METHOD AND CONTROL DEVICE FOR OPERATING A TRANSMITTER OF A RADIO KEY SYSTEM OF A MOTOR VEHICLE AND MOTOR VEHICLE WITH SUCH A TRANSMITTER

Abstract

The invention relates to a method for operating a transmitter unit (12) of a wireless key system of a motor vehicle (10), wherein a control device (16) of the transmitter unit (12) provides that, for a respective closing operation (S) in at least one measurement cycle (14), in each case in response to a polling message (15), in a plurality of successive time slots (19), in each case one of a plurality of anchor transmitters (13) of the transmitter unit (12) transmits an anchor message (17), and the measurement cycle (14) is ended by reception of a final message (18), which signals reception times of the anchor messages (17) measured by a wireless key unit (11). The invention provides that, for determining a transmission sequence (22) of the anchor transmitters (13), by means of an assignment rule (20) an assignment (21) of the anchor transmitters (13) to the time slots (19) is carried out, wherein the assignment rule (20) provides that the assignment (21) takes place variably over time.

Claims

1.-14. (canceled)

15. A method for operating a transmitter of a radio key system of a motor vehicle, wherein a control device of the transmitter provides that for a respective locking process in at least one measurement cycle in each case in response to a polling message in a plurality of consecutive time slots in each case one of a plurality of anchor transmitters of the transmitter sends out an anchor message and the measurement cycle is completed by receiving a final message which signals receiving times of the anchor message measured by a radio key unit, wherein for determining a transmission sequence of the plurality of anchor transmitters, an assignment of the plurality of anchor transmitters to the plurality of consecutive time slots is performed by an assignment rule, the assignment rule providing that the assignment is effected in a time-variable manner.

16. The method according to claim 15, wherein the assignment rule provides that the assignment for at least some consecutive measurement cycles is performed according to a predetermined permutation pattern.

17. The method according to claim 15, wherein the assignment rule provides that the assignment for at least some consecutive measurement cycles is performed pseudo-randomly by a cryptographic function.

18. The method according to claim 15, wherein the respective assignment selected is kept secret from the radio key unit and the control device assigns the respective receiving times signaled by the final message to the associated anchor transmitter.

19. The method according to claim 15, wherein for the locking process a predetermined training sequence and/or a session key for securing a radio communication with the radio key unit is exchanged and the assignment is derived by a function depending on the training sequence and/or the session key.

20. The method according to claim 15, wherein for the locking process several measurement cycles are performed one after the other and the measurement cycles are distinguished from each other by a counter index and the assignment performed for the respective measurement cycle is determined in dependence on the respective current counter index.

21. The method according to claim 15, wherein the assignment performed for at least one measurement cycle or at least some measurement cycles is determined in dependence on a time signal of a timer unit or a counter reading.

22. The method according to claim 15, wherein in at least one or at least some measurement cycles a number of the time slots is greater than or equal to or less than a number of the anchor transmitters.

23. The method according to claim 15, wherein the assignment rule for at least one time slot provides that two anchor transmitters within the at least one time slot transmit their respective anchor message.

24. The method according to claim 15, wherein the assignment rule provides for at least one measurement cycle that at least one anchor transmitter transmits its respective anchor message in at least two different time slots of the at least one measurement cycle.

25. The method according to claim 15, wherein the assignment rule for at least one measurement cycle provides that only some of the anchor transmitters emit their respective anchor message.

26. The method according to claim 15, wherein for at least one locking process it is provided that a plurality of measurement cycles are carried out and from the final message of each measurement cycle a respective distance value of a distance of the radio key unit to each of the anchor transmitters is determined and a release signal for the locking process is only generated if the distance values of the plurality of measurement cycles fulfil a predetermined plausibility criterion.

27. A control device for a vehicle-side transmitter of a radio key system for a motor vehicle, wherein the control device has a computing device which is configured to perform a method according to claim 15.

28. A motor vehicle with a transmitter of a radio key system wherein anchor transmitters of the transmitter are coupled to the control device according to claim 27.

