Patent Description:
An electronic control key, or "key fob," is a keyless entry remote device which may be used to perform one or more authorized functions, such as locking or unlocking doors or the like for controlling access to vehicles or other controlled locations (e.g., hotel rooms, apartments, buildings, secure areas, etc.), opening a trunk, activating an alarm, starting an engine, etc. Modern electronic control keys may include wireless communication technology, such as <NUM>, Wi-Fi, Bluetooth, Bluetooth Low Energy (BLE), etc., for communicating with a corresponding access control system or the like at the vehicle or other secure location. The electronic control key and the access control system may include additional wireless technologies, such as ultra-wide band (UWB) or the like, for performing secure distance measurements such as proximity determinations between the electronic control key and the access control system. A UWB device, for example, may be used to determine when the electronic control key is within a predetermined threshold distance to facilitate access or other control decisions. The electronic control key typically includes a battery that provides power to the wireless communication devices. The term "electronic control key" as used herein contemplates many different configurations of electronic control devices, including conventional vehicle key fob devices and various other electronic Smart Device configurations, such as SmartFOBs, Smart cards, Smart watches, mobile or cellular phones, etc..

When the battery of the electronic control key is dead or otherwise disconnected, the battery-powered primary communication circuitry of the electronic control key may be disabled or otherwise unavailable. For this reason, electronic control keys may include backup communication circuitry remotely powered and controlled. The backup communication circuitry may be independent and secure so that it independently performs the same functions and applications of the primary communication circuitry including secure cryptographic and key store functions. An inductive element may be provided on the electronic control key that inductively links with the access control system to establish an inductive power and communication link. Existing automotive systems, for example, may use low frequency (LF) technologies in which the cable length to the central base station is critical, or may use near-field communication (NFC) technologies in which the reader electronics are integrated into each coupling device.

There are several security issues with current and proposed backup communication circuitry of electronic control keys and the like. A secure distance check (distance measurement) is typically performed during normal battery-powered operation to ensure that an authorized electronic control key is within a predetermined security distance threshold, in which the secure distance measurement typically requires active communication and thus needs the battery supply. The backup communication circuitry, however, does not use the battery and thus may not be configured to perform the secure distance test. This backup vulnerability can be used by an attacker or a hacker as a backdoor access method to avoid or otherwise bypass the secure distance check. The hacker uses the backup vulnerability to perform a forced backup mode attack to avoid the secure distance check. As an example, the hacker has equipment that performs a relay attack while the authorized electronic control key is outside the secure distance threshold.

<CIT> discloses a communication gateway which establishes a Bluetooth low energy connection with a portable device. A localization module which determines a portable device location based on two-way ranging and a passive entry/passive start (PEPS) system which can perform vehicle functions, based on the portable device location. Also disclosed is a system that includes at least one low frequency (LF) antenna configured to transmit a wireless charging ping signal within a predetermined range to a portable device configured for wireless charging, the communication gateway authenticates the portable device based on a response to the ping signal by the portable device. Vehicle functions are performed in response to authenticating the portable device.

<CIT> discloses a way of authenticating users using biometric devices. The biometric device may be arranged to capture one or more biometric features that correspond to an electrocardiogram of the user. When the user is authenticated, the biometric device may be preauthorized for the user. If the preauthorized biometric device is removed from the user, the biometric device is deauthorized. <CIT> discloses an authentication system including a plurality of portable devices and a base station, if the portable device is operated by an internal battery, ID data encrypted at a higher level are exchanged (normal mode), and if the portable device is operated by electromagnetic induction coupling with the base station, ID data encrypted at a lower level are exchanged (backup mode). These two communication modes are performed in the same communication device. At the time of initiating communication, the portable device transmits a signal in the normal mode as first communication. If there is no response from the portable device, the portable device refers to the storing portion, and only if there is a portable device insufficient in voltage, the base station shifts communication in the backup mode. The document "<NPL>, discloses a system description of the communications interface of a QI wireless power transfer system. Section <NUM>. <NUM> of the document outlines the various reasons for terminating the power transfer process.

In a first aspect, there is provided an electronic control key, comprising: an inductive link; an inductive system configured to receive power and enable communications via the inductive link; and security check circuitry coupled to the inductive system and configured to perform at least one security check to determine whether to enable authorized functions.

The security check circuitry comprises: battery status circuitry configured to indicate a status of a battery; and distance measurement circuitry configured to perform a secure distance check by a distance measurement between the electronic control key and an access system; and the inductive system invokes the distance measurement circuitry to perform the secure distance check when the battery status is good and enables authorized functions only when the secure distance check passes.

In one or more embodiments, the distance measurement circuitry may comprise a wireless ultra-wideband communication circuit.

In one or more embodiments, the security check circuitry may comprises a motion detector; and the inductive system may monitor the motion detector to perform a motion inquiry and may enable the authorized functions when the motion inquiry passes. In one or more embodiments, the motion inquiry may comprise detected motion of the electronic control key. In one or more embodiments, the motion inquiry may comprise comparing detected motion detected by the motion detector with a predetermined characteristic movement of the electronic control key. In one or more embodiments, the motion inquiry may comprise comparing motion of the electronic control key with a programmed motion pattern.

In one or more embodiments, the security check circuitry may comprise a button, and the inductive system may enable the authorized functions only when the button is pressed.

