What is SFD protection? (VCDS / OBDeleven)
The protection of vehicle diagnostics (SFD, Schutz Fahrzeug Diagnose) is an additional layer of security requiring authorization between the vehicle and the manufacturer. It helps protect against fraud by providing information on who has logged on to the control unit, as well as the date and time of the connection. This protection applies to models manufactured from 2020 onwards equipped with the MQB Evo (VW Golf 8, Škoda Octavia IV, Seat Leon IV, Audi A3 8Y, Q4, etc.) and MEB (VW ID.3, ID.4, Škoda Enyaq, etc.) platforms, limiting certain functionalities such as adaptations, coding and parameterization.
SFD-protected control units: engine electronics, central electrical system, instrument cluster, power supply circuits, multimedia unit, etc.
-> VCDS vs OBDeleven Comparison
-> OBDeleven One-Click Apps list
-> VCDS: Reset tire pressure
Contents:
- What is SFD?
- Which calculators are currently protected by SFD?
- How do I know if my vehicle contains ECUs protected by SFD?
- Can I bypass SFD with VCDS? ( Unlock SFD with VCDS)
- How can I obtain the unlocking token to open SFD-protected ECUs?
- How do I unlock SFD-protected control units with OBDeleven?
1 – What is SFD?
From 2020, the VAG Group has introduced a new method of protecting vehicle diagnostics ( SFD ) , starting with the VW Golf 8, based on the MQBevo platform . Certain control units in new vehicles are then protected by SFD and can only be encoded or adjusted after entering a special token.
How to obtain this token is explained later in section 5 ( How do I obtain the activation token to open SFD-protected control units? ). SFD should be introduced gradually in 2 stages, which are explained below:
SFD – Level 1
This level includes access protection for modifications to control units, such as coding, adaptation and parameterization. Reading activities, such as reading the error memory or displaying blocks of measured values (actual values), are always possible without a token. What’s more, any changes made to control units are recorded at individual level to ensure traceability.
SFD – Level 2
This level builds on level 1 and also features tamper-proof protection for the diagnostic content. This means that changes to control units are made via a secure connection between the control unit and the vehicle manufacturer. This is also known as end-to-end protection.
In addition, strong user authentication is required for better logging (2-factor authentication, 2FA for short). This can be implemented, for example, using one of the following systems:
- PKI cards
- SecurID cards
- Applications that can generate one-time passwords (e.g. Google Authenticator, Microsoft Authenticator)
In the transition phase, weak authentication via the Group Retail Portal using a username and password should initially be possible. At the same time, the transition to strong authentication is being developed.
The entire SFD process requires an online connection to the diagnostic tester!
Does SFD also work offline?
There is a so-called fallback solution in the event of problems with the online method. This is explained in the points below:
- Direct token recovery with diagnostic tester fails
- The central unit’s activation request to generate the token is recorded locally
- You log in to the group’s retail portal and enter the locally registered activation request.
- An activation token is generated, which can now be entered manually in the tester
- Using a special function on the tester, the control unit checks the token and grants access after a successful verification.
- This feature is included in the latest version of VCDS, see : Can I bypass SFD with VCDS? ( Unlocking SFD with VCDS)
Why did VW launch SFD protection?
According to VW analyses, there is a growing need for data protection in control units. The previous procedure (activation using a 5-digit login code) no longer meets demand. For this reason, the protection of vehicle diagnostics, starting with the VW Golf 8, should gradually be introduced in all new vehicle models.
2 – Which calculators are currently protected by SFD?
Note: The list below shows controllers where we have already seen SFD. This does not mean that in every new vehicle, all these control units are protected by SFD. As far as we know, this varies from vehicle to vehicle or control unit to control unit. For example, in an Octavia IV, only 01 is SFD-protected, while in the next Octavia IV, 01, 09 and 19 are SFD-protected.
Control units:
01 – Motor electronicsDue to EU models, protection has been repealed at higher software levels.- 03 – Brake electronics
- 09 – Central electrical system
- 15 – Airbag
- 16 – Éles Electronic for the steering wheel
- 17 – Switchboard insert
- 19 – Diagnostic interface
- 23 – booster actuator
- 51 – electric drive
- 5F – Information electronics
- 75 – Telematics
MQBevo platform (VW Golf 8, Skoda Octavia IV, Seat Leon IV, Audi A3 8Y, etc.)
