Microwave Engineering Europe - October 2007 - (Page 19)

COVER FEATURE — UHF RFID DATA PROTECTION 19 Figure 1: Memory maps. Atmel Secure IDIC® Password Lock Default Page/Password Lock Block Perma Lock Shadow TID Atmel UID TID EPC Mandatory SHADOW TID User 2048 bit USER TID EPC 512 bit EPC EPC 64 bit (96 bit typ.) PC CRC-16 RESERVED HIDDEN PC CRC-16 Access Password 3 Access Password 2 Access Password 1 Cloak Password Kill Password Kill Password Lock, Kill etc. Lock User Memory Cloak Mode Lock, Kill etc. Access Password (Optional) high metal content (70%) of aircraft parts. These tags use special patch antennas or shielded dipol structures to ensure a large range and good performance. UHF RFID as a secure vignette replacement Due to the growing amount of trafﬁc and its resultant pollution, local authorities worldwide favor the limiting of trafﬁc in cities. London’s mayor, Ken Livingstone’s congestion charge policy in London is one of the more famous examples. Currently, there are a number of systems available for toll collection and trafﬁc registration. These include manually-read vignettes, active battery powered systems using GHz frequencies, GPS and GPRS systems. However, a cheap passive UHF RFID solution can potentially offer a viable replacement for AVI systems such as the vignette systems used in Austria and Switzerland. A disposable UHF RFID tag with a 6-month validity could be used. As an RFID based tolling solution involves the communication of virtual money, the EPC security speciﬁcations are insufﬁcient. Anti-cloning, anti-emulation, authentication, and unique ID numbers are important security requirements for such a system. In addition to the security requirements, reading of tags in ﬂowing trafﬁc brings unique communication challenges. Only through the use of sophisticated antenna systems, tag circuits with minimum current consumption, and particular energy strategies can an RFID-based tolling solution be used. Security threats to UHF RFID technology The very nature of RFID technology, where data is transmitted over the air, makes it susceptible to attacks. The easiest and most often used attack method is known as brute force. This method of defeating a cryptographic scheme involves trying a large number of passwords. With the simplest EPC tags, it is only a question of time until the password is hacked. Another method, known as eavesdropping, involves the interception of the data transmitted between the tag and the reader. Using one-off or repeated eavesdropping, it is possible to record passwords and transmitted data. The range of a normal passive UHF RFID system varies according to the application and the antenna type of both the reader and tag. The range can vary between a few centimeters to a few meters (<10m). Eavesdropping devices have an distinct technical advantage; they do not need to supply the tag with power, and as a result can optimize the electronic bugging operation. Tests have proved that the forward channel communication from reader to tag, can be eavesdropped with special equipment up to 1-2 km away, and the backward channel, with special equipment, up to 100 m away. A more complex method of attack is know as the power-spectrum method. With this method, both the commands sent to the tag and the power consumption are tracked. With a more exact analysis, the password or the internal encryption algorithm can be identiﬁed. In parallel, optical or electronic analysis of the memory cells by specialized chip analysis devices can be carried out. This method is well known in crypto smart card attacks. Criminal efforts to read, change, or manufacture tag copies are naturally dependent on the direct or indirect value of the material saved on the RFID tags or on the value of the tagged good. A simple EPCgen2 tag, functioning purely as a barcode replacement, offers little protection against the more than 100-billion-dollar counterfeiting industry. RFID tags, in contrast to barcodes, do offer a means of prevent counterfeiting. The use of a unique number, stored in a protected area of the RFID tag’s memory, makes each chip one-of-a-kind. This forms the basis for a number of security concepts. In addition, the expansion of the 32bit EPC password length to a length of 96-bits can increase the efforts of a brute force attack by a factor of 264. A mechanism that counts the number of failed password attempts, and prevents further attempts after a certain number, can also hinder brute force attacks. Encryption of the forward and backward link also makes extraction of user data by eavesdroppers very difﬁcult. This degree of difﬁculty is increased further by varying the encryption key between each partial communication. By addressing the previously described security threats, UHF RFID technology offers a real possibility of verifying the authenticity of goods and ensuring data security. Security through an extended RFID memory Atmel, an RFID pioneer, produce transponder circuits in LF, HF, and UHF frequency bands and from simple read-only LF RFID (IDIC®) circuits to highly secure crypto HF RFID circuits (CryptoRF®). The European research project PALOMAR, resulted in Atmel’s ﬁrst UHF RFID product, the TAGIDU™ ATA5590, typiﬁed by its large operational distances and 1-kbit user space. Circuits meeting only the minimum speciﬁcations of the EPC Class1Gen2 are not adequate for memory-intensive or security-oriented applications. A ﬂexible EPPROM memory on the RFID circuit is a prerequisite for such applications. Figure 1 shows a memory map of an EPC mandatory tag and an extended EPC/ISO conformed tag such as Atmel’s ATA5593. The ATA5593 has an EEPROM of approximately 3 kBits, with an accessible user memory of 2 kBits. Both tags are Microwave Engineering ● October 2007 ● www.mwee.com 018-019-020_MWEE.indd 19 19/09/07 12:03:46 http://www.mwee.com

Table of Contents Feed for the Digital Edition of Microwave Engineering Europe - October 2007

Microwave Engineering Europe - October 2007 Contents Comment News CMOS RF: Si-On-Sapphire Goes Mainstream Cover Feature: New Data Protection Concept for UHF RFID Tags CMOS RF: RF Design Team Touts CMOS Spin for 3G PAs Wireless HID – Are You Following the Standard to Another “Average” Product Development? Phase Optimisation of the RF Front-End Direct Synthesis of UWB-WiMedia Signal Generation 4G Chips to Target 700 MHz Applications Femtocells Mobilize to Fight Wi-Fi in the Home Products Product Feature: AXIEM Pioneers the Future of EM Technology Calendar

Microwave Engineering Europe - October 2007

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.