BACKGROUND OF THE INVENTION

The invention relates to a system for enhancing the security of a bi-directional data transmission used to control access to an enclosed space, of the type including an identification device, with a transmitting circuit and a receiving circuit, installed in the enclosed space, and an identifier carried by a user who wishes to gain access. A data interchange is established between the identification device and the identifier to confirm the identity of the user. This interchange is normally established when the distance between the identifier and the identification device is less than a predetermined limit, access being granted only when the identification device authenticates the identifier.

The invention has many potential applications, and appears to be particularly suitable for a system of enhanced access security to an automobile vehicle whose openings, notably the doors of the passenger compartment, include locks controlled by the access system.

DESCRIPTION OF THE PRIOR ART

In this type of system, to gain access the user must first start an identification operation. This operation can be triggered, for example, by pressing a control button on the access door, or by a remote control, or possibly by a presence sensor installed in the enclosed space.

Generally, this start of the identification operation necessitates that the user be in close proximity to the enclosed space to which he requires access.

The identification operation makes use of a data interchange between the identification device and the identifier constituted, for example, by a badge containing an electromagnetic transponder. When the operation is triggered, the identification device installed in the enclosed space generally emits an interrogation signal to activate the identifier which then returns a coded signal analyzed by the identification device. If the coded signal corresponds to the authorized code, the identification device grants access, for example by unlocking one or more locks. The signals interchanged are generally electromagnetic signals.

To improve the security, the system is designed to provide only a short transmission range such that an interchange of identification data between the identification device and identifier can normally be established only when the distance between the enclosed space and the identifier is less than a predetermined limit, for example a few tens of meters.

Despite these precautions, such an access system runs the risk of being pirated by another transmission-reception system interposed in the link between the identification device and the identifier, this pirate transmission-reception serving in fact only as a repeater.

For example, two pirates acting together could fraudulently gain access to the enclosed space as follows. A first pirate, equipped with a transmission-reception system installed for example in a bag approaches a vehicle closed by the authorized user who then walks away. The second pirate, equipped with a transmission-reception system similar that of his accomplice follows the user carrying the identifier. When the authorized user is sufficiently far away, the first pirate starts the identification operation, for example by pressing a control button on the door of the vehicle. The signals emitted by the identification device are relayed by the transmission-reception system of the first pirate to the system of the second pirate, that repeats the signals of the identification device to the identifier. Unknown to the authorized user, his identifier responds by emitting the authorized code which is relayed by the repeater system back to the identification device which then unlocks of the door thereby giving access to the first pirate.

SUMMARY OF THE INVENTION

The purpose of the invention is above all to provide a system that enhances the security of a bi-directional data transmission used to control access to an enclosed space, by preventing any violation by a pirate transmission-reception system such as described previously. The security system proposed is also reliable, easy to use, practical and inexpensive.

More precisely, the invention is a system providing enhanced security of a bi-directional data transmission controlling access to an enclosed space, notably access to a vehicle, including an identification device with a transmitting circuit and a receiving circuit installed in said enclosed space, and an identifier carried by a user wishing to gain access, a data interchange between said identification device and said identifier normally being established when the distance between them is less than a predetermined limit, the access being granted only when said identification device has authenticated said identifier, wherein, to prevent an interchange of identification data at a distance greater than said predetermined limit, notably by interposing an unauthorized repeater, the system includes means of switching that establish a momentary loopback of the transmitting circuit of the identification device, via a return circuit of said identifier, and said identification device includes means of measuring the resonance frequency of the oscillation generated by such a loopback, and means of control able to measure the difference between said resonance frequency and a reference frequency, so as to maintain access interdiction when this difference exceeds a predetermined value.

According to the invention, an oscillator is made between the identification device and the identifier. If a parasitic system, such as a repeater system, is interposed in the feedback loop the resonance frequency is modified; detection of this modification then enables the interdiction of access to be maintained.

