Ultra Wide Band technology in cars

The times of turning an actual key to open your car or start the engine are way behind in the past! Since the introduction of remote keyless systems back in the 1980s, key fobs and hands-free access have become the norm, making life easier for drivers. Nowadays, car key fobs often come with multiple options to control the door locks, open/close the trunk, start the engine, or even more advanced features like remotely warming up or turning on the AC, lowering the windows, fold-in mirrors, adjusting seats, etc. And we’re actually deep into the era of completely hands-free access, where in many cases you do not need to pick the fob from your pocket or press any button - just have the smart fob or smart card with you and you’re good to go!

Until recently, all of this depended on radio-frequency identification (RFID) - which has been the technology of choice for car fobs since their early days in the ‘80s. The key fobs are essentially like a small remote control with a short-range radio transmitter / RFID chip and an antenna, communicating with receivers in the car that activate locks, engine start, and other possible functions. Still, the simplicity of the RFID-enabled fobs has been dimmed by a problem that has only grown bigger over the years: security! 

Relay attacks

The most common way of modern car theft involves so-called relay attacks, which explore the vulnerabilities in the car key fob radio frequency communication. Relay attacks are a well-known form of hacking across several communication systems. For car theft, these work in a very simple way: one of the attackers stands by the targeted vehicle, while the other stands as near to the fob as possible (in general, close to the owner’s house while the car is parked outside). Both attackers hold devices that can pick up signals from the key fob and trick the car into considering the owner/fob is close by, unlocking doors and allowing to start the engine. Nowadays, such devices are very cheap and easily accessible online, picking up signals from more than 100 metres away! Seems like it is becoming quite easy for thieves - and that’s probably the reason why keyless car thefts represented over 90% of all recorded thefts in certain regions of the UK during 2019 and 2020!

The RFID technology that traditionally equips key fobs is vulnerable to these kinds of attacks. But so are other wireless technologies that have recently gotten increased traction in this sphere, such as near-field communication (NFC) and Bluetooth Low Energy (BLE).

Let’s first give a look at the recent trends within digital car keys and how different wireless communication technologies are stepping up to replace good old RFID!

Beyond fobs - the smartphone is the key

It should not come as a surprise that your smartphone - or your smartwatch, wristband, or any other futuristic wearable gadget you may think of - will sooner or later become the key to your car, your home, the office, etc. Indeed, digital keys are already a reality - particularly in high-end car models. In order to push new features and try to address security issues, the industry is moving into more advanced technologies like NFC and BLE, widely available in today’s smartphones and related gadgets. 

NFC allows communication between two devices over distances of less than 10 centimeters. It might be of a passive type, where the initiator device actively generates a radio frequency field that can power a passive target (one-way interaction). This means that the passive element does not need an embedded power source and can be as simple as a slick tag, sticker or card. Yet, in active mode, where both devices are powered and can establish peer-to-peer connectivity, is where NFC unleashes new forms of interaction and connectivity patterns. Suddenly, all kinds of gadgets - smartphones, headsets, wearables, smart home devices and appliances, or even pieces of industrial gear - can initiate or react to NFC queries, opening up wider and fancier use-cases. Technically speaking, the difference between NFC and other short-range wireless technologies is that NFC transmits data via magnetic field induction, whereas others generally work through radio wave propagation. This limits the range to very low distances with fields that fade out far quicker than radio waves, which can be leveraged to prevent attacks and thus improve the security of transactions. The typical applications of NFC are within contactless payment systems and mobile payments, such as Apple Pay or Google Pay, as well as within access authentication and control - e.g. in public transports, public venues, homes, offices, etc. In cars, typically an NFC reader installed in the door handle enables the driver to open the door by holding the NFC fob, card or smartphone close to the handle. Moreover, placing the fob, card, or smartphone next to an NFC reader (e.g. in a specific tray) inside the car allows starting the engine without using a key. But NFC technology serves other purposes as well: it provides the easiest way to set up a wireless connection, and this makes it very useful e.g. to pair electronic devices or to set up Wi-Fi connections automatically.

Bluetooth is nowadays a part of practically all our electronic devices and needs no introduction. BLE is a variation of classic Bluetooth, designed specifically for very low-power operation. BLE is particularly useful for IoT applications and small battery-powered smart devices. Compared to NFC, BLE works at much faster speeds/transfer rates and much longer distances - up to at least 50 meters. Yet, for applications like payments and access authentication, NFC's very short distance reduces the likelihood of unwanted interceptions/hacks and helps with accurate identification, e.g. in areas crowded with connected devices. 

In any case, back to our point - i.e. smart access to cars - both NFC and BLE are susceptible to relay attacks!

For instance, Tesla has recently been in the news for vulnerabilities in its NFC and BLE smart access systems, which allow for new types of relay attacks. Although the spotlight has been on Tesla, cars from other manufacturers - such as BMW, Mercedes-Benz, Ford and Hyundai - may be at the same risks. 

Hence, although there are multiple implementations of NFC and BLE within digital car access systems, the automotive industry has been on the lookout for alternatives. And it may have found the ultimate solution: UWB! 

UWB excels at accurate measurements of the distance between devices, through a process called ranging. It relies on time-of-flight (ToF) and angle-of-arrival (AoA) metrics to accurately determine distances and direction of the signals, resulting in extremely accurate positioning/localization of devices. The accuracy of UWB positioning can go down to a few centimeters, compared to meters for BLE or Wi-Fi. The distance of communication is similar to BLE. Besides, the latest releases of the UWB standard (IEEE 802.15.4z) implemented cryptographic elements to protect the timestamp data, making it tamper-proof. For car access systems this makes the whole difference: essentially it means that you cannot fool the car into thinking the fob or smartphone is nearby - which is the fundamental trick behind a relay attack. Notably, cybersecurity expert firm NCC Group recommends the use of UWB to prevent the kind of relay attacks recently reported against NFC and BLE smart access systems. 

