Louis Yi, Mary Ruthven, Kevin O‘Toole, & Jay Patterson

We made an Radio Frequency ID (RFID) card reader and, while attempting to create a long-range spoofer, created an jammer which overcomes card‘s signals.

The reader uses filtering circuitry following a 125kHz driven resonator to produce the returned FSK signal from the HID brand RFID proximity cards used around Olin college. Reading was initially performed by capturing data with an oscilloscope and then processing in MATLAB, but was eventually implemented on an FPGA using Verilog.

Reading the cards provided the binary data we attempted to reproduce with the RFID spoofer. Trying several transmission hardware designs and many encoding methods failed to yield a successful RFID activation. We discovered while testing that sending similar signals at high amplitudes blocked real RFID cards, effectively jamming them and locking the door.

RFID systems are currently and increasingly a part of our lives. We use them at school, at work, and on the roads for fare collection in systems like the Northeast‘s E-ZPass. Frighteningly, many online papers and our own experiments show, they‘re not very secure. Personal data stored on such cards is available to anyone nearby with a suitable, inexpensive RFID reader.

We were curious about the technology involved and whether we could implement a full RFID system. Also, Eric really wanted an RFID gun, which we are disappointed to say we couldn‘t deliver.

The RFID protocol of communication is a nesting of three different encodings: Backscattering of a carrier frequency, Frequency Shift Keying, and Manchester encoding. 

The RFID reader outputs a constant 125kHz signal to all nearby tags, amplifying the signal when it detects any reflected signal. Since an RFID tag is passive, it needs to send back a signal without drawing any power itself. Using the sent signal as both a power source and a clock, the RFID tag flips a transistor in a predefined sequence (a black box described in the Frequency Shift Keying section) to send a sequence of HIGH and LOW values through the backscattered signal back to the reader.

On top of this encoding, HIGH and LOW signals are determined by the frequency of the backscattered ONs and OFFs. In Frequency Shift Keying, which is used by Olin’s Prox Cards, switching from ON to OFF at a rate of 12.5kHz (period every 10 cycles of the carrier frequency) denotes a LOW signal, and switching from ON to OFF at a rate of 15.6kHz (period every 8 cycles of the carrier frequency) denotes a HIGH signal. Thus the HIGH and LOW digital signals are encoded by The advantages of this encoding is that it is computationally simpler and less susceptible to noise than traditional pulse-amplitude modulated signals. Because only takes two frequencies to send a message, proper filtering can ensure the system is only susceptible to white noise around those two frequencies. Additionally, no channel equalization or phase calibration is needed, since the decoding method simply calculates the distance between peaks, and determines if it is closer to 12.5kHz or 15.6kHz. The HIGH and LOW frequencies are switched between according to a predetermined signal, a black box determined by the Manchester encoding of the tag’s data. 
On top of this encoding, 1s and 0s are encoded and decoded from the highs and lows using Manchester Encoding. Manchester Encoding simply encodes a 1 as (HIGH, LOW) and a 0 as (LOW, HIGH).

Diagram of a decoding of a Manchester-Encoded sequence of HIGH and LOW signals

RFID Reader