Nothing Special   »   [go: up one dir, main page]

CN116193444A - Relay attack vulnerability detection method based on automobile keyless function - Google Patents

Relay attack vulnerability detection method based on automobile keyless function Download PDF

Info

Publication number
CN116193444A
CN116193444A CN202310080581.3A CN202310080581A CN116193444A CN 116193444 A CN116193444 A CN 116193444A CN 202310080581 A CN202310080581 A CN 202310080581A CN 116193444 A CN116193444 A CN 116193444A
Authority
CN
China
Prior art keywords
signal
low
automobile
frequency
frequency modulation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310080581.3A
Other languages
Chinese (zh)
Inventor
龚思禄
尹兴亮
赵焕宇
黄俊良
李俊玲
宋雪冬
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Guangdong Weichen Information Technology Co ltd
Original Assignee
Guangdong Weichen Information Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Guangdong Weichen Information Technology Co ltd filed Critical Guangdong Weichen Information Technology Co ltd
Priority to CN202310080581.3A priority Critical patent/CN116193444A/en
Publication of CN116193444A publication Critical patent/CN116193444A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12Detection or prevention of fraud
    • H04W12/121Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L27/00Modulated-carrier systems
    • H04L27/02Amplitude-modulated carrier systems, e.g. using on-off keying; Single sideband or vestigial sideband modulation
    • H04L27/04Modulator circuits; Transmitter circuits
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L27/00Modulated-carrier systems
    • H04L27/10Frequency-modulated carrier systems, i.e. using frequency-shift keying
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433Vulnerability analysis
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W24/00Supervisory, monitoring or testing arrangements
    • H04W24/08Testing, supervising or monitoring using real traffic
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02DCLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00Reducing energy consumption in communication networks
    • Y02D30/70Reducing energy consumption in communication networks in wireless communication networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Lock And Its Accessories (AREA)

Abstract

The invention relates to the technical field of automobile keyless functions, in particular to a relay attack vulnerability detection method based on an automobile keyless function, which comprises the following steps: s1: triggering the keyless function of the automobile to generate a low-frequency request signal; s2: the receiving end captures a low-frequency request signal and demodulates the low-frequency request signal to obtain original data; s3: the receiving end carries out high-frequency modulation on the original data and transmits a high-frequency modulation signal to the surrounding environment; s4: the transmitting end captures the high-frequency modulation signal and demodulates the high-frequency modulation signal to obtain original data; s5: the transmitting end carries out low-frequency modulation on the original data and broadcasts the low-frequency modulation signal in the surrounding environment; s6: the automobile key receives the low-frequency modulation signal and sends out a response signal; s7: and after receiving the response signal, the automobile executes the keyless function. The invention realizes the relay of keyless low-frequency signals and transmits the low-frequency signals farther, thereby realizing the anti-theft test of the keyless function of the automobile.

