Patent Description:
Embodiments described herein generally relate to remote actuation of a motor or other device and more specifically to a secure wireless lock-actuation exchange.

Wireless mechanisms to actuate a motor, solenoid, or other device have been employed in a variety of products, such as garage door openers or vehicle locking mechanisms (e.g., unlocking a car door, opening a trunk, starting the engine, etc.). A pairing between a signaler (e.g., a wireless key-fob) and the actuator (e.g., a vehicle unlocking mechanism) can be used to add security to the process. Such pairing typically does not employ sophisticated encryption to reduce component costs and increase battery life in the signaler, for example.

Rolling codes (e.g., hopping codes) can be used to prevent replay attacks possible with simple pairing. A replay attack involves recording a previous transmission-such as using a radio receiver in proximity to the signaler being successfully used-and replaying the transmission in the future to achieve an unauthorized actuation. Rolling codes help to prevent this attack by defining a sequence of codes, a next code in the sequence used for a next actuation attempt. The signaler and the actuator store the sequence and maintain an index into the sequence that is incremented with each use. Thus, recording a previously used code in the sequence will not be accepted by an actuator because the actuator has moved on to another code in the sequence after the recorded code was successfully used.

<CIT> relates to a device which includes a first interface, a second interface, a memory, and a processor coupled to the first and second interfaces and to the memory. The processor is configured to receive key-management information via the second interface, and to store the key-management information in a protected portion of the memory as stored key-management information. The processor is also configured to perform a challenge-response authentication interaction via the first interface. The challenge-response authentication interaction is based at least in part on the stored key-management information. The device is configured to prevent data in the protected portion of the memory from being modified in response to information received via the first interface.

<CIT> relates to a content-based authorisation method, wherein the method is operable to validate that a user has access to certain content. By having access to the content, the system is able to decide that the user is authorised to access the content, and may perform operations or set access rights accordingly.

In the drawings, which are not necessarily drawn to scale, like numerals can describe similar components in different views. Like numerals having different letter suffixes can represent different instances of similar components.

In a first aspect of the invention, a method is provided as recited in claim <NUM>. In a second aspect of the invention, a computer readable medium is provided as recited in claim <NUM>. In a third aspect of the invention, a system is provided as recited in claim <NUM>. Rolling codes are susceptible to an attack, sometimes called Rolljam, in which an attacker actively intervenes in an actuator exchange. The attacker snoops the frequency to obtain a first code from the signaler. The attacker also jams the wireless link (e.g., by broadcasting on the frequency to raise the noise floor above the signaler's signal). Thus, the actuator receiver does not operate (e.g., open a lock) and does not move the rolling code sequence forward. If the signaler attempts the actuation again-such as a user again pressing the "unlock" button on a key-fob because the vehicle door did not unlock-the attacker captures the second code, jams the receiver again, and then transmits the first code. Because the actuator did not progress the sequence when the first code was originally sent from the signaler, the actuator will accept the first code and operate, progressing the sequence to the second code. Because the attacker has the second code, the attacker can broadcast it at a later time, resulting in an effective operation of the actuator.

To address the security problem presented by the Rolljam attack, as well as related techniques, a secure wireless lock-actuation exchange is described herein. The exchange modifies a typical wireless actuation technique by introducing a variable number of challenge-response exchanges into each request. Each of these exchanges involves the signaler and the actuator to prove a secret that enables the other of the exchange to verify that a given exchange is authorized. The technique is effective because an attacker cannot predict whether a given captured signal from the signaler will operate the actuator, and thus cannot effectively capture a signal that will operate the actuator in the future. Further, because the technique can be implemented with hardware that already exists on signalers and actuators, the low-cost components, and high-energy efficiency typically required by these systems is maintained.

Additional details and examples are provided below. Although many examples relate to vehicle actuation systems, other examples with similar operating parameters can equally benefit from the described devices and techniques. Example system can include garage door openers, wireless locks for buildings, and other wirelessly activated actuators.

