In response to growing concerns about the vulnerability of RFID tags to cloning, two startups—Veratag and Verayo—are taking advantage of variations that occur in RFID chips to create security features that are impervious to hacking. While the companies use different technologies to authenticate the identity of tagged items, both say their solutions provide a lower-cost, less complicated and robust alternative to the encryption techniques being promoted for some applications, such as protecting RFID-tagged pharmaceuticals and high-priced goods from counterfeiters.
The companies do not expect their products to eliminate the need for encryption. Instead, they both maintain their products can provide a more efficient security solution for particular applications and can be used with encryption when needed. Both companies are founding members of the RFID Security Alliance, a resource and advocacy group.
Veratag has based its unclonable chips on microelectromechanical systems (MEMS) resonator technology, spun out of the Cornell University research labs. When MEMS resonators—micron-scale mechanical devices—are added to silicon chips, they produce unique high-frequency analog signals that can be read, identified and authenticated.
The security application was the unintended result of a quality-control problem the Cornell researchers were encountering, says Veratag CEO John Schneiter. Each resonator produced slightly different sets of high-frequency analog signals. Creating a resonator with a specific frequency signal is virtually impossible, because the signals are the result of variations in the manufacturing process. The unique behavior of each MEMS resonator, combined with the impossibility of manufacturing the resonators at a specific frequency, created the opportunity to produce a nanoscale device that can be used for authentication and cannot be cloned, the company says.
Borrowing the image of a one-of-a-kind snowflake, Veratag has dubbed the chips with resonators “MEMFlakes.” When a MEMFlake is activated by an RFID interrogator, it emits high-frequency analog signals that are unique in terms of quality, sharpness and frequency peaks, Schneiter says. Once activated, the signals can be read, identified and authenticated by comparing them with a list of valid signals stored on the reader or in a database. This makes the technology a perfect fit for access control, passport, e-pedigree and other applications where there is a need for authentication but not the increased complexity of encryption, he says. MEMS resonators can be added to RFID chips for less than a dollar per chip, making them cheaper to use than encryption technology, he maintains.
Veratag is eyeing high-frequency passive tags for its initial chips. Existing RFID interrogators would need to be upgraded either with firmware or a replacement hardware module to support the MEMS devices. The company has had discussions with RFID tag and reader manufacturers, but no deals have been struck, Schneiter says. Veratag expects to have a beta system available after the first of the year.
Verayo has based its unclonable chips on Physical Unclonable Functions (PUFs) technology, developed at the Massachusetts Institute of Technology, which takes advantage of the variations that occur in silicon during the fabrication process. The company says the subtle variations create unique physical characteristics that distinguish each silicon chip from all others, creating a sort of “electronic DNA” that can be used for authentication. The PUF technology is used to extract the chip’s identity. “PUF is essentially a biometric technology for a silicon chip,” says Vivek Khandelwal, Verayo’s marketing director.
PUFs are actually a class of tiny, low-power circuits that are added to standard silicon chips. Those circuits are used to transmit unique 64-bit “challenges” that authenticate the chip’s identity. For example, a unique identifier such as the tag identification or Electronic Product Code is written to the PUF RFID tag. In addition, for each PUF RFID tag, a database storing all challenge-response pairs is created. To authenticate the RFID tag, the tag’s ID or EPC is read and transmitted to the secure database. One of the challenges is presented to the RFID chip. If the chip’s response matches the one stored in the secure database, the RFID chip is authenticated. To prevent replay attacks, each challenge-and-response pair is used only once. Standard RFID interrogators need a firmware upgrade to support the PUF technology.
In September, Verayo launched its first product, the Vera X512H—a passive 13.56 MHz RFID chip with 512 bits of memory based on the ISO 14443-A standard. The chip is designed for anti-counterfeiting and access control applications, Khandelwal says. Verayo has been working with RSI ID Technologies to create the inlays in which the chips are embedded. Khandelwal expects the first Vera X512H pilot, with a luxury winemaker that wants to add anti-counterfeiting protection to its wine labels, to get under way in the first quarter of 2009.
Since the launch of the Vera X512H, several ultrahigh-frequency tag makers have expressed interest in adding PUF technology to their chips, so Verayo is looking at designing a chip for UHF applications, Khandelwal says. Because the PUF circuitry is so small, the cost of adding it to a chip is “insignificant,” he says, estimating it would cost one-third to one-half less than adding encryption.
End Users’ Wish Lists
As the number of RFID deployments grows, so do the expectations for the technology among those who are using it. This year, when RFID Journal asked several end users what advancements they’d like to see in 2009, their comments reflected some of the unique and innovative ways RFID is being applied across a variety of industries. Here’s what our respondents had to say.
Jerome Gardner, VP, special projects and consulting services, Integris Health (the largest health-care provider in Oklahoma)
“This is futuristic, but wouldn’t it be cool if RFID could be developed to do monitoring of patients’ vital signs? RFID can now pick up humidity and temperature. What about using RFID to monitor pulse and body temperature? If it picks up irregularities, it would send an alert. This would provide an additional safety feature. “I’d also like to see the medical-device manufacturers incorporating RFID into their high-value products such as stents, pumps and hernia mesh.”
Tony Hollis, director of innovation and technology management, Exel (a provider of contract logistics and a wholly owned entity of Deutsche Post World Net)
“We’d like to see increased development of sensor technology. We think that has a lot of value. A key challenge is costs. We need to lower costs and increase the flexibility of solutions. We also need a more flexible infrastructure. A lot of the technology is coming together. The question is, how do you simplify the infrastructure and improve the integration of data?”
Samuel Ingalls, assistant director of information systems, Clark County department of aviation, McCarran International Airport, Las Vegas
“We’re upgrading our RFID installation for baggage sortation from Gen 1 to Gen 2 chips in 2009, which should improve tracking capabilities and deliver lower prices. We would like to see other airports and/or airlines adopt baggage-tracking programs utilizing RFID in accordance with the industry standard. At the point that RFID implementation gains critical mass in the industry, this tracking information should reduce baggage mishandling, and will provide other opportunities for improving customer service.”
Robert Kashmer, VP of information technology, H.D. Smith (a pharmaceutical distributor)
“We need to see tags perform better. A big problem with pharmaceuticals is that [tagged] items with different frequencies and different standards are all randomly mixed in the bottom of plastic totes. In order to have tags read at the speed we need, we have to have better performance.”
Rob Nagler, chairman, Freiker (a solar-powered RFID system that encourages kids to ride their bikes to school)
“For us, price points are a problem because we’re a nonprofit. I’d love to see a general-purpose kiosk computer with RFID built in. That would save us a ton of work.”
Doug Olson, general manager of systems and process, Schneider Logistics, and co-chair of EPCglobal‘s Transportation and Logistics Services Industry Action Group
“We believe in the need for continued development of standards, especially when it comes to Electronic Product Code Information Services. EPCIS is the glue that holds everything together. Our goal is to expand the standards vocabulary for transportation and logistics [within EPCIS]. Building up that vocabulary helps everybody. It makes the standards more efficient.”
Who’s Who in Unclonable RFID Chips
• Veratag (www.veratag.com)
• Verayo (www.verayo.com)