Evaluation of Contactless Identification Card Immunity against a Current Pulse in an Adjacent Conductor

Abstract

This paper analyses the possibility of damaging and destroying an identification chip of the Mifare type in a frequently used contactless identification card of size ID-1, following the standard ISO/IEC 7810 (i.e., with dimensions 85.60 × 53.98 × 0.76 mm), using the magnetic field of an adjacent conductor in which a current pulse of a defined shape and amplitude is flowing. For analysis purposes, the nonlinear current–voltage characteristic of the Mifare chip voltage limiter was measured and approximated, and the mutual inductance of the straight conductor and the rectangle coil antenna in the card was calculated. Next, a mathematical analysis was conducted based on the description of the equivalent electrical circuit by the differential equations. The results of the mathematical analysis were verified by a simulation in the free simulation software Micro-Cap 12. The peak value of the current pulse that can damage the Mifare chip was measured by a combination wave generator. Based on these measurements and the chip characteristics, the energy capable of destroying the chip was calculated. The characteristics of chip damage were determined using a comparison of the resonant characteristics of undamaged and damaged RFID cards with Mifare chips.

1. Introduction

Contactless identification cards based on RFID technology [1] are currently an integral part of many human activities in industry, transport, trade, etc. The most used cards are contactless cards operating at 13.56 MHz, according to the ISO/IEC 14443 standard [2], and using some version of the NXP Mifare chip. Great emphasis is placed on the information security of the data stored in the chips of these cards. The immunity of these cards (or other forms of RFID transponders) to external electromagnetic fields which, in unfavourable cases, can destroy the identification chip by inducing a current pulse exceeding the safe value given by the chip manufacturer, is considered less often.

In practice, there are several cases in which RFID transponders can be destroyed by a current pulse induced from an adjacent linear conductor. Figure 1 documents the use of RFID for marking underground cables and pipes. If these are metallic, they can conduct, e.g., part of the lightning current, endangering the transponder. The authors already have their own experience with such cases of transponder destruction. A similar situation can occur when embedding an RFID transponder in reinforced concrete in a bridge structure [3]. An example of an RFID transponder application (in this case, the UHF frequency band is used) in a railway vehicle chassis is given in [4], an environment with high traction currents. Other examples of the use of RFID technology in adverse environments with high currents are provided in [5] (RFID sensors for energy transmission lines), [6,7] (inductive power transfer for e-bikes equipped with RFID), and [8] (underground pipe monitoring). In [9], the design of a UHF RFID transponder for application in a strong electromagnetic field is described. Finally, for information security, the possibility of the targeted destruction of RFID cards with sensitive information (e.g., personal certificates) by a pulse in an external inductively coupled conductor (in this case, maybe a coil) is also interesting.

Therefore, this article aims to measure Mifare chip characteristics and conduct a mathematical and simulation analysis of the induction of possibly dangerous current pulses in identification card circuits. The analysis is based on experiences using RFID transponders in an adverse environment for the marking of underground engineering networks where a random current pulse caused by, e.g., lightning, propagating along an underground metal element (line, pipeline) can destroy a given RFID transponder.

Each chip intended for incorporation into an RFID transponder, in addition to logic and memory elements, contains a voltage limiter that limits the maximum value of (alternating) voltage on the chip to approximately 4–8 V. The current–voltage characteristic of such a limiter looks like an anti-serially connected pair of Zener diodes characteristics, which causes significant nonlinear distortion of signals induced into the RFID transponder from reading devices. In the case of overcurrent induction (several tens of mA, [10]), the RFID transponder may be destroyed.

In the following parts of the article, the energy needed for the random unwanted destruction of a contactless identification card, e.g., by placing it near the current conductor, for example, within the testing environment in an electric (or classic) car [11], will be analysed using a mathematical and simulation model based on real measurements. On the other hand, this analysis can be used to design equipment for the targeted destruction of RFID cards for security reasons [12], similar to equipment for the secure deletion of magnetic media (floppy disks, HDDs).

