Wireless activation system, method and device

Description of equivalent WO 2004051593 A2

DESCRIPTION

WIRELESS ACTIVATION SYSTEM, METHOD AND DEVICE

The invention relates to a wireless activation system, apparatus for use therein, and a method of wireless activation, which may be used, for example, for remote control applications such as wireless activation and deactivation of a lock on a vehicle door, or for tagging a person, animal or object.

Keyless car entry systems, in which the proximity of the car owner with a key fob in his pocket is sufficient to unlock the car door, are becoming increasingly common-place. Such a system is illustrated in Figure 1 and uses two-way communication between the key fob 10 held by the car owner A and an in-car device 20. Typically, the in-car device generates a magnetic field M using a 125 kHz signal so that it is limited to a range of a few metres. The key fob detects the magnetic field M and then responds with a UHF code signal S, for example in the range 800-900 MHz. When the in-car device is satisfied that a valid code signal S has been received from the key fob, the in-car device unlocks the car door. Alternatively, UHF or microwave frequency bands could be used for both the car to key fob communication and the key fob to car communication.

Keyless car entry systems can be extended to "Keyless Go" systems in which it is not even necessary to insert a key into an ignition switch in order to start the car's engine. Instead the driver presses a button and the car engine starts only if the key fob is nearby.

Known keyless car entry systems are susceptible to what is known as the "relay attack". Relay attack is illustrated in Figure 2. A thief C close to the car uses first relay attack apparatus 30 to detect the magnetic field M around the car and to pass the parameters P of the magnetic field M to an accomplice B who is close to the owner A of the car. The accomplice B uses a second relay attack apparatus 40 to receive the parameters P of the magnetic field M and to generate a spurious magnetic field M' which mimics the magnetic field M generated by the in-car device 20. The owner's key fob 10 responds by transmitting the code signal S, even though the owner A may be many hundreds of metres away from the car. The second relay attack apparatus 40 relays the code signal S to the first relay attack apparatus 30, which in turn relays the code signal S to the in-car device 20. The in-car device 20 reacts to the code signal S by unlocking the car door, and the thief C is able to steal the car.

One method of mitigating against the relay attack is to measure the time of flight of the code signal S and to unlock the car door only if the time of flight measurement indicates that the key fob is very close to the car. However, practical schemes for measuring the time of flight result in an ambiguity such that, by inserting a delay in the code signal S relayed from the key fob to the in-car device, the key fob can be made to seem closer to the car than it actually is. Therefore even known protection systems are vulnerable to relay attack.

Tagging systems can also be vulnerable to relay attack. In such a system a person, animal or object is equipped with a transmitter device for transmitting a signal to a receiver device. The receiver device estimates the distance of the transmitter device and if the distance becomes larger than a predetermined value, or alternatively, depending on the application, smaller than a predetermined value, an alert is generated. By means of a relay attack, the receiver device can be deceived into making a false estimate of distance.

An object of the present invention is to make relay attack more difficult. According to a first aspect of the invention there is provided a wireless activation system comprising a first device having means for generating and transmitting a code signal, wherein each successive transmission of the code signal comprises a successive code sequence from a succession of code sequences, and a second device having means for generating the succession of code sequences in synchronism with the first device, means for receiving the code signal, means for detecting the successive code sequence transmitted by the first device, means for generating an indication of the time of flight of the code signal, and means for generating an activation signal in response to the combination of the detected successive code sequence corresponding to the successive code sequence generated most recently by the second device and the indication of the time of flight being within a predetermined range of values, wherein the succession of code sequences comprises code sequences of different time durations.

According to a second aspect of the invention there is provided a method of wireless activation comprising at a first device generating and transmitting a code signal, wherein each successive transmission of the code signal comprises a successive code sequence from a succession of codes, and at a second device generating the succession of code sequences in synchronism with the first device, receiving the code signal, detecting the successive code sequence transmitted by the first device, generating an indication of the time of flight of the code signal, and generating an activation signal in response to the combination of the detected successive code sequence corresponding to the successive code sequence generated most recently by the second device and the indication of the time of flight being within a predetermined range of values, wherein the succession of code sequences comprises code sequences of different time durations. According to a third aspect of the invention there is provided a transmitter device for use in a wireless activation system, comprising means for generating and transmitting a code signal wherein each successive transmission of the code signal comprises a successive code sequence from a succession of code sequences and wherein the succession of code sequences comprises code sequences of different time durations. The term "transmitter device" does not exclude the possibility of the device also including a receiver, but is merely used for convenience to denote a device that suitable for generating and transmitting the code signal.