<FIG> is a block diagram of an example of an environment including a system for secure wireless lock-actuation exchange, according to an embodiment. The environment includes a device <NUM> (e.g., signaler) and a vehicle <NUM> with a controller <NUM> (e.g., actuator controller) operably coupled to control a lock n actuator (for example, such as a motor or solenoid) to operate (lock/unlock) a vehicle lock. Although the examples involve a vehicle <NUM>, other systems, such as garage door opener, can be used with the devices and techniques described herein.

The device <NUM> includes processing circuitry <NUM> and machine readable media <NUM>, along with a transceiver to communicate with the vehicle <NUM> using a wireless link <NUM>. In an example, the machine readable media <NUM> contains a symmetric key that also is held by the vehicle <NUM> (e.g., in the machine readable media <NUM>). In an example, the machine readable media <NUM> is secured, for example, via encryption, a trusted platform module, etc..

The processing circuitry <NUM> is arranged to perform one or more cryptographic functions. For example, the processing circuitry <NUM> can include an application specific integrated circuit (ASIC), field programmable gate array (FPGA), or execution units to compute a hash, message authentication code (MAC), or the like. In an example, the processing circuitry <NUM> includes hardware support for a monotonic counter that can be used to provide a level of variation (e.g., freshness) to generated MACs. As described below, this facility supports the device's ability to answer challenges posed by the controller <NUM> to actuate a motor.

The controller <NUM> includes processing circuitry <NUM> and the machine readable media <NUM>. Similar to the machine readable media <NUM>, the machine readable media <NUM> includes the symmetric key and can be cryptographically protected in a variety of ways.

The processing circuitry <NUM> is arranged to actuate a motor, in response to a request from the device <NUM>, and upon a successful challenge-exchange with the device <NUM>. As noted above, the challenge-exchange prevents attacks whereby an unauthorized device can instruct the controller <NUM> to actuate the motor. In the following examples, the motor that is actuated actuates a lock (e.g., moves a pin, release a magnet, etc.), such as a door lock, a trunk lock, etc. However, the motor actuator can be used to actuate other entities as well, such as starting the vehicle's engine, turning on or off a water pump at a building, etc..

To accomplish the challenge-exchange, the processing circuitry <NUM> is arranged to receive a request to actuate a lock from the device <NUM> (e.g., via the wireless link <NUM>). In an example, a portion of the request is a vehicle identification number (VIN) identifier for the vehicle <NUM>. The "VIN identifier," as used herein can be the VIN itself, a portion of the VIN, or an identifier derived from the VIN. Here, the VIN identifier enables the vehicle <NUM> to discriminate between a request directed at it, or a request that is directed to another vehicle. Other identifications can also be used, such as a serial number, registration tag, or any uniquely identifying code. Here, the vehicle contains the lock that is actuated by the motor and controlled by the controller <NUM>. In an example, the request is to actuate the lock from a locked state to an unlocked state. In an example, the nature of the request (e.g., "unlock door," "open trunk," etc.) is carried in an open message (e.g., unencrypted portion) of the request. Thus, for example, the vehicle <NUM> can include multiple different locks or actuators specified by the request.

The processing circuitry <NUM> is arranged to calculate a challenge count. The challenge count is a variable number of challenge-exchanges that will be used for this request. Thus, the challenge count is calculated for each request from the device <NUM>. In an example, the challenge count is above a threshold. Thus, in this example, there is a minimum for the challenge count. Establishing a minimum helps to establish a baseline security for the exchanges. In an example, the challenge count is below a second threshold (e.g., a maximum). Setting a maximum can be used to balance efficiency with security. In an example, the challenge count is a random number. Here, a random number generator of the controller <NUM>, or accessible to the controller <NUM>, can be used to create the challenge count. In an example, a pseudo-random generator or technique can be used to calculate the challenge count.

