How secure is your vehicle with digital key technology?

Digital key technology allows mobile devices to streamline approval for everyday access points, making it a fitting solution for the automotive industry.

While there are a few different approaches to implementing digital keys for automotive use, a secure digital key standard should utilize near field communications (NFC) and ultra-wideband (UWB) in combination with Bluetooth Low Energy (BLE) to access a vehicle, start the engine, immobilize the vehicle, or authorize a variety of other operations.

A vehicle owner also can use their mobile device and share digital keys to friends or family with the option to place restrictions on shared keys.

A vehicle is one of the most expensive purchases a person will make in their lifetime, so while the benefits of digital key from a convenience and user experience standpoint are great, so may be the risk. To ensure consumer acceptance and support long-term adoption, we must first ensure digital key technology is secure and can effectively protect against the threat of attack.

RF relay attack mitigation

A relay attack is a method that hinges on intercepting messages between two parties – in this case a vehicle and mobile device – then relaying the message to another device within close range of the vehicle to enable access features.

According to analysis released in February of 2023 by Tracker in the UK, this type of attack remains one of the largest threats to vehicle security:

Keyless car theft and ‘relay attack’ continues to challenge manufacturers, as Tracker’s latest data confirms. The level of vehicle theft carried out through this method has significantly increased over the years. In 2017, 80% of all vehicles stolen and recovered were stolen without using the owner’s keys, it now stands at 93% in 2022.

To mitigate the occurrence of relay attacks UWB with BLE performs secure ranging through Time of Flight (ToF) measurements. Considering the lack of manipulation to the many messages used for ToF measurements, it would be evident to the vehicle that the true distance of the device is much further than a relay attack is trying to convey.

NFC is inherently at a lower risk for relay attacks due to the very limited transmission range. An attacker would need to be within a small number of centimeters to both the vehicle and device to successfully relay the message.

While these qualities are helpful against relay attacks, digital key technology owes a great portion of its broader security enhancements to the existence of a secure element.

The value of the secure element for digital key

A secure element is a microprocessor chip (embedded technology) that provides tamper resistant, secure implementation. It is within a secure element that all security-critical processing – authentication, encryption, key generation used for owner pairing, key derivation for “secure ranging”, key sharing, vehicle access and engine start transactions, storage of digital keys – takes place. The functions of a secure element help prevent hardware- and software-based attacks, including tampering, storage intrusion, cloning, and unauthorized access.

Some digital key architectures dictate both NFC and UWB interface directly with the secure element and digital key framework, separating them from the mobile device and applications thus adding a necessary level of protection.

These architectures also assume the following standard interfaces are present:

• Vehicle – Device: Vehicle to device is the wireless interface that facilitates direct communication between the vehicle and mobile device. It provides a mutually authenticated, secure communication channel that protects the user’s privacy by exposing their mobile device’s identity only to trusted vehicles after they have been authenticated.
• Vehicle OEM server – Device OEM server: Vehicle OEM server to device OEM server is the secure, trusted interface between device OEM servers and vehicle OEM servers that works with the help of certification authorities. It supports interoperability by abstracting the details of managing mobile devices and vehicles from each other. The interface between them provides a standardized way to manage digital keys and provide customer services.

With the right measures, digital key technology can be secure

With more automotive OEMs embracing digital key solutions, it raises questions around security for vehicles and mobile devices making use of this technology.

There is an increasing number of relay attacks year after year and a secure digital key specification should address these attacks through distance bounding with NFC and secure distance measurement with UWB. These considerations alone are not enough to prevent other types of keyless attacks and why additional measures are taken to secure transactions through the use of a secure element.

Moreover there is the mutual authentication that must take place between servers and the secure channels for the certificate exchange and command between vehicle and device to ensure secure connections for each step of the process.

It is the combination of all these elements that help answer the question “Is digital key secure?”