2. Related Works

The identification chips used in RFID transponders are principally nonlinear semiconductor components, usually manufactured using CMOS technology. The analysis and design of such chips are explained, e.g., in [13]. The nonlinear properties of identification chips for the UHF frequency band are described in [14,15,16]. The nonlinearity of HF RFID chips was documented in [17,18] by measuring the impedance of chips depending on the supply voltage within the allowed range according to the datasheets of the used chips. A powering circuit (rectifier and voltage regulator) for ISO/IEC 14443-compliant RFID chips based on CMOS technology was designed in [19]. However, this paper focuses on something other than the voltage limiter, which is mentioned only marginally. A detailed design of a voltage limiter for an RFID chip, specifically for the UHF frequency band, is provided in [20]. This design uses NMOS and PMOS transistors as a controlled load directly connected to the antenna terminals to limit the RF power in the chip. The analogue front-end for the 13.56 MHz transponder, including a powering circuit based on lateral MOS transistors, is described in [21,22]. The influence of a parallel-connected energy harvester on RFID transponder performance is modelled and measured in [23]. Other scientific works concerning power supply circuits of RFID chips are presented in [19,24,25,26,27,28,29].

The simplified mathematical model of the RFID chip used to calculate the current induced in the transponder assumes the approximation of the nonlinear current–voltage characteristic of the identification chip using suitable equations based on the mathematical description of the Zener diode. In general, sources [30,31] have dealt with the issue of semiconductor physics, while a more detailed analysis of models of semiconductor junctions applicable to Zener diodes can be found in [32,33,34].

Technical praxis is based on the regulations in the technical standard to evaluate the impact of overcurrent pulses caused by lightning [35]. This standard defines the time courses of voltage and current pulses, the simplified mathematical description of which can be found in the [36]. Electromagnetic compatibility tests of the proximity and vicinity identification cards and readers, e.g., intensity of magnetic field, sensitivity to electrostatic discharge, interferences etc., are described in the standards ISO/IEC 10373-6 [37] (for proximity devices, e.g., cards based on the NXP Mifare chip family) and ISO/IEC 10373-7 [38] (for vicinity devices, e.g., cards based on the NXP I-code chip family). These tests define the working conditions of the cards and readers that they must pass without damage.

RFID cards damaged during tests and measurements were measured using contactless means using a vector network analyser to calculate their state after the damage. For calculations, mutual relations between measured scattering parameters and the theoretical transfer function of measuring fixture were taken from [39,40,41,42].

The analyses of the electromagnetic field distribution and the standard working conditions of RFID transponders, necessary for their excitation, are presented in [43,44,45,46,47], and the electromagnetic field of the RFID reader is described in [48]. The possible destruction of RFID transponders and cards by a strong magnetic field with an intensity of more than 12 A/m is mentioned in [49]. The studies [50,51] deal with the tests of 125 kHz and 13.56 MHz RFID transponders in the strong magnetic field of MRI (magnetic resonance imaging) equipment. The paper [52] states that the damage of animal RFID transponders is almost certain when the animal crawls under a wirelessly charged vehicle where the magnetic field intensity is about 10 kA/m. There is also a patent [53] that describes the possibility of destroying an RFID tag using an electromagnetic pulse generator without further details.

The damage of the RFID card or transponder is one of the possible security (DOS—denial of service) attacks on the RFID system. The possibility of the DOS attack is mentioned in [54] and other security aspects of RFID systems are analysed in [55,56,57,58,59].

3. Measurement and Approximation of the Mifare Chip Current–Voltage Characteristic

The characteristic of the voltage limiter embedded in the Mifare Classic 1K chip was measured for two cases. The first case was measured using continuous alternative current for smaller currents up to 40 mA (note that the datasheet [10] allows currents only up to 30 mA). The second case uses the pulse principle to limit the power dissipation of the chip using higher currents. The measurement, in this case, was performed for a current up to 1 A.

