Service Interaction Protocol
Security Access
CHALLENGE_TYPE
SECURITY_TIERS
ANTI_BRUTE
Overview
“The client uses this service to unlock and access secured functions and data on the server by passing a security challenge.”
Many critical UDS services (like Write Data (0x2E), Routine Control (0x31), and Download (0x34)) are restricted until a specific security level is unlocked.
Default Behavior
At system startup or after a diagnostic session transition (e.g., from Extended to Default), the ECU security status resets to Locked. Access to restricted services requires a successful challenge-response exchange using service 0x27. A seed of 0x0000… from the ECU indicates the requested security level is already unlocked.
Protocol Anatomy (Request Seed L1)
◆ PROTOCOL ANATOMY
0x27 SECURITY ACCESS
0x27 RESPONSE
Security Levels
Security levels are defined by Sub-Functions. Odd numbers are used to Request Seeds, while the following even number is used to Send Keys.
Visualizing the tiered security structure and the services they unlock.
Level | Seed SF | Key SF | Typical Purpose |
|---|---|---|---|
| Level 1 | 0x01 | 0x02 | Standard Access (Config, Clearing History) |
| Level 3 | 0x03 | 0x04 | Programming / Flashing (Requires Prog. Session) |
| Level 5 | 0x05 | 0x06 | Supplier / Engineering Access |
| OEM Specific | 0x61... | 0x62... | Custom OEM-defined security tiers |
Seed & Key Logic
Workflow: Challenge-Response Sequence
4 stepsRequest
27 01> Request Seed for Level 1
Response
67 01 4A 2B 9C 1D> Seed = 0x4A2B9C1D
Request
27 02 [Calculated Key]> Tester sends key derived from seed
Response
67 02> Security Access Granted
Timers & Lockouts
- Attempt Counter: Typically allows 3 consecutive failed attempts.
- Delay Timer: After 3 failures, the ECU enters a Time Penalty state (e.g., 10 seconds).
- NRC 0x36: Returned when attempts are exceeded.
- NRC 0x37: Returned if you try again before the timer expires.
Negative Response Codes
Error_Catalog