Patent Description:
Certain classes of wireless communications systems employ transponders and base stations that communicate with each other. In one example, a wireless transponder may be used to enable passive keyless entry (PKE) for unlocking the doors of a vehicle, or passive keyless go (PKG) for enabling an ignition circuit. In each case, the wireless transponder communicates with a base station in the vehicle in a series of operations that are intended to authenticate the transponder and ensure that the transponder is within a defined distance of the vehicle.

PKE and PKG systems can be susceptible to so-called relay attacks, in which signals transmitted by transceivers in a vehicle are relayed by an attacker to and from a transponder that may be at a remote location, for example inside the vehicle owner's house or on the owner's person. The attacker may be able to access the vehicle by relaying signals between the transponder and the vehicle to gain entry and to enable the vehicle ignition circuit.

One method of reducing susceptibility to such relay attacks is to employ multiple antennae in the vehicle, which together provide a challenge signal to a transponder. Upon receiving the challenge signal, the transponder determines a strength of the received signals in three orthogonal directions using three antennae arranged to receive signals in mutually orthogonal directions. The transponder then responds by transmitting an encoded signal containing the measurements, and a controller in the vehicle determines from the received signal whether the vector information meets predetermined criteria, and enables access to the vehicle, for example to unlock or enable the ignition circuit, only if the criteria are met. Such a system is disclosed in <CIT>.

Further methods for reducing susceptibility to relay attacks may involve generating superposed signals from two or more antennae in a vehicle, and determining whether a transponder is within physical range of the vehicle, for example as disclosed in <CIT> or <CIT>. In such a system, first and second signals may be transmitted sequentially from first and second antennae, followed by a third signal transmitted from both antennae. The third signal is required to deliver at least two valid vector components that are above the noise level at the receiver (i.e. the transponder) to defend against a relay attack. If this criterion is not met, the vehicle controller determines that the transponder response is not valid and does not enable access to the vehicle. A problem with this approach is that in some cases a valid transponder in a valid location, i.e. within proximity of the vehicle, may receive a superposition of signals that does not result in two or more vector components above the noise level, and the vehicle controller incorrectly refuses access.

In accordance with a first aspect there is provided a method of wireless communication between a vehicle base station and a transponder, the method comprising:.

An advantage of the above defined method is that account can be taken of the presence of 'black holes', being regions where the transponder may determine that a superposed signal effectively cancels out to leave a signal having a vector in only one direction, which would otherwise prevent authentication from occurring.

The adjustment factor may increase or decrease a signal strength magnitude emitted from the one of the first and second antennae, for example by <NUM>% or more. The adjustment factor may for example increase or decrease a signal strength magnitude emitted from the one of the first and second antennae by up to around <NUM>%, <NUM>% or up to <NUM>%.

The method may further comprise unlocking the vehicle upon authenticating the transponder and/or activating an ignition circuit of the vehicle.

In some examples step iv) may be repeated no more than once. If, after repeating the step, there is still no more than one detected vector component are above the threshold noise level, the possibility of the transponder actually being in a valid location is very low.

In other examples if, after repeating step iv), fewer than two of the three detected vector components are above the threshold noise level, the adjustment factor may be changed and step iv) repeated again. In such cases step iv) may be repeated no more than twice, given that the possibility of the transponder being in a valid location after still not recognising the required number of vector components will be very low.

In accordance with a second aspect there is provided a system for wireless authentication of a transponder, the system comprising:.

The adjustment factor may increase or decreases a signal strength magnitude emitted from the one of the first and second antennae, for example by <NUM>% or more. The adjustment factor may for example increase or decrease a signal strength magnitude emitted from the one of the first and second antennae by up to <NUM>%, <NUM>% or up to <NUM>%.

The base station may be configured to cause the vehicle to be unlocked upon authentication of the transponder and/or cause an ignition circuit of the vehicle to be activated.

In some examples the base station may be configured to repeat step iv) no more than once.

In other examples if, after repeating step iv), fewer than two of the three detected vector components are above the threshold noise level, the base station may be configured to change the adjustment factor and repeat step iv) again. In such cases the base station may be configured to repeat step iv) no more than twice.

