Source: http://patents.com/us-6850148.html
Timestamp: 2019-09-22 04:38:53
Document Index: 465601688

Matched Legal Cases: ['art 23', 'art 23', 'art 33', 'art 33', 'art 23', 'art 33', 'art 23', 'art 33']

US Patent # 6,850,148. Passive entry with anti-theft function - Patents.com
United States Patent 6,850,148
Masudaya February 1, 2005
Inventors: Masudaya; Hideki (Miyagi-ken, JP)
Appl. No.: 10/184,401
Jun 29, 2001 [JP] 2001-198771
Current U.S. Class: 340/5.61 ; 340/5.72
Current International Class: B60R 25/00 (20060101); G07C 9/00 (20060101); H04B 001/00 ()
Field of Search: 340/5.61,5.62,5.64,5.72,10.1,10.2,10.6,426.25,426.13,426.35,828.69,825.72 307/10.4,10.5,10.2
5983347 November 1999 Schwegler et al.
6208239 March 2001 Knepper et al.
6577227 June 2003 Rohrl et al.
40 20 445 Jan., 1992 DE
1 004 726 May., 2000 EP
WO 01/25060 Apr., 2001 WO
In the example shown in FIG. 5, since the owner (not provided with a reference numeral) of a car 51 having a portable transmitter-receiver 52 is considerably distant from the car 51, the portable transmitter-receiver 52 is placed outside a reach range E.sub.L of a request signal from a car-mounted transmitter-receiver (not provided with a reference numeral) mounted on the car 51. On the other hand, since the car-mounted transmitter-receiver is placed outside a reach range of an answer signal from the portable transmitter-receiver 52, communication between the car-mounted transmitter-receiver and the portable transmitter-receiver 52 is impossible in this state.
In the example shown in FIG. 5, a first repeater 53.sub.1 and a second repeater 53.sub.2 intervene between the car-mounted transmitter-receiver (not provided with a reference numeral) mounted in the car 51 and the portable transmitter-receiver 52 distant from the car so that a request signal and an answer signal can be transmitted between the car-mounted transmitter-receiver and the portable transmitter-receiver 52. The first repeater 53.sub.1 is placed within a reach range E.sub.L of a low frequency carrier signal (request signal) transmitted by the car-mounted transmitter-receiver and the second relay 53.sub.2 is placed within a reach range E.sub.L of a low frequency carrier signal (request signal) transmitted by the portable transmitter-receiver 52. Upon receiving the low frequency carrier signal (request signal) from the car-mounted transmitter-receiver, the first repeater 53.sub.1 converts the low frequency carrier signal to a high frequency carrier signal to transmit the request signal to the second repeater 53.sub.2. Upon receiving the request signal transmitted by the high frequency carrier signal, the second repeater 53.sub.2 converts the high frequency carrier signal to a low frequency carrier signal and transmits the request signal to the portable transmitter-receiver 52 by the low frequency carrier signal so that the request signal is transmitted to the portable transmitter-receiver 52. On the other hand, upon receiving a high frequency carrier signal (answer signal) from the portable transmitter-receiver 52, the second repeater 53.sub.2 amplifies the received high frequency carrier signal and then transmits the answer signal to the first repeater 53.sub.1 by the high frequency carrier signal. Upon receiving the answer signal transmitted by the high frequency carrier signal, the first repeater 53.sub.1 amplifies the received high frequency carrier signal and then transmits the answer signal to the car-mounted transmitter-receiver by the high frequency carrier signal so that the answer signal is transmitted to the car-mounted transmitter-receiver.
In the existing passive entry, as shown in FIG. 5, if the repeaters 53.sub.1 and 53.sub.2 are used, since the reach range E.sub.L of the low frequency carrier signal (request signal), and in some cases, a reach range of the high frequency carrier signal (answer signal) can be substantially expanded, the owner of the car 51 carrying the portable transmitter-receiver 52 can unlock a car door even if he is considerably distant from the car 51. The above-described act is used to unlock a car door by malicious people without permission of a car owner and is called relay attack.
The existing passive entry has the risk of a car door being unlocked using the repeaters 53.sub.1 and 53.sub.2 by malicious people, that is, undergoing relay attack.
When these operations are performed, the controller 1 of the car-mounted transmitter-receiver 10 controls the timer 5 to count elapsed time T (T=T1+T2+T3+nT0+T4+T5) from time t1, which is the falling point of the wakeup signal, to time t8, which is the point of supplying the answer signal to the controller 1, and obtains the elapsed-time value. The controller 1 locks or unlocks a car door only when the elapsed-time value is within a valid elapsed-time value set in advance. As the valid elapsed-time value, a theoretical elapsed time T plus a slight margin time T.sub.y, usually 300 to 350 .mu.s, is used.
