TECHNICAL FIELD The present disclosure relates to vehicle entry systems and particularly, but not exclusively, to a passive vehicle entry device for authorising one or more operations of a vehicle, wherein the vehicle operations include unlocking the vehicle doors. Aspects of the invention relate to a passive vehicle entry device, to a vehicle and to a method of operating a passive entry system wherein one or more vehicle operations of the vehicle are authorised through the passive vehicle entry device.

BACKGROUND

In existing passive vehicle entry systems it is possible to gain authorised access to a vehicle and start the vehicle's engine without any interaction with a key fob by the vehicle owner. Such passive entry systems work by the vehicle sending a radio signal to the key fob which the key fob then responds to by sending an unlock request. The challenge signal from the vehicle may be sent in response to a door handle being pulled, for example.

Such systems are potentially vulnerable to relay attacks where a signal booster is used to relay the challenge signal from the vehicle and/or the challenge response signal from the key fob over larger distances such that a third party can gain unauthorised access to the vehicle.

In existing passive entry systems, vehicles may be accessed if an individual is in possession of the key fob. Therefore, in the event the key fob is stolen then it is possible for an individual in possession of the stolen key fob to access the vehicle. The present invention has been devised to mitigate or overcome at least some of the above-mentioned problems. SUMMARY OF THE INVENTION

According to an aspect of the present invention there is provided a passive entry device, comprising: an input for receiving a challenge signal from a vehicle; a processor arranged to generate a response signal to authorise a vehicle operation; an output for outputting the response signal to the vehicle; wherein, in response to receiving the challenge signal from the vehicle, the processor is arranged to generate the response signal to be received at the vehicle authorising the vehicle operation, the response signal being generated in dependence on information relating to motion of the passive entry device, a location of the vehicle and a location of the passive entry device, wherein the response signal comprises information identifying the passive entry device.

By generating the response signal in dependence on information relating to the motion of the passive entry device, the response signal may only be sent if the passive entry device has moved or been perturbed. For example, relay-attacks, as mentioned above, wherein signals are boosted to increase their range, often take place overnight. At night, there are fewer witnesses to an unauthorised attempt to access a vehicle and greater opportunities for an attacker to gain access. A vehicle equipped with a passive entry system may be parked on the driveway and the passive entry device would likely be inside the house, for example, resting on a piece of furniture. An attacker may amplify the challenge and/or response signals between the vehicle and the passive entry device to make them operate as though they are in close proximity. In this manner, the attacker can gain access to the vehicle without alerting any witnesses. This is not possible with the claimed invention. The claimed invention checks whether the passive entry device has been moved or perturbed, implying that the passive entry device is in the possession of the vehicle owner. This acts as a significant deterrent to theft and reduces the opportunities for an attacker to gain access to the vehicle without alerting anyone.

Advantageously, the invention determines both a location of the passive entry device and a location of the vehicle. The security of the passive entry device is significantly improved based on this information because, in determining the two locations, the proximity of the passive entry device to the vehicle cannot be falsified by mere signal amplification. Hence, there is greater certainty of the separation between the vehicle and the passive entry device. Optionally the location of the passive entry device relative to the vehicle may be determined by GPS means. The invention presented herein cannot be falsified by signal boosting alone. Instead, the passive entry device's location and the vehicle's location may be measured in space by a location determining module, such as a module equipped with GPS. The two positions can be compared to confirm proximity with increased certainty compared to existing passive entry systems.

Optionally, the processor is arranged to determine a location of the vehicle and a location of the passive entry device and to generate the response signal in dependence thereon. This may optionally be achieved by GPS measurements, providing sufficient location accuracy and reliability. The vehicle location may be determined by recording the GPS position of the passive entry device at key-off of the vehicle. The invention enables the distance between a location of the vehicle and a location of the passive entry device to be measured and compared to a threshold distance. Optionally, the response signal and/or challenge signal may take the form of a Bluetooth® signal or a Wi-Fi signal.

Optionally, the processor is arranged to generate the response signal in dependence on a proximity of the passive entry device to the vehicle. The security advantage of this measure is such that, in order to generate the response signal, the motion of the passive entry device must be considered alongside the proximity of the passive entry device to the vehicle. In this manner, the response signal can be generated upon confirmation that the passive entry device has been moved or perturbed and that the passive entry device is close enough to the vehicle. This implies that the device is in the vehicle owner's possession and that the vehicle owner has moved from a position outside of the required proximity to the vehicle, to a position that is inside the required proximity to the vehicle. Optionally, the processor is arranged to measure the distance between the location of the vehicle and the location of the passive entry device and compare the measured distance to a threshold. Optionally, the processor is arranged to determine the proximity of the passive entry device to the vehicle by a triangulation method.

Optionally, the triangulation method comprises determining signal strengths of the response signal received at a plurality of vehicle antennas.

Optionally, the processor is arranged to determine the proximity of the passive entry device to the vehicle by obtaining a signal strength of the challenge signal received at the input of the passive entry device and/or of the response signal received at a vehicle antenna.

Optionally, the passive entry device comprises a sensing means for sensing motion of the passive vehicle entry device.

Optionally, the processor is arranged to sense motion of the passive entry device and to generate the response signal in dependence thereon.

Optionally, the processor is arranged to measure the motion of the passive entry device. The processor may be configured to generate the response signal in dependence thereon.