In one or more embodiments, the security check circuitry may comprise battery status circuitry that indicates a status of a battery, distance measurement circuitry that can perform a secure distance check, and a button, wherein the inductive system may invoke the distance measurement circuitry to perform the secure distance check when the battery status is good, and wherein the inductive system only enables authorized functions when both the secure distance check passes and the button is pressed.

In one or more embodiments, the security check circuitry may comprise a button and a motion detector, wherein the inductive system may monitor the motion detector to perform a motion inquiry, and wherein the inductive system only enables authorized functions when the motion inquiry passes and the button is pressed.

In a second aspect, there is provided an electronic control key system comprising an electronic control key according to the present disclosure, and an access system, comprising inductive power and communication circuitry that can inductively couple to the inductive system of the electronic control key via the inductive link when the inductive link is within a predetermined coupling zone distance of the inductive power and communication circuitry.

In one or more embodiments, the security check circuitry may comprise battery status circuitry that indicates a status of a battery of the electronic control key, and distance measurement circuitry that can perform a secure distance check between the electronic control key and the access system, and the inductive system may invoke the distance measurement circuitry to perform the secure distance check when the battery status is good and enables authorized functions only when the secure distance check passes.

In one or more embodiments, the security check circuitry may comprise a motion detector, and the inductive system may monitor the motion detector to perform a motion inquiry and enables the authorized functions only when the motion inquiry passes. In one or more embodiments, the motion inquiry may comprise detected motion of the electronic control key. In one or more embodiments, the motion inquiry may comprise comparing motion of the electronic control key with a programmed motion pattern.

In a second aspect, there is provided a method of operating an electronic control key having a battery and an inductive link, comprising: receiving power and establishing communications via the inductive link; performing by a security check circuitry, at least one security check by a distance measurement between the electronic control key and an access system; and enabling authorized functions only when each of the at least one security check passes. The performing at least one security check comprises: checking by a battery status circuitry, the status of the battery; and invoking a secure distance check by a distance measurement circuitry, when the battery status is good; and enabling by the inductive system, the authorized functions only when the secure distance check passes. In one or more embodiments, the performing at least one security check may comprise performing a motion inquiry, and the authorized functions are enabled only when the motion inquiry indicates an authorized motion. In one or more embodiments, the performing at least one security check may comprise detecting whether a button is pressed, and the authorized functions are enabled only when the button is pressed.

Embodiments of the present invention are illustrated by way of example and are not limited by the accompanying figures. Similar references in the figures may indicate similar elements.

The inventors have recognized the vulnerability of battery-powered electronic control keys (a. , key fobs) that include backup functionality. They have therefore developed a system and method of improving security by performing at least one security check during backup functionality of electronic control keys. In some embodiments, the status of the electronic control key battery is evaluated and if available and sufficiently charged, a secure distance check is mandatory and performed to avoid an attack when the authorized electronic control key is beyond the security distance threshold. In other embodiments, the electronic control key includes a motion detector that it used to perform a motion inquiry in which an attack may be avoided when the authorized electronic control key is stationary or otherwise does not move in accordance with a programmed motion pattern. The motion inquiry may be a simple motion, or it may be more sophisticated motion such as comparing actual motion detected by the motion detector with a predetermined or programmed user-defined characteristic movement of the electronic control key. In other embodiments, a button is added or an existing button is re-purposed and authorized functions are enabled only when the button is pressed. In still other embodiments, a combination of the security checks may be enabled.

The electronic control key includes an inductive system that enables backup communications via an inductive link typically used when the electronic control key battery is disconnected or not sufficiently charged. The inductive system establishes authorized communications via the inductive link and further enables authorized functions to be commanded via the inductive link. As further described herein, even if authorized communications are established using the inductive link, the inductive system does not enable the authorized functions when any of the at least one security check fails. The security check can be battery status combined with secure distance check, or authorized motion check, or a combination of security check methods.

<FIG> is a simplified block diagram of an electronic key-based control system <NUM> implemented according to one embodiment of the present disclosure. An electronic control key <NUM> is configured to establish authorized wireless communications with an access controller <NUM> contained within a vehicle <NUM>, such as an automobile, van, SUV, truck or the like. The vehicle <NUM> may also represent any type of controlled location, such as, for example, hotel rooms, apartments, buildings, secure areas, etc. The electronic control key <NUM> may be used to perform a variety of different authorized functions, such as locking/unlocking doors, opening a trunk, activating an alarm, starting an engine of the vehicle <NUM>, etc. The electronic control key <NUM> and the access controller <NUM> may each be equipped with wireless communication circuitry that are configured to wirelessly communicate with each other to perform wake up, connection, and communication tasks for access, control and data transfer functions and the like, and for also performing distance measurements between the electronic control key <NUM> and the vehicle <NUM>.

