Let´s take a look into a immobilizer transponder as it is used a lot in older generations of cars. The transponder is put into the key and a coil in the car communicates with the transponder to check if the key is valid.
The transponder contains a chip and an inductance which is potted in something like silicone.
The datasheet of the EM4170 (the immobilizer chip) shows the building blocks of the chip.
There is a resonance capacitor on the die. A AC/DC converter draws energy from the antenna and charges a capacitor to 9,5V at maximum. A voltage regulator supplies the logic with 3,5V.
Clock and data are extracted from the antenna and fed to the logic.
There is an 16x16-EEPROM with a read only 96Bit secret key, a 32Bit unique ID and 94Bit User Memory. The memory is protected with a 32Bit PIN.
The crypto algorithm seems to be in a separate block.
The transponder communicates with the transceiver by damping the antenna which modulates the voltages at the antenna of the transceiver.
The datesheet gives us a small glimpse into the authentication process. The transceiver sends a random number and a encrypted variant of this number. If the transponder calculates the same numbers it gives feedback and sends another variant of the random number which authenticates the transponder.
The die is 2,3mm x 1,7mm. You contact the ferrite coil at the right two bondpads. On the left edge there are some testpads. I assume with this testpads the unique ID is written.
The design of the EM4170 dates back to the year 2000.
On the right edge there are a lot of capacitors, a lot of them probably acting as resonance capacitors.
In the upper area there are smaller structures, probably data and clock generation.
In the lower right corner there are bigger structures. Perhaps that´s the damping circuit that modulates the data into the electromagnetic field.
In the middle of the die there is some standard logic. You can see the lines with the standard cells and the interconnection between them.
Here we have the memory area.
In the lower left corner you can see 18 lines coming out of the logic area. In the upper area there are 16 lines leading towards the memory. That fits good with the 16x16 memory.
In the upper right corner there is the symmetric structure of the memory. It´s interesting that there is a very big and dense area left of the memory. I assume in this area there is most of the cryptographic algorithm.
There is another circuit with capacitors under the memory area. I assume that is the "high voltage" generator that is necessary to write into the EEPROM.
https://www.richis-lab.de/transponder01.htm 
Home
Help
Search
Login
Register
