The present disclosure relates to a wireless device and a method for controlling the wireless device.
There is a method for relay attack resistant communication. In the method for the relay attack resistant communication, a master wireless device that transmits a synchronization signal to a slave wireless device is included, the synchronization signal includes timing information, and the timing information includes a common time reference and a time slot duration for coordinating master and slave communication time slots so that alternating TX and RX roll patterns are provided to the master and to the slave. The master analyzes slave packet data received from the slave to identify an overlap of transmissions from the master and slave packet data, which is a packet error, and in the case of the packet error, the communication from the master to the slave is interrupted to prevent a relay attack (for example, see Patent Document 1).
According to one embodiment of the present disclosure, a wireless device includes a transmitter; a receiver; and a control device configured to obtain a first difference of a predetermined physical quantity, in a unit time, of a predetermined-frequency signal transmitted by the transmitter to another device, and calculate a second difference of the predetermined physical quantity, in the unit time, of the predetermined-frequency signal received by the another device, based on a signal received by the receiver; and perform a determination process of comparing the first difference and the second difference to determine legitimacy of the signal received by the receiver.
In a method for the relay attack resistant communication, the packet error is detected by using a common time reference and a time slot duration for coordinating the master and slave communication time slots. Therefore, for example, in a case where a master device serving as “master” changes a phase of a transmission signal to be transmitted to a slave device serving as “slave”, if an illegitimate slave device receives a transmission signal and impersonates a legitimate slave device by changing a phase of the transmission signal, the illegitimate slave device cannot be detected. The relay attack method for changing the phase of the transmission signal and impersonating a legitimate slave device is called early detect late commitment (EDLC).
A wireless device that can detect a relay attack of impersonating a legitimate device by changing a phase of a reception signal, and a method for controlling the wireless device can be provided.
In the following, an embodiment in which a wireless device and a method for controlling the wireless device of the present disclosure are applied will be described.
At least either the distance measuring device 100A of the vehicle 10 or the distance measuring device 100B of the smart key 20 measures a distance between the vehicle 10 and the smart key 20, and locks of a door, a trunk, and the like of the vehicle 10 are unlocked when the distance measured by the distance measuring device 100A or 100B is an appropriate distance.
Here, as an example, it is assumed that the distance measuring device 100A of the vehicle 10 performs distance measuring, and notifies the distance measuring device 100B of the smart key 20 of a result of the distance measuring. The distance measuring devices 100A and 100B have the same configuration, as an example. Therefore, in the following description, when the distance measuring devices 100A and 100B are not distinguished, they are simply referred to as a distance measuring device 100. The distance measuring device 100B that does not perform distance measuring among the distance measuring device 100A of the vehicle 10 and the distance measuring device 100B of the smart key 20 is an example of another device. It is noted that it is possible to handle the distance measuring device 100A as a master device and the distance measuring device 100B as a slave device, or conversely, to handle the distance measuring device 100B as a master device and the distance measuring device 100A as a slave device, but here, description will be given without such handling.
The distance measuring device 100A includes an antenna 101, a power amplifier (PA) 110, a low noise amplifier (LNA) 120, an orthogonal modulator (OM) 130, an orthogonal demodulator (ODM) 140, a voltage controlled oscillator (VCO) 150, a phase locked loop (PLL) 155, a codec processor 160, and a control device 170. The wireless device 100R includes components other than a phase measuring unit 178 and a distance measuring unit 179 of the control device 170 among the components of the distance measuring device 100A. Therefore, the reference symbol 100R is written in parentheses for the components other than the phase measuring unit 178 and the distance measuring unit 179 of the control device 170 among the components of the distance measuring device 100A.
The antenna 101 performs communication with the antenna 101 of the distance measuring device 100B in the smart key 20. The antenna 101 is connected to the PA 110 and the LNA 120. Here, a switch for switching the connection destination of the antenna 101 to either the PA 110 or the LNA 120 is omitted.
The PA 110 is provided between the OM 130 and the antenna 101, and amplifies a modulated signal for transmission that is input from the OM 130 and outputs the amplified signal to the antenna 101. The PA 110 is an amplifier for transmission.
The LNA 120 is provided between the antenna 101 and the ODM 140, and amplifies a radio wave received by the antenna 101 with low noise and outputs the amplified radio wave to the ODM 140. The LNA 120 is an amplifier for reception.
The OM 130 is an example of a transmitter, and modulates an I/Q signal input from the codec processor 160 by using a high-frequency signal input from the VCO 150, and outputs the modulated signal to the PA 110 as a modulated signal for transmission.
