1. Field of the Invention The present invention relates to an improved secure self learning system and method and, in particular, to an improved secure self learning system and method for remotely controlling systems and devices in security systems.

2. Discussion of the Background The remote control of systems or devices via ultrasonic, radio fiequency or infla red transducers is popular for many applications, including security systems for buildings and vehicles, and remote controlled garage door and gate openers. Certain unidirectional transmission systems currently in use have two very important security shortcomings: (a) the codes they transmit are usually fixed; and (b) the number of possible code combinations is relatively small. Either of these shortcomings can lead to unauthorized access.

The limited number of possible combinations available in most remote control systems makes it possible to transmit all possible combinations in a relatively short time. A hand held microprocessor-based system for this purpose (called a code scanner) can easily be constructed.

In systems using eight DIP switches (256 combinations), this scanning process can typically be accomplished in less than 32 seconds, when trying eight combinations per second.

Even in systems using 16 bit keys, yielding 65,536 combinations, only 2 1/4 hours would be required to try all possible combinations. It should also be noted that the scanner may gain access in far less time than this maximum time and the average time would, in Ihcl, be halt of the total time.

An easier way of gaining unauthorized access to a security system is freely available. A unit of this type is advertised as a tool for the "legal repossession of vehicles." A remote control transmitter of the type normally used in vehicle security and remote control systems includes a small radio transmitter that transmits a code number on a spccific li-cquency. This code number is normally generated by an integrated circuit encoder. llis tri'0smission frequency is usually fixed by legislation within a particular country. Illus, it is possible to build a receiver tllat call receive signals from all such transmitters and to use this together with a circuit which records the transmissions captured by the receiver. Such a device is known as a code or key grabbed and can be used to gain access to protected premises or to vehicles with remote control security systems.

Code hopping and rolling code systems are currently available to overcome the limitations of fixed code systems (refer to ZA Patent No. 91/4063 and U.S. Patent No.

5,103,221). The specifications of these patents describe transmitters which use algorithms to generate a different transmission each time the transmitter is activated. When a code is received and decoded, a decoder responds only if a valid transmission was made. In some cases (refer to ZA Patent No. 91/4063) a special algorithm is used with a stored key to decode an encoded reception. The decoded value is then compared to a stored value to detemine if the transmission is legitimate or not.

A disadvantage of code hopping and rolling code systems is the fact that it is difficult to replace or disable lost, stolen or unserviceable transmitters. External equipment must be used by a manufacturer or dealer to reprogram and replace a transmitter. An additional security problem may be created during this process.

Ideally, a security system should not require dealer intervention when a user needs lo add a new transmitter to the system or replace a transmitter. The user should be able to buy a generic replacement transmitter off the shelf and add this transmitter unassisted then convenient. Leaving systems provide this capability, in that the decoder can "learn" the new transmitter's identity without having to be reprogrammed from outside using special equipment.

A learning system should however not only enable a user to add a new transmitter to the system, but should also have a means of excluding a previous transmitter from the system, due to the possibility of such a transmitter falling into the wrong hands.

In self learning fixed code systems, the incoming code is stored for fbture references by the decoder when it is in a learning mode. Subsequent transmissions are compared \vilh the learned code. Different arrangements to learn new transmitler codes are used. A switch can be

used to set the decoder either in a normal operation mode or in a learning mode (U.S. Patent Nos. 4,750,118 and 4,912,463). In the learning mode, the decoder can lean new valid codes from a transmitter. Similar means are used (refer to U.S. Patent Nos. 4,931 *789 and 5,049,867) to program the decoders to react to a new transmitler code. ln anotbel- patenl (refer to O.S.

Patent No. 5,148,159), a randomly selected fixed code is generated by the decoder and programmed into the associated transmitter. U.S. Patent No. 4,855,713 describes the use of a hand held programmer to program the new fixed code to be recognized by the decoder. In all of these patents, the transmitted or programmed codes are fixed stored codes. Security threats by means of code grabbing or code generation still exist irrespective of the learning mechanism employed. In addition, for these systems to learn, the user has to either (1) use a cumbersome, more expensive, two switch system; and/or (2) the user has to set the receivelldecoder in learning mode via (a) a switch inconveniently physically located on the receiver/decoder which can be very difficult (if not impossible for elderly or handicapped persons) to activate once the system, e.g., a receiver of a garage door opening system. is installed, e.g. on the ceiling of a user's garage (See Figure 1 of U.S. Patent No. 4,750,11 8), (b) a code sent by the transmitter -- activation and use of such can be complicated and not secure if the transmitter is lost or worse stolen, or (c) a code sent by a separate programming means which can be complicated to use and likewise not secure if the programming means is lost or worse stolen.

Reference should also be made to the specifications of tulle following U.S. Patent Nos.: RE 29,525; 4,380,762; 4,385,296; 4,426,637; 4,529,980; 4,534,333; 4,574,247; 4,5c)0,470:

4,596,985; 4,638,433; 4,652,860; 4,686,529; 4,737,770; 4,779,090, 4,835,407; 4.847,614; 4,855,713; 4,878,052; 4,890,108; 4,928,098; 4,951,029; 4,988,992; 5,049,856; and 5,055,701.

In contrast to tloe above-described fixed-code systems, the invention of the present application provides a secure self-learning code hopping or rolling code system wloereby security threats by code grabbing or code generation devices are rellloved.

According to one preferred embodiment, the invention of the present application provides an improved rolling code or code hopping system comprising an encoder and a decoder, wherein the improvement comprises: a decoder learning mode activation means whereby upon activation of said means the decoder is set in learning mode, said means being physically remote or detached from the encoder, and tloe decoder, and preferably from any other programming means.

According to a further embodiment, the invention of bloc prescnl application provides an improved code hopping or rolling code system comprising a transmitter and a receiver. 'vloerein said improvement comprises: a receiver learning mode switch whereby upon activation of said switch the receiver is set in the leanoing mode, said switch being ploysically detached or remote from the receiver, the transmitter, and preferably any other programming means.

The invention provides, in the first instaloce, a method of operating an encoder which includes the steps of: storing a serial number; storing at least one of the following: a seed; and a key which is generated using a manufactuler's master key and at least one of the following: the seed; and the serial number; and transferring key generation information selected at least from: the seed; the serial number; and information derived liom applying the key and an algorithm to an input value.

The input value may include infolmatioll selected at least from: a management code; a counter value; and infonnation relating to a command.

in one embodiment the method includes the steps of: storing a plurality of parameter sets, each parameter set including information selected at least from: a respective serial number; a respective seed; a respective key; and

respective information derived front applying the said respective key and the algoritllm to a respective input value; selecting a parameter set; and transferring the respective key generation infornoation for the selected parameter set.

Each input value may include infornoation selected at least from: a respective management code; a respective counter value; and information relating to a command.

