Keyless Go

from Wikipedia, the free encyclopedia

Keyless Go describes a system for unlocking a vehicle without actively using a car key (ie "keyless", in English "keyless") and to start it by simply pressing the start button. This is made possible by a keyless go key with a chip that the vehicle driver carries with him. "KEYLESS GO" is a registered word mark of Daimler AG . There are comparable solutions under different brands from all vehicle manufacturers.

functionality

Individual hardware blocks in the keyless entry / go control unit

As soon as a hand approaches the door handle of a vehicle equipped with Keyless Go within a few centimeters, the system is woken up from the so-called "sleep mode" with the help of an on-board capacitive or optical proximity sensor that is always active and a coded request signal is sent via several antennas distributed in the vehicle transmitted with an LF frequency of 125 or 130 kHz ( Audi : 20 kHz). The on-board system then goes into a reception mode in the UHF range (Europe: 433 MHz or 868 MHz , Japan and USA: 315 MHz) and waits for confirmation. Is the key with the RFID - transponder in range, it receives on the 125 kHz signal, decodes it and sends it active, powered by a battery, with a new coding in the UHF frequency band again. A control unit in the vehicle decodes it. Since the Keyless Go control unit knows both coding tables, it can compare its own original transmission with the signal just received. If there is no correct answer within a defined time, nothing happens and the system switches back to standby . Pulling the door handle has no effect as the state of the door lock was not changed by the Keyless Go system. However, if both codes match, authentication is carried out , the on-board system releases the lock and pulling the handle unlocks the door. Alternatively, the vehicle can also be opened with the remote control. There is also a mechanical emergency key with which at least the driver's door can be opened. A vehicle key for a keyless go vehicle therefore consists of the mechanical key, the battery-powered remote control, an RFID transponder and a battery . In current vehicles, the electronic key is designed both as a remote control and as a transponder; a mechanical emergency key is only used to attach it to the key ring.

The engine start process essentially corresponds to that of the door unlocking process, except that the engine start / stop button is pressed here. It is crucial for the function that the Keyless Go control unit has recognized the transponder as being in the vehicle. In the development phase, the internal-external demarcation is one of the most difficult undertakings. The end user should be able to store the key anywhere inside the vehicle, with the key always having to be recognized inside. In addition, it must be ensured that the key is recognized as outside everywhere outside the vehicle and that the range does not increase too much.

If the owner so wishes, the vehicle locks automatically as soon as the transponder is out of a certain range. The ranges achieved are low in accordance with the conditions specified in the vehicle for size, position, power consumption of antennas and electronics as well as permissible transmission energy. This effect is expressly desired for safety reasons. This operating scenario is the most controversial function in keyless go systems; the automatic locking can therefore be switched off or is not offered by many manufacturers.

In many vehicles (e.g. Mercedes-Benz S-Class , Toyota Prius , Toyota Yaris HSD , VW Phaeton ) a small button or sensor located on the outside of the door handle must be pressed to lock the vehicle. As with the usual locking, a turn signal confirms that the locking process has been triggered manually.

special cases

Keyless Go should be able to recognize special cases and react accordingly. Standard examples are:

  • The transponder is in the trunk
  • There are several transponders in the vehicle
  • Transponder is lost while driving
  • Transponder battery empty ( limp home )
  • Open the door from the outside after an accident
  • Extremely fast pulling of the door handle (outsmarting the proximity detection)
  • Subsequent recoding of the transponder after loss or theft
  • The user checks whether the doors are actually locked automatically (as soon as a vehicle has been locked as required, checking the locking by pulling the door handle would have exactly the opposite effect: the vehicle would automatically unlock immediately. Renault therefore has a time window of three seconds after locking, in order to check without unlocking. If a user wants to check the desired automatic locking by observation, he is inevitably too close to the vehicle: the system would not activate the automatic locking.)

Problem cases

It is extremely important that the vehicle cannot be started if the Keyless Go key is outside the vehicle. A maximum overlap of 10 cm (measured on the side window / front window) between the detected inner and outer areas was defined, i.e. H. above 10 cm the key is either definitely inside or outside, below 10 cm ("gray area") the position detection of the transponder key may be incorrect. This ensures that in everyday situations the driver (provided he has the transponder with him) z. B. refuel his vehicle and the child sitting in the interior cannot start the engine. However, this is prevented if the car's engine can only be switched on with the footbrake depressed (with automatic transmission) and / or the clutch (with manual transmission) (e.g. VW Golf VI , Audi A4 B8 ).

The range of the LF antennas used with the Keyless Go is limited. Depending on the vehicle interior, it can happen that the keyless system detects the transponder as "not in the vehicle", although it is actually there. In the same way, for example in the case of a convertible , it can be detected as being in the vehicle, even though it is on the roof. This “blind spot” phenomenon is indirectly explained from the previous section: A keyless system is usually optimized for its behavior in the border area on the side windows (or windshield) and of course the “everyday positions” during normal driving. Due to economic cost / benefit assessments, perfect detection in the "border area" is dispensed with. The LF frequencies emitted by the control unit are strongly reflected and / or absorbed, particularly when the vehicle is loaded with unusual loads (load with a high proportion of metal volume), so that incorrect detections may occur here.

safety

According to security experts and the ADAC, the keyless go system is absolutely unsafe against radio or car thieves with radio eavesdropping technology. In tests by the ADAC with 20 vehicle models, the block could be overcome by listening in on the codes by strangers.