In accordance with a third aspect there is provided a computer program comprising instructions that, when executed, cause a processor for a vehicle base station to perform the method according to the first aspect.

There may be provided a computer program, which when run on a computer, causes the computer to configure any apparatus, including a circuit, controller, sensor, filter, or device disclosed herein or perform any method disclosed herein. The computer program may be a software implementation, and the computer may be considered as any appropriate hardware, including a digital signal processor, a microcontroller, and an implementation in read only memory (ROM), erasable programmable read only memory (EPROM) or electronically erasable programmable read only memory (EEPROM), as nonlimiting examples. The software implementation may be an assembly program.

The computer program may be provided on a computer readable medium, which may be a physical computer readable medium, such as a disc or a memory device, or may be embodied as a transient signal. Such a transient signal may be a network download, including an internet download.

Embodiments will be described, by way of example only, with reference to the drawings, in which.

It should be noted that the Figures are diagrammatic and not drawn to scale. Relative dimensions and proportions of parts of these Figures have been shown exaggerated or reduced in size, for the sake of clarity and convenience in the drawings. The same reference signs are generally used to refer to corresponding or similar feature in modified and different embodiments.

<FIG> shows an example wireless system <NUM> with field superposition. The system <NUM> includes first and second antennae <NUM>, <NUM>, which may be respectively a main antenna <NUM> and an interior antenna <NUM>. The antennae <NUM>, <NUM> pass signals from a base station/controller <NUM> to a remote transponder <NUM>. The interior antenna <NUM> is shielded, such as by a vehicle shell or other component, from direct access by the transponder <NUM>.

The base station <NUM> drives the main and interior antennae <NUM> and <NUM>, and the transponder <NUM> detects the signals from the antennae, including vector components for each signal. The transponder <NUM> communicates encrypted information characterizing these detected signals back to the base station <NUM>, which uses the information to generate field superposition factors for use in driving each antenna. The base station <NUM> further encrypts and sends the superposition factors to the transponder <NUM>.

The base station <NUM> then applies the respective superposition factors to drive each antenna at the same time in-phase. The transponder <NUM> detects the superposed signal, which is used together with the superposition factors to determine whether the superposed signal, including a combined signal from each antenna, is within an error factor. In some implementations, the superposed signal is authenticated by determining whether each of three vector components (e.g., x, y and z) is within an error factor for that vector. If the combined signal is within the error factor, the transponder is authenticated. This authentication can be used, for example, to operate or enable a system, such as an entry/locking mechanism or an ignition mechanism. In addition, calculations for authenticating the signal can be made at one or both of the transponder and the base station, with the transponder communicating information characterizing the received signals to the base station for such a calculation in the latter example.

<FIG> shows an example wireless automotive system <NUM> with field superposition. The system <NUM> includes a base station <NUM> within a vehicle <NUM>, an external first antenna <NUM> and an internal second antenna <NUM>. An optional external third antenna <NUM> is located opposite the first antenna <NUM>, relative to the vehicle <NUM>. The positioning of the respective antennas can be varied to suit different embodiments and application to different types of vehicles <NUM>, with both the vehicle and the antenna positioning being exemplary of a multitude of vehicles and antenna configurations (with the first antenna <NUM> being shielded).

The first and second antennae <NUM>, <NUM> are each configured to transmit a signal that is detectable by a transponder <NUM> within the indicated driver detection area <NUM>, which may for example be within range of a door handle of the vehicle <NUM>. When used, an external fourth antenna <NUM> may be also configured to transmit a signal to a transponder <NUM> within the driver detection area <NUM>.

The vehicle <NUM> shields the interior second antenna <NUM> from an external transponder, such that a signal from the interior second antenna <NUM> is not directly detectable by a transponder in the driver detection area <NUM>. For example, glass, metal or other components of the vehicle <NUM> may distort the signal sent by the interior antenna <NUM>, such that the transponder <NUM> does not directly detect the signal as generated at the antenna <NUM>.

