Example Applications - RFID: Fundamentals and Applications in Contactless Smart Cards and Identification - page 362

remote control devices with a range of 5-20 m had already been available on the
market for years. These are small infrared or RF transmitters operating on the UHF
frequency 433.92MHz, which are primarily used to control the central locking system
and an integral alarm. An (electronic) immobiliser may also be coupled to the remote
control function. In this type of anti-theft device, however, the mechanical lock can
still be used to gain access to the vehicle — in case the remote control device fails to
work due to the failure of the battery in the transmitter. This is the greatest weakness
of this type of system, as the system cannot check whether the mechanical key is
genuine. Vehicles secured in this manner can therefore be opened with a suitable tool
(e.g. picklock) and started up by an unauthorised person.
Since the middle of the 1990s, transponder technology has provided a solution that
can be used to check the authenticity, i.e. the genuineness, of the key. This solution has
proved ideal for the realisation of the electronic immobilisation function via the ignition
lock. Today, transponder technology is usually combined with the above-mentioned
remote control system: the remote control operates the vehicle's central locking and
alarm system, while transponder technology performs the immobilisation function.

13.7.1 The functionality of an immobilisation system

In an electronic immobilisation system a mechanical ignition key is combined with a
transponder. The miniature transponder with a ferrite antenna is incorporated directly
into the top of the key (see Figure 13.34). The antenna is integrated into the ignition
lock (Figure 13.35).
The reader antenna is integrated into the ignition lock in such a manner that when the
ignition key is inserted, the (inductive) coupling between reader antenna and transpon-
der coil is optimised. The transponder is supplied with energy via the inductive coupling
and is therefore totally maintenance free. Electronic immobilisers typically operate at a
transmission frequency in the LF range 100-135 kHz. ASK modulation is the preferred
modulation procedure for the data transfer to the transponder, because it allows reader
and transponder to be manufactured very cheaply (Doerfler, 1994). Load modulation
is the only procedure used for data transmission from the transponder to the reader.
When the ignition key is turned in the ignition lock to start the vehicle, the reader
is activated and data is exchanged with the transponder in the ignition key. Three
procedures are employed to check the authenticity of the key:

• Checking of an individual serial number. In almost all transponder systems the

transponder has a simple individual serial number (unique number). If the normal
number of binary positions is used, significantly more different codes are available
than worldwide car production (2 32 = 2 . 8 × 10 14 ). Very simple

systems (first generation immobilisation) read the transponder's serial number and
compare this with a reference number stored in the reader. If the two numbers
are identical the motor electronics are released. The problem here is the fact that
the transponder serial number is not protected against unauthorised reading and,
in theory, this serial number could be read by an attacker and copied to a special
transponder with a writable serial number.

= 4 . 3 billion, 2 48

•

Rolling code procedure. Every time the key is operated a new number is written
to the key transponder's memory. This number is generated by a pseudo-random