FIELD

The present disclosure relates to systems and methods for establishing a secure communication link between a portable access device and a vehicle.

BACKGROUND

The background description provided here is for the purpose of generally presenting the context of the disclosure. Work of the presently named inventors, to the extent it is described in this background section, as well as aspects of the description that may not otherwise qualify as prior art at the time of filing, are neither expressly nor impliedly admitted as prior art against the present disclosure.

Traditionally, a passive entry/passive start (PEPS) system is able to perform keyless entry by allowing a user in possession of a key fob, which has been paired with a central PEPS electronic control unit (ECU) of a vehicle, to gain access to the vehicle. The user may simply grab a door handle of the vehicle and start the vehicle with a push of a button. In response to the button being pushed, the central PEPS ECU performs an authentication process to determine if the key fob is authorized to access the vehicle. Strengths of signals received via multiple vehicle antennas may be monitored to estimate the location of the key fob relative to the vehicle. If the key fob is authenticated and is located within a predetermined range of the vehicle, vehicle access functions are made available to the user (e.g., the unlocking of doors, starting of the vehicle, setting temperature within the vehicle, etc.).

Traditionally, PEPS systems use proprietary grade radio protocols including transmission of low frequency (LF) signals at approximately 125 kHz. These types of PEPS systems are limited by physics associated with transmitting LF signals. Wave propagation of LF signals allow for accurate estimation of range and location of a key fob. This is accomplished, for example, by monitoring signal strength within a target activation range of 2 meters. However, due to a long wavelength of a LF signal and practical sizes of a vehicle antenna and key fob receiver, it is difficult within reasonable power consumption and safe transmit power levels to reliably communicate beyond a few meters with a key fob using LF. Consequently, it is also difficult to make vehicle access functions available to the user when the key fob is located more than a few meters away from the vehicle.

Accordingly, smart devices (e.g., smart phones and wearable devices) are being used instead of key fobs to gain access to vehicle functions. Smart devices communicate at high radio frequencies (RFs) and thus are able to communicate over longer distances than LF systems. As such, smart devices allow various vehicle functions and long range distancing features to be implemented, such as passive welcome lighting and distance bounding on remote parking applications.

PEPS systems using LF access devices and PEPS systems using RF access devices have wireless vulnerabilities that subject the respective PEPS systems to malicious attacks. As an example, a user may attack a PEPS system by passive eavesdropping, performing a man-in-the-middle (MITM) attack, performing a replay attack, and/or performing identity tracking of various telemetric links of the PEPS system.

SUMMARY

This section provides a general summary of the disclosure, and is not a comprehensive disclosure of its full scope or all of its features.

A portable access device for wirelessly gaining access to a vehicle is provided. The portable access device includes a transceiver, receive and transmit queues, and a control module. The transceiver is configured to, during a current connection event, receive first notification messages from a phone-as-a-key (PaaK) system of the vehicle and in response thereto transmit second notification messages to the PaaK system. The first notification messages and the second notification message are transmitted to establish a communication link between the portable access device and the PaaK system. The receive queue is configured to receive the first notification messages. The transmit queue is configured to store the second notification messages. The control module is configured to generate and store the second notification messages in the transmit queue in response to receiving the first notification messages from the receive queue. The control module is configured to, based on a first one of the first notification messages, (i) determine what data was transmitted during a last connection event prior to the current connection event, and (ii) generate one or more of the second notification messages to include data not previously received during the last connection event.

In other features, the second notification messages are associated with one or more frames in a frame sequence. The first one of the first notification messages indicates at least one of characteristics transmitted by the portable access device during the last connection event, channel attempts performed by the portable access device during the last connection event, or where the portable access device is in the frame sequence. The control module generate one or more of the second notification messages to include data not previously received during the last connection event based on the at least one of characteristics transmitted by the portable access device during the last connection event, channel attempts performed by the portable access device during the last connection event, or where the portable access device is in the frame sequence.

In other features, the second notification messages are associated with one or more frames in a frame sequence. The first one of the first notification messages indicates characteristics transmitted by the portable access device during the last connection event, channel attempts performed by the portable access device during the last connection event, and where the portable access device is in the frame sequence. The control module is configured to generate the one or more of the second notification messages based on the characteristics, channel attempts, and where the portable access device is in the frame sequence.

In other features, the first notification messages and the second notification messages are transmitted as 2.4 GHz radio frequency signals.

