Relay attack prevention for passive entry/passive start systems

• US 9,672,671 B2
• Filed: 07/02/2015
• Issued: 06/06/2017
• Est. Priority Date: 06/24/2013
• Status: Active Grant

• Current Assignee: Texas Instruments, Inc.
• Original Assignee: Texas Instruments, Inc.
• Inventors: Seiberts, Klaus, Childers, Jim
• Primary Examiner(s): SYED, NABIL H
• Application Number:
  US14/790,223
• Publication Number:
  US 20150302673A1
• Time in Patent Office: 705 Days
• CPC Class Codes: B60R 25/20 Means to switch the anti-theft system on or off
• CPC Class Codes: B60R 25/2072 with means for preventing jamming or interference of a remote switch control signal
• CPC Class Codes: G07C 2009/0038 whereby the wake-up circuit is situated in the keyless data carrier
• CPC Class Codes: G07C 2009/00555 comprising means to detect or avoid relay attacks
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/30 not involving the use of a pass

Abstract

A keyfob is disclosed for use in detecting an attack on a vehicle. The keyfob includes a microcontroller, a wake receiver and an accelerometer. The wake receiver is configured to measure received signal strength and save the measured value in received signal strength indicator (RSSI). The accelerometer is used to generate acceleration data. The microcontroller detects an attack based on the RSSI and the acceleration data.

Claims

1. An apparatus for wirelessly accessing a vehicle, comprising:

a wake receiver configured to receive a wireless signal for requesting access to the vehicle;

an accelerometer configured to generate acceleration data based on a motion of the apparatus; and

a microcontroller coupled with the wake receiver and the accelerometer, the microcontroller configured to;

generate a received signal strength indicator (RSSI) estimating a signal strength of the received wireless signal; and

detect a relay attack by comparing a first relay attack parameter based on the acceleration data with a second relay attack parameter based on the RSSI, and determining a deviation between the first and second attack Parameters above a threshold.

2. The apparatus of claim 1, wherein the microcontroller is configured to disable the wake receiver based on the acceleration data representing the motion of the apparatus is below a predetermined threshold.

3. The apparatus of claim 1, wherein the microcontroller is configured to detect the relay attack by:

determining a first motion of the apparatus based on the acceleration data collected within a time interval;

determining a second motion of the apparatus based on the RSSI estimated within the time interval; and

determining the relay attack present if the second motion deviates from the first motion by or above a predetermined threshold.

4. The apparatus of claim 1, wherein the microcontroller is configured to detect the relay attack by:

determining a first distance traveled by the apparatus within a time interval based on the acceleration data;

determining a second distance traveled by the apparatus within the time interval based on the RSSI; and

determining the relay attack present if a difference between the first distance and the second distance is greater than a predetermined threshold.

5. The apparatus of claim 1, wherein the microcontroller is configured to decline authentication with the vehicle upon detecting the relay attack.

6. The apparatus of claim 1, wherein the microcontroller is configured to communicate the relay attack to the vehicle upon detecting the relay attack.

7. The apparatus of claim 1, wherein the wireless signal includes a low frequency (LF) wireless signal originated from the vehicle.

8. A method for wirelessly accessing a vehicle, comprising:

generating, by a microcontroller, a received signal strength indicator (RSSI) estimating a signal strength of a wireless signal for requesting access to the vehicle;

generating, by an accelerometer, acceleration data based on a motion of a key configured to wirelessly access the vehicle;

detecting, by the microcontroller, a relay attack by comparing a first relay attack parameter based on the acceleration data with a second relay attack parameter based on the RSSI, and determining a deviation between the first and second attack parameters above a threshold; and

authenticating, by the microcontroller, the key in response to the wireless signal only when the relay attack is not detected.

9. The method of claim 8, further comprising:

receiving, by a wake receiver, the wireless signal in response to the acceleration data representing the motion of the key is above a predetermined threshold.

10. The method of claim 9, further comprising:

disabling, by the microcontroller, the wake receiver in response to the acceleration data representing the motion of the key is below a predetermined threshold.

11. The method of claim 8, wherein the detecting the relay attack includes:

determining, by the microcontroller, a first motion of the key based on the acceleration data collected within a time interval;

determining, by the microcontroller, a second motion of the key based on the RSSI estimated within the time interval; and

determining, by the microcontroller, the relay attack present if the second motion deviates from the first motion by or above a predetermined threshold.

12. The method of claim 8, wherein the detecting the relay attack includes:

determining, by the microcontroller, a first distance traveled by the key within a time interval based on the acceleration data;

determining, by the microcontroller, a second distance traveled by the key within the time interval based on the RSSI; and

determining, by the microcontroller, the relay attack present if a difference between the first distance and the second distance is greater than a predetermined threshold.

13. The method of claim 8, further comprising:

declining, by the microcontroller, authentication between the key and the vehicle when the relay attack is detected.

14. The method of claim 8, further comprising:

communicating, by the microcontroller, the relay attack to the vehicle upon detecting the relay attack.