By actively measuring the motion and generating the response signal in dependence on information relating to the motion of the passive entry device, the invention provides enhanced sophistication. For example, the measured motion can be analysed to better understand the motion of the passive entry device, such that, an attempted access to the vehicle can be granted with greater certainty of the device holder's intention.

Optionally, the processor is arranged to generate the response signal in dependence on a measurement of a non-zero acceleration of the device. In some embodiments, the passive entry device performs a gait analysis of the measured acceleration. Optionally, the processor is configured to generate the response signal in dependence on the gait analysis being indicative of a user having the device in his/her possession whilst walking or running. In this way, gait analysis could be used to confirm that the passive entry device is in the possession of a walking or running individual, as would be expected during an approach to the vehicle.

Optionally, the processor is arranged to determine a direction of motion of the passive entry device. Determining a direction of motion significantly improves the invention's ability to ascertain whether the passive entry device holder is making an approach towards the vehicle. The direction of motion can be combined with the location information to confirm that the device is moving from its current location towards the location of the vehicle. The invention can confirm the approach with relatively high certainty. Optionally, the direction of motion may be determined by measuring the motion and creating a motion vector or measuring changes in the second position of the passive entry device relative to the first position of the vehicle over time.

Optionally, the processor is arranged to determine whether the direction of motion is indicative of the passive entry device approaching the location of the vehicle.

Optionally, the measurement of the motion of the passive entry device is used to derive a motion vector. The processor may be configured to generate the response signal in dependence on the motion vector.

Optionally, measuring the motion of the passive entry device comprises any one of: measuring an acceleration of the passive entry device, measuring an acceleration of the passive entry device; measuring an acceleration of the passive entry device and an orientation of the passive entry device; measuring a change in the orientation of the passive entry device; and measuring a change in position of the passive entry device.

Optionally, the processor is arranged to generate the response signal in dependence on a measurement of signal strength of the challenge signal received at the input of the passive entry device and/or of the response signal received at a vehicle antenna. The signal strength measurement provides a further security challenge of the passive entry device and improves the robustness of the system accordingly. Optionally, a change of the signal strength is indicative of motion of the passive entry device.

Optionally the vehicle antenna is a Bluetooth® beacon. Optionally, the passive entry device comprises a motion sensor.

Optionally, the motion sensor is one or more selected from: an accelerometer, a gyroscope, an inertial measurement unit (IMU), or a locating module.

Optionally, the passive entry device is configured to communicate with a cellular network.

When the passive entry device is able to communicate with a cellular network its functionality is significantly improved and the invention becomes suitable for additional uses which may reduce the number of items that an individual keeps on their person; removing the need to carry an additional key fob/keyless remote for the vehicle.

According to another aspect of the present invention there is provided a method of operating a passive entry system, the method comprises receiving a challenge signal from a vehicle at a passive entry device and transmitting a response signal from the passive entry device. The response signal is transmitted to authorise an operation of the vehicle and the response signal is transmitted from the passive entry device in dependence on information relating to motion of the passive entry device, a location of the vehicle and a location of the passive entry device, the response signal comprises information identifying the passive entry device.

According to another aspect of the invention there is provided a vehicle configured to execute one or more operations of the vehicle in dependence on the response signal output from a passive vehicle entry device as described in a previous aspect of the invention. According to another aspect of the invention there is provided a computer program for operating a vehicle entry system comprising instructions to cause a passive entry device, as described in a previous aspect of the invention, to execute the method of another previous aspect of the invention.

According to another aspect of the invention there is provided a computer-readable medium having stored thereon a computer program as described in a previous aspect of the invention.

According to another aspect of the invention there is provided a mobile communication device comprising a passive entry device as descried in a previous aspect of the invention. According to another aspect of the invention there is provided a passive entry passive start device comprising a passive entry device as described in a previous aspect of the invention.

Within the scope of this application it is expressly intended that the various aspects, embodiments, examples and alternatives set out in the preceding paragraphs, in the claims and/or in the following description and drawings, and in particular the individual features thereof, may be taken independently or in any combination. That is, all embodiments and/or features of any embodiment can be combined in any way and/or combination, unless such features are incompatible. The applicant reserves the right to change any originally filed claim or file any new claim accordingly, including the right to amend any originally filed claim to depend from and/or incorporate any feature of any other claim although not originally claimed in that manner.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

Figure 1 is a representation of a known passive entry system;

Figures 2 and 3 illustrate a method of operation of a known passive entry system; Figures 4 and 5 illustrate a relay attack within a known passive entry system;

Figure 6 illustrates an embodiment of a system in accordance with the present invention; Figure 7 shows an embodiment of a 'virtual' keyless remote application on a passive entry device in accordance with the present invention;

Figures 8 to 1 1 illustrate an embodiment of a method of operation of the system of Figure 6 in accordance with the present invention.

Figure 12 illustrates an embodiment of a connected system in accordance with the present invention;

DETAILED DESCRIPTION

Embodiments of the present claimed invention relate to a system and method for using a passive entry device in co-operation with a passive entry system to authorise one or more operations of a vehicle. Known passive entry key fobs are provided with wireless communication means such that they can communicate with an associated vehicle and authorise one or more vehicle actions including unlocking/locking the vehicle doors during an approach to/exit from the vehicle. The vehicle action may be authorised without necessitating user interaction with the key fob. Passive entry key fobs and associated systems have been developed as an alternative to standard wireless remotes also known as keyless remotes or remote keyless entry (RKE) fobs.