Means of switching preferably establish, during an identification request, the momentary loopback of the transmitting circuit of the identification device, via a return circuit of the identifier, after the identification request has been authenticated by the identifier.

In a first embodiment, the identification device includes a receiving circuit with a radiofrequency (RF) receiver and a management unit with a frequency counter, and a transmitting circuit with a low frequency (LF) generator, an amplifier, and a switch able to connect the output of the RF receiver directly to the input of the amplifier, in order to establish the loopback, whereas in normal operation the input of this amplifier is connected to the output of the LF generator.

The identifier includes a LF receiver, notably with automatic gain control (AGC), a data decoding circuit, a management unit, an RF transmitter, and a switch able to connect the output of the LF receiver directly to the input of the RF transmitter, in order to establish the loopback, whereas in normal operation the input of the RF transmitter is connected to the management unit.

The momentary loopback is advantageously triggered by the emission of an initialization signal by the RF transmitter of the identifier, this signal initializing the counter of the management unit of the identification device.

The reference frequency with which the measured resonance frequency is compared is advantageously constituted by a value initially memorized which is learned by the system.

The LF transmitting circuit of the identification device is thereby looped back momentarily with the high frequency (RF) return circuit of the badge or identifier.

The LF communication frequency of the identification device to the identifier can be 125 kHz, and the transmitting and receiving antennas are tuned to this frequency, which obliges the system to oscillate around this frequency if the return channel is assumed to be linear and without phase shift at this frequency.

The return channel operates advantageously at radiofrequency, 434 MHz or other. The most suitable modulation for the return signal would appear to be frequency modulation to optimize the linearity. The RF transmission-reception system should preferably have a modulation band of at least 150 kHz.

The frequencies mentioned previously obviously constitute only one particular embodiment, since the system can operate at different frequencies.

In another simplified variant, the system is designed to transmit and receive signals of logical “all or nothing” type and to operate in “on/off” amplitude modulation.

The identification device includes an oscillator whose output is connected to a transmitting circuit and whose input is connected to a switch able to connect the output of a RF receiver directly to the input of the oscillator, in order to establish the loopback, whereas in normal operation the input of this oscillator is connected to the output of an operational amplifier whose non-inverter input is connected to ground via a resistor, and the inverter input is connected to ground via a capacitor, these two inputs being connected respectively via a resistor to the output of the RF receiver.

The identifier includes an envelope detector circuit whose input is connected to a LF receiving circuit and whose output is connected to a data decoding circuit and a management unit, and also to a switch able to connect the output of the envelope detector circuit directly to the input of a RF transmitter, in order to establish the loopback, whereas in normal operation the input of the RF transmitter is connected to the management unit.

The whole transmission-reception loop has a transit time which, associated with the time constant RC, where R and C are the respective values of the resistor and the capacitor connected to the inverter input of the operational amplifier, results in an oscillation at a specific frequency.

If relay transmitters (repeaters) are introduced in the loop, the transit time in the feedback loop will increase, lowering the oscillation frequency in proportion to the parasitic time delay introduced.

Therefore if the oscillation frequency of the system is measured, this can serve as a reference during each interrogation of the identifier.

To exit this oscillatory mode, it is sufficient to break the oscillation loop at the identifier, for example by the switch provided between the envelope detector and the RF transmitter, or in the identification device.

BRIEF DESCRIPTION OF THE DRAWINGS

Other characteristics and advantages of the invention will become evident on reading the description below of embodiments, which are non-limitative and taken only as examples, with reference to the attached drawings of which:

FIG. 1

is a block diagram of a first embodiment of a system according to the invention providing secure access to an enclosed space, in particular a vehicle;

FIG. 2

is a block diagram of a variant of embodiment of the system according to the invention.

DETAILED DESCRIPTION

FIG. 1

shows a diagram of an system S

1

for enhancing access security to a vehicle.