3.1. Small Current Characteristic

The small current characteristic was measured in a simple electronic circuit according to Figure 2, where the voltage U_S was measured on the 100 Ω sensing resistor R_S1. The frequency of the signal generator (125 kHz) was chosen outside the operating frequency of the Mifare chip (13.56 MHz) to suppress the influence of the chip capacitance on the measurement of the characteristic. The capacitance of the Mifare chip, according to [10], is approximately 17 pF. If a frequency of 13.56 MHz was used for this measurement, there was a significant phase shift between the current sensed at R_S1 and the generator voltage U_G (Figure 3b). Moreover, the spectrum of the 8/20 µs current pulse, used for the tests described in the following chapters, is closer to the measuring frequency of 125 kHz than to the operating frequency of the transponder of 13.56 MHz.

The measured and calculated values of voltages and currents U_G, U_M, U_S, I_M are given in

Table 1. Measured and calculated values of Mifare chip current–voltage characteristic for smaller currents.

UG [Vpp]	US [Vpp]	IM [A]	UM [V]	UG [Vpp]	US [Vpp]	IM [A]	UM [V]
0.0	0.000	0.00000	0.000	12.0	4.240	0.02120	3.880
4.0	0.232	0.00116	1.884	12.5	4.680	0.02340	3.910
6.0	0.324	0.00162	2.838	13.0	5.160	0.02580	3.920
8.0	0.488	0.00244	3.756	13.5	5.560	0.02780	3.970
8.5	0.984	0.00492	3.758	14.0	6.080	0.03040	3.960
9.0	1.380	0.00690	3.810	14.5	6.560	0.03280	3.970
9.5	1.920	0.00960	3.790	15.0	6.960	0.03480	4.020
10.0	2.400	0.01200	3.800	15.5	7.420	0.03710	4.040
10.5	2.840	0.01420	3.830	16.0	7.920	0.03960	4.040
11.0	3.300	0.01650	3.850	16.3	8.120	0.04060	4.090
11.5	3.680	0.01840	3.910

. Note that the values of U_G and U_S are measured as peak-to-peak values; the calculated values are given as amplitudes. The effect of the Mifare chip voltage limiter is apparent in Figure 3a, where the time course of the voltage on the sensing resistor is distorted in the zero-crossing areas of the signal.

For the analysis of the Mifare chip immunity against induced current pulses, the measured current–voltage characteristic U_M vs. I_M must be approximated into the form of functional dependence U = f(I). Because the voltage limiter in RFID chips has a characteristic similar to the characteristic of two anti-serially connected Zener diodes, based on [30,31,32,33,34], the model of the Zener diode mathematically expressed by (1) was used. This equation was modified into its inverse form (2), and a linear term R_Z.I, modelling the serial resistance of the limiter, was added. The symbol U_BD denotes a diode breakdown voltage, and the symbol I₀ denotes a reverse diode current. The exponent p would be in the range 3–6 [34].

Another used modification of the Zener diode model is given by (3). The modification is based on the subtraction of the current I₀ so that the diode characteristic crosses the (0,0) point. The inverse form of this modification is given by (4) with the linear term added.

$$I=\frac{I_0}{1-{\left(\frac{U}{U_{\mathrm{BD}}}\right)}^p}$$

(1)

$$U=U_{\mathrm{BD}}\cdot {\left(1-\frac{I_0}{I}\right)}^{\frac{1}{p}}+R_Z\cdot I$$

(2)

$$I=\frac{I_0}{1-{\left(\frac{U}{U_{\mathrm{BD}}}\right)}^p}-I_0$$

(3)

$$U=U_{\mathrm{BD}}\cdot {\left(\frac{I}{I+I_0}\right)}^{\frac{1}{p}}+R_Z\cdot I$$

(4)

$$U=f(I)=U_{\mathrm{BD}}\cdot \tanh \left(\frac{I}{I_0}\right)+R_Z\cdot I$$

(5)

The models of Zener diodes given by (1)–(4) are disadvantaged because their mathematical functions are not odd. To modify them into the odd form, mathematical operations such as the absolute value and signum would have to be used. Therefore, the model given by (5) was created based on the hyperbolic tangent function and added using the linear term. The hyperbolic tangent is the odd function itself, and it is suitable to model the characteristic of two anti-serially connected Zener diodes.

