HCS200
The HCS200 operates over a wide voltage range of
3.5 volts to 13.0 volts and has three button inputs in an
8-pin configuration.This allows the system designer the
freedom to utilize up to seven functions. The only
components required for device operation are the but-
tons and RF circuitry, allowing a very low system cost.
system is meant to be carried by the user and operated
to gain access to a vehicle or restricted area. The
HCS200 requires very few external components
(Figure 2-1).
Most low-end keyless entry systems transmit the same
code from a transmitter every time a button is pushed.
The number of possible code combinations for a low
end system is also a relatively small number. These
shortcomings provide the means for a sophisticated
thief to create a device that ‘grabs’ a transmission and
re-transmits it later, or a device that scans all possible
combinations until the correct one is found.
1.0
SYSTEM OVERVIEW
Key Terms
• Manufacturer’s code — a 64-bit word, unique to
each manufacturer, used to produce a unique
encryption key in each transmitter (encoder).
• Encryption Key — a unique 64-bit key generated
and programmed into the encoder during the
manufacturing process. The encryption key
controls the encryption algorithm and is stored in
EEPROM on the encoder device.
The HCS200 employs the KEELOQ code hopping
encryption algorithm to achieve a high level of security.
Code hopping is a method by which the code
transmitted from the transmitter to the receiver is
different every time a button is pushed. This method,
coupled with a transmission length of 66 bits, virtually
eliminates the use of code ‘grabbing’ or code
‘scanning’.
1.1
Learn
The HCS product family facilitates several learn strate-
gies to be implemented on the decoder. The following
are examples of what can be done. It must be pointed
out that their exists some third-party patents on learn-
ing strategies and implementation.
As indicated in the block diagram on page one, the
HCS200 has a small EEPROM array which must be
loaded with several parameters before use. The most
important of these values are:
• A 28-bit serial number which is meant to be
unique for every encoder
1.1.1
NORMAL LEARN
The receiver uses the same information that is transmit-
ted during normal operation to derive the transmitter’s
secret key, decrypt the discrimination value and the
synchronization counter.
• A 16-bit configuration value
• An encryption key that is generated at the time of
production
• A 16-bit synchronization value
1.1.2
SECURE LEARN*
The serial number for each transmitter is programmed
by the manufacturer at the time of production. The
generation of the encryption key is done using a key
generation algorithm (Figure 1-1). Typically, inputs to
the key generation algorithm are the serial number of
the transmitter and a 64-bit manufacturer’s code. The
manufacturer’s code is chosen by the system
manufacturer and must be carefully controlled. The
manufacturer’s code is a pivotal part of the overall
system security.
The transmitter is activated through a special button
combination to transmit a stored 48-bit value (random
seed) that can be used for key generation or be part of
the key. Transmission of the random seed can be dis-
abled after learning is completed.
The HCS200 is a code hopping encoder device that is
designed specifically for keyless entry systems,
primarily for vehicles and home garage door openers. It
is meant to be a cost-effective, yet secure solution to
such systems. The encoder portion of a keyless entry
FIGURE 1-1: CREATION AND STORAGE OF ENCRYPTION KEY DURING PRODUCTION
HCS200 EEPROM Array
Transmitter
Serial Number
Serial Number
Encryption Key
Sync Counter
.
.
.
Key
Generation
Algorithm
Encryption
Key
Manufacturer’s
Code
* Code Hopping learn patents pending.
DS40138A-page 2
Preliminary
1996 Microchip Technology Inc.
MICROCHIP [ MICROCHIP ]
