Method for safeguarding code words of a remote control system
This is a continuation of application Ser. No. 07/483,812, filed Feb. 23, 1990, now abandoned. 
    
    
     BACKGROUND AND SUMMARY OF THE INVENTION 
     The invention relates to a method and system for safeguarding code words of a remotely actuated control system. An example of the mode of operation of a known remote control system, provided in particular for central locking systems of motor vehicles, is shown in German Patent 36 36 822 C1. 
     The code words of this remote control system are transmitted wirelessly by a remote transmitter and received by a receiver at the control system. The code words are protected against unauthorized recording and use by sychronizing the advancement of a portion, of each code word in the receiver and in the last-used transmitter. The algorithm, which produces the advancement, takes as its basis a normally unalterable key word stored in EEPROMs both in the receiver and in the transmitter. 
     Owing to the selected composition of each code word and of the algorithm used, which advances in one direction only, a code word which has been used can only recur identically after a very long period of time or a very large number of advances. The unauthorized reuse of an illegally recorded code word is thereby virtually excluded. 
     In addition to its algorithmically alterable portion, each code word of the generic remote control system can furthermore contain so-called system bits, which can be used for various distinctions--e.g. key types (main/secondary key), car make, key system, currently controllable function etc. According to one variant of the known system, these system bits are exempted from algorithmic alteration. One or more system bit (s) can however nevertheless be altered at will by the user of the transmitter--by switches provided in addition to the transmit button on the transmitter--in order to alter the function controllable or triggerable by the transmitter without influencing the advance algorithm. 
     While the door of the vehicle is open, the receiver can be switched manually to a &#34;learning phase&#34; by an electrical switch. In this learning phase, the key code word of the receiver is reprogramed, by the next code word transmitted to the receiver from an arbitrary transmitter compatible with the system in general. The system bits may also be reprogramed in the learning phase. This new key code word is then accepted and stored as the key code word underlying the advance in accordance with the predetermined algorithm upon each successive code-word transmission. 
     A code word stored in an available transmitter can be completely reset by removing the battery from the transmitter. The above-described `learning phase` of the receiver--using the transmitter with reset code--can then be carried out again. This is recommended in particular for shortening synchronization when the code words in transmitter and receiver have been advanced to a different extent. Of course, an unauthorized person can also carry out the resetting procedure described in the transmitter by temporary removal of the battery from the transmitter in his possession. 
     A remote control system of a central locking system shown in one embodiment of German Patent DE 32 44 049 C2, makes available, using a plurality of transmitters, a quantity of code words which differs from transmitter to transmitter. 
     Since the code words of this remote control system are also advanced algorithmically, measures must be taken, in dependence on the transmitter used, to limit the code advance to the limited code-word supply allocated individually to said transmitter. This avoids unnecessary resynchronization effort in the case of alternating transmitter use. 
     For this purpose, each transmitter is allocated different identification codes, which can be emitted first when the respective transmitter is actuated. For processing the code words which differs from transmitter, a decoding device connected downstream of the receiver is equipped with a plurality of decoding channels corresponding to the number of transmitters. Thus it is possible for said decoding channels to be switched on by the transmitter identification codes. 
     Nothing is mentioned of the nature of these transmitter identification codes in the last-mentioned patent. Functionally, they are to be equated with the arbitrarily alterable system bits of the generic remote control system and can be used, for identifying key types having different locking functions. 
     It is shown in German Patent DE 33 09 802 C2 to simplify th adaptation of standardized sensors (for tank filling, temperatures etc.) to the individual conditions in a particular motor vehicle with the aid of a ROM which contains vehicle-specific signal-conversion characteristics and impresses these on the signal-conversion arrangements provided between the sensors and their display instruments. But there is no indication that this can be used for the code words of a remote control system. 
     According to the invention, all code words generatable by the algorithmic advance includes at least one object-specific and unalterable basic portion of all code words. Since virtually any number of variations of a code-word portion can be produced with relatively little effort by electronic coding, it is possible to allocate to each object, i.e. even to each motor vehicle of a model series, its own, nowhere repeated, object-specific code. 
     Each transmitter belonging to the object is also allocated an unalterable basic portion of all code words. 