How the industry is working

As with virtually anything that goes into cars, the size of the industry - with new car sales rounding 70 million units per year globally - makes car access systems a quite interesting business. The market for smart keys and fobs is often characterized as highly fragmented. Not to a big surprise, German and Japanese players dominate the market landscape. On the German side the top list includes companies like Continental, Hella, ZF group, Huf Group or Bosch, while in Japan there’s Denso, Alps Alpine, Tokai Rika, Mitsubishi, etc. 

The main chipset provider for UWB technology for cars is NXP Semiconductors - through its Trimension series. They have been working with industry leaders like Continental, BMW, the VW Group and Huf for the new generation of UWB-enabled car access systems. Other UWB chip providers making way into the automotive space include 3DB Access (through partnerships with Microchip and Renesas), Qorvo and STMicroelectronics. 

The industry has been clustering around initiatives to promote interoperability, standardization and new use-cases for UWB in cars - including the IEEE, the FiRa consortium, and the Car Connectivity Consortium (CCC). It is clear that most players in the industry are looking into UWB - driven by technology flexibility, accurate real-time localization and increased security capabilities. As such, UWB is projected to reach more than 33% of total cars by 2030. Now, let’s give a deeper look into some examples of industry partnerships and UWB implementations in smart keys and phone-as-key for car access.

Leading examples

BMW has been one of the first car manufacturers to try UWB, namely introducing their BMW Digital Key Plus with the BMW iX models. The company is pitching the Digital Key Plus as a new phone-as-key experience for car access: the car will greet you by turning on its lights when you approach the car and unlock shortly before you reach the door handle, without the need to take the smartphone out of your pocket. Besides, you will be able to start the engine without having to physically place your phone in the smartphone tray. It also works with NFC, so in case your phone runs low on battery you’ll still be able to use NFC to unlock the car by holding the phone to the door handle. This is actually a cool feature of NFC: as it can work in passive mode, you can still use the phone-as-key even if it runs out of battery. BMW seems to be one of the front-runners in advanced car access and UWB - very actively involved in the Car Connectivity Consortium and collaborating with others, particularly NXP and Continental, to push new standards and use cases.

The Volkswagen group has also been exploiting UWB in cooperation with NXP. The partnership has resulted in testing UWB capabilities for several use-case scenarios in a concept car. Meanwhile, implementation of UWB keys in commercial car models across the group has already started: the new Škoda Octavia and Enyaq models are confirmedly equipped with UWB keys, and there has been news about the roll-out of UWB keys in Volkswagen models (Golf 8, ID.3, ID.4) as well as in other brands of the group, such as Audi or Seat.

Other car makers implementing UWB keys include Hyundai (Genesis GV60 model), Nio (ET7 and ET5 models), General Motors (Hummer EV) and Jaguar. Inevitably, there are also quite a few rumours that Tesla is on the run to use UWB technology in their car access systems. 

Looking at UWB smart key system providers, we’ve already mentioned Continental, but others also supply commercial systems, such as Hella and Huf. Hella has been producing classic remote keys with UWB technology since 2019, and is now offering the HELLA Smart Car Access, a phone-as-key system based on UWB. The system enables typical access control (door control, engine start, etc.) and more advanced features - such as digital management of access authorisations to the vehicle, e.g. for car sharing or fleet providers. It also allows for storage and activation of personalisable settings - e.g. related to comfort, interior lighting, welcome functions, etc. Huf is also ready to supply phone-as-key solutions based on UWB for car makers.

Beyond advanced access systems, UWB technology can also help the automotive industry in other ways. For instance, the VW group is exploiting UWB-based real-time location systems to streamline production operations, together with Qorvo. Ubisense is also leveraging its real-time location systems based on UWB to improve processes in automotive manufacturing plants - working together with brand names like BMW, Renault, General Motors, Ford, Toyota or Hyundai.

The missing link

All UWB devices - including small gadgets like fobs, smart cards, tags, and trackers - still need batteries to work. Now, imagine getting rid of those batteries - with all the constraints these mean in terms of design of the electronics and casing, the hassle around charging or replacing them, along with all the nasty effects those have in the environment! That’s our mission - and matching ONiO.zero with UWB technology means no less than a marital bliss! Batteryless UWB technology will represent another step forward towards ever-lasting smart key fobs or cards, while also enabling manufacturers to multiply the number of self-powered - simple and cheap - UWB-enabled sensors distributed in a car!

In conclusion

The most advanced car access systems available today, namely the examples given above, are combining BLE, NFC and UWB - leveraging the strengths of each technology. Still, UWB is the masterpiece, providing the ultimate security features and enabling higher-end use-cases. The typical use-cases are within keyless car door control and engine start, using a smart fob, card or phone. But UWB in cars holds the promise for many other use-cases in the not so distant future. Examples include: car-as-key (e.g. to automatically open the garage door once the car is approaching), sharing of digital keys (e.g. share access to car with family members, friends or other people using the smartphone; access control in rental cars; fleet control), drive-through payments (secure payments on the go in restaurants, gas stations, etc.), smart parking, autonomous charging of electric vehicles, in-cabin child presence detection (using UWB radar), indoor navigation, autonomous driving, etc. With all these possibilities in play and most of the industry giants on the move, UWB technology is bound to have a place in present-day and future cars! Batteryless UWB devices will only make that future grander and greener!