the vehicle and the portable access device based on the measured flight time.

[0084] In another feature, the estimated distance is used to detect whether another device is attempting to carry out a range extender-type relay station attack. In another feature, the method of claim 4 further includes implementing measures, including preventing access to the interior of the vehicle, if another device is attempting to carry out a range extender-type relay station attack. In another feature, the measures include notifying the vehicle owner of the range extender-type relay station attack.

[0085] Other features of the method include exchanging multiple pairs of unmodulated carrier tones with a portable access device at multiple frequencies, each pair of unmodulated carrier tones comprising a receive tone and a transmit tone, measuring the phase of the receive tone relative to the transmit tone, and collecting frequency data, and estimating the distance between the vehicle and the portable access device based on the measured phase and frequency data.

[0086] Other features include determining, based on the estimated distance, whether another device is attempting to carry out a range extender-type relay station attack. Other features include each selected antenna pair including linearly polarized antennas.

[0087] Other features include the algorithm switching between possible antenna pairs between consecutively transmitted packets. Other features include the algorithm switching between possible antenna pairs during the transmission of a portion of a packet. Other features include a portion of the packet being a continuous wave tone.

[0088] In other characteristics, a particular pair of possible antenna pairs includes two juxtaposed antennas.

[0089] Other features of the method further include sending a packet to a portable access device, measuring the time-of-flight value of the packet based on a response signal received from the portable access device, determining whether another device is performing a range extender-type relay station attack based on the response signal sent based on the packet and the time-of-flight value, and preventing access to the interior of the vehicle in response to detecting a range extender-type relay station attack.

[0090] Other features include the portable access device being a key fob or a mobile phone. Other features include the method further including the encryption of the best antenna pair identifier. The transmission of one or more additional packets includes the encrypted identifier of the best antenna pair.

[0091] Other features include the provision of a vehicle system for communicating with a portable access device. The vehicle system includes an access module and antennas with different polarization axes. The access module is configured to repeatedly execute an algorithm. The algorithm includes a series of processes including selecting one frequency from multiple frequencies, selecting one antenna pair from antennas with different polarization axes, transmitting a packet to the portable access device via the selected antenna pair, receiving a first RSSI and a response signal from the portable access device, the first RSSI corresponding to the packet transmission, and measuring a second RSSI of the response signal. Based on the first and second RSSIs, the access module is configured to select the best one of the frequencies and the best antenna pair from the antenna pairs, and to transmit one or more additional packets using the selected best frequency and the selected best antenna pair.

[0092] In other features, the access module is configured to measure the flight time of one or more additional packets, including the time it takes to send one or more additional packets to a portable access device and the time it takes to receive one or more responses from the portable access device, and to estimate the distance between the vehicle and the portable access device based on the measured flight time.

[0093] In other features, the access module is configured to exchange multiple pairs of unmodulated carrier tones with the portable access device at multiple frequencies, the unmodulated carrier tones including a receive tone and a transmit tone, measure the phase of the receive tone relative to the transmit tone, collect the measured phase and frequency data, and use the measured phase and frequency data to estimate the distance between the vehicle and the portable access device.

[0094] In other features, the access module is configured to detect, based on estimated distance, whether the portable access device is attempting to perform a range extender-type relay station attack.

[0095] In other features, the access module is configured to detect, based on estimated distance, whether a device is attempting to carry out a range extender-type relay station attack.

[0096] Other features include the configuration of the access module to implement measures, including preventing access to the vehicle's interior, if a portable access device is attempting to carry out a range extender-type relay station attack.

[0097] Other features include countermeasures that involve notifying the vehicle owner of range extender-type relay station attacks. Other features include portable access devices being key fobs or mobile phones.

[0098] In other features, the portable access device is configured to encrypt the identifier of the best antenna pair. One or more additional packets sent will contain the encrypted identifier of the best antenna pair.

[0099] Other features include a system for detecting range extender type relay attacks. The system includes a first transmitter, a receiver, and a first module. The first transmitter is configured to transmit a first radio frequency signal from one of the vehicles and portable access devices to the other of the vehicles and portable access devices. The receiver is configured to receive a first response signal from one of the vehicles and portable access devices in response to the first radio frequency signal. The first module monitors or generates one or more parameters related to the transmission of the first radio frequency signal and the reception of the first response signal, and based on one or more parameters, detects a range extension type relay attack performed by an attack device to gain at least one of access to the vehicle or control of the vehicle's operation, where (i) the first radio frequency signal is relayed from the vehicle to the portable access device via the attack device, or (ii) the first response signal is relayed from the portable access device to the vehicle via the attack device, and is configured to take action in response to detecting a range extension type relay attack.

[0100] In other features, the first module is implemented in a vehicle. In other features, the first module is implemented in a portable access device.

[0101] In other features, the first module is configured to measure the round-trip time of a first radio frequency signal and, based on the round-trip time, detect range-extension type relay attacks.

[0102] In other features, the first module is configured to transmit a second radio frequency signal and receive a second response signal before transmitting a first radio frequency signal and receiving a first response signal, to monitor at least one of a first received signal strength indicator for the second radio frequency signal or a second received signal strength indicator for the second response signal, and to determine at least one of a path, frequency, channel, or antenna pair for transmitting the first radio frequency signal and receiving the first response signal based on at least one of the first or second received signal strength indicators.

[0103] In other features, the first module is configured to transmit a second radio frequency signal and receive a second response signal before transmitting a first radio frequency signal and receiving a first response signal, to monitor the antenna polarization state corresponding to at least one of the second radio frequency signal or the second response signal, and to determine at least one of the paths, frequencies, channels, or antenna pairs for transmitting the first radio frequency signal and receiving the first response signal based on the antenna polarization state of at least one of the first radio frequency signal or the first response signal.

[0104] In other features, the first module is configured to transmit a first radio frequency signal while receiving a first response signal or a second radio frequency signal from either the vehicle or one of the portable access devices.

[0105] In other features, the first module is configured to receive a first response signal while receiving a second radio frequency signal from the vehicle and one of the portable access devices.

[0106] In other features, the first module is configured to determine a randomly selected set of frequencies or channels, share the randomly selected set of frequencies or channels with the vehicle and one of the portable access devices, and transmit a first radio frequency signal and receive a first response signal based on the randomly selected frequencies or channels.

[0107] In other features, the first module is configured to randomize the access addresses of a vehicle or portable access device, share the randomized access addresses with the portable access device, and generate a first radio frequency signal containing one of the access addresses.

[0108] In other features, the first module is configured to measure the length of at least one bit of the first response signal and to detect range-extension type relay attacks based on the length of at least one bit.

[0109] In other features, the first module is configured to monitor the rise and fall edges of the first response signal and to detect range extension type relay attacks based on the slope.

[0110] In other features, the first module is configured to use a sliding correlation function to align the first response signal to an idealized Gaussian waveform of known bit patterns and bit rates, including peak scaling and zero offset adjustment, and to detect range extension type relay attacks based on the alignment.

[0111] In other features, the first module is configured to accumulate the early portion of the first response signal after a predetermined waveform zero-crossing and before the next peak, determine an average based on the accumulated portion, and then detect range-extension type relay attacks based on the average.

[0112] In other features, the first module is configured to accumulate the slower portion of the first response signal after a predetermined waveform peak and before the next zero crossing, determine an average based on the accumulated portion, and then detect range extension type relay attacks based on the average.

[0113] In other features, the first module is configured to randomize the direction of travel of the first radio frequency signal, including whether the first radio frequency signal is transmitted from the vehicle to the portable access device or from the portable access device to the vehicle.

[0114] Other features include measures that prevent at least one of access to the vehicle or control of the vehicle's operation.

[0115] In other features, the system further includes a second transmitter configured to transmit a dummy signal while the first transmitter transmits a first radio frequency signal or the receiver receives a first response signal.

[0116] In other features, the system includes a first module to be mounted in a vehicle and a portable access device comprising a second module. The first module is configured to transmit a first radio frequency signal to the portable access device and to receive a first response signal from the portable access device. The second module is configured to transmit a second radio frequency signal to the vehicle and to receive a second response signal from the vehicle. At least one of the following occurs: the first module transmits the first radio frequency signal while the second module transmits the first response signal or the second radio frequency signal, or the first module receives the first response signal while the second module transmits the second radio frequency signal.

[0117] In other features, the first and second modules are configured to exchange at least three pairs of radio signals, including a section of unmodulated carrier tones, the unmodulated carrier tones including a received tone and a transmitted tone, and to measure the phase of the received tone relative to the transmitted tone. One or more of the first and second modules are configured to collect frequency and phase information and to estimate the distance between the first and second modules based on the phase and frequency information.

[0118] In other features, one or more of the first and second modules are configured to use estimated distance to detect range extension type relay attacks.

[0119] Other features provide a method for detecting range-extension type relay attacks. The method includes transmitting a radio frequency signal from one of the vehicles and portable access devices to the other via a transmitter; receiving a response signal from one of the vehicles and portable access devices in response to the radio frequency signal via a receiver; monitoring or generating one or more parameters related to the transmission of the radio frequency signal and the reception of the response signal; and detecting a range-extension type relay attack performed by an attack device to gain at least one of access to the vehicle or operational control of the vehicle, wherein (i) the radio frequency signal is relayed from the vehicle to the portable access device via the attack device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attack device. The method further includes taking countermeasures in response to detecting a range-extension type relay attack, measuring the round-trip time of the radio frequency signal, monitoring at least one of a first received signal strength indicator for the radio frequency signal or a second received signal strength indicator for the response signal, and detecting a range-extension type relay attack based on the round-trip time.

[0120] Other features include a system for accessing a vehicle or for providing control over the vehicle's operation. The system includes a master device which includes a first antenna module having a first antenna having different polarization axes, a transmitter configured to transmit a challenge signal from a vehicle to a slave device via the first antenna module, and the slave device being a portable access device, and a first receiver configured to receive a response signal from the slave device in response to the challenge signal. The system further includes a first sniffer device which includes a second antenna module having a second antenna having a different polarization axis, and a second receiver configured to receive the challenge signal from the transmitter and the response signal from the slave device via the second antenna module. The first sniffer device is configured to measure when the challenge signal and the response signal have arrived at the first sniffer device in order to provide arrival times. The master device or the first sniffer device is configured to (i) estimate at least one of the distance from the vehicle to the slave device or the position of the slave device relative to the vehicle based on the arrival time, and (ii) prevent at least one of the estimated distance or position from accessing the vehicle or controlling the vehicle's operation.

[0121] In other features, the master device or first sniffer device is configured to determine the round-trip time associated with the transmission of a challenge signal based on the arrival time, and to detect, based on the round-trip time, a range-extension type relay attack performed by the attacking device to gain access to the vehicle or control of the vehicle's operation. The response signal is relayed from the slave device to the vehicle by the attacking device and modified by the attacking device. The master device is configured to take countermeasures in response to detecting a range-extension type relay attack.

[0122] In other features, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0123] In other features, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with the antenna of the slave device.

[0124] In other features, the master device or the first sniffer device is configured to determine a first time length during which the first sniffer device receives a challenge signal and a second time length during which the sniffer device receives a response signal, and to estimate the distance based on the first and second time lengths.

[0125] Other features include the system further comprising a second sniffer and a third sniffer. The second sniffer device includes a third antenna module, which includes a third antenna, and a third receiver configured to receive challenge signals from a transmitter and response signals from a slave device via the third antenna module. The third sniffer device includes a fourth antenna module, which includes a fourth antenna, and a fourth receiver configured to receive challenge signals from a transmitter and response signals from a slave device via the fourth antenna module. The second sniffer device is configured to measure when the challenge signals and response signals arrive at the second sniffer device in order to provide arrival times. The third sniffer device is configured to measure when the challenge signals and response signals arrive at the third sniffer device in order to provide arrival times. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the location based on the arrival time provided by the first sniffer device, the arrival time provided by the second sniffer device, and the arrival time provided by the third sniffer device.

[0126] In other features, the first sniffer device is configured to determine a first time length during which the first sniffer device receives a response signal. The second sniffer device is configured to determine a second time length during which the second sniffer device receives a response signal. The third sniffer device is configured to determine a third time length during which the third sniffer device receives a response signal. The master device, the first sniffer device, the second sniffer device, or the third sniffer device is configured to estimate the position based on the first, second, and third time lengths.

[0127] In other features, the master device is configured to periodically transmit a challenge signal or other challenge signal to a slave device and receive the respective response signals from the slave device. The first sniffer device is configured to measure when the challenge signal and response signal have arrived at the first sniffer device in order to provide the corresponding arrival time. The master device or the first sniffer device is configured to (i) update at least one of the distance or position based on the arrival time associated with the challenge signal and response signal, and (ii) prevent at least one of the updated distance or updated position from accessing the vehicle or controlling the vehicle's operation.

[0128] Other features provide a method for accessing a vehicle or for providing control over the operation of a vehicle. This method includes transmitting a challenge signal from a master device of a vehicle to a slave device via a first antenna module, the first antenna module including a first antenna having different polarization axes, receiving a response signal from the slave device in response to the challenge signal in a first receiver, receiving the challenge signal from the master device and the response signal from the slave device via a second antenna module and a second receiver in a first sniffer device, the second antenna module including a second antenna having different polarization axes, measuring when the challenge signal and the response signal were received by the first sniffer device in order to provide arrival times via the first sniffer device, estimating at least one of the distance from the vehicle to the slave device or the position of the slave device relative to the vehicle based on the arrival times, and preventing at least one of the estimated distance or position from accessing the vehicle or controlling the operation of the vehicle.

[0129] Other features of the method include determining the round-trip time associated with the transmission of a challenge signal based on the arrival time; detecting a range-extension type relay attack performed by an attacking device to gain at least one of access to the vehicle or control of the vehicle's operation based on the round-trip time; the response signal being relayed from the slave device to the vehicle via the attacking device and modified by the attacking device; and taking countermeasures in response to detecting a range-extension type relay attack.

[0130] In other features, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with at least one of the second antennas of the second antenna module.

[0131] In other features, at any given time, at least one of the first antennas of the first antenna module is not cross-polarized with the antenna of the slave device.

[0132] In other features, the method further includes determining a first time length during which the first sniffer device receives a challenge signal, a second time length during which the sniffer device receives a response signal, and estimating a distance based on the first and second time lengths.

[0133] Other features include the method further comprising: a third receiver of a second sniffer device receiving a challenge signal from a transmitter and a response signal from a slave device via a third antenna module, the third antenna module comprising a third antenna having different polarization axes; and a fourth receiver of a third sniffer device receiving a challenge signal from a transmitter and a response signal from a slave device via a fourth antenna module, the fourth antenna module comprising a fourth antenna having different polarization axes. The method further comprises measuring when the challenge signal and the response signal arrived at the second sniffer device in order to provide the arrival time via the second sniffer device; measuring when the challenge signal and the response signal arrived at the third sniffer device in order to provide the arrival time via the third sniffer device; and estimating the position based on the arrival time provided by the first sniffer device, the arrival time provided by the second sniffer device, and the arrival time provided by the third sniffer device.

[0134] Other features of the method include determining a first time length in which a first sniffer device receives a response signal, determining a second time length in which a second sniffer device receives a response signal, determining a third time length in which a third sniffer device receives a response signal, and estimating a position based on the first, second, and third time lengths.

[0135] Other features include the master device periodically transmitting a challenge signal or other challenge signals to a slave device and receiving corresponding response signals from the slave device. The first sniffer device measures when the challenge signal and response signal arrived at the first sniffer device in order to provide the corresponding arrival time. Based on the arrival times associated with the challenge signal and response signal, at least one of the distance or position is updated. And, based on at least one of the updated distance or updated position, at least one of the vehicle access or vehicle operation control is prevented.

[0136] Other features include a system for accessing a vehicle or for providing control over the vehicle's operation. The system includes a first network device and a control module. The first network device includes a first antenna module, a transmitter, and a receiver. The first antenna module includes antennas having different polarization axes. The transmitter is configured to transmit a series of tones from the vehicle to a second network device via the first antenna module and to change the frequency of the tones while transmitting the series of tones. At any given time, at least one of the antennas of the first antenna module is not cross-polarized with the antenna of the second network device. The receiver is configured to receive a series of tones from the second network device. The control module is configured to (i) determine the phase difference of a series of tones relative to the frequency difference of a series of tones, (ii) determine the distance between the first network device and the second network device based on the phase difference and the frequency difference, and (iii) prevent at least one of accessing the vehicle or controlling the vehicle's operation based on the distance.

[0137] In other features, the control module is configured to change the corresponding frequency for each tone during its transmission, generate a tone curve for each tone that relates the phase change of each tone to the frequency change, determine the slope of the curve, and then determine the distance based on the slope of the curve.

[0138] In other features, the control module randomizes the channels selected for transmitting a series of tones.

[0139] In other features, the control module randomizes the direction in which tones are transmitted between the first and second network devices. The tones consist of one or more tones within a sequence of tones.

[0140] In other features, the control module is configured to send and receive a series of tones via a transmitter and receiver, and to determine the distance based on the phase difference and corresponding frequency difference of the series of tones.

[0141] In other features, the system further includes a second network device. The first network device includes a first tone exchange responder and a first tone exchange initiator. The first tone exchange initiator includes a transmitter. The first tone exchange responder includes a receiver. The second network device includes a second tone exchange responder and a second tone exchange initiator. The second tone exchange responder responds to a set of tones by sending back a set of tones or a second set of tones to the first tone exchange initiator. The second tone exchange initiator transmits a third set of tones to the first tone exchange responder.

[0142] In other features, the control module is configured to determine the distance based on at least one of (i) the difference in phase of a second set of tones relative to the difference in frequency of a second set of tones, or (ii) the difference in phase of a third set of tones relative to the difference in frequency of a third set of tones.

[0143] Other features include the fact that the first network device is implemented inside the vehicle, and the second network device is a portable access device.

[0144] In other features, the first network device simultaneously transmits two symbols to the second network device at two different frequencies. To prevent the attack from succeeding, the length of each of the two symbols is less than 1 μs.

[0145] Other features include synchronized clock timing between the first and second network devices. The first network device transmits a first symbol to the second network device at a first frequency. The second network device transmits a second symbol to the first network device simultaneously with the first network device's transmission of the first symbol to the second network device. To prevent a successful attack, the lengths of the first and second symbols are each less than 1 μs.

[0146] Other features provide a method for accessing a vehicle or providing control over the operation of a vehicle. The method includes transmitting a series of tones from a first network device to a second network device via a transmitter and a first antenna module, and changing the frequency of the tones while transmitting the series of tones, the first antenna module including an antenna, and at any given time, at least one of the antennas of the first antenna module not cross-polarized with the antenna of the second network device, and receiving the series of tones from the second network device at a receiver in a vehicle, determining the phase difference of the series of tones with respect to the frequency difference of the series of tones, determining the distance between the first network device and the second network device based on the phase difference and the frequency difference, and preventing at least one of accessing the vehicle or controlling the operation of the vehicle based on the distance.

[0147] Other features of the method include, for each tone, changing the corresponding frequency during the transmission of that tone, generating a tone curve for each tone that relates the phase change of each tone to the frequency change, determining the slope of the curve, and determining the distance based on the slope of the curve.

[0148] Other features of the method include further randomizing the channels selected for transmitting a series of tones.

[0149] In other features, the method further includes randomizing the direction in which tones are transmitted between a first network device and a second network device. The tones include one or more tones within a sequence of tones.

[0150] Other features of the method further include transmitting and receiving a series of tones via a transmitter and a receiver, and determining a distance based on the phase difference and the corresponding frequency difference of the series of tones.

[0151] In other features, the method further includes responding to a set of tones via a second tone-exchange responder of a second network device by sending back a set of tones or a second set of tones to a first tone-exchange initiator of a first network device, the first tone-exchange initiator including a transmitter, and transmitting a third set of tones to the first tone-exchange responder of the first network device via the second tone-exchange initiator of the second network device, the first tone-exchange responder including a receiver.

[0152] In other features, the method further includes determining the distance based on (i) the difference in phase of a second set of tones relative to the difference in frequency of a second set of tones, or (ii) the difference in phase of a third set of tones relative to the difference in frequency of a third set of tones.

[0153] Other features include the first network device being implemented in the vehicle, and the second network device being a portable access device.

[0154] Other features include a system for accessing a vehicle or for providing control over the vehicle's operation. The system includes an initiator device and a sniffer device. The initiator device includes a first antenna module having multiple polarization antennas and a transmitter configured to transmit a first tone signal from a vehicle to a responder device via the first antenna module, and the responder device is a portable access device and includes a first receiver configured to receive a second tone signal from the responder device in response to the first tone signal. The sniffer device includes a second antenna module having multiple polarization antennas and a second receiver configured to receive a first tone signal from the transmitter and a second tone signal from the responder device via the second antenna module. The sniffer device is configured to determine the states of the first and second tone signals, including their respective phase delays. The initiator device or sniffer device is configured to (i) estimate at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of a first tone signal and a second tone signal, each including a phase delay, and (ii) prevent at least one assessment of the vehicle or vehicle operation control based on the estimated first distance or the second distance.

[0155] In other features, the initiator device or sniffer device is configured to estimate a first distance and a second distance, and based on the first distance and the second distance, to prevent at least one of access to the vehicle or control of the vehicle's operation.

[0156] In other features, the initiator device or sniffer device is configured to detect range-extension type relay attacks performed by an attacking device to gain access to the vehicle or control of the vehicle's operation, based on at least one of a first or second distance. A second tone signal is relayed from the responder device to the vehicle by the attacking device and modified. The initiator device is configured to take countermeasures in response to detecting a range-extension type relay attack.

[0157] In other features, at any given time, at least one of the multiple polarization antennas of the first antenna module is not cross-polarized with at least one of the multiple polarization antennas of the second antenna module.

[0158] In other features, at any given time, at least one of the multiple polarization antennas of the first antenna module is not cross-polarized with the antenna of the responder device.

[0159] In other features, the initiator device or sniffer device is configured to determine a first time length for the first tone signal to travel from the initiator device to the responder device based on the state of the first tone signal when it is received by the responder device, to determine a second time length for the second tone signal to travel from the responder device to the sniffer device based on the state of the second tone signal when it is received by the sniffer device, and to estimate a first distance and a second distance based on the first and second time lengths.

[0160] In other features, the initiator device or sniffer device is configured to generate a first representation of the first tone signal as received by the responder device in natural logarithmic form, a second representation of the first tone signal as received by the sniffer device in natural logarithmic form, a third representation of the second tone signal as received by the sniffer device in natural logarithmic form, and to estimate a first distance and a second distance based on the first, second, and third representations.

[0161] Other features include methods for accessing the vehicle or for providing control over the vehicle's operation. The method includes transmitting a first tone signal from a vehicle's initiator device to a responder device via a first antenna module, the first antenna module comprising multiple polarization antennas, the responder device being a portable access device, receiving a second tone signal from the responder device in response to the first tone signal at the initiator device, receiving the first tone signal from the transmitter and the second tone signal from the responder device at a sniffer device via a second antenna module, the second antenna module comprising multiple polarization antennas, determining the state of the first and second tone signals, including their respective phase delays, at the sniffer device, estimating at least one of a first distance from the vehicle to the responder device or a second distance from the responder device to the sniffer device based on the states of the first and second tone signals, including their respective phase delays, and preventing at least one of the estimated first or second distances from the vehicle to the sniffer device.

[0162] Other features of the method include estimating a first distance and a second distance, and preventing at least one of access to the vehicle or control of the vehicle's operation based on the first distance and the second distance.

[0163] Other features of the method further include detecting a range-extension type relay attack performed by an attacking device to gain access to a vehicle or control of the vehicle's operation based on at least one of a first distance or a second distance; a second tone signal being relayed from a responder device to the vehicle by the attacking device and modified; and taking countermeasures in response to detecting a range-extension type relay attack.

[0164] In other features, at any given time, at least one of the multiple polarization antennas of the first antenna module is not cross-polarized with a linear polarization antenna or at least one of the multiple polarization antennas.

[0165] In other features, at any given time, at least one of the multiple polarization antennas of the first antenna module is not cross-polarized with the antenna of the responder device.

[0166] Other features of the method further include determining a first time length for the first tone signal to travel from the initiator device to the responder device based on the state of the first tone signal when it is received by the responder device; determining a second time length for the second tone signal to travel from the responder device to the sniffer device based on the state of the second tone signal when it is received by the sniffer device; and estimating a first distance and a second distance based on the first and second time lengths.

[0167] Other features include a system for accessing a vehicle or for providing control over the operation of a vehicle. The system includes a first network device and a control module. The first network device includes a first antenna module and a control module. The first antenna module includes a plurality of polarization antennas and a transmitter configured to transmit initiator packets from a vehicle to a second network device via the first antenna module, wherein the initiator packets include a synchronous access word and a first continuous wave (CW) tone, and one of the first and second network devices is implemented in a vehicle, the other one of the first and second network devices is a portable access device, and at any given time, at least one of the plurality of polarization antennas of the first antenna module is not cross-polarized with the antenna of the second network device, and a receiver configured to receive response packets from the second network device, wherein the response packets include a synchronous access word and a first CW tone. The control module is configured to (i) determine if the round-trip timing difference between an initiator packet and a response packet is greater than a predetermined threshold, (ii) detect a range-extension type relay attack performed by an attacking device to gain at least one of access to the vehicle or control of the vehicle's operation based on the timing difference being greater than the predetermined threshold, and (iii) in response to detecting a range-extension type relay attack, prevent at least one of access to the vehicle or control of the vehicle's operation.