     This basic portion can be the same for all transmitters and then need be stored only once in the object. 
     In a preferred embodiment, each transmitter of the remote control system is allocated an individual, unalterable basic portion of all code words. This is consequently object--and transmitter-specific. In this embodiment, a total supply of all individual basic portions which corresponds at least to the number of transmitters supplied for independent parallel use must be stored in the object or receiver. 
     The permanent storage of the object-specific portions must be withdrawn from any write access storage, i.e. can, for example, be present in ROMs. It can be linked with the temporary storage of the alterable portions or, alternatively, be present in completely, i.e. even physically, separated memories. This has the advantage that, in contrast to the prior art, it is no longer possible to use any transmitter obtainable from a spare-parts dealer for storing a new current code word in the receiver, even when a transmitter RESET has been carried out and the mechanical safeguard has been overcome. This is because, although the object-specific, unalterable portions of the code words are still transmitted and prechecked for correspondence, they can under no circumstances effect alterations of the corresponding permanent memory contents in the object or receiver. It is obvious that the sale of replacement transmitters for such a system can be considerably better monitored and misuse made even more difficult. Exchange of the object-specific basic portions, once allocated, is only possible by exchanging the control device or the memories. 
     The basic portions can additionally contain user-specific portions which, upon transmitter actuation, impart certain user data to the receiver or object in advance. User-specific code portions of this kind are already known per se; in the automotive application of a remote control system. They act, for example, on adjustable vehicle components such as seats or rear-view mirrors. 
     Unauthorized use of the remote control system with a lost transmitter can be c very effectively by automatically invalidating--i.e. blocking or erasing each basic code-word portion which is allocated to a transmitter which has a) already been used at least once and b) has not been used in a read-in procedure. This automatic safeguarding function can be made dependent on various conditions: 
     the at least single use of the transmitter, the basic code-word portion of which is to be blocked, can be detected, for example, by recording a code advance procedure in the associated alterable portion of said code word; 
     the safeguarding function can in principle be carried out during the final acknowledgement of a read-in procedure performed with a plurality of transmitters; or 
     it can be carried out in dependence on the sequence of reading in, e.g. if, during the read-in procedure, a particular sequence is not complied with because one transmitter is missing. Here it is useful if the total supply of basic code-word portions stored in the object is somewhat larger than the number of transmitters supplied. An additional basic code-word portion, which has not yet been used, from the total supply can then be allocated to the transmitters to be newly acquired for the remote control system. 
     Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of the invention when considered in conjunction with the accompanying drawings. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The single drawing figure shows a remote control system having a single object and a plurality of transmitters constructed in accordance with an embodiment of the present invention. 
    
    
     DETAILED DESCRIPTION OF THE DRAWINGS 
     A total quantity of n code words CW l  to CW n  is stored in n memory locations ML l  to ML n  in a control device 1 arranged in an object to be protected, e.g. a motor vehicle V. It corresponds to at least a number m of associated transmitters T l  to T m  which are to be supplied for independent use in parallel, e.g. by different persons. The number m of transmitters T l  to T m  can be less than or equal to n. In the illustration chosen, m=3. 
     Each code word CW l  to CW n  consists of 
     a) a fixed basic portion CWB 1 , CWB 2  etc., which is object- and transmitter-specific and cannot be altered, i.e. is stored, for example, in ROMs, and 
     b) an alterable portion CWA 1 , CWA 2  etc., which is alterable in known manner in accordance with any desired algorithm in both the transmitters and the receiver control device. 
     The specific algorithm is not essential to the invention and is therefore not explained in greater detail here. Algorithms and apparatus to produce them are discussed in the Background of the Invention. For the sake of clarity, the memory locations ML l  . . . m for the unalterable basic portions and the alterable portions are illustrated as unitary but can of course have different structures, in particular can also be physically separated from one another. 
     The code words CW l  . . . m are here illustrated graphically as sequences of decimal numbers. It is self-evident that the type of code used and, likewise, the manner of transmission of the code words between the transmitters and the receiver are completely irrelevant to the essential nature of the invention. Any desired types of code or transmission methods can be used (infrared, ultrasound, radio). As can be seen, the alterable portions CWA of the code words also differ from one another; since they are independently advanced by the control device 1 after each code transmission. Identical alterable portions CWA l  . . . n in two or more code words can only occur by chance, if at all; but code words then still differ in their basic unalterable portions CWB . . . . 
