Experimental Procedure: Short-Range Tests

The experimental setup is shown in Figure 1.  An MPR5000 PC-card-based UHF reader, obtained from WJ Communications (now part of TriQuint Semiconductor) was operated under a slightly modified version of the Python interface MPRGUI.  A 6 dBi linearly-polarized patch antenna was connected by a short cable to the reader.  A standard commercial UHF passive tag was placed between the reader and a simple half-wave wire dipole receiver antenna, initially at a distance of about 1.5 meters (but longer distances were also tested, as described below).  The receiver was an MPR reader modified for use as a channel sniffer:  the transmitter is disabled and the converted baseband I and Q (in-phase and quadrature) signals are extracted for display on an Agilent digital oscilloscope.

Figure 1: schematic depiction of test setup.

Both readers were run at a fixed radio channel (nominally 920.8 MHz here). This is an important aspect of the test to take note of.  A normal commercial UHF reader in the United States is obligated to hop no less often than every 0.4 seconds (see the discussion of RFID frequency bands for more information).  If we attempted to perform the same operation on such a radio, using a fixed-channel receiver, we would intercept only one out of every 50 packets.  Clearly it is much more convenient for testing purposes to fix the transmit frequency.  Note that such operation is technically illegal without a license, though normally permitted for research purposes where reasonable precautions are taken to minimize interference with other unlicensed users (as was the case here).   A photograph of the test setup is shown in Figure 2.  The reader antenna and the sniffer antenna are rotated to minimize cross-coupling, to make it easier to see the modulated signal from the tag.  In an anechoic environment the two antennas would be cross-polarized (one horizontal, the other vertical); in this case, with lots of junk close to the antennas, the polarization angles were empirically adjusted for minimum coupling.

Figure 2:  actual test setup.

The inventory setup is shown in Figure 3; the parameters are typical for an 18000-6C (EPC C1G2) tag.   The nominal output power of the reader was 25 dBm (about 300 mW).  The session is set to 0, so that the tag can be inventoried repeatedly (the Session flag is reset to A after each inventory).  The starting value of Q, Qst, is also set to 0, so that the tag can be expected to respond to each inventory attempt.

Figure 3:  test setup.

Results

A typical example of an intercepted signal is shown in Figure 4.  Recall that the reader is sending an amplitude-modulated,  pulse-interval-encoded signal, and the tag responds with the FM0 variant of frequency-shift keying.  It is very easy to see that we've intercepted both signals.

Figure 4: reader signal and tag response.

To demonstrate that the received signal is interpretable, we show a closeup in Figure 5.   The tag sends twelve FM0 '0' symbols (the pilot tone), followed by the symbols 1010(v)1, where (v) indicates a violation of the FM0 rules -- in this case, an anomalously long time in a constant state.  These features are readily discernable in the displayed signal.

Figure 5: closeup of tag response to reader query.

The amplitude of the tag signal is observed to vary from time to time; an example is shown in Figure 6, which depictes a complete exchange between a reader and tag (that is, the reader issues a Select command and a Query, the tag responds with a random number RN16, the reader acknowledges the random number, and the tag provides its protocol control word (PC) and unique identifier (EPC).  It is apparent that the RN16 from the tag has a small and variable amplitude; the PC+EPC, on the other hand, appears to have a large and constant amplitude.

Figure 6: an intercepted inventory exchange.

The origin of this curious behavior becomes apparent in Figure 7, which depicts BOTH the in-phase and quadrature channels.  Recall that these are simply the downconverted signals offset by 90 degrees in phase.  The I response is reduced in amplitude and somewhat variable, whereas the Q signal has a large and constant amplitude (limited by the sniffer radio's receive chain).

Figure 7: I (green) and Q (yellow) tag responses.

Long-Distance Intercepts

OK, let's face it:  an attacker who has to locate their receiver within a meter or two of the reader faces a significant risk of discovery.  A user with open eyes should be secure enough.  So what about longer distances?  In a second set of measurements, the sniffer was popped on a cart and moved to a more remote location past a typical indoor partition wall, as shown in Figure 8.

Figure 8:  The intercepting antenna was moved to a distance of 7.5 meters from the reader, with an intervening interior partition wall.

Figure 9:   remote setup; the receive dipole antenna is behind the oscilloscope.

The received signal amplitude was significantly reduced, but the signal-to-noise ratio was still large at the remote site (Figure 10).    To demonstrate that the signal was still intelligible, a complete tag reply was deciphered manually (Figure 11), with the expected result: Decode: Pilot tone Preamble 0011 0000 0000 0000        30 00 0011 0000 0000 1000        30 08 0011 0011 1011 0010        33 b2 1101 1101 1101 1001        dd d9 0000 0001 0100 0000        01 40 0011 0101 0000 0101        35 05 0000 0000 0000 0000        00 00    (and CRC follows)

Figure 10:  I and Q tag signals for a 16-bit random number from the tag, received at > 7 meters through a wall.

Figure 11:   decoding a full tag signal intercepted at > 7 meters.

Discussion and Conclusions

	www.enigmatic-consulting.com