[0168] In other features, the control module is configured to determine the start and end times of a synchronous access word based on the initiator packet, and then to detect the timing difference based on the start and end times.

[0169] In other features, the control module is configured to determine the start and end times of the synchronous access word for the first CW tone of the response packet based on the initiator packet, to determine if the start and end times of the synchronous access word in the response packet match the determined start and end times, and to detect the timing difference if the start and end times of the synchronous access word in the response packet do not match the determined start and end times.

[0170] In other features, the control module is configured to determine a first length of the synchronous access word in the initiator packet, compare that first length to a second length of the synchronous access word in the response packet, and detect a range extension type relay attack if the difference between the first and second lengths is greater than a predetermined amount.

[0171] In other features, the control module is configured to determine a first length of the first CW tone of an initiator packet, compare that first length to a second length of the first CW tone of a response packet, and detect a range extension type relay attack if the difference between the first and second lengths is greater than a predetermined amount.

[0172] Other features include the fact that the first CW tone of the initiator packet is at the end of the initiator packet, and the first CW tone of the response packet is at the beginning of the response packet.

[0173] Other features include the initiator packet containing a second CW tone, and the response packet containing that second CW tone.

[0174] Other characteristics include: the first CW tone of the initiator packet is at the beginning of the initiator packet; the second CW tone of the initiator packet is at the end of the initiator packet; the first CW tone of the response packet is at the beginning of the response packet; and the second CW tone of the response packet is at the end of the response packet.

[0175] Another characteristic is that initiator packets and response packets have the same format.

[0176] In other features, the response packet indicates the amount of phase difference between the second CW tone of the initiator packet and the first CW tone of the response packet. The first CW tone of the response packet is in phase with the responder's phase-locked loop.

[0177] In other features, the control module is configured to determine the phase difference between the first CW tone of the response packet and the second CW tone of the initiator packet. The second CW tone of the initiator packet is in phase with the initiator's phase-locked loop. The first and second devices are configured to determine the phase difference for a second frequency and the phase difference for a third frequency. The control module is configured to determine the distance between the devices based on (i) the phase difference between the first and second CW tones, (ii) the phase difference for the second frequency, and (iii) the phase difference for the third frequency.

[0178] In other features, the control module is configured to compare some frequencies, power levels, bits, and amplitudes of the received signal, including the response packet, with some frequencies, power levels, bits, and amplitudes of the transmitted signal, including the initiator packet, and to determine whether a range-extension type relay attack is occurring based on the resulting difference.

[0179] Other features include a method for accessing a vehicle or for providing control over the operation of a vehicle. This method involves transmitting an initiator packet from a vehicle to a second network device via a first antenna module of a first network device, the first antenna module including multiple polarization antennas, the initiator packet including a synchronous access word and a first continuous wave (CW) tone, one of the first and second network devices being implemented in a vehicle, the other of the first and second network devices being a portable access device, and at any given time, at least one of the multiple polarization antennas of the first antenna module being cross-polarized with the antenna of the second network device. The process includes receiving a response packet from a second network device, determining that the response packet includes a synchronous access word and a first CW tone, determining that the timing difference between the initiator packet and the response packet is greater than a predetermined threshold, detecting a range-extension type relay attack performed by the attacking device to gain at least one of access to the vehicle or control of the vehicle's operation based on the timing difference being greater than a predetermined threshold, and preventing at least one of access to the vehicle or control of the vehicle's operation in response to detecting the range-extension type relay attack.

[0180] Other features of the method include determining the start and end times of a synchronous access word based on the initiator packet, and detecting the timing difference based on the start and end times.

[0181] Other features of the method further include determining the start and end times of the synchronous access word for the first CW tone of the response packet based on the initiator packet, determining whether the start and end times of the synchronous access word of the response packet match the determined start and end times, and detecting the timing difference if the start and end times of the synchronous access word of the response packet do not match the determined start and end times.

[0182] Other features include the fact that the first CW tone of the initiator packet is at the end of the initiator packet, and the first CW tone of the response packet is at the beginning of the response packet.

[0183] Other features include: the initiator packet contains a second CW tone; the response packet contains a second CW tone; the first CW tone of the initiator packet is at the beginning of the initiator packet; the second CW tone of the initiator packet is at the end of the initiator packet; the first CW tone of the response packet is at the beginning of the response packet; and the second CW tone of the response packet is at the end of the response packet.

[0184] Other features of the method further include determining the round-trip time of the initiator packet based on the amount of phase delay. The response packet shows the amount of phase delay between the first CW tone of the initiator packet and the first CW tone of the response packet.

[0185] Other features include a system for detecting range-extension type relay attacks. The system includes a transmitter, a receiver, and a control module. The transmitter is configured to transmit a radio frequency signal from one of the vehicles and portable access devices to the other of the vehicles and portable access devices. The receiver is configured to receive a response signal from one of the vehicles and portable access devices in response to the radio frequency signal. The control module converts the response signal into an in-phase signal and a quadrature-phase signal and, based on the radio frequency signal, the in-phase signal, and the quadrature-phase signal, detects a range-extension type relay attack performed by an attack device to gain at least one of access to the vehicle or control of the vehicle's operation, wherein (i) the radio frequency signal is relayed from the vehicle to the portable access device via the attack device, or (ii) the response signal is relayed from the portable access device to the vehicle via the attack device, and is configured to take action in response to detecting a range-extension type relay attack.

[0186] In other features, the system further includes an antenna module. The antenna module is mounted on one of the vehicles and portable access devices, where the transmitter and receiver are also mounted. The antenna module includes multiple polarization antennas. At any given time, at least one of the multiple polarization antennas of the antenna module is not cross-polarized with one of the other antennas of the vehicle and portable access device.

[0187] In other features, the control module is implemented in the vehicle. In other features, the control module is implemented in the portable access device.

[0188] In other features, the control module is configured to determine the phase difference based on in-phase and quadrature-phase signals, measure the round-trip time of the radio frequency signal based on the phase difference, and then detect range-extension type relay attacks based on the round-trip time.

[0189] In other features, the control module is configured to sample in-phase and quadrature-phase signals and to determine the received bits based on the in-phase and quadrature-phase signals.

[0190] In other features, the control module is configured to upsample received bits based on in-phase and quadrature-phase signals, upsample another signal, cross-correlate the results of upsampling the received bits based on in-phase and quadrature-phase signals with the results of upsampling the other signal, and then determine the phase based on the cross-correlation results.

[0191] In other features, another signal contains a reference bit pattern. The control module is configured to determine the sign of the differentiated arctangent signal and, based on that sign, generate the reference bit pattern. In other features, another signal contains a radio frequency signal after being filtered through a Gaussian low-pass filter.

[0192] Other features provide a method for detecting range-extension type relay attacks. The method includes transmitting a radio frequency signal from one of the vehicles and portable access devices to the other of the vehicles and portable access devices via a transmitter; receiving a response signal from one of the vehicles and portable access devices via a receiver in response to the radio frequency signal; converting the response signal into an in-phase signal and a quadrature-phase signal via a control module; detecting a range-extension type relay attack performed by an attack device to gain at least one of access to the vehicle or control of the vehicle's operation via the control module, which is at least one of (i) the radio frequency signal being relayed from the vehicle to the portable access device via the attack device, or (ii) the response signal being relayed from the portable access device to the vehicle via the attack device, and taking action in response to detecting a range-extension type relay attack.

[0193] In other features, the antenna module is implemented in one of the vehicles and portable access devices, where the transmitter and receiver are also mounted. The antenna module includes multiple polarization antennas. At any given time, at least one of the multiple polarization antennas of the antenna module is not cross-polarized with one of the other antennas of the vehicle and portable access device.

[0194] In other features, the control module is implemented in the vehicle. In other features, the control module is implemented in the portable access device.

[0195] Other features of the method further include determining a phase difference based on in-phase and quadrature-phase signals, measuring the round-trip time of radio frequency signals based on the phase difference, and detecting range-extension type relay attacks based on the round-trip time.

[0196] Other features of the method further include sampling in-phase and quadrature-phase signals, and determining the received bits based on the in-phase and quadrature-phase signals.

[0197] In other features, the method further includes upsampling received bits based on in-phase and quadrature-phase signals, cross-correlation the result of upsampling the received bits with the result of upsampling another signal, and determining the phase based on the result of the cross-correlation. In other features, the other signal includes a reference bit pattern. In other features, the other signal includes a radio frequency signal after being filtered through a Gaussian low-pass filter.

[0198] Further areas of application of this disclosure will become apparent from the detailed description, claims, and drawings. The detailed description and specific examples are for illustrative purposes only and are not intended to limit the scope of this disclosure. [Brief explanation of the drawing]

[0199] This disclosure will be better understood from the detailed description and accompanying drawings. [Figure 1] This is a side view of an object showing a primary high-power RF signal traveling along a bounce path due to the cross-polarization of an RF antenna. [Figure 2] This is a functional block diagram of an example of a vehicle access system, including an access module, an RF antenna, and a portable access device, according to one embodiment of the present disclosure. [Figure 3] This is a functional block diagram of an example of a vehicle including the access module shown in Figure 2, according to one embodiment of the present disclosure. [Figure 4] This is a functional block diagram of an example of the access module shown in Figure 2, according to one embodiment of the present disclosure. [Figure 5] This is a functional block diagram of an example of a vehicle RF antenna module according to one embodiment of the present disclosure. [Figure 6] This is a functional block diagram of an example of a portable network device according to one embodiment of the present disclosure. [Figure 7] This is an example of a polarization axis diagram showing an exemplary arrangement of polarization diversity according to one embodiment of the present disclosure. [Figure 8] This is an example of a polarization axis diagram showing an exemplary arrangement of another polarization diversity according to one embodiment of the present disclosure. [Figure 9] This is an exemplary field diagram and polar coordinate plot showing the electric field pattern and null of a linear antenna. [Figure 10] This is an example voltage-field diagram for a linearly polarized antenna. [Figure 11A] This is a top perspective view of at least one example of a multi-axis polarization RF antenna assembly including a linear polarization antenna and a circular polarization antenna, according to one embodiment of the present disclosure. [Figure 11B] Figure 11A is a bottom perspective view of at least a portion of the multi-axis polarization RF antenna assembly. [Figure 12] Figure 11A-B shows an example polar coordinate plot of radiated power associated with a linearly polarized antenna. [Figure 13] Figure 11A-B shows an exemplary polar coordinate plot of radiated power associated with a circularly polarized antenna. [Figure 14] This is a functional block diagram of an example of a part of an RF circuit and portable access device according to one embodiment of the present disclosure. [Figure 15] This is a block diagram of a partial example of a key fob having two linearly polarized slot antennas, a metal trim, and a spare key, according to one embodiment of the present disclosure. [Figure 16] This is a block diagram of an example of a part of the key fob shown in Figure 15, which has an x-axis linear polarization slot antenna and a y-axis linear polarization slot antenna, and lacks metal trim and spare keys. [Figure 17] Figure 16 is an illustrative polar coordinate plot of radiated power associated with a linearly polarized slot antenna on the x-axis of a portion of the key fob. [Figure 18] Figure 16 is an illustrative polar coordinate plot of radiated power associated with a y-axis linearly polarized slot antenna for a portion of the key fob. [Figure 19] Figure 16 shows an example of a return loss versus frequency plot for a linearly polarized slot antenna. [Figure 20] This is a block diagram of an example of a part of the key fob shown in Figure 15, including a spare key and without metal trim. [Figure 21] Figure 20 is an illustrative polar coordinate plot of radiated power associated with a linearly polarized slot antenna on the x-axis of a portion of the key fob. [Figure 22] Figure 20 is an illustrative polar coordinate plot of radiated power associated with a y-axis linearly polarized slot antenna for a portion of the key fob. [Figure 23] Figure 20 shows an example of a return loss versus frequency plot for a linearly polarized slot antenna. [Figure 24] This is a block diagram of an example of a key fob, Figure 15, with a metal trim piece and a spare key. [Figure 25] Figure 24 is an illustrative polar coordinate plot of radiated power associated with a linearly polarized slot antenna on the x-axis of a portion of the key fob. [Figure 26]Figure 24 is an illustrative polar coordinate plot of radiated power associated with a y-axis linearly polarized slot antenna for a portion of the key fob. [Figure 27] Figure 24 shows an example of a return loss versus frequency plot for a linearly polarized slot antenna. [Figure 28] Figure 15 is an illustrative polar coordinate plot of radiated power associated with a linearly polarized slot antenna on the x-axis of a portion of the key fob. [Figure 29] Figure 15 is an illustrative polar coordinate plot of radiated power associated with a y-axis linearly polarized slot antenna for a portion of the key fob. [Figure 30] Figure 15 shows an example of a return loss versus frequency plot for a linearly polarized slot antenna. [Figure 31] This is a block diagram of a partial example of a key fob having a closed linear polarization slot antenna, an open linear polarization slot antenna, a metal trim, and a spare key, according to one embodiment of the present disclosure. [Figure 32] Figure 31 is an illustrative polar coordinate plot of radiated power associated with a portion of the x-axis linearly polarized slot antenna in the key fob. [Figure 33] Figure 31 is an illustrative polar coordinate plot of radiated power associated with a y-axis linearly polarized slot antenna for a portion of the key fob. [Figure 34] Figure 31 shows an example of a return loss versus frequency plot for a linearly polarized slot antenna. [Figure 35] One embodiment of the present disclosure describes a method for determining which antenna combination to use for exchanging packets between RF antenna modules of a vehicle and a portable access device for round-trip flight time measurement. [Figure 36] One embodiment of the present disclosure provides another method for determining which antenna combination to use for exchanging packets between RF antenna modules of a vehicle and a portable access device for round-trip flight time measurement. [Figure 37] This is a time-of-flight measurement chart. [Figure 38]This is a functional block diagram of an exemplary BLE radio equipped with a superheterodyne receiver and transmitter according to one embodiment of the present disclosure. [Figure 39] This is an example GFSK parameter definition plot. [Figure 40] This is a functional block diagram of the system for sending BLE packets. [Figure 41] Exemplary preambles and access addresses for different types of BLE packets are shown. [Figure 42] This is an example of a plot of a BLE packet signal showing the corresponding bits. [Figure 43] Here is another example of a plot of other BLE packet signals showing the corresponding bits. [Figure 44] Figure 44 is an overlap plot of BLE packet signals, where one BLE packet signal is shifted relative to the other. [Figure 45] An exemplary method for detecting range-extension type relay attacks according to one embodiment of the present disclosure is shown. [Figure 46] This is a functional block diagram of an example of a vehicle and a portable access device, including a round-trip time initiator and a round-trip time responder, according to one embodiment of the present disclosure. [Figure 47] Figure 46 is a functional block diagram of a vehicle and portable access device, illustrating the transmission of radio frequency signals via the corresponding antenna. [Figure 48] Figure 46 is a functional block diagram of a vehicle and portable access device under attack by a range-extension type relay attack device. [Figure 49] These are functional block diagrams of two exemplary BLE radios according to one embodiment of the present disclosure. [Figure 50] This is a functional block diagram of an exemplary position-distance determination system including a round-trip time sniffer, according to one embodiment of the present disclosure. [Figure 51]This is a functional block diagram of an exemplary position-distance determination system including multiple round-trip time sniffers according to one embodiment of the present disclosure. [Figure 52] This is a functional block diagram of an exemplary network device configured to perform tone exchange for distance determination and attack detection, according to one embodiment of the present disclosure. [Figure 53] This is a functional block diagram of an exemplary positioning system including a tone-exchange sniffer according to one embodiment of the present disclosure. [Figure 54] One embodiment of the present disclosure describes a method for determining the distance between an initiator and a responder, and between a responder and a sniffer. [Figure 55] This is a functional block diagram of an exemplary passive tone exchange and phase difference detection system according to one embodiment of the present disclosure. [Figure 56] This is a functional block diagram of an example of an active tone exchange / phase difference detection system according to one embodiment of the present disclosure. [Figure 57] This is a diagram of exemplary initiator and responder packets used for RSSI and time-of-flight measurement according to one embodiment of the present disclosure, the packets including a continuous wave (CW) tone and a preamble. [Figure 58] This is a diagram of exemplary initiator and responder packets used for RSSI and time-of-flight measurement according to one embodiment of the present disclosure, the packets containing a CW tone but without a preamble. [Figure 59] This is a diagram of exemplary initiator and responder packets used for RSSI and time-of-flight measurement according to one embodiment of the present disclosure, the packets being in the same format, containing multiple CW tones, and not including a preamble. [Figure 60] This figure shows exemplary initiator and response packets having the same format according to another embodiment of the present disclosure. [Figure 61] This is a functional block diagram of an antenna routing system for a network device having separate antenna modules, according to another embodiment of the present disclosure. [Figure 62] Figure 38 is an exemplary radio model corresponding to the structure, function, and operation of the BLE radio. [Figure 63] Another embodiment of the present disclosure describes a method for exchanging packets between RF antenna modules of a BLE radio to detect range extension type relay attacks. [Figure 64A] Figure 62 shows illustrative plots of the signals from the sampling module, Gaussian low-pass filter, and integrator of the model. [Figure 64B] Figure 62 is an illustrative plot of the signal from the resampling module of the model. [Figure 64C] Figure 62 shows an illustrative plot of the signal from the arctangent module of the model. [Figure 64D] This is an illustrative plot of the signal from the differentiator superimposed on the signal from the Gaussian LPF in the model shown in Figure 62. [Figure 65] The diagram shows a different pair of antenna axis assemblies, each containing two linearly polarized antennas, according to another embodiment of the present disclosure. [Figure 66] The image shows a perspective view of a pair of antenna axis assemblies having the same number of antennas, one of which is located inside a metal container and the other outside the metal container, according to another embodiment of the present disclosure. [Figure 67] The following is a perspective view of another pair of antenna axis assemblies having a different number of antennas, one of which is located inside a metal container and the other outside the metal container, according to another embodiment of the present disclosure. [Figure 68] This diagram shows the distance boundary during high-speed bit exchange, where the prober sequence can be cryptographically secure and known independently of the verifier sequence. [Figure 69] This diagram illustrates how, during high-speed bit exchange, response bits are prevented from being sent too quickly, and the prober sequence is cryptographically secure and can rely on the verifier sequence. [Figure 70] This is a side view of multiple antennas showing their angles of arrival. [Figure 71] This disclosure describes the AOA method, including the use of the MUSIC algorithm. [Figure 72] This is an example of a covariance plot based on this disclosure. [Figure 73] This is an example of plotting eigenvectors and array manifold responses according to this disclosure. [Figure 74] This is another example of a plot of eigenvectors and array manifold response according to this disclosure. [Figure 75] This is an example of a MUSIC power spectrum plot according to this disclosure. [Figure 76] This is a functional block diagram of the antenna selection system described in this disclosure. [Figure 77] This disclosure illustrates an exemplary reconstruction method. [Figure 78A] This is a top view of a vehicle showing an example of sensor placement according to this disclosure. [Figure 78B] This is a side view of the vehicle shown in Figure 78A. [Figure 78C] Figure 78A is a rear view of the vehicle showing the bounce reflection and corresponding path of the transmitted signal detected by the sensor according to this disclosure. [Figure 79A] This is a top view of a vehicle showing another example of sensor arrangement according to this disclosure. [Figure 79B] This is a side view of the vehicle shown in Figure 79A. [Figure 79C] Figure 79A is a rear view of the vehicle showing the bounce reflection and corresponding path of the transmitted signal detected by the sensor according to this disclosure. In the drawings, reference numbers may be reused to identify similar and / or identical elements. [Modes for carrying out the invention]

[0200] RF devices can measure distance by unmodulated carrier tone exchange. For example, U.S. Patent No. 8,644,768, incorporated herein by reference, provides a system and method for measuring distance between two nodes in a radio network using unmodulated carrier tone exchange.

[0201] RF devices can measure or limit distance by the timing of the round-trip rapid exchange of cryptographically secure messages. For example, in "Distance-Bounding Protocols (Extended abstract)" by Brans and Chaum, presented at the workshop at Cryptographic Technology Theory and Applications for Advances in Cryptography (EUROCRYPT '93), incorporated herein by reference, a sequence of rapid bit exchanges is used between a verifier and a prober. The prober sequence may be cryptographically secure and known, independently of the verifier sequence, as shown in Figure 68. The prober sequence may be cryptographically secure and depend on the verifier sequence, as shown in Figure 69.

[0202] RF devices that measure distance by round-trip timing are vulnerable to early detection and late commit attacks, as described in "Attacks on Time-of-Flight Distance Bounding Channels" by Hancke and Kuhn in the proceedings of the 1st ACM Conference on Wireless Network Security (WiSec'08), incorporated herein by reference. RF devices that measure distance by unmodulated carrier tone exchange are vulnerable to signal delay rollover attacks, as described in "On the Security of Carrier Phase-based Ranging" by Olafsdotter, Ranganathan, and Capkun in the IACR Cryptology ePrint Archive 2016, incorporated herein by reference.

[0203] Traditional PEPS systems enable keyless entry and vehicle starting, but they are susceptible to range extender-type relay station attacks. A range extender-type relay station attack refers to an attacker using a relay device to detect, amplify, and relay signals between a key fob (or other smart portable network device) and a vehicle, causing the vehicle's access module to behave as if the key fob were approaching or near the vehicle. For example, if an attacker touches the vehicle's door handle with their hand and / or relay device, the access module may generate and transmit an LF wake-up signal. As a result, the relay device is actually detected, and the access module sends an LF wake-up signal to the key fob, which is received by the relay device. The relay device receives and amplifies the LF wake-up signal and forwards (or rebroadcasts) it to the actual key fob. The key fob may be located inside a house, while the vehicle is parked outside or in front of the house. The key fob may receive an amplified wake-up signal, generate a response signal, and / or initiate communication over the RF link. The response signal and / or RF communication signal are amplified and relayed between the vehicle's antenna and one or more antennas on the key fob. This can be done via a relay device. As a result, the relay device is mistaken for the key fob by the access module, “deceiving” the access module into behaving as if the key fob were in the relay device’s location, which allows the access module to gain unauthorized access to the vehicle’s interior.

[0204] In addition, the antenna system of the current PEPS system may prevent the PEPS system from accurately estimating the distance between the key fob and the vehicle, and accurately estimating the key fob's position relative to the vehicle, as will be further explained below. Distance and position can be determined based on time-of-flight measurements. Time of flight and the corresponding received signal strength are measured. The received signal strength indicator (RSSI) with the greatest magnitude typically corresponds to the direct or shortest distance between the key fob and the vehicle. The time-of-flight measurement associated with the largest RSSI is used to calculate the distance between the key fob and the vehicle.

[0205] Examples described herein include a combined LF and RF PEPS key fob that uses RF round-trip timing (RTT) measurement to prevent range extender type relay station attacks. Other examples include RTT measurement, carrier phase-based ranging, and combinations of RTT measurement and carrier phase-based ranging in a PEPS system. These examples also reveal many other features, which are further described below.

[0206] Figure 1 illustrates an example of when cross-polarization of antennas can lead to inaccurate distance determination between a first RF antenna on a key fob and a second RF antenna on a vehicle. If the first RF antenna on the key fob is positioned relative to the second RF antenna on the vehicle so that the first RF antenna is cross-polarized with the second RF antenna, the determined distance corresponds to a bounce path rather than a direct path. Antennas are cross-polarized, for example, when their polarizations are perpendicular to each other. An example of this is shown in Figure 1.

[0207] Figure 1 shows object 10 and the polarization axes 12 and 14 of the respective RF antennas. The antennas are linearly polarized antennas. The first RF antenna has a first polarization axis 12 and is located inside the vehicle. The second RF antenna has a second polarization axis 14 and is located inside the key fob. Due to the relative positions of the first RF antenna, the second RF antenna, and object 10, the RF signal 16 transmitted from the antennas may bounce off object 10. The signal energy (or voltage) corresponding to the bounce path is greater than the signal energy (or voltage) corresponding to the direct path 18 between the antennas. This is due to the cross-polarization of the RF antennas. An access module that determines the distance between antennas based on the signal path with the greatest signal energy or voltage may incorrectly determine the distance between antennas as the length of the bounce path 16 rather than the length of the direct path 18.

[0208] When nulls align in an identical polarization antenna configuration, bounce paths are also used. This occurs when the first and second RF antennas are oriented in the same direction. The antennas may be positioned so that lines extend longitudinally through the antennas. This is further illustrated in Figure 9-10.

[0209] The examples described herein include polarization diversity for RF signal transmission between a vehicle's RF antenna and an RF antenna of a portable access device (e.g., a key fob, mobile phone, wearable device, etc.). In addition, these examples include pseudo-random bidirectional data exchange. Polarization diversity is provided to ensure that at any given time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized with the polarization axis of at least one receiving antenna, is somewhat identically polarized, and is identically polarized without collinear nulls. As used herein, the phrase “at any given time” means always while the corresponding devices are communicating with each other, and / or always while one or more signals are being transmitted between devices and while one or more signals are being received by one or more devices. This helps prevent range extender-type relay station attacks, in addition to enabling accurate distance determination. The pseudo-random bidirectional data exchange described below also helps prevent range extender-type relay station attacks.