Description

Relay attack vulnerability detection method based on automobile keyless function
Technical Field
The invention relates to the technical field of keyless functions of automobiles, in particular to a relay attack vulnerability detection method based on the keyless functions of automobiles.
Background
With the development of science and technology, intelligent internet-connected automobiles are becoming more popular, and intelligent interaction functions of the automobiles are becoming more and more. The keyless entry and keyless start vehicle belongs to a part of intelligent interaction functions, and corresponding risks exist in the process of increasing keyless intelligent interaction.
The keyless function of the automobile is realized based on a radio frequency radio signal, and the keyless function is basically maintained to be about 3-5 meters by factors such as a transmission antenna, transmitting power, modulation frequency, a modulation and demodulation mode, electromagnetic environment interference and the like. According to research, the request signal sent by the keyless function vehicle end in the market at present is based on OOK modulation and the carrier signal is 125KHz, the response signal is based on ASK, FSK, PSK and the like modulation and the carrier signal is based on 315/433MHz, see figures 1 and 2.
The keyless function topology diagram is shown in fig. 1, the function request process is shown in fig. 2, and the keyless function normal communication request process is adopted. If a malicious person captures a 125KHz request signal sent by an automobile through a radio monitoring device, and then forwards and replays the signal through other means, relay attack can be implemented on the automobile key. When the automobile key receives the request signal, a response signal is generated, so that the keyless function is executed, and the risk of automobile theft is greatly increased.
Disclosure of Invention
The invention provides a method for detecting relay attack loopholes based on an automobile keyless function, which can detect the distance risk of the automobile keyless function, and provides a method for detecting a low-frequency relay without a key of the automobile, which can realize the test of the correlation of the keyless function, thereby verifying whether the keyless function is still normally used beyond the design range.
The invention relates to a relay attack vulnerability detection method based on an automobile keyless function, which is characterized by comprising the following steps of: the method comprises the following steps:
s1: triggering the keyless function of the automobile to generate a low-frequency request signal;
s2: capturing a low-frequency request signal by an RFKey-LFR-V end, and demodulating the low-frequency request signal to obtain original data;
s3: the RFKey-LFR-V end carries out high-frequency modulation on the original data, and transmits a high-frequency modulation signal to the surrounding environment;
s4: capturing a high-frequency modulation signal by an RFKey-LFR-S end, and demodulating the high-frequency modulation signal to obtain original data;
s5: the RFKey-LFR-S end carries out low-frequency modulation on the original data obtained by demodulation in the S4, and broadcasts a low-frequency modulation signal in the surrounding environment;
s6: the automobile key receives the low-frequency modulation signal sent in the step S5 and sends a response signal;
s7: and (5) after receiving the response signal sent by the S6, the automobile executes the keyless function.
Preferably, in S1, when the keyless function of the automobile is triggered, the automobile generates a 125KHz low frequency request signal, and the low frequency request signal uses an OOK modulation scheme.
Preferably, in S2, the RFKey-LFR-V end detects 125+/-5 KHz signals in the environment in real time, and after detecting that the low-frequency request signal generated in S1 exists, the low-frequency request signal is demodulated to obtain the original data; the band-pass filter is used for detecting the low-frequency request signal, the band-pass filter can filter signals except 125+/-5 KHz, and if the signals with 125+/-5 KHz exist, a rising edge is generated; because of the OOK modulation scheme used for the low frequency request signal, the original data can be obtained using the envelope detection scheme.
Preferably, in S3, the carrier signal used for high frequency modulation is 868MHz, and the modulation scheme is OOK.
Preferably, in S4, the RFKey-LFR-S end detects 868±2MHz signals in the environment in real time, and detects a high frequency modulation signal to generate a rising edge, and demodulates the high frequency modulation signal to obtain the original data; the high-frequency modulation signal with 868MHz as the center frequency is filtered by a band-pass filter, and the original data is acquired by an envelope detection mode.
Preferably, in S5, the raw data obtained by demodulation in S4 is subjected to low-frequency modulation and then broadcast in the surrounding environment; the OOK modulation mode is used for low-frequency modulation, the carrier signal is 125KHz, and the signal amplifier is used for amplifying the signal and broadcasting.
Preferably, in S6, after the automobile key receives the low-frequency modulation signal sent in S5, the low-frequency modulation signal is checked, and if the request is met, a response signal is sent to the automobile; the response signal is 315/433MHz, and the modulation method comprises ASK, FSK, PSK.
Preferably, in S7, after the automobile receives the response signal sent by the automobile key, the automobile checks, if the response signal meets the requirement, the corresponding keyless function is executed; the response signal check can have rolling code check, the rolling code check is a means for making different differences for the same automobile, is a synchronous code of the request signal and the unlocking signal, the rolling code is understood as the unlocking times, and the unlocking is executed when the unlocking times meet the range.
The invention discloses a method for testing the anti-theft of an automobile keyless function, which realizes the relay of a keyless low-frequency signal and the transmission of the low-frequency signal farther, thereby realizing the anti-theft test of the automobile keyless function.
