RFID and NFC

How RFID Works

RFID systems consist of three components: a reader (interrogator), an antenna, and tags (transponders). The reader transmits radio waves through its antenna; tags containing a microchip and antenna respond by backscattering or modulating the signal with their stored data. The reader's antenna sends an RF signal that energizes passive tags (or activates active tags), which then transmit their stored identification data back to the reader.

The reader-tag communication uses one of two coupling mechanisms depending on frequency and range:

• Inductive coupling (LF/HF): The reader coil generates a magnetic field that induces a current in the tag coil via Faraday induction. Effective range is limited to the near-field region (within one wavelength). At 13.56 MHz (wavelength 22.1m), the near-field boundary is approximately 1–2 meters
• Electromagnetic coupling (UHF/microwave): The reader transmits a propagating electromagnetic wave that the tag antenna captures. The tag modulates and reflects (backscatters) the signal. Effective range extends to 10–15 meters. At 915 MHz (wavelength 32.8 cm), the far-field begins at approximately 0.5 meters

RFID Tag Types

• Passive Tags: No battery, powered entirely by the reader's RF energy via electromagnetic induction or backscatter coupling. Typical read range: LF 1–2 cm, HF 10 cm, UHF 1–12 m. Extremely small (grain-of-rice) and inexpensive ($0.05–$0.10 per tag in volume). Lifetime exceeds 10 years (no battery to deplete)
• Active Tags: Battery-powered (typically lithium coin cell, 3–10 year life). Broadcast periodically or on-demand. Read range 100+ meters. Larger form factor (credit card size or larger). Used for high-value asset tracking and vehicle identification
• Battery-Assisted Passive (BAP): Small battery (3V lithium) powers the tag chip for signal processing and memory, but communication still relies on reader's RF field for backscatter. Improved sensitivity enables 15–30m range. Used in pharmaceutical tracking and cold chain monitoring
• Semi-passive: Battery powers chip and sensor (temperature, humidity) for logging, but communication uses reader's RF field. Used in supply chain monitoring where environmental data is critical

RFID Frequency Bands — Detailed

LF (125–134 kHz)

Low frequency RFID operates at 125 kHz (read-only) or 134.2 kHz (read-write, ISO 11784/11785). The LF band offers excellent penetration through liquids, metals, and biological tissue, making it ideal for:

• Animal identification: ISO 11784/11785 defines the FDX-B protocol for livestock and pet microchips. Each chip stores a 15-digit ID number. Read range: 1–2 cm. Over 500 million animals identified globally
• Access control: Proximity cards operating at 125 kHz (EM4100, HID Prox) with fixed 64-bit or 126-bit IDs. Read range: 2–10 cm. Unencrypted — easily cloned with $20 reader/writer devices
• Immobilizer systems: Automotive anti-theft transponders (Hitag2, Texas Instruments) at 125 kHz. Challenge-response authentication with 48-bit or 96-bit keys. Embedded in the key fob or key head
• Industrial: Tagging tools, laundry, and waste bins where proximity operation is acceptable

HF (13.56 MHz)

High frequency RFID is the dominant frequency for contactless smart cards and NFC. Operating at 13.56 MHz with data rates of 106–848 kbit/s (ISO 14443) or 26.48 kbit/s (ISO 15693), HF RFID enables:

• NFC payments: Apple Pay, Google Pay, and contactless credit/debit cards use ISO 14443 Type A (NXP MIFARE) or Type B chips. Transaction time: <500 ms. Over 10 billion NFC-enabled devices deployed globally
• Smart cards: Building access, transit cards (Oyster, MetroCard), and electronic passports (ICAO 9303). MIFARE DESFire EV2/EV3 uses AES-128 encryption for mutual authentication
• Library/book tagging: ISO 15693 Vicinity Cards with 1–1.5m range for inventory management. NXP ICODE SLIX chips store 256-bit user memory
• Healthcare: ISO 15693 tags on medication packaging for track-and-trace compliance. FDA Drug Supply Chain Security Act (DSCSA) mandates RFID for pharmaceutical authentication

UHF (860–960 MHz)

Ultra High Frequency RFID is the workhorse of supply chain management. Operating at 860–960 MHz (regional sub-bands: 865–868 MHz EU, 902–928 MHz US, 952–954 MHz Japan), UHF tags achieve read ranges of 1–12 meters with data rates of 26–640 kbit/s.