As shown, each includes a communication (COM) antenna coupled to internal communication circuitry for performing the primary communications. In one embodiment, for example, each may include a wireless Bluetooth device configured to operate according to the Bluetooth wireless standard including low power versions, such as Bluetooth Low Energy (BLE). Although Bluetooth and BLE are commonly used for such functions, alternative wireless communication technologies are also contemplated for performing the same or similar functions, such as <NUM> or Wi-Fi and the like. In addition, the electronic control key <NUM> and the access controller <NUM> may each be equipped with additional wireless communication circuitry configured to wirelessly communicate with each other to perform distance (DIST) measurements or and the like for localization functions including determining the relative proximity of the electronic control key <NUM>. As shown, for example, each includes a distance antenna DIST coupled to internal communication circuitry for performing wireless communications associated with measuring a distance between the electronic control key <NUM> and the access controller <NUM>. In one embodiment, for example, each may include an ultra-wideband (UWB) device configured to operate using UWB technology.

During normal operation, an authorized user (e.g., user <NUM> shown in <FIG>) uses the electronic control key <NUM> to perform any of one or more different authorized functions, such as locking/unlocking doors, opening a trunk, activating an alarm system, starting an engine of the vehicle <NUM>, etc. Many of these authorized functions may be activated by one or more pushes of one or more buttons other interfaces provided on the electronic control key <NUM>. Other authorized functions, such as passive keyless entry (PKE), may be performed without human action. When the electronic control key <NUM> is within a predetermined threshold distance <NUM> from the vehicle <NUM>, an authorized wireless communication session may be established to allow wireless communications between the electronic control key <NUM> and the access controller <NUM> to perform any of the desired authorized functions. The threshold distance <NUM> is a predetermined to ensure that the electronic control key <NUM> is nearby the vehicle <NUM> for enabling the authorized functions. In one embodiment, the predetermined threshold distance <NUM> is on the order of a few meters, such as <NUM>-<NUM> meters or the like, although any suitable distance threshold less than or greater than <NUM>-<NUM> meters is contemplated. The electronic control key <NUM> may include memory or the like storing a secure key or code which may be encrypted and transferred for purposes of authentication. The COM and DIST functions are supported by corresponding communication circuitry, described further below, powered by a battery or the like.

When the battery of the electronic control key <NUM> is absent, disconnected, or dead (or substantially discharged), then the normal wireless communications, including COM and DIST functions, might not be functional such as is the case for legacy or conventional key fob configurations. The electronic control key <NUM> includes an inductive element <NUM> which may be used to establish an inductive link with a corresponding inductive element <NUM> located on or within the vehicle <NUM>. The inductive elements <NUM> and <NUM> may each be implemented as physical inductors, although alternative inductive configurations are contemplated. When the inductive elements <NUM> and <NUM> are sufficiently close to one another, such as within a predetermined coupling zone <NUM>, then the inductive link may be established for providing power and for establishing communications with the electronic control key <NUM>. In one embodiment, the location of the inductive element <NUM> of the vehicle <NUM> is marked or otherwise known by the user, such as at or near a door handle or the like. The coupling zone <NUM> may be a predetermined distance, such as <NUM>-<NUM> centimeters (or <NUM>-<NUM> inches) or the like. The user positions the electronic control key <NUM> so that the inductive element <NUM> of the electronic control key <NUM> is within the coupling zone <NUM> of the inductive element <NUM>.

Various methods are contemplated for detection of the presence of the electronic control key <NUM>. In the illustrated embodiment, a sensor <NUM> is provided on or within the vehicle <NUM>. The sensor <NUM> may be configured according to any suitable method and may include a sensor interface <NUM> configured according to the particular sensor type. The sensor interface <NUM> may a button, an inductive object detector, a capacitive sensor, etc. In one embodiment, the sensor interface <NUM> may be sufficiently close to the inductive element <NUM> for detecting the inductive element <NUM> when within the coupling zone <NUM>. In another embodiment, the sensor interface <NUM> is a button that is pressed by a user. In yet another embodiment, the sensor interface <NUM> may be a touch pad or the like configured as a capacitive sensor. In yet another embodiment, the sensor <NUM> is avoided and the inductive element <NUM> itself may be used as the sensing device. Once proximity is detected indicating a possible inductive link, the sensor <NUM> wakes up or otherwise activates the access controller <NUM>. Either the sensor <NUM> or the access controller <NUM> activates inductive power and communication (IPC) circuitry <NUM> electrically interfaced with the inductive element <NUM>. If the inductive element <NUM> is the sensing device, then the IPC circuitry <NUM> may detect low inductive power and awaken.

When activated, the IPC circuitry <NUM> energizes the inductive element <NUM> to transfer power to the electronic control key <NUM> via the inductive element <NUM>. The inductive link between the inductive elements <NUM> and <NUM> is also used for backup communications between the electronic control key <NUM> and the access controller <NUM>. In one embodiment, the access controller <NUM> communicates with the electronic control key <NUM> via the IPC circuitry <NUM> and the inductive element <NUM>. In an alternative embodiment, the IPC circuitry <NUM> is configured to perform duplicate communications rather than the access controller <NUM>. The inductive link may use low frequency (LF) technologies or near-field communication (NFC) technologies or the like.