As shown in FIG. 3, in the case where relay attack is made, the passive entry comprises the car-mounted transmitter-receiver 10, the portable transmitter-receiver 20, and a first repeater 30.sub.1, and a second repeater 30.sub.2. In this case, the car-mounted transmitter-receiver 10 is identical with the car-mounted transmitter-receiver 10 shown in FIG. 1. The portable transmitter-receiver 20 is identical with the portable transmitter-receiver 20 shown in FIG. 1.
In the first repeater 30.sub.1, a low frequency signal receiver 21 is connected to a low frequency receiving antenna 25 at an input end thereof and to an input end of a frequency converting part 23 at an output end thereof. A high frequency signal transmitter 22 is connected to an output end of a high frequency signal amplifier 24 and an input end thereof and a high frequency transmitting antenna 26 at an output end thereof. The frequency converting part 23 is connected to a high frequency transmitting/receiving antenna 27 at an output end thereof, and the high frequency signal amplifier 24 is connected to the high frequency transmitting/receiving antenna 27 at an input end thereof. In the second repeater 30.sub.2, a low frequency signal transmitter 31 is connected to an output end of a frequency converting part 33 at an input end thereof and a low frequency transmitting antenna 35 at an output end thereof. A high frequency signal amplifier 32 is connected to a high frequency receiving antenna 36 at an input end thereof and a high frequency signal transmitter 34 at an output end thereof. The frequency converting part 33 is connected to a high frequency transmitting/receiving antenna 37 at an input end thereof and the high frequency signal transmitter 34 is connected to the high frequency transmitting/receiving antenna 37 at an output end thereof.
In FIG. 4, the first row (A) denotes a control signal supplied from the controller 1 to the low frequency signal transmitter 2 in the car-mounted transmitter-receiver 10; the second row (B), a low frequency carrier signal outputted from the low frequency signal transmitter 2 in the car-mounted transmitter-receiver 10; the third row (H), a low frequency carrier signal supplied from the low frequency signal transmitter 31 to the low frequency transmitting antenna 35 in the second repeater 30.sub.2 ; the fourth row (C), an activation signal supplied from the low frequency signal receiver 12 to the controller 11 in the portable transmitter-receiver 20; the fifth row (D), a low frequency carrier signal supplied from the low frequency signal receiver 12 to the controller 11 in the portable transmitter-receiver 20; the sixth row (E), low frequency data supplied from the low frequency signal receiver 12 to the controller 11 in the portable transmitter-receiver 20; the seventh row (F), a control signal supplied from the controller 11 to the high frequency signal transmitter 13 in the portable transmitter-receiver 20; the eighth row (K), an illegal control signal supplied from the high frequency signal transmitter 22 to the high frequency signal transmitter 26 in the first repeater 30.sub.1 ; the ninth row (G), a control signal supplied from the high frequency signal receiver 3 to the controller 1 in the car-mounted transmitter-receiver 10; and the tenth (L), a control signal supplied from the controller 1 to a controlled apparatus. (A) to (L) indicate signals in the positions of symbols A to L shown in FIG. 3.
In the car-mounted transmitter-receiver 10, at time t0, a control signal (wakeup signal) supplied from the controller 1 to the low frequency signal transmitter 2 rises {FIG. 4(A)}, and a low frequency carrier signal is outputted from the low frequency signal transmitter 2 {FIG. 4(B)} and transmitted from the low frequency transmitting antenna 7. Thereafter, upon receiving the low frequency carrier signal through the low frequency receiving antenna 25 in the low frequency signal receiver 21, the first repeater 30.sub.1 subjects the received low frequency carrier signal to frequency conversion to a high frequency carrier signal in the frequency converting part 23 and transmits the obtained high frequency carrier signal through the high frequency transmitting/receiving antenna 27. Upon receiving the high frequency carrier signal in the high frequency transmitting/receiving antenna 37, the second repeater 30.sub.2 subjects the received high frequency carrier signal to frequency conversion to a low frequency carrier signal in the frequency converting part 33 and supplies the obtained low frequency carrier signal to the low frequency signal transmitter 31.
In the second repeater 30.sub.2, at time t1, a low frequency carrier signal is outputted from the low frequency signal transmitter 31 {FIG. 4(H)} and transmitted through the low frequency transmitting antenna 35.
