Securing Passive Keyless Entry and Start System in Modern Vehicles Based on LF-Band Signal Analysis

The low-frequency-band (LF-band) communication in the passive keyless entry and start (PKES) system is basically designed to enable short-range communication (1 to 2 m) through which a key fob determines whether it is in the vicinity of its paired vehicle. However, this short-range communication is vulnerable because it is unable to precisely verify the distance, as the LF-band signals can be easily relayed or amplified. In this article, we present a novel method (named low-frequency fingerprinting, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LOFI</monospace>) to detect LF-band signals generated by an attacker. <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LOFI</monospace> is designed as a subauthentication method that supports existing authentication systems for PKES systems. Through a series of experiments, we demonstrate that <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">LOFI</monospace> effectively detects attacks on the PKES system, achieving an average false positive rate (FPR) of 0.92% and an average false negative rate (FNR) of 0.01% under Non-Line-of-Sight (NLoS) conditions. Moreover, using a physics-based ray-tracing simulation, we analyze detection boundaries against feature impersonation attackers.