[0210] Next, exemplary embodiments will be described in more detail with reference to the attached drawings.

[0211] Figure 2 shows a vehicle access system 28 that functions as a PEPS system and a PAK system. The vehicle access system 28 includes a vehicle 30 and may include a key fob 32, a mobile phone 34, and / or other portable access devices such as a wearable device, a laptop computer, or other portable network device. The portable access device may be a Bluetooth®-enabled communication device such as a smartphone, smartwatch, wearable electronic device, key fob, tablet device, or other device associated with the user of the vehicle 30. The user may be the owner, driver, or passenger of the vehicle 30, and / or a mechanic for the vehicle 30.

[0212] Vehicle 30 includes an access module 36, an LF antenna module 38, and an RF antenna module 40. The access module 36 can wirelessly transmit an LF signal to a portable network device via the LF antenna module 38 and can wirelessly communicate with a portable access device via the RF antenna module 40. The RF antenna module 40 provides polarization diversity between the antennas of the portable network device and the antenna of the RF antenna module 40, respectively. The polarization diversity, which will be further described below, provides a minimum number, combination, and arrangement of polarization axes in the portable network device and the vehicle 30, and at any point in time, at least one transmitting antenna has at least one polarization axis that is not cross-polarized with the polarization axis of at least one receiving antenna. In other words, at any point in time, at least one RF antenna of the vehicle has at least one polarization axis that is not cross-polarized with the polarization axis of at least one RF antenna of each portable access device. Although a specific number of LF antenna modules and RF antenna modules are shown, any number can be used, respectively.

[0213] The access module 36 can communicate with the LF antenna module 38 and the RF antenna module 40 wirelessly and / or via a vehicle interface 45. As an example, the vehicle interface 45 can include a controller area network (CAN) bus, a local interconnect network (LIN) for lower data rate communication, a clock extension peripheral interface (CXPI) bus, and / or one or more other vehicle interfaces.

[0214] The LF antenna module 38 is located at various locations in the vehicle and can transmit low-frequency signals (e.g., 125 kHz signals). Each of the LF antenna modules includes an LF antenna and can include a control module and / or other circuits for LF signal transmission. The RF antenna module 40 is also disposed at various locations in the vehicle and can transmit RF signals such as Bluetooth Low Energy (BLE) signals that follow the BLE communication protocol. Alternatively, the RF antenna module 40 may communicate according to other wireless communication protocols such as Wi-Fi. An example of the antenna is shown in FIG. 11 (referring collectively to FIGS. 11A and 11B).

[0215] In one embodiment, to improve signal coverage for the vehicle and improve transmission and reception characteristics, the RF antenna module 40 is disposed on the roof 46 of the vehicle 30. As an example, each of the RF antenna modules 40 can include a pair of RF antennas, one linearly polarized antenna, and one circularly polarized antenna. The number and position of the RF antenna modules can be preselected based on the size and shape of the vehicle 30. In one embodiment, two RF antenna modules are included and are spaced apart from each other as shown in FIG. 2 such that the corresponding electric fields overlap each other and spread in a 360° pattern around the vehicle beyond the outer periphery of the vehicle. The electric fields provide the resulting electric field as shown in FIG. 1, represented by the dashed circle 48. The dashed circle provides an overall "rectangular-like" shape. In larger vehicles, more antenna modules 40 may be added to make the shape more "rectangular-like". In smaller vehicles, only one RF antenna module 40 may be included.

[0216] Different numbers of antennas with different numbers of antenna polarizations may be used. Figures 65-67 show several other exemplary antenna configurations. Figures 65-67 include fewer antennas and antenna polarizations, which are used to measure or limit distance when a diverse set of frequencies and / or RF channels is used to measure or limit distance and / or reflection from metal of a vehicle. This is done to create virtual polarization diversity. The antenna system can tolerate some degree of erroneous measurement due to cross-polarization and / or null alignment. In Figures 65-67, 7100A-J refers to antenna axis assemblies, 7100A-7100I refers to antenna axis assemblies with two polarization axes, and 7100J refers to antenna axis assemblies with one polarization axis. Numerical designators 7101A-7101I and 7102A-7102I refer to the polarization antenna axes of two polarization antenna axis assemblies. Numerical designator 7101J refers to a single polarization axis of 7100J. Numerical designators 7103AB, 7103CD, 7103EF, 7103GH, and 7103JI refer to RF paths between pairs of antenna assemblies. Many RF paths exist between antenna axes, some with large link margins, some with small link margins, and some with large phase rotation time delays. Various round-trip timing and unmodulated carrier tone exchange ranging algorithms disclosed, described, and / or referenced herein have the ability to find or measure shorter paths, which may not be the shortest, with link margins of several decibels (dB) above or below the path with the highest link margin. The more frequencies (or channels), the more round-trip timing or tone exchange measurements are performed, and the more mathematically complex and time-consuming the algorithm, the smaller the link margins of the shorter indirect paths found may be.

[0217] The additional antenna axes provide polarization diversity to the RF paths between the antenna axis assemblies, which provides path diversity. Numerical designator 7200 refers to a simplified representation of an open, three-sided metal box and / or vehicle body for RF radio waves in the gigahertz or multi-gigahertz range. Numerical designator 7201 refers to a simplified representation of a metal plate and / or lid to a box and / or roof of a vehicle for RF radio waves in the gigahertz or multi-gigahertz range. Figures 66 and 67 can also be viewed upside down, where 7200 is a simplified representation of the open, concave shape of the vehicle roof and 7201 is a simplified representation of the vehicle floor.

[0218] The RF connection between 7100A and 7100B along RF path 7101AB is strong because both pairs of antenna axes between the antenna axis assemblies are identically polarized. This condition is rare for any pair of two-axis antennas in any orientation, even when the identical polarization zone is wide and a rotation of approximately 5° from 90° increases the link margin by about 6dB from the median link margin. This is because manipulating any pair of antenna axis assemblies in any orientation to this setting requires a rotation of three angles, and the antenna axes are symmetrical every 90 degrees, so this setting occurs arbitrarily in a time portion of approximately (5 / 90)*(5 / 90)*(5 / 90), or 1.71E-4. The RF connection between 7100C and 7100D along RF path 7101CD is not as strong as 7101AB, but is still good because there are no identically polarized or cross-polarized antenna paths and the nulls are not aligned. The RF connection between 7100E and 7100F along the RF path 7101EF is weakened because each antenna path between the individual antenna axes is either cross-polarized or contains a null in at least one antenna. Again, this condition is rare because manipulating a pair of arbitrarily oriented antenna axes to this setting requires a rotation of three angles. Furthermore, for example, as an arbitrarily oriented pair of two-axis antennas with a 5° cross-polarization and null alignment zone, where the link margin drops by 20dB or pow2dB(sin(pi*5 / 180)∧2), manipulating an arbitrarily oriented antenna pair to this setting requires a rotation of three angles, and since the antenna axes are symmetrical every 90 degrees, this setting occurs arbitrarily in a time portion of approximately (5 / 90)*(5 / 90)*(5 / 90), or 1.71E-4.

[0219] As can be seen in Figure 7-8, it is clear that if there are three polarization axes that are nearly perpendicular to one side and two polarization axes that are nearly perpendicular to the other side, it is not possible to align the nulls while cross-polarizing. If there are three polarization axes that are nearly perpendicular to one side and one polarization axis on the other side, the nulls can be aligned through two rotations and can be generated arbitrarily.

[0220] Generally, the more antenna axes there are on each side of the connection, the less likely it is that a direct path with a low link margin will occur. Round-trip timing ranging and unmodulated carrier tone exchange ranging tend to measure direct paths with a larger link margin compared to reflected paths, so preventing or reducing the possibility of a direct path with a low link margin is beneficial. Conversely, the lower the link margin of the direct path is compared to the reflected path, the more likely ranging techniques are to measure the distance along the reflected path.

[0221] In Figure 66, if the size of the metal box is appropriate for the range of distance to be measured, and the distance variation is measured based on various reflection paths within the metal box, and one side of the ranging connection is located inside the metal box, then by planning a small number of direct paths, the number of polarization axes required to obtain reasonable measurements can be reduced. If one of the antenna axes of the 7100G is oriented such that a null is directed along the strongest and / or shortest reflection path toward the 7100H, then the other antenna axes of the 7100G will find a bounce path with a strong link margin toward one of the antenna axes 7101H or 7102H. This is especially true when averaging across multiple channels, such as 37 data channels in a BLE data link. Some, but not most, channel and antenna axis path combinations may fade rapidly due to multipath. For any orientation of antenna axis pair 7100G, the link margin at antenna axis pair 7100H is approximately the same, and the distance measured along the reflection path of 7103IJ is approximately the same. While how the reflection path 7103GH bounces off the sidewalls of roof 7201 or 7200 varies, the overall path variation is limited by the size and position of the components of 7200 and 7201. This limitation on path variation changes when 7100G is raised to a height where a direct path exists, which shortens the measured distance by removing the reflection from path 7103GH. The range measured between 7100G and 7100H along the reflection path or the shorter direct path sets a comparison boundary indicating that 7100G, which may be part of a portable device, is within the distance threshold of 7100H. 7100H may also be part of PEPS module 211 or PAKM module 212. These distance range measurements between a pair of 7100 modules may be compared to be smaller than the boundary. The measured values, distances, and / or comparison results may be used as part of an "if-then-else" comparison in a software decision tree to indicate that the portable access device 400 is within the approach zone, unlocking zone, and / or vehicle mobility zone.

[0222] Figure 67 is similar to Figure 66, except that the antenna axis assembly 7100J includes a single polarization antenna axis 7101J. In one embodiment, the antenna axis assembly 7100J includes only a single polarization antenna axis. It is possible to orient 7101J so that nulls are directed along the strongest and / or shortest reflection path toward 7100H. In this case, round-trip timing and unmodulated carrier tone exchange techniques tend to measure the distance along a path (not shown) away from box 7200 and bouncing back toward the box. Two rotations of an arbitrary orientation of antenna pair are required to operate to this setting, and since the antennas are symmetrical every 90 degrees, two rotations are required to orient an arbitrary orientation of antenna axis to this orientation if, for example, the link margin is 20 dB or pow2 dB (sin(pi*5 / 180)∧2) down, for example, if there is a zone where nulls are aligned, for example, 5° wide. This orientation occurs arbitrarily for approximately (5 / 90)*(5 / 90), i.e., 3E-3, in the time portion. This setting may be used to perform distance range measurements between a pair of 7100 modules and compare the measured values ​​to those smaller than the boundary, except in the time-increasing portion where significantly different indirect paths are measured due to higher power paths reflected by distant objects. The measured values, distances, and / or comparison results may be used as part of one or more "if-then-else" comparison and software decision trees to indicate that the portable access device 400 is within the approach zone, unlocking zone, and / or vehicle mobility zone.

[0223] Polarization diversity can be created by using different polarizations of antennas. Multiple polarization antennas (or antenna axes) create polarization diversity. A linear axis and another linear axis, two linear axes including a linear axis and a circularly polarized antenna, or three independent linear axes (linearly polarized antennas) are all possible. This is especially true if there is metal nearby to create virtual polarization diversity.

[0224] The 7101H or 7101J antenna axis pair may be positioned at a lower position on the metal box that is the vehicle body, or at a higher position on the metal box that is the vehicle roof, in order to realize these virtual antenna axis array effects.

[0225] Figure 3 shows vehicle 200, which is an example of vehicle 108 in Figure 1. Vehicle 200 includes a PAK system 202, which includes a vehicle control module 204, an infotainment module 206, and other control modules 208 (e.g., a body control module). Modules 204, 206, and 208 can communicate with each other via a Controller Area Network (CAN) bus 209 and / or other vehicle interfaces (e.g., vehicle interface 45 in Figure 2). The vehicle control module 204 can control the operation of the vehicle system. The vehicle control module 204 may include a PEPS module 211, a PAK module 212, a parameter adjustment module 213, and other modules shown in Figure 4. The vehicle control module 204 may also include one or more processors configured to execute instructions stored in a non-temporary computer-readable medium such as memory 218, which may include read-only memory (ROM) and / or random access memory (RAM).

[0226] The PEPS module 211 can perform PEPS operations to provide access to the interior of the vehicle and allow the vehicle to be started and / or operated. The PAK module 212 works in conjunction with the PEPS module 211 to perform the PAK operations described herein. The PEPS module 211 may include the PAK module 212, or modules 211 and 212 may be implemented as a single module. A parameter adjustment module 213 may be used to adjust the parameters of the vehicle 200.

[0227] The PAK system 202 may further include a memory 218, a display 220, an audio system 221, and one or more transceivers 222 including an LF antenna module 38 and an RF antenna module 40. The RF antenna module 40 may include and / or be connected to an RF circuit 223. The PAK system 202 may further include a navigation system 227 including a telematics module 225, a sensor 226, and a Global Positioning System (GPS) receiver 228. The RF circuit 223 may be used to communicate with a mobile device (e.g., mobile device 102 in Figure 1) that transmits Bluetooth® signals at 2.4 gigahertz (GHz). The RF circuit 223 may include BLE radios, transmitters, receivers, etc., for sending and receiving RF signals.

[0228] One or more transceivers 222 include an RF transceiver containing an RF circuit 223 and run an access application having code for checking timestamped data transmitted and received by the RF antenna module 40. The access application can, for example, verify whether the RF antenna module received the correct data at the correct time. The access application is stored in memory 218 and may be executed by the PEPS module 211 and / or the PAK module 212. Other examples of the operation of the access application are described further below.

[0229] The access application can implement a Bluetooth® protocol stack configured to provide a channel map, access identifier, next channel, and next channel time. The access application is configured to output a timing signal for a timestamp of the signals transmitted and received via the RF antenna module 40. The access application can acquire channel map information and timing information and share this information with other modules in the vehicle.

[0230] The telematics module 225 can communicate with a server via a cell tower station. This may include the transfer of timing information, including certificates, license information, and / or global clock timing information. The telematics module 225 is configured to generate location information and / or location information errors relating to the vehicle 200. The telematics module 225 may be implemented by a navigation system 227.

[0231] Sensor 226 may include sensors used for PEPS and PAK operation, cameras, object detection sensors, temperature sensors, accelerometers, vehicle speed sensors, and / or other sensors. Sensor 226 may include, for example, a touch sensor to detect when a person is touching a door handle in order to initiate the process of waking up the portable access device. Sensor 226 may be connected to a body control module and / or other control modules 208, such as modules disclosed herein, which can communicate with LF and RF antenna circuits. GPS receiver 228 may provide vehicle speed and / or vehicle direction (i.e., direction of travel) and / or global clock timing information.

[0232] Memory 218 can store sensor data and / or parameters 230, certificates 232, connection information 234, timing information 236, tokens 237, keys 238, and applications 239. Applications 239 may include applications executed by modules 38, 40, 204, 206, 208, 210, 211, 212, 223, and / or transceiver 222. For example, applications may include access applications, PEPS applications, and / or PAK applications executed by transceiver 222 and modules 210, 211, and / or 212. Although memory 218 and vehicle control module 204 are shown as separate devices, they may be implemented as a single device. A single device may include one or more other devices shown in Figure 2.

[0233] The vehicle control module 204 can control the operation of the engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seating system 254, mirror system 256, brake system 258, electric motor 260, and / or steering system 262 according to parameters set by modules 204, 206, 208, 210, 211, 212, and 213. The vehicle control module 204 can perform PEPS and / or PAK operations, which may include setting several parameters. PEPS and PAK operations may be based on signals received from sensor 226 and / or transceiver 222. The vehicle control module 204 may receive power from a power source 264 which may supply power to the engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seating system 254, mirror system 256, brake system 258, electric motor 260, and / or steering system 262, etc. Some PEPS and PAK operations may include unlocking the doors of the window / door system 250, enabling fuel and ignition of the engine 240, starting the electric motor 260, supplying power to any of systems 250, 252, 254, 256, 258, and 262, and / or performing other operations as further described herein.

[0234] The engine 240, converter / generator 242, transmission 244, window / door system 250, lighting system 252, seating system 254, mirror system 256, brake system 258, electric motor 260, and / or steering system 262 include actuators controlled by the vehicle control module 204 that can adjust, for example, fuel, ignition, airflow, steering wheel angle, throttle position, pedal position, door lock, window position, seat angle, etc. This control can be based on the output of the sensor 226, the navigation system 227, GPS 228, and the above data and information stored in the memory 218.

[0235] Figure 4 shows access module 210. Access module 210 includes a PEPS module 211, a PAK module 212, and a parameter adjustment module 213, and may further include a link authentication module 300, a connection information distribution module 302, a timing control module 304, a sensor processing and location identification module 306, a data management module 308, and a security filtering module 310. The PAK module 212 may include an RTC 312 that maintains the local clock time.

[0236] The link authentication module 300 can authenticate the portable access device in FIG. 2 and establish a secure communication link. For example, the link authentication module 300 can be configured to execute a challenge-response authentication or other cryptographic verification algorithm to authenticate the portable access device.

[0237] The connection information distribution module 302 is configured to communicate with some of the sensors 226 in FIG. 3 and provide the sensors with the communication information necessary for the sensors to find a secure communication link and track or intercept it. This can occur once the sensor is synchronized with a communication gateway that may be included or implemented in one of the transceivers 222. As an example, the vehicle 200 and / or the PAK system 202 can include any number of sensors disposed at any location on the vehicle 200 to detect and monitor mobile devices. The connection information distribution module 302 is configured to obtain information corresponding to the communication channels and channel switching parameters of the communication link and transmit that information to the sensors 226. When the sensor 226 receives information from the connection information distribution module 302 via the vehicle interface 45 and the sensor 226 is synchronized with the communication gateway, the sensor 226 can locate the communication link and track or intercept it.

[0238] The timing control module 304, when not controlled by the PAK module 212, can maintain the RTC and / or currently stored date, transmit current timing information to sensors, generate timestamps for incoming and outgoing messages, requests, signals, certificates, and / or other items, calculate round-trip time, etc. Round-trip time may refer to the length of time between when a request is generated and / or transmitted and when a response to the request is received. The timing control module 304 can acquire timing information corresponding to the communication link when the link authentication module 300 performs challenge-response authentication. The timing control module 302 is also configured to provide timing information to the sensor 226 via the vehicle interface 209.

[0239] After link authentication is established, the data management module 308 collects the current location of the vehicle 108 from the telematics module 225 and shares that location with the portable access device. The portable access device optionally includes a GPS module and application software that, at runtime, compares the estimated relative location of the portable access device with that of the vehicle 108. Based on the estimated location of the portable access device relative to the vehicle 108, the portable access device can send a signal to one of the transceivers 222 requesting the vehicle to perform a specific action. As an example, the data management layer 308 is configured to acquire vehicle information obtained by any module (e.g., location information obtained by the telematics module 225) and send that vehicle information to the portable access device.

[0240] The security filtering module 310 detects physical layer and protocol violations and filters the data accordingly before providing information to the sensor processing and location module 306. The security filtering module 310 flags the injected data so that the sensor processing and location module 306 can discard the data and warn the PEPS module 211. The data from the sensor processing and location module 306 is passed to the PEPS module 211, which is configured to read vehicle state information from the sensors in order to detect the user's intent to access the function and compare the location of the mobile device 102 with a set of locations that allow specific vehicle functions, such as unlocking the vehicle doors or trunk and / or starting the vehicle.

[0241] Figure 5 is a functional block diagram of the RF antenna module 40, which includes a control module 350 connected to a multi-axis polarized RF antenna assembly 352. The multi-axis polarized RF antenna assembly 352 may include a linearly polarized antenna, another linearly polarized antenna, and / or a circularly polarized antenna (e.g., a right-side circularly polarized antenna or a left-side circularly polarized antenna). An example of a multi-axis polarized RF antenna is shown in Figure 11. The control module 350 may include or be part of a BLE communication chipset. Alternatively, the control module 350 may include or be part of a Wi-Fi or Wi-Fi Direct communication chipset. The multi-axis polarized RF antenna assembly 352 may be included as part of the RF antenna module 40 or may be located separately from the control module 350. Some or all of the operation of the control module 350 may be performed by one or more of modules 204, 210, 211, and 212 in Figure 3.

[0242] The control module 350 (or one or more of modules 204, 210, 211, and 212 in Figure 3) can establish a secure communication connection with a portable access device (for example, one of the portable access devices 32 and 34 in Figure 2). For example, the control module 350 can establish a secure communication connection using the BLE communication protocol, which may include transmit and / or receive timing and synchronization information. The timing and synchronization information may include information directed towards a secure communication connection, such as the timing of the next communication connection event, the timing interval between communication connection events, the communication channel of the next communication connection event, a channel map, a channel hop interval or offset, communication delay information, and communication jitter information. The control module 350 can detect (or "intercept") packets transmitted to the vehicle control module 204 by the portable access device and measure the signal information of the signals received from the portable access device. The channel of the subsequent communication connection event can be calculated using the channel hop interval or offset.

[0243] The control module 350 can measure the received signal strength of the signal received from the portable access device and generate a corresponding RSSI value. Additionally or alternatively, the control module 350 can perform other measurements of the signal received from the portable access device, such as the angle of arrival, time of arrival, and time difference of arrival. The control module 350 can then transmit the measured information to the vehicle control module 204, which can determine the position and / or distance of the portable access device relative to the vehicle 30 based on the measured information. The determination of the position and distance can be based on similar information received from one or more other RF antenna modules and / or other sensors.

[0244] For example, the vehicle control module 204 can determine the location of the portable access device based on a pattern of RSSI values ​​corresponding to the signal received from the portable access device by, for example, the RF antenna module 40. A strong (or high) RSSI value indicates that the portable access device is close to the vehicle 30, while a weak (or low) RSSI value indicates that the portable access device is far from the vehicle 30. By analyzing the RSSI values, the control module 204 can determine the location and / or distance of the portable access device relative to the vehicle 30. Additionally or alternatively, measurements of the arrival angle, departure angle, round-trip timing, unmodulated carrier tone exchange, or arrival time difference of the signal transmitted between the portable access device and the control module 204 may also be used by the control module 204 or the portable access device to determine the location of the portable access device. Additionally or alternatively, the RF antenna module 40 may determine the location and / or distance of the portable access device based on the measured information and communicate that location or distance to the control module 204.

[0245] Based on a determined position or distance of the portable access device relative to the vehicle 30, modules 211 and 212 in Figure 3 may permit and / or perform vehicle functions such as unlocking the doors of the vehicle 30, unlocking the trunk of the vehicle 30, starting the vehicle 30, and / or allowing the vehicle 30 to start. As another example, if the portable access device is less than a first predetermined distance from the vehicle 30, modules 211 and 212 may turn on the interior or exterior lights of the vehicle 30. If the portable access device is less than a second predetermined distance from the vehicle 30, modules 211 and 212 may unlock the doors or trunk of the vehicle 30. If the portable access device is located inside the vehicle 30, modules 211 and 212 may allow the vehicle 30 to start.

[0246] Referring again to Figure 5, the control module 350 may include a physical layer (PHY) module 356, a media access control (MAC) module 358, a time synchronization module 360, and a channel map reconstruction module 362. The PHY module 356 receives BLE signals via the multi-axis polarized RF antenna assembly 352. The control module 350 monitors the received BLE physical layer messages and can obtain measurements of the corresponding physical characteristics of the signal, including received signal strength, using, for example, a channel map generated by the channel map reconstruction module 362. The control module 350 can communicate with the control modules and / or modules 204, 210, 211, 212 of other RF antenna modules via the vehicle interface 45 to determine arrival time differences, arrival times, arrival angles, and / or other timing information. In one embodiment, the control module 350 includes a portion of the RF circuit 223 shown in Figure 3.

[0247] The time synchronization module 360 ​​is configured to accurately measure the reception time of signals / messages at the vehicle interface 45. The control module 350 can synchronize the PHY module 356 to a specific channel at a specific time based on channel map information and reception time and / or other timing information. Furthermore, the control module can monitor received PHY messages and data that comply with Bluetooth® physical layer specifications, such as Bluetooth® Specification Version 5.1. The data, timestamp, and measured signal strength may be reported by the control module 350 to the control module 204 via the vehicle interface 45.

[0248] Figure 6 shows an exemplary portable access device 400, which is one example of the portable access devices 32 and 34 in Figure 2. The portable access device 400 may include a control module 402, a user interface 404, a memory 406, a sensor 407, and a transceiver 408. The transceiver 408 may include a MAC module 410, a PHY module 412, and multiple linearly polarized antennas 414.

[0249] The control module 402 may include or be part of a BLE communication chipset. Alternatively, the control module 402 may include or be part of a Wi-Fi or Wi-Fi Direct communication chipset. Memory 406 can store application code executable by the control module 402. Memory 406 may be a non-temporary computer-readable medium including read-only memory (ROM) and / or random access memory (RAM).

