Apparatus and method for detecting location of wireless device to prevent relay attack

• US 10,645,596 B2
• Filed: 03/04/2016
• Issued: 05/05/2020
• Est. Priority Date: 12/02/2011
• Status: Active Grant

• Current Assignee: Lear Corporation
• Original Assignee: Lear Corporation
• Inventors: Ghabra, Riad, Christenson, Keith A.
• Primary Examiner(s): Khan, Mehmood B.
• Application Number:
  US15/061,358
• Publication Number:
  US 20160182548A1
• Time in Patent Office: 1,523 Days
• CPC Class Codes: B60R 25/245 where the antenna reception area plays a role
• CPC Class Codes: G01S 13/46 Indirect determination of position data
• CPC Class Codes: G01S 2013/466 by Trilateration, i.e. two antennas or two sensors determine separately the distance to a target, whereby with the knowledge of the baseline length, i.e. the distance between the antennas or sensors, the position data of the target is determined
• CPC Class Codes: G01S 5/10 Position of receiver fixed by co-ordinating a plurality of position lines defined by path-difference measurements , e.g. omega or decca systemsG01S5/12 takes precedence ; beacons and receivers cooperating therewith G01S1/306, G01S1/308
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

A passive entry passive start (PEPS) method for preventing relay attack includes detecting a distance of a wireless device to a vehicle based on a time of flight of an ultra-wideband (UWB) signal between the wireless device and a base station at the vehicle. The method further includes enabling by the base station a function of the vehicle only when the distance of the wireless device to the vehicle is within a zone of the vehicle.

Claims

1. A method for preventing relay attack on a passive entry passive start (PEPS) system of a vehicle, the PEPS system having a base station at the vehicle, the method comprising:

transmitting, by a fob, a polling signal to the base station;

in response to the base station receiving the polling signal from the fob, transmitting, by the base station, a first ultra-wideband (UWB) signal to the fob;

transmitting, by the fob, a second ultra-wideband (UWB) signal to the base station in response to the first UWB signal, wherein an operating frequency of each UWB signal is between 3 GHz and 10 GHz and each UWB signal has a bandwidth of at least 500 MHz;

determining, by the base station, a distance of the fob to the vehicle based on a round trip time of flight of the UWB signals between the fob and the base station; and

detecting, by the base station, a relay attack of the PEPS system depending on the determined distance of the fob to the vehicle.

2. The method of claim 1 further comprising:

transmitting the first UWB signal from the base station to the fob with a first time stamp;

transmitting the second UWB signal from the fob to the base station with a second time stamp corresponding to the time the fob received the first UWB signal from the base station; and

detecting the distance of the fob to the vehicle based on the round trip time of flight of the UWB signals as measured from the first time stamp and the second time stamp.

3. A passive entry passive start (PEPS) vehicle system configured to prevent relay attack, the system comprising:

a fob; and

a base station at a vehicle;

wherein the fob is further configured to transmit a polling signal to the base station;

wherein the base station is configured to transmit a first ultra-wideband (UWB) signal to the fob in response receiving the polling signal;

wherein the fob is further configured to transmit a second UWB signal to the base station in response to receiving the first UWB signal;

wherein an operating frequency of each UWB signal is between 3 GHz and 10 GHz and each UWB signal has a bandwidth of at least 500 MHz;

wherein the base station is further configured to determine a distance of the fob to the vehicle based on a round trip time of flight of the UWB signals between the fob and the base station and detect a relay attack of the PEPS system depending on the determined distance of the fob to the vehicle.

4. The system of claim 3 wherein:

the base station is further configured to transmit the first UWB signal to the fob with a first time stamp;

the fob is configured to transmit the second UWB signal to the base station with a second time stamp corresponding to the time the fob received the first UWB signal from the base station; and

the base station is further configured to detect the distance of the fob to the target device based on the round trip time of flight of the UWB signals as measured from the first time stamp and the second time stamp.