This is due to the radio unit code of the car key, which often does not separate the opening code from the locking code, whereby this would be an effective measure against car thieves, especially since the car could not be stolen only with the tapped locking code.

With special Keyless-Go radio keys, the signal is sent continuously. Radio signal thieves can extend all active signals, whether from the car itself or from the key, with their own transmitter. The signals can even be intercepted through walls and transmitted up to 400 meters.

In addition, a suitable jammer can prevent the car from being locked, which makes it even easier for a thief to get into the car. Whereby the solution is still trivial and the driver only has to acknowledge the closing command of the vehicle - nowadays usually a noise from the central locking or the display from the indicators.

technical structure

Due to the limited permissible transmission power, the range is 13.56 MHz at 0.3 m, at 125 kHz only at a maximum of 2 m and at 433 MHz at a few tens of meters. Greater ranges are possible with an active response from the key at 866 MHz.

Vehicle theft

An obvious idea for vehicle thieves is therefore to increase the range of the Keyless Go to the required level with the help of two relay stations for their purposes . This scenario is called "relay station attack" RSA .

Large variant of the RSA

An attacker with the first relay station is in the vicinity of the vehicle and a second attacker with a second relay station in the immediate vicinity of the rightful transponder owner. The attack would therefore take place in such a way that the large spatial distance between the rightful owner and the vehicle would be electronically reduced with the help of relay station technology. Both the keyless go control unit in the vehicle and the transponder near its owner would be led to believe that the environment is normal.

Small variant of the RSA

As above, with the difference that the 433 MHz UHF return channel of the transponder is not converted via the relay station, but received directly by the vehicle. As a result, the maximum range of the attack is reduced to a few 10 meters, while with the large variant it could theoretically be almost any size. The advantage (for the car thief) is the lower technical effort.

communication

Keyless Go communicates with other devices to enable or disable their functions. Depending on the vehicle type, the following systems are available (not all combinations are useful, therefore only a loose list is given here):

Other product names

There are other product names for Keyless Go. Here is a selection of the best known in German-speaking countries:

Keyless Entry or Keyless Go should not be confused with Remote Keyless Entry , which is the English-language term for a radio remote control .

history

First keyless entry / go control unit of the 1999 series for the Mercedes-Benz S-Class

Keyless Go was developed and first introduced into series production in April 1999 by Mercedes-Benz and Siemens VDO in the S-Class models .

outlook

The design goals of the various automobile manufacturers are never uniform. Here is a loose list of some of the different tendencies in series (S) and pre-development (V).

  • S: Decentralization of some assemblies for better scaling, i.e. H. Assemblies can be used in both Keyless Go vehicles and those without Keyless Go. For example, the same decentralized UHF receiver can be used without modification in the basic model without Keyless Go as well as in the model with Keyless Go special equipment.
  • S: Reduction of the number of antennas used in order to be able to equip small cars with a keyless go system with little loss of comfort.
  • V: Use of biometric procedures for authentication (security and personalization).
  • V: Communication between the transponder and the keyless control unit takes place via frequencies in the microwave range. Similar to the physics of radar systems , an exact distance measurement between the transponder and the vehicle would result in a comfort control of the system, e.g. B. definable zones around the vehicle. (Since radio and radar waves travel at the speed of light at around 300,000 km / s, evaluation electronics that wanted to detect a 1 meter delay time difference would have to have a resolution of around 3.3 nanoseconds . On the other hand, it must not be caused by naturally caused delay times, e.g. B. Let reflections on a metal garage door have a negative influence.)
  • V: Replacement of the magnetic antennae by capacitive surface radiators, which use the effect of the electric field (cost minimization).

literature

  • Schmitz / Roser (Bosch): A New State-of-the-Art Keyless Entry System . SAE Papers, Stuttgart 1998, SAE 980381 .
  • Schmitz / Kruppa / Crowhurst (Bosch): Safety and Security Considerations of New Closure Systems . SAE papers, Wuppertal / Stuttgart / Clayton (AUS) 2000, SAE 2000-01-1304 .

Individual evidence

  1. ↑ Information on the Keyless Go brand  in the register of the German Patent and Trademark Office (DPMA)
  2. ↑ Car theft. Keyless Go and the car is gone - car theft has never been so easy. In: Stern. July 3, 2018 ( stern.de ).
  3. ↑ Archived copy ( Memento from June 18, 2016 in the Internet Archive )
  4. ↑ spiegel.de August 5, 2019: Car thieves have an easy time with Keyless-Go
  5. ↑ Car theft in seconds: Keyless - go car. In: Spiegel Online Video. Retrieved June 9, 2018 .