According to a fourth aspect of the invention there is provided a receiver device for use in a wireless activation system, comprising means for generating a succession of code sequences, means for receiving a code signal, means for detecting a code sequence conveyed by the code signal, means for generating an indication of the time of flight of the code signal, and means for generating an activation signal in response to the combination of the detected code sequence corresponding to the code sequence generated most recently and the indication of the time of flight being within a predetermined range of values, wherein the succession of code sequences comprises code sequences having different time durations. The term "receiver device" does not exclude the possibility of the device also including a transmitter, but is merely used for convenience to denote a device that is suitable for receiving the code signal and, in response, generating the activation signal.

Each code signal comprises a number of identical code sequences. By using code sequences of different durations in different code signals, it becomes more difficult for relay attack apparatus to predict the duration of a transmitted code sequence, the code sequence is more difficult for the relay attack apparatus to detect, and the delay required to deceive the receiver device into being activated by a distant transmitter device is more difficult for the relay attack apparatus to calculate and insert in the relayed signal.

Code sequences of different durations may be implemented by using different numbers of symbols or chips in the code sequences, or by using different symbol or chip rates.

The invention will now be described, by way of example only of a keyless car entry system, with reference to the following drawings in which:

Figure 1 is a schematic diagram of a wireless activation system, Figure 2 is a signal flow diagram of a wireless activation system under relay attack,

Figure 3 is a block schematic diagram of a receiver device in accordance with the present invention for use in a wireless activation system,

Figure 4 is a block schematic diagram of a transmitter device in accordance with the present invention for use in a wireless activation system, and

Figure 5 illustrates a succession of code signals. First, an explanation is presented of how the ambiguity in the calculated time of flight arises. To illustrate this, we consider an example in which a code signal S_j j=1 ,N is a direct sequence spread spectrum signal having a chip rate of 1Mchip/s and in which the transmit power of the transmitter device is -20dBm in order to ensure a long battery life. In order to enable the receiver device to be simple, rather than transmit a single, long code sequence, each code signal S_j comprises a short code sequence m k=1 ,R repeated identically within the code signal Sj. For example, code signal Si can have a length of 10 chips corresponding to 10μs duration. In order to ensure reliable detection of the code signal S_j, the receiver device enables its receiver for a time window when the code signal S_j is expected to be received. In order to measure a distance of 10m to an accuracy of 1m using the power level of -20dBm, the receiver device typically needs to receive a signal of 1ms duration in order to average the noise sufficiently, so the duration of the receiver time window is chosen to be approximately 1ms. The precise time of arrival of the code signal S_j at the receiver device is uncertain due to the variable propagation distance of the code signal S_j, and to ensure that 1ms of signal is received when the receiver is enabled throughout the time window, the transmitted code signal Sj is longer than the time window, and comprises the code sequence m_k repeated for an overall duration of 2ms. The code signal Si with a constituent code sequence mi is illustrated in Figure 5.

A receiver device 200 suitable for use in an in-car device and adapted in accordance with the invention is illustrated in Figure 3. It comprises a transmitter (Tx) 220 coupled to an antenna 230 for radiating the magnetic field M and coupled to a processing means (μP) 210 such as a microprocessor for controlling generation of the magnetic field M. In addition there is a low noise amplifier (LNA) 110 for receiving the code signal si from an antenna 100. An output of the LNA 110 is coupled to a first input of a mixer 120 where it is down converted by being mixed with a local oscillator signal generated by a local oscillator source 130 and coupled to a second input of the mixer 120. An output of the mixer is coupled to an input of a low pass filter 140 and an output of the low pass filter 140 is coupled to an input of an analogue-to-digital converter (ADC) 150. An output of the ADC 150 is coupled to an input of a detector 160 for detecting the code signal Sj. The detector 160 comprises a buffer 165 for storing the part of the received code signal Sj received in the receiver time window and delivered from the output of the ADC 150. The detector 160 also comprises a cyclic register 167 for storing a reference code signal comprising identical concatenated code sequences m_k. An output from the buffer 165 and an output from the cyclic register 167 are coupled to respective inputs of a multiplier 168, an output of the multiplier 168 is coupled to an input of an integrator 166, and an output of the integrator 166 is coupled to an input of the processing means 210. In operation, correlation between the signal stored in the buffer 165 and the reference code signal stored in the cyclic register 167 is performed by multiplying these signals in the multiplier 168 and integrating the resulting product in the integrator 166, and repeating these steps for consecutive cyclic shifts of the reference code signal in the cyclic register 167. Due to the use of short code sequences m , a correlation peak occurs at the output of the integrator 166 within at most the number of cyclic shifts corresponding to the length of the code sequence m_k. The processing means 210 processes the correlation signal supplied to it by integrator 166 to identify the time of occurrence of the correlation peak and to estimate the time of flight of the code signal Sj. To enable the time of flight to be calculated the processing means 210 is coupled to a clock (CLK) 240. Signals detected by the detector 160 are used by the processing means 210 to adjust the clock 240 so that it is maintained in synchronism with the device transmitting the code signal (i.e. transmitter device 400 having a clock 440, described below in relation to Figure 4). From the time of flight the processing means 210 calculates the distance of the receiver device 200 from the key fob and if the distance is within a predetermined limit, generates an activation signal on an output 270 which is coupled to a car locking system (SYS) 300. The activation signal results in the car doors being unlocked.