<FIG> is a simplified schematic and block diagram of the circuitry of the electronic control key <NUM> implemented as a key fob according to one embodiment of the present disclosure. The circuitry includes communication (COM) circuitry <NUM> for performing the COM functions via a COM antenna <NUM>, distance (DIST) circuitry <NUM> for performing the DIST functions via a DIST antenna <NUM>, and micro-electromechanical system (MEMS) circuitry <NUM>. The COM circuitry <NUM> establishes primary wireless communications with corresponding COM circuitry (not shown) of the access controller <NUM>. In the illustrated embodiment, the COM circuitry <NUM> is used for the primary communication method between the electronic control key <NUM> and the access controller <NUM> for performing various tasks including wake up, connection and other communication tasks including the authorized COM functions. The DIST circuitry <NUM> operates according to a selected wireless technology, such as UWB technology or the like, for distance measurements for localization of the electronic control key <NUM>. The MEMS circuitry <NUM> performs energy harvesting functions. The electronic control key circuitry further includes a battery <NUM> having a negative terminal coupled to ground (GND) and a positive terminal coupled to a power supply node <NUM> developing a supply voltage VDD.

The battery circuitry is shown in simplified format and additional circuitry may be included. For example, a diode or other rectifier circuit may be interposed between the battery <NUM> and the power supply node <NUM>. A filter capacitor and a voltage limiter (e.g., a Zener diode or the like) may also be coupled between the power supply node <NUM> and GND. The power supply node <NUM> is coupled to power inputs of the COM circuitry <NUM>, the DIST circuitry <NUM>, and the MEMS circuitry <NUM>. A communication bus <NUM> is provided to enable internal communications between the COM circuitry <NUM>, the DIST circuitry <NUM>, and the MEMS circuitry <NUM>, and may be implemented in any suitable manner such as, for example, a serial peripheral interface (SPI) or the like.

During normal operation, the battery <NUM> is present and sufficiently charged to enable operation of the COM circuitry <NUM> and the DIST circuitry <NUM>. The DIST circuitry <NUM> measures the distance between the electronic control key <NUM> and the vehicle <NUM>. When the electronic control key <NUM> is within the predetermined threshold distance <NUM> from the vehicle <NUM>, the COM circuitry <NUM> is enabled to establish an authorized wireless communication session to perform any of the desired functions. It is noted that the COM circuitry <NUM> and the DIST circuitry <NUM> of the electronic control key <NUM> may be combined into a single wireless communication device performing the functions of both. When BLE or the like is used for performing the COM functions, however, BLE may not be able to perform proper localization in a targeted environment with acceptable speed, so that UWB circuitry or the like is better suited for the DIST functions. When the battery <NUM> is absent, disconnected or not sufficiently charged, then the COM circuitry <NUM> and the DIST circuitry <NUM> may not be enable or otherwise may not be available to perform the normal functions.

The circuitry of the electronic control key <NUM> further includes an inductive system <NUM> coupled to the inductive element <NUM>. The inductive system <NUM> may further be coupled to other circuitry of the electronic control key <NUM>, such as via the communication bus <NUM>. When the inductive element <NUM> of the electronic control key <NUM> is placed sufficiently close to the inductive element <NUM> (e.g., within the coupling zone <NUM>) and when the IPC circuitry <NUM> is activated forming an inductive link, then the IPC circuitry <NUM> may deliver power (PWR) to the inductive system <NUM> and may enable communications (COM) with the inductive system <NUM>. In one embodiment, for example, the inductive link may be configured with low frequency (LF) technology. In another embodiment, the inductive link may perform near-field communications (NFC) according to ISO/IEC (International Organization for Standardization / International Electrotechnical Commission) <NUM> or the like. The inductive system <NUM> may be implemented in any suitable fashion, such as an SE050 integrated circuit (IC) manufactured by NXP Semiconductors.

The COM functions normally performed by the COM circuitry <NUM> are essentially duplicated by the inductive system <NUM> using the inductive link. The DIST functions, however, may not be available when the battery <NUM> is not available or is discharged. Since the inductive link is typically established when the inductive element <NUM> of the electronic control key <NUM> is within the coupling zone <NUM> of the inductive element <NUM>, then the DIST functions might otherwise be considered extraneous. It has been determined, however, that this backup link opens up a back-door vulnerability that renders the system vulnerable to an attack by a hacker. Such an attack may allow the unauthorized hacker to perform any of the otherwise authorized functions, including gaining access to and control of the vehicle <NUM>.

The circuitry of the electronic control key <NUM> further includes battery status circuitry <NUM> coupled to the battery <NUM> or otherwise coupled to the power supply node <NUM> and provides a battery status indication BSTAT to the inductive system <NUM>. The battery status circuitry <NUM> may be configured to perform one or more functions for determining the status of the battery <NUM>. For example, if the battery voltage level or the voltage level of VDD indicates that the battery <NUM> is present and sufficiently charged, then BSTAT provides a GOOD indication. Otherwise, if the battery <NUM> is not detected or if the voltage level of the battery <NUM> or of VDD is below a predetermined threshold, then BSTAT provides a NOT GOOD indication. BSTAT may be a digital or binary signal with a single bit, or it may include multiple bits depending upon the configuration. For example, BSTAT may indicate battery presence and whether the battery voltage or the voltage of the power supply node <NUM> is above a predetermined level.

The battery status circuitry <NUM> may be implemented in any suitable manner. In one embodiment, the battery status circuitry <NUM> may include a comparator or the like that compares the voltage of the battery <NUM> or the voltage level of VDD with a predetermined minimum voltage threshold. In addition or in the alternative, the battery status circuitry <NUM> may include circuitry that momentarily applies a minimum load to the battery <NUM> or to VDD to ensure that the indicated voltage level accurately reflects the charge of the battery <NUM> rather than spurious capacitance charge or the like. The battery status circuitry <NUM> may also be a simple conductor that conveys the voltage of the battery <NUM> or VDD to the inductive system <NUM>, which is configured to compare the voltage level of the battery <NUM> or VDD or to test the charge of the battery <NUM>.