The ODM 140 is an example of a receiver, and demodulates a signal output from the LNA 120 by using a high-frequency signal input from the VCO 150 to obtain the I/Q signal, and outputs the I/Q signal to the codec processor 160. The signal output from the LNA 120 is a signal received by the distance measuring device 100A from the distance measuring device 100B.
The VCO 150 oscillates at the frequency set by the PLL 155. The VCO 150 can oscillate at multiple frequencies set by the PLL 155.
The PLL 155 sets the frequency at which the VCO 150 oscillates. The PLL 155 can set multiple frequencies in the VCO 150.
The codec processor 160 includes an analog to digital converter (ADC) and a digital to analog converter (DAC), and performs codec processing. The codec processor 160 performs detection of a BLE (registered trademark) packet, address determination processing, and the like. More specifically, the codec processor 160 performs digital conversion (ADC processing) on the I/Q signal processed in the ODM 140, and converts the I/Q signal into the packet information of BLE. Additionally, the codec processor 160 generates the I/Q signal (divides an I signal and a Q signal) from a BLE packet (digital signal) input from the control device 170, converts the I/Q signal into an analog signal by DAC processing, and outputs the analog signal to the OM 130 as the I/Q signal serving as a transmission signal.
In the following, a predetermined-frequency signal that is transmitted from the OM 130 of the distance measuring device 100A to the distance measuring device 100B is referred to as a transmission signal. Additionally, a signal transmitted as the transmission signal by the distance measuring device 100A and received by another device is referred to as a reception signal.
The control device 170 includes a main control unit 171, a setting unit 172, a notifying unit 173, a switching unit 174, a phase acquiring unit 175, a difference calculating unit 176, a determining unit 177, the phase measuring unit 178, the distance measuring unit 179, and a memory 170M. The memory 170M is an example of a storage unit. The control device 170 is implemented by a microcomputer including a central processing unit (CPU), a random access memory (RAM), a read only memory (ROM), an input/output interface, an internal bus, and the like.
The main control unit 171, the setting unit 172, the notifying unit 173, the switching unit 174, the phase acquiring unit 175, the difference calculating unit 176, the determining unit 177, the phase measuring unit 178, and the distance measuring unit 179 indicate functions of a program executed by the control device 170 as functional blocks. Additionally, the memory 170M functionally represents a memory of the control device 170.
The main control unit 171 is a processing unit that controls processing of the control device 170, and performs processing other than processing performed by the setting unit 172, the notifying unit 173, the switching unit 174, the phase acquiring unit 175, the difference calculating unit 176, the determining unit 177, the phase measuring unit 178, and the distance measuring unit 179.
The setting unit 172 sets the frequency (the predetermined frequency) and the phase of the signal to be transmitted from the distance measuring device 100A to the distance measuring device 100B. Additionally, the distance measuring device 100B transmits, to the distance measuring device 100A, a signal having a frequency the same as the frequency of the signal transmitted to the distance measuring device 100A. Here, the same frequency of the signal transmitted by the distance measuring devices 100A and 100B to each other may be determined in advance between the distance measuring devices 100A and 100B. Data representing the frequency may be shared by using the BLE packet communication.
The notifying unit 173 notifies the notifying unit 173 of the distance measuring device 100B in the smart key 20 of the result of the distance measuring. For the notification, a BLE packet communication having a frequency different from that of the communication for the distance measuring is used. In the notification, the result of the distance measuring and the like may be written in a payload of the BLE packet.
The switching unit 174 switches between a transmission state in which the OM 130 transmits the signal and a reception state in which the ODM 140 receives the signal. The switching unit 174 allows the PA 110 to amplify the signal in the transmission state and allows the LNA to amplify the signal in the reception state. The switching unit 174 provides a stabilization time for stabilizing the phase and the frequency when switching between the transmission state and the reception state.
The phase acquiring unit 175 acquires, from the distance measuring device 100B, the phase when the distance measuring device 100B receives the predetermined-frequency transmission signal that is transmitted by the distance measuring device 100A, as the reception signal. The phase acquiring unit 175 acquires data representing the phase from the distance measuring device 100B by the BLE packet communication having a frequency different from that of the communication for the distance measuring. The data representing the phase may be written in the payload of the BLE packet. Additionally, the data representing the phase may be measured by the phase measuring unit 178 of the distance measuring device 100B and transmitted to the distance measuring device 100A.
The difference calculating unit 176 obtains a first difference of the phase of the predetermined-frequency transmission signal transmitted by the OM 130 to the distance measuring device 100B, and calculates a second difference of the phase of the predetermined-frequency reception signal received by another device, using the data representing the phase acquired by the phase acquiring unit 175 based on the signal received by the ODM 140. The phase is an example of a predetermined physical quantity.