[0250] The control module 402 communicates with the vehicle's modules 204 and 350 and performs authentication and other operations, as further described below. The control module 402 can transmit information about the portable access device 400, such as position and / or speed information obtained from one or more sensors 407 (e.g., a Global Satellite Navigation System (e.g., GPS) sensor, an accelerometer, and / or an angular velocity sensor). The user interface 404 may include a keypad, a touchscreen, a voice-activated interface, and / or other user interfaces.

[0251] Figure 7 shows a polarization axis diagram illustrating an exemplary arrangement of polarization diversity. In the example shown, two 3-axis antennas located within a vehicle communicate with a 2-axis antenna located in a portable access device (or mobile access network device). Using sufficient antenna axes, this antenna topology can prevent a situation where cross-polarization exists between one of the 3-axis antennas and the 2-axis antenna. Also using sufficient antenna axes, this system can be configured to have at least one pair of antennas where no nulls are present (or directed) in the direct signal path. Heuristic measurement of RSSI in the continuous wave (CW) tone portion of a packet can be performed while measuring the round-trip time and phase delay of the packet. This can be repeated over multiple frequencies. This can be implemented in a vehicle access module and / or portable access device. Round-trip timing and / or unmodulated carrier tone exchange can be used to ensure ranging. RSSI and frequency-dependent (or delta) phase may be used.

[0252] Figure 8 shows a polarization axis diagram illustrating an exemplary configuration of another polarization diversity. In the example shown, two single-axis antennas located within a vehicle communicate with a three-axis antenna located in a portable access device (or mobile access network device). Using sufficient antenna axes, this antenna topology can also prevent a situation where cross-polarization exists between one of the single-axis antennas and the three-axis antenna. Also using sufficient antenna axes, this system can be configured to have at least one pair of antennas where no nulls are present (or directed) in the direct signal path. Heuristic measurement of RSSI in the continuous wave (CW) tone portion of a packet can be performed while measuring the round-trip time and phase delay of the packet. This can be repeated over multiple frequencies. This can be implemented in vehicle access modules and / or portable access devices. Round-trip timing is used to ensure accurate ranging. RSSI and frequency-dependent (or delta) phase may be used. The example in Figure 7 may be more suitable than the example in Figure 8 because it can be difficult to incorporate a three-axis antenna into certain portable access devices, such as key fobs.

[0253] Figure 9 shows the field diagram 900 and polar coordinate plot 902 of a linear antenna, showing the field pattern and null 906. The linear antenna is positioned along the vertical axis 908. The linear antenna has a “donut” shaped radiation pattern. When nulls are aligned in a line between the transmitting and receiving antennas (i.e., the nulls are on the same line or nearly the same line and are on the same polarization antenna), the bounce path of the transmitted signal is measured. The examples described herein prevent this situation from occurring at any given time between at least one transmitting antenna and at least one receiving antenna. To prevent the use of cross-polarized and / or identically polarized antennas, algorithms for determining which transmitting and receiving antennas should be used at any given time are provided herein. Once the appropriate antenna pair is selected, time-of-flight measurements are performed to determine the distance between the transmitter and receiver and / or between the vehicle and the portable access device. Figure 10 shows the voltage-to-field diagram 1000 of a linearly polarized antenna 1002.

[0254] Figures 11A-B show at least a portion of an example of a multi-axis polarized RF antenna assembly 1100, which includes a linearly polarized antenna 1102 and a circularly polarized antenna 1104. Antennas 1102 and 1104 are arranged together. The linearly polarized antenna 1102 extends linearly outward in the axial direction from the center of the circularly polarized antenna 1104. Antennas 1102 and 1104 can transmit with a 90° phase difference from each other. The linearly polarized antenna 1102 may include a conductive element (e.g., a straight wire or a helix) 1110 extending within a sleeve 1112. The circularly polarized antenna 1104 may be ring-shaped.

[0255] The linearly polarized antenna 1102 is a monopole antenna. The sleeve 1112 is made of a dielectric material such as Teflon. Both antennas 1102 and 1104 share the same center as a disk-shaped insulator (or isolator) 1106 and a disk-shaped ground surface 1108. The ring-shaped insulator 1106 is stacked as the uppermost layer on the ground surface 1108 (or the bottom layer). The circularly polarized antenna 1104 is positioned on the ground surface 1108 inside the inner recess 1114 of the insulator 1106. The inner recess 1114 of the insulator is positioned between the circularly polarized antenna 1104 and the ground surface 1108.

[0256] The circularly polarized antenna has two feed points 1120 and 1122, while the linearly polarized antenna 1102 has a single feed point 1124. RF signals are transmitted and / or received via feed points 1120, 1122, and 1124. RF signals are transferred between antennas 1102 and 1104 and the RF circuit 1114 via a coaxial cable. The coaxial cable includes inner conductive wires 1130, 1132, and 1134 and an outer ground shield (not shown). The ground shield is connected to a ground plane 1108. The conductive wires 1130, 1132, and 1134 are connected to feed points 1120, 1122, and 1124.

[0257] During transmission, the signal or voltage is supplied between the ground plane 1108 and the conductive element 1110 via a feed point 1124, which is connected to the ground plane 1108 via another conductive element 1140. The RF signal or voltage is also applied between the ground plane 1108 and the feed points 1120 and 1122 of the circularly polarized antenna 1104. The feed points 1120 and 1122 are offset by 90° on the plane of the antenna 1104 and are 90° out of phase with each other. A 90° electrical phase shift combined with a 90° geometric phase shift causes the circularly polarized antenna 1104 to radiate a circularly polarized signal. The feed points 1120 and 1122 are connected to the circularly polarized antenna 1104 from the ground plane 1108 via an insulator 1106. The hole 1142 in the center of the ground surface 1108 and the hole 1144 in the center of the circularly polarized antenna 1104 are large enough to allow the linearly polarized antenna 1102 to radiate without short-circuiting to the ground surface 1108.

[0258] Antennas 1102 and 1104 may be formed from conductive materials, while the circular isolator 1106 may be formed from a non-conductive (or electrically insulating) material. In one embodiment, the linearly polarized antenna 1102 can be realized as a straight wire, with the sleeve 1112 formed from polytetrafluoroethene (PTFE) and the conductive element 1110 formed from copper. In another embodiment, the linearly polarized antenna 1102 can be realized as a helix, with the wire wound around a cylindrical object formed from PTFE. Figure 12 shows a polar coordinate plot 1200 of the radiated power for the linearly polarized antenna 1102 of Figure 11. Figure 13 shows a polar coordinate plot of the radiated power for the circularly polarized antenna 1104 of Figure 11. Antennas 1102 and 1104 may be connected to an RF circuit 1114, such as one of the RF circuits 223 in Figure 3, and configured to be mounted on the roof of a vehicle. Antennas 1102 and 1104 can be used for measuring time of flight between the vehicle and the portable access device, while other LF antennas in the vehicle can be used for authentication of the portable access device.

[0259] The antenna assembly is primarily described as having a circularly polarized antenna and a linearly polarized antenna, which may be positioned, for example, on the roof of a vehicle; however, two linearly polarized antennas may be used instead. This is true for each example disclosed herein. The two linearly polarized antennas may be positioned deeper in the vehicle, such as on the floor, instrument panel, or center console.

[0260] Figure 14 shows a first RF circuit 1400, a second RF circuit 1401, and a portion 1403 of a portable access device (e.g., one of the portable access devices described above). While a specific number of RF circuits are shown, any number of RF circuits may be included and capable of communicating with a portable access device. The first RF circuit 1400 includes a serial transmitter module 1402, an RF transceiver module 1404, a switch 1406, a splitter 1408, a mono-polarized (or monopole) antenna 1410, a delay module 1412, and a circularly polarized antenna assembly 1414. Antennas 1410 and 1414 may be implemented as the multi-axis polarized RF antenna assembly shown in Figure 11. Each RF circuit is shown having a mono-axis antenna and a circularly polarized antenna to provide three-axis polarization, although each RF circuit may include only two mono-axis polarized antennas. To achieve polarization diversity in the module, the linear and circular polarization antenna axes can be combined in various ways, preventing cross-polarization and / or null alignment. If the RF circuit includes two single-axis antennas, the portable access device includes a three-axis antenna or three single-axis antennas orthogonal to each other to correspond to the x, y, and z axes.

[0261] The serial transmitter module 1402 can communicate with one or more vehicle modules (e.g., the vehicle control module or access module described above) via a serial bus according to the Serial Peripheral Interconnection (SPI) protocol. Discrete signals (or general-purpose I / O signals) can be transmitted between modules 1402 and 1404, and between the RF transceiver module 1404 and the switch 1406. The RF transceiver module 1404 can communicate with the PEPS module 211 (in Figure 3). The switch 1406 switches between antennas 1410 and 1414. The splitter 1408 can split the signal received from the RF transceiver module 1404 and provide the signals to antennas 1410 and 1414, and / or combine the signals received from antennas 1410 and 1414. Splitter 1408 is a 90° splitter that splits a single signal into two signals with a 90° phase difference, and provides these signals to two feed points of a circularly polarized antenna (e.g., feed points 1120 and 1122 in Figure 11). Splitter 1408 can provide a signal to antenna 1414 or receive a signal from antenna 1414 via delay module 1412.

[0262] The second RF circuit 1401 includes a switch 1420, a splitter 1422, a mono-polarized (or monopole) antenna 1424, a delay module 1426, and a circularly polarized antenna 1428. Antennas 1424 and 1428 can be implemented as the multi-axis polarized RF antenna assembly shown in Figure 11. Devices 1420, 1422, 1424, 1426, and 1428 can operate similarly to devices 1406, 1408, 1410, 1412, and 1414. Switch 1420 can communicate with the RF transceiver module 1404. Switch 1406 can also connect the splitter 1408, the mono-polarized antenna 1410, and / or switch 1420 to the RF transceiver module 1404. Switch 1420 can connect a single-axis polarized antenna 1424 or a splitter to switch 1406 or RF transceiver module 1404.

[0263] Part 1403 includes a three-axis LF antenna 1430, an LF module 1432, an RF module 1434, a user interface 1436, a first single-axis polarization antenna 1438, a second single-axis polarization antenna 1440, and a switch 1442. The LF module 1432 transmits and receives LF signals via the three-axis LF antenna 1430. The RF module 1434 transmits and receives RF signals via the switch 1442 and antennas 1438 and 1440. The switch 1442 connects one or more of antennas 1438 and 1440 to the RF module 1434. Discrete signals and serial peripheral interconnect (SPI) signals can be transmitted between the LF module 1432 and the RF module 1434. Discrete signals can be transmitted between the RF module 1434 and the switch 1442.

[0264] RF signals are transmitted between (i) antennas 1410, 1414, 1424, and 1428 and (ii) antennas 1438 and 1440. For example, antennas 1410 and 1424 can be associated with the z axis, and antennas 1414 and 1428 can be associated with the x and y axes, respectively. Antennas 1438 and 1440 can be, for example, slot antennas associated with the x and y axes, respectively. The 3-axis LF antenna 1430 can communicate with the corresponding vehicle's LF antenna as described above. LF antennas can be used for the purpose of waking up the downlink. RF antennas can be used for authentication and communication.

[0265] Antennas 1410 and 1414 can be used to communicate with antennas 1438 and 1440, or antennas 1424 and 1428 can be used to communicate with antennas 1438 and 1440. Alternatively, one of antennas 1410 and 1424 and one of antennas 1414 and 1428 may be used to communicate with antennas 1438 and 1440. One or more antennas in circuit 1401 can be used while one or more antennas in circuit 1400 can be used. By using one monopole (or linearly polarized) RF antenna and a dipole (or multi-axis polarized) RF antenna such as a circularly polarized antenna, the number of RF switching lanes to poll is reduced from 3 to 2. Heuristic measurements of RSSI on a continuous wave tone of packets can be performed while measuring the round-trip time and phase delay of packets. This can be repeated over multiple frequencies.

[0266] Figure 15 shows a portion of a key fob 1500 having two linearly polarized slot antennas 1502 and 1504, a metal trim 1506, and a spare key 1508. The metal within the key fob may short-circuit a field that should be stable along the longitudinal direction (or Y direction) of the key fob. As a result, it can be difficult to design an efficient radiator in a structure that should contain properly functioning antennas. Antenna 1502 is an x-axis linearly polarized slot antenna. Antenna 1504 is a y-axis linearly polarized slot antenna. The metal trim 1506 may be a cast decorative trim. The key fob may also include an LF coil antenna 1510, a processor (not shown), a battery 1512, and a metal plate (or conductive film) 1514. An RF signal is supplied to the metal plate 1514, and the apertures of the slot antennas 1502 and 1504 radiate electromagnetic waves.

[0267] Figure 16 shows a portion 1600 of the key fob from Figure 15 without the metal trim 1506 and spare key 1508. This portion 1600 includes an x-axis linearly polarized slot antenna 1502 and a y-axis linearly polarized slot antenna 1504. Removing the metal trim 1506 and spare key 1508 supports radiation from the slot antennas 1502 and 1504. This arrangement is configured to work with nearby metals such as the metal trim and spare key, but the plots in Figures 17 and 18 show that these are distorted from those plots when the metal trim and spare key are included. Figure 17 shows a polar coordinate plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the portion 1600 of the key fob from Figure 16. Figure 18 shows an exemplary polar coordinate plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of the portion 1600 of the key fob from Figure 16. Figure 19 shows a plot of return loss (decibels (dB)) versus frequency for the linearly polarized slot antennas 1502 and 1504 of Figure 16, where curve S1,1 represents the return power of the first port or antenna 1502 of the first radio (or transmitter), and S2,2 represents the return power of the second port or antenna 1504 of the second radio (or transmitter). Given the structure of the key fob, the S1,1 and S2,2 plots can be defined, where the “dips” or minimum return loss in the S1,1 and S2,2 curves are at the same frequency or within a predetermined range from each other to provide improved performance.

[0268] Return loss is a measure of how well an antenna converts the voltage at its terminals into the electric field in space, or how well an antenna converts the electric field in space into the voltage at its terminals. Return loss is a decibel measurement of how much power is reflected at the terminals. For example, a return loss of 0 dB means all power is reflected and no power is transferred to the terminals. As another example, a return loss of -10 dB means that approximately 10% of the power is reflected and 90% of the power is transferred. If a plot of return loss includes a curve that drops to a reasonable level at the operating frequency (e.g., -6 dB), the corresponding antenna is functioning correctly. If the return loss drops to -10 dB, the antenna is considered to be functioning well. Return loss is measured as an S-parameter. S1,1 is the return loss at port 1. S2,2 is the return loss at port 2.

[0269] Figure 20 shows a portion of the key fob 2000 from Figure 15, including a spare key 1508 and without the metal trim 1506. Figure 21 shows a polar coordinate plot of the radiated power associated with the x-axis linearly polarized slot antenna 1502 of the portion of the key fob 2000 from Figure 20. Figure 22 shows a polar coordinate plot of the radiated power associated with the y-axis linearly polarized slot antenna 1504 of the portion of the key fob 2000 from Figure 20. Adding a spare key may negatively affect the y-polarization, but does not affect operation. Figure 23 shows a plot of return loss versus frequency for the linearly polarized slot antennas 1502 and 1504 from Figure 20, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504.

[0270] Figure 24 shows a portion 2400 of the key fob from Figure 15, with a portion of metal trim 2402 and a spare key 1508. Adding the metal trim 2402 near the spare key 1508 can adversely affect operation, as shown by the plots and curves in Figures 25-27. Figure 25 shows a polar plot of radiated power associated with the x-axis linearly polarized slot antenna 1502 of the portion 2400 of the key fob from Figure 24. Figure 26 shows a polar plot of radiated power associated with the y-axis linearly polarized slot antenna 1504 of the portion of the key fob from Figure 24. Figure 27 shows a plot of return loss versus frequency for the linearly polarized slot antennas from Figure 24, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504. Figures 19, 23, and 27 show that the antennas function well in the target frequency range (e.g., 2.4–2.8 GHz).

[0271] With the presence of a complete metal trim 1506, referring to part 1500 in Figure 15, the antenna operation is further adversely affected, as shown in the plots and curves of Figures 28-30. Figure 28 shows a polar coordinate plot of radiated power associated with x-axis linearly polarized slot antenna 1502 of part 1500. Figure 29 shows a polar coordinate plot of radiated power associated with y-axis linearly polarized slot antenna 1504 of part 1500. Figure 30 shows a plot of return loss versus frequency for linearly polarized slot antennas 1502 and 1504, where S1,1 is for antenna 1502 and S2,2 is for antenna 1504.

[0272] The y-axis linear polarization slot antennas 1502 and 1504 are open-slot antennas because each of the antennas 1502 and 1504 has an open end. Figure 31 shows a portion 3100 of a key fob having an open linear polarization slot antenna 3102, a closed linear polarization slot antenna 3104, a metal trim 3106, and a spare key 3108. Figure 32 shows a polar coordinate plot of the radiated power associated with the x-axis linear polarization slot antenna 3102 of portion 3100. Figure 33 shows a polar coordinate plot of the radiated power associated with the y-axis linear polarization slot antenna 3104 of portion 3100. Figure 34 shows a plot of return loss versus frequency for the linear polarization slot antennas 3102 and 3104 of Figure 31. Figure 34 shows that the antenna measured at port S2,2 does not function well.

[0273] When a portable access device has multiple orthogonal antennas as described above, the larger the portable access device is compared to the corresponding physical metal key, and the larger the portable access device is compared to the palm of the hand, the removal of decorative metal trim provides improved round-trip time performance. Improved round-trip time performance enhances the accuracy of distance determination.

[0274] The systems disclosed herein can be operated using many of the methods described herein. Several exemplary methods for determining which antenna combination should be used are shown in Figures 35 and 36. Figures 35 and 36 show a method for determining which antenna combination should be used to exchange packets between RF antenna modules (or RF circuits) of a vehicle and a portable access device for round-trip time-of-flight measurement. Figures 35 and 37 represent a method from the perspective of an initiator of round-trip time-of-flight measurement. In one embodiment, this is a vehicle. In another embodiment, this is a portable access device. The reflector / responder performs an obvious step corresponding to the initiator step of the process. Round-trip time-of-flight measurement can be used to prevent range extender type relay station attacks, as will be further described below. Figure 35 shows an approach of switching antennas between packets. Figure 36 shows an approach of switching antennas during the transmission of packets and / or continuous wave (CW) tones.

[0275] The following process will be described primarily with respect to the embodiments shown in Figures 2-6, 11, and 14, but the process can be readily modified for application to other embodiments of the present disclosure. The process can be repeated.

[0276] The process may begin at 3500. The following processes may generally be performed simultaneously by the control module 402 within the portable access device 400 and by modules located in the vehicle, for example, by the access module 210, PEPS module 211 and / or PAK module 212 in Figure 4. There are many ways in which a combination of frequency and antenna to be sampled can be selected to determine the best frequency (or channel) and antenna axis. Optionally, at 3501, the module arranges an initial frequency (or channel) and antenna combination to be used for sampling the frequency and antenna. This step may be arranged between modules based on prior agreement, based on post-data, and / or commanded by the module based on post-data. At 3502, the frequency (or channel) to which the first (or next) packet will be transmitted is selected.

[0277] In step 3504, an antenna pair is selected to transmit and receive packets. This could be two of the antennas in the RF circuit of the vehicle shown in Figure 11. In step 3506, the packet is transmitted from the first (or transmitting) antenna to the portable access device at the selected frequency. The portable access device measures the transmit RSSI and sends the packet back to the second (or receiving) antenna of the selected antenna pair as the first RSSI.

[0278] At 3508, the second antenna receives the packet and / or the response to the packet transmission, and the first RSSI. At 3512, the second RSSI is measured for the second transmission of the packet. At 3514, the first and second RSSIs are stored in memory, associated with the packet, selected frequency, and selected antenna pair.

[0279] In step 3516, if a different antenna pair is selected, process 3504 is executed; otherwise, process 3518 is executed. This allows the swapping of each antenna pair to cycle through for each selected frequency. The swapping of antenna pairs can cycle through in a pseudo-random and / or predefined order.

[0280] In step 3518, if a different frequency (or channel) is selected, process 3502 is executed; otherwise, process 3520 is executed. This allows each frequency (or channel) to be cycled through. This allows the RSSI of each frequency (or channel) to be determined. Due to multipath fast fading, some frequencies may have lower power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels can be cycled through in a pseudo-random and / or predefined order to determine the best frequency and / or channel for transmitting other packets and the best antenna pair.

[0281] Optionally, after cycling through a predetermined, agreed-upon, and / or consensual set of frequencies and antenna axis pairs in 3519, the algorithm may optionally cause a node (control module) to swap antenna and / or channel RSSI results. By swapping RF channels, the module can use a heuristic to select the antenna axis used by the module without sharing antenna RSSI measurements acquired by the module. By swapping RF channels, the module can use a heuristic to select a channel (frequency) without results from other channels, although the module may use an algorithm to select a channel based on results from the channel. In this case, the algorithm and system become less susceptible to interference from other nearby transmitters.

[0282] In 3520, after cycling through a predetermined number of frequencies and antenna pairs, the antenna axis combination and / or frequency (channel) with the best RSSI is selected for transmitting the remaining packets. The antenna axis combination with the highest RSSI is optimal. Regarding frequencies (or channels), those with an RSSI that is not low and / or high are optimal. In 3522, the identifier of the selected antenna pair and / or frequency (channel) may be encrypted. In 3524, the encrypted selected antenna axis pair and / or frequency (channel) may be transmitted to other nodes. In 3526, packets are transmitted and responses are received using the selected frequency (channel) and antenna pair. The process may end in 3528.

[0283] The following process in Figure 36 will be described primarily with respect to the embodiments in Figures 2-6, 11, and 14, but the process can be readily modified for application to other embodiments of the present disclosure. The process can be repeated.

[0284] The process may begin at 3700. The following processes may generally be performed simultaneously by the control module 402 within the portable access device 400 and by modules located in the vehicle, for example, by the PEPS module 211 and / or PAK module 212 in Figure 4. Several different techniques may be used to select the sampling frequency and antenna combination to determine the best frequency (or channel) and antenna axis. Optionally, at 3701, the module arranges the initial frequency (or channel) and antenna combination to be used for sampling the frequency and antenna. This step may be based on prior agreement, arranged between modules based on post-data, or commanded by the module based on post-data. At 3702, the frequency (or channel) to which the first (or next) packet will be transmitted is selected.

[0285] In 3704, an antenna pair is selected to transmit and receive packets, such as two of the antennas in the vehicle's RF circuit shown in Figure 11. In 3706, the packet is transmitted from the first (or transmitting) antenna to the portable access device at the selected frequency. The vehicle switches a predetermined set of antenna axes between the CW tone portion of the packet, with a state-holding period in between. The portable access device switches a predetermined set of antenna axes between the state-holding periods during each of the vehicle antenna axis "switching and state-holding periods" within the CW tone, measures the RSSI of the receiving transmit / receive antenna axis swap, sends the packet and the first set of the measured RSSI back to the vehicle, and switches a predetermined set of antenna axes of the selected antenna pair between the CW tone portion of the packet, with a state-holding period in between.

[0286] In 3708, the vehicle receives a packet and / or a response to the transmission of a packet, and a first set of RSSIs. In 3712, a second RSSI is measured for a second transmission of a packet. In 3714, the first and second RSSIs are stored in memory, associated with the packet, the selected frequency, and the selected antenna pair.

[0287] In step 3716, if another packet needs to be sent, process 3718 may be executed; otherwise, process 3726 may be executed. In step 3718, if another antenna pair needs to be selected, process 3720 may be executed; otherwise, process 3724 may be executed. This allows for a rotation of each antenna pair swap for each selected frequency. The antenna pair swaps may be rotational in a pseudo-random and / or predefined order.

[0288] In 3720, the first transmission of the next packet is initiated using the previous transmitting antenna of the previously selected antenna pair.

[0289] In step 3722, a switch is made between the previous antenna pair and the next selected antenna pair. This can be done during the CW tone of the currently transmitted packet or during another portion of the currently transmitted packet, so that the remainder of the packet is transmitted through the transmitting antenna of the next selected antenna pair. Process 3708 may be performed following process 3722.

[0290] In step 3724, if a different frequency (or channel) needs to be selected, process 3704 is executed; otherwise, process 3718 is executed. This allows each frequency (or channel) to be cycled through. This allows the RSSI of each frequency (or channel) to be determined. Due to multipath fast fading, some frequencies may have lower power levels (or RSSI values). As an example, the frequencies of the 37 BLE data channels are cycled through in a pseudo-random and / or predefined order to determine the best frequency and / or channel and the best antenna pair for transmitting other packets. In step 3725, the antenna and RSSI result values ​​may be swapped as described above in step 3519.

[0291] In 3726, after cycling through a predetermined number of frequencies and antenna pairs, the antenna combination, frequency, and / or channel with the best RSSI is selected for transmission of the remaining packets.

[0292] In 3728, the identifier of the selected antenna pair may be encrypted. In 3730, each remaining packet may be encapsulated to include the encrypted identifier, or modified to include the encrypted identifier. In 3732, the encapsulated or modified packets are transmitted and a response is received using the selected frequency, channel, and antenna pair. The process may end in 3734.