Description

[0031] In the following an embodiment of the invention is described. In this connection it is shown in the following Figures.

[0032] FIG. 1 is a sketch illustrating the state of the art.

[0033] FIG. 2 is a schematic representation of an embodiment of the motor vehicle according to the invention and a representation of a radio key unit.

[0034] FIG. 3 is a sketch for illustrating a time-variable assignment, as it can be realized by an assignment rule of a control device in the motor vehicle.

[0035] FIG. 4 is a sketch for illustrating a collision problem as to be prevented by the invention.

[0036] FIG. 5 is a flow diagram for illustrating the use of a session key and a cryptographic function in determining an assignment of anchor transmitters to time slots for a measurement cycle of a locking process as may be provided according to an embodiment of the method according to the invention.

[0037] The execution example explained in the following is a preferred embodiment of the invention. In the execution example, the described components of the embodiment of the invention each represent individual features of the invention which are to be considered independently of each other and which also further develop the invention independently of each other and are thus also to be considered individually or in a combination other than the combination shown as part of the invention. Furthermore, the described embodiment can also be supplemented by further features of the invention already described.

[0038] In the figures, functionally identical elements are each provided with the same reference signs.

[0039] FIG. 2 shows a motor vehicle 10 and a radio key unit 11 in the same representation mode as FIG. 1. In the motor vehicle 10, a transmitter 12 can be provided for a radio key system, which enables a user of the radio key unit 11 to control or release a locking process S from outside the motor vehicle 10 by the radio key unit 11. For explanation of the elements with the reference signs shown reference is made to FIG. 1.

[0040] In contrast to FIG. 1, however, the control device 16 of the motor vehicle 10 according to FIG. 2 provides an assignment rule 20, which is shown here as function f (m, r), wherein the function f has an assignment 21 depending on a sequence number or an identity of the respective anchor transmitters 13 (A1, A2, . . . , AN, . . . , AN) and a current counter index r of the currently performed measurement cycle 14 as input parameters. The assignment determines a transmission sequence 22 of the anchor transmitters 13 for the current measurement cycle 14 (index r). The anchor transmitters can also be used for a distance measurement or transit time measurement inside the motor vehicle 10.

[0041] FIG. 3 illustrates how the transmission sequence 22 is determined by the control device 16 for two consecutive measurement cycles 14 with the exemplary counter index values r and r+1 using the assignment rule 20.

[0042] The arrows shown between the control device 16 and the radio key unit 11 symbolize the transmission sequence 22 in which the anchor transmitters 13 transmit their respective anchor message 17 in the measurement cycle 14. Of course, the anchor transmitters 13 do not transmit through the control device 16, but rather the display is to be taken in a symbolic way to the effect that the assignment rule 20 of the control device 16 determines the transmission sequence 22 by controlling the anchor transmitters 13 accordingly.

[0043] Over the time t, two consecutive measurement cycles 14 with the exemplary indices r and r+1 can thus result, whereby their transmission sequence 22 may differ. A time interval between the consecutive measurement cycles is also referred to as measurement interval 23.

[0044] FIG. 4 illustrates how by the assignment rule 20 also a radio collision or interference between two motor vehicles 10, 10′ can be prevented so that two colliding anchor messages can only occur for one measurement cycle.

[0045] It is shown how the anchor transmitter 13 (designated as A1, A2, . . . , An) in the motor vehicle 10 can be provided or arranged at corners of the motor vehicle 10. In the case of the motor vehicle 10′ these anchor transmitters 13′ can also be provided at the corners. In the parking situation shown, interference 24 may occur between the anchor transmitter An of the motor vehicle 10 and the anchor transmitter A2 ‘ of the motor vehicle 10’ if they transmit simultaneously.

