BLE Passive Vehicle Access Using RSS Profiling Against Relay Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Passive vehicle access control systems are vulnerable to relay attacks, which exploit the proximity detection limitations of standard Passive Entry Systems (PES) using radio frequencies, allowing unauthorized access by amplifying and retransmitting signals.
Innovation Solution
A BLE passive vehicle access control system that modulates transmitted power levels to create a specific RSS profile, uses sensors like motion detectors and barometric pressure sensors to verify genuine proximity, and disables communication if the profile or sensor data does not match pre-defined secure patterns, thereby preventing relay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Length of stationary object
If radio frequency signals are used for proximity detection and localization, then communication range is extended, but the system becomes vulnerable to relay attacks
Solution Approach 1:
The system changes the parameter being measured from simple signal presence to signal power profile characteristics. By analyzing the temporal and spatial distribution of received signal strength (RSS) values across multiple measurements, the system creates a unique power profile that is difficult to replicate in relay attacks, thus maintaining security while using RF communication.
Solution Approach 2:
The system implements feedback by continuously monitoring RSS values and comparing them against expected patterns. The processor analyzes the feedback from multiple RSS measurements to determine whether the external device is genuinely nearby or being relayed, enabling dynamic security decisions based on real-time signal characteristics.
2Measurement precision
If multiple antennas and optimal power control are used to satisfy proximity requirements, then localization accuracy is improved, but device complexity increases
Solution Approach 1:
The system extracts the essential security information from the complex RF environment by focusing solely on RSS power measurements rather than implementing complex multi-antenna arrays. By taking out only the necessary measurement (RSS) and analyzing its temporal profile, the system achieves security without the complexity of multiple antennas and sophisticated power control mechanisms.
3Ease of operation
If relay apparatus amplifies and retransmits signals, then unauthorized access is enabled, but signal power measurements become inconsistent
Solution Approach 1:
The system performs preliminary actions by taking multiple RSS measurements before making an access decision. By collecting a sequence of power readings and analyzing their temporal profile in advance, the system establishes a baseline of expected signal behavior that reveals inconsistencies introduced by relay apparatus, preventing unauthorized access before it can occur.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
A Bluetooth Low-Energy (BLE) passive vehicle access control system integrated into a vehicle and an external device to defend the system against relay attacks is provided. The system includes at least one of a motion detector, a microprocessor, or a barometric pressure sensor. The motion detector is configured to detect and distinguish various types of motion and vibration. The motion detector is further configured to distinguish between a true motion event and a false motion event. The microprocessor comprises a set of computer executable instructions including a TX power profiling is capable of modulating the transmitted (TX) power level to create at a receiving end of a communication having link in the vehicle a RX power level (RSS) profile that serves as an authentication. The barometric pressure sensor is configured to measure barometric pressure which ultimately translates the measured barometric pressure into altitude value and distinguish the altitude value of the vehicle and of the external device is either matched or different.