As further described herein, if the inductive system <NUM> is being used for communications (COM) and BSTAT indicates GOOD, then the inductive system <NUM> communicates with the DIST circuitry <NUM> to perform a secure distance check to determine whether the electronic control key <NUM> is within the predetermined threshold distance <NUM> from the vehicle <NUM>. If the secure distance check passes, meaning that the electronic control key <NUM> is within the predetermined threshold distance <NUM> from the vehicle <NUM>, then the inductive system <NUM> is enabled to perform authorized functions. If the secure distance check fails, then it is assumed that an unauthorized attack is being attempted and additional communications are disabled or otherwise not allowed. If BSTAT indicates that the status of the battery <NUM> is NOT GOOD, then the backup communications and authorized functions may be enabled.

<FIG> is a figurative diagram illustrating an attack scenario in which the inductive system <NUM> is used as the backup mode facilitating a relay attack as further described herein. The authorized user <NUM> in possession of the electronic control key <NUM> is located a distance <NUM> from the vehicle <NUM>, in which the distance <NUM> is greater than the predetermined threshold distance <NUM>. A first thief <NUM> places first attack equipment <NUM> sufficiently close to the electronic control key <NUM> to establish an inductive link <NUM> with the electronic control key <NUM>. A second thief <NUM> located near the vehicle <NUM> places second attack equipment <NUM> sufficiently close to the inductive element <NUM> to establish an inductive link <NUM> with the IPC circuitry <NUM>. The first and second attack equipment <NUM> and <NUM> communicate with each other via wireless link <NUM> to relay communications.

The second attack equipment <NUM> is either sensed directly or its presence indicated by the second thief <NUM> in the manner previously described. The IPC circuitry <NUM> is activated and begins sending information (from the access controller <NUM> or directly from the IPC circuitry <NUM>) to the second attack equipment <NUM> via the inductive link <NUM>. The transmitted information from the IPC circuitry <NUM> is relayed to the first attack equipment <NUM> and to the inductive system <NUM> of the electronic control key <NUM> via the relayed communication links <NUM> and <NUM>. The inductive system <NUM> of the electronic control key <NUM> provides responses which are relayed via communication links <NUM>, <NUM> and <NUM> by the first and second attack equipment <NUM> and <NUM> to the IPC circuitry <NUM>. Essentially, communications looping between the IPC circuitry <NUM> and the inductive system <NUM> are relayed back and forth by the attack equipment <NUM> and <NUM> as though they were communicating directly with each other. In this manner, the IPC circuitry <NUM>, or the access controller <NUM> communicating via the IPC circuitry <NUM>, may otherwise be fooled into enabling the functions that are only authorized for the electronic control key <NUM>, possibly enabling unauthorized access and control of the vehicle <NUM> to the second thief <NUM>.

The electronic control key <NUM>, however, includes the battery status circuitry <NUM> queried by the inductive system <NUM> for thwarting the illustrated attack scenario. In particular, before enabling authorized functions, the inductive system <NUM> queries BSTAT to determine the status of the battery <NUM>. If BSTAT indicates that the status of the battery <NUM> is NOT GOOD (not present or not sufficiently charged), then normal backup communications are enabled to perform the authorized functions. If BSTAT indicates that the status of the battery <NUM> is GOOD, then the inductive system <NUM> communicates with the DIST circuitry <NUM> to perform a secure distance check with the access controller <NUM>. If the secure distance check passes, meaning that the electronic control key <NUM> is within the threshold distance <NUM>, then normal backup communications are enabled to perform the authorized functions. If, however, the secure distance check fails, such as the case shown in <FIG> when the electronic control key <NUM> is located at the distance <NUM> beyond the predetermined threshold distance <NUM>, then the secure distance test fails and the inductive system <NUM> does not enable the authorized functions.

<FIG> is a flowchart illustrating operation of the electronic control key <NUM> during inductive linking according to one embodiment of the present disclosure. At first block <NUM>, the inductive system <NUM> is awakened upon detection of current through the inductive element <NUM> of the electronic control key <NUM>, and the inductive system <NUM> attempts to establish authorized communications with the IPC circuitry <NUM> or with the access controller <NUM> via the IPC circuitry <NUM>. Although not shown in <FIG>, the electronic control key <NUM> (or other inductive device) is first detected by the sensor <NUM> (or the IPC circuitry <NUM>) and the access controller <NUM> is awakened to attempt to establish communications. If communications with the COM circuitry <NUM> is unsuccessful, then the access controller <NUM> awakens the IPC circuitry <NUM> (if not already activated) to begin providing power via the inductive element <NUM>. The current through the inductive element <NUM> induces current through the inductive element <NUM> awakening the inductive system <NUM>.

At next block <NUM>, it is queried whether the inductive system <NUM> begins to establish authorized communications with the IPC circuitry <NUM> or with the access controller <NUM> via the IPC circuitry <NUM>. Authorized communications may be established according to any known methods, such as including secure cryptographic and key store functions or the like. If authorized communications are not established, such as when the electronic control key <NUM> is attempting to communicate with another system with which it is not authorized, then operation advances to block <NUM> in which the communications are terminated and the inductive system <NUM> is deactivated. Operation then loops back to block <NUM> in which the inductive system <NUM> remains asleep until subsequently awakened.

If authorized communications are established as determined at block <NUM>, then operation advances instead to block <NUM> in which the inductive system <NUM> queries BSTAT to determine the status of the battery <NUM>. It is noted at this point that authorized communications may actually be established between the electronic control key <NUM> and the vehicle <NUM> during an attack scenario as shown and described in <FIG> since authorized communications are relayed by the first and second attack equipment <NUM> and <NUM>. Nonetheless, the authorized functions are not yet enabled by the electronic control key <NUM>. Operation then advances to block <NUM> to query the battery status. If BSTAT indicates that the battery status is GOOD, meaning that the battery <NUM> is present and sufficiently charged for normal operation, then operation advances to block <NUM> in which the inductive system <NUM> communicates with the DIST circuitry <NUM> to perform a secure distance check. At next block <NUM>, it is queried whether the secure distance check passed or failed. If the secure distance check failed (e.g., PASS is false), meaning that the electronic control key <NUM> is located beyond the predetermined threshold distance <NUM> from the vehicle <NUM>, then an attack scenario is presumed and operation loops back to block <NUM> in which the communications are terminated and the inductive system <NUM> is deactivated as previously described. In this case, the attack scenario is thwarted.

If instead the secure distance check passed as determined at block <NUM> (e.g., PASS is true), meaning that the electronic control key <NUM> is located within the predetermined threshold distance <NUM> from the vehicle <NUM>, then operation advances instead to block <NUM> in which the authorized functions are enabled by the inductive system <NUM>, the current communication session is completed, and then the inductive system <NUM> is deactivated and put back to sleep. Operation is completed and may loop back to block <NUM> previously described. In this case the electronic control key <NUM> is nearby and the authorized user <NUM> may be using the inductive link even when the status of the battery <NUM> is good.

Referring back to block <NUM>, if BSTAT instead indicates that the battery status is NOT GOOD, meaning that the battery <NUM> is either not present or is not sufficiently charged for normal operation, then operation instead advances directly to block <NUM> in which the authorized functions are enabled by the inductive system <NUM>, the current communication session is completed, and then the inductive system <NUM> is deactivated and put back to sleep. Operation is completed and may loop back to block <NUM> previously described. In this case, the status of the battery <NUM> is not good so that backup functionality is enabled presumably for the authorized user <NUM>.

<FIG> is a simplified schematic and block diagram of circuitry of an electronic control key <NUM> implemented according to another embodiment of the present disclosure. The electronic control key <NUM> is substantially similar to the electronic control key <NUM> in which similar components include identical reference numbers. The COM circuitry <NUM>, the DIST circuitry <NUM>, and the MEMS circuitry <NUM> are included and coupled to communicate via the communication bus <NUM> in similar manner. Also, the battery <NUM> is included to develop the supply voltage VDD on the power supply node <NUM> in similar manner, in which VDD is distributed to the COM circuitry <NUM>, the DIST circuitry <NUM>, and the MEMS circuitry <NUM>. The battery status circuitry <NUM> is not shown, but may be included in an alternative embodiment. The electronic control key <NUM> includes a motion detector <NUM> coupled to the MEMS circuitry <NUM> and providing a motion signal MOT to the inductive system <NUM>. The inductive system <NUM> operates in a similar manner as previously described, except that it is configured to monitor the MOT signal for making decisions regarding enablement of the access and control functions as further described herein.

<FIG> is a simplified schematic and block diagram of circuitry of a mobile phone <NUM> implemented according to yet another embodiment of the present disclosure. The mobile phone <NUM> may include the motion detector <NUM> and the inductive system <NUM> that operate in a similar manner as the electronic control key <NUM>. The mobile phone <NUM> includes a low power battery domain <NUM> that develops and provides the supply voltage VDD to the motion detector <NUM> and the inductive system <NUM> via a power supply node <NUM>. The mobile phone <NUM> also includes remaining circuitry <NUM> coupled to the power supply node <NUM> which includes mobile phone circuitry not further described.

<FIG> is a flowchart illustrating operation of the electronic control key <NUM> or the mobile phone <NUM> during inductive linking according to one embodiment of the present disclosure. The blocks <NUM>, <NUM>, and <NUM> are included and operate in substantially similar manner as previously described in <FIG> for the electronic control key <NUM>. When authorized communications are established as determined at block <NUM>, operation advances to block <NUM> in which the inductive system <NUM> monitors the MOT signal from the motion detector <NUM> to perform a motion inquiry. Operation then advances to block <NUM> in which the inductive system <NUM> determines whether motion of the electronic control key <NUM> or the mobile phone <NUM> is an "authorized" motion further defined herein. If the motion is not authorized, then the authorized functions are not enabled and operation loops back to block <NUM> in which communications are terminated and the inductive system <NUM> deactivated.