The invention has the following characteristics: the low frequency signal relay distance is about 40 meters; the low frequency relay consumes a low time, about 1ms; the system in the low-frequency signal has the characteristics of high reliability, strong anti-interference capability, high success rate and the like.
The invention can detect the distance risk of the keyless function of the automobile, and provides the keyless low-frequency relay method of the automobile, which can realize the test of the keyless function, thereby verifying whether the keyless function is still normally used beyond the design range.
Drawings
FIG. 1 is a topology diagram of a keyless function of an automobile in the background art;
FIG. 2 is a diagram of a request process of a keyless function of an automobile in the background art;
FIG. 3 is a topology diagram of a method for detecting a relay attack vulnerability based on an automobile keyless function in an embodiment;
FIG. 4 is a request process diagram of a method for detecting a relay attack vulnerability based on an automobile keyless function in an embodiment;
fig. 5 is a flowchart of a method for detecting a relay attack vulnerability based on an automobile keyless function in an embodiment.
Detailed Description
For a further understanding of the present invention, the present invention will be described in detail with reference to the drawings and examples. It is to be understood that the examples are illustrative of the present invention and are not intended to be limiting.
Examples
As shown in fig. 3, 4 and 5, the present embodiment provides a method for detecting a relay attack vulnerability based on a keyless function of an automobile, which includes the following steps:
s1: triggering the keyless function of the automobile to generate a low-frequency request signal;
in S1, when the keyless function of the automobile is triggered, the automobile generates a 125KHz low-frequency request signal, wherein the low-frequency request signal adopts an OOK modulation mode, and the process (1) in FIG. 4 is shown; automobile keyless functions such as: the automobile keyless entry button is pressed and the automobile one-key start button is pressed.
S2: capturing a low-frequency request signal by an RFKey-LFR-V end (receiving end), and demodulating the low-frequency request signal to obtain original data;
in S2, the RFKey-LFR-V end detects a 125+/-5 KHz signal in the environment in real time, and after detecting that a low-frequency request signal generated in S1 exists, the low-frequency request signal is demodulated to obtain original data; the band-pass filter is used for detecting the low-frequency request signal, the band-pass filter can filter signals except 125+/-5 KHz, and if the signals with 125+/-5 KHz exist, a rising edge is generated; because of the OOK modulation scheme used for the low frequency request signal, the original data can be obtained using the envelope detection scheme.
S3: the RFKey-LFR-V end carries out high-frequency modulation on the original data, and transmits a high-frequency modulation signal to the surrounding environment; see fig. 4 (2) process.
In S3, the carrier signal used for high frequency modulation is 868MHz, and the modulation scheme is OOK. The carrier signal is 868MHz to prevent radio frequency signal interference (same frequency signal superposition); the modulation mode can be selected optionally, and the OOK effect used in the actual test process is relatively good.
S4: capturing a high-frequency modulation signal by an RFKey-LFR-S end (transmitting end), and demodulating to obtain original data;
in S4, the RFKey-LFR-S end detects 868+/-2 MHz signals in the environment in real time, a rising edge is generated when a high-frequency modulation signal is detected, and the high-frequency modulation signal is demodulated to obtain original data; the high-frequency modulation signal with 868MHz as the center frequency is filtered by a band-pass filter, and the original data is acquired by an envelope detection mode.
S5: the RFKey-LFR-S end carries out low-frequency modulation on the original data obtained by demodulation in the S4, and broadcasts a low-frequency modulation signal in the surrounding environment; see fig. 4 (3) process.
S5, carrying out low-frequency modulation on the original data obtained by demodulation in the S4, and broadcasting the original data in the surrounding environment; the OOK modulation mode is used for low-frequency modulation, the carrier signal is 125KHz, and the signal amplifier is used for amplifying the signal and broadcasting.
S6: the automobile key receives the low-frequency modulation signal sent in the step S5 and sends a response signal;
in S6, after the automobile key receives the low-frequency modulation signal sent by S5, the low-frequency modulation signal is checked, and if the low-frequency modulation signal meets the request, a response signal is sent to the automobile, see the process (4) of FIG. 4; the response signal is 315/433MHz, and the modulation method comprises ASK, FSK, PSK.
S7: and (5) after receiving the response signal sent by the S6, the automobile executes the keyless function.
S7, checking after the automobile receives a response signal sent by an automobile key, executing a corresponding keyless function if the response signal meets the requirement, and then unlocking a door and igniting the automobile; the response signal check can have rolling code check, the rolling code check is a means for making different differences for the same automobile, is a synchronous code of the request signal and the unlocking signal, the rolling code is understood as the unlocking times, and the unlocking is executed when the unlocking times meet the range.
The embodiment can detect the distance risk of the keyless function of the automobile, and provides the keyless low-frequency relay method of the automobile, which can realize the test of the keyless function, thereby verifying whether the keyless function is still normally used beyond the design range.
The invention and its embodiments have been described above by way of illustration and not limitation, and the invention is illustrated in the accompanying drawings and described in the drawings in which the actual structure is not limited thereto. Therefore, if one of ordinary skill in the art is informed by this disclosure, the structural mode and the embodiments similar to the technical scheme are not creatively designed without departing from the gist of the present invention.