RKE fobs need to be activated by pressing a button on the remote. Activating the remote causes it to generate a radio signal, containing a key code identifier, which is transmitted to a receiver unit in the vehicle. The receiver unit locks or unlocks the vehicle doors in response to the signal. In comparison, passive entry systems allow more convenient access to a vehicle and the passive entry key fob can remain pocketed throughout the approach towards and exit from the vehicle.

Passive entry systems are known in the art. An example of a passive entry system is described in Figure 1 . The control process for such a system is shown in Figures 2 and 3, whilst, Figures 4 and 5 demonstrate a security weakness that affects some existing passive entry systems.

Figure 1 shows a vehicle 1 and an associated passive entry key fob 2 in wireless communication with each other.

The key fob 2, depicted in Figure 1 , is a device which features a transceiver 3 and a control circuit 4 among other components. The transceiver 3 is able to transmit/receive signals in communication with a passive entry system of the vehicle 1 . The control circuit 4 exchanges signals with the transceiver 3 and is able to receive an authentication challenge from the vehicle 1 and generate a corresponding signal in response. The response signal may comprise a key code or similar identifier of the key fob 2.

The vehicle 1 of Figure 1 features an electronic control unit (ECU) 5, which includes a range of in-vehicle modules, such as a passive entry system control module, and a door-lock control module. The ECU 5 and the associated in-vehicle modules are operatively connected to different systems within the vehicle 1 , which include a door- lock system 6 and a plurality of antennas 7.

The door-lock system 6 is configured to receive command signals from the ECU 5 and lock/unlock the vehicle doors in response. The plurality of antennas 7 are in communication with the passive entry system control module and are also configured to wirelessly communicate with the associated key fob 2, via the key fob's transceiver 3.

The wireless communication between the vehicle antennas 7 and the key fob transceiver 3 may include communication via a number of different communication protocols such as short range signals, including Bluetooth® Low Energy (Bluetooth® LE) signals, and/or via longer range signals. Different signal frequencies may be preferable between longer range and shorter range transmissions where adverse environmental factors such as obstructing elements may be present. The wireless communication enables the exchange of signals between the vehicle 1 and the key fob 2. In use, the ECU 5 is able to process input signals and, in return, generate and transmit output signals to control the various systems of the vehicle 1 . In this manner, the vehicle 1 is equipped to process the passive entry sequence outlined in Figures 2 and 3. Figures 2 and 3 describe a known method of operation for passive entry to a vehicle. Figure 2 describes the initial connection between the key fob 2 and the vehicle 1 which prepares the vehicle for an access request and Figure 3 describes the security challenges which are sent from the vehicle 1 to the key fob 2 in response to an access request. A successful response to the access request grants the key fob holder access to the vehicle 1 .

In Figure 2, the key fob holder approaches the vehicle to initiate the passive entry operation. The key fob 2 may advertise itself by broadcasting advertisement signals from the transceiver 3. The vehicle antennas 7 may periodically or continuously scan or 'listen', as shown in step 201 , for an advertisement signal from the key fob 2 and the ECU 5 analyses the results of the scan in step 202.

In the event that the ECU 5 does not detect a signal broadcast from the key fob 2, for example because the key fob 2 is out of range of the vehicle 1 , then the process may be terminated 203, leaving the vehicle doors locked in step 200 and the vehicle 1 may subsequently continue to search for advertisement signals, as in step 201 .

As the key fob holder moves within the range of the vehicle antennas 7, the key fob advertisement signal is received 204 at the vehicle's ECU 5, and the process moves to step 205. In step 205, the ECU 5 acknowledges the key fob's advertisement signal and forms a communicative connection with the key fob 2.

The system may react to the connection by enabling one or more access features in step 206. The access features may include but are not limited to such vehicle operations as the activation of the vehicle headlights, the retraction of door handle covers and/or enabling of additional vehicle systems. These access features are intended to welcome the key fob holder to the vehicle and provide helpful assistance to their entry.

The system is now suitably prepared for an access request which would prompt the subsequent processing decisions that may grant access to the vehicle. As such, in step 207, the system awaits a suitable access request. It is noted that the system may wait for an access request within a suitable time limit, beyond which the connection with the key fob 2 may be terminated. The access requests may take various forms and may be, for example, pulling a door handle, pressing a button on the door handle and/or specific gestures may constitute a suitable access request.

In Figure 3, the system has detected a suitable access request, at step 301 , which triggers the subsequent processing. For example, the key fob holder may have reached the vehicle 1 and pulled the door handle to produce the access request. The ECU 5 receives the access request signal and, in response, the ECU 5 generates a challenge signal. The challenge signal is transmitted via the vehicle antennas 7 to the key fob 2 in step 302. The challenge signal may include any suitable authentication method but most commonly requests a key code identifier from the key fob 2.

In step 303, the key fob 2 receives the challenge signal via the key fob transceiver 3 and the control circuit 4 generates a reply signal that communicates the key fob's identification. The signal is then transmitted back from the key fob transceiver 3 to the vehicle antennas 7.

In step 304, response signals are received by the vehicle antennas 7 and sent to the ECU 5 for analysis.

If a response is not received, or the response does not match the authentication criteria, then the response is rejected, the connection to the key fob 2 is terminated 305 and the vehicle doors remain locked in step 300. The vehicle 1 may subsequently continue to search for advertisement signals as in step 201 .