If instead the motion is authorized, then operation advances to block <NUM>, similar to block <NUM> previously described, in which the authorized functions are enabled by the inductive system <NUM>, the current communication session is completed, and then the inductive system <NUM> is deactivated and put back to sleep. Operation is completed and may loop back to block <NUM> previously described. In this case the decision to enable the authorized functions is determined by an authorized motion.

In one embodiment, an authorized motion is simply any significant motion at all, meaning that the electronic control key <NUM> or the mobile phone <NUM> is in motion. With reference back to <FIG> in which the attack scenario is illustrated, presumably the inductive link <NUM> between the attack equipment <NUM> and the authorized device, which in this case is with the electronic control key <NUM> or the mobile phone <NUM>, is enabled only while the authorized device is stationary. The inductive link <NUM> is likely not successful while the authorized device is in motion. If the authorized device is stable and not moving as indicated by the MOT signal, then an attack scenario is presumed and authorized functions are not enabled. In this embodiment, if the authorized user <NUM> uses the authorized device, such as either the electronic control key <NUM> or the mobile phone <NUM>, in the backup mode to access the vehicle <NUM>, then the user <NUM> positions the authorized device within the predetermined coupling zone <NUM> and moves the authorized device until the authorized functions are enabled. It is noted that while the authorized device remains stationary, similar positioning and motion of the second attack equipment <NUM> at the vehicle <NUM> is not successful in enabling the authorized functions so that the attack remains unsuccessful.

In another embodiment, the authorized motion detected as block <NUM> is a predetermined, user-defined and programmable motion pattern of the authorized device, such as either the electronic control key <NUM> or the mobile phone <NUM>. In this case, the authorized user <NUM> initially or preliminarily performs a motion training session by placing the authorized device in a programming mode and moves the authorized device in an arbitrary motion pattern or in any one of many different predetermined motion patterns. Many different types of motion patterns are contemplated, such as a circular motion including one or more circle motions in a selected direction (clockwise or counterclockwise), a figure-<NUM> pattern, a crossing pattern, etc. Of course, other types of motions including arbitrary motions are contemplated as long as sufficiently complex. Once programmed with the selected motion pattern, then the authorized functions are only enabled by the inductive system <NUM> when the authorized device duplicates the programmed motion pattern as indicated by the MOT signal generated by the motion detector <NUM>.

Referring back to <FIG> illustrating the attack scenario, even if the authorized device (electronic control key <NUM> or mobile phone <NUM>) is moving during the attack, it is very unlikely that it is moving in the programmed motion pattern so that the attack is thwarted. In addition, the authorized device must duplicate the programmed motion pattern rather than the second attack equipment <NUM>. In other words, even if the second thief <NUM> moves the second attack equipment <NUM> to somehow duplicate the programmed motion pattern, the attack is unsuccessful.

<FIG> is a simplified block diagram of an electronic control key <NUM> implemented according to still another embodiment of the present disclosure. The electronic control key <NUM> includes the inductive system <NUM> coupled to the inductive element <NUM> in a similar manner previously described. The inductive system <NUM> is coupled to remaining circuitry <NUM> configured according the particular implementation. For example, when the electronic control key <NUM> is configured as a key fob, then the remaining circuitry <NUM> may include the COM circuitry <NUM>, the DIST circuitry <NUM>, the MEMS circuitry <NUM>, and the battery <NUM> along with any of one or more antennas and other supporting circuitry. When instead the electronic control key <NUM> is configured as a mobile phone such as the mobile phone <NUM>, then the remaining circuitry <NUM> may include the low power domain <NUM> and any other remaining circuitry <NUM> as previously described.

In this case, a button <NUM> is included and coupled to the inductive system <NUM>. The button <NUM> may be configured in any suitable manner, such as a physical push button located on the body or chassis of the key fob or mobile phone or the like. The button <NUM> may be an existing button on the electronic control key <NUM> having a normal function during normal operation. For example, a key fob may have a remote keyless entry (RKE) open or close button, trunk open button, etc. A mobile phone may have a home button, a volume button, a power button, etc. When the inductive system <NUM> is used for power and COM functions, the existing button <NUM> is repurposed for a security check as further described herein. Alternatively, the button <NUM> may be an additional button that is dedicated to the security check. In some embodiments, the user may program the inductive system <NUM> to sense activation or pressing of the button <NUM> during inductive link operation.

<FIG> is a flowchart illustrating operation of the electronic control key <NUM> during inductive linking according to one embodiment of the present disclosure. The blocks <NUM>, <NUM>, and <NUM> are included and operate in substantially similar manner as previously described in <FIG>. When authorized communications are established as determined at block <NUM>, operation advances to block <NUM> in which the inductive system <NUM> determines whether the button <NUM> is pressed. If the button <NUM> is not pressed, operation loops back to block <NUM> previously described in which communications are terminated and the inductive system <NUM> deactivated. If the button <NUM> is pressed, then operation advances to block <NUM> similar to blocks <NUM> and <NUM> previously described, in which the authorized functions are enabled by the inductive system <NUM>, the current communication session is completed, and then the inductive system <NUM> is deactivated and put back to sleep. Operation is completed and may loop back to block <NUM> previously described.

For the electronic control key <NUM>, the decision to enable the authorized functions is determined by pressing of the button <NUM>. When the authorized user <NUM> needs to perform any of the authorized functions during inductive linking, then the authorized user <NUM> places the electronic control key <NUM> within the coupling zone <NUM> as previously described and presses the button <NUM>.

