NFC

Outline
Background

Wireless Charging

History

Security

RFID

Security Defenses

Technology

Advantages/Drawbacks

Standards

Conclusion

Applications

Questions

Consumer
Medical

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

Background
NFC: Near Field Communication
Antenna <<< signal wavelength
RX within TX near field (<5cm)

Operating modes
Active: TX/RX Generate an RF Field peer-to-peer
Passive: TX or RX generates, other powers itself from the field Tags

Contactless payment systems, social networking, gaming,

identity tokens, etc

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

Near Field
Radius << /2
Wave depends on source
characteristics rather than
propagation medium
High current, low voltage
Magnetic rather than electric
EM radiation carried back and forth from
the antenna
Changes into electrostatic and
magnetostatic effects
Current creates purely magnetic
component

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

Introduction: History
Major Events Timeline:
1983 The first patent to be associated with the
abbreviation RFID was granted to Charles Walton
2002 Sony and Philips agreed on establishing a
new technology specification and created a
technical outline on March 25, 2002
2006 Initial specifications for NFC Tags

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

Introduction: History
2006 Nokia 6131 was the first NFC phone
2009 In January, NFC Forum released Peer-toPeer standards to transfer contact, URL, initiate
Bluetooth, etc
2010 The city of Nice in Southern France
launches the "Nice City of contactless mobile"
project, providing inhabitants with new NFC
generation mobile phones and bank cards

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

Introduction: History
2013 Samsung and Visa announce major
partnership to develop mobile payments
2013 IBM have come up with a new mobile
authentication security technology based on
Near-Field Communication (NFC).
2014 Apple Inc. announces Apple Pay

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

RFID
Used to identify objects
capture information implicitly
Two elements:
Transponder: Tags with an antenna
element that store data
Active System 100m range

Readers: Emit radio waves and

receives signals from the
transponders
Low (125KHz), High (13.56MHz), UHF(860960MHz)

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

RFID led to NFC

Evolution, not revolution
Subset of RFID (ISO/IEC 14443)
Patented in 1983 by Charles Walton

Two devices brought <4cm

RX RF field causes current flow, activating
circuit
TX/RX antennas act as coils in a transformer
Signal TX by reader results in power flow
changes
Half Duplex

Grew out of Sony and Philips

(2002)
Accepted as ISO/IEC 18092 in
2003
ECMA-340
NFC Forum Created

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

How NFC Works

NFC Tags and Readers:

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

10

How Data is Transmitted

Wirelessly

Communication Modes
Active: the target and initiator devices have
power supplies and can communicate by
alternate signal transmission
Passive: the initiator device generates radio
signals that power the target device (EMF), and
the target device responds by modulating the
electromagnetic field

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

12

Communication Modes
PASSIVE MODE

PEER-TO-PEER

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

13

Communication Modes
Modes of Operation:
Read/Write: the NFC enabled device can read or
write data to and supported tags
Peer to Peer: two NFC-enabled devices can
exchange data with each other (small files or
digital photos
Card Emulation: the NFC-enabled phone acts as
a reader when in contact with tags or can act as
a tag for existing readers
RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

14

Technology
PASSIVE MODE

ACTIVE/PEER-TO-PEER

TRX radiates 13.56MHz RF

Coil antenna

Both radiate 13.56MHz RF

Half-duplex, single carrier

RF powers the circuit in a

smartcard/tag
Smartcard then sends/receives
data
Momentarily short-circuits antenna, AM
carrier

RF Collision Avoidance
Polls ever n milliseconds
Checks RSSI (RX Signal Strength Indicator)

Data rates of 106, 212, and 424

kbps
848 kbps in development

Changes in load detected by device

Decodes data based on time interval
ISO14443 Smartcards

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

15

Technology

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

16

Regulation
New Radio Standard not yet available*

Unlike Bluetooth, no pairing

code is needed, and because it's
very low power, no battery in
the device being read

Standards
NFC-A
106 kbps
Miller Delay Encoding
Amplitude Modulation at 100%
High & low bits (100% vs 0 %)

ISO/IEC 14443 Type A

NFC-B
106 kbps
Manchester encoding
AM at 10%
High bit 100%, low bit 90%

NFC-F
Faster RFID TX known as FeliCa
Subway tickets, credit card payments,
identification, etc
212/424 kbps

JIS X 6319-4

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

18

Consumer Applications

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

19

Consumer Application:
Mobile Pay
In the future, payments will be done using our phones.
Retailers such as Target, Macys, and Walgreens already have
NFC based contactless pay terminals, making mobile
transactions simple.

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

20

Consumer Application:
Mobile Pay
Apple Pay:
Allows you to pay with either your phone, watch, or tablet
in a safe and simple manner
Accepted at over 200,000 stores currently
6 major banks already participating

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

21

Consumer Application:
Ticketing
An NFC-enabled phone can be used in a ticketing application
to replace physical tickets
London and France have been using NFC technology for
public transit such as train tickets

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

22

Consumer Application:
Ticketing

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

23

Consumer Application:
Sharing Info
Some phones now have the capability to share data through
NFC. This data includes webpages, photos, contacts, and
more.

24
RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

Consumer Application

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

25

Medical Applications
Keep track of patients
and appropriate
treatments
Medication tracking
system based on patient
wristbands
Attractive due to security
based on the TX distance
Authentication for implanted
devices
Diagnostics and monitoring

FITBIT

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

26

Medical Applications

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

27

NFC Enabled Wireless

Charging
Since NFC already facilitates power transfer
and bidirectional communication in the
same implementation
Why not add-on to the existing NFC
operating modes that implements charging
power transmission and charging power
reception

Use Cases

Charging power reception

via NFC: NFC-enabled
devices are charged via
their NFC interface by a
specific wireless charger
that doesn't implement
conventional NFC operating
modes

Charging power
transmission via NFC: NonNFC devices (e.g., a wireless
mouse) are charged via
their specific charging
interface by the NFC
interface of another device
(e.g., a laptop PC)

Charging power
transmission and reception
via NFC: NFC-enabled
devices (e.g., a cell phone)
are charged via their NFC
interface by the NFC
interface of another device
(e.g., a laptop PC).