If the response is accepted, the ECU 5 issues a command signal 306 to the door-lock system 6. The door-lock system 6 receives and interprets the command signal to unlock the vehicle door, in step 307. The processing operations of Figure 3 may be enacted in a sufficiently short period of time that the access request and the unlocking of the door may appear simultaneous to the key fob holder. As such, the unlocked door may open as the key fob holder pulls the door handle or alternatively be opened thereafter.

The process described allows the key fob holder to keep the key fob pocketed throughout their approach to the vehicle and the key fob unlocks the vehicle as they attempt to access the vehicle 1 . The system provides greater convenience to the driver and the pocketed key fob is less vulnerable to theft or accidental loss.

However, the passive entry system described in Figures 2 and 3 makes the vehicle susceptible to alternative methods of theft. One such example is a relay-attack, in which, an attacker can relay messages between one source, such as the vehicle 1 , and another device, such as the key fob 2, to make the two entities appear closer together than their physical proximity. In practice, a relay-attack is used to make the ECU 5 act as though the vehicle 1 were in close proximity with the key fob 2. Relaying communications in this manner enables an attacker to gain access to the vehicle 1 without the key fob holder's knowledge or any traces of unauthorised entry, and without the key fob itself. Some passive systems are susceptible to relay attacks from a single relay device which amplifies the challenge signal sent from the vehicle 1 to the key fob 2, or vice versa. For example, the attacker may have watched the key fob holder exit and move away from the vehicle 1 whilst identifying their target and subsequently the attacker may prompt the vehicle to issue the challenge signal, for example by pulling the door handle. The attacker may use the relay device to amplify the vehicle's challenge signal such that it reaches the distant key fob 2, which produces and transmits its identification key code signal in response. The identification signal typically has a much greater range. As such, the vehicle may receive the longer range signal from the key fob 2 and grant the attacker access to the vehicle.

More recent improvements in passive entry system defences have been able to protect against such single device relay-attacks. For example, the defence systems measure the signal strength of the key fob identification signal at the vehicle antennas 7 and find that the signal's strength is lower than expected. However, this simple means of defence remains susceptible to a relay attack from a pair of relay devices.

When more than one relay device is used in a relay-attack, messages can be relayed between sources via suitable first and second relay devices. The relay devices may be relatively inexpensive and would include an antenna for capturing/reproducing source signals, amplifiers to boost signal strength and filters to restore signal quality. The devices typically include suitable circuitry to up-convert or down-convert signals in order to produce high frequency signal transmission between distant relay devices. The relay devices may additionally include modulating and de-modulating components to first demodulate the signal, transmitting it as digital information and then modulate it near the target.

As used herein, the term "relay" describes a process in which, the source signal is captured by a first relay device, where the signal may be filtered, amplified and up- converted to a higher frequency for transmission to a second relay device. A second relay device will similarly down-convert, amplify and filter the transmitted signal to restore the signal to its original state. An antenna on the second device is subsequently able to reproduce the signal, as emitted by the source, in sufficient proximity of the target and establish the required close proximity communication.

In order to highlight the problems that affect some passive entry systems, a common form of relay-attack is described by way of example in Figures 4 and 5.

Figures 4 and 5 are typical of a situation in which the key fob holder has parked their vehicle 1 in a car park. The authorised vehicle user (and key fob holder) exits the vehicle a suitable locking command from the key fob 2, or activation of a door lock switch on the exterior of the vehicle, causes the vehicle doors to lock. The vehicle locking is often confirmed by indicators such as a flash of the headlights and an audible tone.

In Figure 4, the vehicle antennas 7 subsequently scan, in step 401 , for a key fob signal.

However, an attacker can position a first relay device at the entry/exit to the car park, with a second relay device kept in the attacker's possession. As the key fob holder leaves the car park they pass within close proximity of the first relay device. The key fob 2 is broadcasting an advertisement signal, which can be captured by the first relay device and relayed to the second relay device for transmission to the vehicle, as in step 402. The second relay device may be in the possession of the attacker and in close proximity to the vehicle 1 .

If the attacker is within sufficient proximity of the vehicle 1 , the vehicle antennas 7 will detect the reproduced advertisement signal and transmit the signal to the ECU 5, in step 403. The ECU 5 receives the advertisement signal, as 405, and as a result the system of relay devices forms the communicative connection to the key fob 2 and enables the access features as previously described in steps 406 and 407. As in Figure 2, the system enters a prepared state in step 408, awaiting an access request.

At this point, the attacker interacts with the target vehicle 1 in a suitable manner, for example by pulling the door handle, to satisfy an access request. This action is demonstrated by step 501 in Figure 5 and the access request causes the ECU 5 to generate a challenge signal which is transferred to the vehicle antennas 7 for transmission. The challenge signal is captured at the second relay device and relayed to the first relay device, which subsequently reproduces the challenge signal to the key fob 2; establishing continued communication between the two end-point systems, in step 502. As a result of the relay devices, the vehicle 1 and key fob 2 act as though they are within close proximity of each other and the key fob 2 generates the identification signal, in response to the challenge, which is similarly relayed back to the second relay device and transmitted to the vehicle antennas 7, in step 503. The response is processed by the ECU 5, in step 504, and, in the event that the response is successful, the ECU 5 issues a command signal 506 to the door-lock system 6.