[0293] In the above method, packets transmitted to determine the best frequency, channel, and antenna pair may be discarded. The discarded packets are simply used to measure the RSSI value. In another embodiment, a CW tone is included at the end of the packet, and the antenna switching occurs during these tones. In another embodiment, a predetermined period (e.g., 4 μs) is allocated for each antenna swap, a CW tone is included at the end of the packet, and the antenna pair with the best RSSI (or power value) is selected. If another nearby network device is transmitting and / or receiving data in the same frequency range, the selected frequency, channel, and / or antenna pair may be changed. In one embodiment, between the methods of Figures 35 and 36, the pattern in which frequencies are selected is known and shared between the vehicle's access module and the portable access device.

[0294] Processes 3526 and 3732 may be performed to authorize a portable access device, detect a range extender-type relay station attack by the portable access device, provide access to the vehicle interior, and / or perform other PEPS and / or PAK system operations. For example, a packet may be sent to authorize a portable access device, and when it is determined that the portable access device and / or the corresponding user are authorized to access the vehicle, access to the vehicle interior may be provided. This may include authorizing the operation of the vehicle. A packet may be sent to perform a time-of-flight measurement, including the time it takes to send the packet to the portable access device and the time it takes to respond and receive a corresponding response from the portable access device. Based on the measured time-of-flight value, the vehicle's access module (e.g., a PEPS module or a PAK module) may determine whether the portable access device is attempting to perform a range extender-type relay station attack. If the portable access device is attempting to perform a range extender-type relay station attack, the access module may take one or more measures, including preventing access to the vehicle interior. Measures may include notifying the vehicle owner of the range extender-type relay station attack. This can be done, for example, by text messages or emails sent from the access module to one or more of the owner's network devices. One or more warning signals may be generated to notify a central monitoring station and / or authorities of the attack.

[0295] Figure 37 shows a time-of-flight measurement diagram 3800, which includes an initiating / measuring device 3802 and a reflecting (or responding) device 3804. The initiating / measuring device 3802 transmits a radio message (e.g., a packet) to the reflecting device 3804, and the reflecting device 3804 responds to the radio message by sending the radio message back to the initiating / measuring device 3802. The time of flight (or the total time for sending and receiving these signals) is equal to the sum of (T2-T1), (T3-T2), and (T4-T3), where T2-T1 is the length of time it takes for the radio message to travel from the initiating / measuring device 3802 to the reflecting device 3804, T3-T2 is the length of time it takes for the reflecting device 3804 to respond, and T4-T3 is the length of time it takes for the radio message to travel from the reflecting device 3804 to the initiating / measuring device 3802. The calculation of the exemplary average flight time and distance can be performed according to equations 1-4, where distance refers to the distance between the start / measurement device 3802 and the reflecting device 3804.

number

number

number

number

[0296] When using a timer to measure the response time T3-T2, the amount of timing information may be reduced to compensate for fine-tuning information measured in relation to the response time. If the initiator is unaware of this time length, the time T3-T2 may be reported to the initiator.

[0297] Figure 38 shows an exemplary BLE radio 3900 comprising a superheterodyne receiver 3902 and a transmitter 3904. The BLE radio 3900 may be used, for example, as one of the transceivers 222 in Figure 3 and may include, or be part of, one of the RF antenna module 40 and RF circuitry 223. In another embodiment, the BLE radio 3900 may be used as a transceiver in a portable access device, such as the transceiver 410 of the portable access device 400 in Figure 6. The superheterodyne receiver 3902 uses frequency mixing to convert the received signal to a fixed intermediate frequency (IF). The superheterodyne receiver 3902 includes an RF (e.g., bandpass) filter 3906, a switch balun 3908, a low-noise amplifier 3910, a downconverter 3912, a bandpass filter amplifier 3914, an analog-to-digital converter 3916, a demodulator 3918, and a correlation protocol module 3920. The transmitter 3904 includes a processing module 3922, a protocol module 3924, a Gaussian frequency-shift keying (GFSK) modulator 3926, a digital-to-analog converter / low-pass filter 3928, an upconverter 3930, and a power amplifier 3932. The crystal oscillator 3934 can generate one or more clock signals, which can be distributed to devices 3914, 3916, 3918, 3920, 3922, 3924, 3936, 3938, and phase-locked loops 3940, 3942. As an example, the processing module 3922 and the correlation / protocol module 3920 can be implemented as a single module, as part of one or more modules 204, 210, 211, 212 in Figure 3. The processing performed by modules 3922 and 3920 may be performed by any one of modules 204, 210, 211, 212 in Figures 3 and 4. One or more of devices 3906, 3908, 3910, 3912, 3914, 3916, 3918, 3920, 3924, 3926, 3928, 3930, 3932, 3934, 3936, 3938, 3940, and 3942 may be implemented as part of RF circuit 223 and / or as part of one or more of modules 204, 210, 211, and 212.

[0298] The bandpass filter 3906 can be connected to a linearly polarized antenna and / or a circularly polarized antenna (specified by 3907). The downconverter 3912 downconverts the received signal from the RF frequency to the IF frequency based on the signal from the phase-locked loop 3942. The upconverter 3930 upconverts the IF signal to the RF signal based on the signal from the phase-locked loop 3940.

[0299] The GPSK modulator 3926 and demodulator 3918 can modulate and demodulate the bits of a signal according to the GFSK protocol. Figure 39 shows an exemplary GFSK parameter definition plot, including a plot of the transmit carrier frequency Fc showing the zero-crossing point and error. As an example, the transmit carrier frequency Fc is ±250 kHz or ±500 kHz, the symbol time is 1 μs or 0.5 μs, and the zero-crossing error is 1 / 8 of 1 μs (1 Mbps) or 1 / 8 of 0.5 μs (2 Mbps).

[0300] Figure 40 shows a functional block diagram of system 4100 for transmitting BLE packets. An exemplary format of a BLE packet 4101 is shown, including the preamble, access address, protocol data unit (PDU), and cyclic redundancy check (CRC) bitfield. This is an example of a packet that may be received by the correlation protocol module 3940 in Figure 38 and / or generated by the processing module 3922 and / or protocol module 3924.

[0301] The packet preamble is AA or 55 such that the last bit of the preamble is different from the first bit of the access address. The access addresses of peripheral and central devices 4102 and 4104 are the same. Sensor 4106 may be used to monitor packets. The access address is the same for each packet and each connection interval. The access address follows the BLE access address rules. Packets within the same connection interval are on the same RF channel. Figure 41 shows examples of preambles and access addresses for BLE 1M and BLE 2M packets. Since the preamble is multiple A's and multiple 5's (AA or 55 at 1 mbit / s, AAAA or 5555 at 2 mbit / s), the last bit of the preamble is different from the first bit of the access address. This is indicated by the bits in circle 4200.

[0302] The access address of an advertised channel packet may be 10001110100010011011111011010110b (0x8E89BED6). Each link-layer connection between any two devices and each periodic advertisement has a different access address. The access address can be a 32-bit value. Whenever a new access address is needed, the link layer can generate a new random value that satisfies the following rules: The access address is not the address of an existing link-layer connection on the corresponding network device. The access address is not the address of a valid periodic advertisement, does not have six consecutive 0s or 1s, is not an advertised channel packet access address, does not have a sequence that differs from the advertised channel packet access address by only one bit, and does not contain four equal octets. There are no more than 24 variations of an access address. The seed for the random number generator is from a physical entropy source with at least 20 bits of entropy. If the random number for the access address does not satisfy the above rule, a new random number is generated until the rule is satisfied. In embodiments that also support a BLE-encoded physical layer (PHY), the access address may have at least three 1s in the least significant 8 bits and 11 or fewer variations in the least significant 16 bits. In a typical BLE packet, the first bit of the access address may be known from the preamble, and then the next bit of the access address may be known from the access rule (e.g., six or fewer consecutive 0s or 1s). This could cause a ranging security issue as an attacker could predict the bits, but this is mitigated or eliminated by the embodiments disclosed herein.

[0303] Figure 42 shows an exemplary plot of a BLE packet signal showing the corresponding bits. The first BLE signal 4300 represents the bitstream from the protocol module 3924 in Figure 38. If the bits remain at the same value, a normal BLE packet does not return to the carrier (or midpoint level). This is called non-regression to zero recording. The bits corresponding to the first plot are shown above the plot. The second BLE signal 4302 represents the bitstream from the GFSK modulator (or Gaussian filter) 3926. The Gaussian filter adds a 1 / 2 bit time lag, giving a little time during the transition. The bits corresponding to the second BLE curve are shown below the second BLE curve. As an example, the carrier frequency can be 2.402 GHz, and the BLE packet signal can vary in frequency between 2.402250 GHz and 2.401750 GHz.

[0304] Figure 43 shows an exemplary plot of BLE packet signals showing the corresponding bits of a stronger BLE packet signal (e.g., a BLE packet signal with a larger RSSI) transmitted on a faster edge after leading edge sensing. The first BLE signal 4400 represents the bitstream from protocol module 3924 in Figure 38. The second BLE signal 4402 represents the bitstream from GFSK modulator (or Gaussian filter) 3926. The third BLE signal 4404 represents a stronger BLE packet signal transmitted on a faster edge after leading edge sensing of Gaussian bits. The third BLE signal 4404 may be generated by an attacking device. As can be seen, the edge is sloped and transitions faster than the transition in the second BLE curve 4402. This causes the corresponding bits to be earlier than the bits in the second plot (or the output of GFSK modulator 3924). The region where differences may be detected is indicated by the ellipse 4406. The bits corresponding to the first BLE curve 4400 are shown above the first BLE curve 4400. The bits corresponding to the second BLE curve 4402 are shown below the second BLE curve 4402. The bits corresponding to the third BLE curve 4404 are shown below the bits of the second BLE curve 4402 and are shifted to the left relative to the bits of the second BLE curve 4402.

[0305] Figure 44 shows the second and third BLE curves 4402 and 4404 of Figure 43, where the third BLE curve 4404 is shifted relative to the second BLE curve 4402. To defend against bit acceleration attacks, the following processes can be performed. A bit acceleration attack refers to a situation where an attacking device accelerates the transmission of a BLE signal, such as a BLE signal transmitted from a key fob and / or other portable access device, taking into account the delays associated with the attacking device receiving, processing, and / or modifying the BLE signal and transmitting it. Figure 45 shows an example of a method for detecting a range extension type relay attack. The following processes in Figure 45 are mainly described with respect to the embodiments of Figures 2-6, 11, and 14, but the processes can be readily modified to be applied to other embodiments of the present disclosure. The processes can be performed repeatedly. The following processes can be performed, for example, by one or more of modules 210, 211, and 212.

[0306] The method may begin in 4600. In 4602, a sliding correlation function is used to match the received input waveform to an ideal Gaussian waveform (or other suitable predetermined waveform) of a known bit pattern and bit rate, scaling the peaks of the received input waveform and the predetermined waveform, or aligning the zero offset. This can be done by the correlation protocol module 3920 in Figure 38. This may be done, for example, to identify a synchronization access word. An example of this is shown in Figure 44.

[0307] In 4604, the portion (or part) of the received waveform that occurred earlier in time after the zero-crossing of a given waveform and before the next peak is integrated and accumulated (or summed). 4605 This is called positive accumulation.

[0308] In 4606, a portion (or part) of the received waveform that occurred later in time, after the peak and before the next zero crossing, is integrated and accumulated. 4607 This is also called positive accumulation.

[0309] In 4608, the resulting cumulative values ​​determined in 4604 and 4606 are averaged over the number of transitions used to provide an indicator of the level of the bit acceleration attack. The cumulative values ​​may be averaged separately to provide two average values, or they may be summed and then averaged to provide a single average value.

[0310] In 4610, it is determined, based on one or more averages and one or more predetermined thresholds, whether an attack has occurred and / or is likely to have occurred. In 4612, if an attack has occurred and / or is likely to have occurred, process 4614 is executed; otherwise, process 4616 is executed. In 4614, countermeasures are taken, such as one of the aforementioned countermeasures, including preventing access to and / or operation of the corresponding vehicle. One or more alerts may be generated. As an example of another countermeasure, data related to the attack may be stored in memory and / or sent to the vehicle owner's network device and / or a central monitoring station. In 4616, if no attack has occurred and / or is likely to have occurred, access to and / or operational control of the vehicle is permitted. Operational control may include, for example, unlocking or locking the vehicle doors, remotely starting the vehicle engine, or adjusting the vehicle's internal environment controls. In 4618, one or more averages may be discarded and / or aggregated and accumulated old data may be discarded. If a sliding window is used to monitor the received signal, older portions of the data are discarded, while more recent portions may be retained for the purpose of subsequent integration, accumulation, and averaging with newly received data.

[0311] Figure 46 shows a vehicle 5200 including a round-trip time (RTT) responder 5202 and an RTT initiator 5204, and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210. As used herein, “initiator” refers to a network device including a BLE radio, transmitter, and / or receiver that can initiate signal or tone exchange. As used herein, “responder” refers to a network device including a BLE radio, transmitter, and / or receiver that can respond to signals and / or tones received from an initiator. The RTT responders 5202, 5210 and RTT initiators 5204, 5208 may be implemented, for example, by the RF antenna module 40, RF circuit 223, and / or modules 210, 211, 212 in Figure 3, and may include corresponding transmit and receive circuits. Vehicle 5200 may include an antenna module with a single circularly polarized antenna, as described above. RTT responder 5202 and RTT initiator 5204 can transmit and receive using the antenna. The antenna provides polarization diversity using the antenna (e.g., a single-polarized antenna) used by RTT initiator 5208 and RTT responder 5210 such that at any given time, at least one of the described antennas of vehicle 5200 has at least one polarization axis that is not cross-polarized with and not identically polarized with at least one polarization axis of the antenna of portable access device 5206.

[0312] Devices 5202, 5204, 5208, and 5210 each include the control module described above and can perform any of the processes described. Devices 5202, 5204, 5208, and 5210 can transmit and receive RF signals on random channels (e.g., 40 BLE channels across an 80 MHz spectrum). Devices 5202 and 5208 can communicate with each other, including transmitting and receiving signals, while devices 5204 and 5210 can communicate with each other, including transmitting and receiving signals. Communication between devices 5202 and 5208 can occur simultaneously with communication between devices 5204 and 5210. Transmission of signals for determining RTT may be transmitted simultaneously and bidirectionally for security reasons and for attack detection. Devices 5202 and 5204 can share the communication frequency with the portable access device 5206. The frequencies are presented in a predetermined order and can be followed by devices 5202, 5204, 5208, and 5210. When a bandpass filter is used to monitor two channels simultaneously, the filter introduces propagation delay.

[0313] The typical delay of a bandpass filter is 0.5 of the bandwidth (i.e., 0.5 / bandwidth). The protocol's channel spacing, randomness of channel selection, randomness of transmission direction over time, and simultaneous transmissions force the bandpass filter to detect bits with a group delay that is large compared to the measurable round-trip time delay. This further increases the difficulty for attack devices to perform range-extension type relay attacks. The vehicle 5200 and the portable access device 5206 can be configured, respectively, to prevent, for example, an attack device from having a filter that is wide enough to receive the signal for relaying with a sufficiently short delay, but not wide enough to analyze the signal.

[0314] In one embodiment, a signal is transmitted, the direct flight time is measured, and it is determined whether there is a predetermined amount of delay (e.g., 10 to 500 nanoseconds (ns)), which is often associated with range extender type attack devices. When a range extender type attack device relays a signal between the vehicle 5200 and the portable access device 5206, it may delay the transmitted signal by a predetermined amount. The described bidirectional and simultaneous transmission and reception makes it difficult for the attack device to determine the frequency, channel, and direction of the signal to be transmitted at any given time. It also makes it difficult for the attack device to avoid relaying the signal without a predetermined amount of delay.

[0315] Figure 47 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, and a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210. Figure 47 shows the signal path through the corresponding antennas 5300, 5302, 5304, and 5306. In one embodiment, antennas 5300 and 5302 have a total of three polarizations, and antennas 5304 and 5306 have a total of two polarizations. In another embodiment, antennas 5300 and 5302 have a total of two polarizations, and antennas 5304 and 5306 have a total of three polarizations.

[0316] Figure 48 shows a vehicle 5200 including an RTT responder 5202 and an RTT initiator 5204, a portable access device 5206 including an RTT initiator 5208 and an RTT responder 5210, and a range extension type relay attack device 5400. The range extension attack device 5400 has a control module 5402 including a bandpass filter 5404, a bit signal direction detector 5406, and a bit acceleration attack module 5408. The bandpass filter 5404 is used to detect incoming bits but has an associated delay time. The bit signal direction detector 5406 determines the direction in which the bits are moving (e.g., from the vehicle to the portable access device, or from the portable access device to the vehicle). The bit acceleration attack module 5408 cannot accelerate bits without introducing a delay time into some of the symbols (or bits) that can be detected using a sliding correlation function that averages the shape of symbols (or bits) across multiple symbols (or bits) and aligns them to an ideal waveform. The described delay time can be detected by the vehicle's access module when determining whether an attack is taking place.

[0317] As shown, the range extension attack device 5400 includes amplifiers 5410, such as a low-noise amplifier (LNA) and a power amplifier, for receiving and transmitting purposes. The range extension attack device 5400 may also include a mixer for down-conversion and up-conversion purposes. Amplifiers 5410 are connected to antenna 5412.

[0318] In addition to performing the described communications simultaneously, the channels and access addresses can be selected pseudo-randomly. This random selection may be performed in the vehicle and pre-shared with the portable access device. Conversely, the selection may be performed in the portable access device. Alternatively, the selection may be performed by secure cryptographic techniques using key material from either or both devices that contribute to the pseudo-randomly selected sequence of channels and / or the sequence of access addresses. In this case, the pseudo-random sequence of access addresses functions as a cryptographically secure sequence of bits exchanged for round-trip timing measurement. When the response is on the same channel as the initiator, and the response access address is not the same as the initiator access addressrel, the simultaneous transmit and receive processing is performed on a random channel using randomly selected access addresses, making it difficult for a range extension attack device to perform an attack without being detected by the vehicle's access module and / or the control modules of one or more portable access devices. A range extension attack device must simultaneously eavesdrop on all channels in both directions, determine which direction a message will pass through the range extension attack device, and detect bits early to convince the vehicle and one or more portable access device initiators that the bits must be transmitted early and in an appropriate amount of time in both directions. The range extension attack device must convince the vehicle and one or more portable access device initiators that the portable access devices are closer than they actually are and at an appropriate distance from the vehicle, thereby obtaining permission to access and / or control the vehicle. Furthermore, by using a Gaussian filter on the BLE bits, the attack device has a small window of less than approximately 10-100 ns for early bit detection time that can be used to detect bits and transmit them early.

[0319] In one embodiment, the RF signals associated with the simultaneous communication described above are monitored by modules 210, 211, and 212 in Figure 3, and the described initiator and responder monitor and / or determine the RSSI value and antenna polarization state of the signals (e.g., the degree of polarization between the transmitting and receiving antennas). Based on the RSSI value and polarization, one or more modules 210, 211, and 212 determine the best path, frequency, channel, and antenna pair for communication. Signals related to the shortest path (or least interference), best RSSI value, maximum polarization, etc., are used to indicate which path, frequency, channel, and antenna pair should be used. This information may also be used to determine which device transmits and which device receives at any given time. The selection of transceiver chips and channels at each device may be randomized. In one embodiment, one device (of a vehicle or portable access device) can transmit while another device is not transmitting, but rather receiving. Then, this role is reversed, and as a result, the second device transmits, and the first device receives while the second device is not receiving.

[0320] Many of the techniques described above and below involve monitoring, generating, receiving, transmitting, and / or measuring various parameters in a vehicle access module, and detecting range-extension type relay attacks based on this information; however, these techniques may be modified so that some or all of their processing is performed in a control module (or other module) of a portable access device, such as any portable access device disclosed herein. Similarly, although various processing is described as being performed in a portable access device, these processing may be performed in a vehicle access module.

[0321] Examples of various BLERF transmission frequencies include 2.410 gigahertz (GHz), 2.412 GHz, 2.408 GHz, and 2.414 GHz. These and other frequencies may be used by the RTT initiator and responder and / or corresponding transmitter and receiver.

[0322] In one embodiment, other transmitters in the vehicle and / or portable access device can be used to lightly load one or more channels, forcing an attack device to have a narrow low-pass filter for detecting RF signals transmitted by the initiator and responder. The one or more channels may include or be near the channels used by the initiator and responder. The signals transmitted on one or more channels may be dummy signals.

[0323] Figure 49 shows two BLE radios 3900 (indicated as 3900A and 3900B). The first BLE radio 3900A functions as an initiate / measure device. The second BLE radio 3900B functions as a reflector (or response) device. The initiate / measure device 3900A can measure the round-trip time (RTT) of a packet transmitted from the first BLE radio 3900A to the second BLE radio 3900B, the time it takes for the second BLE radio to respond, and the time it takes for the packet to be transmitted from the second BLE radio 3900B to the first BLE radio 3900A. In another embodiment, the RTT includes the time it takes for a packet to be transmitted from the processing module 3922A of the first BLE radio 3900A to the correlation / protocol module 3920B of the second BLE radio and back from the processing module 3922B or protocol module 3924B to the demodulator 3918a or correlation / protocol module 3920A. This may include measuring the transfer time from processing module 3922A to BLE radio 3900B via protocol module 3924A, GFSK modulator 3926A, D / A low-pass filter 3928A, upconverter 3920A, power amplifier 3932A, switch balun 3908A, and bandpass filter 3906A, and to correlation protocol module 3920B via bandpass filter 3906B, switch balun 3908B, low-noise amplifier 3910B, downconverter 3912B, bandpass filter amplifier 3914B, A / D 3916B, and demodulator 3918B. The transfer time from demodulator 3918B or correlation protocol module 3920B to protocol module 3924B or processing module 3922B may also be determined. The time can also be determined from protocol module 3924B or processing module 3922B via GFSK modulator 3926B, D / A low-pass filter 3928B, upconverter 3930B, power amplifier 3932B, switch balun 3908B, bandpass filters 3906B, 3906A, switch balun 3908A, low-noise amplifier 3910A, downconverter 3912A, bandpass filter amplifier 3914A, A / D 3916A, and demodulator 3918A or correlation protocol module 3920A.Although BLE radio 3900A is listed as the initiator and BLE radio 3900B is listed as the responder, the roles of processing can be switched so that BLE radio 3900B is the initiator and BLE radio 3900A is the responder.

[0324] The following processes may be performed to accurately determine the RTT between two BLE radios in a vehicle (e.g., BLE radios 3900A and 3900B in Figure 49) and / or between the vehicle's BLE radio and the portable access device's BLE radio. The processes are performed to prevent attacks and / or to facilitate detection when an attack is being carried out and / or has already been carried out. The following processes may be performed individually or in any combination. In one embodiment, a large number of predetermined packets are exchanged between BLE radios. An initiator can measure and / or estimate the RTT of the signals transmitted between the BLE radios. This may include the time T1 when a packet is sent from the first BLE radio to the second BLE radio, the time T2 when the second BLE radio responds, the time T3 when the second BLE radio sends the packet back to the first BLE radio, and the time T4 when the first BLE radio receives the packet from the second BLE radio.

[0325] In one embodiment, the A / D and D / A clocks of a BLE radio and / or a phase-locked loop are dithered between packets. In addition to dithering the clocks where possible, cryptographically random fluctuations may be added, which have been known in BLE radios for when the least significant bit (LSB) generated by a digital timer is transmitted. The cryptographically random fluctuations are used so that an attacking device cannot predict the exact moment when the transmission occurs.

[0326] In one embodiment, each packet contains a pre-agreed, large, for example, 16-256 bit encrypted random multi-bit identifier (PACRMBI). In another embodiment, the packet bit content from an initiator and the packet bit content from a responder are indistinguishable to an attacking device. Based on the packet bit content, the attacking device cannot determine the direction from which the packet originated or whether the packet is an initiator packet or a responder packet.

[0327] In one embodiment, the channels of the BLE radios are cryptographically randomized. In one embodiment, the determination of which of the BLE radios is the initiator or the responder is cryptographically randomized. In one embodiment, one or both of the BLE radios send dummy packets that an attack device cannot distinguish from other packets sent by the BLE radios. The selection of which BLE radio sends the dummy packets is cryptographically randomized and can be switched randomly. This makes it difficult for the attack device to determine which packets are valid and in which direction the packets are being sent between the BLE radios.

[0328] In one embodiment, the polarization of the antenna set used by the BLE radio is initially cryptographically randomized. Heuristic techniques are used to select which antenna swapping provides the best “antenna-channel” across the entire set of channels among the BLE radios. This may include using heuristic techniques to select higher received signal strength, compensating for and monitoring antenna gain with respect to frequency across multiple channels, using the antenna combination with the highest average or intermediate power, and / or using a Rayleigh fading estimator or Kalman filter estimator. This reduces cryptographically random antenna patterns and allows for targeting of the “antenna-channel” with maximum power and minimum cross-polarization.