[0046] Above the parking situation is illustrated above the time t for the motor vehicle 10 and the vehicle 10′ respectively, which anchor messages 17 the radio key unit 11, 11′ belonging to the motor vehicle 10, 10′ in each case receives. The interference 24 results during the first measurement cycle shown for the anchor messages 17 with the designations Rn for the motor vehicle 10 and R2′ for the motor vehicle 10′. If one now assumes that the measurement interval 23 is equal for both motor vehicles 10, 10′, the two anchor transmitters An of the motor vehicle 10 and A2′ of the motor vehicle 10′ would again generate the interference 24 in the next measurement cycle because they would transmit at the same time slot. This is prevented, however, in the case of the motor vehicle 10 by changing the transmission sequence and, as illustrated in FIG. 4, instead of the anchor transmitter AN for the time slot in question the anchor transmitter A2 sends its anchor message R2 so that a prevented interference 25 is rendered, since now spaced apart anchor transmitters transmit simultaneously.

[0047] FIG. 5 in a diagram illustrates how a cryptographic function 26 can be determined on the basis of a session key 27 for a radio communication the transmission sequence 22 over the time t for a given measurement cycle 14 with the counter index r. The URSK (UWB Ranging Session Key) can be used as session key 27, for example, from which a position key 29 can be determined by a predetermined function 28, which is referred to here as TPSK (Transmit Position Session Key) for example. By the cryptographic function 26, the assignment 21 can therefore be made to the first time slot 19 on the basis of the input parameters 30 consisting of the output of function 28 and the counter index r of the current measurement cycle 14. As cryptographic function 26 for example a hash value or a checksum can be calculated from the input parameters 30. The assignment 21 can then, starting for instance from the determined hash value 31, provide an offset function 32, which adds an offset value to the hash value 31, wherein each of the possible offset values 33 is assigned only once for the measurement cycle 14 so that within the measurement cycle 14 for the transmission sequence 22, one anchor transmitter A1, A2, A3, A4, A5, A6 each is assigned to exactly one still free and unused time slot 19. The example in FIG. 5 assumes that six anchor transmitters are to be assigned to six time slots 19. To determine the offset values 33 for instance a so-called shuffle function can be used as known under the name of Fisher-Yates shuffle (https://en.wikipedia.org/wiki/Fisher % E2%80%93Yates_shuffle). Such a shuffle function can receive as input value the hash value 31 and the number of time slots 19 and generates the required offset values 33.

[0048] From the current counter index r of the measurement cycle 14, a training confidence STS can also be derived.

[0049] In the case of the motor vehicle 10 shown as an example, a UWB-based time of flight measurement for determining a distance between a radio key unit 11 on the one hand and one of the anchor transmitters 13 on the other hand is thus facilitated (ToF—Time of Flight Measurement). Here the DS-TWR method with polling message P, anchor message R, and final message F can be used. The use of several anchor transmitters 13 is possible in this connection. The time of flight measurement can be periodically repeated by several measurement cycles 14 to allow a more precise localization and/or position tracking over time.

[0050] The following solutions are offered by the control device 16.

[0051] M1: The assignment (mapping) of the anchor transmitters to the time slots is effected dynamically and changes with each measurement cycle.

[0052] M2: The mapping occurs according to a predetermined pattern (for example permutation).

[0053] M3: The mapping can be cryptographically secured and known only to the participating measuring elements.

[0054] M4: The mapping is transparent for the initiator, i.e. the radio key unit, and only known to the transmitter.

[0055] M5: The mapping is derived from the cryptology for the STS (see FIG. 5).

[0056] M6: The mapping depends on the indexing r of the current measurement cycle or ranging cycle.

[0057] M7: The mapping depends on the time t (time slots).

[0058] M8: The number of time slots is equal to, less than or greater than the number of anchor transmitters (any number of anchor transmitters is mapped to any number of time slots).

[0059] M9: Time slots can be occupied multiple times (if M>N).

[0060] M10: Anchor transmitters can use several time slots within one measurement cycle (increase of the availability/accuracy).

[0061] M11: Not every anchor transmitter must be assigned one time slot per measurement cycle (if M>N).