Referring back to <FIG> illustrating the attack scenario, even if the first attack equipment <NUM> sufficiently close to the electronic control key <NUM> to establish an inductive link <NUM>, the first thief <NUM> likely does not have physical access to the electronic control key <NUM> and thus is unable to press the button <NUM>. In this manner, the attack is thwarted.

<FIG> is a simplified block diagram of an electronic control key <NUM> implemented according to an embodiment of the present disclosure illustrating a combination of security checks. The electronic control key <NUM> includes the inductive system <NUM> coupled to the inductive element <NUM> in a similar manner previously described. The inductive system <NUM> is coupled to remaining circuitry <NUM> configured according the particular implementation, similar to that described for the remaining circuitry <NUM>. The battery status circuitry <NUM>, the motion detector <NUM>, and the button <NUM> are shown coupled to the inductive system <NUM>. In this configuration, any one security check, or any combination of two or three security checks may be enabled. For a combination of security checks, the inductive system <NUM> may check battery status via BSTAT (and perform secure distance check if GOOD) and also query MOT for authorized motion for enabling authorized functions; the inductive system <NUM> may check battery status via BSTAT (and perform secure distance check if GOOD) and also determine whether the button <NUM> is pressed for enabling authorized functions; the inductive system <NUM> may query MOT for authorized motion and determine whether the button <NUM> is pressed for enabling authorized functions; or the inductive system <NUM> may check battery status via BSTAT (and perform secure distance check if GOOD), query MOT for authorized motion, and determine whether the button <NUM> is pressed for enabling authorized functions.

The electronic control key in any of the embodiments described herein includes security check circuitry that is incorporated within or otherwise used by an inductive system to enable authorized functions to be commanded via the inductive link. If the security check circuitry determines a potential attack, then authorized functions are not enabled and inductive link communications are terminated.

In some embodiments, the security check circuitry includes battery status circuitry that checks or otherwise evaluates the status of the battery of the electronic control key and that reports the status to the inductive system. If the battery is good, such as being sufficiently charged, then the inductive system forces distance measurement circuitry to perform a secure distance check to determine whether the electronic control key is within a predetermined threshold distance. If the electronic control key is not within the predetermined threshold distance, then the secure distance check fails so that the authorized functions are not enabled and inductive link communications are terminated.

In other embodiments, the security check circuitry includes a motion detector that reports motion to the inductive system. The inductive system evaluates motion of the electronic control key to determine whether an authorized motion is detected for determining whether to enable the authorized functions. In some embodiments, the authorized motion may simply be any type of motion that indicates that the electronic control key is moving. If the electronic control key is not moving, then the motion test fails so that the authorized functions are not enabled and inductive link communications are terminated. In other embodiments, the authorized motion is a predetermined or preprogrammed motion pattern created, chosen or otherwise selected by an authorized user. If the electronic control key does not move in accordance with the selected or programmed authorized motion pattern, then the motion test fails so that the authorized functions are not enabled and inductive link communications are terminated.

In yet other embodiments, the security check circuitry includes a button detected by the inductive system. The inductive system determines whether the button is pressed to determine whether to enable the authorized functions.

In other embodiments, a combination of security check circuitry may be included and selectively enabled.

By now it should be appreciated that there is provided herein an electronic control key including security check circuitry used by an inductive system to perform at least one security check to determine whether to enable authorized functions. The inductive system receives power and enables communications via an inductive link for backup operation. The security check circuitry may include battery status circuitry and distance measurement circuitry. The inductive system invokes the distance measurement circuitry to perform a secure distance check when the battery status is good, in which the inductive system enables authorized functions only when the secure distance check passes. The security check circuitry may include a motion detector for performing a motion inquiry. The motion inquiry may include detecting motion of the electronic control key or detecting a predetermined characteristic movement or a programmed motion pattern. The security check circuitry may be a button in which authorized functions are enabled only when the button is pressed.

Although the present invention has been described in connection with several embodiments, the invention is not intended to be limited to the specific forms set forth herein. On the contrary, it is intended to cover such alternatives, modifications, and equivalents as can be reasonably included within the scope of the invention as defined by the appended claims. For example, variations of positive logic or negative logic may be used in various embodiments in which the present invention is not limited to specific logic polarities, device types or voltage levels or the like. For example, logic states, such as logic low and logic high may be reversed depending upon whether the pin or signal is implemented in positive or negative logic or the like. In some cases, the logic state may be programmable in which the logic state may be reversed for a given logic function.

Claim 1:
An electronic control key (<NUM>), comprising:
an inductive link;
an inductive system (<NUM>) configured to receive power and enable communications via the inductive link; and
security check circuitry coupled to the inductive system (<NUM>) and configured to perform at least one security check to determine whether to enable authorized functions, wherein:
the security check circuitry comprises:
battery status circuitry (<NUM>) configured to indicate a status of a battery (<NUM>); and
distance measurement circuitry (<NUM>) configured to perform a secure distance check by a distance measurement between the electronic control key and an access system; and
wherein the inductive system (<NUM>) invokes the distance measurement circuitry (<NUM>) to perform the secure distance check when the battery status circuitry (<NUM>) indicates that the battery status is good and enables authorized functions only when the secure distance check passes.