The invention also extends to a method of operating a decoder which includes the steps of: storing a manufacturer's master key; setting the decoder in learning mode by activating a decoder learning mode activation means physically remote or detached from the decoder; receiving a signal which contains key generation inforniation selected at least from: a seed; a serial number; and encoded information derived from applying a first key and an algorithm to an input value; and

generating a second key using at least the key generation information and the manufacturer's master key.

The method may include the steps of storing at least one of: the second key; the key generation information; and the serial number.

In one embodiment the received signal includes the encoded information and the method includes the steps of: decoding the encoded information using a decoding algoritlml and a previously generated second key to obtain a decoded input value which includes information selected at least from: a management code; a counter value; and information relating to a command; and storing the decoded input value.

The method may include the steps of: storing a plurality of parameter sets, each paral1leter set including information selected at least from: a respective serial number; a respective nomoagement code; and a respective counter value.

The invention further extends to a method of operating an access control system which includes an encoder and a decoder, the method including the steps of: storing a serial number; storing at least one of the following: a seed; and a first key which is generated using a manufacturer's master key and at least one of the following: the seed; and the serial number; and using the encoder to transfer a signal which includes key generation information selected at least from: the seed; the serial number; and information derived from applying the first key and an algorithm to an input value; and storing a manufacturer's master key in the decoder; activating a decoder learning mode activation means for setting the decoder in leaning mode, said means being remote from the encoder and the decoder; receiving the transferred signal by the decoder; and

generating a second key by the decoder using at least the key generation information and the manufacturer's master key.

The second key or the key generation infomlation may be stored. in the fonner case, the method includes the steps of: activating the encoder with a command; encoding at least an input value using the first key and an algorithm to form an encoded part, the input value including information selected at least from: a counter value; a management code; and information relating to the command; using the encoder to transfer a signal which is fondled from al least the serial number and the encoded part; and, at the decoder, receiving the transferred signal; and using the second key and a decoding algoritlono to decode thc said encoded part in the transferred signal to obtain the said input value.

In the latter case the method includes the steps of: activating the encoder with a command; encoding at least an input value using the first key and an algorithm to form an encoded part, the input value including formation selected at least atom: a counter value;

a management code; and information relating to the command; using the encoder to transfer a signal which is formed from at least the serial number and the encoded part; mod, at the decoder, receiving the transferred signal; and using the key generation information and a decoding algorithm to decode the said encoded part in the transferred signal to obtain the said input value.

The method may further include the steps of: at the encoder, storing a plurality of parameter sets, each parameter set including information selected at least from: a respective serial number; a respective seed; and respective infornoation derived from applying the said respective key and the algorithm to a respective input value; selecting a parameter set; activating the encoder using a command; transferring a signal which contains the key generation infonooatioio associated with a selected parameter set; and, at the decoder, storing a plurality of parameter sets, each parameter set including information selected at least from: a respective serial number;

a respective management code; and a respective counter value; receiving the said transferred signal, and generating a respective second key, associated with a selected parameter set, using the manufacturer's master key and the key generation information contained in the said transferred signal.

Preferably the encoder and the decoder are each formed in a respective microchip.

The invention also provides an encoder which includes: means for storing a serial number; means for storing at least one of the following: seed; and a key which is generated using a manufacturer's master key and at least one of the following: the seed; the serial number; and means for transferring key generation inlbrmation selected at least from: the seed; the serial number; and information derived from applying the key and an algorithm to an input value.

The encoder may include means for storing a plurality of parameter sets, each parameter set including information selected at least from: a respective serial number; a respective seed; a respective key; and respective information derived from applying the said respective key and the algorithm to a respective input value; and means for selecting a parameter set; the said transferring means being adapted to transfer the respective key generation information for the selected parameter set.

The invention also extends to a decoder which includes: means for storing a manufacturer's master key; means for receiving a signal which contains key genelation inlbnnatioio selected at least from: a seed; a serial number; and encoded information derived from applying a first key and an algorithm to an input value; and means for generating a second key using at least the key generation information and the manufacturer's master key.

Means may be provided for storing at least one of:

the second key; the key generation information; and the serial number.

The invention further provides an access control system which includes an encoder learning mode activation means, and a decoder, the encoder including: means for storing a serial number; means for storing at least one of the following: a seed; and a first key which is generated using a manufacturer's master key and at least one of the following: the seed; and the serial number; and means for transferring a signal which includes key generation infbriioa- tion selected at least from: the seed; the serial number; and information derived from applying the first key and an algorithm to an input value; a decoder learning mode activation means physically remote from the encoder and the decoder for setting the decoder in learning mode; and the decoder including:

means for storing a manufacturer's master key; means for receiving the transferred signal; and means for generating a second key using at least the key generation information and the manufacturer's master key.

The system may include means for storing the second key or the key generation information.

In the former case the system may include: means for activating the encoder with a command; means for encoding at least an input value using the first key and an algorithm to form an encoded part, the input value including information selected at least from: a counter value; a management code; and information relating to the command; means for forming a signal, for transfer by the encoder, frono at least the serial number and the encoded part; the decoder including means for using the second key and a decoding algorithm to decode the said encoded part in the transferred signal, received by the said signal receiving means, to obtain the said input value.

In the latter case the system may include: means for activating the encoder with a command;

means for encoding at least an input value using the first key and an algorithm to form an encoded part, the input value including infolmation selected at least front: a counter value; a management code; and information relating to the command; means for forgoing a signal, for transfer by the encoder fiom at least the serial number and the encoded part; the decoder including means for using the key genel-ation information and a decoding algorithm to decode the said encoded part in the transferred signal, received by the said signal receiving means, to obtain the said input value.

The system may include means for storing a plurality of parameter sets at thc encoder, each parameter set including information selected at least from: a respective serial number; a respective seed; and respective information derived from applying tloe said respective key and the algorithm to a respective input value; means for selecting a parameter set; means for activating the encoder using a command

the signal transferring means then transferring a signal which contains the key generation information associated witlo a selected palanoeter set; means for storing a plurality of parameter sets at tloe decoder, each parameter set including information selected at least from: a respective serial number; a respective management code; and a respective counter value; and means for generating a respective second key, received by the said signal receiving means, associates with a selected parameter set, using the manufacturer's master key and the key generation information contained in tloe said transferred signal.

Preferably the encoder and the decoder are each formed in a respective microchip.

It is an object of the present invention to provide an access control systcm wherein a transmitter or token, such as a so-called "smart card." may be replaced or addled to tloe system by a user without external equipmcnt and without transferring an encoding key in clear fornoat.

i.e., in unencoded form.

The access control system may allow for the disabling, in a decoder, of stolen transmitter codes to prevent unauthorized access to the system.

Another object of the invention is to provide an access control system which acts against the use of code grabbing or scanning methods.

The invention is further concemed with an encoder and a decoder for use in an access control system, and with their method of operation.

During the manufacturing process, encoders are programmed with different serial numbers associated with a range of decoders. A unique manufacturer's master key is used together with an algoritllm and tloe serial number, to generate and store a user key in a non- volatile memory of the encode, together with counter, management code and other information.