This system S

1

includes an identification device C

1

with a transmitting circuit E

1

and a receiving circuit R

1

. The device C

1

is installed in the vehicle.

The system S

1

also includes an identifier constituted by a badge B

1

carried by a user wishing to gain access to the vehicle.

The transmitting circuit El includes a LF generator

10

whose output is connected to one terminal

11

of a two-way switch

12

with a common terminal

13

connected to the input of an amplifier

14

. The output of this amplifier

14

is connected to an oscillator circuit constituted by a capacitor

15

and an inductance

16

in series, one terminal of the inductance

16

being connected to ground. The other terminal

17

of the switch

12

is connected to the output of a radiofrequency receiver

18

whose input is connected to the output of an antenna

19

.

The receiver

18

is preferably of frequency demodulation type.

The output of the receiver

18

is also connected to a management unit

20

with counter of the oscillation frequency produced. The management unit

20

includes a control output connected via a link

21

to the generator

10

. Another output of the unit

20

provides control of the switch

12

, via a link L.

This switch

12

can take two positions: a first position shown as a solid line in

FIG. 1

, in which terminal

13

is connected to terminal

17

, and a second position, shown as a dotted line, in which terminal

13

is connected to terminal

11

.

The identifier or badge B

1

includes an inductance

22

whose terminals are connected to a LF receiver

23

, preferably with automatic gain control (AGC). The output of the receiver

23

is connected to a terminal

24

of a two-way switch

25

that has a common terminal

26

and another terminal

27

.

This switch

25

can take two positions: a first position shown as a solid line in

FIG. 1

, in which terminal

26

is connected to terminal

24

, and a second position, shown as a dotted line, in which terminal

26

is connected to terminal

27

.

The output of the receiver

23

is also connected to an input of a data decoding circuit

28

. One output of this circuit

28

is connected to an input of a management unit

29

of micro-controller type. One terminal of this management unit

29

is connected to the terminal

27

of the switch

25

.

The common terminal

26

of the switch

25

is connected to the input of a RF transmitter

30

operating by frequency modulation (FM). The output of the transmitter

30

is connected to an antenna

31

.

The position of the switch

25

is controlled by the management unit

29

via a link L′ connected to an output of this unit

29

.

The operation is as follows:

The system is designed to provide an oscillator between the identification device C

1

mounted in the vehicle and the badge B

1

and to create the so-called “Larsen” effect.

An oscillator is by principle a feedback system which displays a phase condition of 0° at a certain frequency, with a gain of a few dB. When a person approaches the vehicle equipped with the system S

1

, this system is “awakened” by a control signal. This signal can be emitted in various ways: for example, when the person operates the door handle, a micro-switch associated with said handle moves to a position that makes the electrical power supply of the system S

1

; or the user could press a button on a remote control unit to send a control signal that is detected by the antenna

19

of the system S

1

of the vehicle; the control signal can be also emitted by inductive coupling when the user carrying his badge B

1

approaches the vehicle.

When the system S

1

is “awakened”, the management unit

20

activates the oscillator

10

so that it emits a coded identification signal to the badge B

1

. For the emission of this identification signal, the switch

12

is in its position shown by a dotted line in FIG.

1

. After the emission of this identification signal, the management unit

20

switches the switch

12

to its position shown by a solid line in

FIG. 1

, by means of the electric link L.

When the badge B

1

receives the low frequency identification signal from the system S

1

, the switch

25

is in its position represented shown by a dotted line in FIG.

1

. The coded identification signal is then received by the decoding circuit

28

which compares the identification code of the vehicle with that of the badge B

1

. If the codes match, the management unit

29

moves the switch

25

, by means of the electric link L′, to its position shown by a solid line in FIG.