Another device is either the distance measuring device 100B or the illegitimate device. The distance measuring device 100B is a legitimate device having legitimate access authority to the distance measuring device 100A. The illegitimate device is a device that impersonates the distance measuring device 100B, which is the legitimate device, and is a device that does not have legitimate access authority to the distance measuring device 100A. The first difference and the second difference are used when determining the legitimacy of the device that is a transmission source having transmitted the signal received by the ODM 140. Methods for calculating the first difference and the second difference will be described later with reference to
The determining unit 177 performs a determination process of comparing the first difference and the second difference calculated by the difference calculating unit 176, to determine the legitimacy of the signal received by the ODM 140. The determination of the legitimacy by the determining unit 177 indicates that the determining unit 177 determines the legitimacy of the device that is the transmission source having transmitted the signal received by the ODM 140. More specifically, the determining unit 177 determines whether the transmission source is the distance measuring device 100B or the illegitimate device impersonating the distance measuring device 100B.
The phase measuring unit 178 measures the phase when the distance measuring device 100A receives the predetermined-frequency signal from the distance measuring device 100B. This phase is measured for distance measuring. Therefore, the phase measuring unit 178 is not included in the components of the wireless device 100R.
The distance measuring unit 179 performs the distance measuring of the distance between the distance measuring device 100A and the distance measuring device 100B based on the phase of the transmission signal acquired by the phase acquiring unit 175, the phase measured by the phase measuring unit 178, and the number of waves of the transmission signal and the reception signal between the distance measuring device 100A and the distance measuring device 100B.
The memory 170M stores programs, data, and the like that are necessary for the main control unit 171, the setting unit 172, the notifying unit 173, the switching unit 174, the phase acquiring unit 175, the difference calculating unit 176, the determining unit 177, the phase measuring unit 178, and the distance measuring unit 179 of the control device 170 to perform the above-described processing. The memory 170M stores data and the like in which the predetermined frequency and phases of the signals to be transmitted to each other between the distance measuring devices 100A and 100B are set.
In
As an example, when the symbol value of the BLE packet changes as illustrated in
The phase of the illegitimate reception signal indicated by the dashed line in
The phase of the illegitimate reception signal generated by the EDLC changes sharply so as to follow the symbol value of the BLE packet, and consequently, the phase of the illegitimate reception signal has a pattern that also follows the phase of the transmission signal. If the phase changes sharply in this way, it is not detected as a bit abnormality in the conventional method for the relay attack resistant communication.
In
The phase difference of the transmission signal is a difference (a phase difference) between a phase of the transmission signal and a phase sampled one cycle before in a sampling period. The sampling period is an example of a unit time, and such a phase difference of the transmission signal is a difference of the phase in the unit time (the first difference). That is, the phase difference of the transmission signal is a difference (a phase difference) between phases sampled in two consecutive sampling periods (two consecutive sample points) among the phases of the transmission signal repeatedly sampled in the distance measuring device 100A.
Similarly, the phase difference of the legitimate reception signal is a difference (a phase differences) between phases sampled in two consecutive sampling periods (two consecutive sample points) among the phases of the reception signal repeatedly sampled in the distance measuring device 100B.
Additionally, the phase difference of the illegitimate reception signal is a phase difference of the reception signal illegitimately generated by the illegitimate device impersonating the distance measuring device 100B based on the transmission signal of the distance measuring device 100A, and simulates a difference (a phase difference) between phases sampled in two consecutive sampling periods (two consecutive sample points) for the legitimate reception signal.
As illustrated in
In contrast, the phase difference of the illegitimate reception signal changes when the phase difference of the transmission signal changes, but the phase itself changes sharply as indicated in
As described, the phase difference of the legitimate reception signal and the phase difference of the illegitimate reception signal are completely different in the manner of change. The wireless device 100R and the distance measuring device 100A according to the embodiment determine whether it is the legitimate distance measuring device 100B or the illegitimate device based on such a difference in temporal change.