Several sets of these parameters can be stored to handle several transmissions (transmit different commands by activating different inputs). The noanufacturer's master key is also stored in all the manufacturer's decoders. User data and control data is also programmed to control the different functions that need to be activated by the encoder. The same algorithm used to generate the user key in the encoder must also be present in the decoder.

In normal operation of an encoder, the key information associated with a parameter set is used to encode the variable counter infornoation, together with the encoder management code.

serial number and other information by making use ofa special algorithm. The information that is encoded will be different each time the encoder is activated. this technique is refereed to as code whopping. Although it is known that the counter infbrnoatioio changes, tloe transmission is not predictable because of the secret key and algorithm that encode the infonooation. In an access control systems, a fixed part denoting the serial number may be generated with the code hopping part and together form a transmission value that is transmitted by a data transfer interface.

In one embodiment of the invention an encoder learning capability is implemented.

This allows a user to replace an encoder or add an encoder to be recognized by a decoder which has a leaniing mode function, selectable by the user. The learning mode function can be selected by activating it on the decoder. This can be accomplished by using a normal encoder and programming the output function to set the decoder in learning mode. This is also known as a master encoder or token. The use of such a master encoder allows for a highel- level of security to be achieved. The master token may also be used in conjunction with input switches.

In a different embodiment of the invention, it is possible for an encoder to encode an external input value. This input value replaces the value to be encoded intemally by the encoder. A bidirectional communication arrangement is used in this case. This procedure can be used to identify the originality of the encoder, known as identification friend or foe (ll 1j), for access control and authentication purposes. The encoder accepts a challenge value as an input from a terminal that forioos part of an access control system. This input value is encoded by the encoder using the encoding function and key to form an encoded value. 7'he encoded value is then transferred to the decoder that is part of an access control telmillal. 1 f a legitimate encoder is used, the encoded value will correspond with a decoded value calculated by tloc decoder and the decoder will enable an external function to operate. If it is not a legitinoate encoder, the decoded value will not correspond with tloe value generated by tloe decoder, preventing the required response by the decoder.

The encoder can be used in a token or a transmitter type device in an access control systems. A transmitter would generally, on activation, transfer infornoatioio from the encode

output to a receiver system via a transfer medium suclo as radio (rf), infra red (ir) or microwave.

A token can also designate a transmitter device, but more generally includes a device in which information transfer is done by means of electrical contacts and conductors. In these physical contact tokens (or smart cards), infonmation can be transferred bi-directionally through read and write operations. In both cases the invention is directed to the transfer of information regarding the encoding or decoding key without possibly exposing the encoding or decoding key to tloe outside world.

Once the learning mode of the decoder is selected, the data from the new encoder is captured and the serial number is first used. By making use of the manufacturer's master key and the captured encoder serial number, a new decoder key is derived witlo the key generation algorithm that must fonn part of the decoder. Tloe newly derived key is used to decode the variable (encoded) part of the previously captured transmission. Once decoded, it is checked to verify that the correct key was generated and used.

In a different embodiment, a further transmission can be required to be decoded. This double transmission system can then also check the decoded counter iiofbriooation to ensure that the generated key is valid. The encoder serial number is stored in non-volatile memory, and associated with it, the derived decoder key, management code, counter and other user information. the learning is thus verified before it is accepted as valid. after 'vloiclo the encoder can be used to activate the decoder in iooriooal operation.

In nonnal operation, the encoder, when activated through electrical inputs. for example by depressing a push button switch, or switches, or by any other suitable command means,

encodes the counter, button and management code information with an algorithm and a key.

The management code information usually consists of information selected from the following group: the encoder status, command, identity, technology type, time, mode, integrity and user data. It may also include time infornoation. This time information may be used to transfer tloe tinoe that the encoding event took place or to indicate valid periods or expiry dates to the decoder system. The user key is associated with the serial number that fouls part of the information that is stored in non-volatile memory. The imencoded serial number and the encoded information are transferred by external data transferring means. The data transfer can be a transmission by an encoder, or the encoder can be activated electrically in a specific application to transfer the data.

The decoder, on receipt of the transmission, detects tlle encoded serial number and encoded part. It compares the serial number with the serial numbers of the learned encoders stored in its memory. If no comparison is found, rhe transmission is rejected. Ifa matching value is found, the decoder key stored in memory associated with the matching serial number is used to decode the encoded iiofbriooation with a decoding algorithm. The integrity of the transmission is checked to verify that the signal was received and decoded correctly. If this is valid, the counter is checked. If valid, the decoder counter information is updated and the output function control is activated. If the counter is not valid, the transmission is rejected.

The advantages of the security system are that tloc transmissions always differ without intervention from the user and that the leaning process is conducted in a secure fashion. The

learning decoder must be accessible and available and information regarding the manufacturer's master key must be available in the decoder.

In a different embodiment. an even more secure learning process is implemented. Using an algoritlun and a manufacturer's master key together with a unique key generation seed chosen for each encoder, an encoder key is generated. The key generation seed and user key are programmed into every encoder along with the encoder serial number and managemclat code information. The key generation algoritllm and manufacturer's master key need not preside in any encoder. No mathematical link need or should exist between encoder serial numbers and key generation seeds. When learning a decoder with a new encoder, the encoder is put into learning mode and the key generation seed and serial number are transferred to the decoder.

The decoder generates a key for this encoder, using the manufacturer's master key, key generation seed and key generation algoritlono. As the key generation seed is only transnoitted during the learning process, unauthorized access under normal operation. is not possible.

A verification process is initialized to verify that the correct key has been generated and that other encoder information has been stored. (;)n completion, the encoder is now a valid encoder. This verification process also ensures gloat traiosnoitted witll rogue encoders or transmitters from other manufacturers that do not have tloe correct manufacturer's master key cannot be learned.

The use of a key generator seed protects the security of the system in the event of unauthorized scanning for the serial number of an encoder. With the known serial number. it is very unlikely, but possible, that an encoder can be forged if access is gained to the

manufacturer's equipment and the manufacturer's master key. If a key generator seed is used, however, the key that is stored in the decoder cannot be generated without having access to the owner's transmitter or token as well.

After the learning operations has been successfully executed and the decoder has retuned to the normal operating mode, the encoder can be used to activate the decoder in the normal way. This means the serial number will again be compared against learned systems. Special baud rate compensation circuitry can be used during the reception process to allow reliable code reception. The stored key associated with the encoder serial number is used to decode the transmission. The integrity of the received and decoded transmission is checked for validity by comparing the management code infonnation received and decoded from the encoder with the stored information. A similar process is carried out on the associated counter information. If successful, the counter infonnation is updated and the predetermined output signal is selected, resulting in the correct external function being activated.

To prevent an intruder from grabbing key information and compromising a security system, the key infomation should never be transmitted. Code hopping makes it impossible fbr an intruder to gain unauthorized access to the decoder or the leaming capability of the decoder by using code grabbing or generation, or by initializing an unauthorized code hopping encoder.