In other features, the control module is configured to, during the current connection event, limit at least one of (i) a number of characteristics stored in the transmit queue and transmitted to the PaaK system, or (ii) a number of protocol data units stored in the transmit queue and transmitted to the PaaK system. The second notification messages include the characteristics and the protocol data units.

In other features, the control module is configured to: based on one of the first notification messages from the PaaK system, determine that a receive queue of the PaaK system is filling up; and reduce a number of notification messages transmitted from the portable access device to the PaaK system during a connection event subsequent to the current connection event.

In other features, the control module is configured to reduce the number of notification messages transmitted from the portable access device to the PaaK system during the connection event subsequent to the current connection event to maintain a lag in a corresponding control loop to two connection events.

In other features, the control module is configured to generate de-whitened packets to include in some of the second notification messages. The de-whitened packets are generated based on an indication of the current connection event and an indication of a current channel over which the portable access device is transmitting the second notification messages to the PaaK system.

In other features, the control module is configured to generate some of the second notification messages to each include a mobile de-whitened section including a predetermined number of series of consecutive bits. Each of the series of consecutive bits includes all zeros or all ones.

In other features, the predetermined number of series of consecutive bits includes 2-10 series of consecutive bits, where each of the series of consecutive bits includes 12-32 bits.

In other features, the transceiver is configured to receive a connection event information score from the PaaK system indicating whether the portable access device is ahead, centered or behind in transmitting the second notification messages to the PaaK system. The control module is configured to adjust a fill rate of the transmit queue based on the connection event information score.

In other features, a PaaK system for a vehicle is provided. The PaaK system includes a transceiver, a receive queue, a transmit queue and a PaaK module. The transceiver is configured to, during a current connection event, transmit first notification messages to a portable access device and in response thereto receive second notification messages from the portable access device. The second notification messages are associated with one or more frames in a frame sequence. The first notification messages and the second notification message are transmitted to establish a communication link between the portable access device and the PaaK system. The receive queue is configured to receive the second notification messages. The transmit queue configured to store the first notification messages. The PaaK module is configured to generate and store the first notification messages in the transmit queue and generate a first one of the first notification messages to indicate the aspects including at least one of characteristics transmitted by the portable access device during the last connection event, channel attempts performed by the portable access device during the last connection event, or where the portable access device is in the frame sequence.

In other features, the transceiver, the receive queue, the transmit queue, and the PaaK module are implemented as a PaaK device.

In other features, the PaaK module is configured to generate the first one of the first notification messages to indicate: the characteristics transmitted by the portable access device during the last connection event; the channel attempts performed by the portable access device during the last connection event; and where the portable access device is in the frame sequence.

In other features, the PaaK module is configured to: determine what data was received by the PaaK system from the portable access device during the last connection event; and indicate in the first one of the first notification messages what data was received from the portable access device.

In other features, the PaaK system further includes: a tone remover module configured to remove at least one of mobile de-whitened tones or mobile de-whitened sections from the second notification messages; and a validation module configured to determine whether bytes of remaining portions of the second notification messages are valid.

In other features, the PaaK module is configured to limit at least one of a number of non-empty protocol data units stored in the transmit queue or transmitted to the portable access device during the current connection event; and the first notification messages include the non-empty protocol data units.

In other features, the PaaK module is configured to: determine whether the receive queue is filling up; and based on a fill level of the receive queue, indicate in one of the first notification messages a status of the receive queue to cause the portable access device to reduce a number of notification messages the portable access device transmits to the PaaK system during a connection event subsequent to the current connection event.

In other features, the PaaK module is configured to indicate to the portable access device the current connection event and a current channel over which the PaaK system is communicating with the portable access device for generation of de-whitened packets by the portable access device. The second notification messages include the de-whitened packets. In other features, the PaaK module is configured to: generate a connection event information score indicating whether the portable access device is ahead, centered or behind in transmitting the second notification messages to the PaaK module; and store the connection event information score in the transmit queue. The transceiver is configured to transmit the connection event information score to the portable access device.

In other features, a reader is provided and includes a transceiver and a control module. The transceiver is configured to, during a current connection event, monitor notification messages transmitted from a portable access device to a phone-as-a-key (PaaK) system of a vehicle, where the notification messages are transmitted to establish a communication link between the portable access device and the PaaK system. The control module is configured to: perform an in-phase and quadrature phase capture of the notification messages based on fields in one or more of the notification messages, where the fields include a mobile de-whitened section including two or more series of consecutive bits, where the consecutive bits in each of the one or more series are all zeros or all ones; based on the in-phase and quadrature phase capture, determine an angle-of-arrival of the notification messages, and indicate the angle-of-arrival to the PaaK system for permitted access determined by the PaaK system.

