A similar technology, the IFF transponder, was invented by the British in 1939 , and was routinely used by the allies in World War II to identify airplanes as friend or foe.
Another early work exploring RFID is the landmark 1948 paper by Harry Stockman, entitled "Communication by Means of Reflected Power" (Proceedings of the IRE, pp1196-1204, October 1948). Stockman predicted that "...considerable research and development work has to be done before the remaining basic problems in reflected-power communication are solved, and before the field of useful applications is explored." It required thirty years of advances in many different fields before RFID became a reality.
Passive RFID tags have no internal power supply. The minute electrical current induced in the antenna by the incoming radio frequency signal provides just enough power for the integrated circuit (IC) in the tag to power up and transmit a response. Most passive tags signal by Backscattering the carrier signal from the reader. This means that the aerial has to be designed to both collect power from the incoming signal and also to transmit the outbound backscatter signal. Due to limited power and cost, the response of a passive RFID tag is brief - typically just an ID number (GUID). Lack of an onboard power supply means that the device can be quite small: commercially available products exist that can be embedded under the skin. As of 2005, the smallest such devices commercially available measured 0.4 mm × 0.4 mm, and is thinner than a sheet of paper; such devices are practically invisible. Passive tags have practical read distances ranging from about 10 mm up to about 6 metres. Due to their simplicity in design they are also suitable for manufacture with a printing process.
Semi-passive RFID tags are very similar to passive tags except for the addition of a small battery. This battery allows the tag IC to be constantly powered. This removes the need for the aerial to be designed to collect power from the incoming signal. Aerials can therefore be optimised for the backscattering signal.
Active RFID tags, on the other hand, have an internal power source which is used to power any ICs and generate the outgoing signal. They may have longer range and larger memories than passive tags, as well as the ability to store additional information sent by the transceiver. At present, the smallest active tags are about the size of a coin. Many active tags have practical ranges of tens of metres, and a battery life of up to 10 years.
Because passive tags are cheaper to manufacture and have no battery, the majority of RFID tags in existence are of the passive variety. As of 2004, these tags cost an average of US$0.40 at high volumes. Today, as universal RFID tagging of individual products become commercially viable at very large volumes, the lowest cost tags available on the market are as low as 7.5 cents eachin volumes of 1 million units or more. Current demand for RFID integrated circuit chips is expected to grow rapidly based on these prices. Analysts from independent research companies Gartner and Forrester Research agreed that a price less than $0.10 (production volume of one billion units) is achievable in 6–8 years, thus limiting near-term prospects for widespread adoption of passive RFID; however, the high demand for the tags from Wal-Mart, DoD, etc., has created a big enough market to support these prices. Other analysts believe such prices are achievable within 10-15 years.
While the cost advantages of passive tags over active tags are significant, other factors including accuracy, performance in certain environments such as around water or metal, and reliability make the use of active tags very common today.
There are four different kinds of tags commonly in use. They are categorized by their radio frequency: low frequency tags (125 or 134.2 kHz), high frequency tags (13.56 MHz), UHF tags (868 to 956 MHz), and Microwave tags (2.45 GHz). UHF tags cannot be used globally as there are no global regulations for their usage.
There are some Transponder devices and contactless chip cards which deliver a similar function.
The purpose of an RFID system is to enable data to be transmitted by a mobile device, called a tag, which is read by an RFID reader and processed according to the needs of a particular application. The data transmitted by the tag may provide identification or location information, or specifics about the product tagged, such as price, color, date of purchase, etc. The use of RFID in tracking and access applications first appeared during the 1980s. RFID quickly gained attention because of its ability to track moving objects. As the technology is refined, more pervasive and possibly invasive uses for RFID tags are in the works.
In a typical RFID system, individual objects are equipped with a small, inexpensive tag. The tag contains a transponder with a digital memory chip that is given a unique electronic product code. The interrogator, an antenna packaged with a transceiver and decoder, emits a signal activating the RFID tag so it can read and write data to it. When an RFID tag passes through the electromagnetic zone, it detects the reader's activation signal. The reader decodes the data encoded in the tag's integrated circuit (silicon chip) and the data is passed to the host computer for processing.