• EPC Gen2 (ISO 18000-6C): The dominant UHF standard. Tags use 96-bit EPC (Electronic Product Code) with 64-bit or 96-bit UII (Unique Item Identifier). Anti-collision: Q-algorithm with dynamic slot selection handles 100+ tags per second. Tag sensitivity: −18 to −22 dBm (passive)
• Supply chain: Walmart, Amazon, and major retailers mandate EPC Gen2 tags on pallets and cases. Item-level tagging enables real-time inventory visibility, reducing out-of-stock losses by 15–30%
• Rain RFID: Impinj Monza chips achieve sensitivity of −24 dBm, enabling 15+ meter read range. Dense-reader mode (DRM) prevents reader-to-reader interference in warehouse environments
• Tag IC power budget: Passive UHF tags harvest approximately 10–100 μW of RF energy at maximum range. The tag IC must operate on this power — the power sensitivity determines read range. Modern UHF tag ICs (NXP UCODE 8, Impinj Monza R6) operate at 0.3 μW sensitivity

Backscatter Modulation

Passive RFID tags communicate by modulating their radar cross-section (RCS). The tag antenna presents two different impedances — matched (absorbing energy) and mismatched (reflecting energy) — controlled by the tag IC's switching transistor. By rapidly alternating between these states, the tag modulates the reflected signal with its data. The reader detects these small changes in the backscattered signal amplitude or phase.

The backscatter signal is extremely weak — typically −70 to −90 dBm at the reader when the tag is 10 meters away. The reader must transmit 20–30 dBm (100–1000 mW) to illuminate the tag, and the tag reflects only a tiny fraction of that power. This fundamental power limitation determines the maximum read range of passive systems.

NFC: RFID for Consumer Devices

Near-Field Communication operates at 13.56 MHz and enables two-way communication between devices within 10 cm. NFC evolved from RFID standards (ISO 14443) but adds peer-to-peer mode and higher data rates. NFC is defined by the NFC Forum (founded 2004 by Nokia, Philips, Sony).

• Card Emulation (CE): Phone acts like an RFID card for payments and access control. Secure Element (SE) or Host Card Emulation (HCE) stores payment credentials
• Reader Mode (PCD): Phone reads NFC tags (smart posters, product info, transit cards). Supports ISO 14443 Type A/B and ISO 15693
• Peer-to-Peer (P2P): Two phones exchange data at 106–424 kbit/s. Used for Android Beam (deprecated), business card exchange, and device pairing

Common Applications

• Payments: Contactless credit/debit cards, Apple Pay, Google Pay
• Access Control: Building entry badges, hotel keycards
• Supply Chain: Pallet/case tracking, Walmart/System #1 mandates
• Animal ID: Pet microchips, livestock tracking
• Transportation: E-ZPass toll collection, transit cards
• Passports: E-passports with encrypted data storage
• Sports Timing: Marathon timing chips

Security and Privacy Concerns

RFID raises legitimate privacy and security concerns:

• Eavesdropping: Tags can be read at distance without consent. UHF tags readable at 10+ meters; HF tags at 1+ meter. Unauthorized readers in public spaces can silently collect tag data
• Cloning: Simple LF/HF RFID tags (EM4100, basic MIFARE Classic) can be copied with $20–100 reader/writer devices in seconds. The MIFARE Classic Crypto-1 cipher was broken in 2008
• Skimming: Criminals can capture payment card data from contactless cards by holding a concealed reader near a victim's pocket or bag. Range: 1–5 cm for HF, up to 3m for UHF
• Tracking: Unique tag serial numbers enable persistent tracking of individuals (via embedded tags in clothing, transit cards) or items (tracking product ownership)
• Relay attacks: An attacker relays communication between a legitimate reader and a distant tag, making a remote tag appear nearby. Demonstrated against contactless payment cards and RFID passports

Modern systems address these with AES-128 encryption (Gen2V2), challenge-response authentication (ISO 14443-4 T=CL protocol), Faraday cage shielding (RFID-blocking wallets), and kill commands (EPC Gen2 kill command permanently disables tags).

Electronic Product Code (EPC)

The EPC, developed by the MIT Auto-ID Center in 1999, provides a unique numbering scheme for physical objects, enabling item-level identification across global supply chains:

• 96-bit EPC: Header (8 bits) + manager number (28 bits, identifies company) + object class (24 bits, identifies product type) + serial number (36 bits, unique per item). Total capacity: 268 million companies × 16.7 million products × 68 billion serial numbers
• SGTIN-96: Serialized Global Trade Item Number. Encodes GTIN-14 (from barcode) plus unique serial number. Replaces linear barcodes with RFID for item-level tracking
• EPCglobal Network: Object Naming Service (ONS) resolves EPCs to product information servers. EPC Information Services (EPCIS) stores and shares event data (what, where, when, why). Enables supply chain visibility from factory to consumer