Unclonable RFIDs

Physical Unclonable Function (PUF) technology makes each and every IC chip unique and unclonable. Additionally, PUF technology enables a simple, yet strong and robust, mechanism to authenticate each chip. PUF based RFID chips are integrated circuit devices based on PUF technology. PUF is a semiconductor technology, it can work in RFIDs operating at any frequency such as LF, HF, UHF etc. The Vera X512H RFID chips are compliant with ISO/IEC 14443-A radio frequency standard, operate at 13.56 Mhz (HF) carrier frequency.

PUFs are tiny electrical circuit primitives that exploit the unavoidable IC fabrication process variations to generate unlimited number of unique, unpredictable, though reliable “secrets” from each chip. These secrets are dynamically generated, using a challenge response scheme. A PUF is queried with a challenge – a random 64-bit (or longer) number. It almost instantly generates a unique response – a 64-bit (or longer) number. Each PUF can generate a virtually unlimited number of these unique challenge response pairs. Since it is impossible to model or duplicate the IC fabrication process variations, even for the IC manufacturer, it is impossible to generate the same challenge response pairs from another chip. Hence, PUF technology makes ICs effectively unclonable.

PUF generated secrets (challenge response pairs) provide a simple, yet strong and robust, authentication mechanism. As shown in the diagram above, a group of challenge response pairs are collected from the chip, and stored in a database. This may usually happen at an initial stage in the life of the chip, perhaps at a secure location. To authenticate the chip at a later time, one of the stored challenges from the database is sent to the chip, the response generated is compared against the one initially recorded in the database. If the two match, the chip is authentic. Since each chip can have multiple challenge response pairs, each challenge response pair is used just once, as a one-time pad. This prevents skimming and replay attacks on PUF authentication.

How are PUF based RFIDs Unclonable?

As mentioned above, it is effectively impossible for anyone, even an IC chip manufacturer, to create a clone of a PUF based IC such as the RFID. To understand unclonability, it is important to understand how RFIDs can be cloned. The first, and perhaps more difficult, method would be to somehow copy the contents of one RFID chip to another. This can be achieved if an attacker gets access to another same kind of uninitialized RFID chip as the one the attacker is targeting. The second, and easier, method would be to program a ghost RF device to act like a RFID chip. Such devices are available on the internet, an attacker would skim the information exchanged between the real RFID chip and reader and then replay the same information using such devices to attack the system.

PUF technology makes it effectively impossible to clone Verayo RFID chips. Even if an attacker gets hold of an uninitialized Verayo RFID chip, and copies all the contents from one RFID chip to the other, the PUFs on the two chips will show very different characteristics. No two PUF based RFID chips will generate the same response to any given challenge. Hence, in the example above, if the same challenge is given to a fake wrist-watch with a copy of the real PUF RFID tag, the PUF will not provide the expected response to any of the challenges stored.

PUF based RFIDs can address the issue of skimming and replay by ghost RF devices as well. Each PUF based RFID can generate virtually unlimited number of challenge response pairs. To address the issue of skimming and replay attack, the system should, ideally, use a new challenge response pair every time. A ghost device that would have skimmed the previous exchange between the chip and the reader would not know the new response and fail. For certain kinds of applications where the number of authentication events is very large, say thousands, storing unique one-time-use challenge response pairs may be impractical. Such systems can still store a large number, say hundred, challenge response pairs, and randomly pick a new challenge response pair from the stored list of hundred such pairs for every authentication event. This system would require an attacker to follow the real RFID tag (and the product or ID card user) at all check-points, more than hundred times, and skim and store the challenge response pairs for use by the ghost device, an impractical feat for the attacker. Additionally, when a PUF based RFID tag or an ID card is brought to a trusted location, the challenge response pair database can be replenished, making any of the skimmed challenge response pairs useless.

PUF based RFIDs are the world’s first, and only, RFID chips that are effectively unclonable. They provide strong and robust authentication (based on silicon “biometric” information) at a significantly lower cost. PUF circuits are tiny, hence inexpensive and consume low power. This makes PUFs ideal for low cost and low power consuming device like an RFID.

PUF based RFIDs are a new class of RFIDs in the industry. They break the cost-security continuum, and bring a significantly higher level of security and trust in a low cost RFID chips. Crypto RFIDs provide comparable security and trust, but at a significantly higher cost and power consumption. PUF based authentication and security can be easily implemented in RFIDs operating at any frequency - LF, HF, UHF etc.

Anti-Counterfeiting

Verayo's PUFs based unclonable RFID tags offer a cost-effective anti-counterfeiting solution. Nobody can clone the Verayo RFID chip, and the chip can be easily authenticated anywhere in the field. Commonly used authentication mechanisms used today, such as holograms, color-shifting inks, special printing etc., have been shown to be largely ineffective in controling counterfeiting. RFID tags have been used recently for anti-counterfeiting, but basic RFID tags lack authentication and security features. Secure RFID tags (based on cryptography technology) offer stronger protection, but they are too expensive to be used at the item level in high volume.

Verayo unclonable RFIDs can prevent counterfeiting in markets such as：

Pharmaceuticals

Liquor, Wine and Cigarettes

Luxury Products

Government documents, including things like currency notes

More on Anti-Counterfeiting Solution

Secure IDs and Access Cards

Secure and reliable identification requires strong authentication. For humans, biometrics technologies, like fingerprinting or DNA analysis, provides strong and robust authentication. Verayo has taken the same concept to silicon chips. Verayo’s RFID chips, based on breakthrough “silicon biometrics” technology, provide a strong and robust, yet low cost mechanism to authenticate contactless identification and access cards in markets like:

Government issued ID cards – driver’s ID cards, travel cards, employment cards etc.

Credit cards and loyalty cards

Passports

Secure facility access cards

More on Secure ID and Access Solution