Universal Rolling Code Transmitter

Universal Rolling Code Transmitter

A universal rolling code transmitter provides an added level of security to a garage door operator system. Typically, these systems use the hopping code technology for transmitting security codes.

The hopping code is used to prevent replay attacks where an eavesdropper can intercept and record the transmittal of the security code to “unlock” the device. However, these devices are susceptible to a number of problems.

RF Transmitter

A universal rolling code transmitter is configured to activate one or more remote systems 14 by radio frequency messages. Examples include a garage door opener, a gated entrance system, security system, home automation system, or vehicle remote keyless entry (RKE) system. Transmitter 10 and receiver 12 can comprise digital and/or analog circuitry, volatile or non-volatile memory, and radio frequency transmit and receive components.

In an exemplary implementation, radio frequency messages containing an identifier 20 and an encrypted counter value 22 are sent from transmitter 10 to receiver 12. A crypt key 25 is used to derive the counter value 26. This counter value is stored in memory in transmitter 10 and in receiver 12.

The identifier 20 is transmitted along with the encrypted counter value 22 in each radio frequency message from transmitter 10. Each time the user input device 16 (FIG. 1) is actuated, counter value 26 increments and a new radio frequency message containing the identifier 20 and encrypted counter value 22 is generated.

Upon receiving the next encrypted counter value, receiver 12 decrypts the radio frequency message and compares the identifier 20 and the encrypted counter value 22. If the identifier 20 and the encrypted counter values 22 match, receiver 12 generates a signal to actuate remote system 14 via transmitter 10 to activate one or more remote systems 14.

In alternative embodiments, the identifier 20 can be transmitted in each radio frequency message without the encrypted counter value 22. A synchronizing method is implemented to ensure that the counter values 22 and 26 begin at the same value. This synchronization may be performed by training transmitter 30 to receiver 12 by a user pressing the button on trainable transmitter 30 trained to a receiver 12.

At a step 62, trainable transmitter 30 loads from non-volatile memory a transmit count value (or number of times it will transmit), a serial number, an encryption key, and a variable IncRoll. At a step 66, the variable IncRoll is set equal to the transmit count value. At a step 70, trainable transmitter 30 sends a rolling code signal comprising the same transmit count value and encrypted counter value until the button on user input device 34 is released.

RF Receiver

The RF receiver of a universal rolling code transmitter receives signals from the radio input pin and translates them into trinary data bits. The trinary data bits are then shuffled and packaged in a first 20-trinary bit frame and a second 20-trinary bit frame which have a single synchronization or identification pulse indicating the start of each frame.

In this way, the receiver identifies the start of each frame and can be programmed to receive the appropriate alternating trinary bits as they are transmitted. Each of these frames contains a fixed code bit and a rolling code bit resulting in a total of 40 trinary bits.

Each of these alternating trinary bits has a number of digits in it. The higher the number of digits in the corresponding trinary bit, the greater the increment of the resulting rolling code value.

As you can see, the shuffle of the alternating trinary bits provides a much better security feature than if the fixed code and the rolling code had been encoded separately in each frame. As a result, it is far more difficult to clone the universal rolling code transmitter.

A further advantage of this design is that it allows users to set the intervals at which two or more valid codes must be received in order for a garage door opener to open. This is especially useful for those with security concerns and is an invaluable feature of the keeloq system.

To program the transmitter, a transmitter with a known fixed code is placed into the memory of the receiver. The receiver will then recognize that transmitter as being associated with the channel on which it was saved. The receiver will then exit the programming mode and check the proper operation of the transmitter saved.

Once the transmitter is stored in the memory, it can be used again. The receiver can then be programmed to operate as a universal remote control. To do this, a user will need to use an antenna that is compatible with the receiver’s inputs and power it according to the instructions in the manual. The controller will usually include a programming button and a LED indicator to indicate that the transmitter is being programmed.

Transmitter Programming

A universal rolling code transmitter allows you to program your door openers without the need for an additional remote control. These transmitters work with most Chamberlain, Craftsman, Genie, Liftmaster, Multicode, and Stanley openers that use Security+ 2.0 technology, which sends a new code with each use. They’re available in two-button, three-button, and four-button models that can operate one gated entrance plus up to three openers.

Transmitter programming is similar to that of a remote, which involves pressing the “learn” button on your receiver and selecting the channel you want to save. The transmitter and receiver both use a pseudo-random number generator (PRNG) that generates random codes. Once a code is generated, the receiver compares it to the last code it received. If it finds that the code is out of sequence, it will not accept the next transmission.

This technique protects against replay attacks, which occur when an eavesdropper records a code and then replays it later to break the system. It’s also resistant to HMAC-based one-time password systems.

The only exception to this is a remote learning feature in certain receivers, which lets you store a previously memorized transmitter on the receiver and then pair a new one to it with no need for the original transmitter. However, you can’t save ARC and HCS Rolling Code transmitters on the same receiver at the same time, since they don’t share a common encoding. You can, however, remotely learn a new HCS or ARC Rolling Code transmitter, which pairs with the receiver quickly and works like the one originally saved.