CORRESPONDING KEY CONTROL SYSTEM

TECHNICAL FIELD

[0001] The present disclosure relates to a protection device for protecting a key fob, and in particular to a protection device, and key fob comprising a switch being wirelessly controllable.

BACKGROUND

[0002] Access control has greatly improved both in security and in convenience for users in recent years. For instance, in the automotive industry, key fobs are typically provided with push buttons for remote control of locking and unlocking the car. The remote control removes the need for a mechanical key to open doors of a car.

[0003] A fairly recent improvement is passive access control by the car, sometimes known as the use of a smart key. In passive access control, the user keeps the key fob in a pocket or handbag and the car detects the presence of the key fob of the user and causes an access control system in the car to communicate wirelessly with the key fob.

As long as the correct key fob is in the vicinity of the car and is authorised, the access control system grants access and unlocks the car. In this way, the user does not even need to handle the key fob for unlocking the car and can conveniently keep the key fob hidden.

[0004] In passive access control, the initial communication between the car and the key fob can be based on magnetic, i.e. inductive, signals which have a very limited range. In this way, it is prevented that an attacker could gain access of a car in a driveway when a key is located a few metres away, e.g. inside a front door or when a user walks away from the car. It is thus of great importance to have full control of communication range between car and key fob.

[0005] Recently, relay attacks are used to attempt to gain access where passive access control is employed. In relay attacks, one person is located by the car with a first relay device. Another person attempts to be close to a key fob (e.g. by a front door) with a second relay device. If successful, the car communicates, via the relay devices, with the key fob whereby access to the car is granted even without the attackers having physical access to the key fob. [0006] One known way to reduce the risk of relay attacks is to place the key fob inside a metal enclosure, to block signals from the car or relay device to reach the key fob. However, such metal enclosures are bulky and inconvenient.

SUMMARY

[0007] It is an object to prevent relay attacks of an attacker attempting to gain access to a protected object which is more convenient than prior art solutions.

[0008] According to a first aspect, it is provided a protection device for being provided inside a key fob to selectively inactivate the key fob. The protection device comprises: a first conductive layer; a second conductive layer; an insulator layer between the first conductive layer and the second conductive layer, the insulator layer preventing conductive contact between the first conductive layer and the second conductive layer; and a switch conductively coupled between the first conductive layer and the second conductive layer, the switch being wirelessly controllable to be in a conductive state or a blocking state.

[0009] The switch may be a reed switch.

[0010] The protective device may further comprise a first communication module connected to the switch. In such a case, the communication module is configured to receive signals to control the state of the switch.

[0011] The first communication module may support communication using any one of Near-field communication (NFC), Bluetooth, Bluetooth Low Energy (BLE), or any of the IEEE (Institute of Electrical and Electronics Engineers) 802.15 standards.

[0012] The protection device may be configured to be provided between a pole of a battery of the key fob and a power connector of the key fob.

[0013] The protective device may further comprise a battery, in which case the protective device being provided in contact with one pole of the battery and a

corresponding power connector.

[0014] According to a second aspect, it is provided a key fob comprising a battery and the protective device according to any one of the preceding claims. The protective device is then provided in contact with one pole of the battery and a corresponding power connector. [0015] According to a third aspect, it is provided a key control system comprising the protective device according the first aspect, when the protective device comprises the first communication module. The key control system further comprises a switch controller comprising: a second communication module configured to determine a distance to a protected object; and a third communication module configured to communicate with the first communication module of the protective device; wherein the switch controller is configured to control the state of the switch of the protective device based on a distance between the switch controller and a protected object.

[0016] The second communication module may be configured to cooperate with a fourth communication module installed in the protected object to determine the distance.

[0017] The second communication module may be configured to cooperate with the fourth communication module installed in the protected object to determine the distance based on time-of-flight measurements.

[0018] The second communication module may be configured to cooperate with the fourth communication module installed in the protected object to determine the distance based on multi-carrier phase-based ranging, also referred to as multiple carrier phase difference.

[0019] The switch controller may be configured to close the switch when the distance is less than a threshold distance and open the switch when the distance is more than a threshold distance.

[0020] The third communication module may be configured to communicate with the first communication module to control the switch using an inductive signal.