[0329] In one embodiment, in-phase and quadrature-phase (IQ) streams at the receiver are upsampled (or interpolated) before being transmitted to a corresponding correlation protocol module in the BLE radio, with an idealized upsampled IQ stream matching PACRMBI. As an alternative to using PACRMBI, the transmitted message may be encrypted, bit-decoded upon reception, and converted to an ideal upsampled IQ stream. The two upsampled streams can be transmitted via the correlation protocol module 3920, which can monitor upsampled clock edges where sufficient correlation exists to match that of PACRMBI. The correlation protocol module 3920 selects the largest matching clock edge. Sub-bit timings in the round-trip timing of the bitstream of the communication channel may be interpolated using other clock recovery methods. This may be done in combination with upsampling correlation or in combination with normal clock sampling.

[0330] In one embodiment, the amplifier settings are communicated between BLE radios. The amplifier settings are sufficient to compensate for any frequency or amplifier gain fluctuations in propagation delays between BLE radios.

[0331] In another embodiment, the measured die temperature within the BLE radio is communicated (or shared) between BLE radios to compensate for any temperature-based frequency or amplifier gain variations in propagation delays between BLE radios.

[0332] Another possible process is to communicate balan fluctuations between BLE radios. Another process is to append short (e.g., 6 μs) but cryptographically random continuous wave tones (e.g., 4-8 μs) to packet pairs to perform tone-exchange ranging while simultaneously performing round-trip timing measurements.

[0333] Figure 50 shows a position and distance determination system 5600 including an RTT initiator 5602, an RTT responder 5604, and an RTT sniffer 5606. The RTT initiator 5602 and the RTT responder 5604 may function as any of the initiators, responders, BLE radios, or RF circuits disclosed herein. The RTT sniffer 5606 may be placed in a vehicle together with one of the RTT devices 5602, 5604 and may include one of the antenna modules 40 in Figure 2, while the RTT device in the vehicle may include one of the other antenna modules 40. Devices 5602, 5604, and 5606 each include the control modules described above and may perform any of the processes described. The polarization diversity described above is provided between the antennas of RTT devices 5602 and 5604, and between one of the RTT devices 5602 or 5604 located in the vehicle and the antenna of the RTT sniffer 5606. Polarization diversity is particularly useful when performing round-trip timing measurements. Each of the RTT devices 5602 and 5604 may include a single circularly polarized antenna.

[0334] One of the RTT devices 5602 and 5604 located within the vehicle is called the master device, while the other RTT device 5602 and 5604 is called the slave device. When the master device sends a challenge signal to the slave device, the RTT sniffer 5606 acts as a listener and detects (i) when the challenge signal was sent and / or when the challenge signal was received by the RTT sniffer 5606, and (ii) when the slave device sent a response signal to the challenge signal and / or (iii) when the RTT sniffer 5606 received the response signal. The RTT sniffer 5606 can then determine the location of the slave device using triangulation based on the transmission and / or reception times of the challenge signal and the response signal. The master device can also measure the round-trip timing associated with the challenge and response signals to measure the direct path between antennas instead of the bounce path. This ensures that the antenna nulls are aligned and cross-polarization is prevented.

[0335] The master device and the RTT sniffer 5606 work together to estimate the distance to the slave device. Equations 5-7 below are performed by the master device, and the length of time T is the duration for which the challenge signal is sent from the master device to the slave device. MS We decided on this, and here, T SM T is the length of time it takes for the response signal to be sent from the slave device to the master device. RX T is the time it takes for the response signal to be received by the master device. TX This is the time when the challenge signal is transmitted from the master device, and T SDELAY is the length of the delay time between receiving the challenge signal and the slave device responding with a response signal, and FixedOffset1 is the length of a first offset time, which can be 0 or greater.

number

number

Number

[0336] The RTT sniffer 5606 knows when a challenge signal was received by the RTT sniffer 5606, when a response signal was received by the RTT sniffer 5606, and the number of slave clock cycles between when the slave device received the challenge signal and when the slave device transmitted the response signal. The RTT sniffer 5606 (or listener) uses Equation 8 to determine the time T SLRX at which the RTT sniffer 5606 receives the response signal and the time T MLRX at which the RTT sniffer 5606 receives the challenge signal, where T SL is the length of time until the RTT sniffer 5606 receives the response signal, FixedOffset2 is the length of a second offset time that can be 0 or greater, and T ML is the length of time until the RTT sniffer 5606 receives the challenge signal, T SLRX is the time at which the RTT sniffer 5606 receives the response signal, and T MLRX is the time at which the RTT sniffer 5606 receives the challenge signal.

Number

[0337] Since the master device and the RTT sniffer 5606 are cooperating, information is shared so that one or more of these devices can estimate the distance to the slave device based on Equations 9 - 11. The sum of T MS and T SL can be replaced to provide Equations 9 - 11.

Number

Number

number

[0338] Figure 51 shows another position-distance determination system 5700, which includes an RTT initiator 5702, an RTT responder 5704, and several RTT sniffers 5706. The RTT initiator 5702 and RTT responder 5704 may function as any of the initiators, responders, BLE radios, or RF circuits disclosed herein. The RTT sniffer 5706 is placed in a vehicle together with one of the RTT devices 5702, 5704 and includes an antenna module (similar to the antenna module 40 in Figure 2). Devices 5702, 5704, and 5706 each include the control modules described above and may perform any of the processes described. The RTT devices in a vehicle may also include an antenna module similar to the antenna module 40 in Figure 2. Polarization diversity is provided between the antennas of RTT devices 5702 and 5704, and between one of the RTT devices 5702 or 5704 located in the vehicle and the antenna of the RTT sniffer 5706. Polarization diversity is particularly useful when performing round-trip timing measurements to measure the direct path between antennas rather than the bounce path. This ensures that the antenna nulls are aligned and prevents cross-polarization.

[0339] One of the RTT devices 5702 and 5704 located within the vehicle is called the master device, while the other RTT device 5702 and 5704 is called the slave device. When the master device sends a challenge signal to the slave device, the RTT sniffer 5706 acts as a listener, detecting when the challenge signal was sent and when the slave device sent a response signal to the challenge signal. RTT devices 5702 and 5704 can operate similarly to RTT devices 5602 and 5604 in Figure 50. Each of the RTT sniffers 5706 can operate similarly to the RTT sniffer 5606.

[0340] Time TAB is the length of time it takes for the challenge signal to be transmitted from the RTT initiator 5702 to the RTT responder 5704. Time TBA is the length of time it takes for the corresponding response signal to be transmitted from the RTT responder to the RTT initiator. Time TAC is the length of time it takes for the first RTT sniffer to receive the challenge signal. Time TBC is the length of time it takes for the first RTT sniffer to receive the response signal. Time TAD is the length of time it takes for the second RTT sniffer to receive the challenge signal. Time TBD is the length of time it takes for the second RTT sniffer to receive the response signal. Time TAE is the length of time it takes for the third RTT sniffer to receive the challenge signal. Time TBE is the length of time it takes for the third RTT sniffer to receive the response signal. If TAB and TAC are known, TBC can be calculated. If TAB and TAD are known, TBD can be calculated. If TAB and TAE are known, TBE can be calculated.

[0341] If there are enough RTT sniffers, the time TAB can be calculated. For example, if three RTT initiators know the position of each RTT initiator relative to a master device (or initiator), the time TAB can be calculated. This can be realized using equations 12-17, assuming all reflections are instantaneous, where TRxAC is the time when the first RTT sniffer receives the challenge signal, TRxBC is the time when the first RTT sniffer receives the response signal, TRxAD is the time when the second RTT sniffer receives the challenge signal, TRxBD is the time when the second RTT sniffer receives the response signal, TRxAE is the time when the third RTT sniffer receives the challenge signal, and TRxBE is the time when the third RTT sniffer receives the challenge signal. A is the time when the response signal is received, deltaRxAtC is the time difference between the time when the first RTT sniffer receives the response signal and the time when the first RTT sniffer receives the challenge signal, deltaRxAtD is the time difference between the time when the second RTT sniffer receives the response signal and the time when the second RTT sniffer receives the challenge signal, and deltaRxAtE is the time difference between the time when the third RTT sniffer receives the response signal and the time when the third RTT sniffer receives the challenge signal. The position of the slave device (or responder) can also be determined using equations 18-25, where xa is the x-coordinate of the master device, ya is the y-coordinate of the master device, za is the z-coordinate of the master device, xb is the x-coordinate of the slave device, yb is the y-coordinate of the slave device, zb is the z-coordinate of the slave device, xc is the x-coordinate of the first RTT sniffer, yc is the y-coordinate of the first RTT sniffer, zc is the z-coordinate of the first RTT sniffer, xd is the x-coordinate of the second RTT sniffer, yd is the y-coordinate of the second RTT sniffer, zd is the z-coordinate of the second RTT sniffer, xe is the x-coordinate of the third RTT sniffer, ye is the y-coordinate of the third RTT sniffer, and ze is the z-coordinate of the third RTT sniffer.The x, y, and z coordinates of the master and slave devices are known, and the x, y, and z coordinates of the slave device are determined. TBC, TBD, and TBE can be determined in the same manner as described above.

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0342] When three RTT sniffers (e.g., RTT sniffer 5706 shown) are used, trilateration can be performed using three circles to measure the distance of a slave device to one of the RTT devices 5702, 5704 and / or the corresponding vehicle, and to determine its position. This can be done with the master device and / or one or more RTT sniffers. Information determined by the master device and the RTT sniffers can be shared with each other. Time, distance, and / or position can be determined and updated periodically.

[0343] If, within a vehicle, an object (e.g., the head of a vehicle occupant) is present near and / or between the master device and the antenna module of one or more RTT sniffers so that the object interferes with the signal transmitted by the master device, the round-trip timing measurements may be updated periodically. This may be done to measure the distance between the master device and the RTT sniffers and to detect when the corresponding physical environment / system has changed.

[0344] Figure 52 shows a first network device (or vehicle) 5800 and a second network device (or portable network device) 5802. The first network device 5800 includes a tone-switching responder 5804 and a tone-switching initiator 5806. Tone switching is also called unmodulated carrier tone switching. The second network device 5802 includes a tone-switching initiator 5808 and a tone-switching responder 5810. Devices 5804, 5806, 5808, and 5810 may be implemented as any other BLE radios, RF circuits, initiators, responders, etc. disclosed herein. At least one of devices 5804, 5808 and at least one of devices 5806, 5808 may include or be connected to a single-polarization antenna and a circular-polarization antenna. Devices 5804, 5806, 5808, and 5810 may each include the antenna module 40 in Figure 2 and / or the antenna shown in Figure 11.

[0345] Tone exchange may occur between responder 5804 and initiator 5808, and between initiator 5806 and responder 5810. RTT measurements may be transmitted in the same packet as the exchanged tones. Devices 5804, 5806, 5808, and 5810 can randomly select the channel used to transmit packets. Packet transmission can occur simultaneously with packet reception. For example, initiator 5808 may transmit a tone to responder 5804 on the first channel while receiving a tone from responder 5804 on the second channel. Initiator 5806 may transmit and / or receive a tone while initiator 5804 is transmitting and / or receiving a tone.

[0346] Network devices 5800 and 5802 may be pre-synchronized, for example, through the exchange (or handshake) of sequence signals to synchronize the clocks of network devices 5800 and 5802. This synchronization may be performed to allow the network devices to transmit signals to each other simultaneously. As an example, two 1MHz signals can be transmitted, each transmitting data at 1Mbps. The signals can be 2MHz apart from each other. This prevents an attacking device from performing attacks such as range extension attacks or attacks involving active manipulation of tones. If an attacker uses a 1MHz wide bandpass filter, the delay time of the bandpass filter is long enough that they will not respond fast enough to perform an attack. If an attacker uses a wideband bandpass filter, such as a 4MHz bandpass filter, the noise in the corresponding signal eye diagram is too great to distinguish the signals transmitted by network devices 5800 and 5802. As another example, signals may be transmitted from the network devices at a symbol transmission rate of less than a given time length (e.g., 1μs per symbol). This allows for rapid transmission and prevents attacks. Furthermore, the simultaneous transmission of two signals further hinders an attacker's success, as they would need to detect and influence both signals. As mentioned above, both signals may be transmitted at different frequencies by the same or different network devices.

[0347] Devices 5804, 5806, 5808, and 5810 can change the frequency of the transmitted tone, monitor the phase change due to the frequency change, and determine the distance between network devices 5800 and 5802 based on the phase change. This is sometimes called carrier phase-based ranging. Alternatively, if signals are transmitted and received as a result of the signal being reflected back to the source, the phase difference between the transmitted and received signals can be used to determine the modulo of the distance between the source and the reflector. Similarly, an initiator can determine the modulo of the distance between itself and a responder based on the phase difference between (i) the signal transmitted from the initiator to the responder and (ii) the corresponding response signal sent back from the responder to the initiator. The slope of the phase difference with respect to the amount of frequency change corresponds to or is equal to the distance, subject to the frequency step size. The smaller the frequency step, the greater the modulo rollover distance (see "Security of Carrier Phase-Based Ranging" by Olafsdotter, Ranganathan, and Capkun, which is incorporated herein by reference).

[0348] As another example, the Received Signal Strength Indicator (RSSI) parameter can be monitored to determine if the network device is close to the vehicle, and then a series of tone exchanges can be performed to measure the distance. Tone exchanges may also be performed to confirm that there is no attack based on the user's touch of the door handle. Multiple round-trip timing measurements may be performed to determine the distance of the network device to the vehicle.

[0349] The distance determination techniques described above may be used in combination with other techniques disclosed herein for determining the RTT value. The direction of tone propagation between devices 5804, 5806, 5808, and 5810 can be randomized.

[0350] In one embodiment, the control module of the first network device 5800 plots the phase change versus the frequency change for each of the multiple tones to be exchanged, thereby generating multiple linear curves. The control module determines the slope of the curves, which provides the ratio of the phase change to the frequency change. The slope is then used to determine the distance between adjacent curves, which relates to the distance between the first and second network devices 5800, 5802.

[0351] Figure 53 shows a positioning system 5900 including a tone-exchange initiator 5902, a tone-exchange responder 5904, and a tone-exchange sniffer 5906. The tone-exchange initiator 5902 and the tone-exchange responder 5904 may function as any of the initiators, responders, BLE radios, or RF circuits disclosed herein. The tone-exchange sniffer 5906 may function similarly to the RTT sniffer 5606 in Figure 50 and may be placed in a vehicle together with one of the tone-exchange devices 5902, 5904, and may include one of the antenna modules 40 in Figure 2, while the tone-exchange device in the vehicle may include another of the antenna modules 40. Devices 5902, 5904, and 5906 each include the control modules described above and may perform any of the processes described. Polarization diversity is provided between the antennas of tone-changing devices 5902 and 5904, and between one of the tone-changing devices 5902 and 5904 located in the vehicle and the antenna of tone-changing sniffer 5906. Polarization diversity is particularly useful when performing round-trip timing measurements.

[0352] One of the tone exchange devices 5902, 5904 located within the vehicle is called the master device, while the other tone exchange device 5902, 5904 is called the slave device. When the master device transmits a tone to the slave device, and vice versa, the tone exchange sniffer 5906 acts as a listener and detects (i) when a tone was transmitted to and / or received by the tone exchange sniffer 5906, (ii) when the slave device transmitted a tone to the master device, and / or (iii) when the tone exchange sniffer 5906 received a tone transmitted by the slave device. The slave device acts as a reflector and can send back to the master device the tone it has received from the master device. The master device and / or the sniffer device can prevent at least one of the following: access to the vehicle or operational control, based on the tone arrival time, round-trip timing measurements, and / or the estimated distance between the devices.

[0353] Figure 54 shows a method for determining the distance between the initiator and the responder, and between the responder and the sniffer. The process described below in Figure 54 is primarily explained with respect to the embodiments in Figures 50 and 53, but the process can be readily modified to apply to other embodiments of the present disclosure, such as the embodiments in Figures 2-6, 11, 14, 39, and 46-49. The process can be repeated. This method is primarily explained with respect to the embodiment in Figure 53, but this method can be applied to other embodiments of the present disclosure.

[0354] The method can begin at 6000. At 6002, the tone exchange initiator 5902 sends a tone signal containing the tone to the tone exchange responder 5904. The tone is e(jωt+Ф A )·τ AB It can be expressed as follows, where A is the tone exchange initiator 5902, B is the tone exchange responder 5904, τ AB ω is the time it takes to travel from A to B, and is directly related to the distance between the tone exchange initiator 5902 and the tone exchange responder 5904, where ω is the frequency and φ is the frequency. Ais the phase of the tone at the tone exchange initiator 5902, and t is time.

[0355] In 6004, the tone has a delay of φ B Received by tone exchange responder 5904 with a delay φ C The tone signal is received by the tone-exchange sniffer 5906. The received tone signal is down-converted to the baseband by the tone-exchange responder 5904, which can be expressed by equation 26.

number

number

[0356] In step 6006, the tone exchange initiator 5902 receives a tone from the tone exchange responder 5904, and the tone exchange responder 5904 retransmits that tone signal to the tone exchange initiator 5902 as a second tone signal. The tone is e(jωt+Ф A )·τ AB The second tone signal received can be expressed by equation 28. The tone exchange sniffer 5906 also receives a second tone signal, which can be expressed by equation 29.

number

number

[0357] In 6008, the tone exchange initiator 5902 receives a phase signal from the tone exchange responder 5904 that represents the natural logarithmic tone value, including the phase difference of the tone as received by the tone exchange responder 5904. Thus, the tone exchange responder 5904 transmits the measured phase to the tone exchange initiator 5902, where the value is multiplied as shown by equation 30.

number

[0358] In 6010, the tone exchange sniffer 5906 determines, based on the received tone signal, the phase difference of the tone between when it was transmitted from the tone exchange initiator and when it was received by the tone exchange sniffer, and the tone value associated with the phase difference of the tone between when it was transmitted from the tone exchange responder and when it was received by the tone exchange sniffer. The tone value is e(jωτ BC +φ B -φ C ) and e(jωτ AC +φ A -φ C It can be expressed as ).

[0359] In 6012, the initiator 5902 and / or sniffer 5906 determine the distance between the initiator 5902 and the responder 5904, and the distance between the initiator 5902 and the sniffer 5906. The distance values ​​can be determined in the same manner as when sniffing the round-trip time described above; see, for example, equations 12 and 15 and their corresponding descriptions. Instead of round-trip time, phase is used. This calculation involves the use of equation 31, where the tone value e(jωτ) is... BC +φ B -φ C ) and e(-jωτ) AC -φ A +φ C ) was measured or determined with Sniffer 5906, and e(jωτ AC ) is known a priori, and the tone value e(jωτ AB +φ A -φ B) is determined by responder 5904.

number

[0360] Figure 55 shows an example of a passive tone exchange / phase difference detection system 6100. The system 6100 includes a phase-locked loop (PLL) 6102, a phase module 6104, a transmitter 6106, a receiver 6108, and an antenna module 6110. The antenna module 6110 may be similar to the antenna module 40 in Figure 2. The transmitter 6106 transmits a first tone, which is the output of the PLL 6102, reflected by the reflector 6112, and returned to the receiver 6108. The output of the PLL and the reflected tone signal are provided to the phase module 6104. The phase module 6104 determines the phase difference between the output of the PLL and the reflected tone signal. The phase module 6104 or other modules disclosed herein determine the distance between the transmitter 6106 and the reflector 6112 based on the phase difference. The phase module 6104 or other modules disclosed herein can prevent access to the interior of the vehicle and / or control of the vehicle's operation based on a determined distance.

[0361] Figure 56 shows an example of an active tone-exchange / phase difference detection system 6200. System 6200 operates similarly to system 6100 in Figure 55. The transmitter and receiver 6106, 6108 are represented by box 6202. The reflector 6112 in Figure 55 can be replaced with a responder device 6204 for active tone exchange. The responder device 6204 can receive a first tone signal from transmitter 6106, which contains one or more first tones, and respond with a second tone signal. The second tone signal may contain one or more tones and / or one or more other tones. The second tone signal is sent back to receiver 6108.

[0362] Figure 57 shows initiator packet 6300 and response packet 6302 used for measuring RSSI and time of flight. Initiator packet 6300 may include multiple fields, such as a preamble, a synchronous access word (e.g., a pseudo-random synchronous access word), a data field containing data, a cyclic redundancy check (CRC) field containing CRC bits, and a continuous wave (CW) tone field containing a CW tone. Response packet 6302 may include a CW tone field, a preamble, a synchronous access word, a data field, and a CRC field.

[0363] An initiator device can send an initiator packet 6300, which can be received by a responder device. The responder device can then generate a response packet 6302 and send that response packet back to the initiator device. This can be done for purposes such as tone exchange, phase difference determination, and round-trip timing measurement. The distance between the devices can then be determined. These measurements and calculations can be performed to detect range extender type relay station attacks. In one embodiment, the initiator and responder pre-arrange what the synchronous access word will be based on a given list. The synchronous access word includes an access address. The initiator can measure, for example, the length of time it takes to receive the response packet and / or the synchronous access word after sending the initiator packet. The length of time and the synchronous access word can be compared to a given length of time and a given synchronous access word. If the comparison performed results in a match, a range extender type relay station attack has not occurred. However, if the received synchronous access word does not match, and / or if the duration differs from the expected value by a predetermined amount, a range extender type relay station attack may be occurring.

[0364] In one embodiment, the initiator and responder exchange a predetermined key, a list of synchronous access words, and the time at which each of the synchronous access words should be transmitted. When initially created, the synchronous access words can be randomly selected. This allows the responder to know the appropriate key and / or synchronous access word to respond when it receives the initiator packet. The key may be included in the response packet. In another embodiment, the initiator and response packets do not include a preamble, as shown in Figure 58. In one embodiment, the CW tone is 4 to 10 μs long.

[0365] In another embodiment, the initiator and response packets have the same format as shown in Figure 59. Each packet contains a first CW tone as the first field, a synchronization access word, a data field, a CRC field, and a second CW tone as the last field. Another example of initiator and response packets having the same format is shown in Figure 60, where each packet contains a first CW tone as the first field, a synchronization word including PACRMBI, a PDU field including PDU, a medium access controller (MAC) field, a CRC field, and a second CW tone as the last field. The CW tones in Figures 57-60 are cryptographically random length tones and may be checked by the initiator upon reception. For example, if the CW tone received from the responder is incorrect, a range extender type relay station attack may be in progress. In the embodiment of Figures 59-60, the round-trip timing of the synchronization word prevents CW tone exchanges from overlapping beyond an uncertain range (e.g., 75 meters) in a 2 MHz channel tone step. The initiator and responder packets described above may be transmitted on the same frequency. By making the initiator and responder packets the same format, an attacking device cannot distinguish which packets are initiator packets and which are responder packets. In one embodiment, the end of the packets does not include a CW tone.

[0366] In one embodiment, the timing, frequency, length, power level, amplitude, and content of the CW tone and synchronized access word of the initiator and responder packets are checked in the initiator and responder to determine if they are correct and / or match, thereby identifying whether an attack is taking place. In one embodiment, a pseudo-random number of packets are exchanged on a first frequency before changing to the next frequency and exchanging another pseudo-random number of packets.

[0367] Attack devices typically include filters (e.g., low-pass filters, band-pass filters) and mixers (e.g., down-converters, up-converters), so they introduce delays when relaying signals. To avoid detection of an attack by an attack device, it must retransmit the received signal without any detectable delay. This makes it difficult to keep an attack device undetected. An attack device may delay a signal by 500 ns, which could delay the signal by 500 feet (ft) in space. To either accelerate the transmission of a tone or start transmitting a tone at the appropriate time, the attack device might need to know in advance what is being transmitted. This is impossible. This is especially true when receiving a relayed signal using a heterodyne receiver. A heterodyne receiver converts packets / tones into in-phase (I)-quadrature-phase (Q) domains and captures them within the IQ domain. In the IQ domain, phase differences are detected. If an attack is present, the delay caused by the attack can be detected in the IQ domain based on the phase difference. If the tone is shortened by the attacking device so that the corresponding synchronous access word arrives at the correct time, the timing and length of the CW tone will be incorrect and will be detected by the initiator.

[0368] In one embodiment, the initiator examines the received CW tone transmitted from the responder for (i) its length relative to the start position of the transmitted synchronous access word, (ii) consistent power (or amplitude) before and relative to the synchronous access word, and (iii) consistent tone throughout the synchronous access word. Consistent tone may refer to a consistent frequency, power level, amplitude, etc. In another embodiment, the start and end times of the synchronous access word relative to the start of the first CW tone of the transmitted packet are known to be within a predetermined time range (e.g., ±10 ns). Therefore, if the start and end times are within the predetermined range of the start of the first CW tone of the packet, there is no attack; otherwise, an attack may be occurring.

[0369] As another example, a PLL in an initiator transmitting a tone may have three different tones that the PLL can generate on a given channel: a center tone, a high tone at a first frequency (e.g., 250 kHz), and a low tone at a second predetermined frequency (e.g., -250 kHz). The transmitted tone may be selected and transmitted according to a predetermined and agreed random sequence and / or pattern of tones. This may be agreed upon between the initiator and the responder. The PLLs of the initiator and the attacking device may not be matched with each other. If there is a frequency difference exceeding a predetermined threshold between the signal transmitted by the initiator and the signal received in response, the initiator can determine that an attack is taking place.