The coefficients of all three approximation functions (2), (4), (5) were calculated using the Matlab Curve Fitting tool. They were quantitatively evaluated using the SSE (sum of squares due to error) metric, and they are ordered in

Table 2. Parameters for various approximation models.

Approximation Type	UBD [V]	I0 [µA]	RZ [Ω]	p [-]	SSE
Hyperbolic tangent	3.714	1350	8.223	-	0.01582
Modified model of Zener diode	3.956	2057	3.781	3	0.288
Model of Zener diode	3.453	0.9975	17.05	3.81	2.778

according to the rising SSE. The most suitable approximation seems to be the model based on the hyperbolic tangent (5), see Figure 4.

3.2. High Current Characteristic

Because the continuous measurement described in Section 3.1 is limited by the allowable thermal losses of the Mifare chip, the characteristic for a higher current up to 1 A was measured in the simple circuit according to Figure 5. The chip was periodically switched with period T = 1 s using the transistor Q to the variable DC voltage U_G for a short time (t_M = 12.4 µs). The chip current was measured using an oscilloscope as the voltage drop on the current sensing resistor R_S2 = 5.3 Ω.

The measured and calculated values are summarized in

Table 3. Measured and calculated values of the Mifare chip current–voltage characteristic for higher currents.

UG [V]	US [V]	IM [A]	UM [V]	UG [V]	US [V]	IM [A]	UM [V]
0.0	0.00	0.0000	0.00	9.0	0.91	0.1717	8.09
3.5	0.02	0.0038	3.48	10.0	1.02	0.1925	8.98
4.0	0.21	0.0396	3.79	11.0	1.09	0.2057	9.91
5.0	0.45	0.0849	4.55	12.0	1.17	0.2208	10.83
6.0	0.58	0.1094	5.42	13.0	4.36	0.8226	8.64
7.0	0.70	0.1321	6.30	14.0	5.08	0.9585	8.92
8.0	0.81	0.1528	7.19	15.0	5.68	1.0717	9.32

and Figure 6. During this measurement, the measured chips were destroyed in the last point (i.e., the last line in Table 3, U_G = 15 V), so the energy to destroy the chip can be calculated using (6), and it is approximately 124 µJ.

$$E=U_M\cdot I_M\cdot t_M$$

(6)

The term U_M.I_M = 10 W (values taken from the last line in Table 3) is the peak power dissipated in the chip during measurement, and U_M.I_M.t_M/T = 124 µW is the average power dissipated in the chip. The datasheet [10] allows a total dissipative power up to 120 mW, so the measurement did not overload the chip by average thermal losses. The chip destruction probably occurs due to local overheating of the voltage limiter structure in the chip.

The measured characteristic in Figure 6 was not approximated using an analytic function due to its complexity. For simulation purposes, the data from Table 3 were used directly to define a nonlinear component using piecewise linear approximation. The differences between both polarities of the chip connection during measurements appeared negligible, so the data can be used with positive and negative signs, too.

4. Mutual Inductance between the Rectangle Coil and Linear Conductor

The Mifare identification chips family is mainly applied to the identification cards of ID-1 size according to the ISO/IEC 7810 standard [60]. Therefore, the calculation of the mutual inductance M of a single-turn rectangle coil with dimensions w, l and a straight conductor with current I, which is displaced horizontally by s and vertically by h from the coil, is based on Figure 7. The magnetic induction B in the point A in the rectangle coil plane, generated by the current I in the conductor, is

$$B=\frac{\mu \cdot I}{2\cdot \pi \cdot z}\cdot \cos \alpha ,$$

(7)

where

$$\cos \alpha =\frac{s+x}{z}=\frac{s+x}{\sqrt{h^2+{\left(s+x\right)}^2}}.$$

(8)

