Patent Application
20210237688
Aspects of various embodiments are directed to systems, such as keyless entry-and-go systems, using wireless access to vehicles such as automobiles including cars and the like.
In a keyless entry-and-go system for vehicles, the authentication can be compromised by so-called relay attacks, in which a malicious attacker uses wireless-communication circuitry in an attempt to make the system believe that a legitimate owner of the key fob has the key fob nearby the vehicle; whereas in reality, the legitimate owner of the key fob is distant from the vehicle and the relay attacker sends an unauthorized communication in attempt to access the vehicle as though the attacker is the legitimate key fob owner so that the system grants access to the attacker.
One approach for a counter-measure against relay attacks is the Ultra-Wideband (“UWB”) Distance Bounding. A drawback is that it requires a wideband transmitter which needs to conform to regulations with respect to the allowed bandwidth, power and repetition rate. These regulations often vary from country to country. Moreover, the transmitter needs significant chip area and battery power. Also, it has been reported that certain UWB distance bounding systems may be vulnerable to such attacks.
These and other matters have presented challenges, for a variety of applications.
Various example embodiments are directed to issues such as those above and others as may become apparent from the following disclosure concerning secure wireless communications for access to a vehicle.
In certain example embodiments, aspects of the present disclosure involve an apparatus including a data-processing circuit and wireless communications circuitry. The data-processing circuit is to compare a first RF background observed by a vehicle-located RF receiver which is part of a vehicle-located circuit secured to a vehicle, with a second RF background observed for a wireless-communications vehicle-access circuit that includes another RF receiver. In response, a distance metric is generated as an indication of a degree of similarity between the first RF background and the second RF background. The wireless communications circuitry is to communicate data between the vehicle-located circuit and the wireless-communications vehicle-access circuit and grant access to the vehicle, via the wireless-communications vehicle-access circuit, in response to the metric satisfying a threshold (e.g., an upper threshold setting a maximum-difference tolerance).
In a specific example, the data-processing circuit may be communicatively integrated with the vehicle-located circuit, and the wireless-communications vehicle-access circuit is part of a key fob. Also in a more specific example, the wireless-communications vehicle-access circuit may use ultra-wideband (UWB) RF transmissions of the monitored RF background for UWB-based distance bounding, and with a distance-based RF metric being at least partly based on the UWB-based distance bounding.
In other related embodiments relating to secure wireless communications for access to a vehicle, a method includes comparing a first RF background observed for a vehicle-located RF receiver that is part of a vehicle-located circuit secured to a vehicle, with a second RF background observed for a wireless-communications vehicle-access circuit that includes another RF receiver, and in response, producing a distance metric indicative of a degree of similarity between the first RF background and the second RF background. In response to the metric satisfying a threshold and conveying data between the vehicle-located circuit and the wireless-communications vehicle-access circuit, access to the vehicle via the wireless-communications vehicle-access circuit is granted; and if the threshold is not satisfied, the request for access is refused.
Using such a method, the metric may provide a distance measurement estimating a proximity relationship between the vehicle and the wireless-communications vehicle-access circuit, with the proximity relationship corresponding to a maximum distance for a user to visualize the vehicle while securing the wireless-communications vehicle-access circuit.
In a more specific implementation, such a method may involve the wireless-communications vehicle-access circuit observing the second RF background to provide an RF digest corresponding to a set of characteristics including characteristics associated with variability of spectral power of a number of frequency bands wherein communicating data between the vehicle-located circuit and the wireless-communications vehicle-access circuit includes conveying a representation of the RF digest. Also, logic/CPU processing circuitry may be integrated and used in connection with the wireless communications circuitry for vehicle-located circuit. With such logic/CPU processing circuitry, the vehicle-located circuit may use and/or compare representations of the RF digest to generate the metric and therein assess whether the metric satisfies a threshold for granting access to the vehicle.
The above discussion/summary is not intended to describe each embodiment or every implementation of the present disclosure. The figures and detailed description that follow also exemplify various embodiments.
Various example embodiments may be more completely understood in consideration of the following detailed description in connection with the accompanying drawings, in which:
While various embodiments discussed herein are amenable to modifications and alternative forms, aspects thereof have been shown by way of example in the drawings and will be described in detail. It should be understood, however, that the intention is not to limit the disclosure to the particular embodiments described. On the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the scope of the disclosure including aspects defined in the claims. In addition, the term “example” as used throughout this application is only by way of illustration, and not limitation.
Aspects of the present disclosure are believed to be applicable to a variety of different types of apparatuses, systems and methods involving wireless access to vehicles such as automobiles including cars and the like. In certain implementations, aspects of the present disclosure have been shown to be beneficial when used in the context of secure wireless access to such vehicles based on user-operated keyless entry apparatuses (e.g., systems and devices) including, for examples key fobs as used for access to vehicles. While not necessarily so limited, various aspects may be appreciated through the following discussion of non-limiting examples which use exemplary contexts.