In the car-mounted transmitter-receiver 10, at time t4 at the elapse of the time T1 from time t2, a control signal supplied from the controller 1 to the low frequency signal transmitter 2 rises {FIG. 4(A)}, and at time t5 at the elapse of the short time T2 from time t4, a low frequency carrier signal (request signal) is outputted from the low frequency signal transmitter 2 {FIG. 4 (B)} and transmitted from the low frequency transmitting antenna 7. Thereafter, upon receiving the low frequency carrier signal (request signal) through the low frequency receiving antenna 25 in the low frequency signal receiver 21, the first repeater 30.sub.1 subjects the received low frequency carrier signal (request signal) to frequency conversion to a high frequency carrier signal in the frequency converting part 23 and transmits the obtained high frequency carrier signal (request signal) through the high frequency transmitting/receiving antenna 27. Upon receiving the high frequency carrier signal (request signal) in the high frequency transmitting/receiving antenna 37, the second repeater 30.sub.2 subjects the received high frequency carrier signal (request signal) to frequency conversion to a low frequency carrier signal (request signal) in the frequency converting part 33 and supplies the obtained low frequency carrier signal (request signal) to the low frequency signal transmitter 31.
In the second repeater 30.sub.2, at time t6 at the elapse of time T6 from time t5, an illegal low frequency carrier signal (illegal request signal) is outputted from the low frequency signal transmitter 31 {FIG. 4(H)} and transmitted from the low frequency transmitting antenna 35.
The time T6 is time required for signal processing and the like in the first repeater 30.sub.1 and the second repeater 30.sub.2 after the car-mounted transmitter-receiver 10 transmits the low frequency carrier signal (request signal) until the second repeater 30.sub.2 transmits the illegal low frequency carrier signal (illegal request signal).
At time t9 at the elapse of time T4 after the elapse of the time nT0 from the time t7, in response to the request signal, a control signal (answer signal) supplied from the control 11 to the high frequency signal transmitter 13 rises {FIG. 4(F)}. The high frequency signal transmitter 13 forms a high frequency carrier signal including the supplied answer signal and transmits it through the high frequency transmitting antenna 17. Thereafter, upon receiving the high frequency carrier signal (answer signal) through the high frequency receiving antenna 36, the second repeater 30.sub.2 amplifies the received high frequency carrier signal (answer signal) in the high frequency signal amplifier 32 and transmits the high frequency carrier signal (answer signal) by the high frequency signal transmitter 34 from the high frequency transmitting/receiving antenna 37. Upon receiving the high frequency carrier signal (answer signal) through the high frequency transmitting/receiving antenna 27, the first repeater 30.sub.1 supplies the received high frequency carrier signal (answer signal) to the high frequency signal transmitter 22 in the high frequency signal amplifier 24.
In the first repeater 30.sub.1, at time t10 at the elapse of a short time T7 from time t9, an illegal high frequency carrier signal (illegal answer signal) is outputted from the high frequency signal transmitter 22 {FIG. 4(K)} and transmitted from the high frequency transmitting antenna 36.
The time T7 is time required for signal processing and the like in the first repeater 30.sub.1 and the second repeater 30.sub.2 after the portable transmitter-receiver 20 transmits the high frequency carrier signal (answer signal) until the first repeater 30.sub.1 transmits the illegal low frequency carrier signal (illegal answer signal).
When these operations are performed, the controller 1 of the car-mounted transmitter-receiver 10 controls the timer 5 to count elapsed time T' (T'=T1+T2+T6+T3+T4+nT0+T7+T5) from time t2, which is the falling point of the wakeup signal, to time t12, which is the point of supplying the answer signal to the controller 1, and obtains the elapsed-time value. The elapsed time T' is compared with the elapsed time T (T=T1+nT0+T4+T5) obtained when no relay attack is made as shown in FIG. 2. The elapsed time T' is longer by time T.sub.N (T.sub.N =T6+T3+T7), which is usually about 200 .mu.sec. The elapsed-time value of the elapsed time T' obtained by the controller 1 exceeds the valid elapsed-time value set in advance.
Therefore, from the fact that the elapsed time T' exceeds the valid elapsed-time value, the controller 1 determines that the received answer signal is an illegal answer signal due to relay attack, and ignores all subsequently received signals not to generate control signals to the controlled apparatus {FIG. 4(L)}.
As has been described above, according to the passive entry of this embodiment, only when a request signal and an answer signal are legally transmitted directly between the car-mounted transmitter-receiver 10 and the portable transmitter-receiver 20, the car-mounted transmitter-receiver 10 locks or unlocks the car door; on the other hand, when the repeaters 30.sub.1 and 30.sub.2 intervene to transmit a request signal and an answer signal between the car-mounted transmitter-receiver 10 and the portable transmitter-receiver 20, control of a controlled apparatus such as car door locking and unlocking is not exercised by the car-mounted transmitter-receiver 10. As a result, car theft by relay attack can be prevented.
The controller 1, after counting an elapsed time T', determines whether an answer signal is legal or illegal. Alternatively, the controller 1 may discontinue subsequent processing at the moment when the timer 5 exceeds a valid elapsed-time value.
Previous Patent US 6,850,147 | Next Patent US 6,850,149