The total magnetic flux through the coil plane is then given using the term

$$\Phi =M\cdot I={\displaystyle \underset{0}{\overset{w}{\int }}B\cdot l\cdot dx}.$$

(9)

After integration and separation [61,62], the mutual inductance of one turn is

$$M=\frac{{\mu }_0\cdot l}{4\cdot \pi }\ln \left(\frac{h^2+{\left(s+w\right)}^2}{h^2+s^2}\right).$$

(10)

5. Mathematical Model of an RFID Card with a Voltage Limiter Based on the Small Current Characteristic

A simplified electrical circuit based on the small current characteristic of the Mifare chip and on modelling the currents in the Mifare identification card is shown in Figure 8. This model was created to find a limit of the current pulse exposing the RFID card at which the voltage limiter starts to operate. Assume that the current pulse i(t) flows through the adjacent conductor and is standardized using the standard [35] (8/20 µs) and modelled using Equation (11) in the form of subtraction of two exponentials [36]. The parameters in (11) are the following: t₁ = 7.179 µs, t₂ = 8.951 µs, I_PEAK is the maximum value of the current pulse. The circuit in Figure 8 is described using the system of differential Equations (12) and (13), where f is the approximation function (5) with parameters according to Table 2, and differentiation of the function f is given using (14). The numerical solution of the system (12), (13) for the time course of current i₁(t) was calculated for these parameters:

• L = 4.9 µH is the inductance of the coil in the RFID card [63];
• R = 2.24 Ω is the loss resistance of the coil in the RFID card [63];
• N = 5 is the number of turns of the coil in the RFID card [63];
• C = 20.22 pF is the resonant capacitance of the Mifare chip (16.9 pF) with the addition of parallel capacitance of coil (3.32 pF) [10,63]. Note that the capacitance 20.22 pF together with the inductance 4.9 µH resonates at 15.9 MHz instead of the nominal value 13.56 MHz, but real cards have the resonant frequency increased at approx. 15–16 MHz;
• M is the mutual inductance of the straight conductor and one turn of the rectangular coil according to (10) calculated for the following geometrical dimensions: l = 80 mm, w = 48 mm, s = 300 mm, h = 100 mm; M = 10.83 nH.

$$i(t)=12.343\cdot I_{\mathrm{PEAK}}\cdot \left(e^{-\frac{t}{t_2}}-e^{-\frac{t}{t_1}}\right)$$

(11)

$$L\frac{d^2{i}_1\left(t\right)}{d{t}^2}+R\frac{d{i}_1\left(t\right)}{dt}+\frac{1}{C}\left(i_1\left(t\right)-i_2\left(t\right)\right)=N\cdot M\frac{d^{2}i\left(t\right)}{d{t}^2}$$

(12)

$$\frac{1}{C}\left(i_2(t)-i_1(t)\right)+\frac{df(i_2(t))}{dt}{i}_2(t)=0$$

(13)

$$\frac{df\left(i_2\left(t\right)\right)}{dt}=\frac{U_{\mathrm{BD}}}{I_0\cdot {\cosh }^2\left(\frac{i_2\left(t\right)}{I_0}\right)}+R_Z$$

(14)

The time course of the current i₁(t) is depicted in Figure 9 for two various values of the excitation current pulse maximum I_PEAK (500 A and 1500 A). It documents two cases. The first case (at the lower value of the excitation current pulse) did not cause the opening of the Mifare chip voltage limiter, and the chip current i₁(t) is characterized as damped harmonic oscillations. In the second case (at the greater value of excitation current pulse), the opened voltage limiter damps the harmonic oscillations totally with its low dynamic resistance, and the current time course is aperiodical. The calculation shows that the allowable maximum current of the Mifare chip (30 mA, [10]) was more than doubly exceeded, and chip damage may be probable.