[0370] In one embodiment, a responder can measure and respond with data what phase delay it has detected in the signal it has received. This can be based on the timing at which the responder received the tail-end CW tone of the packet from the initiator. The responder can measure the phase delay between (i) the tail-end (or ending) CW tone of the packet received from the initiator and (ii) the front-end (or initial leading CW tone) of the packet being transmitted by the responder in response to the packet received from the initiator. The initiator can calculate the total round-trip time for packets in both directions, from the initiator to the responder and back from the responder to the initiator.

[0371] In addition to detecting signal delays, the initiator can also detect when the attacking device amplifies the signal (or tone). Signal / tone amplification can also delay transmission, which can be detected. During tone relaying by the attacking device, the tone may become distorted and / or a different tone than the original transmitted tone may be sent.

[0372] The above example enables more accurate distance measurement with fewer packets, each having both a synchronous access word and a CW tone. The synchronous access word protects the CW tone from being altered by an attacking device without detection, and vice versa. Bidirectional randomized communication is performed, protecting both the synchronous access word and the CW tone.

[0373] The initiator PLL disclosed herein may be a phase-predictable PLL that enables the initiator to predict the phase of a signal when the signal frequency is changed. This eliminates the need to verify whether the timing of the CW tone transmitted by the initiator and the CW tone transmitted by the responder is correct. The responder may, for example, measure the time it has received the tail-end CW tone from the initiator, determine the corresponding phase delay of the tail-end CW tone relative to the generation of the front-end CW tone by the responder for the response signal, and transmit this information to the initiator along with the front-end CW tone. The initiator can then calculate the total round-trip time based on the received information.

[0374] In one embodiment, the initiator is either a vehicle or a portable access device, and the responder is the other of the vehicle and / or portable access device. The order in which the vehicle and portable access device transmit and respond is changed pseudo-randomly. Packets and / or tone signals can also be transmitted as responses and can be used as initiator packets and / or initiator tone signals. In one embodiment, the order in which the vehicle and portable access device transmit and respond is not changed during short periods (e.g., exchange periods less than a predetermined period) but is changed during long exchange periods (e.g., exchange periods longer than a predetermined period). The order can be switched periodically. In these examples, bidirectional data is exchanged using antenna polarization diversity to provide accurate timing measurements.

[0375] The processing is performed to provide accurate measurements of the start and end times of the CW tone and synchronous access word. The correlation protocol module 3920 maintains a cyclical queue of bits and can lock in the start and end times and length of the CW tone and synchronous access word of the transmitted (initiator) packet to compare with the start and end times and length of the CW tone and synchronous access word of the received (responder) packet. The correlation protocol module 3920 can interpolate where zero-crossing points are located. Post-processing of the I and Q data associated with the synchronous access word may be performed for clock recovery to interpolate when the synchronous access word was reached. The I and Q data may have different transition / spin rates. Interpolation may be performed to determine where the center point of the transition is to obtain accurate timing for clock recovery. Multiple zero-crossing points may be detected and aligned to align the timing. Additionally, the I and Q data may be oversampled, as further described below, to best fit / align to one or more bits.

[0376] Figure 61 shows an antenna routing system 6700 for network devices, each having an antenna module. The antenna modules represent polarization diversity. In this example, two polarization axes are shown for each antenna module. Each antenna module includes a vertical antenna and a horizontal antenna. Possible channel vector h VV h VH h HV , and h HH The distance measuring module 6710 is shown. The distance measuring module 6710 has a channel vector h VV h VH h HV , and h HH Based on one of each of these, the range (or distance) between the corresponding antennas of the network device is determined. The ranging module executes a ranging algorithm to determine the range r VV , r VH , rHV , and r HH The range r can be determined. VV , r VH , r HV , and r HH Which range r VV , r VH , r HV , and r HH This is provided to the minimum module 6712, which determines which is the shortest path. The shortest path may then be selected.

[0377] Each channel vector can be generated for one or more selected frequencies. When compared, ranges can be generated for channel vectors of the same or different frequencies. As an example, vectors can be generated for at least a subset of 80 different tones within the 2.4 GHz Industrial, Scientific, and Medical (ISM) band, with a 1 MHz frequency step between adjacent tones. Frequencies related to the shortest range can be selected. Other factors, such as signal strength, amplitude, voltage, and parameter consistency, may also be taken into consideration during selection. This path selection can be performed by any of the initiators, responders, modules, network devices, etc., disclosed herein, and used for round-trip timing measurements. This allows the optimal antenna path to be selected for bidirectional packet and / or tone signal exchange to determine round-trip time.

[0378] Referring now to Figures 38 and 62, Figure 62 shows an exemplary radio model 6800 corresponding to the structure, function, and operation of the BLE radio 3900 (and / or a modified version of the BLE radio 3900) and RF channels and corresponding RF circuits of Figure 38. The radio model 6800 includes a first sampling module 6802, a time offset module 6804, a Gaussian low-pass filter 6806, an integrator 6808, a first upsampler 6810, an amplifier 6812, an adder 6814, a modulator 6816, a second sampling module 6818, a phase-frequency offset module 6820, a first mixer 6822, a phase delay device 6823, a second mixer 6824, a phase delay module 6826, a second low-pass filter 6828, a resampling module 6830, an arctangent module 6832, a differentiator 6834, a code determination module 6836, a bit pattern module 6838, a second upsampler 6840, a third upsampler 6842, a cross-correlation module 6844, and a peak detector 6846. Devices 6802, 6804, 6806, 6808, 6810, and 6812 represent examples of the transmitter portion of BLE radio 3900 or another BLE radio. Adder 6814 represents a channel between (i) another BLE radio and (ii) BLE radio 3900, including devices 3907, 3906, 3908, 3932, and 3910. Since the receiving BLE radio is not phase-locked to the transmitting BLE radio, phase and frequency offsets may exist between the receiving and transmitting BLE radios. Devices 6816, 6818, 6820, 6822, 6824, 6828, and 6830 correspond to the receiver portion of the BLE radio and are related to the RF sampling rate. Devices 6830, 6832, 6834, 6836, and 6838 also correspond to the receiver portion and perform processing on the baseband signal. Resample module 6830 functions as an analog-to-digital converter. Devices 6840, 6842, 6844, and 6846 also correspond to the receiver portion and are involved in interpolation for determining the phase.

[0379] When recovering the bitstream, the zero-crossings of the reconstructed signal from the differentiator 6834 can be determined. A significant amount of jitter may be present at the zero-crossings, which negatively affects the determination of the time of flight based on the timing of the zero-crossings. Small amounts of jitter also negatively affect the determination of the transmit and receive times.

[0380] The upsamplers 6840 and 6842 and the cross-correlation module 6844 are implemented to reduce jitter associated with sampling and zero-crossing decisions. The upsamplers 6840 and 6842 perform signal processing to interpolate and inject data points between existing received data points, thereby improving temporal resolution.

[0381] In one embodiment, the transmitted bitstream is known in advance to the BLE receiver and is provided to the upsampler 6842, as indicated by arrow 6843. This example does not include the code determination module 6836 and the bit pattern module 6838. In another embodiment, the transmitted bitstream is unknown, and the code determination module 6836 and the bit pattern module 6838 are included and provide the estimated bitstream to the upsampler 6842. As an example, the transmitted bitstream may be an access address indicating which device is transmitting. The estimated bitstream can be determined based on a criterion. For example, the criterion may be a preamble and / or a set of bits of bits received before the bitstream is estimated. The preamble and / or set of bits provides a temporal criterion based on which estimated bitstream is generated. The estimated bitstream is generated based on a known clock frequency of the transmitter and is associated with the transmit signal and the receiver's clock frequency.

[0382] The cross-correlation module 6844 performs cross-correlation between the outputs of upsamplers 6840 and 6842, and / or cross-correlation between the output of upsampler 6840 and the output of bit pattern module 6838. Cross-correlation is performed to match the envelopes of the signals provided to the cross-correlation and determine the phase difference. Cross-correlation may include performing product of the output signals, which involves taking the product of the corresponding data points of the two output signals and summing those products. By repeating this sum-of-products operation, with each iteration one output is gradually shifted in time by one data point relative to the other output, multiple sum-of-products values ​​can be obtained. The maximum sum-of-products value refers to the point when the two outputs are synchronized (or aligned) so that their waveforms match and are aligned in time. Based on this information, the phase offset (or difference) between the two outputs is determined.

[0383] Cross-correlation is improved in resolution by upsampling performed by upsamplers 6840 and 6842. Cross-correlation module 6846 correlates with a finer resolution signal than the initially received signal, interpolating the arrival time of received packets more finely in the received signal. Higher correlation resolution reduces the signal-to-noise ratio and message bit length, allowing for interpolation at finer resolution. Phase offset can be used to determine time of flight, as described herein. Peak detection module 6846 evaluates the cross-correlation results and indicates (i) when a time-matched peak occurred, and / or (ii) the phase offset. In one embodiment, cross-correlation module 6844 receives a digital value, and peak detection module 6846 determines whether the cross-correlation output (or sum-of-products value) has reached a predetermined threshold. If the predetermined threshold is reached, the peak detection module indicates "signal found" and the determined phase.

[0384] In one embodiment, the output of the upsampler 6840 is provided to the sign determination module 6836 and the cross-correlation module 6844, but the upsampler 6842 is not included. In this example, the output of the bit pattern module 6838 is provided directly to the cross-correlation module 6844.

[0385] The devices in Figures 38 and 62 are further described in relation to the method in Figure 63. The subsequent process in Figure 63 is mainly described in relation to the embodiments in Figures 2-6, 11, 14 and 38, but the process can be readily modified for application to other embodiments of the present disclosure. The process can be performed repeatedly.

[0386] The process can begin at 6900. At 6902, the sampling module 6802 of the first network device (e.g., a network device or portable access device implemented in a vehicle as part of an in-vehicle system) receives the bitstream transmitted from the processing module 3922. The sampling module 6802 samples the bitstream.

[0387] In 6904, the time offset module 6804 can receive the output of the sampling module 6802 and introduce a time offset (or delay). The sampling module 6802 and the time offset module 6804 can be implemented by the protocol module 3924. In 6906, the Gaussian low-pass filter (LPF) 6806 receives the output of the time offset module 6804, and its output may contain a bitstream that is filtered and converted from a square wave to a sine wave. The processing of the Gaussian LPF 6806 can be implemented by the GFSK modulator 3926. In 6908, the integrator 6808 integrates the output of the Gaussian LPF 6806 and can be implemented by the D / A low-pass filter 3928. Examples of signals 7000, 7002, and 7004 output from the sampling module 6802, the Gaussian LPF 6806, and the integrator 6808 are shown in Figure 64A.

[0388] In 6910, the upsampler 6810 upsamples the output of the integrator 6808 to include an additional point per sample. The upsampler 6810 can be implemented by the upconverter 3930. In 6912, the amplifier 6812 provides frequency deviation gain. In 6914, the sampling module 6818 receives an RF tone which can be provided by the PLL 3940. The output of the sampling module 6818 is provided to both the modulator 6816 and the phase-frequency offset module 6820. In 6916, the modulator 6816 modulates the output of the sampling module 6818 based on the output of the amplifier 6812 to provide an initiator signal. The modulator 6816 can be implemented at least partially by the upconverter 3930.

[0389] In 6918, the initiator signal from modulator 6816 is provided to power amplifier 3932 and may be transmitted to a second network device. The second network device may be a network device or portable access device implemented in a vehicle as part of an in-vehicle system. The initiator signal may be any of the initiator signals disclosed herein, start tone signals, master device transmit signals, and / or similar.

[0390] In 6920, the low-noise amplifier 3910 receives a response signal in response to an initiator signal. The response signal may contain Gaussian noise, as represented by the adder 6814. In 6922, the mixers 6822 and 6824 receive the response signal from the low-noise amplifier 3910 and downconvert the response signal to in-phase (I) and quadrature-phase (Q) baseband signals. The quadrature-phase baseband signal may be phase-delayed by 90° via a phase-delay device 6823. This can be achieved by the downconverter 3912.

[0391] In 6924, the LPF6828 filters the baseband signal and removes high-frequency components. The LPF6828 may contain multiple LPFs, one for each down-converted signal. The LPF6828 may be replaced and / or implemented by the bandpass filter amplifier 3914. In 6926, the resampling module 6830 samples the filtered baseband signal with sample jitter. The resampling module 6830 may be implemented by the A / D converter 3916. Examples of signals 7006 and 7008 from the resampling module 6830 are shown in Figure 64B.

[0392] In step 6928, the arctangent module 6832 determines the arctangent of the baseband signal to generate an arctangent signal. An example of the signal 7010 from the arctangent module 6832 is shown in Figure 64C. In step 6930, the differentiator 6834 differentiates the arctangent signal from the arctangent module 6832. An example of the signal 7012 from the differentiator 6834, superimposed on the original Gaussian filtered signal 7002, is shown in Figure 64D.

[0393] In 6932, the coding module 6836 performs a coding function to determine the coding of the output of the differentiator 6834. In 6934, the bit pattern module 6838 determines an idealized (or reference) bit pattern based on the output of the coding module 6836. After processing by the low-pass filter 6828 and the arctangent module 6832, an idealized bit pattern is obtained that matches the bit pattern from the Gaussian LPF 6806 or another bit pattern with the received bit pattern. This is done so that the upsampled values ​​are similar to the noise-free resampled data.

[0394] In 6936, the upsamplers 6840 and 6842 upsample the outputs of the differentiator 6834 and the bit pattern module 6838, respectively. In 6938, the outputs of the upsamplers 6840 and 6842 are correlated by the cross-correlation module 6844 to generate a correlated signal. Devices 6832, 6834, 6836, 6838, 6840, and 6842 can be implemented by the demodulator 3918. In 6940, the peak detector 6846 determines the phase of the correlated signal obtained from the cross-correlation module 6844. The cross-correlation module 6844 and the peak detector 6846 can be implemented by the correlation protocol module 3920. In one embodiment, the peak detector 6846 is implemented as a three-point parabolic peak interpolator on top of the upsampled cross-correlation module 6844. Two points near the detected peak (within a predetermined distance) are selected, and the parabolic interpolation of the three resulting points is obtained by upsampling.

[0395] In 6942, distance, position, round-trip time, and / or other parameters are determined based on the phase (or three-point parabolic interpolation of the upsampled result). Distance may be the distance between the first network device and the second network device. Position may be that of the second network device relative to the first network device. Round-trip time is the time it takes for the initiator signal to travel to the second network device and for the first network device to receive the response signal, and includes the time it takes for the second network device to generate the response signal after receiving the initiator signal.

[0396] In 6944, the processing module 3922 may determine whether a range extension type relay attack is occurring based on the phase, distance, position, round-trip time, and / or other parameters determined in 6942. If a range extension type relay attack is occurring, processing 6946 is performed; otherwise, the method may terminate in 6948. In 6946, the processing module 3922 implements a countermeasure such as any of the countermeasures disclosed herein.

[0397] The processes described above in Figures 35, 36, 45, 54, and 63 are intended to be illustrative examples. Depending on the application, the processes may be executed sequentially, synchronously, simultaneously, continuously, during overlapping periods, or in different orders. Furthermore, any process may not be performed or may be skipped depending on the embodiment and / or the order of events.

[0398] (i) There is a variation in transmission timing between the time it takes for the generated waveform to reach the antenna to which it is to be transmitted and (ii) the corresponding time measured by the timer. Factors that may contribute to this include clock domain crossings, changes in clock period, power amplifier propagation delay due to power amplifier gain settings, temperature, and processing propagation delay. Variations in processing, temperature, and amplifier gain settings can be calibrated from timing measurements.

[0399] A second BLE device (e.g., BLE device (or radio) 3900B), similar to or identical to the first BLE device (e.g., BLE device (or radio) 3900A in Figure 38), may be added to or implemented in the vehicle to substitute for a reflector (or responder) device as shown in Figure 49. Each of the BLE radios 3900 may be implemented on a separate system-on-a-chip (SOC). The first BLE radio 3900A can transmit an initiator signal that can be received by the receiver portion of the second BLE device.

[0400] Time T1 may be generated, determined by timer 3938A, when a first bitstream is generated and / or provided to the protocol module 3924A of the first BLE radio 3900A in order to generate an initiator signal to be transmitted from the first BLE radio 3900A. Time T2, determined by timer 3938B, may be when the correlation protocol module 3920B of the second BLE radio 3900B receives the first bitstream. A first calibration constant CAL1 may be set equal to, or determined based on, the difference between when timer 3938A detects the generation of the first bitstream and when the corresponding initiator signal is transmitted from antenna 3907A. A second calibration constant CAL2 may be set equal to, or determined based on, the difference between when timer 3938B detects the reception of the first bitstream at the correlation protocol module 3920B. The time of flight of the first bitstream from protocol module 3924A to correlation protocol module 3920B is (T2-CAL2)-(T1-CAL1).

[0401] Similarly, a time T3 may be generated, determined by timer 3938B, for when a second bitstream corresponding to the first bitstream is generated and / or provided to protocol module 3924B in order to generate a response signal to be transmitted from the second BLE radio 3900B. The response signal is generated in response to the initiator signal. A time T4, determined by timer 3938A, may be when correlation protocol module 3920A receives the second bitstream. A third calibration constant CAL3 may be set equal to, or determined based on, the difference between when timer 3938B detects the generation of the second bitstream and when the corresponding response signal is transmitted from antenna 3907B. A fourth calibration constant CAL4 may be set equal to, or determined based on, the difference between when timer 3938A detects the reception of the second bitstream at correlation protocol module 3920A. The time of flight of the second bitstream from protocol module 3924B to correlation protocol module 3920A is (T4-CAL4)-(T3-CAL3). The average time of flight and distance between the first and second BLE radios 3900 can be determined using equations 33-35, where equation 33 is based on equation 32, taking into account the described timing variations and therefore including the corresponding calibration values.

number

number

number

number

[0402] Timer 3938B can be activated by processing agreement to minimize reporting for T2-T3 and / or fine-tune the transmission time in the second BLE radio 3900B.

[0403] The PLLs 3940A and 3942A of the first BLE radio 3900A can be implemented as a single PLL. Similarly, the PLLs 3940B and 3942B of the second radio 3900B can be implemented as a single PLL. The two PLLs allow the transmitter and receiver hardware to be implemented on the same SoC, while enabling the capture of the initiator signal transmission time using the same BLE circuitry used to capture the response signal reception time.

[0404] According to this instruction, a multi-axis polarized RF antenna assembly includes a circularly polarized antenna comprising a conductive ring-shaped body having an internal bore, a circular isolator connected to the conductive ring-shaped body, and a linearly polarized antenna connected to the circularly polarized antenna and the circular isolator, extending outward from the circular isolator. The linearly polarized antenna includes a sleeve and a conductive element extending through the sleeve. The linearly polarized antenna extends perpendicular to the radius of the circularly polarized antenna.

[0405] According to this instruction, a multi-axis polarized RF antenna can include conductive elements as wires.

[0406] According to this instruction, the sleeve can be formed from polytetrafluoroethene, and the conductive element can be formed from copper.

[0407] According to this instruction, a linearly polarized antenna can be configured to extend downward from a circularly polarized antenna when in use.

[0408] According to this instruction, a circularly polarized antenna can be a two-axis antenna, and a linearly polarized antenna can be a single-axis antenna.

[0409] According to this instruction, the multi-axis polarized RF antenna assembly may further include a ground layer, and the circular isolator may be placed on the ground surface between the conductive element and the ground surface, and between the circularly polarized antenna and the ground surface.

[0410] According to this instruction, a circularly polarized antenna can include two feed points that are 90° phase-off, and can be configured to receive signals that are 90° phase-off from each other.

[0411] According to this instruction, the vehicle may include a body and a roof containing a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly can be oriented on the roof such that the linearly polarized antennas extend downward from the circularly polarized antennas.

[0412] According to this teaching, a vehicle may include a multi-axis polarized RF antenna assembly. The multi-axis polarized RF antenna assembly may include a first multi-axis polarized RF antenna assembly configured to be mounted on a vehicle, and a second multi-axis polarized RF antenna assembly configured to be mounted on a vehicle, including a second circularly polarized antenna including a second conductive ring-shaped body having a second internal bore, a second circular isolator connected to the second conductive ring-shaped body, and a second linearly polarized antenna connected to the second circular isolator and extending outward from the second circular isolator. The second linearly polarized antenna may include a sleeve and a conductive element extending through the sleeve of the second linearly polarized antenna. The second linearly polarized antenna may extend perpendicular to the radius of the second circularly polarized antenna, and the access module may be connected to the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly and configured to communicate with a portable access device via the first multi-axis polarized RF antenna assembly and the second multi-axis polarized RF antenna assembly.

[0413] According to this instruction, at any point in time, at least one of the linearly polarized antennas or the first multi-axis polarized RF antenna assembly is not cross-polarized with the antennas of the second multi-axis polarized RF antenna assembly.

[0414] According to this instruction, the access module can be configured to perform a passive entry passive start operation or a phon-as-a-key operation, which includes transmitting and receiving radio frequency signals via one first multi-axis polarized RF antenna assembly and one second multi-axis polarized RF antenna assembly.

[0415] According to this instruction, the access module can be configured to grant access to the vehicle based on radio frequency signals.

[0416] According to this instruction, the access module can be configured to run an algorithm that determines which antenna pair of the first multi-axis polarized RF antenna assembly and which multi-axis polarized RF antenna assembly should be used for communication with the portable access device.

[0417] According to this instruction, the portable access device can be a key fob or a mobile phone.

[0418] In one embodiment, the phone-as-a-key system described herein uses a BLE radio of a mobile phone to microlocate the phone's position relative to a set of receiving sensors. The sensors are located inside the vehicle. The sensors are used to detect whether the phone is close enough to the vehicle to allow access to the vehicle (e.g., unlocking the doors and / or starting the vehicle). The vehicle's access module uses the principle of angle of arrival (AOA). By knowing the angle of arrival of signals transmitted from the BLE radio to at least two separate sensors inside the vehicle, the source (i.e., the BLE radio) can establish its position on a two-dimensional plane. In this case, a phased antenna array is used to measure the angle of arrival of incoming signals. The phased antenna array includes multiple antennas that receive the transmitted signals. Each sensor in the vehicle includes one or more antennas. Each sensor may be a phased array sensor including a 3-antenna interleaved circular polarization (CP) receiver with a single wireless receiver, a 6-antenna interleaved linear polarization (LP) receiver with a single wireless receiver, a 3-antenna interleaved CP receiver with a single wireless receiver, and a 3-antenna interleaved printed antenna CP receiver with a single wireless receiver.

[0419] The access module detects the direction of the incident AOA signal, taking multipath effects into account. For example, two sinusoidal RF signals transmitted and reaching the sensor array are summed at the sensor array's antenna. The sum of the two sinusoidal RF signals is a sine wave with different phases and amplitudes, depending on the phase angles and amplitudes of the two source sine waves. The mathematical model used to predict the AOA direction can exhibit errors. These errors can be very large and unstable in dynamic multipath environments. To prevent these errors, the source signal can be identified along with potential strong multipath reflections using the MUSIC algorithm disclosed herein. The direct path signal is precisely tracked from the mobile phone. This tracking identifies any additional reflections. Reflected signals may be identified and discarded.

[0420] The access and control modules disclosed herein can implement any MUSIC algorithm referenced and / or disclosed herein. Direction-finding methods can generally be classified into two categories, sometimes called classical and sometimes modern. Classical methods include various beamforming methods. Modern methods are generally called subspace methods. MUSIC algorithms are classified as super-resolution parameter estimation algorithms that use subspace separation methods. Subspace methods may require a specific array arrangement of two identical but physically shifted arrays. Other methods include maximum likelihood estimation and beamforming.

[0421] Figure 70 shows a side view of multiple antennas 7000 in an array, indicating the angle of arrival θ. The array of antennas is sometimes referred to as an array manifold. Each antenna 7000 may be configured in the same way as and / or similarly to any of the antennas disclosed herein. In one embodiment, one or more antennas are quadrifold helix antennas.

[0422] The MUSIC algorithm uses an array manifold model to describe the response of an array manifold to one or more incident AOA signals. An equal linear array (ULA) of antennas can be defined as shown in Figure 70, where m is the antenna index in the array starting from 1, M is the total number of antennas, d is the spacing between antenna elements, and θ is the angle of the incident signal. The response of array element m to an incident signal s can be expressed by equation 37, where r is the received signal, a is the complex array manifold response, s is the source signal, m is the index number of the antenna element in question as stated, θ is the physical angle of the incident source signal as stated, λ is the wavelength of the signal, and n(t) is the noise in the receiver channel. This shows the effect of phase delay as a function of the physical position of the elements of the receiving sensor array, with a full 180° phase shift at d = λ / 2. It also shows the phase shift as a function of the incident angle θ.

number

[0423] Array steering vector a m For antennas where 1 ≤ m ≤ M, the incident angle θ is at the antenna element m. n For a given source signal n, it is defined by equation 38. This assumes an amplitude response of 1 for each antenna and an ideal phase response of ULA relative to antenna 1.

number

[0424] In the case of N incident signals, the received signal r(t) becomes the sum of the source signals via the array manifold and can be expressed by Equation 39.

number

[0425] In vector notation, the array manifold response parameters a and A are defined by equations 40 and 41. Vector a describes the array response of each element to a single source signal n, and A is an M × N matrix describing the response of all M array elements to all N source signals, where M and N are integers greater than or equal to 2. N source signals sampled at a temporal instant t are represented as an N × 1 vector S(t) as shown by equation 42.

number

number

number

[0426] Equation 43 may be used to map N source tones at various source arrival angles represented in the signal S(t) at a given time t, via antenna array response manifold model A, to a received (measured) data vector r(t) containing channel noise n(t), where r(t) is an M × 1 vector of data received at each antenna element.

number

[0427] Figure 71 shows an exemplary AOA method including the use of the MUSIC algorithm. The process is described primarily as being performed by a vehicle access module, such as one of the access modules disclosed herein, but the process may also be performed by a control module of a portable access device. Note that the H operator represents the Hermitian transpose or conjugate transpose operation. The method may begin at 7400. At 7402, the access module performs {r(t)}T t As represented by =1, T analytical signal samples are collected simultaneously from each antenna.