15. A microcontroller for use in a system for wirelessly accessing a vehicle, the microcontroller comprising:

a memory storing a set of instructions;

a processor coupled to the memory, upon receiving an interrupt signal from a wake receiver, the processor configured to execute the stored set of instructions to perform a process including;

generating a received signal strength indicator (RSSI) estimating a signal strength of a wireless signal for requesting access to the vehicle;

receiving acceleration data representing a motion of a key configured to wirelessly access the vehicle; and

detecting a relay attack by comparing a first relay attack parameter based on the acceleration data with a second relay attack parameter based on the RSSI, and determining a deviation between the first and second attack parameters above a threshold.

16. The microcontroller of claim 15, wherein the process further includes:

enabling the wake receiver for receiving the wireless signal when the acceleration data represents the motion of the key is above a predetermined threshold.

17. The microcontroller of claim 15, wherein the process further includes:

disabling the wake receiver for receiving the wireless signal when the acceleration data represents the motion of the key is below a predetermined threshold.

18. The microcontroller of claim 15, wherein the detecting the relay attack includes:

determining a first motion of the key based on the acceleration data collected within a time interval;

determining a second motion of the key based on the RSSI estimated within the time interval; and

determining the relay attack present if the second motion deviates from the first motion by or above a predetermined threshold.

19. The microcontroller of claim 15, wherein the detecting the relay attack includes:

determining a first distance traveled by the key within a time interval based on the acceleration data;

determining a second distance traveled by the key within a time interval based on the RSSI; and

determining the relay attack present if a difference between the first distance and the second distance is greater than a predetermined threshold.

20. The microcontroller of claim 15, wherein the process further includes:

authenticating the key in response to the wireless signal only when the relay attack is not detected.

21. The microcontroller of claim 15, wherein the process further includes:

declining authentication between the key and the vehicle when the relay attack is detected.

22. The microcontroller of claim 15, wherein the process further includes:

communicating the relay attack to the vehicle upon detecting the relay attack.

23. An apparatus for wirelessly accessing a vehicle, comprising:

a wake receiver configured to receive a wireless signal for requesting access to the vehicle;

an accelerometer configured to generate acceleration data based on a motion of the apparatus; and

a microcontroller coupled with the wake receiver and the accelerometer, the microcontroller configured to;

determine a signal strength of the received wireless signal; and

detect a relay attack by comparing a first relay attack parameter based on the acceleration data with a second relay attack parameter based on the signal strength, and determining a deviation between the first and second attack parameters above a threshold.

24. The apparatus of claim 23, wherein the microcontroller is configured to disable the wake receiver based on the acceleration data representing the motion of the apparatus is below a predetermined threshold.

25. The apparatus of claim 23, wherein the microcontroller is configured to detect the relay attack by:

determining a first motion of the apparatus based on the acceleration data collected within a time interval;

determining a second motion of the apparatus based on the signal strength within the time interval; and

determining the relay attack present if the second motion deviates from the first motion by or above a predetermined threshold.

26. The apparatus of claim 23, wherein the microcontroller is configured to detect the relay attack by:

determining a first distance traveled by the apparatus within a time interval based on the acceleration data;

determining a second distance traveled by the apparatus within the time interval based on the signal strength; and

determining the relay attack present if a difference between the first distance and the second distance is greater than a predetermined threshold.

27. The apparatus of claim 23, wherein the microcontroller is configured to decline authentication with the vehicle upon detecting the relay attack.

28. The apparatus of claim 23, wherein the microcontroller is configured to communicate the relay attack to the vehicle upon detecting the relay attack.

29. The apparatus of claim 23, wherein the wireless signal includes a low frequency (LF) wireless signal originated from the vehicle.

30. A microcontroller for use in a system for wirelessly accessing a vehicle, the microcontroller comprising:

a memory storing a set of instructions;

a processor coupled to the memory, upon receiving an interrupt signal from a wake receiver, the processor configured to execute the stored set of instructions to perform a process including;

determining a signal strength of a wireless signal for requesting access to the vehicle;

receiving acceleration data representing a motion of a key configured to wirelessly access the vehicle; and

detecting a relay attack by comparing a first relay attack parameter based on the acceleration data with a second relay attack parameter based on the signal strength, and determining a deviation between the first and second attack parameters above a threshold.

31. The microcontroller of claim 30 wherein the process further includes:

enabling the wake receiver for receiving the wireless signal when the acceleration data represents the motion of the key is above a predetermined threshold.

32. The microcontroller of claim 30, wherein the process further includes:

disabling the wake receiver for receiving the wireless signal when the acceleration data represents the motion of the key is below a predetermined threshold.

33. The microcontroller of claim 30, wherein the detecting the relay attack includes:

determining a first motion of the key based on the acceleration data collected within a time interval;

determining a second motion of the key based on the signal strength within the time interval; and

determining the relay attack present if the second motion deviates from the first motion by or above a predetermined threshold.

34. The microcontroller of claim 30, wherein the detecting the relay attack includes:

determining a first distance traveled by the key within a time interval based on the acceleration data;

determining a second distance traveled by the key within a time interval based on the signal strength; and

determining the relay attack present if a difference between the first distance and the second distance is greater than a predetermined threshold.

35. The microcontroller of claim 30, wherein the process further includes:

authenticating the key in response to the wireless signal only when the relay attack is not detected.

36. The microcontroller of claim 30, wherein the process further includes:

declining authentication between the key and the vehicle when the relay attack is detected.

37. The microcontroller of claim 30, wherein the process further includes:

communicating the relay attack to the vehicle upon detecting the relay attack.