From the number of current i₁(t) time-course solutions (in accordance with Equations (11)–(14))—where the maximum excitation current I_PEAK was a (varying) parameter—the graph was compiled describing the dependence of the maximum value of the current i₁(t) and time needed for reaching this maximum on the maximum value of the current I_PEAK. This graph is depicted in Figure 10. Both curves have expressive rises for I_PEAK > 1.1 kA. It denotes that for a given space arrangement of the coil and conductor, the voltage limiter starts to open.

6. Verification of the Mathematical Model Using Simulation Software

The results of the mathematical analysis from Section 5 were verified using simulation in the software Micro-Cap 12. The equivalent circuit to the circuit analysed in the previous chapter, which was created using simulation software, is depicted in Figure 11.

The used numerical values of the components are the same. Moreover, the component R_P = U_BD/I₀ = 2751 Ω was added to the simulation circuit. This component replaces the characteristic of the voltage limiter near the zero point. The pair of anti-serially connected Zener diodes D1 and D2 simulate the voltage limiter. These Zener diodes must have the junction capacitance set to a negligible small value compared to the resonant capacitor C to retain the resonant frequency of the RFID circuit. The element K2 simulates the coupling coefficient between the coils L1 and L2, which is 0.0155. The simulation results are shown in Figure 12, and they are practically the same as the results of the mathematical analysis.

7. Simulation and Measurement of 8/20 µs Current Pulse Amplitude in an Adjacent Conductor Able to Destroy the Mifare Card

Section 5 and Section 6 analysed the case of influencing the RFID card using the current in the conductor, which is generated by the high-impedance source and thus does not affect the conditions in the circuits of the card itself using inductive coupling.

To verify the possibility of the accidental or intentional destruction of the RFID card with the Mifare chip, a simulation and measurement of the current pulse effect was performed using a combination wave generator Schaffner NSG 2050 with a PNW 2050 module (Figure 13). An antenna in the form of a single-turn square coil with side length m₁ = l₁ = 1 m (Figure 14) and with conductor radius r_w = 3 mm was connected to the combination wave generator. The antenna has an inductance L_SQ = 4.028 µH, according to (15) [64]. The RFID measuring card with an inserted 1 Ω current sensing resistor in series with its coil (therefore, the value of the loss resistor R is 3.24 Ω instead of 2.24 Ω in Figure 15) was placed outside the square antenna in the position according to Figure 14 at a distance of s_l = 0.02 m and s_m = −0.54 m from its edges. In such an arrangement, the mutual inductance of the square antenna and the coil in the RFID card is according to the equations 4.109c, 4.109d, and 4.110 in [64], 89.71 nH, and the coupling factor between them is 0.0202.

$$L_{\mathrm{SQ}}=\frac{2\cdot {\mu }_0\cdot m_1}{\pi }\left(\ln \frac{m_1}{r_w}-0.774\right)$$

(15)

Based on these parameters, a simulation model was created (Figure 15). Because the manufacturer does not disclose the scheme of the combination wave generator NSG 2050, this equipment was simulated using a simplified circuit, taken from [65] (left part in Figure 15). The element K1 simulates the coupling factor between the inductance of the square antenna and the inductance of the coil in the RFID card. The initial voltage on the capacitor C1 would be set in the simulation model at 4 kV to generate the 8/20 µs current pulse with a maximum value of 2 kA. Because the peak current pulse value in the given configuration when the destruction of tested cards starts is between 1.75 kA and 2 kA, the initial voltage at C1 is 3.5 kV for simulation. It corresponds with the 1.75 kA peak current. The card voltage limiter, in this case, is not simulated using Zener diodes and serial resistance as in Section 6. However, the measured nonlinear characteristic of the limiter for the higher currents is defined directly using values from Table 3 in the nonlinear element H1 (Figure 15).