One way to generate a pseudo-random number involves leveraging the cryptographic hardware that is used by the controller <NUM> to generate a MAC. Thus, in an example, the challenge count can be calculated by selecting a portion of a MAC generated using: the key, a portion of the request (e.g., the VIN), and a monotonic counter. This monotonic counter is a secret, not shared outside of the controller <NUM>, and used to seed the MAC, such that it is different each time that it is generated. Thus, in an example, the monotonic counter increments each time a request to actuate the lock is received.

In an example, the portion of the MAC used as the random number is selected by comparing bytes in the MAC to the threshold until a current byte being compared meets or exceeds the threshold. Thus, for example, byte <NUM> can be first compared to the minimum, and possibly maximum, thresholds. If byte <NUM> meets the thresholds, then the number represented by byte <NUM> is used as the pseudo-random number for the challenge count. If, however, byte <NUM> does not meet the thresholds, byte <NUM> is tested. The process continues until a suitable (e.g., meets the thresholds) byte is found in the MAC. Although a linear search is described here, any type of search through the bytes of the MAC can be used to find a suitable pseudo-random value to use as the challenge count.

The processing circuitry <NUM> is arranged to perform verification iterations until an end condition is met. A verification iteration is one part of the loop, which is repeated, until the number of verification iterations meets or exceeds the challenge count, or a failure condition is encountered. A freshness value is used to modify each iteration, changing with each iteration. In an example, the freshness value is implemented as a monotonic counter that is incremented with each iteration. In an example, this monotonic counter is a different counter than that described above with respect to pseudo-random number generation. In this case, the freshness value counter need not be kept secret, and its value can be shared as described below. Otherwise, the following occurs with each iteration.

The processing circuitry <NUM> is arranged to create a vehicle signature from the counter and a portion of the request (e.g., the VIN). In an example, the vehicle signature is a MAC generated using: the key, the portion of the request, and the freshness value. In an example, the portion of the request and a current value of the freshness value are concatenated (e.g., the value of the monotonic counter is added to the beginning, end, or somewhere in the middle of the portion of the request). However, any combination of the counter and the request portion can be used as long as both the controller <NUM> and the device <NUM> implement the same technique. Thus, the counter can be prepended to the portion of the request, the counter can be exclusively ORed (XORed) to the portion of the request, etc. Whatever technique that combines the variance of the counter to the portion of the request can be used.

The processing circuitry <NUM> is arranged to control the transmission of the vehicle signature to the device <NUM>. Thus, the processing circuitry <NUM> can direct a transceiver, or includes a transceiver, to use the wireless link <NUM> to transfer the vehicle signature to the device <NUM>. In an example, in addition to the vehicle signature, a current value of the freshness value is sent to the device <NUM>.

In response to receiving the vehicle signature, the processing circuitry <NUM> of the device <NUM> is arranged to verify the transmission by computing a MAC using the key stored in the machine readable media <NUM>, a freshness value that the processing circuitry <NUM> maintains, and the message (e.g., portion of the original request). In an example, the device <NUM> uses the freshness value sent by the processing circuitry <NUM>. In an example, the processing circuitry <NUM> verifies that the received freshness value is greater than a last freshness value. To accomplish this, the last freshness value used by the processing circuitry <NUM> is stored in the machine readable media <NUM>. This last value is compared to the value sent by the processing circuitry <NUM>, and if it is less than or equal to the last freshness value, the exchange is terminated. This prevents a malicious entity from recording a previous exchange and playing the exchange forward to achieve a set of valid future messages for the exchange.

Once this MAC is generated, it can be compared to that of the vehicle signature. If they match, then the transmission is good. The processing circuitry <NUM> is arranged to create a reply message (e.g., verification signature) by creating a MAC using the freshness value, the key, and the vehicle signature. This verification signature is then sent back to the vehicle <NUM> via the wireless link <NUM>.

The processing circuitry <NUM> is arranged to compute a local-remote vehicle signature from the vehicle signature. In an example, the local-remote vehicle signature is a second MAC using the key and the vehicle signature. Thus, the first MAC is treated as the message and a second MAC is created by combining the key with that message.

The processing circuitry <NUM> is arranged to compare the local-remote vehicle signature to the verification signature transmitted from the device <NUM>. If the local-remote vehicle signature does not match the verification signature, then the failure end condition is met. The exchange terminates and the processing circuitry <NUM> does not actuate the motor. However, if the failure condition is not reached, then the processing circuitry <NUM> is arranged to end the verification iterations in response to the number of verification interactions meeting or exceeding the challenge count. In this case, the processing circuitry <NUM> is arranged to actuate the motor (e.g., actuate the lock).

<FIG> illustrates a flow diagram of an example of a vehicle implemented lock-actuation exchange <NUM>, according to an embodiment. The exchange <NUM> is illustrated from the vehicle's perspective, although a portion of the exchange is completed by a signaling device, such as a key fob, remote control, etc. The exchange <NUM> begins when the vehicle receives a request from the signaling device (operation <NUM>). The request can include an identifier (e.g., a VIN) and a message indicating the purpose of the request, such as open a door, open a trunk, open the hood, start the engine, etc..

The vehicle determines whether the request is directed to the vehicle by comparing the VIN with its own VIN. If the VIN, or other identifier being used, does not match, the exchange ends; the request was not meant for the vehicle. If the VINs do match, then the vehicle prepares the challenge-exchange by defining (e.g., computing, calculating, etc.) the number of messages to use in the exchange <NUM> (operation <NUM>). The vehicle initializes a loop counter (e.g., to zero) (operation <NUM>).

The loop counter is compared against the number of messages defined for the exchange <NUM>. As long as the loop counter is less than the defined number of messages, the loop continues. When the loop counter is equal to or greater than the defined number of messages, the loop exits, the vehicle performs the request (e.g., unlocks the door at operation <NUM>), and then the exchange <NUM> ends.

While the loop continues, the vehicle creates a vehicle signature by combining (e.g., concatenating, interleaving, etc.) a freshness value (e.g., a monotonic counter that increments with each iteration of the loop) to the VIN to create a message, and then creating a MAC from the message and a secret key shared with the signaling device (operation <NUM>). This vehicle signature is transmitted to the signaling device (<NUM>) along with the VIN and a current state of the freshness value. The signaling device then takes the message and computes its own version of the vehicle signature using the message, its own version of the private key, and the freshness value that is in sync with the vehicle counter (e.g., via a synchronization mechanism or received from the vehicle). If the signaling device's version of the vehicle signature matches that sent by the vehicle, then the signaling device creates a verification signature by creating another MAC using the secret key, the counter and the vehicle signature. For example, the signaling device can combine the freshness value to the received vehicle signature to create a new message, and then create the verification signature as a MAC with the key and the new message. The verification signature is then transmitted and received by the vehicle (operation <NUM>). The signaling device can also verify that the freshness value provided by the vehicle is valid by tracking the last freshness value used by the signaling device and verifying that the current freshness value is at least larger than that last value.

In the meantime, or in response to the receipt of the verification signature, the vehicle computes an expected remote vehicle signature by following the same practice as the signaling device: creating a new message from the previously computed vehicle signature and the freshness value, and then creating a new MAC with the key and the new message (operation <NUM>). This expected remote vehicle signature is compared to the received vehicle signature. If they do not match, then the exchange <NUM> terminates without actuating the lock (e.g., operation <NUM> does not occur). If the expected remote vehicle signature does match the received verification signature, then the loop counter is incremented (operation <NUM>) and the exchange continues as described above.

<FIG> illustrates a swim-lane diagram of an example message exchange between a key-fob and a vehicle performing a secure wireless lock-actuation exchange, according to an embodiment. The key-fob signals to the vehicle a request to unlock a door (message <NUM>). The message <NUM> identifies the vehicle by a VIN, and includes a message indicating the purpose of the request.

Once the message <NUM> is received, the vehicle can determine how many challenges this exchange will use by defining a challenge count (operation <NUM>). The challenge count can be determined by generating a random or pseudo-random value that is at least as large as a first threshold and optionally below a second threshold. Once the challenge count is determined, the vehicle initiates and controls the exit from an iterative message exchange (loop <NUM>).

The loop <NUM> includes the generation and transmission of a hash-based MAC (HMAC) from the vehicle to the key-fob (message <NUM>). The HMAC is created using an increment of a freshness value as determined by a monotonic counter on the vehicle, the VIN (or other agreed upon message), and a secret key). The VIN, or other agreed upon message, can also be included in the message <NUM>, along with the current freshness value (e.g., as incremented for this portion of the loop <NUM>).

The key-fob verifies the current freshness value by ensuring that it is greater than a last freshness value used by the key-fob (operation <NUM>). If the transmitted freshness value is not greater than the last value used by the key-fob, then the key-fob terminates the loop <NUM>. The key-fob can terminate the loop <NUM> by transmitting a termination message, transmitting a message than doesn't comply with the challenge exchanges, sending the message <NUM> again, or simply terminating communication. The key-fob verifies the HMAC (operation <NUM>) and, assuming that the verification was successful, generates and transmits an HMAC of the HMAC in message <NUM>) back to the vehicle (message <NUM>). The freshness value is added to the HMAC of message <NUM>, and the secret key is used to complete the HMAC of the message <NUM>.

Once received, the vehicle verifies the HMAC of message <NUM>. If the verification passes, the loop <NUM> continues until a number of exchanges defined by the challenge count is met. The loop <NUM> then exits and the vehicle unlocks the door (operation <NUM>). If, however, the verification of operation <NUM> is unsuccessful, the vehicle does not unlock the door and terminates the exchange. At this point, the key-fob would initiate a new exchange via a new request.

<FIG> illustrates a flow diagram of an example of a method <NUM> for secure wireless lock-actuation exchange, according to an embodiment. The operations of the method <NUM> are performed by hardware, such as that described above or below (e.g., processing circuitry).

At operation <NUM>, a request to actuate a lock is received from a device. In an example, a portion of the request is a vehicle identification number (VIN) for a vehicle. Here, the vehicle contains the lock. In an example, the request is to actuate the lock from a locked state to an unlocked state.

At operation <NUM>, a challenge count is calculated. In an example, the challenge count is above a threshold. In an example, the challenge count is below a second threshold. In an example, the challenge count is a random number.

In an example, calculating the challenge count includes selecting a portion of a message authentication code (MAC) generated using: a key, the portion of the request, and a monotonic counter. In an example, selecting the portion of the MAC includes comparing bytes in the MAC to the threshold until a current byte being compared meets or exceeds the threshold. In an example, the monotonic counter increments each time a request to actuate the lock is received.

At operation <NUM>, verification iterations are performed until an end condition is met. A verification iteration (e.g., each iteration) includes operations <NUM> through <NUM>, and the iterations are repeated until the end condition is met.

At operation <NUM>, a vehicle signature is created from a freshness value and a portion of the request (e.g., the VIN). In an example, the freshness value is generated from a monotonic counter. In an example, the monotonic counter is incremented at each iteration of the verification interactions.

In an example, the vehicle signature is a message authentication code (MAC) generated using: a key, the portion of the request, and the freshness value. In an example, the portion of the request and a current state of the freshness value are concatenated (e.g., the value of the monotonic counter is added to the beginning, end, or somewhere in the middle of the portion of the request).

In an example, the key is a symmetric key present on the device and on hardware performing the verification iterations. In an example, the hardware performing the verification iterations includes a secure storage in which the key is held.

At operation <NUM>, the vehicle signature is transmitted to the device. In an example, the freshness value is included in the transmission to the device. In an example, the device verifies that the transmitted freshness value is greater than any previous freshness value received by the device.

At operation <NUM>, a local-remote vehicle signature is computed from the vehicle signature. In an example, computing the local-remote vehicle signature includes computing a second MAC using the key and the vehicle signature.

At operation <NUM>, the local-remote vehicle signature is compared to a verification signature transmitted from the device. The device derived the verification signature from the previously transmitted vehicle signature.

The end condition for the verification iterations is at least one of the verification iterations reaching the challenge count or the comparing (operation <NUM>) determining that the local-remote vehicle signature does not match the verification signature. The first end condition is reached in response to each challenge being correctly met by the device. The second end condition means that a challenge by the device was not met, and the process terminates in failure.

At operation <NUM>, the lock is actuated in response to the counter being equal to or greater than the challenge count.

<FIG> illustrates a block diagram of an example machine <NUM> upon which any one or more of the techniques (e.g., methodologies) discussed herein can perform. Examples, as described herein, can include, or can operate by, logic or a number of components, or mechanisms in the machine <NUM>. Circuitry (e.g., processing circuitry) is a collection of circuits implemented in tangible entities of the machine <NUM> that include hardware (e.g., simple circuits, gates, logic, etc.). Circuitry membership can be flexible over time. Circuitries include members that can, alone or in combination, perform specified operations when operating. In an example, hardware of the circuitry can be immutably designed to carry out a specific operation (e.g., hardwired). In an example, the hardware of the circuitry can include variably connected physical components (e.g., execution units, transistors, simple circuits, etc.) including a machine readable medium physically modified (e.g., magnetically, electrically, moveable placement of invariant massed particles, etc.) to encode instructions of the specific operation. In connecting the physical components, the underlying electrical properties of a hardware constituent are changed, for example, from an insulator to a conductor or vice versa. The instructions enable embedded hardware (e.g., the execution units or a loading mechanism) to create members of the circuitry in hardware via the variable connections to carry out portions of the specific operation when in operation. Accordingly, in an example, the machine readable medium elements are part of the circuitry or are communicatively coupled to the other components of the circuitry when the device is operating. In an example, any of the physical components can be used in more than one member of more than one circuitry. For example, under operation, execution units can be used in a first circuit of a first circuitry at one point in time and reused by a second circuit in the first circuitry, or by a third circuit in a second circuitry at a different time. Additional examples of these components with respect to the machine <NUM> follow.

In alternative embodiments, the machine <NUM> can operate as a standalone device or can be connected (e.g., networked) to other machines. In a networked deployment, the machine <NUM> can operate in the capacity of a server machine, a client machine, or both in server-client network environments. In an example, the machine <NUM> can act as a peer machine in peer-to-peer (P2P) (or other distributed) network environment. The machine <NUM> can be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile telephone, a web appliance, a network router, switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine.

The machine (e.g., computer system) <NUM> can include a hardware processor <NUM> (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory <NUM>, a static memory (e.g., memory or storage for firmware, microcode, a basic-input-output (BIOS), unified extensible firmware interface (UEFI), etc.) <NUM>, and mass storage <NUM> (e.g., hard drive, tape drive, flash storage, or other block devices) some or all of which can communicate with each other via an interlink (e.g., bus) <NUM>. The machine <NUM> can further include a display unit <NUM>, an alphanumeric input device <NUM> (e.g., a keyboard), and a user interface (UI) navigation device <NUM> (e.g., a mouse). In an example, the display unit <NUM>, input device <NUM> and UI navigation device <NUM> can be a touch screen display. The machine <NUM> can additionally include a storage device (e.g., drive unit) <NUM>, a signal generation device <NUM> (e.g., a speaker), a network interface device <NUM>, and one or more sensors <NUM>, such as a global positioning system (GPS) sensor, compass, accelerometer, or other sensor. The machine <NUM> can include an output controller <NUM>, such as a serial (e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate or control one or more peripheral devices (e.g., a printer, card reader, etc.).