Claims (8)

1. A relay attack vulnerability detection method based on an automobile keyless function is characterized by comprising the following steps of: the method comprises the following steps:
s1: triggering the keyless function of the automobile to generate a low-frequency request signal;
s2: capturing a low-frequency request signal by an RFKey-LFR-V end, and demodulating the low-frequency request signal to obtain original data;
s3: the RFKey-LFR-V end carries out high-frequency modulation on the original data, and transmits a high-frequency modulation signal to the surrounding environment;
s4: capturing a high-frequency modulation signal by an RFKey-LFR-S end, and demodulating the high-frequency modulation signal to obtain original data;
s5: the RFKey-LFR-S end carries out low-frequency modulation on the original data obtained by demodulation in the S4, and broadcasts a low-frequency modulation signal in the surrounding environment;
s6: the automobile key receives the low-frequency modulation signal sent in the step S5 and sends a response signal;
s7: and (5) after receiving the response signal sent by the S6, the automobile executes the keyless function.
2. The method for detecting the relay attack vulnerability based on the keyless function of the automobile according to claim 1 is characterized by comprising the following steps: in S1, when the keyless function of the automobile is triggered, the automobile generates a 125KHz low-frequency request signal, and the low-frequency request signal adopts an OOK modulation mode.
3. The method for detecting the relay attack vulnerability based on the keyless function of the automobile according to claim 2 is characterized by comprising the following steps: in S2, the RFKey-LFR-V end detects a 125+/-5 KHz signal in the environment in real time, and after detecting that a low-frequency request signal generated in S1 exists, the low-frequency request signal is demodulated to obtain original data; the band-pass filter is used for detecting the low-frequency request signal, the band-pass filter can filter signals except 125+/-5 KHz, and if the signals with 125+/-5 KHz exist, a rising edge is generated; because of the OOK modulation scheme used for the low frequency request signal, the original data can be obtained using the envelope detection scheme.
4. The method for detecting the relay attack vulnerability based on the keyless function of the automobile according to claim 3, wherein the method comprises the following steps: in S3, the carrier signal used for high frequency modulation is 868MHz, and the modulation scheme is OOK.
5. The method for detecting the relay attack vulnerability based on the keyless function of the automobile according to claim 4 is characterized in that: in S4, the RFKey-LFR-S end detects 868+/-2 MHz signals in the environment in real time, a rising edge is generated when a high-frequency modulation signal is detected, and the high-frequency modulation signal is demodulated to obtain original data; the high-frequency modulation signal with 868MHz as the center frequency is filtered by a band-pass filter, and the original data is acquired by an envelope detection mode.
6. The method for detecting the relay attack vulnerability based on the keyless function of the automobile according to claim 5, wherein the method comprises the following steps: s5, carrying out low-frequency modulation on the original data obtained by demodulation in the S4, and broadcasting the original data in the surrounding environment; the OOK modulation mode is used for low-frequency modulation, the carrier signal is 125KHz, and the signal amplifier is used for amplifying the signal and broadcasting.
7. The method for detecting the relay attack vulnerability based on the keyless function of the automobile according to claim 6, wherein the method comprises the following steps: s6, after the automobile key receives the low-frequency modulation signal sent by the S5, checking the low-frequency modulation signal, and if the low-frequency modulation signal meets the request, sending a response signal to the automobile; the response signal is 315/433MHz, and the modulation method comprises ASK, FSK, PSK.
8. The method for detecting the relay attack vulnerability based on the keyless function of the automobile according to claim 7, wherein the method comprises the following steps: s7, checking after the automobile receives a response signal sent by an automobile key, and executing a corresponding keyless function if the response signal meets the requirement; the response signal check can have rolling code check, the rolling code check is a means for making different differences for the same automobile, is a synchronous code of the request signal and the unlocking signal, the rolling code is understood as the unlocking times, and the unlocking is executed when the unlocking times meet the range.
CN202310080581.3A 2023-02-02 2023-02-02 Relay attack vulnerability detection method based on automobile keyless function Pending CN116193444A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310080581.3A CN116193444A (en) 2023-02-02 2023-02-02 Relay attack vulnerability detection method based on automobile keyless function