By way of example, a transponder <NUM> is shown placed in the driver detection area <NUM>, representing an exemplary interaction with the system <NUM>. Optionally, the transponder <NUM> is part of the system, and operates to communicate signals with the base station <NUM> in the vehicle <NUM>, via one or both antennae <NUM> and <NUM> (or <NUM> where implemented). As in the system <NUM> in <FIG>, the base station <NUM> is connected to each of the antennae <NUM>, <NUM> (and <NUM>, <NUM> where implemented) to send and receive signals via the antennae.

The base station <NUM> (e.g., a circuit within the vehicle <NUM>) drives the antennae <NUM> and <NUM> at an initial transmission current for each antenna (e.g., the currents may be different, with the antennas subsequently driven). Signals with respective vector components corresponding to each antenna <NUM> and <NUM> are detected at a transponder (such as <NUM>) and sent back (e.g., encrypted) to the base station in vehicle <NUM>. The base station uses the detected vector components for each antenna <NUM> and <NUM>, together with a random field strength value (high enough to account for noise/errors), to generate field strength factors to apply to respective signals used to subsequently drive each of the antennae.

The base station <NUM> then drives the antennae <NUM> and <NUM>, at the same time and with the same phase, with a current, for each antenna, that respectively corresponds to the initial current previously applied to that antenna, multiplied by the field strength factor for that antenna. The superposed signal detected at the transponder is processed with error data corresponding to the respective antennas, and the known field strength factors for each antenna to determine a condition of authenticity of the transponder <NUM>. Such authenticity may be determined, for example, as determining whether the transponder <NUM> receiving and processing the signal is in the driver detection area <NUM>, or has received a signal in this detection area as detected by a relaying transponder. For instance, where transponder <NUM> is a relaying transponder, and a transponder <NUM> is actually authenticated for the vehicle <NUM> but is out of the driver detection area <NUM>, the relaying transponder <NUM> is incapable of generating the fields from each antenna with respective vector values.

Further details of the method of transponder authentication using superposition are disclosed in <CIT>, from which <FIG> and the above passages are derived.

<FIG> illustrates schematically how a vector <NUM> representing the strength and direction of a signal may be broken down into three components x, y, z along respective mutually orthogonal axes, the vector <NUM> representing a geometric sum of the three components.

<FIG> illustrate schematically the effect of superposition of signals transmitted by first and second antennae, which may for example be the first and second antennae <NUM>, <NUM> of the example system <NUM> shown in <FIG> or the first and second antennae <NUM>, <NUM> of the system <NUM> shown in <FIG>. In each case the signal shown is that received by the transponder <NUM>, <NUM>, which is located at an unknown position relative to the antennae. The signal <NUM> from the first antenna is superposed with the signal <NUM> from the second antenna, resulting in the superposed signal <NUM>. Because the y components of the first and second signals <NUM>, <NUM> are sufficiently close in magnitude, they effectively cancel each other out, resulting in the y component of the superposed signal <NUM> being null. In practice, a null result will result if the superposed signal results in a component being below a threshold noise level. The resulting superposed signal <NUM> consequently effectively contains only two components, in this case in the x and z directions.

In some cases more than one component of the first and second signals <NUM>, <NUM> may cancel out, resulting in null components on two axes and only a single resulting component. In accordance with the above mentioned authentication process, this would be interpreted as resulting from a relay station attack, and the transponder would not be authenticated. Depending on the specific field pattern resulting from the antenna positions, vehicle configuration and surrounding environment, there may exist multiple relative locations and orientations where a transponder will not be authenticated due to the superposition of signals resulting in a component along only one axis.

To take into account the possibility of there being such 'black holes' where the transponder will not be authenticated if a response from the transducer results in fewer than two components above a threshold noise level being detected, an additional sequence of operations may be included in a method of authenticating the transponder.

<FIG> illustrates schematically the effect of applying an adjustment factor to one of the signals transmitted by the antennae. In this case, the signal <NUM> from the second antenna is reduced in magnitude, for example by around <NUM>%, while the signal <NUM> from the first antenna is maintained at the same level as previously. The resulting superposed signal <NUM> now has components in all three orthogonal axes that are above a noise level. Consequently, the resulting signal transmitted from the transponder to the base station may result in the transponder being authenticated and access allowed to the vehicle.