In
The correlation between the phase difference of the transmission signal of the distance measuring device 100A and the phase difference of the reception signal of the legitimate distance measuring device 100B has a maximum value close to 1 as indicated by the solid line. As described with respect to
With respect to the above, the correlation between the phase difference of the transmission signal of the distance measuring device 100A and the phase difference of the reception signal of the illegitimate device has a low maximum value as indicated by the dashed line. This is because, as illustrated in
Therefore, for example, by performing determination on the maximum value of the correlation by using an appropriate threshold, it can be determined whether the phase difference is a phase difference of the reception signal of the legitimate distance measuring device 100B or a phase difference of the reception signal of the illegitimate device. Such determination may be performed by the determining unit 177 of the control device 170. The determining unit 177 may calculate the correlation as illustrated in
First, when the process starts, the main control unit 171 causes the setting unit 172 to set the frequency (the predetermined frequency) and the phase of the signal to be transmitted, transmits the transmission signal, and acquires the phase of the transmission signal and the phase of the reception signal (step S1).
The difference calculating unit 176 calculates the first difference of the phase of the predetermined-frequency transmission signal transmitted from the OM 130 to the distance measuring device 100B in the unit time and the second difference of the phase of the predetermined-frequency reception signal received by the other device based on the signal received by the ODM 140 in the unit time (step S2).
The determining unit 177 calculates the correlation (step S3). In step S3, as illustrated in FIG.
6, the characteristic of the correlation having the maximum value may be obtained by shifting the sample point within the range of ±10, for example.
The determining unit 177 determines whether the device is legitimate (step S4). It may be determined whether the device is legitimate by determining whether the maximum value of the correlation is greater than or equal to the threshold value.
In response to determining that the device is legitimate (S4: YES), the determining unit 177 notifies the phase measuring unit 178 and the distance measuring unit 179 that the device is legitimate (step S5). When the processing of step S5 is ended, a series of processing is ended (end), and the process is performed again from start. That is, the determining unit 177 continues the determination process.
The phase measuring unit 178 and the distance measuring unit 179 measure the phase for the distance measuring and perform the distance measuring in response to being notified that the device is legitimate.
In response to determining that the device is not legitimate in step S4 (S4: NO), the determining unit 177 stops the transmission process and the reception process of the OM 130 and the ODM 140 (step S6). This is to prevent illegitimate access to the vehicles 10 because a legitimate access right to the distance measuring device 100A is not owned.
Next, the determining unit 177 notifies the phase measuring unit 178 and the distance measuring unit 179 that the device is not legitimate (step S7).
When the phase measuring unit 178 and the distance measuring unit 179 are notified that the device is not legitimate, the process is ended without measuring the phase for the distance measuring and performing the distance measuring. In this case, a high-level device (an ECU configured to manage the vehicle 10 or the like) of the distance measuring device 100A and the wireless device 100R are notified that access has been made from the illegitimate device, and the doors of the vehicle 10 cannot be unlocked, the ignition switches cannot be switched on, and the like.
Next, the determining unit 177 stops the determination process (step S8). All the processing is stopped because the device is accessed by an illegitimate device. In this case, the process is stopped without returning to the start. Here, for example, the process may be recoverable when the signal of the legitimate device is received and the device is determined to be the legitimate device after the stop.
As described above, the difference calculating unit 176 obtains the first difference of the phase of the transmission signal and calculates the second difference of the phase of the reception signal, and the determining unit 177 compares the first difference and the second difference to determine the legitimacy of the signal. Therefore, a case where the phase of the reception signal is sharply changed by the EDLC can be determined.
Therefore, the wireless device 100R that can detect a relay attack of changing the phase of the reception signal and impersonating a legitimate device, and a method for controlling the wireless device 100R can be provided.
Additionally, the determining unit 177 continues the determination process in response to determining that the device is legitimate, and stops the determination process in response to determining that the device is not legitimate. The vehicle 10 can be prevented from being accessed by an illegitimate device and being illegitimately used.
Additionally, the determining unit 177 stops the determination process and stops the transmission process and the reception process of the OM 130 and the ODM 140 in response to determining that the device is not legitimate, thereby preventing illegitimate access to the vehicle 10.
Additionally, because the phase is used as the predetermined physical quantity of the transmission signal and the reception signal, an illegitimate device can be found based on the phase difference when an illegitimate operation of changing the phase of the reception signal sharply is performed as in the EDLC.
Although the wireless device and the method for controlling the wireless device according to the exemplary embodiments of the present disclosure have been described above, the present disclosure is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.
Number | Date | Country | Kind |
---|---|---|---|
2021-193984 | Nov 2021 | JP | national |
This application is a continuation application of International Application No. PCT/JP2022/038184 filed on Oct. 13, 2022, and designating the U.S., which is based upon and claims priority to Japanese Application No. 2021-193984, filed on Nov. 30, 2021, the entire contents of which are incorporated herein by reference.
Number | Date | Country | |
---|---|---|---|
Parent | PCT/JP2022/038184 | Oct 2022 | WO |
Child | 18647369 | US |