The door-lock system 6 enacts the command signal and unlocks the vehicle door, as step 507. As a result, the attacker is able to open the vehicle without alerting anyone, including the key fob holder.

In some systems the key fob signal strength is measured by the ECU 5 in an attempt to confirm the proximity of the key fob 2 to the vehicle 1 . The proximity check is generally completed after the challenge response has been processed, i.e. after step 504. If the relayed signal fails the signal strength test performed by the ECU 5, or is otherwise not authenticated, the ECU 5 sends a command 505 to the door lock system to remain locked at step 500. However, the test is similarly susceptible to the same relay-attack and signal boosting described above. Embodiments of the present claimed invention utilise passive challenges that verify an approach to the vehicle with increased certainty. As a result, the presently claimed invention provides enhanced protection against the forms of theft described above.

Figure 6 shows a system and method in accordance with an embodiment of the claimed invention and includes the use of a passive entry device 8 in wireless communication with an associated vehicle 9. The wireless communication enables the passive entry device 8 to authorise one or more operations of the vehicle 9. For example, the passive entry device 8 may authorise the vehicle 9 to unlock/lock the vehicle doors and start the engine. The wireless communication takes place during the device holder's approach to the vehicle 9 and features an exchange of signals, between the vehicle 9 and the passive entry device 8, that verify the access credentials of the passive entry device 8. The wireless communication thusly enables the device holder to unlock the vehicle doors during their approach to the vehicle 9, without necessitating interaction with the passive entry device 8. The vehicle 9 of Figure 6 may be any suitable vehicle comprising at least a passive entry system configured for wireless communication with a passive entry device 8. The vehicle may be substantially similar to the vehicle 1 described in Figure 1 , featuring an ECU 5, a door-lock control system 6 and antennas 7, for example. The passive entry device 8 shown in Figure 6 may be any suitable computing device such as, a smartphone, tablet, smartwatch, laptop or key fob which is suitably portable and configured to provide the capabilities outlined below.

The components associated with the principal operation of the passive entry device 8 and the vehicle 9 are generally conventional and therefore will not be described in detail.

Systems and methods according to embodiments of the present invention feature means for wireless communication between the passive entry device 8 and vehicle antennas 7. The wireless communication may, for example, be enabled by transceivers on the passive entry device 8 configured to wirelessly communicate with the vehicle antennas 7. The wireless communication may include communication via a number of different communication protocols such as short range signals, for example, Bluetooth® LE signals, and/or via longer range signals. Different signal frequencies may be preferable between longer range and shorter range transmissions where adverse environmental factors such as obstructing elements may be present. The system may additionally be configured to measure the strength of the communication signals exchanged between the passive entry device 8 and the vehicle 9. The transceivers may also be configured to communicate with global positioning systems (GPS), cellular networks, Bluetooth® enabled devices and other entry devices.

In the embodiment of the invention shown in Figure 6, the wireless communication proceeds via both Bluetooth® LE signals and longer range signals and the passive entry device 8 features transceivers configured to wirelessly communicate with GPS and the vehicle antennas 7.

Systems and methods according to embodiments of the present invention may include means for locating the position of the passive entry device 8 and the vehicle 9. The position of the passive entry device 8 may be determined based on a range of communication signals exchanged at the transceivers. For example, Bluetooth®, Wi-Fi and cellular network signals may be used to determine the passive entry device's relative location based on signal strength or triangulation methods, whilst co-operation with GPS would enable an accurate determination of the passive entry device's location. The position of the vehicle 9 may act as the origin or be determined, for example, by recording the GPS position at key-off.

In the embodiment of the invention illustrated by Figure 6, the location of the passive entry device 8 is determined by using GPS means of a locating module, and the vehicle location is determined by recording and storing the GPS position of the passive entry device 8 and/or vehicle 9 at key-off of the vehicle 9 or other "end-of-journey" event of the vehicle 9. Systems and methods according to embodiments of the present invention may include means for sensing motion of the passive entry device 8. Perturbations of the passive entry device 8 may be sensed by features local to the passive entry device 8 such as accelerometers, gyroscopes, IMUs and GPS. The accelerometers need not be tri- axial, but may be single axis accelerometers. Alternatively, perturbations may be sensed by external features, including but not limited to, infrared sensors, microwave sensors, ultrasonic sensors, tomographic motion detectors or video camera software which may or may not be operatively connected to the vehicle 9. The motion sensors may be configured to detect a perturbation and record measurements of the acceleration and/or the orientation of the passive entry device 8.

In the embodiment of the invention described by Figure 6, the acceleration and/or orientation of the passive entry device 8 may be measured using one or more accelerometers and/or gyroscopes local to the passive entry device 8. For example, the passive entry device 8 may comprise one or more accelerometers and/or gyroscopes and the passive entry device 8 may be configured to measure its acceleration and/orientation using these.

Systems and methods according to embodiments of the present invention may include means for verifying an approach to the vehicle 9. For example, the approach criteria may include gait analysis of the motion sensor data; to distinguish the motion of the passive entry device 8 from a simple perturbation. In another arrangement, the location services may record the movement of the passive entry device 8, during the approach, to assess whether the movement reduces the distance between the passive entry device 8 and the vehicle 9 and thus matches an approach. In a further arrangement, an approach may be verified by measuring an increase in the signal strength of the wireless communication. In another arrangement, accelerometer, gyroscope and GPS measurements may be used to produce a motion vector. In such instances, the means for verifying an approach to the vehicle 9 may confirm whether the direction of the motion vector matches an approach to the position of the vehicle 9.