The described system makes use of stored keys in the decoder to decode incoming transmissions. An alternative arrangement fbr a learning system is to store only the key generation seed, instead of the full key, in tloe decoder's key location. During decoding operations, the correct key is generated from a selection of tlle associated seed. serial number

and manufacturer's master key. The advantage is that less nonvolatile storage space is required as the key generation seed may require less storage space than the key. The correct key is generated in RAM whenevelneeded. Since several encoders can be learned to a single decoder and the RAM can be used over and over, this implementation can be economical.

This invention can be used in different configurations to enable a manufacturer to utilize its principles, for example, in a vehicle security system, door or gate remote control security system or in a system to control personnel access to a security area. Different kinds of transmission media can also be used, for instance radio, infra red or a physical wire connection.

The invention is further described by way of example with reference to the accompanying drawings in which: Figure 1 is a simplified representatioio in block diagram fbrioo of an encoder and data transfer interface, and a decoder and data transfer iiotcrface in an access control system according to the invention; Figure 2 is a block diagram, in greater detail, of the encoder of Figure l; Figure 3 is a block diagram, in greater detail of the decoder of Figure 1; Figures 4a and 4b are flow charts of the operation of a learning algorithm embodied in the system of the invention; and Figures 5A and 5B are diagrams of the storage fonnat of sets of parameters used in the encoder and the decoder of the invention.

The invention is described hereinaftel firstly in a general sense, with reference to Figure 1, in order to illustrate the principles of the invention and thereafter, with reference to Figures 2 to 5B, in a more detailed manner which is related to a practical embodiment of the invention.

Figure 1 is a simplified block diagram of a traiosnoitter comprising an encoder 10 and a data transfer interface 11, and a receiver comprising a decoder 12 and a data transfer interface 13 used in a code hopping remote control system. Sophisticated functions and multiple encoder/decoder combinations have been omitted only for the sake of clarity.

The invention is primarily conceded witlo the implementation of learning in a code hopping system. Learning has been implemented in standard fixed code systems, but code hopping systems present a unique challenge. Information encoded by the encoder cannot be decoded unless one has access to a user key and tllc encoded iiforiooatioio can consequently not be used to transmit the key to the decoder. The invention is directed to overcoillilog this problem.

The encoder includes a button encoder 14. a counter/storage and error correction I 6 management code storage 17, a non-linear encoder 18 having an encoding algorithm, storage 20 for a key generation seed, storage 22 for a user key, storage 24 for a serial number associated with the encoder, and a pulse width modulated code generator 26.

The decoder 12 consists of a controller 31, a ibr'ooat detector 32, a decoder 34 having a decoding algorithm, an integrity checking part 35, a counter value (synchronization) checking

unit 36, an output management function 38, counter/storage 40 for a manufacturer's master key a key generating unit 42, storage 43 for a management code, storage 44 for a decoder key, and storage and error correction 46 for counter information.

The button encoder 14 is responsive to a plurality of buttons 48 which are manually actuable. When a button is actuated the encoder 10, as a whole, is activated. The encoder may function in any one of a plurality of modes, as will become apparent from the following description, with the encoder operating mode being determined by the button or combination of buttons which are actuated. The encoder functions are controlled by a controller 49.

The controller part 49 of the encoder controls tloe encoder operation. '1'he control part 4() is complected to each part of the encoder and senses the operational state of each part and provides operational control signals to each part to control the operation and functioning of the encoder as a whole. Encoder commands are received fi-om the external buttons and used to initiate operational control signals to the rest of the encoder. Control signals can consist of encoder mode changes, selection of transmission infomoation and activation of all the different parts as necessary.

The controller 31 of the decoder controls the decoder in a similar fashion as the encoder control part 49 controls the encoder. The control part 31 is connected to each decoder part. it senses the operational state of each part of the decoder and provides operational control signals to each part to control the operation and functioniilg of the decoder as a whole from the decoder commands that are received from the format detector and mode select input signals. Control signals can consist of decoder mode changes, selection of key generation, storage of

information, such as keys and serial numbers, integrity checking, synchronization and counter value storage, and output signals.

The controller 49 may function in either of two models, namely a learning mode or a normal operating encoding mode. Each mode may be selected, as has been indicated, by an appropriate choice of the buttons 48, or ifi any other suitable way specific to the application arrangement of the encoder. Once a command has been entered by the button encoding part 14, control signals are issued by the control part 49. In the normal operating mode, control signals are issued to operate the counter/storage and error correction part 16, management code storage 17, non-linear encoder 19, key storage 22, serial number storage 24 and PWM code generator 26 to select and activate the appropriate output of each specific part. This ensures that the encoder will function as described more specifically below.

If the encoder is used in learning mode, the control part 49 issues control signals to the seed storage 20, serial number storage 24 and PWM code generator 26 to select and activate the appropriate output of each specific part. This ensures that the encoder will function as described more specifically below.

The controller 31 of the decoder may function in either of two modes, namely a learning mode and a normal operating encoding mode. The mode may be selected by appi.opriate internal or external circuitry. lnterioal circuitry can be activated by the normal detecting and decoding operation as described below, to put the decoder in a learning mode. External circuitry, such as a push button 110 or other switching means, can be used as well. I're èrably, according to one embodiment, it has been found that it is mole convenient and less expensive to

include a decoder learning mode activation means which is physically remote or detached from the encoder and the decoder. For example, according to one embodiment, wherein the encodelldecoder system of the present invention is utilized in a garage door opening system. the decoder/receiver learning mode activation means is preferably, instead of physically located on the receiver (or the transmitter/encoder), located on the wall of the garage in electrical conoioonnication with the receiver/decoder. Preferably, the learning mode activation means is part of the wall console switch which is also utilized to open and close the garage door when not utilizing the transmitter/encoder to do the same. Preferably, the wall console switch is configured such that upon activation of the switch, e.g. by depressing a button for an extended period of tinoe (e.g. 5 seconds) sets the receiver/decoder into the learning mode. Preferably.

when the wall console switch or button is only activated or depressed for a short period of time, the garage door opens and closes, respectively.

In iooriooal operation mode, once the decoder liars detected a received signal usillg tloc format detector 32, the controller 31 decides on the control signals to operate tloc decoder.

Control signals are issued to the key generation algorithm/control 42, key storage 44, decoder 34, management storage 43, integrity checking 35, counter/storage and error correction 46, counter value checking 36 and output management 38 to select and activate the appropriate output of each specific part. This ensures that the encoder will function as described more specifically below.

If the decoder is used in leaning mode, the controller 31 issues commands to the key generation algorithm/control 42, key storage 44, decoder 34, management storage 43. integrity

checking 35, counter/storage and error correction 46, output management 38 and learning control 100. This ensures that the decoder will store the appropriate information and function as described more specifically below.

