Discussing Vehicle Keyless Entry Systems

The mechanical lock structure of vehicles was invented in the 1990s. With iterative advancements and enhanced protection for areas such as the interior, engine compartment, and ignition system, the entire system has become more complex. It eventually evolved into a mechanical key managing all mechanical locks on the vehicle, including doors, trunk, ignition system, and hood.

In the 1980s, wireless key technology was already developed. Over the past 40 years, the usage scenarios for wireless keys have expanded. This technology utilizes numerous wireless transmitters and receivers on the vehicle to communicate wirelessly with user devices.

With iterative advancements, integration of different authentication systems, and the evolution of wireless security technology, both functionality and system complexity steadily increased. The evolution path includes Remote Keyless Entry (RKE) -> Passive Entry System (PES) -> Passive Entry and Passive Start (PEPS).

The initial implementation was the basic Remote Keyless Entry (RKE) system, a unidirectional electronic lock that controls the opening and closing of vehicle doors without using a traditional mechanical key. However, it still had vulnerabilities such as same-frequency interference and signal copying.

In subsequent versions of the system, remote wireless control of windows became possible, adding an important security aspect. By locking the doors with a remote key, the windows and sunroof would also automatically close.

Remote Keyless Entry (RKE):

RKE is a unidirectional electronic lock that allows control of vehicle door locking and unlocking without using a traditional mechanical key. The term "keyless entry" originally referred to locks that could be unlocked by entering a predefined numeric code via a keypad located on or near the vehicle door. Compared to mechanical keys, keyless entry is relatively convenient and enhances vehicle security. However, it still has risks such as same-frequency interference and signal copying.

In subsequent versions of the system, the remote wireless control of windows became possible, adding an important security aspect. By locking the doors with a remote key, the windows and sunroof would also automatically close.

Passive Entry System (PES):

Passive Entry System (PES) is an upgraded version of the Remote Keyless Entry (RKE) system. This feature allows the driver to lock and unlock the doors without pressing any buttons on the remote key. By simply having the key in a pocket or wallet, approaching the door, and touching the door handle, unlocking is completed. The principle involves a touch sensor inside the door handle that discharges the capacitor, waking up the entry and start permission control unit.

The key and the door handle both have antennas. From a distance of several dozen meters, the key continuously sends unlock signals. When the vehicle's unlock device receives the signal and completes authentication according to a specific protocol, the doors automatically unlock.

Passive Entry and Passive Start (PEPS):

PEPS is a widely used wireless communication system that allows the driver to access the car, unlocking it and starting the engine without physically using the key. The system uses radio frequency signals to verify the key between the vehicle and the key. PEPS systems use radio waves in the low-frequency range, typically 125 kHz or 134 kHz, and radio waves in the ultra-high frequency (UHF) range, usually below 1 GHz, to exchange unique access codes between the key and the vehicle in two-way communication. Once the exchanged code matches the expected value and the key is very close to the car, the doors unlock.

The system also measures the distance between the car and the key, determining whether the key is inside or outside the vehicle. This information can be used to provide different types of access permissions for the driver. For example, if the key is outside the car, only entry permission is granted, and the engine start function will not work.

The main components of the PEPS system include the remote key, antenna, Body Control Module (BCM), one-button start switch, and core technologies such as RFID recognition technology, encryption algorithms, and EMC technology.

PEPS includes two main functions: keyless entry and keyless start.

**Keyless Entry:**

When the driver touches the door handle, the internal unlock sensor discharges the capacitor, waking up the entry and start permission control unit. After waking up, the controller performs two actions: first, it wakes up the vehicle's power grid control unit and starts the keyless entry and one-key start control functions through a dedicated harness. Second, it sends out low-frequency information through a low-frequency antenna. The key is awakened by the low-frequency signal within a 1.5m range of the vehicle, receives the information, and performs initial verification. If legal, it encrypts the ID code in a rolling form and sends out a high-frequency signal. The vehicle power grid control unit receives and processes the information through an internally integrated high-frequency antenna, starts the ID verification process, and if consistent, wakes up a specific CAN. Then, it transmits the ID to the entry and start permission control unit for verification. If the ID matches the internally stored value, the entry and start permission control unit sends a confirmation message of consistent ID to the vehicle power grid control unit, which issues the door unlock command. Simultaneously, it controls the flashing of turn signals, provides power to the door lock motor upon receiving the signal from the door module, and unfolds the rearview mirror, among other actions.

**One-Key Start:**

After the driver presses the start button, one of the pins on the entry and start permission control unit is pulled low, waking up the specific CAN link and sending a power-on request to the electronic anti-theft unit. Upon receiving the request, the electronic anti-theft unit sends out a key location and electronic anti-theft code query command. The entry and start permission control unit wakes up the vehicle power grid control unit, instructing it to execute the one-key start function. It then sends a low-frequency signal to the key requesting the basic anti-theft code. The key responds upon receiving the request, and the vehicle power grid control unit begins verification. If consistent, it powers the EPS and notifies the entry and start permission control unit to send a power-on command.

As technology develops, Ultra-Wideband (UWB) is introduced in PEPS systems to address relay attacks (where attackers amplify the signal to make the car and key believe the owner is nearby, enabling unlocking operations). UWB offers advantages such as insensitivity to channel fading, low transmit signal power spectral density, low interception rate, low system complexity, and provides centimeter-level positioning accuracy.

Furthermore, with smartphones being able to connect to vehicles through custom interfaces, the natural progression of digital keys is becoming a reality. The next generation of vehicle access systems is moving towards virtual keys. Key as a Service (KaaS) allows automakers to provide access permissions to drivers through smartphones. Automakers also use flexible digital management and Over-The-Air (OTA) key issuance, making it easier for fleet managers and users to manage keys.