Method for estimating a distance and electronic unit for a vehicle

The invention relates to a method for estimating a distance (d) between a vehicle (10) fitted with a first wireless communication module (12) and an identifier (20) fitted with a second wireless communication module (22), including the following steps: generating a randomly ordered list; receiving, by at least one of the first and second wireless communication modules (12, 22), electromagnetic signals having a frequency that changes consecutively from among a plurality of frequencies in accordance with said list; for each frequency in the plurality of frequencies, measuring a reception phase of the electromagnetic signal having the relevant frequency; estimating said distance (d) on the basis of the measured phases. An electronic unit (11) for a vehicle (10) is also described.

TECHNICAL FIELD OF THE INVENTION

The present invention relates to estimating a distance between an identifier and a vehicle.

The invention more particularly relates to a method for estimating a distance and to an electronic unit for a vehicle.

The invention is particularly advantageously applicable to the case in which it is desired to protect the vehicle from relay attacks.

TECHNOLOGICAL BACKGROUND

PEPS (passive entry/passive start) systems are known in which the implementation of a function (such as unlocking the doors of a vehicle or starting such a vehicle) is conditional upon the presence of an identifier (generally carried by the user of the vehicle) in proximity to the vehicle.

Document US 2003/090 365 proposes measuring phases of reception of electromagnetic signals exchanged between the identifier and the vehicle for two different frequencies of the electromagnetic signals.

The distance separating the identifier and the vehicle may then be estimated on the basis of the difference between the measured phases.

SUBJECT MATTER OF THE INVENTION

In this context, the present invention provides a method for estimating a distance separating a vehicle provided with a first wireless communication module and an identifier provided with a second wireless communication module, comprising the following steps:generating a randomly ordered list;receiving, by at least one of the first and second wireless communication modules, electromagnetic signals having a frequency varying successively between a plurality of frequencies according to said list (in the order indicated in this list);for each frequency from the plurality of frequencies, measuring a phase of reception of the electromagnetic signal having the frequency in question;estimating said distance on the basis of the measured phases.

The frequency of the electromagnetic signals used to estimate the distance thus varies unpredictably and a relay attack such as described below with reference toFIG. 3will therefore be ineffective.

According to features that are optional, and therefore nonlimiting:the method comprises a step of transmitting descriptive data of the list between the first wireless communication module and the second wireless communication module;the method comprises a step of encrypting the descriptive data of the list;the descriptive data of the list are transmitted under encryption between the first wireless communication module and the second wireless communication module;the method comprises a step of transmitting, by the other of the first and second wireless communication modules, said electromagnetic signals having a frequency varying successively between the plurality of frequencies according to said list;the step of estimating said distance comprises a step of determining a slope of a regression line linked to points that are each defined by a frequency from the plurality of frequencies and the associated measured phase;the reception step is implemented by the first wireless communication module.

The estimation method may further comprise one or more of the following steps:transmitting, by the first wireless communication module, electromagnetic signals having a frequency varying successively between the plurality of frequencies;receiving, by the second wireless communication module, electromagnetic signals having a frequency varying successively between the plurality of frequencies;for each frequency from the plurality of frequencies, measuring, at the second wireless communication module, a second phase of a received electromagnetic signal having the frequency in question;transmitting the second measured phases from the second wireless communication module to the first wireless communication module.

The transmitted second phases may then be used in the step of estimating said distance.

The aforementioned method may further comprise a step of potentially implementing a function of the vehicle according to the estimated distance.

The invention also provides an electronic unit for a vehicle, comprising:an element designed to generate a randomly ordered list;an element designed to control the reception (by a wireless communication module fitted to the vehicle), from an identifier, of electromagnetic signals having a frequency varying successively between a plurality of frequencies according to said list;an element designed to measure, for each frequency from the plurality of frequencies, a phase of reception of the electromagnetic signal having the frequency in question;an element designed to estimate a distance separating the vehicle and the identifier on the basis of the measured phases.

Such an electronic unit may also have at least one of the optional features presented above for the method.

When the electronic unit is produced on the basis of a microprocessor and at least one memory (such as described below), at least some of the aforementioned elements may be implemented by means of instructions stored in said memory and designed to carry out the function of the element in question when these instructions are run by the microprocessor.

FIG. 1schematically shows the main elements of a system in which the invention is able to be implemented.

Such a system comprises a vehicle10, here an automotive vehicle, and an identifier20, for example a key or badge for accessing the vehicle10(or, as a variant, a user terminal, such as a mobile telephone or a smartphone, provided with access rights to the vehicle10).