In the normal operating mode the counter/storage and error correction 16 is activated each time the encoder 10 is used. Its count is therefore indicative of the number of times the encoder is used. The counter value is stored in non-volatile memory. The memory only operates when power is supplied to the encoder. If the counter value is changed and the power disconnected at the same time, it can cause spurious values to be stored. For this reason, an error correction function is included in the counter/storage and error correction 16. The counter information is encoded in the non-linear encoder 18 using the user key in the storage 22. The output of the encoder 18 thus comprises variable information which is combined in the generator 26 with the serial number from the storage 24. Tlle serial number, as has been noted, is associated with the encoder. The output of the generator 26 is applied to the data traiosfbr interface 11 and transmitted to the data transfer interface 13 and decoder 12. The serial number can also form part of a unit number uniquely to ideitify an encoder unit.

It is to be noted that the encoder and the decoder may be directly connected, for example by means of a wire, or the encoder and decoder may be remote front one another and thc transmission of information may be done by radio signal, optically, at an in la-red frequency or in any other suitable way.

The signal which is received by the decoder 12 using the data transfer interface 13 is converted to a logic signal which, in turn, is converted by the format detector 32, to a number

which is applied to the decoder 34. The detector may be a pulse width modulation code detector. The decoding algorithm of decoder 34 decodes the variable portion of the number yielding counter and management code infonooation, the integrity of which is checked by the part 35 using management code information in the storage 45, to verify the validity of the decoding operation. If it is valid, the unit 36 compares the decoded counter infornoation with counter information held in the storage 46 to detelmine that the decoded number is valid and has not been used before. If the reception is valid then the relevant outputs are activated by the output management function 38.

In order to implement learning, the user places the decoder 12 in a learning mode.

Preferably, according to one embodiment, this is accomplished by activating tloe learioiiig mode activation means which is physically detached or remote from the decoder. The encoder 10 is also effectively placed in a learning mode by activation of the appropriate buttons 48. In this case, the key generation seed held in the storage 20 is applied together with the serial numbel- in the storage 24 to the generator 26. It is to be noted that tloe key generation seed is only used during the learning operation. The whole operations of the decoder is controlled by the controller 3 1.

The data transfer interface 11 thus transmits infornoation on the key generation seed and the serial number to the decoder 12. The data transfer interface 13 receives this inlormation which is token detected by the detector 32 and passed to the key geileratiolo unit 42. 'llis unit calculates a decoder key based on the incoming key generation seed and the manufacturer's master key which is held in the storage 40. The newly generated decoder key is stored in the

location 44 and can be used for any future decoding operations, acting on the decoding algorithm of decoder 34.

The key generation algorithm that is used in key generation unit 42 during tlle secure learning operation is usually a non-linear algorithm. Tlois algorithm accepts as input the manufacturer's master key 40 (not known) and key generation information. The key generation information can consist of the encoder serial number 24 or the seed 20 or both. This information is transferred from the encoder in a learning operation to the decoder.

The decoder 12 uses the key generation algorithm to generate a key 44 that is used to decode a normal code hopping transmission. The security of this mechanism pertains to the fact that the relationship between the transmitted seed and the decoding key is not known, rendering any kind of interception of the transmission useless. The non-linear key generation function also makes it impossible to establish any relationship between the key and the key generation information, making it impossible for a possible impostor to copy an illegitimate encode. I lle key 22, serial number 24 and randomly generated seed 20 of an encoder 10 are loaded during the manufacturing process. The manufacturer generates the key using the seed, serial number, manufacturers master key and key generation algoritlun. The key generation algoritiun is not made know publicly. Because the seed is a random number, the possibility of manufacturing two encoders with the same keys are very slim. Considering the fact that the serial number is also used in this process, it is highly improbable.

The verification of the learning process is effected as follows. The user presses the appropriate button 48 for normal operation of the encoder 10, thereby causing the transmission

of the variable code which is produced by the non-linear encoder 18, and of the serial number held in the storage 24. The newly generated decoder key in the storage 44 is used to decode the incoming code in the decoding algorithm of decoder 34. The management code iioforiooation which is thereby produced, is used to verify the validity of the decoding operation by comparing it to the management code in the storage 43. The incoming counter information is stored in the relevant storage location 46. An error correction function is included in unit 46 to ensure that if spurious data is stored during a power failure, the correct data can be recovered as soon as power is restored to the decoder.

The user then activates the encoder 10 again. Once more the resulting variable code and the serial number are received by the data transfer interface 13. The variable code is decoded by the decoding algorithm of decoder 34, using the newly generated decoder key. The counter information which results from this transmission is checked against the counter infonnation held in the storage location 46. If the comparison indicates that the two variable code transmissions were successive then it is assumed that the learning process has been valid and the decoder is taken out of the learning mode. The system may now be used for normal operation.

A special relationship exists between the key generation seed in the storage 20 and the user key held in the storage 22. This relationship is dependent on the manufacturer's master key held in the storage 40. The manufacturer's master key is however not programmed into the encoder but, instead, is used in a production line programming unit which progranos corresponding key generation seeds and user keys into respective encoders. The noantifacturer's master key is, on the other hand, programmed into each decoder and is used during learioiiog, in

the manner described, to calculate the correct decoder key, which is then held in the storage location 44, from the received key generation seed.

In a variation of the learning process the serial number which is held in the storage 24 is used by the key generation unit 42 to generate the decoder key. In this case there is no need for the encoder to have the capability of transferring the key generation seed. Further, a special relationship exists between the serial number and the user key, rather than between the key generation seed and the user key.

The serial number is present in each transmission. Thus the encoder from which a transmission originates can be identified even though an outsider cannot gain access to the information contained in the transmission. The serial number can be used to identify several encoders in a single system making it possible to accommodate several distinct encoders in a single decoder system.

The following description, based on Figures 2 and 5 of the accompanying drawings, is made with reference to a practical form of the control system of the invention which embodies the general principles which have been described in connection with Figure 1. Whele applicable similar reference numerals to those employed in Figure 1 are used in Figures 2 to 5 to indicate like components.

Figure 2 depicts an implementation of a code hopping remote control transmitter comprising an encoder 10, buttons 48, a controller 49, a power supply 50 and a data transfer interface 11, which may all be housed in a protective housing, which is iitted with a key ring to

enable the user to transport the transmitter conveniently. The buttons 48 may be puslo button switches, for activation by remote control of the various Ibioctions of the security system. and possibly for the supply of power, fiono the power supply 50, which may be a battery, to the entire transmitter.

All the elements shown in the block diagram, apart form the power supply 50, the button switches 48 and the data transfer interface 11 can be implemented in a single integrated circuit.

An application specific integrated circuit is the preferred implementation in order to make reverse engineering as difficult as possible. Reverse engineering poses a security risk insecurity systems, as full access to algorithms and stored information is provided by this process.

The encoder 10 includes a means 14 (button encoder) for encoding information regarding the buttons 48 which are pressed and outputs encoded infonooatioio 52 which is used for controlling the operation of the encoder using the controller 49 as well as other parts, and which may be encoded as a "function request" to determine tloe fbioctiois to be activated by the decoder 12. The controlling functions include selecting the mode of operation of toe serial code generator 26, and selecting the virtual encoder to he emulated. (Tloe meaning of the phrase "virtual encoder" will become apparent from the following description.) A function request can activate one of several outputs on the decoder. A typical application would be in a vehicle security systems, where different decoder outputs could be used to disarno an inoiooobilizer, arm an alarm, disarm the salami and operate electric windows of toe vehicle.