MEB platform (VW ID.3, VW ID.4, Skoda Enyaq, Cupra Born, Audi Q4 e-tron, etc.)
- Audi:
- A3 since 2020
- Q4 since 2021
- Q5 e-Tron since 2022
- Volkswagen:
- ID.3 since 2020
- ID.4 since 2021
- ID.5 since 2022
- ID.6 since 2021
- Golf 8 since 2020
- Caddy since 2021
- ID Buzz since 2022
- Transporting since 2022
- Škoda:
- Octavia since 2020
- Enyaq since 2021
- Seat:
- Leon since 2020
- Cupra:
- Leon since 2020
- Born since 2021
- Formentor since 2020
3- How do I know if my vehicle contains ECUs protected by SFD?
1 – If you haven’t already done so, download the latest version of VCDS from our VCDSpro website: https://vcdspro.de/downloads/#official-German-version
Note: the latest version of VCDS already shows you in the automatic analysis whether SFD-protected control units are installed in your vehicle.
2 – Run an automatic analysis
You can now display individual control units in detail in the automatic scan.
2.1 – If a control unit is protected by SFD, this is indicated by the abbreviation “SFD” at the end of the “VCID” line:
2.2 – If the abbreviation “SFD” is missing at the end of the line, there is no SFD protection.
2.3 – You will also find an example of an automatic scan in the appendix. In this example, you can see that 16 of the 36 control units are protected by SFD on this vehicle:
Automatic sample analysis PCI_VSSZZxxxxxxxxxxxx.txt
4 – Alternatively, you can open individual control units directly in VCDS
If it is an SFD-protected control unit, VCDS will show you the “SFD” button:
4 – Can I manage the VCDS (SFD)? (activate SFD with VCDS)
In the current version of VCDS, a function has been implemented for entering an offline SFD token. With the help of the offline token, SFD-protected ECUs can now be activated with VCDS. The function is explained in detail below.
Note: The latest version of VCDS is available at any time in our download area VAG software
How does SFD activation work?
1. Select the ECU protected by the SFD
2. The VCDS automatically detects that this is a protected ECU and offers SFD activation via the “SFD” button. This click
3. Now another window opens to activate the ecu
4. First, you need to read the SFD token from the ECU using the “Read token” – “Do It” option.
5. The token can then be copied to the clipboard using the “Copy” button.
6. From the token and chassis number, an activation key is calculated (see section 5: How to obtain the activation token to open SFD-protected ECUs).
7. The activation key can then be inserted into the VCDS mask in the “Release SFD” area by clicking on the “Paste” button and sent to the ECU via the “Do It” option.
8. The ecu confirms the question and is now suitable for write access (e.g. B. Coding).
5 – How can I obtain the unlocking token to open SFD-protected ECUs?
VCDS manufacturer Ross-Tech is already working on a solution for automatically opening SFD-protected ECUs with VCDS. This function is scheduled for release in 2024.
With OBDeleven, the SFD unlocking option is directly integrated with the Pro and Ultimate packs.
If you’d like to open an SFD-protected ECU now, here are some links:
-> Order an SFD token for VCDS with PCI Diagnosetechnik
-> Buy VCDS or OBDeleven cable with VAG Custom
6 – How do I unlock SFD-protected control units with OBDeleven?
To simplify the use of SFD protection, we’ve created an automatic SFD unlock function that makes SFD protection almost invisible. If automatic SFD unlocking is activated and you try to change the long coding, adaptation or use the one-click applications in the locked control unit, the OBDeleven application will automatically request the SFD code from the Volkswagen servers, unlock the control unit and save the value you wish to change.
OBDeleven can automatically detect that the control unit is locked by SFD protection when you switch to long coding, adaptations or one-click applications and try to write data but the control unit is still locked. In this situation, the application will ask you to authorize the SFD unlock procedure.
To manually unlock an SFD-protected control unit, first log in to the vehicle, go to the desired control unit, press the SFD protection button and select the SFD option to unlock. After these steps, the control unit will be unlocked for 90 minutes. If you wish to lock the control unit more quickly, simply select the SFD lock option and the control unit will be locked immediately.
