Search

The Chameleon Mini is a portable device that interfaces with the NFC protocol over RFID. This device is designed to facilitate on-the-fly logging of data exchanges between contactless cards and tag readers operating over NFC in the 13.56 MHz band. It is an indispensible tool for researchers, reverse engineers and system penetration testers that perform security analysis over the protocol. The Chameleon Mini also supports emulation of many contactless card types over NFC that are enabled by contributions to its open source embedded firmware. In 2020, we set out to offer a fully functional open source implementation to provide a frequently requested interface to the complex and proprietary DESFire tag command set and internal architecture specification from within the open source firmware for the Chameleon Mini RevG. In this application note, we describe the technologies utilized, applications of this work, and describe the challenges of the low-level implementation of the embedded software.

Smart card data contains a lot of useful information, so both of urban bus and intercity bus are built up the contactless smart card system in Taiwan. Although smart card data can offer useful information, it’s still limited to how the passengers are being charged. This paper focuses on the estimation of the destination of the passenger who takes the bus twice a day and presents an algorithm to estimate the destination location for each individual boarding of the bus with a smart card. To evaluate the accuracy of destination estimation algorithm, this paper selected Taichung urban bus which uses mileage charges as a case study area. According to the results, the estimated accuracy is 63% with the 600 m tolerance distance (allowable walking distance), after considering 500 m of the value of tolerance distance error the accuracy increases to 90%.

This paper focuses on relay attacks against EMV based contactless payment cards. EMV is a standard for payments via smart cards. In a typical relay attack on contactless cards, the attacker launches the attack by relaying the legitimate user’s card information to another malicious device, in proximity to the verifier. This technique is used by the attacker to burglarize money from the victim’s card. Designing an efficient distance bounding protocol is a promising solution to defeat relay attacks. We study the dominant payment protocols in EMV contactless cards (Visa’s payWave, Mastercard’s PayPass, and PaySafe) and identify the existing vulnerabilities in these protocols. A practical relay attack on the latest EMV payment protocol - PaySafe is performed. Contactless payments are fast becoming a key instrument in the payment industry, and the future technologies must aim towards convenience and security. We propose a light weight protocol that suits well with the current EMV specification. Our protocol is based on LFSR, which supports exchange of a small string of bits through a time critical channel.

This chapter examines the historical use of technology in smart cards and the trends in the future. It considers the options that are available, the choices that must be made with a smart card scheme, the issues that affect the design of the card and its applications. The influence of consumer demand is discussed and the drivers that will define the use smart card technology in the future.

In this chapter, a description of the various attacks and countermeasures that apply to secure smart card applications is described. This chapter focuses on the attacks that could affect cryptographic algorithms, since the security of many applications is dependent on the security of these algorithms. Nevertheless, how these attacks can be applied to other security mechanisms is also described. The aim of this chapter is to demonstrate that a careful evaluation of embedded software is required to produce a secure smart card application.

For universities where security is primordial and accessing to certain areas must be checked, an access control system should be used in order to enhance security in general and to reduce time-consuming in access control of an important number of candidates in the same time. RFID and smart cards are widely used technologies; RFID guarantees a simultaneous reading of the identified objects and the smartcards offer a storage capacity and enable processing information. Several problems of security remain still unresolved for both RFID and smart card used separately. We present in this paper a solution of access control, which combines specific identification and authentication technologies with synchronous and asynchronous data processing. In our case, we target the academic context. We demonstrate by two use cases how much the system security could be improved by combining RFID and Smartcards in a complementary way. For this purpose, the design of our system focuses in the first scenario on performing the verification of the presence of students in exams by using both synchronous and asynchronous techniques based on the coupling of RFID and smart card technologies. The second scenario focuses on the security of accessing sensitive areas by providing a synchronous verification method requiring immediate validation of the access based on RFID technology and the fingerprint of staff. Further technologies are also used to ensure accurate authentication, such as cameras and liveness sensors.

Advanced centralised access control (CAC) systems are widely deployed on campuses as a means to provide security and track movements. There is concern that some campuses are not using such protective systems, hence this paper attempts to resolve this weaknesses in such institutions’ by developing a simpler CAC system using the Radio Frequency (RF) and contactless smart card technologies. The scope of the developed system is not only limited to access control but also to utilise the gathered data to automate and potentially to support other processes of the institution, such as lecture scheduling and attendance tracking.

Contactless devices and smart cards have been widely in use in daily life transactions for a long time. At first, those systems were designed to work fully offline for both the reader and the card side. With technological improvements, Internet connection can be available even in very small embedded devices (IoT devices). As a result, current systems have connected devices as a part of the transaction design and so keeping the system operational all the time relies on the availability of continuous Internet connectivity of such devices. After the invention of NFC technology, contactless cards in our wallets are being replaced with virtual cards in mobile handsets. Regular contactless cards never had the capability to connect the Internet, whereas almost all of the modern mobile handsets routinely access the Internet. This has resulted in a trend shift in contactless transaction designs. Offline verification operations are being replaced with online operation where the system uses the connection capabilities of the mobile handset. However, the connection capability either in the mobile handset or in the transaction acceptance reader is not completely stable yet to rely on. Therefore, in this paper, we examine such connection loss problems in IoT devices and we offer a connection sharing mechanism through NFC so that the transaction can be completed if either one of these two entities has the Internet connection. Our proposed mechanism covers both reader-card communication and also peer-to-peer communication of NFC.

This paper describes a novel antenna design for communicating with ISO/IEC 14443A RFID cards at larger distances than the normal 5-10 cm. The set-up consists of two antennas, one to activate the card at the normal frequency of 13.56 MHz, and another to receive its response at the higher harmonic frequency of 40.68 MHz. The strong field required to power the card at larger distances is likely to drown out its response. By detecting the higher harmonic frequencies originating from the card's response this problem is solved, making communication at larger distances possible. The two antennas, placed 100 cm apart, form an RFID gate that can communicate with cards in the middle of the gate. This is a substantial improvement of the maximum skimming distance of 25 cm reported in literature.

This paper introduces a new cardholder verification method using a multi possession-factor authentication with a distance bounding technique. It adds an extra level of security to the verification process and utilizes the idea of distance bounding which prevents many different security attacks. The proposed method gives the user the flexibility to add one or more extra devices and select the appropriate security level. This paper argues that the proposed method mitigates or removes many popular security attacks that are claimed to be effective in current card based payment systems, and it can help to reduce fraud on payment cards. Furthermore, the proposed method provides an alternative verification technique and enables cardholders with special needs to use the payment cards and make the payment system more accessible.