[0021] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a/an/the element, apparatus, component, means, step, etc." are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Aspects and embodiments are now described, by way of example, with refer ence to the accompanying drawings, in which:

[0023] Fig 1 is a schematic diagram illustrating the use of passive access control in an environment in which embodiments presented herein can be applied;

[0024] Fig 2 is a schematic diagram illustrating a relay attack in the environment of Fig 1;

[0025] Fig 3 is a schematic diagram illustrating an embodiment of a protection device for preventing a relay attack provided in the key fob of Fig 1 or Fig 2;

[0026] Fig 4 is a schematic diagram illustrating components of the protection device of Fig 3 according to one embodiment;

[0027] Fig 5 is a schematic diagram illustrating components of the protection device of Fig 3 according to one embodiment;

[0028] Fig 6 is a schematic diagram illustrating a key control system also comprising a switch controller; and

[0029] Fig 7 is schematic diagram illustrating an example when distance to the protected object is used as an input parameter for controlling the switch.

DETAILED DESCRIPTION

[0030] The aspects of the present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which certain

embodiments of the invention are shown. These aspects may, however, be embodied in many different forms and should not be construed as limiting; rather, these

embodiments are provided by way of example so that this disclosure will be thorough and complete, and to fully convey the scope of all aspects of invention to those skilled in the art. Like numbers refer to like elements throughout the description.

[0031] According to embodiments presented herein, a protection device is provided which can be installed inside a key fob between its battery and a power connector. The protection device can be controlled wirelessly to be in a conductive or blocking state to thereby control whether the key fob is active and usable or not. Optionally, the protection device comprises the battery. [0032] Fig 1 is a schematic diagram illustrating the use of passive access control in an environment in which embodiments presented herein can be applied. A protected object 3 is here in the form of a car. It is to be noted that the protected object can be any other suitable object to which access is controlled, such as any other vehicle, a building, or other secure physical space. Hence, whenever a car is mentioned herein as a protected object, the same principles can be applied to any other protected object.

[0033] The car 3 is secured by locks which are controlled using passive access control. A user 5 keeps a key fob 2 in a pocket or bag, etc. When the car detects the presence of the user, e.g. by the user 5 touching a handle 22 of the car or the key fob 2 coming within communication rage of the car 3, access control is initiated. An access controller 20 of the car receives a signal when the presence of the user or key fob 2 is detected and attempts to communicate wirelessly with any key fob 2 in the vicinity of the car 3. Specifically, the access controller 20 here communicates with the key fob 2 of the user 5 and determines whether the key fob 2 is authorised to unlock the car 3. If this is the case, the access controller 20 unlocks the car 3 and the user can open the door 21.

[0034] As known in the art per se, the communication between the access controller 20 and the key 2 occurs at least initially using inductive (magnetic) signals to thereby effectively control communication range, since the range of inductive signals is very short. Communication based on longer range RF (Radio Frequency) waves can be used after the initial inductive communication. The inductive interface is thus configured to be short range e.g. to prevent an attacker from unlocking the car when the user is walking away from the car or when a key fob is located a few metres away from the car 3 (e.g. inside a building close to a driveway).

[0035] The passive access control can also be used for starting the car.

[0036] Fig 2 is a schematic diagram illustrating a relay attack in the environment of Fig 1. A first person 30a is located by the car and carries a first relay device 31a. A second person 30b is located close to a key fob 2 with a second relay device 31b. The key fob 2 is physically secured inside a building wall 12 (e.g. by a front door).

[0037] The car 3 sends out a first inductive signal to communicate with any nearby key fobs. The first relay device 31a receives the inductive signal and transmits the signal to the second relay device 32a. In one embodiment, the first inductive signal is transformed the signal to a longer range RF wave-based signal and transmitted to the second relay device 32a In one embodiment, the first inductive signal is transformed to an electric signal and is transmitted to the second relay device 32a over a cable. The second relay device 32a receives the signal from the first relay device, converts received signal back to an inductive signal, to which the key fob 2 responds, since the second relay device 32a is sufficiently close. The response from the key fob 2 is picked up by the second relay device 32a transferred in the same way (e.g. via a longer range RF wave- based signal or cable) to the first relay device 31a, which transmits a corresponding response to the car 3. The car 3 continues the access control process and will thus unlock the car 3. The car 3 can be started in the same manner.

[0038] Fig 3 is a schematic diagram illustrating an embodiment of a protection device for preventing a relay attack provided in the key fob of Fig 1 or Fig 2.

[0039] The key fob 2 comprises a battery 13 comprising a positive pole 14a and a negative pole 14b. There is a first power connector 15a for connection with the positive pole 14a and a second power connector 15b for connection with the negative pole 14b. The power connectors I5a-b are connected with circuitry 16 to thereby power the circuitry 16. The circuitry 16 comprises components of the key fob to allow it to function as known in the art per se, e.g. for communication and authentication with the car 3.