The vehicle10is provided with an electronic control unit11and with a communication module12.

The electronic control unit11comprises, for example, a microprocessor and at least one memory, for example a rewritable non-volatile memory. The memory stores, in particular, program instructions that allow, when they are run by the microprocessor, the electronic control unit11to implement the methods described below. The memory also stores values or parameters used in these methods, for example measured phase cl values (as explained below).

The memory of the electronic control unit11additionally stores a cryptographic key K (which has for example been written into the electronic control unit11during the manufacture thereof).

As a variant, the electronic control unit11could be embodied in the form of an application-specific integrated circuit (or ASIC).

The communication module12is designed to establish a wireless link with other electronic devices, in this case a link of Bluetooth Low Energy (or BLE) type. The communication module12is therefore in particular designed to transmit and receive electromagnetic signals (typically with a frequency higher than 1 MHz, or even 500 MHz), in this case in the 2.4 GHz band.

The identifier20is generally carried by a user of the vehicle10, and makes it possible to control certain functions of the vehicle10(for example unlocking the doors of the vehicle10), in particular when it is brought close to the vehicle10. The identifier20may potentially further include control buttons, by way of which the user is able to control at least some of the aforementioned functions or other functions of the vehicle10.

The identifier20comprises a control unit21and a communication module22.

The control unit21is, for example, embodied by means of a microprocessor and at least one memory, for example a rewritable non-volatile memory. The memory stores, in particular, program instructions that allow, when they are run by the microprocessor, the control unit21to implement the methods described below. The memory also stores values or parameters used in these methods.

The memory of the control unit21also additionally stores the cryptographic key K. In the case in which the identifier20is a badge (or key) for accessing the vehicle, the cryptographic key K has for example been written into the memory of the control unit21during the manufacture of the identifier20. In the variant mentioned above in which the identifier20is a user terminal, the cryptographic key K has for example been received from a remote server and stored during a phase of registration for a service for controlling vehicle functions by means of the user terminal.

As a variant, the control unit21could be embodied in the form of an application-specific integrated circuit.

The communication module22is designed to establish a wireless link (in this case of Bluetooth Low Energy or BLE type) with other electronic devices, in particular with the electronic control unit11of the vehicle10via the communication module12mentioned above. The communication module22is therefore also designed to transmit and receive electromagnetic signals (typically with a frequency higher than 1 MHz, or even 500 MHz), in this case in the 2.4 GHz band.

By virtue of the wireless link thus established between the communication module12of the vehicle10and the communication module22of the identifier20, data are able to be exchanged between the electronic control unit11of the vehicle10and the control unit21of the identifier20, as explained below.

The electromagnetic signals exchanged between the communication modules12,22may additionally be used to evaluate the distance d separating the identifier20and the vehicle10, on the basis of the principle now explained with reference toFIG. 2.

Specifically,FIG. 2schematically shows the propagation of two signals having respective frequencies f1, f2(which differ from one another) between a transmitter module TX and a receiver module RX (and along an axis Ox passing through these two modules).

Measuring the phase ϕiof each of these signals at the receiver RX makes it possible to deduce the distance d separating the transmitter module TX and the receiver module RX according to the formula:
d=c·(ϕ2−ϕ1)/[2π·(f2−f1)],

where c is the speed of the electromagnetic waves.

It is possible to take such phase ϕimeasurements for more than two signals having distinct frequencies fi, which makes it possible to overcome the reflection or refraction phenomena that are liable to occur at certain frequencies.

FIG. 3illustrates how a system operating on such a principle could be subject to an advanced relay attack.

A first attacker A is located in proximity to the vehicle10(specifically at a distance d1from the vehicle10) and carries a first electronic module30which receives the signal transmitted by the vehicle10at a frequency fi(it is assumed here that the transmitter module TX is the communication module12of the vehicle10).

The first electronic module30modulates the received signal by means of a carrier of frequency fPand transmits the obtained modulated signal to a second electronic module40carried by an attacker B located in proximity to the identifier20.

As can be seen inFIG. 3, the electronic modules30,40are separated by a distance d2, while the second electronic module40is at a distance d3from the identifier20.

The second electronic module40demodulates the signal that it receives and hence obtains the signal of frequency fi, which it transmits to the identifier20.