As an example of button encoder 14, if an amount of buttons b are used to activate the encoder, the button encoding function encodes the value b to distinguishable values that are

passed to the internal circuitry of the encoder. Pressing two buttons at the same time can for instance initiate the generation by the button encoder 15 of a distinguishable value that activates the encoder to transfer encoder related information. If anp one of the same tow buttons are used separately, a totally different value is generated by the button encoding 14, resulting in the selection and transfer of different information. This means that with an amount of only b buttons, 2 to tloe power of b different functions can be distinguished and selected. The button encoding 15 can also be used to set the encoder in learning mode by programming the encoding function to output a predetermined value. This value can be presented if any one or combination of buttons are pressed.

A section of non-volatile memory 54 is used to store a plurality of parameter sets 56A 56N. Each parameter set consists of a fixed key generation seed 60 which conesponds to the seed held in the storage 20 of Figure 1, a serial nunober 62 which corresponds to the serial number held in the storage 24 of Figure 1, an encoding or user 2() key G4 which corresponds to the user key held in the storage location 22, counter and error correction iilbrnoation G6 which includes the counter inlbriooation held in the conilter/storage alld error convection 16, aiid a management code 68 corresponding to that held ill the storage 17.

As has been noted provision is made for the storage of several parameter sets 56. lach parameter set is associated with what is termed herein a "virtual encoder" for the encoder can act as any one of different virtual encoders, depending on which buttons 48 are pressed.

The counter/storage and error correction 16 is updated each tinoe the encoder is actuated.

When several parameter sets are used, however, only the counter infornoation in a particular parameter set is updated each time tloe corresponding virtual encoder is used.

A specific encoder can either use a single stored parameter se 56 along with various function requests, or different parameter sets with similar or different function requests.

Typically, different parameter sets will be used if several different decoders are to be accessed.

Several functions 15 might be accessible on each of these decoders. A single encode might then be configured to access all the decoders, using different parameter sets, and be able to combine different function requests with each of the parameter sets.

The serial number 62 is unique to a particular virtual encoder, and is encoded with each emission from that particular virtual encoder. Tloe encoding or user key 64 is a nulllbel, unique to a specific virtual encoder, that is used to encode the transmission in such a way tloat the original encoded infornoation cannot be retrieved by all outside. lIle management code 68 consists of information about the status of tlic particular virtual encode, and lolly include sections with redefined values for checking the integrity of decoding operations in the decoder.

The counter and error correction information 66 is tloe count of a 1G bit counter, used fbi.

keeping track of the synchlollization between tloe encoder and toe decoder and error corrected if a spurious error occurs during a storage operation. The counter is altered each time the virtual encoder is operated. The key generation seed 60 is a number which. as loans been noted with reference to Figure 1, bears a specific relationship to the encoding key 64. While the kev is read protected, the seed 60 is not necessarily inaccessible. However, the relationship between the two is sufficiently obscure that an outsider will not be able to infer the key from the value of the seed.

The non-volalile memory 54 is read-protected to prevent scrutiny of the encoding keys 64 from outside. Access to the keys, or to the serial number 62, the seed 60 and the manufacturer's master key in the storage 40, could enable an outsider to program a similar encoder with an identical key and gain access to the systems.

The encoder includes a non-linear encoder 18 which uses a user key 64 to encode an input string. The key length should be sufficient to ensure reasonable immunity against analytical attacks, considering the state of the art in computer technology. A key length of 64 bits is considered adequate for security and access control systems. The use of longer keys has adverse cost implications, while shorter keys provide reduced security levels. The length of the output string 70 of the non-linear encoding algorithm determines the number of bits encoded by the encoder. A 32 bit output string provides a good balance between security alld response time at typical remote control transmission rates. The input string to the encoding algoritlom is 32 bits and contains function information 52 from the button encodel- 14 (4 bits), the counler information 66 (16 bits) and the management code 68 (12 bits), specific to the encoder being activated. The management code can contain system status iiofornoatioio, including low battery voltage indicators and mode selections.

A serial code generator 26 is used to assemble tulle code to be eiitted. 1 lle code consists of either a combination of the 32 bit encoded string 7ü produced by tloc non-linear encoder 18 and the serial number 62 of the encoder, or of a fixed key generation seed 60 and the serial

number 62. The code generator 26 also implements the modulation scheme required for transmission by the data transfer interface 11 which in this case is pulse width modulation (PWM).

The output 72 of the serial code generator 26 is emitted by tile interface 11 using electromagnetic or other means. The data transfer interface 28 can be replaced by a direct connection in the case where remote operation is not required.

The encoder includes a status monitor 74 which can alter parts, for example status information, of the management code 68 in a particular memory block, depending on selected options and conditions existing in the encoder. These changes can be detected in the decoder to provide feedback on imminent encoder problems, for example a flat battery. The status aspects which are monitored are selected via a unit 76.

The options 76 are programmed in the encoder in non-volatile memory to select different encoder status by status monitor 74. A specific predetenniioed options noway indicate fbr instance battery low voltage. The sam value is proglalllmed in the decoder to sense the battery voltage low indication in a transmission for indication to the user. The programmed options 76 are activated, and therefore the selected status monitor 74, when an encoder is activated. 'I'he predetermined value is substituted in part of the management code 68 before encoding and transferring the information. The options, when selected and transferred, are sensed by the decoder after decoding so that the progranonoed action can be taken.

Figure 3 depicts an implementation of a learning code hopping access control decoder 12.

A data transfer interface 13 converts the electromagnetic or other signals used for transmission of the signal from the data transfer interface 11 into a baseband logic signal 78 still modulated according to the modulatiotl scheme inopieiooented by the serial code generator 26.

The decoder includes a detector 32 which has means for compensating for differences in transmission length due to timing differences between the encoder and the decoder.

The detector 32 extracts a 32 bit variable number 80 liom the signal 78 and applies it to a decoding algorithm 34 which decodes the variable number, using a 64 bit decoder key 82 stored in a non-volatile memory 84. If a valid decoding process has taken place the resultant 32 bit code 86 contains the information inserted into the non-linear encoding algorithm of encode 18 in the encoder 10 before encoding.

The decoder includes an integrity checking unit 35 to verify the validity of the decoding process. For a valid decoding there is a predetermined relationship between a stored manageiooent code 90, which corresponds to that held in tloc storage 43 of Figure 1 aild the corresponding portion of the decoded 32 bit word 86.

The decoder key 82 corresponds to the decoder key odd ill the storage location 44 of the decoder 12 of Figure 1.