Registers of the processor <NUM>, the main memory <NUM>, the static memory <NUM>, or the mass storage <NUM> can be, or include, a machine readable medium <NUM> on which is stored one or more sets of data structures or instructions <NUM> (e.g., software) embodying or utilized by any one or more of the techniques or functions described herein. The instructions <NUM> can also reside, completely or at least partially, within any of registers of the processor <NUM>, the main memory <NUM>, the static memory <NUM>, or the mass storage <NUM> during execution thereof by the machine <NUM>. In an example, one or any combination of the hardware processor <NUM>, the main memory <NUM>, the static memory <NUM>, or the mass storage <NUM> can constitute the machine readable media <NUM>. While the machine readable medium <NUM> is illustrated as a single medium, the term "machine readable medium" can include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) configured to store the one or more instructions <NUM>.

The term "machine readable medium" can include any medium that is capable of storing, encoding, or carrying instructions for execution by the machine <NUM> and that cause the machine <NUM> to perform any one or more of the techniques of the present disclosure, or that is capable of storing, encoding or carrying data structures used by or associated with such instructions. Non-limiting machine readable medium examples can include solid-state memories, optical media, magnetic media, and signals (e.g., radio frequency signals, other photon based signals, sound signals, etc.). In an example, a non-transitory machine readable medium comprises a machine readable medium with a plurality of particles having invariant (e.g., rest) mass, and thus are compositions of matter. Accordingly, non-transitory machine-readable media are machine readable media that do not include transitory propagating signals. Specific examples of non-transitory machine readable media can include: non-volatile memory, such as semiconductor memory devices (e.g., Electrically Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.

The instructions <NUM> can be further transmitted or received over a communications network <NUM> using a transmission medium via the network interface device <NUM> utilizing any one of a number of transfer protocols (e.g., frame relay, internet protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Example communication networks can include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), mobile telephone networks (e.g., cellular networks), Plain Old Telephone (POTS) networks, and wireless data networks (e.g., Institute of Electrical and Electronics Engineers (IEEE) <NUM> family of standards known as Wi-Fi®, IEEE <NUM> family of standards known as WiMax®), IEEE <NUM>. <NUM> family of standards, peer-to-peer (P2P) networks, among others. In an example, the network interface device <NUM> can include one or more physical jacks (e.g., Ethernet, coaxial, or phone jacks) or one or more antennas to connect to the communications network <NUM>. In an example, the network interface device <NUM> can include a plurality of antennas to wirelessly communicate using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) techniques. The term "transmission medium" shall be taken to include any intangible medium that can store, encoding or carrying instructions for execution by the machine <NUM>, and includes digital or analog communications signals or other intangible medium to facilitate communication of such software. A transmission medium is a machine readable medium.

In the appended claims, the terms "including" and "in which" are used as the plain-English equivalents of the respective terms "comprising" and "wherein. " Also, in the following claims, the terms "including" and "comprising" are open-ended, that is, a system, device, article, or process that includes elements in addition to those listed after such a term in a claim are still deemed to fall within the scope of that claim.

Claim 1:
A method for secure wireless lock-actuation exchange, the method comprising:
receiving a request to actuate a lock from a device (<NUM>);
calculating a challenge count that is a random number and variable between requests to actuate the lock;
performing verification iterations until an end condition is met, a verification iteration comprising:
creating a vehicle signature from a freshness value and a portion of the request, the freshness value changing between verification iterations;
transmitting the vehicle signature to the device (<NUM>);
computing a local-remote vehicle signature from the vehicle signature;
incrementing a counter to track a number of the verification iterations performed;
receiving a verification signature transmitted from the device (<NUM>); and
comparing the local-remote vehicle signature to the verification signature transmitted from the device (<NUM>), the verification signature derived from the vehicle signature, wherein the end condition is at least one of the number of the verification iterations performed reaching the challenge count or the comparing determining that the local-remote vehicle signature does not match the verification signature; and
actuating the lock in response to the counter being equal to or greater than the challenge count.