Accordingly, in the following description various specific details are set forth to describe specific examples presented herein. It should be apparent to one skilled in the art, however, that one or more other examples and/or variations of these examples may be practiced without all the specific details given below. In other instances, well known features have not been described in detail so as not to obscure the description of the examples herein. For ease of illustration, the same reference numerals may be used in different diagrams to refer to the same elements or additional instances of the same element. Also, although aspects and features may in some cases be described in individual figures, it will be appreciated that features from one figure or embodiment can be combined with features of another figure or embodiment even though the combination is not explicitly shown or explicitly described as a combination.
Consistent with the present disclosure, one set of example embodiments exploit the wireless RF environment which is typical in many venues where a vehicle might be accessed via wireless communications between the vehicle and the vehicle owner. The wireless RF environment, at any point of time, may be expected to have several RF transmissions in the GHz range which are observable near both the car and the car owner. These may include, as examples, WLAN, Bluetooth, ZigBee, GSM, LTI, 5G, etc. Collectively, such RF transmissions form an RF background. The spectrum of this RF background may vary within a few milliseconds, and also may vary from one place to another, for example, places separated in distance from 20 meters to 30 meters. Power/signal-frequency characteristics such as signal strength, the frequencies of the strongest spectral components, etc. may be summarized in an RF digest (e.g., as a subset of all such RF transmissions) so as to provide a relatively constant parameter within a few meters distance of where the RF digest is created from the observed RF background. This parameter helps to indicate whether the place of the vehicle, while observing the RF background, is the same place or near the same place (e.g., a “common location” per a threshold used in comparing the two RF digests) as where key fob user/owner is while the key fob is observing the RF background.
According to one specific embodiment, such wireless RF environments are used by an example method to assess whether to grant access to a vehicle. The grant for access may be requested by a wireless-communications vehicle-access circuit (e.g., a key fob) that includes another RF receiver. In this context and according to the instant disclosure, the example method includes comparing a first RF background observed by a vehicle-located RF receiver that is part of a vehicle-located circuit secured to a vehicle, with a second RF background observed for a wireless-communications vehicle-access circuit that includes another RF receiver. In response, a distance metric is produced at or on behalf of the vehicle-located circuitry to indicate a degree of similarity between the first RF background and the second RF background. If this degree of similarity satisfies a threshold used in connection with comparison (per data communicated between the vehicle-located circuit and the wireless-communications vehicle-access circuit), access to the vehicle may be granted.
In connection with the above method and in contexts applicable to certain systems, the wireless-communications vehicle-access circuit includes or refers to a key fob associated with a wireless-communications key-entry circuit in the automobile, and each of the RF receivers (one for the key fob and another one for the vehicle) is configured to monitor a (common) range of an RF frequency spectrum that spans frequencies used by disparate RF communications systems. As such RF systems communicate disparate sets of information respective to and on behalf of the disparate RF communications systems, respective outputs of the RF receivers are used in the above-noted comparison.
In other related embodiments, each of the respective outputs may provide an RF digest corresponding to a set of characteristics including characteristics associated with variability of spectral power of a number of frequency bands. Also, data communicated between the vehicle-located circuit and the wireless-communications vehicle-access circuit may convey a representation of the RF background (or a representation of the RF digest), and in response logic/computer processing circuitry in the vehicle-located circuit may use the representations of the RF digest to generate the metric and assess whether the metric satisfies the threshold for granting access to the vehicle.
Further, the first and second RF backgrounds may be used to provide various types of assessment and/or estimation of distance measurements (upon which the metric may be based at least in part) for estimating a location-proximity relationship between the vehicle-located circuit and the wireless-communications vehicle-access circuit. In more specific embodiments, the metric provides a distance measurement estimating a proximity relationship between the vehicle and the wireless-communications vehicle-access circuit. The proximity relationship may correspond to a maximum distance for a user to visualize the vehicle while securing the wireless-communications vehicle-access circuit. In various examples, the maximum distance may be set as a fixed/default-programmed value in a range between 5 meters and 40 meters, and/or set as a user-programmable value in this or another range (typically in a range from a 2-3 meters up to 50 meters).
Another related specific example concerns an embodiment that uses the respectively-observed RF backgrounds as RF digests, for assessing whether the car and car owner are sufficiently near each other to mitigate and/or prevent a malicious attack. Each RF receiver may be configured to observe the background in an attempt to generate similar (or common) RF digests. The fob, in the hand of the car owner, may create an RF digest and send it to the car, and the car may create its own RF digest for comparing. These two RF digests should differ only slightly, provided the car and the fob are near to each other. If a relay attacker would want to compromise this system, nearly the whole spectrum of the RF background as observed by the RF receiver of the car would need to be transferred to the remote key fob, and this is not practicable given the typical limitations and/or limited bandwidth associated with such a relay attack. Moreover, the attacker would have to shield the key fob from the local RF background, to prevent the fob from creating a false RF digest or an RF digest different to the one intended by the attacker (because actually, this prevents creating a true RF digest), based on the superposition of the RF background transferred by the relay channel, based on the local RF background at the position, and based on the location of the key fob as perceived from another observation of the RF background.
