ca Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== RFID Exploration ======

Louis Yi, Mary Ruthven, Kevin O'Toole, & Jay Patterson



===== What did you do? =====

We made an Radio Frequency ID (RFID) card reader and, while attempting to create a long-range spoofer, created an jammer which overcomes card's signals.

The reader uses filtering circuitry following a 125kHz driven resonator to produce the returned FSK signal from the HID brand RFID proximity cards used around Olin college. Reading was initially performed by capturing data with an oscilloscope and then processing in MATLAB, but was eventually implemented on an FPGA using Verilog.

Reading the cards provided the binary data we attempted to reproduce with the RFID spoofer. Trying several transmission hardware designs and many encoding methods failed to yield a successful RFID activation. We discovered while testing that sending similar signals at high amplitudes blocked real RFID cards, effectively jamming them and locking the door.
===== Why did you do it? =====

RFID systems are currently and increasingly a part of our lives. We use them at school, at work, and on the roads for fare collection in systems like the Northeast's E-ZPass. Frighteningly, many online papers and our own experiments show, they're not very secure. Personal data stored on such cards is available to anyone nearby with a suitable, inexpensive RFID reader.

We were curious about the technology involved and whether we could implement a full RFID system. Also, Eric really wanted an RFID gun, which we are disappointed to say we couldn't deliver.





===== How did you do it? =====

The RFID protocol of communication is a nesting of three different encodings: Backscattering of a carrier frequency, Frequency Shift Keying, and Manchester encoding. \\

The RFID reader outputs a constant 125kHz signal to all nearby tags, amplifying the signal when it detects any reflected signal. Since an RFID tag is passive, it needs to send back a signal without drawing any power itself. Using the sent signal as both a power source and a clock, the RFID tag flips a transistor in a predefined sequence (a black box described in the Frequency Shift Keying section) to send a sequence of HIGH and LOW values through the backscattered signal back to the reader. \\


{{projects:Backscattering.gif?550}}\\//
Diagram of backscattering  transmission of ON and OFF signals.//\\
\\
On top of this encoding, HIGH and LOW signals are determined by the frequency of the backscattered ONs and OFFs. In Frequency Shift Keying, which is used by Olin’s Prox Cards, switching from ON to OFF at a rate of 12.5kHz (period every 10 cycles of the carrier frequency) denotes a LOW signal, and switching from ON to OFF at a rate of 15.6kHz (period every 8 cycles of the carrier frequency) denotes a HIGH signal. Thus the HIGH and LOW digital signals are encoded by 
The advantages of this encoding is that it is computationally simpler and less susceptible to noise than traditional pulse-amplitude modulated signals. Because only takes two frequencies to send a message, proper filtering can ensure the system is only susceptible to white noise around those two frequencies. Additionally, no channel equalization or phase calibration is needed, since the decoding method simply calculates the distance between peaks, and determines if it is closer to 12.5kHz or 15.6kHz. The HIGH and LOW frequencies are switched between according to a predetermined signal, a black box determined by the Manchester encoding of the tag’s data. \\
On top of this encoding, 1s and 0s are encoded and decoded from the highs and lows using Manchester Encoding. Manchester Encoding simply encodes a 1 as (HIGH, LOW) and a 0 as (LOW, HIGH). \\
 
{{projects:Manchester_code.png?550}} \\//
Diagram of a decoding of a Manchester-Encoded sequence of HIGH and LOW signals. //\\

The advantage of Manchester encoding is a huge improvement in the accuracy of readers and writers that are out of phase, and signals that stay high or low for extended periods of time. Manchester encoding guarantees that there is a flip from high to low in the center of each bit transmitted, so it is trivial to determine the phase of the writer’s signal. It is also impossible to be half a bit off, because a random sequence will include consecutive HIGHs or LOWs if the phase is half a period off. Manchester Encoding also prevents timing errors in long strings of 1s or 0s by making it trivial to count the number of bits in a long string of (LOW, HIGH)s. \\

==== RFID Reader ====
{{projects:rfid_reader.png}}//
Circuit used to decode the rfid tag modulated with a 125KHz down to a digital signal to be processed. // \\ 
Photos of comparator'd traces\\
Code - Mary \\

Our first implementation of the RFID reader was to take an analog signal and measure the peaks in order to find the signal was at 15KHz or 12.5KHz. We then graphed those differences representing different frequencies with as either a 'one' bit or a 'zero' bit. Finally we manually pieced multiple graphs together and then also manually decoded the graphs.
{{projects:decoded.pdf}}
   
{{projects:louis1.png}}//
Manchester Encoding from Louis' prox card processed by the matlab code. //\\
{{projects:spoofer.png}}//
Manchester Encoding from arduino spoofer emulating Louis' prox also processed by the matlab code. //\\

As seen from the two graphs above, both Louis' prox card and the spoofer resulted in similar outputs from the matlab code. This verified that our spoofer was outputting correctly. 

