Radio frequency identification and tracking of vehicles and drivers by exploiting keyless entry systems

Modern commercially-available vehicles have active or passive keyless entry systems. In the case of an active keyless entry system, an individual presses a button on a key fob that transmits a radio frequency signal to its paired vehicle that unlocks the doors. In the case of a passive keyless entry system, a vehicle senses an approaching individual and signals the key fob to respond with a radio frequency signal. If the key fob is paired with the vehicle, then the vehicle unlocks the doors and may even start the engine. For user convenience, most modern vehicles have integrated active–passive keyless entry systems.

A passive keyless entry system in a vehicle uses the four-way handshake protocol to detect a proximal key fob and authenticate the key fob as being paired with the vehicle. Any vehicle or individual that transmits the initial protocol signal forces a key fob to become a passive radio signal transmitter. Exploiting the four-way handshake protocol has privacy and security consequences. This research demonstrates that passive keyless entry key fobs – and by extension, their paired vehicles and drivers – can be identified and tracked in real time using radio frequency signals. Additionally, this research demonstrates that the identification and tracking of key fobs, paired vehicles and drivers can be performed using commercial off-the-shelf hardware costing less than $900.