In certain embodiments according to the instant disclosure, each of the generated RF digests provides radio-frequency-spectrum data which is specific to transmissions sent from one of the RF receivers to the other of the RF receivers, and in a way that would frustrate intervening relays likely used by an attacker and in a way that shows the respective locations as being a common location. In such example, the communications are considered direct and without an intervening transmission/relay system using other RF transceivers of an attacker.
Consistent with the above discussion, more detailed embodiments includes aspects or features implemented in a way to provide distance bounding which can be either used stand-alone, or used in a complementary manner with an existing UWB-based distance bounding system. Such detailed embodiments may include the following aspects and activities: the car requests from the key fob to provide an RF digest based on the RF background as seen by the key fob; the car calculates its own RF digest; the key fob transfers its RF digest to the car so that the car can compare the RF digests against one another. If the RF digests differ only slightly, the (vehicle-located) circuit which is processing the comparison may then indicate whether the fob is near enough to the car (as a secure/safe communication), or the fob is not near enough to the car via a larger difference between RF digests. This procedure is thereby used to indicate whether the vehicle access attempt likely is a relay attack. Moreover, characteristics that are unique even from one transmitter to another of the same type (e.g., turn-on transient behavior), may be included in the RF digest for defying such a relay attack. The vehicle-access circuit (e.g., key fob) may monitor the RF spectrum and use observed UWB RF transmissions from the monitored RF spectrum for UWB-based distance bounding, with the metric being at least partly based on the UWB-based distance bounding.
In more detailed/experimental embodiments specific to certain types of RF environments, the system might automatically assess whether a sufficiently good RF background is available for certain steps or methodology to be used. For these embodiments, a sufficiently good RF background refers to the RF background that has strongly varying signals when observed at different positions. This applies for RF signals intended for short-range communications including, as examples, Bluetooth (both “classic” and “Low Energy”), WLAN, GSM, LTI, 5G, and ZigBee; however, this does not apply for broadcast signals such as for radio and television (TV). Also, in a sufficiently good RF background, the RF background strongly varies from one time slot to another, and this holds for above-mentioned short-range communications signals.
Turning now to the illustrations and in accordance with the present disclosure as discussed above,
As indicated beginning at 125, the RF digest may be optionally encoded or encrypted (the latter via an encryption key) for more secure communications. The vehicle circuitry (e.g., CPU) may be communicatively integrated with the vehicle-located RF receiver and with the vehicle-located wireless transceiver, the latter being used to communicate with the key fob. At 140, vehicle-located circuitry compares the RF digests (or other form of the observed RF background backgrounds) to determine whether to grant access (at 145) or to decline or abort (at 150).
Also in accordance with the present disclosure,
For illustrative purposes in connection with example types of circuits that may be used in connection with the various example embodiments of the present disclosure,
The key fob device 310 includes circuits to complement the operations of the circuits in the vehicle-located circuitry, also consistent with the above discussion of example embodiments. These circuits include a (remote) transceiver 360 (having an antenna 362), and a data-processing circuit depicted as another computer processor (CPU) and/or logic circuitry 370, and an RF receiver 375 (having an antenna 371) to observe RF background at the location of the key fob device. The transceiver 342 and the (remote) transceiver 360 may communicate with one another as described in connection with the example protocols associated with
In connection with embodiments of the types disclosed above, the wireless data communications (between the vehicle circuitry and the circuitry of the key fob) may include a transmission from the key fob to the vehicle-located circuit with the transmission referenced in real time, or near real time, to an edge corresponding to an abrupt change of a property of the RF signal as observed in at least one of the first and second RF backgrounds by an associated one of the RF receivers. The threshold in this example may correspond at least in part to a measurement of the time-of-flight associated with the transmission. In these regards, the property of the RF signal may refer to or include an amplitude of a given spectral line and/or power within a certain frequency band.
More specifically and as an example way of carrying out this time-of-flight feature in connection with the embodiments shown in connection with the flow depicted in
With this approach also involving such a time-indicative comparison, if there were a relay attack scenario, the attacker would likely use a pair of relay stations. In such a scenario, data indicative of the RF background edge would travel from the attacker's relay station (near the vehicle) to the other relay station (near the key fob), and would then be processed by the circuitry of the key fob. The RF digest then needs additional travel time from the key fob to the vehicle. This additional time-of-flight, via the above-described time-indicative comparison, would reveal the relay attack.