{{ projects:rfid_tag_signal_far.jpg?550 }}//
Clean signal from RFID tag which clearly demonstrates FSK and manchester encoding of the tag information.//
{{ projects:rfid_tag_signal_close.jpg?550 }}//
Close up of RFID tag signal.//
{{ projects:spoofer_signal_Far.jpg?550 }}//
Messy signal from RFID spoofer. We haven't been able to determine the source of the noise in the signal.//
{{ projects:spoofer_signal_close.jpg?550 }}//
Close up of spoofer signal.//


==== Spoofer ====

We tried three different driving methods for the RFID spoofer: a bipolar transistor, a pair of FETs, and a rectifying full-bridge followed by a loading FET. All three methods modulated the signal quite successfully, but failed when tested on a commercial HID prox reader.


{{ projects:transmittercoildiagram.png?300 }}

The Signal was sent by an Arduino using port manipulation to keep delays low and precise. Note that one side of each resonating coil and capacitor is grounded.

<file c>

// Coil control pin
int coil_pin = 8;

void setup() {
    digitalWrite(coil_pin, LOW);
    DDRB = B00000001; // set pin 8 OUTPUT
    PORTB = B00000000; // set Pin 8 Low, port manipulation
}

void set_pin_manchester(int clock_half, int signal) {\
    // encoded and send data
    int man_encoded = clock_half ^ signal; // xor

    if(man_encoded == 1) {
        send_1();
    } else {
        send_0();
    }
}

int data_to_spoof[45] = {0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0,
                         0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0,
                         0,0,0,0, 0,0,0,0, 0,0,0,0, 0}; // insert binary card data here

//int i = 33;
void loop() {
    // start sequence //
    send_0();
    send_0();
    send_0();
    send_0();
    send_1();
    send_1();
    send_1();
    // data payload //
    for(int i = 0; i < 45; i++) {
        set_pin_manchester(0, data_to_spoof[i]);
        set_pin_manchester(1, data_to_spoof[i]);
    }
}

int one = 40; // microsecond delay to send 12.5kHz
int zero = 32; // microsecond delay to send 15kHz

void send_1() {
    // send six periods of 12.5kHz signal
    PORTB = B00000000;
    delayMicroseconds(one);
    PORTB = B00000001;
    delayMicroseconds(one);
    PORTB = B00000000;
    delayMicroseconds(one);
    PORTB = B00000001;
    delayMicroseconds(one);
    PORTB = B00000000;
    delayMicroseconds(one);
    PORTB = B00000001;
    delayMicroseconds(one);
    PORTB = B00000000;
    delayMicroseconds(one);
    PORTB = B00000001;
    delayMicroseconds(one);
    PORTB = B00000000;
    delayMicroseconds(one);
    PORTB = B00000001;
    delayMicroseconds(one);
}

void send_0() {
    // send six periods of 15kHz signal
    PORTB = B00000000;
    delayMicroseconds(zero);
    PORTB = B00000001;
    delayMicroseconds(zero);
    PORTB = B00000000;
    delayMicroseconds(zero);
    PORTB = B00000001;
    delayMicroseconds(zero);
    PORTB = B00000000;
    delayMicroseconds(zero);
    PORTB = B00000001;
    delayMicroseconds(zero);
    PORTB = B00000000;
    delayMicroseconds(zero);
    PORTB = B00000001;
    delayMicroseconds(zero);
    PORTB = B00000000;
    delayMicroseconds(zero);
    PORTB = B00000001;
    delayMicroseconds(zero);
    PORTB = B00000000;
    delayMicroseconds(zero);
    PORTB = B00000001;
    delayMicroseconds(zero);
}



</file>
==== Sources ====
[[http://ww1.microchip.com/downloads/en/devicedoc/51115f.pdf|Microchip 125kHz RFID System Design Guide]]\\
[[https://instruct1.cit.cornell.edu/courses/ee476/FinalProjects/s2006/cjr37/Website/index.htm|Cornell Identification Card Project]]\\
[[http://scanlime.org/2008/09/using-an-avr-as-an-rfid-tag/|Variety of RFID Projects using AVR]]\\
[[http://www.proxclone.com/spoofer.html|RFID Prox Card Spoofer]]\\
[[http://www.coilcraft.com/pdfs/Doc397_TranspondersinRFID.pdf|RFID Coil Design by Coilcraft]]\\
[[http://ww1.microchip.com/downloads/jp/AppNotes/00678b.pdf|Microship RFID Coil Design App Note]]\\
ca Wiki

User Tools

Site Tools

Page Tools