In other features, the fields include an access address, a logical link identifier, a logical link header, a channel identifier, a generic attribute profile opcode, and an attribute handle.

In other features, the control module is configured to determine whether to perform the in-phase and quadrature phase capture based on the access address, the logical link identifier, the logical link header, the channel identifier, the generic attribute profile opcode, and the attribute handle.

In other features, the angle-of-arrival is relative to at least one of the reader or a reference point on the vehicle.

In other features, the control module is configured to control the transceiver to perform antenna switching, while determining the angle-of-arrival of the notification messages, based on transmission start and end times of the one or more series of consecutive bits.

In other features, the control module is configured to, while determining the angle-of-arrival of the notification messages, control the transceiver to switch between antennas at (i) a transmission start time of the one or more series of consecutive bits or (ii) a transmission end time of the one or more series of consecutive bits.

In other features, the control module is configured to perform a cyclical redundancy check on the notification messages based on a pre-known de-whitened value.

In other features, the transceiver does not perform antenna switching while the control module determines the angle-of-arrival of the notification messages.

In other features, the control module is configured to perform a cyclical redundancy check on the notification messages and indicate results of the cyclical redundancy check to the PaaK system.

In other features, the control module is configured to control the transceiver to perform antenna switching while determining the angle-of-arrival and while a characteristic is being transmitted from the portable access device to the PaaK system.

In other features, a first one of the notification messages does not include a mobile de-whitened section and other ones of the notification messages include mobile de-whitened sections. The control module is configured to determine a received signal strength indicator value based on the first one of the notification message and indicate the received signal strength indicator to the PaaK system.

In other features, a phone-as-a-key (PaaK) system is provided and includes a transceiver and a PaaK module. The transceiver is configured to, during a current connection event, receive notification messages transmitted from a portable access device, where the notification messages are transmitted to establish a communication link between the portable access device and the PaaK system and gain access to a vehicle, where one or more of the notification messages include fields, where the fields of each of the one or more notification messages include a mobile de-whitened section including two or more series of consecutive bits, and where the bits in each of the one or more series are all zeros or all ones. The PaaK module is configured to: remove the mobile de-whitened section from each of the one or more notification messages; determine whether the notification messages are valid; when the notifications messages are valid, establishing a link with the portable access device; receive angle-of-arrival information from a reader separate from the PaaK system, where the angle-of-arrival information indicates an angle-of-arrival of the notification messages relative to at least one of the reader or a reference point on the vehicle; and providing access to the vehicle to the portable access device based on the angle-of-arrival information.

In other features, the reader performs antenna switching while determining the angle-of-arrival information.

In other features, the reader does not perform antenna switching while determining the angle-of-arrival information.

In other features, the PaaK module is configured to determine whether the notification messages are valid based on a cyclical redundancy check performed by the reader.

In other features, the PaaK module is configured to determine whether the notification messages are valid based on a cyclical redundancy check performed by the PaaK module.

In other features, a first one of the notification messages does not include a mobile de-whitened section and other ones of the notification messages include mobile de-whitened sections. The PaaK module is configured to determine whether one or more of the notification messages are valid based on a received signal strength indicator value received from the reader based on a first one of the notification messages.

In other features, the notification messages are second notification messages. The PaaK module is configured to generate first notification messages and receive the second notification messages from the portable access device in response to the first notification messages. A first one of the first notification messages is a status message and other ones of the first notification messages are empty protocol data unit messages. The first one of the second notification messages is a status message and other ones of the second notification messages are mobile de-whitened messages.

In other features, the PaaK module is configured to indicate to the portable access device whether the portable access device is ahead or behind relative to a channel and connection event the portable access device is targeting.

In other features, the PaaK module is configured to determine (i) when the current connection event starts and stops, (ii) a channel hop sequence of the portable access device, (iii) a frame sequence of the portable access device, (iv) and when the portable access device transmits characteristics, and based thereon control filling a transmit queue of the PaaK system and signal the portable access device to adjust a fill rate of a transmit queue of the portable access device.