Take the example of books in a library. Security gates can detect whether or not a book has been properly checked out of the library. When users return items, the security bit is re-set and the item record in the Integrated library system is automatically updated. In some RFID solutions a return receipt can be generated. At this point, materials can be roughly sorted into bins by the return equipment. Inventory wands provide a finer detail of sorting. This tool can be used to put books into shelf-ready order.
Since January, 2005, Wal-Mart has required its top 100 suppliers to apply RFID labels to all shipments. To meet this requirement, vendors use RFID printer/encoders to label cases and pallets that require EPC tags for Wal-Mart. These smart labels are produced by embedding RFID inlays inside the label material, and then printing bar code and other visible information on the surface of the label.
Amal Graafstra , a Washington native and business owner, had a RFID chip implanted in his left hand in early 2005. The chip was 12 mm long by 2 mm in diameter and has a basic read range of two inches (50 mm). The implant procedure was conducted by a cosmetic surgeon, although the name of the doctor was not released. When asked what he planned to do with the implant Graafstra responded:
Because I'm writing my own software and soldering up my own stuff, pretty much anything I want. Well, more accurately, anything I have the time and inspiration to do. Ultimately though, I think true keyless access will require an implantable chip with a very strong encryption system; right now I’m only looking at this type of thing in a personal context. — One Small Step For Hand—The Present Tense
It must also be recognised that the storage of data associated with tracking goods down to item level will run into many terabytes. It is much more likely that goods will be tracked at pallet level using RFID tags, and at item level with product unique rather than item unique barcodes.
RFID codes are long enough that every RFID tag may have a unique code, while current UPC codes are limited to a single code for all instances of a particular product. The uniqueness of RFID tags means that a product may be individually tracked as it moves from location to location, finally ending up in the consumer's hands. This may help companies to combat theft and other forms of product loss. It has also been proposed to use RFID for Point of sale store checkout to replace the Cashier with an automatic system which needs no barcode scanning. However this is not likely to be possible without a significant reduction in the cost of current tags. There is some research taking place into ink that can be used as an RFID tag, which would significantly reduce costs. However, this is some years from reaching fruition.
The EPCglobal gen 2 standard was approved in December 2004, and is likely to form the backbone of RFID tag standards moving forward. This was approved after a contention from Intermec that the standard may infringe a number of their RFID related patents. It was decided that the standard itself did not infringe their patents, but it may be necessary to pay royalties to Intermec if the tag were to be read in a particular manner. EPC Gen2 is short for EPCglobal UHF Generation 2.
Also, the FDA recently approved the country's first RFID chips that can be implanted in humans. The 134.2 kHz RFID chips, from VeriChip Corp., a subsidiary of Applied Digital Solutions Inc., can incorporate personal medical information and could save lives and limit injuries from errors in medical treatments, according to the company. The FDA approval was disclosed during a conference call with investors.
Some in-home uses, such as allowing a Refrigerator to track the expiration dates of the food it contains, have also been proposed, but few have moved beyond the prototype stage.
Low-frequency (LF: 125 - 134.2 kHz and 140 - 148.5 kHz) and high-frequency (HF: 13.56 MHz) RFID tags can be used globally without a license. Ultra-high-frequency (UHF: 868 MHz-928 MHz) cannot be used globally as there is no single global standard. In North America, UHF can be used unlicensed for 908 - 928 MHz, but restrictions exist for transmission power. In Europe, UHF is under consideration for 865.6 - 867.6 MHz. Its usage is currently unlicensed for 869.40 - 869.65 MHz only, but restrictions exist for transmission power. The North American UHF standard is not accepted in France as it interferes with its military bands. For China and Japan, there is no regulation for the use of UHF. Each application for UHF in these countries needs a site license, which needs to be applied for at the local authorities, and can be revoked. For Australia and New Zealand, 918 - 926 MHz are unlicensed, but restrictions exist for transmission power.
