RFID Security - Part 2: RFID data communications

[Part 1 offers an overview of RFID radio basics, security in general and RFID architecture.]

24.6 Data Communications
In the next few sections we'll look in detail at the data the tags are carrying, and how some of the more popular protocols work when they communicate the data to the reader. We'll also talk about the physical format of the cards, and how physical form can be adapted to the particular job.

24.6.1 Tag Data
Depending on the type of tag, the amount of data it can carry is anything from a few bytes up to several megabytes. The amount of data carried by a tag depends on the application and the individual tag.

The data carried in a tag can be in most formats, as long as both the tag and the reader agree on it. Many formats are proprietary, but standards are emerging. In the next section, we look at the Electronic Product Code™ (EPC™). The EPC™ is considered the RFID replacement for the Universal Product Code (UPC) barcode and, as such, will have a huge impact on retail sales in the future.

The UPC bar code has been the accepted means of conveying pricing at the POS in retail stores since the 1970s (see Figure 24.5). This particular UPC is from Syngress Publishing's WarDriving: Drive, Detect, Defend.

Each UPC bar code contains basic information about the bar coding system, the manufacturer, the item, and a check digit. Because 5 digits are used for both the manufacturer and the item, the total number of manufacturers is limited to 100,000, each limited to 100,000 items. While this allows for 10,000,000,000 products, it is more restrictive than is obvious.

As manufacturers add new items and close out old product lines, UPC numbers are quickly being used up. The UPC does not allow serial numbers to be encoded into the bar code.

24.6.1.1 Electronic Product Code
The new Electronic Product Code uses the EPCglobal organization's General Identifier (GID-96) format. GID-96 has 96 bits (12 bytes) of data.

Under the GID-96 standard, every EPC™ consists of three separate fields: the 28-bit General Manager Number that identifies the company or organization; the 24-bit Object Class that breaks down products into groups; and the 36-bit serial number that is unique to the individual object. A fourth field consisting of an 8-bit header is used to guarantee the uniqueness of the EPC™ code (see Table 24.1). EPCglobal is a not-for-profit worldwide organization that assigns EPC™ to subscribers.

Each company or manufacturer is assigned a General Manager Number from EPCglobal. Each manufacturer assigns an Object Class number to each product line. Each individual item is identified by a Serial Number. Manufacturers can assign the product number and the serial number in any way they deem desirable. Potentially, this allows the manufacturer the ability to uniquely identify every single item.

This allows for a total of 30,939,155,745,879,204,468,201,375 unique items under the EPC™ system.

The EPC™ standards for data tags can be downloaded from:

www.epcglobalinc.org/standards_technology/EPC_Tag%20Data%20Specifi cation%201.1Rev%201.27.pdf.

24.6.2 Protocols
RFID systems work when a reader antenna transmits radio signals. Those signals are picked up by the tag, which answers with a responding radio signal (see Figure 24.6).

That signal is then read by the reader's receiver. Depending on the tag's computational power (if any), the tag may perform some encryption or decryption functions.

Some tags are "read-only," while other tags have data "written" to t hem a nd "read" from them. Using a process similar to the "read" cycle, the reader can "write" data to the tag if it a data "write" operation is needed.

Some tag protocols are proprietary, but EPCglobal and the International Organization for Standardization (ISO) have defined several protocols (see Table 24.2).

ISO also has standards for supply chain applications, tag and reader performance and conformance, and product packaging tagging standards.