[0040] According to embodiments presented herein, it is provided a protection device 1 which can be provided between one of the poles i4a-b of the battery 13 and the respective power connector isa-b, such that any power from the battery to the power connector needs to flow through the protection device 1. In other words, the protective device 1 is provided between the positive pole 14a and the first power connector 15a or the protective device 1 is provided between the negative pole 14b and the second power connector 15b. The protection device 1 is galvanically connected to one of the poles 14a- b and the power connector i5a-b. Optionally, the protection device 1 comprises the battery, which simplifies installation as well as distribution of the protection device 1.

[0041] As explained in more detail below, the protective device 1 can be controlled wirelessly, i.e. through the housing of the key fob, to be in either a conductive state or a blocking state. When in the conductive state, the protection device 1 allows the battery 13 to supply power to the circuitry 16 of the key fob 2, enabling the key fob 2 to function normally. When in the blocking state, the protection device 1 prevents the battery 13 from supplying power to the circuitry 16 of the key fob 2, whereby the key fob is effectively powered off. Hence, when the protective device 1 is in a blocking state, the key fob 2 is incommunicable, effectively preventing any relay attack.

[0042] Fig 4 is a schematic diagram illustrating components of the protection device 1 of Fig 3 according to one embodiment. The protection device 1 is thin and provided in layers to allow retrofitting of the protection device 1 within a housing of the key fob 2.

[0043] The protection device comprises a first conductive layer 30, a second conductive layer 32 and an insulator layer 31 between the first conductive layer 30 and the second conductive layer 32. The insulator layer 31 prevents conductive contact between the first conductive layer and the second conductive layer.

[0044] A switch 35 is provided, conductively coupled between the first conductive layer 30 and the second conductive layer 32. The switch 35 is wirelessly controllable to be in a conductive state or a blocking state. In this embodiment, the switch is

implemented as a reed switch. In this way, the user can apply a magnetic field from a permanent magnet to close the switch, to set the protective device 1 in a conductive state, whenever the key fob should be used. When the magnetic field is not applied, the reed switch is open, whereby the protective device 1 is in the blocking state, preventing any relay attack. Alternatively, the default state is that the switch is closed (i.e.

conductive state), and when a magnetic field is applied, the switch opens.

[0045] By using the reed switch, a simple and robust solution is provided which still allows external wireless control using the magnetic field; the protection device 1 does not need any powered circuitry in this embodiment.

[0046] Fig 5 is a schematic diagram illustrating components of the protection device 1 of Fig 3 according to one embodiment. In this embodiment, the protective device 1 comprises a first communication module 37 is which configured to receive signals to control the state of the switch 35. The first communication module 37 can e.g. support communication using any one or more of inductive communication, Near-field communication (NFC), Bluetooth, Bluetooth Low Energy (BLE) or any of the IEEE (Institute of Electrical and Electronics Engineers) 802.15 standards or infrared (IR).

[0047] The first communication module 37 comprises suitable circuitry and antennas for communication as well as to control the state of the switch 35 based on the communication. The first communication module 37 can comprise processing capability, an application specific integrated circuit (ASIC) and/or a field programmable gate array (FPGA). In one embodiment, the first communication module 37 is

implemented using a microcontroller unit (MCU). The first communication module 37 is powered by connecting to both poles of the battery of the key fob.

[0048] In one embodiment, the first communication module 37 is external to the key fob and the switch is a reed switch. The first communication module 37 then controls the state of the switch by generating a magnetic field. In this case, the first

communication module 37 can have its own battery.

[0049] The signals can be received by the first communication module 37 e.g. from a switch controller provided externally, e.g. as shown in Figs 6 and 7, described below. Alternatively, the first communication module 37 can receive signals from an

application (i.e. app) executing on a smartphone 7. In this way, the user can control the state of the protection device by using the application. The commands can directly control the switch to set the protection device 1 in blocking mode or conductive mode as desired, controlled by the user using the app.

[0050] Furthermore, the commands can cause the protection device 1 to adopt a schedule, controlling when to be in the blocking state and when to be in a conductive state. The schedule is stored in the first communication module 37 and is applied to control the state of the protective state 1 accordingly. This allows the user to set a default schedule when the protection device should be in the conductive state, e.g. when the user typically uses the car to drive to or from work. At other times, the protection device is in the blocking state (unless manually changed using the application in the

smartphone), during which relay attacks are prevented.

[0051] Fig 6 is a schematic diagram illustrating a key control system 4 also comprising a switch controller 6.