These frequencies are know as the ISM bands (Industrial Medical Scientific). The return signal of the tag may still cause interference for other radio users .
Additional regulations exist regarding health and environmental issues . For example, in Europe, the Waste Electrical and Electronic Equipment regulation does not allow for RFID tags to be thrown away. This means that RFID tags in cardboard boxes must be removed before disposing of them. This is important because RFID tags disrupt recycling . Health regulations exist as well; see EMF (Electromagnetic field).
Some standards that have been made regarding RFID technology include:
A second security concern is duplication, or "cloning" of RFID tags. When tags do not contain built-in security features, an attacker may be able to scan the tag and "clone" the data into a tag of her own. This is of particular concern when RFID tags are used in high-security applications, such as the proximity cards used to access secure facilities, or vehicle immobilizer anti-theft systems which use an RFID tag embedded in the vehicle key. It is also a problem when RFID is used for payment systems, such as contactless credit cards (Blink, ExpressPay), the ExxonMobil Speedpass, and even in RFID enhanced casino chips. Because many RFID tags can be scanned at a distance and without the tag holder's knowledge, this attack is potentially more serious than attacks on other technologies (e.g., magnetic stripe cards) which require physical access to the token.
Defenses against cloning and tracking typically fall into two categories: those that depend on the limited range and capabilities of the tag's RF circuitry, and those that use cryptographic protocols. A typical example of the "RF-based" defense relies on the fact that passive RFID tags can only be activated by a reader in close proximity, due to the limited transmission range of the magnetic field used to power the tag. RFID manufacturers and customers occasionally cite this limitation as a security feature which (intentionally or otherwise) has the effect of limiting scanning range. However, while this approach may be successful against direct tag scanning, it does not necessarily prevent "eavesdropping" attacks, in which an attacker overhears a tag's response to a nearby, authorized reader. Under ideal conditions, these attacks have proven successful against some RFID tags at a range of more than sixty feet .
A second class of defense uses cryptography to prevent tag cloning. Some tags use a form of "rolling code" scheme, wherein the tag identifier information changes after each scan, thus reducing the usefulness of observed responses. More sophisticated devices engage in challenge-response protocols where the tag interacts with the reader. In these protocols, secret tag information is never sent over the insecure communication channel between tag and reader. Rather, the reader issues a challenge to the tag, which responds with a result computed using a cryptographic circuit keyed with some secret value. Such protocols may be based on symmetric or public key cryptography. Cryptographically-enabled tags typically have dramatically higher cost and power requirements than simpler equivalents, and as a result, deployment of these tags is much more limited. This cost/power limitation has led some manufacturers to implement cryptographic tags using substantially weakened, or proprietary encryption schemes, which do not necessarily resist sophisticated attack. For example, the Exxon-Mobile Speedpass uses a cryptographically-enabled tag manufactured by Texas Instruments, called the Digital Signature Transponder (DST), which incorporates a weak, proprietary Encryption scheme to perform a challenge-response protocol. In 2005, researchers from RSA Labs and Johns Hopkins University reverse engineered the algorithm and were able to clone Speedpass tags .
Still other cryptographic protocols attempt to achieve privacy against unauthorized readers, though these protocols are largely in the research stage. One major challenge in securing RFID tags is a shortage of computational resources within the tag. Standard cryptographic techniques require more resources than are available in most low cost RFID devices. Many security measures have been proposed for RFID in the academic literature. Several low strength cryptographic solutions have been proposed, including hash locks, backward channel XORing, third party privacy agents, and LPN authentication . RSA Security has patented a prototype device that locally jams RFID signals by interrupting a standard collision avoidance protocol, allowing the user to prevent identification if desired. . Various policy measures have also been proposed, such as marking RFID tagged objects with an industry standard label.
