Relay Attack Resistant Passive Keyless Entry Securing PKE Systems with Immobility Detection
Total Page：16
File Type：pdf, Size：1020Kb
DEGREE PROJECT IN MECHANICAL ENGINEERING, FIRST CYCLE, 15 CREDITS STOCKHOLM, SWEDEN 2020 Relay Attack Resistant Passive Keyless Entry Securing PKE Systems with Immobility Detection ABEL VALKO KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF INDUSTRIAL ENGINEERING AND MANAGEMENT Relay Attack Resistant Passive Keyless Entry ABEL VALKO Bachelor’s Thesis at ITM Supervisor and Examiner: Nihad Subasic TRITA-ITM-EX 2020:48 Abstract A significant security risk of modern vehicles is their vulner- ability to relay attacks. Challenge-response methods, such as those employed in Passive Keyless Entry (PKE) used by most commercial vehicles, are inherently exposed to this class of attacks, where communication between a vehicle and it’s key can be transmitted by an attacker over long range - thereby bypassing any encryption and unlocking the vehicle without requiring direct access to the key. While a multitude of defenses have been proposed in re- cent years, many lack either robustness or practicality. Any viable security system must satisfy a number of criteria. Such a strategy will likely have to rely on an environmental parameter which is not only immutable but also sufficiently space variant as to allow it to discern two positions which may be merely meters apart. Moreover, the system has to be: cost effective; easily implementable; and take user comfort, such as the key’s battery time, into account. The main purpose of this thesis is the implementation and evaluation of a PKE system resistant to relay attacks, it also analyses a multitude of proposed strategies for feasi- bility, as well as suggests a novel method: Approach Curve Matching. It is concluded that the most promising ap- proaches include: Immobility Detection, Distance Bound- ing Protocols, Approach Curve Matching, and analysing the Jackard index of Wi-Fi access points - the first of which is chosen to be implemented in the prototype PKE system. The project first develops a PKE system utilizing two Raspberry Pis acting as the vehicle’s on-board computer and key fobs microcomputer and implements the commu- nication protocol using Bluetooth, as opposed to the con- ventional RFID. Immobility Detection, using an accelerom- eter, is then implemented. The final system is then tested and evaluated. It is concluded that while Immobility De- tection is not comprehensively effective, it is easily imple- mentable, cost-effective, and can greatly increase the se- curity of PKE systems. Furthermore, the project observed that Bluetooth’s Received Signal Strength Indicator (RSSI) measurements are subject to exceeding fluctuation and are generally environment dependent; it is surmised that while other implementations of indirect distance measurement with Bluetooth may be more accurate, RSSI is not optimal for PKE applications. Finally, it is proposed that Immo- bility Detection should be employed promptly by manufac- turers while investigating potentially more effective, albeit uncertain, strategies. Keywords: Passive Keyless Entry, Relay Attack, Mafia Fraud, Access Control, Mechatronics Referat Title in Swedish En betydande s¨akerhetsbrist av moderna fordon ¨ar deras s˚arbarhetmot s˚akallade ’relay attacker’. Dessa typer av attacker, d¨ar signaler mellan bilen och nyckeln vidarebe- fordras, kringg˚arall kryptering och l˚aserupp bilen utan att ha direkt tillg˚angtill nyckeln. En stor del av kommersiella fordon till¨ampar ’Passive Keyless Entry’ (PKE) som byg- ger p˚a’challenge-response’ metoder som visats vara s¨arkilt utsatta f¨or dessa attacker. En m¨angd olika skyddssystem har f¨oreslagits p˚ase- nare ˚ar,men m˚angasaknar erforderlig robusthet eller ge- nom¨orbarhet. Ett l¨ampligt system b¨or uppfylla en rad olika kriterier. Strategin m˚astegrundas p˚aen omgivningspara- meter som ¨ar b˚adeof¨or¨anderlig och tillr¨ackligt rymdbero- ende att tv˚an¨ara positoner kan skiljas ˚at.Dessutom ska systemet vara kostnadseffektivt, implementerbart, och ta h¨ansyn till anv¨andarkomfort s˚asombatteritid. Projektets huvudsyfte ¨ar konstrktionen och analysen av ett ’relay attack’ resistent PKE system. I detta projekt ing˚arocks˚aen analys av ett antal f¨oreslagna f¨orsvar och f¨oresl˚aren ny metod: ’Approach Curve Matching’. Slutsat- sen dras att de mest lovande taktikerna ¨ar: analys av Jac- kard indexet av Wi-Fi hotspots, ’Distance Bounding Pro- tocols’, ’Approach Curve Matching’ och ’Immobility Detec- tion’ som ocks˚aimplementeras i prototyp PKE systemet. Projektet utvecklar f¨orst ett PKE system med tv˚aRasp- berry Pis som agerar som bilens och nyckelns mikrodatorer och implementerar kommunikationsprotokollet med hj¨alp av Bluetooth. ’Immobility Detection’ ¨ar sedan implemen- terad genom en inbyggd accelerometer i nyckeln. Slutligen testas och utv¨arderas systemet. Det konkluderas att trots att ’Immobility Detection’s effektivitet inte ¨ar helt omfat- tande ¨ar den l¨att att implementera, kostnadseffektiv, och kan bidra