Remote keyless system
A smart entry system is an electronic lock that controls access to a building or vehicle without using a traditional mechanical key. The term keyless entry system originally meant a lock controlled by a keypad located at or near the driver's door, which required entering a predetermined (or self-programmed) numeric code. Such systems now have a hidden touch-activated keypad and are still available on certain Ford and Lincoln models.
The term remote keyless system (RKS), also called keyless entry or remote central locking, refers to a lock that uses an electronic remote control as a key which is activated by a handheld device or automatically by proximity.
Widely used in automobiles, an RKS performs the functions of a standard car key without physical contact. When within a few yards of the car, pressing a button on the remote can lock or unlock the doors, and may perform other functions. A remote keyless system can include both a remote keyless entry system (RKE), which unlocks the doors, and a remote keyless ignition system (RKI), which starts the engine.
One of the first introductions was in 1980 on the Ford Thunderbird, Mercury Cougar, Continental Mark VI, and Lincoln Town Car, which Ford called Keyless Entry System (later renamed SecuriCode). It was a keypad on the driver-side exterior door above the door handle. It consisted of a keypad with five buttons that when the code was entered, would unlock the driver's door, with subsequent code entries to unlock all doors, and the trunk. Nissan offered the same technology on the Nissan Maxima and Nissan Fairlady beginning in 1984, essentially using the same approach as Ford, with the addition of being able to roll the windows down and open the optional moonroof from outside the vehicle on the door handle installed keypad on both the driver's and front passengers door.
The remote keyless systems using a handheld transmitter first began appearing on the French made Renault Fuego in 1982, and as an option on several American Motors vehicles in 1983, including the Renault Alliance. The feature gained its first widespread availability in the U.S. on several General Motors vehicles in 1989.
Keyless remotes contain a short-range radio transmitter, and must be within a certain range, usually 5–20 meters, of the car to work. When a button is pushed, it sends a coded signal by radio waves to a receiver unit in the car, which locks or unlocks the door. Most RKEs operate at a frequency of 315 MHz for North America-made cars and at 433.92 MHz for European, Japanese and Asian cars. Modern systems since the mid-1990s implement encryption as well as rotating entry codes to prevent car thieves from intercepting and spoofing the signal. Earlier systems used infrared instead of radio signals to unlock the vehicle, such as systems found on Mercedes-Benz, BMW and other manufacturers.
The system signals that it has either locked or unlocked the car usually through some fairly discreet combination of flashing vehicle lamps, a distinctive sound other than the horn, or some usage of the horn itself. A typical setup on cars is to have the horn or other sound chirp twice to signify that the car has been unlocked, and chirp once to indicate the car has been locked. For example, Toyota, Scion, and Lexus use a chirp system to signify the car being locked/unlocked. While two beeps means that driver's door is unlocked, four beeps means all doors are unlocked. One long beep is for the trunk or power tailgate. One short beep signifies that the car is locked and alarm is set.
The functions of a remote keyless entry system are contained on a key fob or built into the ignition key handle itself. Buttons are dedicated to locking or unlocking the doors and opening the trunk or tailgate. On some minivans, the power sliding doors can be opened/closed remotely. Some cars will also close any open windows and roof when remotely locking the car. Some remote keyless fobs also feature a red panic button which activates the car alarm as a standard feature. Further adding to the convenience, some cars' engines with remote keyless ignition systems can be started by the push of a button on the key fob (useful in cold weather), and convertible tops can be raised and lowered from outside the vehicle while it's parked.
On cars where the trunk release is electronically operated, it can be triggered to open by a button on the remote. Conventionally, the trunk springs open with the help of hydraulic struts or torsion springs, and thereafter must be lowered manually. Premium models, such as SUVs and estates with tailgates, may have a motorized assist that can both open and close the tailgate for easy access and remote operation.
For offices, or residences, the system can also be coupled with the security system, garage door opener or remotely activated lighting devices.
Most keyless systems use a technique called rolling code to avoid replay attacks, in which the open command is intercepted to be used by a thief at a later time. In the rolling code, a pseudorandom number generator is used to generate a different unlock sequence to be sent each time the car is unlocked.
Remote keyless entry fobs emit a radio frequency with a designated, distinct digital identity code. Inasmuch as "programming" fobs is a proprietary technical process, it is typically performed by the automobile manufacturer. In general, the procedure is to put the car computer in 'programming mode'. This usually entails engaging the power in the car several times while holding a button or lever. It may also include opening doors, or removing fuses. The procedure varies amongst various makes, models, and years. Once in 'programming mode' one or more of the fob buttons is depressed to send the digital identity code to the car's onboard computer. The computer saves the code and the car is then taken out of programming mode.
As RKS fobs have become more prevalent in the automobile industry a secondary market of unprogrammed devices has sprung up. Some websites sell steps to program fobs for individual models of cars as well as accessory kits to remotely activate other car devices.
On early (1998-2012) keyless entry remotes, the remotes can be individually programmed by the user, by pressing a button on the remote, and starting the vehicle. However, newer (2013+) keyless entry remotes require dealership or locksmith programming via a computer with special software . The Infrared keyless entry systems offered user programming, though radio frequency keyless entry systems mostly require dealer programming.
Today, this system is commonly found on a variety of vehicles, and although the exact method of operation differs between makes and models, their operation is generally similar: a vehicle can be unlocked without the driver needing to physically push a button on the key fob to lock or unlock the car and is also able to start or stop the ignition without physically having to insert the key and turning the ignition. Instead, the vehicle senses that the key (which may be located in the user's pocket, purse, etc.) is approaching the vehicle.
A simpler version of the smart key system is the engine immobiliser, involving a security key system embedded into most modern vehicle's keys. A small chip rests on the vehicle's key or under the plastic key cover. When any key is inserted into the ignition, the ignition is coded. The key sends its security code to the ignition, which also has its own security code, and if the security codes match, the vehicle will start when the key is turned. However, if the key codes do NOT match, the vehicle will NOT start when the key is turned. Some early examples of this technology include Chrysler Corporation's Sentry Key System, or General Motors's PASSKey System.
Some security keys can be programmed by the user, though most of these keys have to be programmed by a dealership or locksmith via a computer. It was not possible to copy these keys at a hardware store or auto parts store, but nowadays it is.
Keyless ignition does not by default provide better security. In October 2014, it was found that some insurers in the United Kingdom would not insure certain vehicles with keyless ignition unless there were additional mechanical locks in place due to weaknesses in the keyless system.
News media have reported cases where it is suspected that criminals managed to open cars by using signal boosters to trick vehicles into thinking that their keyless entry fobs were close by even when they were far away, though they have not reported that any such devices have been found. The articles speculate that keeping fobs in aluminum foil or a freezer when not in use can prevent criminals from exploiting this vulnerability.
In 2015, it was reported that Samy Kamkar had built an inexpensive electronic device about the size of a wallet that could be concealed on or near a locked vehicle to capture a single keyless entry code to be used at a later time to unlock the vehicle. The device transmits a jamming signal to block the vehicle's reception of rolling code signals from the owner's fob, while recording these signals from both of his two attempts needed to unlock the vehicle. The recorded first code is sent to the vehicle only when the owner makes the second attempt, while the recorded second code is retained for future use. Kamkar stated that this vulnerability had been widely known for years to be present in many vehicle types but was previously undemonstrated. A demonstration was done during DEF CON 23.
Actual thefts targeting luxury cars based on the above exploit have been reported when the key fob is near the front of the home. Several workaround can prevent such exploits, including placing the key fob in a tin box. A criminal ring stole about 100 vehicles using this technique in Southern and Eastern Ontario.
- Job, Ann. "Driving Without Car Keys". MSN Autos. Archived from the original on 9 May 2012. Retrieved 27 February 2012.
- "1980-1985 RENAULT Fuego Turbo". Octane. Archived from the original on 27 October 2012. Retrieved 27 February 2012.
- Lake, Matt (2001-06-07). "HOW IT WORKS; Remote Keyless Entry: Staying a Step Ahead of Car Thieves". The New York Times. ISSN 0362-4331. Retrieved 2017-02-10.
- infrared-keyless-entry, benzworld.org.
- "Archived copy of post to BMW forum". Archived from the original on 2013-11-09. Retrieved 2012-06-29.
- Brain, M., "How Remote Entry Works", HowStuffWorks Auto Auto Basics. Retrieved July 8, 2018.
- Steinberg, Joseph (May 12, 2015). "Vulnerability In Car Keyless Entry Systems Allows Anyone To Open And Steal Your Vehicle". Forbes.
- Thompson, Cadie (2015-08-06). "A hacker made a $30 gadget that can unlock many cars that have keyless entry". Tech Insider. Retrieved 2015-08-11.
- Kamkar, Samy (2015-08-07). "Drive It Like You Hacked It: New Attacks and Tools to Wirelessly Steal Cars". DEF CON 23. Retrieved 2015-08-11.
- "3 solutions to electronic car theft, a continuing threat to high-end Toronto automobiles". CBC.
- "Toyota, Lexus owners warned about thefts that use 'relay attacks'". CBC.
- "20 charged in high-end vehicle thefts in Ontario". CBC.
|Wikimedia Commons has media related to Automobile keys.|
- Article about how keyless entry remote systems on automobiles work
- Requirements of Remote Keyless Entry (RKE) Systems
- False warning about RKE code thieves at Snopes.com
- Why A Keyless Entry Remote Transmitter Is Called A Fob Or Keyfob?
- Guide for Choosing the Right Replacement Car Remote
- Car Key Fob Programming Instructions