1

. Simultaneously, the transmitter

30

of the badge B

1

emits one RF pulse (or more than one) of a duration of about 300 to 400 gs, that is received by the antenna

19

of the system S

1

. The pulse emitted by the transmitter

30

is used to initialize the counter of the management unit

20

. If there are several different authorized badges for the same vehicle and these badges all send the initialization pulse at the same time, the system can be designed such that the transmitter

30

of each badge emits a second pulse, with a different time delay for each badge, enabling the management unit

20

of the system S

1

to identify the different badges and assign an order of priority to them, in order to create the Larsen effect with a only one of the badges. If the Larsen effect were to be produced with several badges simultaneously there would be a risk of interference, notably radiofrequency beating, which would prevent recognition of the resonance frequency. For example, the badge of the driver of the vehicle may authorize him to control all its functions, whereas the badge of a passenger may not authorize starting of the engine. Another badge could be provided to give access to the vehicle but not the trunk (given for example to a garage mechanic who needs to work on the vehicle).

During emission of the RF pulse by the transmitter

30

, the two switches

12

and

25

are in their position shown by a solid line in

FIG. 1

, such that a momentary loopback of the LF transmitting circuit (125 kHz) of the vehicle to the badge B

1

is performed by the return circuit (radio frequency or high frequency) of the badge B

1

to the vehicle. The feedback causes in the device C

1

an oscillation whose resonance frequency is measured by the management unit

20

and is compared, by this management unit, with a reference value. This reference value can be initially memorized by means of a memory in the management unit

20

, and be therefore learned by the system, when the badge B

1

is situated at a distance from the device C

1

less than a predetermined limit. The reference resonance frequency is memorized in the management unit, for each authorized badge, at the time of first use, generally before the sale of the vehicle.

If a parasitic system is interposed in the feedback loop formed in this manner, with the intention of repeating and thereby enabling a loop to be established even though the badge B

1

is at a distance from the device C

1

exceeding the predetermined limit, the phase and therefore the resonance frequency will necessarily change.

By comparing this modified resonance frequency with the reference frequency, the management unit

20

can detect the presence of the parasitic system and maintain the access interdiction.

If, on the other hand, the frequency condition is satisfied, the management unit

20

then pursues the identification procedure and moves the switch

12

from the solid line position of

FIG. 1

to the dotted position to connect terminals

11

and

13

.

In the badge B

1

, the management unit

29

moves the switch

25

from the solid line position to the dotted position to connect terminals

26

and

27

and interrupt the feedback loop.

The device C

1

could use a communication frequency of 125 kHz to transmit to the badge B

1

, the transmitting and receiving antennas being tuned to this frequency, which obliges the system to oscillate around this frequency if the return channel is assumed to be linear and without phase shifting at this frequency.

The return channel

30

,

31

,

19

,

18

operates at radiofrequency, for example at 434 MHz, or at another frequency. Frequency modulation appears to be the most suitable, and is used to achieve the best linearity possible.

The duration of the Larsen loopback can be of the order of 4 ms.

This arrangement can of course apply to any frequency, the value given previously being only as a non-limitative example.

FIG. 2

illustrates a variant that is a simpler embodiment of the system S

1

according to the invention. Again we find the identification device C

1

installed in the vehicle with its transmitting circuit E

1

and its receiving circuit R

1

. On the user side we find the identifier or badge B

1

.

According to this variant, as in the previous case, an oscillator is constructed between the LF link and the RF link, which enables a possible violation by a pirate transmission-reception system to be detected by detecting a variation of the oscillation frequency of the feedback system.

The transmitting circuit E

1

includes a low frequency oscillator

32

, for example at 125 kHz, whose output is connected to an inductance

33

connected in series with a capacitor

34

and a resistor

35

, connected to another terminal of the oscillator

32

. The inductance

33

provides for a coupling with another inductance

36

on the badge B

1

, connected in parallel with a capacitor

37

.