In other features, a method is provided for establishing a communication link between (i) a portable access device that includes a processor that is configured to execute instructions stored in a non-transitory computer-readable medium and (ii) a peripheral device is disclosed. The method includes generating, using the processor of the portable access device: first message authentication code (MAC) bytes based on a shared secret key; first nonce bytes; an authenticated packet based on the first MAC bytes, the first nonce bytes, and a message byte; a de-whitened tone byte based on the shared secret key; and a message packet that includes the authenticated packet and the de-whitened tone byte. Generating the message packet includes: pseudo-randomly identifying a first location of the authenticated packet; and inserting the de-whitened tone byte at the first location; transmitting, using the processor of the portable access device, the message packet to the peripheral device; and establishing, using the processor of the portable access device, the communication link between the portable access device and the peripheral device in response to the peripheral device validating the message packet.

In some configurations, the method includes generating, using a processor of the peripheral device, second MAC bytes based on the shared secret key, where the processor of the peripheral device is configured to execute instructions stored in a non-transitory computer-readable medium. The method also includes generating, using the processor of the peripheral device, second nonce bytes.

In some configurations, validating the message packet includes removing, using the processor of the peripheral device, the de-whitened tone byte from the message packet. Validating the message packet also includes determining, using the processor of the peripheral device, that the message packet is authorized in response to the processor of the peripheral device determining that the first MAC bytes match the second MAC bytes.

In some configurations, validating the message packet includes determining, using the processor of the peripheral device, that the message packet is authorized in response to the processor of the peripheral device determining that the first nonce bytes match the second nonce bytes.

In some configurations, the method further comprises determining the message packet is invalid in response to one of: (i) determining, using the processor of the peripheral device, that the first MAC bytes do not match the second MAC bytes; and (ii) determining, using the processor of the peripheral device, that the first nonce bytes do not match the second nonce bytes.

In some configurations, the first nonce bytes are generated using a random number generator.

In some configurations, the first location is between a first MAC bit of the first MAC bytes and a second MAC bit of the first MAC bytes.

In some configurations, the first location is between a first nonce bit of the first nonce bytes and a second nonce bit of the first nonce bytes.

In some configurations, the first location precedes a location of one of the first nonce bytes and the first MAC bytes.

In some configurations, a location of the first nonce bytes and a location of the first MAC bytes precede the first location.

The present disclosure also provides a system that comprises a portable access device that includes a processor configured to execute instructions stored in a non-transitory computer-readable medium. The instructions include generating, using the processor of the portable access device: first message authentication code (MAC) bytes based on a shared secret key; first nonce bytes; an authenticated packet based on the first MAC bytes, the first nonce bytes, and a message byte; a de-whitened tone byte based on the shared secret key; and a message packet that includes the authenticated packet and the de-whitened tone byte. Generating the message packet includes: pseudo-randomly identifying a first location of the authenticated packet; and inserting the de-whitened tone byte at the first location; transmitting, using the processor of the portable access device, the message packet to the peripheral device; and establishing, using the processor of the portable access device, the communication link between the portable access device and the peripheral device in response to the peripheral device validating the message packet.

In some configurations, the peripheral device includes a processor configured to execute second instructions stored in a second non-transitory computer-readable medium. The second instructions include generating, using the processor of the peripheral device, second MAC bytes based on the shared secret key. The second instructions also include generating, using the processor of the peripheral device, second nonce bytes.

In some configurations, validating the message packet includes removing, using the processor of the peripheral device, the de-whitened tone byte from the message packet. Validating the message packet also includes determining, using the processor of the peripheral device, that the message packet is authorized in response to the processor of the peripheral device determining that the first MAC bytes match the second MAC bytes.

In some configurations, validating the message packet includes determining, using the processor of the peripheral device, that the message packet is authorized in response to the processor of the peripheral device determining that the first nonce bytes match the second nonce bytes.

In some configurations, the instructions include determining the message packet is invalid in response to one of: (i) determining, using the processor of the peripheral device, that the first MAC bytes do not match the second MAC bytes; and (ii) determining, using the processor of the peripheral device, that the first nonce bytes do not match the second nonce bytes.

In some configurations, the first nonce bytes are generated using a random number generator.

In some configurations, the first location is between a first MAC bit of the first MAC bytes and a second MAC bit of the first MAC bytes.

In some configurations, the first location is between a first nonce bit of the first nonce bytes and a second nonce bit of the first nonce bytes.

In some configurations, the first location precedes a location of one of the first nonce bytes and the first MAC bytes.

In some configurations, a location of the first nonce bytes and a location of the first MAC bytes precede the first location.

Further areas of applicability will become apparent from the description provided herein. The description and specific examples in this summary are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure.