To access the SFD functionality for the first time, you will be asked to update your personal data*. This data is mandatory under our agreement with Volkswagen AG.
-> Buy VCDS or OBDeleven cable with VAG Custom
What is SFD2 / CEE protection?
SFD2 or CEE is the highest level of DCD and can be found in VAG vehicles from model year 2024 onwards.
Contents:
- What is SFD2 / CEE?
- Which vehicles are currently protected by SFD2?
- How can I tell if my vehicle is protected
- Can I manage SFD2 with VCDS / OBDeleven?
1 – What is SFD2 / CEE?
SFD2 or The EEC is protection and can be found in VAG vehicles of model year 2024 at various stages of expansion. Depending on the stage of expansion, a higher or lower degree of protection attacks, which is in point 3: “How do I know if my vehicle contains SFD2 protection?” This protection is the result of several UN or EU Guidelines on the safety of vehicle diagnostics, particularly in the field of cybersecurity and software updates. Further information on these guidelines is available on the following official pages:
2 – Which vehicles are currently protected by SFD2?
In general, SFD2 can be protected in vehicles of model year 2024. We have already seen this protection for the following vehicle models:
- Audi e-tron GT (FW) from 2024
- Audi Q8 e-tron (GE) from 2024
- Audi A6 Avant (F2) from 2024
- Audi A4 Avant (F4) from 2024
- ID 7 (DE) from 2024
- VW Touareg (CR) from 2024
- VW Tiguan (CT) from 2024
- VW Passat (B9) from 2024
- Skoda Kamiq (NW) from 2024
- Skoda Fabia (6P) from 2024
3 – How do I know if my vehicle has SFD2 protection?
On the one hand, an automatic scan can be used to determine whether the respective vehicle is protected by SFD2, on the other hand by a PR number query (parts list of… The second variant provides more precise results.
Autocan request
- If you haven’t already, download the latest VCDS software: VAG software
- Perform an automatic scan
- Now you can UNECEsearch forthe word “CEE” in the auto-scan. If no results appear, the vehicle probably doesn’t have SFD2DCD2. If the vehicle is protected by SFD2, you’ll appear in several places in the Auto Scan search panel.
- The following example shows a control unit, which SFD2 Protected is:
Address 19: CAN Gateway (J533) Labels:* None Part No SW: 4KR 907 468 M HW: 4KR 907 468 L Component: Gateway H06 0025 Serial number: F0984674409841 Dataset Number: V03935412MG 0001 Coding: 0703000300800E407F07000000DB013ADE9E00071C0000000300008E02030000 Shop #: WSC 31414 927 00001 GVL: F1513C000804020080FC88008100C800110C0060000000040000000000006F00 ASAM Dataset: EV_Gatew31xUNECE 005014 ROD: EV_Gatew31xUNECE_VW53.rod VCID: E08CE51BFBD1BF922B-80B4 SFD
PR request numbers
- By recovering the vehicle’s equipment, we can identify both the SFD2 protection and the expansion phase used.
- The undercarriage chassis number is required for the PR application number. The result is a list of the components installed in the vehicle.
- If the results of a targeted search for the word “UNECE” are given, the vehicle is protected by the SFD2
- The following examples show the various stages of this protection:
- RP number NI0
Without CEE cybersecurity
Without CEE software update protection
– Without SFD2 control unit - PR number NI1
With CEE cybersecurity protection
With CEE software update protection
– Without SFD2 control unit - PR number NI7
With CEE cybersecurity protection
Without CEE software update protection
– Without SFD2 control unit - PR number NI8
Without CEE cybersecurity
Without CEE software update protection
– With SFD2 control unit - PR number NI9
With UNECE cybersecurity (for countries without UNECE requirements)
Updated UNECE software protection (for countries without UNECE requirements)
– Without SFD2 control unit
- RP number NI0
4 – Can I manage SFD2 with VCDS / OBDeleven?
VCDS manufacturer Ross-Tech is already working on a solution for automatically opening SFD-protected escutcheons with the VCDS. At the same time, SFD2 protection is also being tested on vehicles. VCDS and OBDeleven cannot yet unlock SFD2 protection, but OBDeleven will soon be able to unlock it.
