0
\$\begingroup\$

In RFID Technology, usually there is a reader, and RF tag that contains an unique serial number and optionally storage technology.

In the field of access management there are the the fundamentally different solutions:

1.) UID-Based

In these Systems, usually the RFID Tag only contains an unique number that is linked internally in the system to a data. This is generally used for access management in leisure sector or wherever you don't need hard security because for example a ticket can only be redeemed once, even if you made 5 clones of it.

2.) Data Based

In these Systems, the RFID Tags are encrypted with good encryption (e.g. Mifare DesFire) and contain valuable information, for example access parameters for facility doors.

To protect your solution against tags from different manufacturers, you can encode a customer ID to the UID-Based systems that is checked by the reader if the card is from a "genuine supplier" or not. In Data based systems, different manufacturers cannot supply cards because they don't know the encryption.

In both cases, the problem is, that all major RFID Solution (Mifare, NTag, etc) do not allow protection of the UID itself, so even if you encrypt your tags, someone can read the UID with any reader. This allows "reuse" of tags for another system supplier, if their system is UID based

Are there any RFID Card technologies, that need a password/key to read out the UID? If the password is incorrect, it should act like there is no card present at all

\$\endgroup\$
4
  • \$\begingroup\$ Aren't DESFire cards NFC, rather than RFID? \$\endgroup\$
    – Polynomial
    Commented Jan 1, 2021 at 23:47
  • \$\begingroup\$ I do not understand what problem arises from the reuse of tags in other applications? \$\endgroup\$
    – Stefan Wyss
    Commented Jan 2, 2021 at 17:37
  • \$\begingroup\$ "Are there any?" questions do not meet the stack exchange requirement for specificity; essentially, they are shopping questions. There are certainly ways to accomplish your goal using cryptographic techniques such as signatures, etc. But identifying something which does so is not within the mission of this website. \$\endgroup\$
    – Chris Stratton
    Commented Jan 2, 2021 at 20:20
  • \$\begingroup\$ @StefanWyss the problem lies in reusability, which gives a price different suppliers a major price edge if they are "replacing" the current system. A Mifare Classic card costs around 1$ at the factory. It makes a very big difference in costs, if a different supplier can reuse cards, or have to offer 50k pcs of new cards because he cant reuse the cards. \$\endgroup\$
    – sgt_johnny
    Commented Jan 5, 2021 at 6:03

1 Answer 1

Reset to default
1
\$\begingroup\$

The UID can be read out from all major RFID card technologies that I know of. But there are cards that provide a random UID for some time (Bluetooth does the same in order not to be able to track e.g. a mobile phone by the BLE UID).

\$\endgroup\$
1
  • \$\begingroup\$ Thank you, this seems to help. I've did a search about this. This would suit my question since a "own" UID can be encoded to the data blocks that only can be accessed with keys \$\endgroup\$
    – sgt_johnny
    Commented Jan 5, 2021 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.