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310080581.3A CN116193444A (en) 2023-02-02 2023-02-02 Relay attack vulnerability detection method based on automobile keyless function

Publications (1)

Publication Number Publication Date
CN116193444A true CN116193444A (en) 2023-05-30

Family

ID=86451801

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310080581.3A Pending CN116193444A (en) 2023-02-02 2023-02-02 Relay attack vulnerability detection method based on automobile keyless function

Country Status (1)

Country Link
CN (1) CN116193444A (en)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108068759A (en) * 2016-11-18 2018-05-25 上海海拉电子有限公司 The system and method for preventing relay attack
CN108297830A (en) * 2017-01-11 2018-07-20 福特全球技术公司 For protecting method and apparatus of the system for making Vehicular system passively unlock from relaying site attack
CN108297829A (en) * 2017-01-11 2018-07-20 福特全球技术公司 Locking, unlock and the method for starting vehicle
CN114940142A (en) * 2022-05-31 2022-08-26 中国人民解放军国防科技大学 Automobile anti-theft method and system based on individual verification of radiation source and vehicle
CN115027409A (en) * 2021-08-06 2022-09-09 长城汽车股份有限公司 Vehicle starting control method, keyless intelligent system and electronic equipment
CN116939614A (en) * 2023-07-24 2023-10-24 广州大学 Method and device for detecting and defending automobile relay attack

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108068759A (en) * 2016-11-18 2018-05-25 上海海拉电子有限公司 The system and method for preventing relay attack
CN108297830A (en) * 2017-01-11 2018-07-20 福特全球技术公司 For protecting method and apparatus of the system for making Vehicular system passively unlock from relaying site attack
CN108297829A (en) * 2017-01-11 2018-07-20 福特全球技术公司 Locking, unlock and the method for starting vehicle
CN115027409A (en) * 2021-08-06 2022-09-09 长城汽车股份有限公司 Vehicle starting control method, keyless intelligent system and electronic equipment
CN114940142A (en) * 2022-05-31 2022-08-26 中国人民解放军国防科技大学 Automobile anti-theft method and system based on individual verification of radiation source and vehicle
CN116939614A (en) * 2023-07-24 2023-10-24 广州大学 Method and device for detecting and defending automobile relay attack

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
红帽社区: "UCLA ECE209AS(Winter 2018):汽车无", Retrieved from the Internet <URL:https://app.a5.cn/news.php?id=1307> *

Similar Documents

Publication Publication Date Title
WO2013175799A1 (en) Smart system
Rouf et al. Security and privacy vulnerabilities of {In-Car} wireless networks: A tire pressure monitoring system case study
US20140203907A1 (en) Communication system and communication device
US7102498B2 (en) Remote keyless entry system with two modes of demodulation
JP4542597B2 (en) Method for reporting LF remote signal strength to an electronic control unit via an RF link
Joo et al. Hold the door! fingerprinting your car key to prevent keyless entry car theft
US20120286927A1 (en) Wake Channel Indication for Passive Entry System
CN101141148A (en) Vehicle control system
US20060255909A1 (en) Security system
CN204915587U (en) Electric motor car intelligence anti -theft device of low energy consumption
Alrabady et al. Some attacks against vehicles' passive entry security systems and their solutions
CN116193444A (en) Relay attack vulnerability detection method based on automobile keyless function
JP2007127461A (en) Device and method for detecting moving person
US20120223810A1 (en) System and method for extending remote vehicle control functions
CN105501181A (en) Vehicle-mounted alcohol detection control system and method
CN116939614A (en) Method and device for detecting and defending automobile relay attack
CN201261444Y (en) Intelligent induction GPS monitoring communicating system
CN103448671A (en) Method and device for mobile terminal to gather radio frequency function
JP2008005120A (en) Vehicle communication system with noise radio wave direction detecting and reducing functions
JP2008141473A (en) Communication system, transmitter and receiver
CN106476755B (en) A kind of device of automatic sensing and one-key start
He et al. Battery-enabled anti-theft vehicle immobilizer
CN206155403U (en) Take alarm device&#39;s car locking control device
CN201499162U (en) Super-regenerative receiver
CN206164517U (en) Automobile -used self -adaptation receive demodulate device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination