Physical-layer identification of UHF RFID tags

Abstract

In this work, we study physical-layer identification of passive UHF RFID tags. We collect signals from a population of 70 tags using a purpose-built reader and we analyze time domain and spectral features of the collected signals. We show that, based on timing features of the signals, UHF RFID tags can be classified, independently of the location and distance to the reader (evaluated up to 6 meters), with an accuracy of approx. 71% (within our population). Additionally, we show that is possible to uniquely identify a maximum of approx. 2 6 UHF RFID tags independently of the population size. We analyze the implications of these results on tag holder privacy. We further show that, in controlled environments, UHF RFID tags can be uniquely identified based on their signal spectral features with an Equal Error Rate of 0% (within our population); we discuss the application of those techniques to cloning detection in RFID-enabled supply chains.

On the Practicality of UHF RFID Fingerprinting: How Real is the RFID Tracking Problem?

“…According to the EPC C1G2 specification, the backscatter link frequency (BLF) at which tags communicate is defined within a range between 40 and 640 kHz with a frequency tolerance between ±4% and ±22% depending on the selected BLF. As shown by Periaswamy et al [23] and Zanetti et al [34], the relatively large BLF tolerances allowed by the EPC specification can represent a distinguishing factor between different tags of the same model and manufacturer. Additionally, it has been shown [34] that the BLF is not affected by the tag-reader distance and mutual position; this can allow tag distinguishability disregarding tags' location and position.…”

“…As shown by Periaswamy et al [23] and Zanetti et al [34], the relatively large BLF tolerances allowed by the EPC specification can represent a distinguishing factor between different tags of the same model and manufacturer. Additionally, it has been shown [34] that the BLF is not affected by the tag-reader distance and mutual position; this can allow tag distinguishability disregarding tags' location and position. Therefore, the signal feature we consider for tag identification is the backscatter link frequency at which each tag transmits data.…”

“…Physical-layer fingerprinting (identification) of UHF RFID tags has been investigated in several works [21][22][23]34]. Periaswamy et al [22] studied physical-layer identification of UHF RFID tags as a mechanism to detect counterfeit tags.…”

“…Fingerprint stability was not considered. Zanetti et al [34] studied physical-layer identification of UHF RFID tags using timing and spectral characteristics of tag signals. The authors considered a set of 70 tags from 3 manufacturers and collected tag signals with a high-range acquisition setup in a noisy environment (lab room).…”

“…For tag identification, we use timing features that rely on the extraction of tags backscatter frequencies [23,34]. We tested our setup on a tag population composed of 210 EPC class-1 generation-2 (C1G2) RFID tags [11] of 12 different models and 3 manufacturers.…”