The value of the phase φ corresponding to the propagation of the electromagnetic signals from the vehicle10to the identifier20via the attackers A, B is:
φ=2π·(fP−fi)·d2/c+2π·fi·(d1+d3)/c

Consequently, if the attackers know the successive frequencies of transmission fiand design the electronic modules30,40so that the quantity (fP−fi) is constant (i.e. that the frequency fPof the carrier is modified for each transmission frequency fiso as to have: fP−fi=cte), the attack will go unnoticed since the distance estimate proposed above gives in this case:
d=c·[φ(f2)−φ(f1)]/[2π·(f2−f1)]=d1+d3.

Stated otherwise, since the quantity (fP−fi) is constant, the term 2π·(fP−fi)·d2/c is also constant from one measurement to the next and is cancelled out when differencing between the measured phases φ(f2), φ(f1).

A method for estimating the distance d which is not subject to such an attack is now described with reference toFIG. 4.

This method begins with step E2, in which the electronic control unit11of the vehicle10generates a list of randomly ordered frequencies fi.

In practice, the electronic control unit11stores for example a set of predefined frequencies f1, f2, . . . , fN(where N is for example comprised between 50 and 100) and generates, by random sampling, an ordered list of indices i(1), i(2), . . . , i(N): the list of randomly ordered frequencies is then fi(1), fi(2), . . . , fi(N).

The electronic control unit11then encrypts, in a step E4, descriptive data D of the ordered list by means of a cryptographic encryption algorithm using the cryptographic key K.

The descriptive data D of the ordered list represent for example the successive values of the frequencies fi, in the order given by the ordered list generated in step E2. In the example given above, the descriptive data D of the ordered list may, as a variant, represent the list of indices i(1), i(2), . . . , i(N).

The electronic control unit11then orders the communication module12to transmit the encrypted descriptive data [D]K(step E6).

The communication module12thus transmits (step E8) the encrypted descriptive data [D]Kvia the wireless link established between the communication module12of the vehicle10and the communication module22of the identifier20.

It should be noted that it is possible to envisage, when establishing the wireless link or after the establishment thereof, a process of authenticating the identifier20by the electronic control unit11of the vehicle10, for example by checking (potentially by means of a challenge-response protocol) that the identifier20does indeed hold access rights to the vehicle10(i.e. in practice that the identifier20stores a given cryptographic key, for example the aforementioned cryptographic key K).

The communication module22of the identifier20receives the encrypted descriptive data [D]Kin step E10and transmits these data [D]Kto the control unit21(step E12).

The control unit21may thus decrypt, in step E14, the encrypted descriptive data [D]Kby means of a decryption algorithm using the cryptographic key K (stored as already mentioned in the control unit21).

As mentioned above, the use of a symmetric key encryption system is proposed in the example described here. However, as a variant, it would be possible to use an encryption system in which the encryption key and the decryption key are different, for example a system using a public key (used for encryption) and a private key (used for decryption).

The control unit21is thus able to store, in step E15, the list of randomly ordered frequencies indicated by the descriptive data D. In the exemplary implementation described above, it is possible to envisage the control unit21storing the set of predefined frequencies f1, f2, . . . , fN(which is identical to that stored in the electronic control unit11) and the control unit21then storing in practice, in step E15, the ordered list of indices i(1), i(2), . . . , i(N) defined by the descriptive data.

In the example described here, the ordered list of frequencies is generated randomly at the vehicle10(specifically by the electronic control unit11) and transmitted to the identifier20so that knowledge of this list is shared by these two entities. It is possible to envisage, as a variant, this ordered list of frequencies being generated at the identifier20and transmitted, for example in encrypted form, to the vehicle10, which also allows knowledge of the list to be shared.

The control unit21of the identifier20then orders (step E16) the communication module22to transmit electromagnetic signals successively having the frequencies filisted in the ordered list of frequencies.

For example, step E18ofFIG. 4shows an electromagnetic signal having a frequency fi(1)being transmitted by the communication module22of the identifier20.

This electromagnetic signal having a frequency fi(1)is received by the communication module12of the vehicle10in step E20, which makes it possible to obtain a measurement of the phase ϕi(1)of the received electromagnetic signal. Reference may be made in this regard to document U.S. Pat. No. 5,220,332.

The measured phase ϕi(1)is received by the electronic control unit11and stored in step E22.

Steps similar to steps E18to E22are carried out for each of the frequencies in the ordered frequency list, in the order established by this list.

FIG. 4also shows the transmission, by the communication module22, of an electromagnetic signal having a frequency fi(N)(last frequency in the ordered list in the described example) in step E24.

This electromagnetic signal having a frequency fi(N)is received by the communication module12of the vehicle10in step E26, which makes it possible to obtain a measurement of the phase ϕi(N)of the received electromagnetic signal.