A synchronization checking unit 36 verifies the validity of a transmission by comparing incoming counter information 92, produced by the integrity checking unit 35, with stored counter information 94 for the relevant encoder. The counter iiofornoatioii 94 correspollds to the information held in the storage location 46 of the decoder 12 of Figure 1 and includes an error

correction function to ensure that the value of the counter is corrected when a spurious error is stored during a power failure.

An output management unlit 38 manages the activation of or communication with other devices in the systems. The unit 38 provides an indication of which of several functions is or are desired, whether the encoder 10 has ceased encoding and whether any special options are being requested. An indication of the identity of the encoder, from which the received signal originated, may also be made available. The unit 38 also makes use of storage space in the non- volatile memory 84 to manage options, determined by an option control unit 96, which may influence the format in which output signals 98, which are produced by the unfit, are presented, or may enable or disable specific system features.

A learning control unit 100 manages the learning process by passing appropriate instructions to the detector 32, the decoding algorithm of decoder 34, the integrity checking unit 35, the synchronization checking unit 36 and a key address mallagelllellt unit 102. the unit I()() can be placed into the leaning mode from outside the decoder or special output combinations can be used to place the decoder in the learning mode, by passing the relevant signal froioo the management control unit 38 to the learning control unit 100. Most preferred, is a system wherein the decoder is set into the learning mode by a learning mode activation means. e.g., a switch or circuit, which is physically remote ii-om or detached from the decoder. Preibrably, the learning mode activation means is physically remote or detached liom the encoder also.

Typically a single menoory block is reserved for this purpose. The decoder, including the learning control 100, is controlled by a controller 31.

A parameter set 56 of a designated encoder, referred to as a master encoder, is stored in this reserved memory block. When the master encoder is activated the output function control unit 38 sends a control signal to the tinit 100 thereby placing tile decoder 12 in the learning mode.

The non-volatile memory 84 makes provision for the storage of a plurality of parameter sets 1 02A . . . 1 02N which correspond to the parameter sets 56A . . . 56N in the encoder. Each parameter set includes a serial number 104 which corresponds to the serial number 62 of the corresponding encoder, and the associated decoder key 82, management code 90 and counter information 94. A manufacturer's master key 106, corresponding to the in ornzatioll loeld in the storage location 40 of Figure 1, is also stored in the memory 84 for use during learning operations.

The key address management unit 102 manages the passage of infbrmation to and from the non-volatile memory 84. The key address manageinent unlit can be implemented in hardware or in software or in a combination thereof: This tinit selects the memory bank to be used with each memory bank being capable of storing a single parameter set. A pointer is also maintained in a memory segment 108 indicating the next memory bank to be used for leaming operations.

During learning operations a key generation unit 42 generates a decoding key 82 for the new encoder and transfers it to the relevant memory location for the respective paraloleter set 102. A non-linear encoded algorithm of a similar level of complexity to the code hopping

algorithm is used to ensure that the relationship between the key generation seed and the encoding or decoding key 82 is as obscure as possible.

Figure 5 contains a representation of an encoder parameter set 56 and a decoder parameter set 102 and includes a summary of the contents of each parameter set.

When the user presses a button 48 to activate the encoder 1 0, the button encoding unit 14 detennines which button or combination of buttons has been pressed and generates the 4 bit function code 52 together with a combination of control signals. 'Floe control signals determine from which memory block the relevant parameter set will be taken and whether the transmission should consist of a hopping code or a fixed code.

The buttons 48 may be replaced by a system that can command the encoder electrically.

The command can be generated, for instance, by a computer or other equipment, using a special command interface. The power of the encoder may also be supplied by the colnmand interface.

In another application the encoder and decoder conobination can be used For authentication and access control purposes. 'Floe encoder can be housed 11 a token or siolart card that a person can carry and use to access, for instance, a security area. The communicatiol1 takes place on an electrical interface. In this case bidirectional communication is used to communicate information between an encoder and a decoder. The serial number 62 of the encoder is transferred to the decoder to establish the key 82 to be used in the decoding process.

A value is presented as an input value to the encoder by the decoder, known as a challenge. l he encoder encodes the challenge value and returns the encoded value to thc decoder. The decoder

now decodes the encoded value and compares it with the challenge value to establish the authenticity of the encoder and activate an output accordingly. This teclmique is generally known as IFF (identification friend or foe). In this application, the seed 60 of the encoder can be transferred to a decoder in learning mode. The key 82 can be generated and stored in the decoder as described in this description.

The ability to employ more than one parameter set for an encoder enables the encoder to address more than one decoder without interference, even if a single operating frequency is shared. The encoder appears to be a chosen one of several independent encoders each of wloiclo is capable of independent operation, hence the phrase "virtual encoder." Clearly the encoders are not capable of simultaneous operation. For hopping code operation the noio-liioear encoding algorithm of encoder 18 uses the respective encoding key 64 to encode the counter information 66 and the management code 68 together with the 4 bit function code 52. The 32 bit output code 70 is presented to the serial code generator 26. the counter infonnation 66 is altered each time a transmission takes place for the respective virtual encode. The serial code generator 26 appends the relevant encoder's serial number 62 to the encoded part thereby fornoiiog a single output code 72 which is presented to the input of the data transfer interface 11 in PWM serial form (in this example).

For fixed code operations the key generation seed 60 is presented directly to the serial code generator 26 which presents the code, together with the serial number 62, in PWM serial form to the data transfer interface 11.

In both modes of operation the data transfer interface 11 transmits the infolmatioll from the serial code generator using electromagnetic or other means.

Signals received by the data transfer interface 13 are converted to the logic signal 78, still in PWM fonn. The format detector 32 monitors the logic signal 78 and when the initial portion of an apparently valid signal is observed the detector calibrates itself on the incoming signal to compensate for deviations from nominal timing. The remainder of the iioconoiiog signal is received and converted to a number which, in this example, is a 64 bit binary number.

The first 32 bits of the detector output, i.e., the hopping code, are designated 80 and a represented to the decoding algorithm of decoder 34. The last 32 bits, i.e. the serial number, are presented to the key address management unit 102. This unit determines the memory block to be used by comparing the received serial number with the stored serial numbers 104 until a match is found. The decoding algorithm 34 uses tloc decoder key 82 idiom tile correct mcllloly block, i.e., the respective parameter set, to decode the hoping code 80. A 32 bit output 86 is presented to the integrity checking unit 35. This 32 bit stiling colooprises the original 4 bit function code 52, 16 bits of counter informatioll 66 and the 12 bit management code 68. the integrity checking unit 35 checks for a predetermined relationship between the decoded management code 68, in the decoded word 86 and the stored version 90. If a defined relationship exists the decoding is held to have been valid.

The decoded counter 66 is compared with the stored counter 94 held in the respective parameter set. If the synchronization proves that the transmission is valid the stored value 94 is updated and the output control function unit 38 is advised accordingly.

The unit 38 outputs the decoded function information 98. The unit may make tloe information available in serial fomoat for use by an external controller or may have discrete outputs to indicate any of a number of different conditions. The identity of the encoder being decoded that can be included as part of the management code, a valid signal indicator, and a second function mode, are all examples of useful output information 98.