[0052] The switch controller 6 comprises a second communication module 33 that is configured to determine a distance to a protected object, as described in more detail below with reference to Fig 7. The switch controller 6 also comprises a third

communication module 36 that is configured to communicate with the first

communication module 37 of the protective device.

[0053] The second communication module 33 is configured to cooperate with a fourth communication module 39 installed in the protected object 3 to determine the distance 27 between the second communication module 33 and the fourth

communication module 39. The fourth communication module 39 is installed in the protected object 3 in any suitable way, e.g. in a vehicle diagnostic socket (also known as on-board diagnostics connector) or a USB (universal serial bus) socket.

[0054] The second communication module 33 can be configured to cooperate with the fourth communication module 39 installed in the protected object 3 to determine the distance 27 based on time-of-flight measurements, such as those provided using UWB (ultra-wideband) communication. Alternatively or additionally, the second communication module 33 can be configured to cooperate with the fourth

communication module 39 installed in the protected object 3 to determine the distance 27 based on multi-carrier phase-based ranging, also referred to as multiple carrier phase difference.

[0055] The switch controller 6 can be configured to close the switch 35 when the distance 27 is less than a threshold distance and open the switch 35 when the distance 27 is more than a threshold distance. Closing the switch implies setting the switch in a conductive state and opening the switch implies setting the switch in a blocking state.

To close the switch, the switch controller 6 uses the third communication module 36 to communicate a closing signal to the first communication module 37 of the protective device 1, which closes the switch 35 upon receiving the closing signal. Analogously, to open the switch, the switch controller 6 uses the third communication module 36 to communicate an opening signal to the first communication module 37 of the protective device 1, which opens the switch 35 upon receiving the opening signal.

[0056] The threshold distances for opening and closing the switch can be the same. Alternatively, hysteresis is employed such that the threshold distance for opening is slightly shorter than the threshold distance for closing to avoid the switch opening and closing repetitively when the distance is at about the threshold. [0057] The third communication module 36 can be configured to communicate with the first communication module 37 to control the switch using an inductive signal. By using the inductive signal to control the switch, a simple implementation is provided, which is also difficult for an attacker to emulate, especially from afar. Alternatively or additionally, an IR signal can be used.

[0058] Fig 7 is schematic diagram illustrating an example when distance to the protected object is used as an input parameter for controlling the switch.

[0059] The user 5 carries a key fob and the switch controller, e.g. in a pocket or handbag. As described above, the second communication module 33 of the switch controller determines the distance 27 between the second communication module 33 of the switch controller and (the fourth communication module installed in) the protected object 3.

[0060] When the user is far away from the protected object 3 (a vehicle in this example), the switch controller communicates with the protection device installed in the key fob to open the switch, whereby the key fob is in an inactive state and cannot be used in a relay attack. When the user approaches the protected object 3 and is close enough, the switch controller communicates with the protection device installed in the key fob to close the switch, whereby the key fob is in an active state and is usable for passive access control, simplifying the process of the user gaining access to the vehicle. Significantly, the user does not need to perform any user input action for the protection against relay attacks. The protection is achieved based on the distance to the protected object 3.

[0061] Here now follows a list of embodiments from another perspective,

enumerated with roman numerals.

[0062] i. A protection device for being provided inside a key fob to selectively inactivate the key fob, the protection device comprising:

a first conductive layer;

a second conductive layer;

an insulator layer between the first conductive layer and the second conductive layer, the insulator layer preventing conductive contact between the first conductive layer and the second conductive layer; and

a switch conductively coupled between the first conductive layer and the second conductive layer, the switch being wirelessly controllable to be in a conductive state or a blocking state.

[0063] ii. The protection device according to embodiment i, wherein the switch is a reed switch.

[0064] iii. The protective device according to embodiment i, further comprising a wireless communication module connected to the switch, wherein the communication module is configured to receive commands to control the state of the switch.

[0065] iv. The protective device according to embodiment iii, wherein the wireless communication module supports communication using any one of Near Field

Communication, NFC, Bluetooth or Bluetooth Low Energy, BLE.

[0066] v. The protective device according to any one of the preceding

embodiments, wherein the protection device is configured to be provided between a pole of a battery of the key fob and a power connector of the key fob.

[0067] vi. The protective device according any one of the preceding embodiments, further comprising a battery, wherein the protective device being provided in contact with one pole of the battery and a corresponding power connector.

[0068] vii. A key fob comprising a battery and the protective device according to any one of the preceding embodiments, the protective device being provided in contact with one pole of the battery and a corresponding power connector.

[0069] The aspects of the present disclosure have mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the invention, as defined by the appended patent claims. Thus, while various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope and spirit being indicated by the following claims.