In related embodiments which may be used as further alternatives to the embodiments disclosed above, the instant disclosure addresses and inhibits an attacker from performing a relay attack by creating deterministic high-amplitude fake RF background signals, and to create identical signals both at the location of the car and the remote (far distant) location of the key fob. This may be counteracted by: observing the signal amplitude over a longer time before creating the respective RF digests (e.g., before 105 and 110 of
In this way, the respective RF receivers may be used to mitigate possible interference ensuing from undesired or malicious RF signals which are not specific to an RF signal identification for a location common to the first and second RF backgrounds by adjusting at least one RF signal parameter used by the RF receivers to observe the first and second RF backgrounds. The RF signal parameter or RF signal parameters may include one or more of the following: timings or time duration used for the RF receivers observing the first and second RF backgrounds; and assessing if the transmission directions of certain RF signals in the first and second RF backgrounds appear to be co-located.
Accordingly, by observing the signal amplitude over a longer time and/or by checking the direction of the RF background signals, an attacker would not readily spoof such a system by using fake RF background signals. Also in this case, a relay attacker would need to use two different transmitters to create the two (fake) RF background signals. These would then have different location-specific RF backgrounds and/or digests and with the RF digests differing, and the relay attack would be detected and the request denied. In such embodiments, the wireless-communications reflect the actual RF spectrum and at least one type of RF signal types (or signal parameter type) is used as a reference for timing-based distance bounding. Also, the metric may be at least partly based on the reference.
In other related examples, by observing the RF background and taking into account content of one or more specific broadcast signals (e.g., at least one TV (television)broadcast signal and/or at least one radio broadcast signal), an attacker may also be prevented from readily spoofing such a system. In connection with the previously-discussed embodiments, specific implementations may be designed so that they do not use radio/TV broadcast signals (or they are deemphasized relative to the other mentioned signal types) as part of the RF background and/or for creating the RF digest. This follows since they do not change much in space, as they are intended to cover a large region. In accordance with yet another aspect of the instant disclosure, implementations may choose to use a specific channel of radio/TV broadcast signals in the RF background and/or for creating the RF digest for their signal-content properties which can be used to reveal whether the RF background (including such content of a broadcast station) may be closer to the vehicle than to the RF receiver circuitry of the key fob. In case of a relay attack, a key fob receiving such a broadcast station's signal and sending an RF digest that is related to the signal's content to the vehicle, will suffer a long/distinguishable time delay. Again, the different location-specific RF digest of the two transmitters in case of a relay attack would reveal the relay attack.
As further alternatives to the embodiments disclosed above and in connection with the above discussion of examples, another example of embodiment types according to the instant disclosure also refers to the use of radio/TV broadcast signals and addresses the possibility that an attacker would use his/her own fake radio/TV signal. This scenario may be addressed by using an encrypted broadcast signal. The signal is encrypted using a private key, and each receiver has a public key. This holds both for the vehicle receiver and the fob receiver. Such public key encryption is used to prevent attacks on the signal, for example, to prevent use of malicious transmissions of traffic information or emergency warnings. In this case, the car and the fob would not react on the attacker's fake signal, only on the legitimate broadcast signal. With this type of example embodiment, the remaining aspects of operation by the respective circuitries of the vehicle and key fob may follow as described above with the previously-disclosed embodiments, and where the time-of-flight for transmitters that are closer to the car than to the key fob, this approach rules out any relay attack.
Also, in this context and scenario, the RF receivers may be configured to monitor an encrypted signal transmission from a certain TV/radio broadcast station and, in response, provide the metric based at least in part on decryption of the signal transmission and then assess whether the certain television/radio broadcast station is closer to the vehicle-located circuit as secured to the vehicle than to the wireless-communications vehicle-access circuit that includes the other RF receiver.
The skilled artisan would recognize that various terminology as used in the Specification (including claims) connote a plain meaning in the art unless otherwise indicated. As examples, the Specification describes and/or illustrates aspects useful for implementing the claimed disclosure by way of various circuits or circuitry which may be illustrated as or using terms such as blocks, modules, device, system, controller, and/or other circuit-type depictions (e.g., reference numerals of
Based upon the above discussion and illustrations, those skilled in the art will readily recognize that various modifications and changes may be made to the various embodiments without strictly following the exemplary embodiments and applications illustrated and described herein. For example, methods as exemplified in the Figures may involve steps carried out in various orders, with one or more aspects of the embodiments herein retained, or may involve fewer or more steps. For instance, communicating such data between the vehicle-located circuit and the wireless-communications vehicle-access circuit (e.g., as in
Such modifications do not depart from the true spirit and scope of various aspects of the disclosure, including aspects set forth in the claims