     Each transmitter T 1  to T 3  contains, a code transmission element, illustrated as an infrared diode IT, which can be activated to transmit the current code word CW . . . . stored in the particular transmitter by actuation of a transmit button TB. As can be seen, the current code words CW 1  to CW 3  of transmitters T 1  to T 3  correspond completely to those in memory locations ML 1  to ML 3  of the control device 1. The code word in a specific transmitter is advanced by an algorithm after each transmission. 
     An infrared receiver IR of the motor vehicle V passes each code word CW 1  . . . 3 received on in known manner to the control device. Before the execution of any function controllable by transmitter T, i.e., for example, unlocking or locking of the vehicle by a symbolically indicated central locking system CL connected to control device 1, the receiver code word CW is compared to the code words CW 1  . . . 3 stored in the memory locations ML 1  . . . 3 for complete correspondence. 
     If complete correspondence is ascertained, then, in the illustrative embodiment, the vehicle V is unlocked centrally in execution of a controlled function--&#34;unlocking&#34;. The control device 1 does not of course react to code words of a strange or desynchronized transmitter. It is self-evident that more than just one receiver IR can also be provided; however, a single central control device 1 would to be used. 
     A reset button 2, likewise associated with the control device 1, is provided in the protected zone of the object, e.g. in the passenger compartment of the motor vehicle V. It is thus accessible only when the object has been desecured (=open door). By this reset button 2, all alterable portions CWA l  . . . n of the control device 1 can be reset, independently of transmitter actuation, to defined initial states--which can likewise differ from one another. By this resetting, the owner of the vehicle can, in the event of loss of a transmitter, immediately prevent unauthorized persons from using the lost transmitter for controlling the function allocated to it. The current code words in the transmitters are of course not reset in this procedure. 
     Starting from this reset state of the alterable portions CWA l  . . . n, the memory contents of the control device 1 must be resynchronized with the corresponding memory contents of the transmitters T l  . . . m still in the possession of the vehicle owner in order to ensure that they can continue to be used. For this purpose, a rereading code transmission must be carried out from each of these transmitters to the receiver. Each first code transmission of each transmitter after a resetting procedure is considered a rereading code transmission. During this procedure, the object- and transmitter-specific basic code-word portions CWB l  . . . n are in all cases used: 
     a) to check the code word read-in to establish whether at least a &#34;matching&#34; basic portion CWB l  . . . n is being transmitted; and 
     b) to unambiguously allocate the alterable portion CWA l  . . . n being re-read in from the transmitter T l  . . . n to the corresponding basic portion CWB l  . . . n stored in the object. 
     Before the finally effective storage of its alterable portion CWA l  . . . n in a memory location ML l  . . . n, each re-read code word must then be acknowledged by a further switch 3 which is associated with the control device 1 and represents an acknowledgement device. The switch 3 can only be actuated if a mechanical key 5 which fits is available. This key 5 here symbolically represents the associated mechanically coded device for actuating the switch 3. This can, for example, be integrated--in a known manner--into a lock cylinder (not shown) of a door or of an ignition/steering lock and be actuated therein directly by the key 5. The additional mechanical safeguarding of each read-in procedure results in the advantage that unauthorized resynchronization of the control device 1 or of the receiver using the lost transmitter can be prevented merely by replacing the mechanical locks of the motor vehicle V. 
     An invalidation device 4 is provided--which can, for example, switch on a read lockout for one or more memory locations ML l  . . . m or control an erasure of the particular memory content. Thus it is possible to invalidate the unalterable basic portions CWB l  . . . n or the complete code words CW l  . . . n which were allocated to the lost transmitters. The invalidation device 4 is, for example, activated by locking actuation of the switch 3. 
     Although the present invention has been described and illustrated in detail, it is to be clearly understood that the same is by way of illustration and example only, and is not to be taken by way of limitation. The spirit and scope of the present invention are to be limited only by the terms of the appended claims.