Because the code signal Sj comprises identical concatenated code sequences m , a similar correlation peak is observed at the output of the detector 160 if the code signal Sj is delayed by a multiple of the code sequence m_k duration, so there is an ambiguity in the calculated time of flight of the code signal S_j. In the case of code sequence mi of duration 10μs, there is an ambiguity of n x 10μs, where n is an integer. This results in an ambiguity of n x 3km in the calculated propagation distance.

The ambiguity can be resolved by ensuring that the ambiguity is larger than any distance required to be measured and by subtracting units of the ambiguity distance away from the measured distance until a figure less than the ambiguity distance is obtained. For example, for a keyless car entry system, only distances up to about 20m need to be measured as the system does not need to operate over longer distances. If the key fob is further away than 3km, insufficient signal power will propagate to the vehicle to enable a distance measurement to be made. If the measurement using the code sequence mi yields a propagation distance of 3.01km, it can be readily concluded by subtracting the ambiguity distance of n x 3km that the key fob is 10m from the vehicle. However, under relay attack, the key fob may in reality be 3.01 km from the vehicle with the power level of the code signal boosted by the relay attack apparatus 30.

As another example, the key fob may be 1 km from the vehicle, at which distance the receiver device 200 should determine that it should not react to the code signal Si because the driver is too distant. However, a relay attack apparatus 30 or 40 could insert an additional delay of 6.7μs causing the receive device 200 to measure a distance of 3.01km and conclude, after allowing for ambiguity of n x 3km, that the key fob is only 10m from the vehicle, and therefore falsely allow access to the vehicle.

According to the invention, protection against relay attack is provided by arranging for the duration of the code sequence to vary. There is a predetermined set of code signals Sj, j=1 ,N, where each code signal S_j comprises a predetermined code sequence from the set of code sequences m_k, k=1 ,E. The code sequences m_k are chosen to have a low cross correlation. The number of different durations of the code sequences m , and the number of different values P of the code sequences m , may be less than N, i.e. the code sequences m_k need not be unique within the predetermined set of code signals S_j. The code signals S_j may be unique to a particular pair of transmitter device and receiver device, or the order in which the code signals Sj are transmitted may be unique to a particular pair of transmitter device and receiver device.

In the example embodiment, having transmitted a code signal si comprising a code sequence mi of length 10 chips, the next code signal transmitted will be s₂ and will comprise a code sequence m₂ of length 11 chips. By using code sequence m₂ the time ambiguity increases to 11μs and the distance ambiguity increases by 300m to n x 3.3km. Now if the key fob is 1 m from the vehicle and a relay attack apparatus 30 or 40 inserts an additional delay of 6.7μs, the receive device 200 will measure a distance of 3.01km and conclude, after allowing for ambiguity, that the key fob is 3.01km from the vehicle, and therefore not allow access to the vehicle. The next code signal to be transmitted will be s₃ and will comprise a code sequence m₃ of length 9 chips. By using code sequence m₃ the time ambiguity decreases to 9μs and the distance ambiguity decreases by 300m to n x 2.7km. Now if the key fob is 1 km from the vehicle and a relay attack apparatus 30 or 40 inserts an additional delay of 6.7μs, the receive device 200 will measure a distance of 3.01km and conclude, after allowing for ambiguity, that the key fob is 310m from the vehicle, and therefore not allow access to the vehicle. In this case, if the relay attack apparatus 30 or 40 is to succeed in deceiving the receive device 200 into concluding that the key fob was only 10m away, the relay attack apparatus 30 or 40 would need to insert an additional delay of 5.7μs. By varying the duration of the code sequences m_k, it becomes more difficult for the relay attack apparatus 30 or 40 to detect the code signal S_j and more difficult to estimate and implement the delay required to deceive the receiver device 200. In Figure 5, the code signals Si, s₂ and s₃ are illustrated, together with a generalised code signal S_j comprising code sequences m_k. Referring to Figure 4, there is shown a block schematic diagram of a transmitter device 400 in accordance with the invention and suitable for use in a key fob. It comprises receiver (Rx) 470 coupled to a receive antenna 480 for detecting the magnetic field M emitted by the in-car device. An output of the receiver 470 is coupled to an input of a control means (μC) 410, and an output of the control means 410 is coupled to an input of a transmitter (Tx) 420. On detection of the magnetic field M, the control means 410 initiates transmission of the code signal S_j by the transmitter 420 which is coupled to a transmit antenna 430. The code sequences m_k for transmission in the code signals Sj are supplied to the transmitter 420 from a look-up table (LUT) 460. The selection of code sequence from the LUT 460 for transmission is made by a modulo N counter 450 which is coupled to address the LUT 460. The modulo N counter 450 is clocked by a clock (CLK 440 and counts 0 to N-l cyclically. The duration of each code signal Sj is dependant on the duration of the code sequences m , and on the number of code sequences transmitted in each code signal S_j, which may be varied by the control means 410.