In the embodiment of the invention illustrated by Figure 6, the passive entry device 8 measures the signal strength variation during the approach; where, increasing signal strength verifies an approach to the vehicle 9. Systems and methods according to embodiments of the present invention may additionally feature means for identifying the user, which may include fingerprint recognition, key code identification, gesture control and/or other applications of biometric authentication, such as retinal scanning, iris recognition, finger vein identification, facial recognition or voice identification. The identification may be completed by features of the passive entry device 8 and/or the vehicle 9.

In the embodiment of the invention described by Figure 6, key code identification at the passive entry device 8 is used to identify the user in the event that such identification is necessary.

Systems and methods according to embodiments of the present invention may feature means for running a variety of software components on the passive entry device 8 and/or vehicle 9. In one arrangement, one such software component is an application that enables the passive entry device 8 to act as a 'virtual' keyless remote, as exemplified by Figure 7.

Figure 7 shows a 'virtual' keyless remote embedded within an application of the passive entry device 8. The application features soft keys or buttons 701 to 706. Upon selection, the buttons may cause the passive entry device 8 to transmit a command signal to the vehicle antennas 7 to authorise one or more operations of the vehicle 9.

In an arrangement, button 701 commands the vehicle doors to lock, button 702 commands the vehicle doors to unlock, button 703 commands the vehicle headlights to turn on/off, button 704 commands the vehicle boot to unlock/open and button 705 commands the operation of the vehicle hazard lights. The application may feature additional buttons to further increase the range of possible vehicle operations and/or to communicate with other passive entry devices or keyless remotes. In the arrangement shown, button 706 may be used to enable key sharing capabilities between other entry devices and/or key fobs. A 'virtual' keyless remote application, as described by Figure 7, would provide the functionality of a traditional keyless remote and the command of additional vehicle operations through the passive entry device 8 interface. Figures 8 to 1 1 describe various methods of operation of the system shown in Figure 6. It is noted that these modes of operation are merely provided by way of example only and are not intended to limit the system and/or method. As such, it is understood that the processes may be altered, reordered, added and removed as will be appreciated. Additionally the operation of one or more facilities may be activated by the results of a previous process in order to reduce the battery power consumption of the passive entry device 8.

In Figure 8, the authorised holder of the device approaches the vehicle 9 to initiate the passive entry method.

The passive entry method proceeds through steps 801 to 806 substantially as in the processes described in steps 201 to 206 of Figure 2. Yet one evident difference is that the passive entry device 8 may take various forms besides the key fob 2 of Figures 1 and 2.

However, there is a fundamental difference at step 806. In embodiments of the claimed invention, the access features enabled in step 806 include launching a 'passive' access process. The 'passive' access process is an additional series of security challenges which utilise the one or more additional sensors of the passive entry device 8.

As such, the passive entry method differs substantially herein from the method described in Figure 2 and the differences provide the improvements that have been identified over the existing passive entry systems. In step 807, the system launches the 'passive' access process and waits for an access request.

Figure 9 describes an embodiment of the 'passive' access process in accordance with the present invention. The 'passive' access process is launched at step 901 , in line with the action of step 807. The 'passive' access process of Figure 9 initially checks, in step 902, whether location services and motion sensing facilities are available for use. In certain circumstances, external factors may prevent the use of either the location services or motion sensing facilities of the passive entry device 8.

If location services and/or motion sensing facilities are unavailable, the 'passive' access process is terminated 903 and an 'active' access process 1001 is launched. The location services and/or motion sensing facilities may be unavailable, for example, in an underground car park, where, location services, such as GPS, may be unusable due to a lack of signal. The 'active' access process is described in Figures 10a and 10b.

Providing that location services and motion sensing facilities are available 904, the position of the passive entry device 8 is determined by its GPS and compared to the recorded position of the vehicle 9, as described by step 905. The method assumes that the position of the vehicle 9 had previously been recorded on the passive entry device 8 at ignition off or "key-off" of the vehicle 9, and/or upon one or more further "end-of-journey" events. The passive entry device 8 must be located within a bounding proximity of the vehicle 9, for example, a maximum distance within which the proximity requirements are met. The location challenge prevents the relay-attack described in Figures 4 and 5 because the information from a location service, such as GPS, cannot be manipulated in the same manner by signal boosting or filtering. When the locations of the vehicle and the device do not match, as 906, the vehicle doors remain locked, in step 900, and the connection between the passive entry device 8 and the vehicle 9 may be disconnected. The vehicle 9 may then continue its search for advertisement signals, as in step 801 . However, if the locations match 907, motion sensor data is collected from the accelerometers, gyroscope, or other suitable means associated with the passive entry device 8 and analysed to determine whether the passive entry device 8 has been perturbed, reflecting the challenge described in step 908. The movement challenge may assess the passive entry device's motion within a predetermined period of time. For example, assessing whether motion has been detected within the last sixty seconds of the assumed approach to the vehicle 9.