The signal from the second antenna may be reduced by reducing the current supplied to the antenna by the base station. The signal may alternatively be increased to provide the same effect. A difference in magnitude between the current supplied to the second antenna may be at least <NUM>%, and may be up to around <NUM>%, <NUM>% or up to <NUM>%.

<FIG> is a schematic diagram illustrating a series of steps involved in an example method of authenticating a transponder, with the left hand side indicating operations performed at the base station and antennae, and the right hand side indicating operations performed by the transponder. In a first step <NUM> a first transmission <NUM> is initiated from the first antenna. This transmission <NUM> is received <NUM> by the transponder, which then responds by transmitting a signal <NUM> encoding the vector components of the received signal. This signal <NUM> is received <NUM> by the first antenna. At step <NUM> a second transmission <NUM> is initiated from the second antenna. This second transmission <NUM> is received <NUM> at the transponder, which then responds by transmitting a signal <NUM> encoding the vector components of the received signal. This signal <NUM> is received at step <NUM> by the second antenna. The base station then, at step <NUM>, calculates superposition factors for the first and second antennae based upon the separate vector component information received from the transponder and at step <NUM> concurrently drives the first and second antennae using the same phase, respectively using the driving currents for the first and second transmissions multiplied by the calculated superposition factors, sending a superposed signal <NUM> to the transponder. The superposed signals are detected <NUM> by the transponder, which then responds by transmitting a signal <NUM> encoding the vector components of the received signal, the signal <NUM> being received <NUM> at the base station. At step <NUM> the base station determines whether two of the three detected vector components are above a threshold noise level. If fewer than two of the three detected vector components are above the threshold noise level, step <NUM> is repeated with one of the first and second antennae driven by the first driving current multiplied by the calculated superposition factors and by an adjustment factor. If two of the three detected vector components are above the threshold noise level, at step <NUM> the base station authenticates the transponder in response to the detected superposed vector components being within an error-based range of the sum of the separate vector components for each of the first and second antennae as multiplied respectively by the superposition factors for the first and second antennae. The base station may then unlock the vehicle and/or enable the ignition circuit of the vehicle.

In the unlikely event that repeating step <NUM> with an adjustment factor still does not result in two detected vector components being above the threshold noise level, the base station may alter the adjustment factor and repeat the step. Otherwise the base station may refuse to authenticate the transponder, and the process starts again.

From reading the present disclosure, other variations and modifications will be apparent to the skilled person. Such variations and modifications may involve equivalent and other features which are already known in the art of wireless communications, and which may be used instead of, or in addition to, features already described herein.

The appended claims define the scope of the disclosure of the present invention.

Features which are described in the context of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination.

Claim 1:
A method of wireless communication between a vehicle base station (<NUM>) and a transponder (<NUM>), the method comprising:
i) driving first and second antennae (<NUM>, <NUM>) on the vehicle by the vehicle base station (<NUM>) using first driving currents, the first antenna (<NUM>) being separated from the transponder (<NUM>) by a portion of the vehicle in which the vehicle base station (<NUM>) resides;
ii) detecting three separate mutually orthogonal vector components of the respective fields emitted by the first and second antennae (<NUM>, <NUM>) and received at the transponder (<NUM>);
iii) calculating superposition factors for the first and second antennae (<NUM>, <NUM>) based upon the separate vector components;
iv) concurrently driving the first and second antennae (<NUM>, <NUM>) using the same phase, respectively using the first driving currents multiplied by the calculated superposition factors;
v) detecting three mutually orthogonal vector components of a superposed signal including signals from both antennae (<NUM>, <NUM>) received at the transponder (<NUM>);
vi) determining whether two of the three detected vector components are above a threshold noise level;
vii) if fewer than two of the three detected vector components are above the threshold noise level, repeating step iv) with the second antenna (<NUM>) being driven by the first driving current multiplied by the calculated superposition factors and by an adjustment factor while the first antenna (<NUM>) is driven by the first driving current maintained at the same level as previously; and
viii) if two of the three detected vector components are above the threshold noise level, authenticating the transponder (<NUM>) in response to the detected superposed vector components being within an error-based range of the sum of the separate vector components for each of the first and second antennae as multiplied respectively by the superposition factors for the first and second antennae.