Referring again to Figure 3, in the receiving device 200 reference code sequences, identical to the code sequences m_k stored in the LUT 460 of the transmitter device 200, are stored in a look-up table (LUT) 260 which is coupled to the detector 160, and reference code sequences are supplied to the cyclic register 167 thereby forming the reference code signal.

The constituent elements of the detector 160 are adaptive to detect code sequences m_k of different durations, and the processing means 210 is adaptive to determine the time of flight for code sequences m_k of different durations.

The selection of reference code sequence from the LUT 260 for correlation is made by a modulo N counter 250 which is coupled to address the LUT 260. The modulo N counter 550 is clocked by the clock (CLK) 240 and counts 0 to N-l cyclically. The clock 240 is coupled to the processing means 210 and can be adjusted in response to the detection of the received code sequences m in order to synchronise the clock 240 with the corresponding clock 440 in the transmitting device 400. In this way, the choice of which code sequence m_k is transmitted and received is dependent respectively on the current value of the counter 450 of the transmitter device 400 and the counter 250 of the receiver device 200, and the decoder 160 is maintained in synchronism to correlate for the code sequence transmitted by the transmitter device 400.

Provision may be made in case the counters 450, 250 in the transmitter device 400 and receiver device 200 become non-synchronised, for example due to an extended period without communication. One way of coping with this situation is for the receiving device 200 to correlate for a range of code sequences, instead of for a single code sequence m_k, the range of code sequences corresponding to the degree of non-synchronism likely. In this way, it can be ensured that the receiving device 200 will react to the code sequence mostly recently transmitted by the transmitter device 400, even though the receiving device 200 may have a margin of uncertainty over which code sequence is a priori being transmitted.

Other methods of selecting the code sequence m may be used. For example, the next code sequence m_k in a predetermined succession of code sequences may be selected for each successive transmission of the code signal S_j. If this method is used, the transmitter device 400 and receiver device 200 can become non-synchronised if the transmitter device 400 transmits a code signal S_j that the receiving device 200 fails to receive, perhaps because of inadequate signal strength. To cope with this situation, the receiving device 200 may correlate for a range of code sequences, instead of for a single code sequence m_k, the range of code sequences corresponding to the degree of non-synchronism likely.

It is not essential for the duration of the code sequence in every successive code signal Sj to vary from the duration of the code sequence in the previously transmitted code signal, provided that the duration changes sufficiently frequently to make unauthorised detection difficult. For example, the duration of the code sequence may be changed after transmission of a predetermined number of code signals or after the elapse of a predetermined time period, the change being controlled in the transmitter device 400 by either the clock 440 or the control means 410, and in the receiving device by either the clock 240 or the processing means 210.

As a result of varying the duration of the code sequences, the duration of the code signal may vary proportionally. The number of repetitions of the code sequence within the code signal may be varied by the control means 410 to maintain an approximately constant duration of the code signal.

Similarly, the duration of the receiver time window may be varied proportionally with the varying duration of the code sequences, or alternatively the length of the buffer 165 and the cyclic register 167 may be adaptive to detect an approximately constant duration of code signal.

Although an embodiment has been described using direct sequence spread spectrum sequences, alternatively the code sequences may comprise frequency hopping sequences.

The invention is not limited to keyless car entry systems and to systems for tagging a person, animal or object, but may be used in other applications requiring wireless activation dependent on time of flight or propagation distance measurement.

In the present specification and claims the word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Further, the word "comprising" does not exclude the presence of other elements or steps than those listed.