The use of RFID technology has engendered considerable controversy and even product boycotts. The four main Privacy concerns regarding RFID are:
Most concerns revolve around the fact that RFID tags affixed to products remain functional even after the products have been purchased and taken home, and thus can be used for Surveillance and other nefarious purposes unrelated to their supply chain inventory functions. Although RFID tags are only officially intended for short-distance use, they can be interrogated from greater distances by anyone with a high-Gain antenna, potentially allowing the contents of a house to be scanned at a distance. Even short range scanning is a concern if all the items detected are logged in a Database every time a person passes a reader, or if it is done for nefarious reasons (e.g., a mugger using a hand-held scanner to obtain an instant assessment of the wealth of potential victims). With permanent RFID serial numbers, an item leaks unexpected information about a person even after disposal; for example, items that are resold or given away can enable mapping of a person's Social network. Another privacy issue is due to RFID's support for a Singulation (anti-collision) Protocol. This is the means by which a reader enumerates all the tags responding to it without them mutually interfering. The structure of the most common version of this protocol is such that all but the last Bit of each tag's Serial number can be deduced by passively Eavesdropping on just the reader's part of the protocol. Because of this, whenever RFID tags are near to readers, the distance at which a tag's signal can be eavesdropped is irrelevant; what counts is the distance at which the much more powerful reader can be received. Just how far this can be depends on the type of the reader, but in the extreme case some readers have a maximum power output (4 W) that could be received from tens of kilometres away. The potential for privacy violations with RFID was demonstrated by its use in a pilot program by the Gillette Company, which conducted a "smart shelf" test at a Tesco in Cambridge. They automatically photographed shoppers taking RFID-tagged safety razors off the shelf, to see if the technology could be used to deter Shoplifting.
In another study, uncovered by the Chicago Sun-Times, shelves in a Wal-Mart in Broken Arrow, Oklahoma, were equipped with readers to track the Max Factor Lipfinity Lipstick containers stacked on them. Webcam images of the shelves were viewed 750 miles (1200 km) away by Procter & Gamble researchers in Cincinnati, Ohio, who could tell when lipsticks were removed from the shelves and observe the shoppers in action.
In January 2004 a group of privacy advocates was invited to METRO Future Store in Germany, where an RFID pilot project was implemented. It was uncovered by accident that METRO "Payback" customer loyalty cards contained RFID tags with customer IDs, a fact that was disclosed neither to customers receiving the cards, nor to this group of privacy advocates. This happened despite assurances by METRO that no customer identification data was tracked and all RFID usage was clearly disclosed.
The controversy was furthered by the accidental exposure of a proposed Auto-ID consortium Public relations Campaign that was designed to "neutralize opposition" and get consumers to "resign themselves to the inevitability of it" whilst merely pretending to address their concerns.
The standard proposed by EPCglobal includes privacy related guidelines for the use of RFID-based EPC. These guidelines include the requirement to give consumers clear notice of the presence of EPC and to inform them of the choice that they have to discard, disable or remove EPC tags. These guidelines are non-binding, and only partly comply with the joint statement of 46 multinational consumer rights and privacy groups.
In 2004, Lukas Grunwald released a computer program RFDump which with suitable hardware allows reading and reprogramming the metadata contained in an RFID tag, although not the unchangeable serial number built into each tag. He said consumers could use this program to protect themselves, although it would also have significant malicious uses.
The US State Department initially rejected these concerns on the grounds that they believed the chips could only be read from a distance of 10 cm (4 in), but in the face of 2,400 critical comments from security professionals, and a clear demonstration that special equipment can read the test passports from 30 feet (10 m) away, as of May 2005 the proposal is being reviewed.
The Pakistan Passport Authority has started issuing passports with RFID tags.
The idea was prompted by the fact that several of the September 11 hijackers held fraudulent Virginia driver's licenses. However the American Civil Liberties Union has noted that in addition to being a risk to privacy and liberty, the RFID proposal would not have hindered the hijackers, since the false documents they carried were valid, officially issued documents obtained with other false identification. The weakness in the system is not failure to validate documents in the field, but failure to verify identity before issuing them.
Under the proposal, no information would be stored on the tag other than a number corresponding to the holder's information in a Database, only accessible by authorized personnel. Also, to deter identity thieves one would simply need to wrap one's drivers' license in Aluminium foil. ,