Advantages
Making wireless charging easier
believed to mitigate the problem of the gap between battery capacity and
device power consumption

Not a technology to transfer energy but for purposes of secure

communication between objects that are transferring energy
Both the NFC and the WPC Qi specification are based on inductive
coupling between antenna coils with tuning networks
Already very similar in function!

Problems with
Implementation
The distance between the devices during NFC
interactions is longer than in wireless charging use
scenarios
Charging efficiency requires proximity between the
devices
Influences the mechanical design and antenna placement

Problems with
Implementation Cont.
Power Difference between NFC and Wireless Charging
The input power level to the antenna circuit of an active
NFC device is 100750 mW
one order of magnitude lower than the WPCs Qi Low Power
specification.

But Increasing the power level of NFC has implications

RF specification and design
thermal design
the specific absorption rate (SAR) of RF fields by the
human body
other personal safety issues.

Convenience & Efficiency

Low-power NFC charging:

The maximum charging
power is 100 mW to as
much as 400500 mW,
depending on the antenna
sizes and chip technology.

High-power NFC charging:

The maximum charging
power is increased to even
several watts, which also
makes charging of typical
mobile handsets convenient.

Security
Eavesdropping
NFC channel can be intercepted

Data Corruption
Denial of service attack from
interceptor

Data Modification
Attacker changes valid message
with incorrect data

Data Insertion
Data penetration

Man-in-Middle Attack
Third party listener
RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

34

Security Relay Attack

Relay Attack
Range extension of the
contactless communication
channel
Reader Device (mole)
Card Emulator (proxy)
Fast Communication Channel

Cannot be prevented with

application-level cryptography

Mole enters proximity to card

under attack
Card emulator brought into
proximity of reader
Commands now forwarded to mole
Mole forwards to card under attack
Card replies
Fuzzing
0xFFFFFFE & 0xFFFFFFF
Crashes device, force powers down

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

35

Security Relay Attack

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

36

Security Relay Attack

Defenses
Shielding the cards RF with a Faraday Cage
Card could contain additional circuitry
Physical activation and deactivation

Require pin/multiple authentication

Measure distances between card and reader

Google responded to the phishing vulnerabilities

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

37

Security Defenses
Eavesdropping:
Low range and extremely low power Secure channel

Data Corruption:
Detect RF fields for RSSI, easily countered

Data Modification:
Possible, but protection can be achieved by varying Baud rate

Data Insertion:
Possible if within response time of TX/RX

Man-in-Middle Attack:
Practically impossible due to 5cm range
RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

38

A Future With NFC

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

39

Advantages/Disadvantages
ADVANTAGES

DISADVANTAGES

Convenient

Low data rates

Very easy to use

Can replace credit cards

Not ideal for media streaming

Limited range: 10cm

Versatile

Skepticism

Multifunction
Cheap to implement

Company adoption

Safe
Low range means less likely to be
intercepted

Not widespread in NA

Security holes

No spectrum issues

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

40

Conclusion
NFC is expanding
$110B in Transactions by 2017
1.75B NFC enabled mobile
phones

All wireless has security

issues

Low range may be limiting

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

41

Questions?

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

42

References:
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=6861328&queryText%3DNFC
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=6734919&queryText%3DNFC
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=5066549&queryText%3DNFC
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=6428872&queryText%3DNFC
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=6176332&queryText%3DNFC
http://ezproxy.stevens.edu:2109/stamp/stamp.jsp?tp=&arnumber=6482441
http://www.nearfieldcommunication.org/history-nfc.html
http://arstechnica.com/gadgets/2011/02/near-field-communications-a-technology-primer/
http://www.research.philips.com/password/download/password_24.pdf
http://www.eurasip.org/Proceedings/Ext/RFID2007/pdf/s1p4.pdf
http://www.nxp.com/techzones/nfc-zone/overview.html

RNADLER, VCONRAT, DSAVINSKIY - EE441 NFC

43

Other Sources
http://www.adafruit.com/datasheets/Introduction_to_NFC_v1_0_en.pdf
http://electronics.howstuffworks.com/near-field-communication.htm
http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5958681
http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=http://www.nearfieldcommunication.org/5116794
http://en.wikipedia.org/wiki/Near_field_communication
http://www.cnet.com/how-to/how-nfc-works-and-mobile-payments/
http://nfc-forum.org/wp-content/uploads/2013/12/NFC-in-Public-Transport.pdf
http://www.htc.com/us/support/htc-one/howto/365721.html
http://blog.clove.co.uk/2012/06/20/near-field-communication-nfc-explained-the-complete-guide/
http://www.electronista.com/articles/11/09/29/nfc.revision.allows.peer.to.peer.message.sending/#ixzz1Zuj6DGxH
http://nfc-forum.org/news/pr/view?item_key=088d874025e1049cd9c772ea508f4630ebf079b8
http://www.techradar.com/us/news/phone-and-communications/what-is-nfc-and-why-is-it-in-your-phone-948410
http://skyrfid.com/RFID_Tag_Read_Ranges.php
http://www.quandmedical.com/products/home.htm
http://www.juniperresearch.com/viewpressrelease.php?pr=353