If the accelerometers measure zero acceleration, as 909, the vehicle doors remain locked, in step 900, and the connection between the passive entry device 8 and the vehicle 9 may be disconnected. The vehicle 9 may subsequently continue its search for advertisement signals, as in step 801 . Zero acceleration may be measured, for example, when the passive entry device 8 is in close proximity to the vehicle 9 but remains motionless on a surface. For example, the vehicle 9 may be parked on a driveway and the passive entry device 8 may be inactive, inside the household, but in relatively close proximity. The challenge therefore concludes that the passive entry device 8 is not being used with the intention of gaining access to the vehicle 9 and the access process is terminated accordingly. When the passive entry device 8 senses a perturbation, as 910, the motion/changes in location of the passive entry device 8 may be assessed, in step 91 1 , against criteria that define an approach to the vehicle 9. In Figure 9, an approach is defined by a measured increase in the strength of the communication signals over the course of the approach.

Movement of the passive entry device 8 that does not match an approach to the vehicle 9, as 912, causes the connection between the passive entry device 8 and the vehicle 9 to be disconnected. The vehicle 9 remains locked in step 900 and continues its search for advertisement signals, as in step 801 .

When the movement of the passive entry device 8 does match an approach to the vehicle 9, as 913, the strength of the connection between the vehicle 9 and the passive entry device 8 may be measured, in step 914, and compared, in step 915, to a minimum threshold requirement. In Figure 9, the strength of a Bluetooth® LE signal transmitted from the passive entry device 8 is checked against a minimum threshold to determine suitable proximity of the passive entry device 8 to the vehicle 9.

If the signal strength is less than the minimum requirement, as 916, the vehicle doors remain locked, in step 900, and the connection between the passive entry device 8 and the vehicle 9 is disconnected. The vehicle 9 may then continue its search for advertisement signals, as in step 801 . For instance, the device holder may be in a multi-story building or car park, in which, from an aerial perspective, the holder is in close proximity to the vehicle 9. However, the signal strength would be less than the threshold requirements because there are barriers (walls/floors) separating the passive entry device 8 from the vehicle 9 and thus the passive entry device 8 would be appropriately denied access to the vehicle 9.

However, if the signal strength, as assessed in step 915, is acceptable 917 then it corroborates the proximity of the passive entry device 8 to the vehicle 9. The passive entry device 8 then prepares a challenge response, in step 918, which may certify that the passive entry device 8 has met the requirements for an approach towards the vehicle 9. As such, in step 918, the passive entry device 8 is prepared to answer a challenge signal from the vehicle 9 and hence the system awaits an access request.

Figure 1 1 describes the processing actions of the passive entry system which enable access to the vehicle 9 following an access request.

In Figure 1 1 , the system detects an access request, in step 1 101 , as a trigger for the subsequent processing. For example, the device holder may have reached the vehicle 9 and pulled the door handle to generate the access request. In a fully passive embodiment of the claimed invention, the access request of step 1 101 may be suitably satisfied by the formation of the connection between the passive entry device 8 and the vehicle 9 in step 805 of Figure 8. As such, upon forming the connection, the passive entry device 8 may carry out the 'passive' access process as exampled by Figure 9 and the vehicle 9 may automatically issue the challenge signal to the passive entry device 8.

The challenge signal of step 1 102 may have additional requirements, compared to the challenge signal of step 302. For example, the challenge signal of the claimed invention may additionally require a certificate from the passive entry device 8 that verifies that the passive entry device 8 has passed the 'passive' access process, in addition to the key code identifier.

At step 1 103, the passive entry device 8 transmits the challenge response, as generated at step 918, to the vehicle 9.

Challenge response signals are received by the vehicle antennas 7 and processed by the ECU 5, in step 1 104. If a response is not received, or the response does not match the authentication criteria, then the response is rejected 1 105, the connection to the key fob 2 is terminated and the vehicle doors remain locked in step 1 100. The vehicle 1 may subsequently continue to search for advertisement signals as in step 801 .

However, upon producing a satisfactory challenge response 1 106, at step 1 104, the passive entry device 8 grants access to a virtual keyless remote application, in step 1 107, and the ECU 5 commands the door-lock system 6 to unlock the vehicle doors, in step 1 108.

The vehicle entry process described by Figures 8, 9 and 1 1 allows the device holder to keep the passive entry device 8 pocketed throughout their approach to the vehicle 9 and unlocks the vehicle 9 as they move into a predetermined range or as they perform a suitable interaction with the vehicle 9. The method improves upon existing keyless entry systems by using one or more additional sensors of the passive entry device 8 or vehicle 9 to make a complex verification of an intentional approach to the vehicle 9. As such, the claimed invention provides an improved vehicle entry system over the prior art and the invention provides enhanced defence against various forms of theft, including the relay-attack of Figures 4 and 5.

However, the process may require interaction with the passive entry device 8 if, for example, the facilities used to complete the 'passive' access process are unavailable, as was identified by 903 in Figure 9. In this case, the system may require the user to 'actively' verify their intention to access the vehicle through an 'active' access process. Figure 10a describes an 'active' access process in accordance with an embodiment of the present invention. It assumes that the 'active' process follows on from step 903. Referring to Figure 10a, having completed the initial connection and analysis described by steps 801 to 1001 , the vehicle 9 signals for an unlock notification to be generated on the passive entry device 8 as shown by step 1002. The unlock request notification may require an active acknowledgement in order to proceed to the identification challenge, as indicated by step 1003. Alternatively, the user may have to interact with the notification within a certain predetermined time period, beyond which the challenge expires 1004 and the connection is terminated in step 1000. As such, the vehicle 9 remains locked and it may continue its search for advertisement signals, as in step 801 .

