Passive entry/passive start systems using I and Q data for detecting range extender type relay station attacks
A system includes a transmitter, a receiver and a control module. The transmitter transmits a RF signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device. The receiver receives a response signal from one of the vehicle and the portable access device in response to the RF signal. The control module: converts the response signal to in-phase and quadrature-phase signals; based on the RF, in-phase signal and quadrature-phase signals; detects a range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle; where the RF signal is relayed via the attacking device from the vehicle to the portable access device or the response signal is relayed via the attacking device from the portable access device to the vehicle; and performs a countermeasure.
1. A system for detecting a range extension type relay attack, the system comprising:
a transmitter configured to transmit a radio frequency signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device;
a receiver configured to receive a response signal from one of the vehicle and the portable access device in response to the radio frequency signal; and
a control module configured to
convert the response signal to an in-phase signal and a quadrature-phase signal,
sample the in-phase signal and the quadrature-phase signal,
determine received bits based on the in-phase signal and the quadrature-phase signal,
up-sample the received bits on the in-phase signal and the quadrature-phase signal,
up-sample another signal,
cross-correlate results of the up-sampling the received bits based on the in-phase signal and the quadrature-phase signal with results of up-sampling the another signal,
determine a phase based on the results of the cross-correlation,
based on the radio frequency signal and the phase, detect the range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle,
wherein at least one of (i) the radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle, and
perform a countermeasure in response to detecting the range extension type relay attack.
2. The system of claim 1 , wherein the control module is implemented at the vehicle.
3. The system of claim 1 , wherein the control module is implemented at the portable access device.
4. The system of claim 1 , wherein the control module is configured to:
determine a difference in phase based on the in-phase signal and the quadrature-phase signal;
measure a round trip time of the radio frequency signal based on the difference in phase; and
based on the round trip time, detect the range extension type relay attack.
5. The system of claim 1 , wherein the another signal includes a reference bit pattern.
6. The system of claim 5 , wherein the control module is configured to determine a sign of the differentiated arctangent signal, and based on the sign generate the reference bit pattern.
7. The system of claim 1 , wherein the another signal includes the radio frequency signal after being filtered via a Gaussian low pass filter.
8. A system for detecting a range extension type relay attack, the system comprising:
a transmitter configured to transmit a radio frequency signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device;
a receiver configured to receive a response signal from one of the vehicle and the portable access device in response to the radio frequency signal,
wherein the transmitter and the receiver are both implemented at a same one of the vehicle and the portable access device;
a control module configured to:
convert the response signal to an in-phase signal and a quadrature-phase signal,
based on the radio frequency signal, the in-phase signal and the quadrature-phase signal, detect the range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle,
wherein at least one of (i) the radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle, and
perform a countermeasure in response to detecting the range extension type relay attack; and
an antenna module,
wherein
the antenna module is implemented at the one of the vehicle and the portable access device where the transmitter and the receiver are implemented,
the antenna module comprises multiple polarized antennas, and
at any moment in time, at least one of the multiple polarized antennas of the antenna module is not cross-polarized with an antenna of the other one of the vehicle and the portable access device.
9. A method for detecting a range extension type relay attack, the method comprising:
transmitting via a transmitter a radio frequency signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device;
receiving a response signal via a receiver from one of the vehicle and the portable access device in response to the radio frequency signal;
converting via a control module the response signal to an in-phase signal and a quadrature-phase signal;
sampling the in-phase signal and the quadrature-phase signal;
determining received bits based on the in-phase signal and the quadrature-phase signal;
up-sampling the received bits based on the in-phase signal and the quadrature-phase signal;
cross-correlating results of the up-sampling the received bit with results of up-sampling the another signal;
determining a phase based on the results of the cross-correlation,
based on the radio frequency signal, and the phase, detecting via the control module the range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle,
wherein at least one of (i) the radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle; and
performing a countermeasure in response to detecting the range extension type relay attack.
10. The method of claim 9 , wherein the control module is implemented at the vehicle.
11. The method of claim 9 , wherein the control module is implemented at the portable access device.
12. The method of claim 9 , further comprising:
determining a difference in phase based on the in-phase signal and the quadrature-phase signal;
measuring a round trip time of the radio frequency signal based on the difference in phase; and
based on the round trip time, detecting the range extension type relay attack.
13. The method of claim 9 , wherein the another signal includes a reference bit pattern.
14. The method of claim 9 , wherein the another signal includes the radio frequency signal after being filtered via a Gaussian low pass filter.
15. A method for detecting a range extension type relay attack, the method comprising:
transmitting via a transmitter a radio frequency signal from one of a vehicle and a portable access device to the other one of the vehicle and the portable access device;
receiving a response signal via a receiver from one of the vehicle and the portable access device in response to the radio frequency signal,
wherein the transmitter and the receiver are both implemented at a same one of the vehicle and the portable access device;
converting via a control module the response signal to an in-phase signal and a quadrature-phase signal;
based on the radio frequency signal, the in-phase signal and the quadrature-phase signal, detecting via the control module the range extension type relay attack performed by an attacking device to obtain at least one of access to or operational control of the vehicle,
wherein at least one of (i) the radio frequency signal is relayed via the attacking device from the vehicle to the portable access device, or (ii) the response signal is relayed via the attacking device from the portable access device to the vehicle; and
performing a countermeasure in response to detecting the range extension type relay attack,
wherein
an antenna module is implemented at the one of the vehicle and the portable access device where the transmitter and the receiver are implemented,
the antenna module comprises multiple polarized antennas, and
at any moment in time, at least one of the multiple polarized antennas of the antenna module is not cross-polarized with an antenna of the other one of the vehicle and the portable access device.