Two-way tire pressure monitoring system (TPMS) learning and authenticated pairing

Patent metadata

Field	Value
Publication number	US-12285979-B2
Application number	US-202318321341-A
Country	US
Kind code	B2
Filing date	May 22, 2023
Priority date	May 22, 2023
Publication date	Apr 29, 2025
Grant date	Apr 29, 2025

Abstract

Systems and methods for implementing two-way tire pressure monitoring system (TPMS) learning and authenticated pairing. A random value may be used to determine a test value and a pairing PIN by use of a HMAC (Hash-based Message Authentication Code) function and a pre-shared key that is accessible to a TPMS sensor and a vehicle (e.g., controller system thereof). The random value and test value may be broadcasted by the TPMS sensor and received by the vehicle. The vehicle may calculate the pairing PIN using the random value and the pre-shared key.

First claim

What is claimed is:

1. A tire pressure monitoring system (TPMS) sensor, comprising:
one or more processors and memory storing executable instructions that cause the TPMS sensor to:
determine a random value;
determine, based at least in part on the random value, an input value;
derive an output value based at least in part on the input value and a pre-shared secretkey that is also accessible to a vehicle;
determine, based at least in part on a first portion of the output value, a test value;
determine, based at least in part on a second portion of the output value, a pairing passcode (PIN);
broadcast at least one learning mode advertisement, comprising:
a Resolvable Private Addresses (RPA);
sensor data measured by the TPMS sensor;
the random value; and
the test value;

determine the TPMS sensor is connected to the vehicle;
perform a pairing process with the vehicle that includes authenticating the vehicle has access to the pairing PIN; and
contingent upon the pairing process successfully authenticating the vehicle:
establish a secure connection with the vehicle; and
receive an integrity key (IK) from the vehicle via the secure connection.

2. The TPMS sensor of claim 1 , wherein the executable instructions include further instructions that further cause the TPMS sensor to:
broadcast a TPMS advertisement, comprising:
a second RPA;
second sensor data measured by the TPMS sensor; and
a Message Authentication Code (MAC) determined based at least in part on the second sensor data and using the IK.

3. The TPMS sensor of claim 1 , wherein the input value comprises the random value and additional data.

4. The TPMS sensor of claim 1 , wherein the output value is derived using a HMAC (Hash-based Message Authentication Code) function.

5. The TPMS sensor of claim 1 , wherein the first portion and second portion are non-overlapping portions of the output value.

6. The TPMS sensor of claim 1 , wherein the pairing PIN is determined by at least truncating the output value to determine the second portion and applying a modulus operation on the second portion to produce the pairing PIN.

7. The TPMS sensor of claim 1 , wherein the at least one learning mode advertisement is broadcasted in plaintext.

8. A non-transitory computer-readable storage medium storing executable instructions that, as a result of being executed by one or more processors of a controller system of a vehicle, cause the controller system to at least:
receive one or more learning mode advertisements from a tire pressure monitoring system (TPMS) sensor, one of the one or more learning mode advertisement comprising:
a Resolvable Private Addresses (RPA);
sensor data measured by the TPMS sensor;
a random value; and
a test value;

determine, based at least in part on the sensor data, that the TPMS sensor is likely to be attached to the vehicle;
determine, using the random value and a pre-shared key that is also accessible to the TPMS sensor, a calculated test value;
determine that the calculated test value matches the test value received from the TPMS sensor;
determine, using the random value and the pre-shared key, a pairing passcode (PIN);
perform a pairing process with the TPMS sensor using the pairing PIN;
establish a secure connection with the TPMS sensor; and
provide an integrity key (IK) to the TPMS sensor via the secure connection.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the executable instructions further cause the controller system to:
receive a TPMS advertisement, comprising:
a second RPA;
second sensor data measured by the TPMS sensor; and
a Message Authentication Code (MAC);

determine a calculated MAC based at least in part on the second sensor data and using the IK; and
determine the TPMS advertisement is authentic based at least in part on the calculated MAC matching the MAC received in the TPMS advertisement.

10. The non-transitory computer-readable storage medium of claim 8 , wherein the calculated test value is determined by at least:
determining an input value based at least in part on the random value;
using a HMAC function to calculate an output value based at least in part on the input value and the pre-shared key; and
extracting the test value from at least a first portion of the output value.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the pairing PIN is determined based at least in part on a second portion of the output value.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the first portion and the second portion are non-overlapping.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the one or more learning mode advertisements are received using Bluetooth Low Energy (BLE).

14. A method, comprising:
determining, by a tire pressure monitoring system (TPMS) sensor, a random value;
deriving, by the TPMS sensor, a pairing passcode (PIN) and a test value based at least in part on the random value and a pre-shared key;
transmitting, by the TPMS sensor, one or more learning mode advertisements that comprise first sensor data, the random value, and the test value;
determining, by a controller system of a vehicle, that the TPMS sensor is an attached candidate sensor;
determining, by the controller system of the vehicle, the pairing PIN using the random value, the test value, and the pre-shared key;
performing an authenticated pairing process between the controller system and the TPMS sensor;
establishing a secure connection between the controller system and the TPMS sensor; and
exchanging an integrity key (IK) and identity resolving keys (IRK) between the controller system and the TPMS sensor.

15. The method of claim 14 , further comprising:
transmitting, by the TPMS sensor, one or more TPMS advertisements that comprise second sensor data and a Message Authentication Codes (MAC) based at least in part on the second sensor data; and
determining, by the controller system of the vehicle, authenticity and integrity of the one or more TPMS advertisements.

16. The method of claim 15 , wherein:
each of the one or more learning mode advertisements comprises a first resolvable private address (RPA); and
each of the one or more TPMS advertisements comprises a second RPA.

17. The method of claim 16 , further comprising:
changing the second RPA to a third RPA; and
using the IRK to resolve the third RPA.

18. The method of claim 14 , wherein deriving the pairing PIN and the test value comprises:
generating an HMAC (Hash-based Message Authentication Code) output using the random value and the pre-shared key;
determining a first portion of the random value to be the test value;
truncating a second portion of the random value to produce a truncated HMAC output; and
performing a modulus operation on the truncated HMAC output to produce the pairing PIN.

19. The method of claim 18 , wherein the first portion and the second portion are non-overlapping portions of the HMAC output.

20. The method of claim 14 , wherein the one or more learning mode advertisements are transmitted in plaintext.

Assignees

• Ford Global Tech Llc

Inventors

• Schubert Jochen
• Patel Dilip B
• Rushing Arick Evan

Classifications

• H04W76/14 Primary

  Direct-mode setup · CPC title

• H04W12/0471

  Key exchange · CPC title

• B60C23/0462

  Structure of transmission protocol · CPC title

• H04W12/106

  Packet or message integrity · CPC title

• H04W12/06

  Authentication · CPC title