[0062] M12: To increase safety, the control device accepts a measured value of a runtime for an anchor transmitter only after k successful plausibility checks using a plausibility criterion.

[0063] This reduces the possibility of a physical attack on the transmitter considerably, since for one measurement cycle an attacker does not know which anchor transmitter will transmit next.

[0064] An identification of the next transmitting anchor transmitter is considerably complicated by the method described here. In this connection it is to be generally stated that in a transmitter with M installed anchor transmitters the probability is 1/N that an attacker can guess the correct time slot in which a previously determined anchor transmitter will transmit if he has no special knowledge about the transmission sequence 22. In other words, this probability is equally distributed, which is why the assignment rule 20 described here can also be referred to as whitening (whitening or equal distribution). If the assignment rule 20, i.e. an appropriate mapping, is chosen for the anchor transmitters on the time slots, it can be achieved that a successful, random, K-times identification of an anchor occurs only with the probability (1/N).sup.k.

[0065] However, such an attack can be excluded by specifying a sufficiently high number of required positive validation tests, for which purpose several measurement cycles can be provided for a single locking process and the positive validation is specified by a plausibility criterion and the corresponding minimum number of positive validations is also given by the plausibility criterion. Thus the probability of success of an attack decreases exponentially with the number of positive validations defined by the plausibility criterion.

[0066] As illustrated in FIG. 4, when performing measurement cycles according to a statistical pattern with several motor vehicles, interference 24 may occur, which can be caused by simultaneous transmission of a respective anchor message of two uncoordinated anchor transmitters 13, 13′ if two anchor transmitters use the same measuring interval 23 and the anchor messages partly overlap in time or there is interference between individual anchor messages.

[0067] By changing the transmission sequence 22 in consecutive measurement cycles, the assignment of time slots to anchor messages is dynamically changed, which is why no static state can be created in which two interfering anchor transmitters 13, 13′ always transmit their anchor messages simultaneously for each measurement cycle. This means that for a radio key unit 11 the interference-free receiving of anchor messages can be specified or guaranteed for several measurement cycles except for one.

[0068] Since the number N of the installed anchor transmitters 13 may differ depending on the type of motor vehicle 10 and its equipment, for a coexistence of different transmitters it is required that their transmission protocol is configured to be uniform. The proposed assignment rule 20 allows a uniform length of the anchor messages to be achieved. For this purpose, a number N of time slots 9, which is prescribed by the transmission protocol, is preferably defined to be fixed. For motor vehicles with less than N anchor transmitters, an increase of the measuring accuracy can be achieved by multiple occupation of time slots with anchor transmitters. In contrast, for a motor vehicle with more than N anchor transmitters, the proposed method can achieve a temporal compression, for example by not having to transmit every anchor transmitter in every measurement cycle. It can be ensured thereby that all surplus anchor transmitters transmit their anchor message sporadically or cyclically after several measurement cycles. Furthermore, the proposed method allows the prioritization of important anchors for which the distance measurement is to be performed more frequently or with greater measuring accuracy. For this purpose, the assignment rule can be designed accordingly.

[0069] Altogether the example shows how a frame slot whitening can be achieved by the invention in measurement cycles of a transmitter of a radio key system.

LIST OF REFERENCE SIGNS

[0070] 10 motor vehicle [0071] 10′ motor vehicle [0072] 11 radio key unit [0073] 11′ radio key unit [0074] 12 transmitter [0075] 13 anchor transmitter [0076] 13′ anchor transmitter [0077] 14 measurement cycle [0078] 15 polling message [0079] 16 control device [0080] 17 anchor message [0081] 18 final message [0082] 19 time slot [0083] 20 assignment rule [0084] 21 assignment [0085] 22 transmission sequence [0086] 23 measurement interval [0087] 24 interference [0088] 25 interference-free communication [0089] 26 cryptographic function [0090] 27 session key [0091] 28 function [0092] 29 position key [0093] 30 input parameter [0094] 31 hash value [0095] 32 offset function [0096] 33 offset [0097] r index [0098] S locking process