When the unlock request is successfully acknowledged 1005, the passive entry device 8 issues an identification challenge, as in step 1006. A key code identifier may be created by the device owner and subsequently used in response to such an identification challenge in order to verify the identity of the device holder.

If the identification challenge is unsuccessful 1007, the passive entry device 8 produces a notification of an unsuccessful access attempt, as demonstrated by step 1008. The notification is intended to make the user aware of all unsuccessful access attempts, alerting the user to an unsuccessful attack or informing the user of a mistake in the key code entry. Such notifications may also be sent to other connected devices, alerting the owner to a potential theft of the passive entry device 8 and attempted access to the vehicle 9.

In Figure 10a, unsuccessful access attempts are logged and a tolerance of unsuccessful attempts may be set and checked, in step 1009. Setting a tolerance of unsuccessful attempts mean that, attempts beyond the tolerance 1010 cause the passive entry device 8 and/or the connection to be further disabled and/or the security breach escalated, as described by step 1020. Whilst unsuccessful attempts, below the tolerance 101 1 , may return to the identification challenge of step 1006. This approach provides an error tolerance for mistaken responses to the identification challenge, which may arise due to human error.

Successful responses to the identification challenge/challenges, as 1012, move the process to step 1013, in which, the strength of the connection between the vehicle 9 and the passive entry device 8 is measured and subsequently compared to a minimum threshold requirement, as in step 1014. Step 1014 may check the strength of a low energy Bluetooth® signal received from the passive entry device 8 against a minimum threshold to determine suitable proximity of the passive entry device 8 to the vehicle 9.

When the signal strength is less than the minimum requirement, as 1015, the connection between the passive entry device 8 and the vehicle 9 may be disconnected in step 1000 and the vehicle 9 may remain locked and continue its search for advertisement signals, as in step 801 .

However, if the signal strength is acceptable, i.e. above the minimum requirement, 1016 and corroborates the proximity of the passive entry device 8 to the vehicle 9, then the passive entry device 8 grants access to a virtual keyless remote application, demonstrated by step 1017. The virtual keyless remote application may replicate the functionality of a traditional keyless remote and enables the command of additional vehicle operations through the passive entry device 8 interface, as in the example of Figure 7.

From the application, or upon passing the process, the passive entry device 8 issues an unlock request to the vehicle 9 at step 1018. The vehicle 9 processes the unlock request and commands the door-lock system 6 to unlock the vehicle doors in response, as in the final step 1019.

In the embodiment of the 'active' access process described by Figure 10a, the process was launched, for example, because the facilities used to complete the 'passive' access process may have been unavailable. However, it is worth noting that the user may choose to launch an 'active' access process, at any time, instead of following the preliminary process of Figures 8 and 9. Launching an 'active' process in this manner, would allow the passive entry device 8 to be used in the manner of a traditional keyless remote, but with the advantages of the passive entry device's additional security features. An example embodiment of this alternative 'active' access process is described by way of example in Figure 10b. The 'active' access process of Figure 10b may be launched in step 1001 through a suitable interaction with the passive entry device 8, for example, by selecting the software application through an interface of the passive entry device 8. The 'active' access process subsequently proceeds substantially as in the description of Figure 10a from the point 1006 onwards. As a result, the device holder is able to interact with the passive entry device 8, once they are within sufficient proximity of the vehicle 9, to issue command signals from the passive entry device 8 to the vehicle 9, which authorise one or more vehicle actions, which may include unlocking the vehicle doors. The 'active' processes described allow the passive entry device 8 to replicate the functionality of a keyless remote and authorise one or more vehicle actions. As such, the passive entry device 8 is able to facilitate entry to the vehicle 9, for example, when the 'passive' system is unavailable. The passive entry device 8 may additionally remove the need to carry an additional key fob/keyless remote for the vehicle 9 and the method features more complex access requirements that reduce the vulnerability to theft.

Figure 12 illustrates a system diagram which demonstrates the signal exchanges, between the passive entry device 8 and the vehicle 9, that take place during the passive entry method described in the Figures above. The passive entry device 8 is shown to include an input 10 for receiving a challenge signal from the vehicle 9 and an output 1 1 for outputting a response signal to the vehicle 9. The input 10 and the output 1 1 are configured to communicate with a processor 12. In this configuration, the input 10 receives a challenge signal from the vehicle 9, which it communicates to the processor 12. The processor 12 completes a passive entry method, of the type shown in Figures 8 to 1 1 , and generates a response signal which includes information identifying the passive entry device 8. The processor 12 transmits the response signal to the output 1 1 of the passive entry device 8 and the output 1 1 outputs the response signal to the vehicle 9.

The vehicle 9 is shown to include vehicle antennas 7, which are able to output the challenge signal to the passive entry device 8 and to receive the response signal. The vehicle antennas 7 are configured to communicate with the ECU 5 of the vehicle 9 and the ECU 5 further communicates with the door-lock system 6. In this manner, the ECU 5 detects an access request and in response generates the challenge signal which it transmits to the vehicle antennas 7. The vehicle antennas 7 output the challenge signal to the passive entry device 8 and receive the response signal from the passive entry device 8 in return. The response signal is transmitted back to the ECU 5 and the ECU 5 analyses the response signal, as exemplified in Figure 1 1 , before sending a command signal to the door-lock system 6. The door-lock system 6 receives the command signal and unlocks the vehicle doors in response. Many modifications may be made to the above examples without departing from the scope of the present invention as defined in the accompanying claims.