The circuit R

1

includes a RF receiver

38

of which one input is connected to an antenna

39

. The output of the receiver

38

is connected by two resistors

40

,

41

in parallel that are connected respectively to the inverter input and the non-inverter input of an operational amplifier

42

. The output of the receiver

38

is also connected to the input of a management unit

50

. The output of the management unit

50

is connected to a terminal

51

of a two-way switch

52

that has a common terminal

53

connected to the input of the oscillator

32

. The other terminal

54

of the switch

52

is connected to the output of the operational amplifier

42

that feeds the oscillator

32

. The non-inverter input of the amplifier

42

is connected to ground via a resistor

43

, whereas the inverter input of the amplifier

42

is connected to ground via a capacitor

44

. The management unit

50

controls the position of the switch

52

via a link L shown as a dashed line.

In the badge B

1

, the inductance

36

and the capacitor

37

are connected in parallel to the two input terminals of an envelope detector circuit

45

. The output of the circuit

45

is connected to a terminal

55

of a two-way switch

46

that has a common terminal

56

and another terminal

57

. This switch

46

can take two positions, a first position shown as a solid line in

FIG. 2

, in which terminal

56

is connected to terminal

55

, and a second position shown as a dotted line in which terminal

56

is connected to terminal

57

.

The output of the circuit

45

is also connected to an input of a data decoding circuit

58

. One output of this circuit

58

is connected to an input of a micro-controller-type management unit

59

. One terminal of this management unit

59

is connected to the terminal

57

of the switch

46

.

The common terminal

56

of switch

46

is connected to the input of a RF transmitter

47

whose output is connected to an antenna

48

. The position of the switch

46

is controlled by the management unit

59

, via a link L′ connected to an output of this unit

59

.

The structure of the system in

FIG. 2

is that of an oscillator where the feedback is assured by the transmission-reception assembly. The simplification, compared with the previous embodiment, is that the signals transmitted and received are of logical “all or nothing” type, which enables operation in “on/off” amplitude modulation.

The operation is as follows:

When the device C

1

submits an identification request, the management unit

50

switches the switch

52

to its solid line position and the badge B

1

receives said identification request. The management unit

59

of the badge B

1

, after correct identification of the code, switches the switch

46

to its solid line position, to close the transmission-reception loop.

The signals emitted by the transmitter E

1

are analyzed by the envelope detector circuit

45

of the badge B

1

which outputs modulation signals of the transmitter

47

. The signals emitted by the transmitter

47

and the antenna

48

are picked up by the antenna

39

and the receiver

38

.

The whole transmission-reception loop has a transit time which, associated with the time constant RC, where R and C are the respective values of the resistor and the capacitor connected to the inverter input of the operational amplifier, results in an oscillation at a specific frequency.

The management unit

50

of the circuit C

1

measures this oscillation frequency and compares it with a determined value, as in the case of FIG.

1

.

If relay transmitters are interposed in the feedback loop formed by the device C

1

and the badge B

1

, the transit time in the loop will increase, lowering the oscillation frequency in proportion to the parasitic time delay introduced.

As in the case of

FIG. 1

, by measuring the oscillation frequency of the system and using it as a reference at each interrogation of the identifier B

1

, by comparison with a predetermined value, the presence of a relay transmitter-receiver acting as a repeater can be detected and access can be forbidden.

To exit this oscillatory mode, the feedback loop must be opened at the device C

1

or at the badge B

1

. In the example shown in

FIG. 2

, this can be assured by the switch

46

whose opening breaks the link between the output of the envelope detector

45

and the modulation control of the RF transmitter

30

, or by the switch

52

whose opening breaks the link between the output of the receiver

38

and the input of the oscillator

32

. In both cases, the opening stops the oscillation.

In both the embodiments described, the system proposed enables a bi-directional radiofrequency transmission to be made secure by detecting the presence of relay transmitters serving as repeaters between the identification circuit C

1

and the badge B

1

, thanks to the variation of the oscillation frequency of the feedback system. Access to the vehicle or to the enclosed space can then be forbidden when such relay transmitters are detected.