BLE Passive Vehicle Access Using RSS Profiling Against Relay Attacks

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Passive vehicle access control systems are vulnerable to relay attacks, which exploit the proximity detection limitations of standard Passive Entry Systems (PES) using radio frequencies, allowing unauthorized access by amplifying and retransmitting signals.

Innovation Solution

A BLE passive vehicle access control system that modulates transmitted power levels to create a specific RSS profile, uses sensors like motion detectors and barometric pressure sensors to verify genuine proximity, and disables communication if the profile or sensor data does not match pre-defined secure patterns, thereby preventing relay attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Length of stationary object

If radio frequency signals are used for proximity detection and localization, then communication range is extended, but the system becomes vulnerable to relay attacks

Engineering Contradiction:
Improvecommunication rangeVSAvoidsecurity against relay attacks
Core Design Contradiction:
Length of stationary objectVSReliability

Solution Approach 1:

The system changes the parameter being measured from simple signal presence to signal power profile characteristics. By analyzing the temporal and spatial distribution of received signal strength (RSS) values across multiple measurements, the system creates a unique power profile that is difficult to replicate in relay attacks, thus maintaining security while using RF communication.

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

The system implements feedback by continuously monitoring RSS values and comparing them against expected patterns. The processor analyzes the feedback from multiple RSS measurements to determine whether the external device is genuinely nearby or being relayed, enabling dynamic security decisions based on real-time signal characteristics.

Inventive Principle:
Principle #23Feedback

2Measurement precision

If multiple antennas and optimal power control are used to satisfy proximity requirements, then localization accuracy is improved, but device complexity increases

Engineering Contradiction:
Improvelocalization accuracyVSAvoidantenna and power control system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system extracts the essential security information from the complex RF environment by focusing solely on RSS power measurements rather than implementing complex multi-antenna arrays. By taking out only the necessary measurement (RSS) and analyzing its temporal profile, the system achieves security without the complexity of multiple antennas and sophisticated power control mechanisms.

Inventive Principle:
Principle #2Taking out (Extraction)

3Ease of operation

If relay apparatus amplifies and retransmits signals, then unauthorized access is enabled, but signal power measurements become inconsistent

Engineering Contradiction:
Improveunauthorized access capabilityVSAvoidsignal power measurement consistency
Core Design Contradiction:
Ease of operationVSMeasurement precision

Solution Approach 1:

The system performs preliminary actions by taking multiple RSS measurements before making an access decision. By collecting a sequence of power readings and analyzing their temporal profile in advance, the system establishes a baseline of expected signal behavior that reveals inconsistencies introduced by relay apparatus, preventing unauthorized access before it can occur.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3583006B1Bluetooth low energy (BLE) passive vehicle access control system for defending the system against relay attacks and method thereof
Publication Date: 2024.03.27 ROBERT BOSCH GMBH
  • EP3583006B1 patent drawingFigure 1
  • EP3583006B1 patent drawingFigure 2A~2B
  • EP3583006B1 patent drawingFigure 3

AI summary

A Bluetooth Low-Energy (BLE) passive vehicle access control system integrated into a vehicle and an external device to defend the system against relay attacks is provided. The system includes at least one of a motion detector, a microprocessor, or a barometric pressure sensor. The motion detector is configured to detect and distinguish various types of motion and vibration. The motion detector is further configured to distinguish between a true motion event and a false motion event. The microprocessor comprises a set of computer executable instructions including a TX power profiling is capable of modulating the transmitted (TX) power level to create at a receiving end of a communication having link in the vehicle a RX power level (RSS) profile that serves as an authentication. The barometric pressure sensor is configured to measure barometric pressure which ultimately translates the measured barometric pressure into altitude value and distinguish the altitude value of the vehicle and of the external device is either matched or different.