Learning operation takes place when the user wishes to add a new encoder to the systems. The learning control unit 100 then receives an input signal pronoptilog it to enter the learning mode, for example, by activating switch 110. Preferably, as stated above, switch 110 is <BR> <BR> <BR> <BR> <BR> <BR> physically detached or remote fiono tloc decoder and tloc encoder. The signal may be in Ilic form of an instruction from outside. e.g. generated by a switch or may emanate {i-om tloc output function control unit 48 after reception of a valid code, as has been described hereinbefore.

The user now activates the encoder 10 as a fixed code encoder using a specific leaning hardware configuration. The key generation seed 60 is substituted for the variable code portion of the transmission and the serial number 62 is retained as the remainder of the encoded code.

The resultant signal, emitted by the data transfer interface 11. is received by the data transfer interface 13. The format detector 32 passes the entire received transmission 78 to the key address managemellt unit 102. Thus the signal presented to the uiiit 102 is a 64 bit string.

The unit 102 deviates from its normal functioning in the learning mode and generates an decoding key 82 frono the serial number, the key generation seed and the manufacturer's 100 master key 106. This key is written into one of the memory blocks depending on the value of a pointer used specifically for this purpose and held in tloe memory block 108. The received serial number 104 is stored in the relevant memory block associated with the respective parameter set.

The next learning pointer can be managed according to a variety of different schemes. Options include, inter alia, cycling the pointer through the available memory locations and allowing the user to set the pointer from outside.

From a security point of view a key generation algorithm, of the kind carried out by the unit 42, should only be implemented in an application specific integrated circuit as a generic logic device, such as a micro processor, is readily reverse engineered, leaving the algorithm open to public scrutiny.

The user now activates the encoder twice in tloc code hopping mode. I)iu-ing tloc first transmission the 64 bit code is received by the data transfer interface 13 and detected by the detector 32. The decoding algorithin of decoder 34 decodes the 32 bit variable code 80 using the newly generated decoder key 82 and stores the decoded management code C)O in the correct location. The decoded counter iniormation 94 is also stored in the correct location.

During the second transmission the received signal is detected by the detector 32 and the serial number is passed to the key address mallagement unit 102 where it is compared with the newly stored serial number 104. In addition the 32 bit variable code 80 is decoded by the decoding algorithm 34. The integrity checking unit 35 checks the decoded management code

against the stored version 90 and the synchronization checking unit 36 checks the decoded counter information against the stored version 94. If any of these checks is unsuccessful the leaming operation is rejected. If they are all successful the next learning pointer in the storage location 108 is altered to indicate that the next memory block is available for learning.

The learning process may also include a routine to leam a specific combination of outputs for use with a specific encoder. For example, a specific user may require special priority in a specific system and this priority can be assigned during such a routine.

Once the entire learning operation has been successfully concluded the user should activate the encoder once more to verify that the encoder is operating correctly.

The system as it has been described makes use of stored keys 82 in the decoder to decode incoming transmission. An alternative arrangenleilt for leaning systems is to store only the key generation seed, instead of the full key, in the location allocated for the key 82. During decoding operations the correct key is generated front the associated key genelatioll seed and the ioomoufacturer's master key 106. The advantage is that less non-volatile storage space is required as the key generation seed typically requires less storage space than the key. The correct key is generated in RAM whenever needed.

Figures 4a and 4b are flow charts of Il1e learning algolitllm embodied in toe decoder.

Referring to Figure 4a, once the leaning mode has been establisloed as described previously. the key generation seed (stage 150) and the hopping code (stage 152) are received by the decoder.

At a stage 154 a relational counter (in key generation unit 42) is initialized, and set to zero. The relational counter is used to allow for more than one relationship between the key generation seed, the encoder serial number and the key for lhe encoder, or between the encoder serial number and the key for the encoder.

The relational counter 154 is used at a stage 156 to compose a modified seed for the key generation algorithm which is a non-linear algorithm using at least the iooanufacturer's master key 106 and the key generation seed as an input. After the key is generated (stage 158), the management code can be decoded and stored (stage 162). The decoding operatioll integrity is checked at stage 164 to decide if the decoding operation is valid. lf valid, the flow proceeds to stage 170. If it is not valid, it is decided if the operation should calTy on or not at stage 166. If the operation should carry on, the relational counter 154 is incremented (stage 168) to establish a new relationship that may be valid.

Thc learning process terminates at a stage 172 if all valid relationships betwecil tile key generation seed and the serial number have been used and a valid relationship (stage 166) has not been found.

The probability of accidentally accepting an invalid encoder during learning is related to the number of predefined bits within the encoded management code. Since not more tall 12 bits are available in the implementation under discussion the best integrity is in the order of 1 in 4000. This level is regarded as inadequate for security systems. The integrity can be improved either by increasing the length of the known component of the management code or by implementing a checking algorithm based on a second transmission (stage 176 in Figure 4b)

from the encoder being leamed. Longer code lengths have disadvantages such as higher implementatioll cost and longer response times. Using a second transmission increases the certainty of the integrity checking by many orders of magnitude without affecting the system cost or the response time.

The second part of the flow chart implements this technique, as described with reference to Figure 4b. If the decoding function is perfonooed and found valid (stage 17()). a decoded counter value is stored (stage 174). At stage 176 a second hopping code is received. lois code is decoded (stage 178) and the decoded management code verified (stage 180) with the stored management code. If the values do not match the learning process is accepted as invalid and aborted. Next, the counter value is verified at stage 182 with the stored counter value. If the values do not match, the transmission is accepted as an invalid and illegitimate learn operations and aborted. If the counter values match, a valid learn operations accepted (stage 184). If the counters to not match, as with normal code hopping system operations, some leeway may be allowed in the counter syncloronization checking (stage 182) to allow for interim transmissions that may not have been decoded by the decoder, alld can be accepted as if they match and accepted as valid.

At stage 184 it is assumed that a valid learning process has been completed. The next learning pointer (reference 108 in Figure 3) is updated at stage 186 to point to the next available learning position. Output configuration leating associated with a particular encoder can be included at stage 188 if required. At stage 190 the learning cycle is completed.

Obviously, numerous modifications and variations of the present invention are possible in light of the above teachings. For example, the encoder part 10 is implemenled on an application specific integrated circuit (ASIC). Part of the circuit is made up of non-volatile memory that is used to store the different changing and programmable values, such as the parameter sets 56 and options 76. Although this method of implementation is used to ensure the security and practical aspects of the systems, it can be implemented in software in a computer or a microprocessor controller. The same approach is used with the decoder 12. The functions and memory parts are implemented on an ASIC, but can also be implemented on a computer or microprocessor controller. This implementation may be preferable at the decoder, as the decoder may be required to store a large amount of infolmation to allow many users to access tloe systems. It is therefore understood that within the scope of the appended claims, the invention may be practiced otherwise than as specifically described herein.