[0428] In 7404, the access module estimates the data covariance matrix R as shown in Equation 44.

number

[0429] The estimates of the covariance matrix are calculated according to Equation 44, and an example of covariance is shown in Figure 72. For interpretation, each arrow represents the covariance between antenna numbers, indicated on the X and Y axes at the base of the arrow. The arrow at the top center represents the covariance of antenna number 1 for antenna number 2 (c 12 ) represents the covariance of antenna number 2 with respect to antenna number 1 (c 21 ) represents c12 This is the complex conjugate of . The direction of the arrows represents the complex plane representation of magnitude and direction (the X-axis is the real axis, and the Y-axis is the imaginary axis).

[0430] The diagonal line (from top left to bottom right) represents the autocovariance, which has a magnitude of 1 and an imaginary value of zero. Furthermore, the matrix is ​​Hermesian, and for all i and j, c ij =c * This means that, and note that * is the complex conjugate. Thus, all useful information is (i)c 12 , c 23 , and c 13 , or (ii)c 21 , c 32 , and c 31 It is located in the upper right or lower left corner (excluding the diagonal line from the upper left to the lower right). This is expected to save data storage and reduce the size of the transmitted data.

[0431] In 7406, the access module uses singular value decomposition (SVD) or another eigenvalue decomposition method to compute the M × M matrix U as shown in Equation 45.

number

[0432] Following the eigenvalue decomposition of the covariance matrix estimate R, the resulting complex eigenvectors are provided, an example of which is shown in Figure 73. Figure 73 shows a visualization of the eigenvectors from the array manifold response at 35°. Figure 74 shows a visualization of the eigenvectors from the array manifold response at 0°.

[0433] As shown in Figure 72, the size and direction of the arrows indicate the real and imaginary components of each point corresponding to the real numbers on the X-axis and the imaginary numbers on the Y-axis. The solid and short dashed arrows represent a 3x3 array of eigenvectors. The vector column (X-axis) is sorted from largest (left) to smallest (right) by the eigenvalues ​​of the eigenvectors. Thus, column number 1 on the far left represents the signal subspace, while columns 2 and 3 represent the noise subspace.

[0434] In step 7408, the access module estimates or otherwise determines the number of incident signals N. In step 7410, the access module separates the matrix U into an M×N signal subspace matrix Us and a noise subspace estimation M×(MN) matrix Ue, in order to satisfy equation 46.

number

[0435] The response of the array manifold at the target angle (35°), along with the eigenvalue vectors, is shown by a long dashed arrow. This is derived from Equation 40.

[0436] In 7412, the access module calculates the MUSIC spectrum P(θ) for the target θ range with a predetermined resolution, as shown in Equation 47.

number

[0437] At this point, the noise subspace eigenvectors of the covariance matrix estimate must be perfectly orthogonal to the array manifold response. The result in the denominator of Equation 47 is small compared to the results at various test angles θ.

[0438] Figure 74 presents the same information as Figure 73, except that the array manifold response is shown at AOA of 0°. Note that the eigenvalue vectors remain the same, as they are derived from the measured data. The array manifold response rotates and shows the expected response to a directly incident signal, which means there is no phase shift in the antenna element. In this case, the result in the denominator of Equation 47 is a much larger value than that obtained in the case of Figure 73.

[0439] In 7414, the access module performs a peak search at P(θ) to determine the angle of arrival. The value of θ at the maximum value of P(θ) is the angle of arrival of N incident signals.

[0440] After processing Equation 47 for θ in the range of -90° to +90°, the resulting MUSIC power spectrum P(θ) is shown in Figure 76 for a 35° source signal AOA. Note the clear peak in the 35° test AOA. The actual angle is indicated by the vertical dashed line. The resolution of θ is 1°.

[0441] Covariance smoothing methods may be used. For example, the forward-backward method can be used. The forward-backward approach is implemented using equations 48 and 49, where R is an estimate of the modified covariance matrix and J is the M × M inverse identity matrix (transfer matrix).

number

number

[0442] The effective number of resolvable coherent tones is N ≤ 2M / 3 sources. For a 3-antenna array, up to 2 coherent tones are resolvable. This method can be used for a 3-antenna phased array in a phased antenna array receiver board. The method can be terminated at 7416.

[0443] As another example, spatial smoothing may be used. Spatial smoothing is a technique that involves dividing an array into multiple sub-arrays and averaging the results of the covariance matrices of the sub-arrays. As a result, the number of antenna array elements is effectively reduced.

[0444] A forward-backward spatial smoothing (FBSS) method, which combines spatial smoothing with a forward-backward approach, may also be used. This also reduces the number of antenna elements required. As yet another example, the Teplitz completion method may be used, which is suitable for NLA.

[0445] Variations of the MUSIC algorithm may be implemented. A derivative of the MUSIC algorithm called Root-MUSIC can be used for ULA to find the incident signal AOA without having to compute results for all potential angles. This reduces the computational power required. The reduction in computational complexity comes from not having to perform the processing of the MUSIC algorithm, which includes computing the MUSIC spectrum over a large set of θ values ​​and finding the resulting peaks.7412,7414

[0446] Another derivative, called Spectral-MUSIC, is a generalized version of Root-MUSIC that can be applied to any array configuration but is generally applied to broadband, non-coherent sources. Yet another derivative, called Smooth-MUSIC, refers to various methods of smoothing the covariance matrix of the MUSIC algorithm, which is applied between processes 7404 and 7406 in Figure 71.

[0447] Another derivative, called the CLEAN method, involves reconstructing a model of the source signal from a known array manifold once the source signal is identified in a given direction. This reconstructed signal model is then subtracted from the measured incident signal to remove the incident signal, thereby "cleaning" the measurement data of the unwanted source signal and allowing for the consideration of other sources.

[0448] One of the problems that arises when implementing the MUSIC algorithm on a non-ideal antenna array is that, in forward-backward covariance smoothing, two coherent sources can lead to erroneous position measurements. Standard array calibration techniques do not solve this because the covariance matrix itself leads to erroneous subspace separation. To counter this, a variation of the CLEAN method is performed on multiple coherent sources, which involves using the MUSIC algorithm to identify the source signals, using the CLEAN method to remove source signals one at a time using a calibrated array manifold, forcing the source signal positions to be changed to offsets (rather than the initially measured positions) and recalculating the AOA direction of the remaining signals, repeating processes 7404 and 7406 in Figure 71 to verify convergence to a new set of incident arrival angles if they are not the same as the original arrival angles, and optionally replacing process 7402 in Figure 71 with prior knowledge from the system. For example, while tracking the position of the source signal, it can be assumed that the AOA does not change significantly between subsequent readings.

[0449] Figure 76 shows an antenna selection system 7600, which includes an antenna 7602, a switch 7604, and a radio receiver 7606. The radio receiver 7606 selects one of the antennas to receive a signal via the switch 7604. The antenna selection system 7600 may be implemented in any of the systems disclosed herein. In one embodiment, the antenna selection system 7600 is implemented in a vehicle, and an access module disclosed herein controls the operation of the radio receiver 7606.

[0450] The antenna selection system 7600 is implemented in the PAK AOA system to enable BLE AOA data reception. A portion of the BLE radio packets received by one of the antennas 7602 contains a CW tone. The radio receiver 7606 samples the CW tone to provide an orthogonal analysis signal, which means two sine waves with a 90° phase difference called an in-phase signal and a quadrature-phase signal (I signal and Q signal). The I signal and Q signal are sampled simultaneously and combined to form a complex analysis sample r, where r = iI + Q, and i is an imaginary constant, i = √2. The received data is therefore sliced ​​into interleaved samples from each of the antennas in multiple iterations.

[0451] Figure 77 shows an exemplary reconstruction method for reconstructing IQ data. The interleaved data is interpolated to form a received data matrix r(t) for use in the MUSIC algorithm. The reconstruction method may be performed by any of the access modules disclosed herein. The signal reconstruction method may be initiated in 7700.

[0452] In step 7702, the Access module uses the arctangent function to convert the analysis IQ sample vector r into a phase angle vector Φ. In step 7704, the Access module creates a time vector t corresponding to the sample vector r, based on the data sampling rate.

[0453] At 7706, the access module discards samples acquired near the antenna switching time. At 7708, the access module unwraps each repeating portion of the data point with a step size of π. At 7710, the access module measures the mean gradient, which is the mean frequency of the sine wave.

[0454] In 7712, the access module repeats processes c and d for each antenna, which include a) finding the intercept of the first repeat of the sampled data, b) predicting the position of the next repeat of the sampled data, c) determining the average difference between the predicted position and the actual position measured, d) adding or subtracting 2π, and e) repeating the determination of the average difference and adding or subtracting 2π until the average difference is less than π, f) finding the average slope of all points that have already been aligned, and g) repeating process bg using the new slope for the next repeat of the signal.

[0455] In the 7714, the access module measures the standard deviation of the average gradient of each antenna.

[0456] In 7716, the access module checks which antenna may be misaligned by selecting antenna i based on equation 50 if the standard deviation exceeds a threshold.

number

[0457] In step 7718, the access module repeats steps 7712-7718 for the antenna selected in step 7716 until the low standard deviation or the maximum retry counter is exhausted.

[0458] In the 7720, the access module interpolates the straight line of a point on the original time vector t for each antenna m to reconstruct the phase angle vector Φ. m This is obtained. This can be based on the phase angle vector Φ determined in 7702.

[0459] In 7722, the access module uses equation 51 to determine the IQ sample vector r for each antenna m. m Recreate the original sample vector r, where g is the average magnitude of a valid subset of the original sample vector r. Following process 7722, the method may terminate in 7724.

number

[0460] In one embodiment, the above method is implemented in a vehicle access system and / or PAK system having a circularly polarized antenna, as disclosed herein. The signal is received by the circularly polarized antenna. IQ data is determined based on the received signal as described above, and the angle of arrival is determined using the MUSIC algorithm.

[0461] Figures 78A–C show a vehicle 7800 illustrating an example of the placement of sensor 7802, which may be implemented as part of any PAK system disclosed herein and may be connected to any access module disclosed herein. Figure 78C shows an example of bounce reflection and corresponding path of a signal transmitted from a key fob 7804 or other portable access device and detected by sensor 7802. In this example, sensor 7802 is positioned high and centrally in the vehicle 7800. Sensor 7802 may be positioned, for example, within the headliner 7803 of the vehicle 7800. Sensor 7802 is positioned to cause multiple bounce paths of the transmitted signal before it is received by sensor 7802. The key fob 7804 is shown low relative to the vehicle for illustrative purposes, but may be positioned higher.

[0462] Figures 79A-C show a vehicle 7900 illustrating another example of sensor 7902 placement. Figure 79C shows another example of bounce reflections and corresponding paths of a signal transmitted from a key fob 7904 or other portable access device and detected by sensor 7902. In this example, sensor 7902 is positioned low and centrally in vehicle 7900. Sensor 7902 can be positioned on the vehicle floor 7903 or center console 7905. Sensor 7902 is positioned to cause multiple bounce paths of the transmitted signal before it is received by sensor 7902. The key fob 7904 is shown low relative to the vehicle for illustrative purposes, but may be positioned higher.

[0463] Sensors 7802 and 7902 may be located within the vehicle's metal structure where there are few possible direct paths from the vehicle (i.e., it is unlikely that there is a line of sight between the key fobs 7804 and 7904 and sensors 7802 and 7902). Since the floor may include at least part of the metal structure, the metal structure may include a frame, a metal housing, a partially enclosed metal structure, a unibody structure, etc., which may be at least partially represented by a dashed line 7903. Although a single sensor is shown in each of Figures 78A-C and 79A-C, two or more sensors may be included in each vehicle. In one embodiment, each sensor includes two or more antennas, e.g., two or more antennas disclosed and / or referenced herein. In one embodiment, two sensors are included, and each sensor includes two antennas such that there are four antenna paths. In another embodiment, a single sensor is included, and the sensor includes three or more antennas. Although there may not be a direct line of sight between the key fob and the sensor, several to numerous signal paths exist between the key fob and the sensor, so a short, consistent distance between the key fob and the vehicle can be determined using the techniques disclosed herein. The distance information is used to determine whether to allow access to the vehicle.

[0464] In one embodiment, carrier phase-based ranging, such as using a MUSIC algorithm, is performed to determine the angle of arrival of signals transmitted by key fobs 7804, 7904. This may include eigenvalue decomposition. The distance between key fobs 7804, 7904 and vehicles 7800, 7900 is determined based on the angle of arrival. Access is permitted if key fobs 7804, 7904 are within a predetermined distance of vehicles 7800, 7900. While line-of-sight is unlikely, it is probable that the transmitted signals bounce multiple times and follow multiple paths to each sensor 7802, 7902. This allows the corresponding access module to determine whether key fobs 7804, 7904 are close to vehicles 7800, 7900. In addition to carrier phase-based ranging, multipath signal processing is performed. This may include time-of-flight signal processing, for example, as described above with respect to Figures 37, 52-56, and 62. For example, if key fobs 7804 and 7904 are within a predetermined distance of vehicles 7800 and 7900, the access module of vehicles 7800 and 7900 can unlock the doors of vehicles 7800 and 7900.

[0465] By forcing an indirect signal transmission path, exchanging a predetermined number of tones transmitted in close proximity, and finding eigenvalues, ranging along an indirect reflection path can be performed using BLE carrier phase-based ranging. Systems with a small number of sensors (called anchors) can be used by positioning the anchors so that the signal follows primarily indirect paths rather than direct line-of-sight paths.

[0466] In one embodiment, the RSSI of the transmitted signal is determined to determine whether the key fobs 7804, 7904 are inside or outside the vehicles 7800, 7900. If the key fobs 7804, 7904 are outside the vehicles, carrier phase-based ranging, including eigenvalue decomposition, is performed to determine whether the key fobs 7804, 7904 are within a predetermined distance of the vehicles 7800, 7900.

[0467] The foregoing description is essentially illustrative and is not intended to limit the Disclosure, its application, or its use. The broad teachings of this Disclosure can be implemented in various forms. Therefore, although this Disclosure includes certain examples, the true scope of this Disclosure should not be limited in this way, as other variations will become apparent upon consideration of the drawings, specification, and appended claims. It should be understood that one or more steps within a method may be performed in a different order (or simultaneously) without altering the principles of this Disclosure. Furthermore, although each embodiment is described above as having certain features, one or more of these features described in relation to any embodiment of this Disclosure may be implemented in any other embodiment and / or combined with features of any other embodiment, even if the combination is not explicitly described. In other words, the described embodiments are not mutually exclusive, and the substitution of one or more embodiments remains within the scope of this Disclosure.

[0468] Spatial and functional relationships between elements (e.g., between modules, between circuit elements, between semiconductor layers, etc.) are described using a variety of terms, including “connected,” “engaged,” “joined,” “adjacent,” “next to,” “above,” “below,” and “located.” When a relationship between a first and a second element is described in the above disclosure, unless it is explicitly stated to be “direct,” the relationship may be a direct relationship in which no other intervening elements are present between the first and second elements, or it may be an indirect relationship in which one or more intervening elements are present (spatially or functionally) between the first and second elements. As used herein, the phrase “at least one of A, B, and C” should be interpreted as meaning a logic (A or B or C) using a non-exclusive OR, and not as “at least one of A, at least one of B, and at least one of C.”

[0469] In drawings, the direction of an arrowhead generally indicates the flow of information (such as data or instructions) that is important to the drawing. For example, if elements A and B exchange various types of information, and the information sent from element A to element B is relevant to the drawing, the arrow may point from element A to element B. This one-way arrow does not mean that no other information is sent from element B to element A. Furthermore, regarding the information sent from element A to element B, element B may send an information request or an acknowledgment of information receipt to element A.

[0470] In this application, which includes the following definitions, the terms “module” or “controller” may be replaced with the term “circuit.” The term “module” means, part of, or may include, an application-specific integrated circuit (ASIC), a digital, analog, or analog / digital mixed discrete circuit, a digital, analog, or analog / digital mixed integrated circuit, a combinational logic circuit, a field-programmable gate array (FPGA), a processor circuit (shared, dedicated, or group) that executes code, a memory circuit (shared, dedicated, or group) that stores code executed by the processor circuit, other suitable hardware components that provide the described functionality, or some or all of the above in a system-on-a-chip, etc.

[0471] A module may include one or more interface circuits. In some examples, the interface circuits may include wired or wireless interfaces connected to a local area network (LAN), the internet, a wide area network (WAN), or a combination thereof. The functionality of any given module in this disclosure may be distributed among multiple modules connected via interface circuits. For example, multiple modules may enable load balancing. In a further example, a server module (also known as a remote or cloud module) may perform some functions on behalf of a client module.

[0472] The terms "code" used above may include software, firmware, and / or microcode, and may refer to programs, routines, functions, classes, data structures, and / or objects. The term "shared processor circuit" encompasses a single processor circuit that executes some or all of the code from multiple modules. The term "group processor circuit" encompasses a processor circuit that, in combination with additional processor circuits, executes some or all of the code from one or more modules. References to multiple processor circuits include multiple processor circuits on separate dies, multiple processor circuits on a single die, multiple cores in a single processor circuit, multiple threads in a single processor circuit, or a combination thereof. The term "shared memory circuit" encompasses a single memory circuit that stores some or all of the code from multiple modules. The term "group memory circuit" encompasses a memory circuit that, in combination with additional memory, stores some or all of the code from one or more modules.

[0473] The term "memory circuit" is a subset of the term "computer-readable medium." As used herein, the term "computer-readable medium" does not include transient electrical or electromagnetic signals propagating through a medium (such as on a carrier wave). Therefore, the term "computer-readable medium" can be considered as tangible and non-transient. Non-exclusive examples of non-transient, tangible computer-readable mediums include non-volatile memory circuits (such as flash memory circuits, erasable programmable read-only memory circuits, or mask read-only memory circuits), volatile memory circuits (such as SRAM circuits and DRAM circuits), magnetic storage media (such as analog or digital magnetic tape or hard disk drives), and optical storage media (such as CDs, DVDs, or Blu-ray discs).

[0474] The apparatus and methods described in this application may be partially or completely implemented by a dedicated computer created by configuring a general-purpose computer to perform one or more specific functions embodied in a computer program. The above-mentioned functional blocks, flowchart elements, and other elements serve as software specifications and can be converted into a computer program through the routine work of a skilled technician or programmer.

[0475] A computer program includes processor-executable instructions stored in at least one non-temporary, tangible, computer-readable medium. A computer program may also include, or depend upon, stored data. A computer program may also include a basic input / output system (BIOS) that interacts with the hardware of a dedicated computer, device drivers that interact with specific devices of the dedicated computer, one or more operating systems, user applications, background services, background applications, and the like.

[0476] Computer programs can include (i) descriptive text to be parsed, such as HTML (Hypertext Markup Language), XML (Extensible Markup Language), or JSON (JavaScript Object Notation), (ii) assembly code, (iii) object code generated from source code by a compiler, (iv) source code for execution by an interpreter, and (v) source code for compilation and execution by a just-in-time compiler. As just one example, source code can be written using the syntax of languages ​​including C, C++, C#, Objective-C, Swift, Haskell, Go, SQL, R, Lisp, Java®, Fortran, Perl, Pascal, Curl, OCaml, Javascript®, HTML5 (Hypertext Markup Language, 5th Revision), Ada, ASP (Active Server Pages), PHP (Hypertext Preprocessor), Scala, Eiffel, Smalltalk, Erlang, Ruby, Flash®, Visual Basic®, Lua, MATLAB, SIMULINK, and Python®.

[0477] None of the elements described in the claims are intended to be means-plus-function elements within the meaning of 112(f) of the United States Patent Act unless the element is expressly described using the phrase “means to do ~” or, in th...

Claims

1. A system for accessing a vehicle or for providing control over the operation of said vehicle, The vehicle is equipped with a first network device, a sniffer device, and a control module. The first network device is configured to transmit a first tone signal to a second network device and to receive a second tone signal from the second network device. The control module transmits communication information necessary to track or intercept communication between the first network device and the second network device to the sniffer device via the vehicle interface. The sniffer device is configured to receive the first tone signal and the second tone signal based on the communication information. The control module is configured to (i) determine the distance between the first network device and the second network device based on the phase difference of the first tone signal when it is transmitted from the first network device and when it is received by the second network device, and the phase difference of the second tone signal when it is transmitted from the second network device and when it is received by the first network device; (ii) determine the distance between the sniffer device and the second network device based on the phase difference of the first tone signal when it is transmitted from the first network device and when it is received by the sniffer device, and the phase difference of the second tone signal when it is transmitted from the second network device and when it is received by the sniffer device; and (iii) prevent at least one of access to the vehicle or control of the vehicle's operation based on at least one of the distance between the first network device and the second network device and the distance from the sniffer device to the second network device.

2. The control module determines a first time length for the first tone signal to travel from the first network device to the second network device based on the phase difference of the first tone signal when it is transmitted from the first network device and when it is received by the second network device, and the phase difference of the second tone signal when it is transmitted from the second network device and when it is received by the first network device. The system according to claim 1, wherein the distance between the first network device and the second network device is determined based on the first time length.

3. The control module determines a second time length to propagate from the second network device to the sniffer device based on the phase difference of the first tone signal when it is transmitted from the first network device and when it is received by the sniffer device, the phase difference of the second tone signal when it is transmitted from the second network device and when it is received by the sniffer device, and the first time length. The system according to claim 2, wherein the distance from the second network device to the sniffer device is determined based on the second time length.

4. The system according to claim 1, wherein the control module is configured to prevent at least one of access to the vehicle or control of the vehicle's operation based on the determined distance from the second network device to the sniffer device.

5. The control module is configured to detect range-extension relay attacks performed by an attack device to gain access to the vehicle or control of the vehicle's operation, based on the determined distance from the second network device to the sniffer device. The second tone signal is relayed by the attack device from the second network device to the vehicle and modified. The system according to claim 1, wherein the control module is configured to take action in response to detecting a range-extension type relay attack.

6. The first network device comprises a first antenna module having a plurality of polarization antennas, and transmits the first tone signal to the second network device via the first antenna module. The system according to claim 1, wherein the sniffer device comprises a second antenna module having a plurality of polarization antennas, and receives the first tone signal from the first network device and the second tone signal from the second network device via the second antenna module.

7. The system according to claim 6, wherein at least one of the plurality of polarization antennas of the first antenna module is not cross-polarized with at least one of the plurality of polarization antennas of the second antenna module.

8. The system according to claim 6, wherein at least one of the plurality of polarization antennas of the first antenna module is not cross-polarized with the antenna of the second network device.

9. The system according to claim 1, wherein the control module is configured to generate a difference in phase of the first tone signal between when it is transmitted by the first network device and when it is received by the sniffer device in natural logarithmic form, generate a difference in phase of the second tone signal between when it is transmitted by the second network device and when it is received by the sniffer device in natural logarithmic form, and estimate the distance from the second network device to the sniffer device based on the difference in phase of the first tone signal and the difference in phase of the second tone signal generated in natural logarithmic form.

10. The first tone signal and the second tone signal are exchanged at multiple frequencies, The system according to claim 1, wherein the distance from the second network device to the sniffer device is estimated based on the phase difference of the first tone signal and the phase difference of the second tone signal determined at multiple frequencies.

11. A method for accessing a vehicle or for providing control over the operation of said vehicle, The first network device mounted on the vehicle transmits a first tone signal to a second network device and receives a second tone signal from the second network device. The control module mounted on the vehicle transmits communication information necessary to track or intercept communication between the first network device and the second network device to a sniffer device mounted on the vehicle via the vehicle interface. The sniffer device receives the first tone signal and the second tone signal based on the communication information. A method comprising: (i) determining the distance between the first network device and the second network device based on the phase difference of the first tone signal when it is transmitted from the first network device and when it is received by the second network device, and the phase difference of the second tone signal when it is transmitted from the second network device and when it is received by the first network device; (ii) determining the distance between the sniffer device and the second network device based on the phase difference of the first tone signal when it is transmitted from the first network device and when it is received by the sniffer device, and the phase difference of the second tone signal when it is transmitted from the second network device and when it is received by the sniffer device; and (iii) preventing at least one of access to the vehicle or control of the vehicle's operation based on at least one of the distance between the first network device and the second network device and the distance from the sniffer device to the second network device.

Images