till en betydlig ¨okning av s¨akerheten hos PKE system. Vidare observerade projektet att Bluetooths ’Re- ceived Signal Strength Indicator’ (RSSI) m¨atningar ¨ar ut- satta f¨or avsev¨ard ostadighet och ¨ar allm¨ant omgivningsbe- roende. D¨arf¨or anses Bluetooth RSSI inte l¨amplig f¨or PKE till¨ampningar ¨aven om andra metoder f¨or avst˚ansm¨atning med Bluetooth kan ha h¨ogre prestanda. Det f¨oresl˚asatt ’Immobility Detection’ till¨ampas av tillv¨arkare omg˚aende medans andra potentiellt mer effektiva strategier utreds. Keywords: Nyckell¨osa System, Atkomstkontroll,˚ Relay Attack, IT-s¨akerhet, Mekatronik Acknowledgements I would like to thank my supervisor Nihad Subasic for providing guidance during the whole project. Thanks are also due to the team of course assistants who have helped during the course of this project and my peers for their opposition and discussion on the thesis. Finally, I would also like to express my thanks to Andras Valko, Balazs Valko, and Janos Valko for fruitful discussions and brainstorming, and for providing invaluable support throughout the thesis. Abel Valko May 2020 Contents 1 Introduction 1 1.1 Purpose . 2 1.2 Scope . 2 1.3 Method . 3 2 Background 5 2.1 Passive Keyless Entry . 5 2.1.1 Overview . 5 2.1.2 Encryption . 7 2.2 Relay Attack . 8 2.2.1 Overview . 8 2.2.2 Limitations . 9 2.2.3 Threat . 10 2.3 Key Fob Design . 10 2.3.1 Battery . 10 2.3.2 Wireless Technology . 10 3 Proposed Defenses 13 3.1 Received Signal Strength Indicator . 13 3.2 Coordinate Tracing . 13 3.3 GPS . 14 3.4 Jaccard Similarity of Wi-Fi Access Points . 15 3.5 Distance Bounding . 16 3.6 Immobility Detection . 17 3.7 Approach Curve Matching . 17 4 Implementation 21 4.1 Hardware . 21 4.1.1 Microcomputer . 21 4.1.2 Bluetooth Module . 21 4.1.3 Accelerometer . 22 4.1.4 Locking and Servo Motor . 22 4.2 Software . 23 4.2.1 Logic . 24 4.2.2 Authentication Protocol . 24 4.2.3 Software Architecture . 25 4.2.4 Encryption . 26 4.3 Results . 26 5 Discussion 29 6 Conclusion 31 Bibliography 33 Appendices 37 A ZOE-M8B GPS Module Data-sheet (excerpt) . 37 B Power Consumption Measurements for WF(M)200 Wi-Fi Module (excerpt) . 45 C AIS2DW12 Accelerometer Data-sheet (excerpt) . 50 D Python Code for the Designed PKE System - Key . 53 E Python Code for the Designed PKE System - Vehicle . 65 F Test Cases . 74 List of Figures 2.1 Protocol diagram of typical PKE system. 6 2.2 Inner and outer RFID zones. 7 2.3 Agent entering between the car and key fob communication. 8 2.4 Protocol diagram of relay attack on PKE System. 9 2.5 RFID beacons placed around the car interior and exterior. 11 4.1 Connection diagram for the MPU6050 accelerometer to Raspberry Pi Zero. 22 4.2 Activity diagram of the unlocking process for the improved PKE system with Immobility Detection. 23 4.3 Sequence diagram of a successful unlocking sequence. 25 4.4 Prototype setup of the implemented PKE system with the key fob and accelerometer (left) and on-board computer and lock (right). 26 List of Abbreviations BLE Bluetooth Low Energy DTW Dynamic Time Warping GPIO General Purpose Input/Output GPS Global Positioning System LF Low Frequency PKE Passive Keyless Entry PKES Passive Keyless Entry and Start PWM Pulse Width Modulation RF Radio Frequency RFID Radio-Frequency Identification RKS Remote Keyless System RSSI Received Signal Strength Indicator SARA Signal Amplification Relay Attack SMBus System Management Bus UHF Ultra High Frequency Chapter 1 Introduction Notes: Even number of pages. Holes. Position figures In Sweden alone there are near 5 million registered, in use, personal vehicles [1]. Approximately one for every 2 individuals [2]. The rapidly increasing connectivity of these vehicles and the shift from mechanical to electronic and wireless systems gives rise to new security vulnerabilities. Modern methods of car theft are a prime example of newly digitalized exploits owing to the spread of digital lock systems. The Remote Keyless System (RKS) has all but replaced the previous mechanical lock mechanism in cars with its Passive Keyless Entry (PKE) variant becoming standard in most high-end brands instead of its active counterpart. The traditional active RKS is a unidirectional system where the user unlocks the vehicle with a remote control, a.k.a. ’key fob’. The PKE System, explained in detail in Chapter 2.1, unlocks the car automatically as the user approaches the vehicle with the key fob - without the need for any interaction with the user interface. It employs bidirectional communication where the car sends a wake-up signal to the key when it is within range (commonly under 1 meter) and the driver takes hold of the handle, proceeded by a challenge response from the key which, if correct, will unlock the vehicle. A similar check may be performed in order to start the vehicle [3, 4]. This system increases user comfort due to the eliminated interaction and with the encryption algorithm and challenge-response technique that is employed in most recent implementations, explained in 2.1, assures high resistance to many methods of attacks.