EP3397526A1

EP3397526A1 - Method and system for controlling functionality of a vehicle

Info

Publication number: EP3397526A1
Application number: EP16809372.2A
Authority: EP
Inventors: Joel PATURE; Eric Leconte
Original assignee: Valeo Comfort and Driving Assistance SAS
Current assignee: Valeo Comfort and Driving Assistance SAS
Priority date: 2015-10-19
Filing date: 2016-12-08
Publication date: 2018-11-07
Also published as: WO2017068202A1; WO2017068202A8

Abstract

The invention relates to a method for controlling functionality of a vehicle (10) fitted with a first communication module (13), comprising the following steps: - upon detection of a command from the user, emitting a signal to an identifier (20) fitted with a second communication module (23) so as to initiate an exchange of electromagnetic signals between the first communication module (13) and the second communication module (23), said electromagnetic signals comprising at least two electromagnetic signals having different frequencies, - estimating a distance separating the vehicle (10) from the identifier (20) on the basis of the respective reception phases of said at least two electromagnetic signals, - controlling the functionality if the estimated distance verifies a predefined condition. An associated control system is also proposed.

Description

METHOD AND SYSTEM FOR CONTROLLING A FUNCTIONALITY OF A VEHICLE

TECHNICAL FIELD TO WHICH THE INVENTION RELATES The present invention relates to the control of the functionality of a vehicle subject to the presence of an identifier near the vehicle.

It relates more particularly to a method and a control system of a vehicle functionality.

The invention applies particularly advantageously in the case where it is desired to quickly have a reliable and accurate measurement of the distance separating the identifier of the vehicle, while countering the relay attacks.

BACKGROUND

Passive Entry (Passive Star) systems are known in which the implementation of a feature (such as unlocking the doors of a vehicle or starting such a vehicle) is conditioned by the presence near the vehicle of an identifier (usually worn by the user of the vehicle).

The document EP 2 800 068 describes such a system in which the distance separating the vehicle and the identifier is estimated as a function of a propagation time of electromagnetic signals exchanged between the identifier and the vehicle.

This solution makes it possible to counteract the relay attacks which are the object of such systems.

OBJECT OF THE INVENTION

In this context, the present invention proposes a method of controlling a functionality of a vehicle equipped with a first communication module, comprising the following steps:

- At detection of a user command, transmission of a signal to an identifier equipped with a second communication module so as to initiate an exchange of electromagnetic signals between the first communication module and the second module communication means, said electromagnetic signals comprising at least two electromagnetic signals having distinct frequencies;

- estimation of a distance separating the vehicle and the identifier according to respective reception phases of said at least two electromagnetic signals;

- command of the functionality if the estimated distance verifies a predefined condition.

This solution makes it possible to quickly obtain an estimate of the distance between the vehicle and the protected identifier against relay attacks, and thus to securely control the functionality without perceptible delay compared to the user's command.

According to optional characteristics, and therefore not limiting: said estimation is triggered as soon as a wireless link is established between the first communication module and the second communication module;

the method comprises a step of transmitting an authentication datum of the second communication module to the first communication module;

said authentication datum is determined according to a challenge previously transmitted from the first communication module to the second communication module;

the method comprises steps of measurement, at the level of the identifier, of a power of a signal generated by a low-frequency emission module of the vehicle and of transmission of the second communication module to the first communication module; information determined as a function of the measured power (this information being for example another estimate of said distance, but which may alternatively be an information representative of the measured power, on the basis of which an electronic unit of the vehicle can determine this other estimating said distance);

said information is transmitted with the authentication data;

the signal transmitted in order to initiate the establishment of the wireless link is produced by the low-frequency transmission module;

the estimated distance verifies the predefined condition if the estimated distance is less than a predetermined threshold;

said detection is carried out by a sensor associated with a door of the vehicle;

said functionality is the unlocking of the vehicle doors; said detection is carried out by actuation of a button;

said functionality is the starting of a vehicle engine;

the estimation step comprises a substep of measuring said reception phases by the first communication module or by the second communication module and a sub-step of determining the estimated distance as a function of the measured reception phases.

The invention also proposes a system for controlling a functionality of a vehicle equipped with a first communication module, comprising:

a module designed for detecting a command from the user, transmitting a signal to an identifier equipped with a second communication module so as to initiate an exchange of electromagnetic signals between the first communication module and the second communication module, said electromagnetic signals comprising at least two electromagnetic signals having distinct frequencies;

a module designed to estimate a distance separating the vehicle and the identifier as a function of respective reception phases of said at least two electromagnetic signals;

a module designed to control the functionality if the estimated distance verifies a predefined condition.

Each of the optional features presented above in terms of method may possibly apply to such a system.

DETAILED DESCRIPTION OF AN EXEMPLARY EMBODIMENT The following description with reference to the accompanying drawings, given by way of non-limiting examples, will make it clear what the invention consists of and how it can be implemented.

In the accompanying drawings:

- Figure 1 schematically shows the main elements of a system in which the invention can be implemented; and

FIG. 2 is a logic diagram showing an exemplary method of controlling a functionality according to the invention.

Figure 1 shows schematically the main elements of a system in which the invention can be implemented.

Such a system comprises a vehicle 10 (for example a vehicle automobile) and an identifier 20 (for example a vehicle access key or badge 10, or, alternatively, a user terminal, such as a mobile telephone, provided with rights of access to the vehicle 10).

The vehicle 10 comprises several electronic control units each dedicated to the management of certain functionalities of the vehicle. In particular, the vehicle 10 comprises an access and start management unit 11 and an exchange management unit 12.

The vehicle 10 also comprises a communication module 13 designed to establish a wireless link with other electronic devices, here a "Bluetooth Low Energy" (or "BLE") type link.The communication module 13 is connected for this purpose. to a first antenna 135 (made for example in the form of a conductive track) designed to transmit and receive high-frequency electromagnetic signals (typically with a frequency greater than 1 MHz or even 500 MHz), here in the band at 2.4 GHz.

In the example described here, the exchange management unit 12 and the communication module 13 are separate circuits or modules. Alternatively, these two elements could be physically integrated in the same module.

The vehicle 10 furthermore comprises a low-frequency transmission module 14 designed to emit, by means of a second antenna 145 (made for example in the form of a wound ferrite), a low-frequency electromagnetic signal S (typically below 150 kHz).

The vehicle 10 further comprises actuators for implementing some of the aforementioned functionalities, and in particular an unlocking actuator 1 6 designed to unlock the vehicle doors (on order of one of the electronic control units) and a starter actuator 18 designed to start the vehicle engine 10 (again, on command of one of the electronic control units).

As clearly visible in FIG. 1, the access and start management unit 11, the exchange management unit 12, the low frequency transmission module 14, the unlocking actuator 16 and the The starting actuator 18 are each connected to a data network 15 internal to the vehicle 10 and can thus exchange data with each other as described below.

The vehicle 10 finally comprises a sensor 1 10 (for example a capacitive sensor) located at a door handle of the vehicle 10 and a button of 15. When the sensor 1 10 detects the presence of a person, it transmits a corresponding detection information DT to the management unit access and start 1 1. Likewise, when the start button 1 15 is actuated by a user, a corresponding start information DM is received by the access and start management unit 11.

The identifier 20 comprises a control unit 21, a communication module 23, to which is connected an antenna 235, and a measurement circuit 26. The measurement circuit 26 is directly connected to the control unit 21; the control unit and the communication module 23 are connected by a wire link 25, for example a serial link such as a SPI type link (for "Serial Peripheral Interface").

The communication module 23 is designed to establish a wireless link (here of "Bluetooth Low Energy" or "BLE") type with other electronic devices, in particular with the exchange management unit 12 of the vehicle 10 via the communication module 13 mentioned above.

Thanks to the wireless link L which can thus be established between the communication module 13 of the vehicle 10 and the communication module 23 of the identifier 20, data can be exchanged between the exchange management unit 12 of the vehicle 10 and the control unit 21 of the identifier 20, as explained below.

The measurement circuit 26 is itself designed to measure the power, at the level of the identifier 20, of the electromagnetic signal S emitted by the antenna 145 connected to the low-frequency transmission module 14 (in accordance with a technique called RSSI for "Received Signal Strength Indication") and for communicating information indicative of the measured power to the control unit 21. The control unit 21 can deduce from this information an estimate of the distance separating the vehicle 10 and the identifier 20.

An example of a method for controlling a function according to the invention, in this case a method for controlling the unlocking of the doors of a vehicle, will now be described with reference to FIG.

In the description of FIG. 2, there will also be mentioned from time to time a variant according to which the functionality commanded is the starting of the vehicle.

It is considered at the beginning of the process of Figure 2 that the vehicle is at the stop - locked doors, that the identifier 20 has not been detected by the aforementioned electronic circuits of the vehicle 10 and that at least some of these electronic circuits are therefore in standby mode (or "standby" according to the designation of Anglo-Saxon origin commonly used).

The user approaches the vehicle 10 provided with the identifier 20 and comes to touch the door handle mentioned above.

In the variant mentioned in places, it is considered instead that the user (provided with the identifier 20) is already in the vehicle 10 and actuates the start button 1 15.

The method thus begins at step E2 when the sensor 1 10 detects the presence of a person and thus transmits a corresponding detection information DT to the access management unit and start 1 1. (In the above variant, the start button transmits DM start information to the access management and start-up unit 1 1.)

The access and start management unit 11 receives the detection information DT (or, alternatively, the start-up information DM) at the step E4 and consequently sends a wake-up command to the module d. low-frequency transmission 14 (step E6) and a wake-up command to the unlocking actuator 16, or, in the aforementioned variant, the starting actuator 18 (step E10). (The aforementioned wakeup commands are transmitted from one element to another on the internal data network 15.)

The wake up command is for example sent to the low-frequency transmission module 14 after a duration Ti (with Ti less than 20 ms, and preferably T1 less than 15 ms) with respect to the first detection of the user. by the sensor 1 10.

The low frequency transmission module 14 and the unlocking actuator 166 (or, if applicable, the starter actuator 18) then switch each of their standby mode to their normal operating mode (respectively to the steps E8 and E12).

Upon awakening, the low-frequency transmission module 14 generates (via the antenna 145) a low-frequency electromagnetic signal (step E14), for example modulated successively by a synchronization pattern and by a wake-up code. The control unit 21 of the identifier 20 is in turn awakened (step E1 6) by this signal, transmitted via the measurement circuit 26. As soon as the control unit 21 is functional (ie after a short start-up phase), the control unit 21 sends in step E18 an activation command to the communication module 23.

The transmission of the activation command to the communication module 23 occurs after a duration T ₂ (with T ₂ less than 20 ms, preferably less than 14 ms) with respect to the reception of the wake up command by the low-frequency emission module 14.

As soon as it is activated, the communication module 23 of the identifier 20 enters a phase of establishment of a wireless link with the communication module 13 of the vehicle 10 (this phase of establishing the wireless link being represented by steps E21 and E22 respectively at the level of the communication module 23 and at the level of the communication module 13). For example, it is envisaged for this purpose that the communication module 23 of the identifier 20 will transmit advertisement frames (or "advertising packets" according to the English terminology) and that the communication module 13 of the vehicle 10 will be placed in position. scanning mode (or "scanning" according to the English terminology), for example by the exchange management unit 12 informed by the access management unit and startup 1 1 that an alarm clock of the identifier 20 was started at step E6, and thus responds to an announcement frame to establish the wireless link.

As a variant, the announcement frames could be transmitted by the communication module 13 of the vehicle 10 and the communication module 23 of the identifier could be placed in scanning mode in step E21, which would also make it possible to establish the aforementioned wireless link.

The establishment phase of the wireless link has a duration T ₃ (with T ₃ less than 10 ms, preferably less than 5 ms).

The communication module 13 of the vehicle 10, which participates in the establishment of the wireless link L as just indicated (step E22), informs the exchange management unit 12 of the establishment of the link without wire L (establishment information received in step E23 by the exchange management unit).

As soon as the wireless link between the communication modules 13, 23 is established, these communication modules 13, 23 trigger a process for estimating the distance separating the vehicle 10 and the identifier 20 as a function of the propagation time of electromagnetic signals involved in the established wireless link L (the triggering of this process is indicated in steps E24 and E26 respectively for the communication module 23 and for the communication module 13). It can be provided for this purpose that the communication modules 13, 23 are programmed to automatically trigger such an estimation process as soon as the link is established. As a variant, the estimation process can be triggered respectively by the exchange management unit 12 and by the control unit 21.

The process of estimating the distance separating the vehicle 10 and the identifier 20 comprises here:

the transmission, by one of the two communication modules 13, 23 and in separate time windows, of at least two electromagnetic signals respectively having distinct frequencies f 1, f ₂ and

the measurement, at the level of the other of the two modules 13, 23, of the respective phases φ-ι, φ ₂ of reception of these two electromagnetic signals.

We can then estimate the aforementioned distance d by the following calculation: d = α [φ ₂ - φ-ι] / [2π. (Ί ₂ - f-ι)], where c is the celerity of light.

It will also be possible to use bidirectional exchanges during the estimation process, as proposed for example in the US document

5,220,332.

Note also that alternatively, the estimation process just described could be implemented without prior establishment of a wireless link between the communication modules 13, 23 (that is to say by the simple exchange of electromagnetic signals at distinct frequencies f-ι,) - For example, it is provided in this case that the control unit 21 controls, as from the aforementioned step E18, the transmission by the communication module 23 of the electromagnetic signals. at distinct frequencies f-ι, (corresponding to step E24 mentioned above), the exchange management unit 12 having, for example, placed the communication module 23 waiting for such signals (to measure their reception phases respective φ-ι, φ ₂ ) after being informed by the management unit access and start 1 1 that an alarm of the identifier 20 was started in step E6. In parallel with the aforementioned exchanges between the communication modules 13, 23, the low-frequency transmission module 14 emits a low-frequency electromagnetic signal S (step E27) whose power is measured by the measurement circuit 26 so that the The control unit 21 determines, as a function of the measured power, a first estimate d1 of the distance separating the vehicle 10 and the identifier 20 (step E28), according to the technique already mentioned known as RSSI.

Furthermore, after having received the wireless link establishment information (step E23), the exchange management unit 12 prepares in step E30 a challenge CHL (or "challenge" according to the name of Anglo-Saxon origin commonly used), for example by random draw, and controls the issuance of this challenge by the communication module 13, via the established wireless link L and therefore to the identifier 20 (step E32).

The CHL challenge is for example sent by the communication module 13 within a frame which also contains a MAC message authentication code. Such a MAC message authentication code is obtained by application to the CHL challenge of a cryptographic algorithm using a cryptographic key (secret key) associated with the vehicle 10.

The communication module 23 of the identifier 20 receives this frame in step E34 and can thus transmit it (with the CHL challenge and the MAC message authentication code) to the control unit 21 in step E36 .

It can be provided that in parallel with the various exchanges made between the vehicle 10 and the identifier 20 to ensure the presence of the identifier 20 near the vehicle 10 (as explained below), the management unit of access and start 1 1 checks the continuous presence of a person at the sensor 1 10 (which allows for example to ensure that the initial detection of step E2 was not fortuitous): the new DT 'detection of a person at the sensor 1 10 is transmitted to the access management unit and startup 1 1 in step E38 and the access management unit and startup 1 1 can therefore confirm to the unlocking actuator 1 6 that an unlock is imminent.

The unlocking actuator 166 receives this confirmation in step E42, but remains waiting for an authentication confirmation (as described further in step E60) before unlocking the vehicle doors 10.

As indicated above, the control unit 21 of the identifier 20 receives the CHL challenge and the MAC message authentication code in step E36.

After checking the MAC message authentication code (which ensures that the CHL challenge has been generated by the vehicle 10 and not by an attacker who seeks to know, for all possible challenges, the answers of the identifying these challenges), the control unit 21 determines in step E44 a REP response to the CHL challenge, for example by applying to the CHL challenge a cryptographic algorithm (such as an encryption algorithm) using a memorized secret key in the identifier 20.

The control unit 21 then controls (step E46) to the communication module 23 the transmission of the response REP and the first estimate di via the established wireless link L. (Of course, if the message authentication code MAC was not verified, none of this expected information would be issued by ID 20.)

The communication module 23 of the identifier 20 thus sends a frame containing the response REP and the first estimate d-i, to the communication module 13 of the vehicle 10.

The communication module 13 of the vehicle 10 receives this frame in step E50, and transmits it to the exchange management unit 12 which can thus store the response REP and the first estimate di received (step E52).

The process of estimating the distance separating the vehicle 10 and the identifier 20 as a function of the propagation time of electromagnetic signals involved in the established wireless link L (process initiated at steps E24 and 26) has continued in parallel with different steps which have just been described (being interrupted if necessary during steps E24, E26, E48, E50 where the communication modules 13, 23 are used), until the end of this process (step E54), where the communication module 13 can thus communicate to the exchange management unit 12 a second estimate d ₂ of the distance separating the vehicle 10 and the identifier 20 (determined this time on the basis of the propagation time of electromagnetic signals via the established wireless link L).

The process of estimating the distance as a function of the propagation time, which lasts from step E26 to step E54, thus extends over a duration T ₄ , with T _{4 being} less than 50 ms (and preferably T ₄ less than 40 ms).

This second estimate d ₂ is thus received and stored by the module of exchange management 12 at step E56.

The exchange management module 12 can then check in step E58 whether various conditions are fulfilled, namely whether:

the response REP received from the identifier corresponds to the expected response (this verification can be done for example by comparing the response received REP to the result of the application of the cryptographic algorithm using the aforementioned secret key, also stored within the trade management unit 12, the challenge determined in step E30); and

the first estimate di is less than a first predefined threshold (being generally less than 5 m and being for example 1 m); and

the second estimate d ₂ is less than a second predefined threshold (generally less than 5 m), possibly identical to the first predefined threshold.

The first estimate d-ι, performed using the above-mentioned RSSI technique, is generally quite accurate and reliable, but it can be the subject of a relay attack.

The second estimate d ₂ , because it is determined on the basis of the travel time of the electromagnetic wave, can not be faked by a conventional relay attack. Thus, checking the condition relating to the second estimate d ₂ makes it possible to ensure that the vehicle 10 is not subject to a relay attack.

When all the conditions are verified, the exchange management unit 12 issues an authentication confirmation CONF to the unlocking actuator 166 (or, in the case of the variant mentioned above, to the starter actuator 18). (If a condition was not verified - which is not the case during the normal operation shown in Figure 2, the process would end immediately, without unlocking the doors of the vehicle 10.)

Note that, according to another conceivable embodiment, the data used for the verification of the various conditions (REP response, first estimate d-ι, second estimate d ₂ ) could be transmitted from the exchange management unit 12 to the 1 1 access control and startup management unit and the verification of the various conditions could then be performed by the access management unit and startup 1 1 (which would then transmit, in case of verification of all conditions, CONF confirmation confirmation to the unlocking actuator 16 or, if applicable, the starting actuator).

The unlocking actuator 166 receives the authentication confirmation CONF in step E60 and can thus perform in step E62 the unlocking of the doors of the vehicle 10. In the variant already mentioned several times, it is the boot actuator 18 which receives the authentication confirmation CONF and then starts the starting of the vehicle engine 10.

The storage of the second estimate d ₂ , the verification of the aforementioned conditions and the communication of the authentication confirmation requires a duration T ₅ (with T ₅ less than 5 ms, preferably less than 4 ms).

Consequently, the total duration (ΤΊ + T ₂ + T ₃ + T ₄ + T ₅ ) separating the first detection of the user by the sensor 1 10 and the unlocking of the doors is less than 105 ms (and preferably less than 78 ms).

In the variant mentioned several times where it is intended to start the vehicle 10 following the actuation of the button 1 15, the time constraints are lower, and there is for example in this case:

Less than 100 ms (preferably less than 60 ms);

T ₂ less than 20 ms (preferably less than 14 ms);

T ₃ less than 10 ms (preferably less than 5 ms), as already proposed above;

T less than 100 ms (preferably less than 60 ms);

T ₅ less than 30 ms (preferably less than 21 ms).

In this case, the total duration (ΤΊ + T ₂ + T ₃ + T ₄ + T ₅ ) separating the detection of the depression of the button 1 15 and the start of the start by the starting actuator 18 is less than 260 ms. (and preferably less than 160 ms).

Claims

1. A method of controlling a functionality of a vehicle (10) equipped with a first communication module (13), comprising the following steps:

- at detection (E2, E4) of a user command, transmission (E8) of a signal to an identifier (20) equipped with a second communication module (23) so as to launch a exchanging electromagnetic signals between the first communication module (13) and the second communication module (23), said electromagnetic signals comprising at least two electromagnetic signals having distinct frequencies;

estimating (E24, E26, E54) a distance (d ₂ ) separating the vehicle (10) and the identifier (20) as a function of respective reception phases of said at least two electromagnetic signals;

- command (E62) of the functionality if the estimated distance (d ₂ ) satisfies a predefined condition.

A control method according to claim 1, wherein said estimate is triggered (E24, E26) as soon as a wireless link (L) is established between the first communication module (13) and the second communication module (23). ).

3. Control method according to claim 1 or 2, comprising a step of transmitting (E48) an authentication data (REP) of the second communication module (23) to the first communication module (13).

4. Control method according to claim 3, wherein said authentication data (REP) is determined according to a challenge (CHL) previously transmitted from the first communication module (13) to the second communication module (23). .

5. Control method according to one of claims 1 to 4, comprising the following steps:

measuring, at the level of the identifier (20), a power of a signal (S) generated by a low frequency transmission module (14) of the vehicle (10);

- Transmission (E48) of the second communication module (23) to the first communication module (13) of information (d-i) determined as a function of the measured power.

6. Control method according to claim 5 taken in dependence of claim 3 or 4, wherein said information (d-i) is transmitted with the authentication data (REP).

A control method according to claim 5 or 6, wherein the signal transmitted to initiate the establishment of the wireless link (L) is generated by the low frequency transmission module (14).

8. Control method according to one of claims 1 to 7, wherein the estimated distance (d ₂ ) verifies the predefined condition if the estimated distance

(d ₂ ) is less than a predetermined threshold.

9. Control method according to one of claims 1 to 8, wherein said detection (E2) is performed by a sensor (1 10) associated with a door of the vehicle (10).

10. Control method according to one of claims 1 to 9, wherein said functionality is the unlocking of the vehicle doors (10).

1 1. Control method according to one of claims 1 to 8, wherein said detection is performed by actuating a button (1 15).

12. Control method according to one of claims 1 to 8 and 1 1, wherein said functionality is the starting of a vehicle engine (10).

13. Control method according to one of claims 1 to 12, wherein the estimation step comprises a substep of measuring said reception phases by the first communication module (13) or by the second communication module (23) and a sub-step of determining the distance estimated (d ₂ ) as a function of the measured reception phases.

14. A vehicle functionality control system (10) having a first communication module (13), comprising:

a module (14) designed for detecting a command from the user, transmitting a signal to an identifier (20) equipped with a second communication module (23) so as to initiate an exchange of electromagnetic signals between the first communication module (13) and the second communication module (23), said electromagnetic signals comprising at least two electromagnetic signals having distinct frequencies;

a module (13) designed to estimate a distance (d ₂ ) separating the vehicle (10) and the identifier (20) as a function of respective reception phases of said at least two electromagnetic signals;

a module (1 6; 18) adapted to control the functionality if the estimated distance (d ₂ ) satisfies a predefined condition.