The measured phase ϕi(N)is received by the electronic control unit11and stored in step E28.

The electronic control unit11thus stores the measured phases ϕifor a plurality of frequencies fi(regardless of the order in which these measurements have been taken) and may deduce therefrom in step E30an estimate of the distance d separating the identifier20and the vehicle10.

For example, by accounting for the fact that the various points of coordinates (fi, ϕi) are in theory located on a straight line having a slope c/(2π·d) according to the distance estimation principle recalled with reference toFIG. 2, step E30comprises for example determining the slope of a regression line linked to the points of coordinates (fi, ϕi) and determining the estimated distance according to this slope.

The electronic control unit11of the vehicle10may then potentially control, in step E32, a function of the vehicle10according to the estimated distance. For example, the electronic control unit11may control the unlocking of the doors of the vehicle10if the estimated distance is below a predetermined threshold.

In the example described above, the electromagnetic signals (successively having the frequencies fiin the order indicated in the ordered list of frequencies) are transmitted by the communication module22of the identifier20.

As a variant, these electromagnetic signals could be transmitted by the communication module12of the vehicle10; the reception phases ϕiwould then be measured at the communication module22. The measured phases ϕiassociated with each frequency ficould then be transmitted (via the wireless link established between the communication modules12,22, potentially in encrypted form) to the electronic control unit11for estimating the distance d (as in step E30described above); the measured phases ϕicould also be used within the identifier20to estimate the distance d (according to the principle recalled above), in which case the distance d estimated within the identifier20is transmitted to the electronic control unit11via the wireless link established between the communication modules12,22(potentially in encrypted form).

According to yet another variant, electromagnetic signals successively having the frequencies fi(in the order indicated by the randomly ordered list) are transmitted by the communication module22of the identifier20and a phase ϕimeasurement is taken at the vehicle10as described above with reference to FIG.4. Furthermore, electromagnetic signals successively having the frequencies fi(in the order indicated by the randomly ordered list, or in another randomly defined order as explained above) are transmitted by the communication module12of the vehicle10and a phase ϕ′imeasurement is taken at the identifier20.

The phase ϕ′ivalues measured at the identifier20are transmitted to the electronic control unit11via the wireless link established between the communication modules12,22.

According to this variant, the electronic control unit11determines, for each frequency fi, the sum of the corresponding phase ϕimeasured at the vehicle10and of the corresponding phase ϕ′imeasured at the identifier20, and estimates the distance d separating the identifier20and the vehicle10on the basis of these sums (which are each associated with a frequency fi).

Such sums effectively corresponds to a return journey of the electromagnetic signal, i.e. to a distance equal to 2·d, and make it possible to overcome the difference in phase reference which may exist between the two communication modules12,22, as explained for example in document U.S. Pat. No. 5,220,332.

Specifically, the process of exchanging the signals and measuring the reception phases is then as follows for a given frequency f:transmitting, by a first module (for example the communication module12), an electromagnetic signal having this given frequency f with a reference phase ϕref;receiving the signal by the second module (here the communication module22) with an (absolute) phase ϕ′abs=ϕref+2*π*d*f/c;measuring this phase by the second module using its own reference phase ϕ′ref, the value of the measured phase therefore being:
ϕ′=ϕ′abs−ϕ′ref=ϕref+2*π*d*f/c−ϕ′ref;transmitting, by the second module, an electromagnetic signal having this same given frequency f with its own reference phase ϕ′ref;receiving, by the first module, this electromagnetic signal with an (absolute) phase ϕabs=ϕ′ref+2*π*d*f/c;measuring this phase by the first module using its reference phase ϕ′ref, which gives a measured phase:
ϕ=ϕabs−ϕref=ϕ′ref+2*π*d*f/c−ϕref.

The value of the sum (ϕ+ϕ′) of the measured phases is: 2*(2*π)*d*f/c and the phase offset between the two modules12,22is thus overcome.

In another possible embodiment, the reception of measured phases, the calculation of the aforementioned sums and the estimation of the distance on the basis of these sums could be carried out by the control unit21of the identifier20(the estimated distance could then potentially be transmitted from the control unit21to the electronic control unit11of the vehicle10via the established wireless link).

In all cases, the order in which the various frequencies fiare used for the transmitted signals is random so that an attacker will not be able to predict this order and match the frequency of the carrier fpto the frequency fiof the transmitted signal (as explained above with reference toFIG. 3). The attackers will therefore not be able to implement the attack described above with reference toFIG. 3.