The simulation results are shown in Figure 16, together with the measured current in the RFID card. Given the geometrical arrangement of the square antenna and the card, the chip in the card was destroyed in 10 out of 10 attempts using a current pulse with a peak value of 2 kA. The centre of the damaged cards was placed at a distance of approximately d = 47 mm from the linear conductor in this experiment. The intensity of the magnetic field in the centre of the card obtained using a simple calculation (16) is H_M = 6.8 kA/m for this case. In contrast, no card was destroyed with a pulse less than 1.75 kA. From Figure 17, the peak-to-peak value of the current pulse in the card during the destruction of the RFID chip is approximately 3.64 A.

$$H_M=\frac{I_{PEAK}}{2\cdot \pi \cdot d}$$

(16)

The time course of the current in Figure 17 was recorded with a sampling frequency of 5 MHz, i.e., with a sampling period T_s = 200 ns. A simulated time course of the current was also generated with same parameters (Figure 16). From measured current samples I_meas(k) and using the PWL approximation of the characteristic in Figure 6, an estimation of the time course of the accumulated energy E_m needed to destroy the RFID chip (17) and the time course of the instantaneous power P_m dissipated in the RFID chip (18) can be calculated, where n is the serial number of the sample.

$$E_m\left(n\right)=T_s\cdot {\displaystyle \sum _{k=1}^n{I}_{\mathrm{meas}}\left(k\right)\cdot U_M\left(I_{\mathrm{meas}}\left(k\right)\right)}$$

(17)

$$P_m\left(n\right)=I_{\mathrm{meas}}\left(n\right)\cdot U_M\left(I_{\mathrm{meas}}\left(n\right)\right)$$

(18)

The cumulated energy E_m and the instantaneous power P_m are shown in Figure 18, together with the energy E_sim and the power P_sim obtained from the simulation model in Figure 15.

8. Estimation of Damaged Card Parameters

In the previous chapter, it was calculated that by inducing a certain amount of energy (several hundred microjoules) in a short time (in the order of several microseconds) into the identification card, the card can be damaged in such a way that the RFID reader cannot read it. To verify the condition of cards damaged in this way, a measuring device was assembled, the diagram of which is shown in Figure 19. The device serves to measure the resonance characteristics of the cards. The measured frequency characteristics of the undamaged card are shown in Figure 20a for different levels of the input signal U₁. In addition, there is also a measurement without the card in this figure (light blue curve). The measurement was performed using a Siglent SNA5002a vector network analyser (VNA) as parameter S₂₁.

From the characteristics in Figure 20a, the undamaged card has a resonance characteristic significantly dependent on the level of the input signal, which is given using the nonlinear volt–ampere characteristic of the Mifare chip, which is represented by the element R₄ in Figure 19 and by the nonlinear resonant capacitor C₂. Figure 20b shows the measured resonance characteristics of four cards damaged by a current pulse in the adjacent conductor during the experiment described in Section 7. The intense resonance effect is almost lost, and the characteristics are independent of the input signal level. This fact indicates that the significant nonlinearity of the identification chip (the parallel connection of the resistor R₄ and the capacitor C₂ in Figure 19), causing the resonance frequency to decrease as the level of the measurement signal increases, no longer works after Mifare chip damage. The differences in characteristics among the individual damaged cards are minimal, in the order of tenths of a decibel.

The state of damaged card No. 3 (the parameters to find are R₄ and C₂) was estimated from the absolute value of the theoretical transfer function of the measuring fixture (Figure 19) and the measured values of S₂₁ using the optimized Levenberg–Marquardt method for the following circuit parameters in Figure 19: R₁ = R₃ = 50 Ω, coupling factor k = 0.35, the inductance of the sensing coil L₁ = 0.78 µH, the inductance of the card coil L₂ = 4.9 µH, and the series resistance of the card coil R₂ = 2.24 Ω. Considering the definition of the transfer function and the scattering parameter S₂₁, it was necessary to add an offset of 6 dB to the theoretical absolute value of the transfer function [41,42]. The regression result gives an estimation of R₄ = 745 Ω and C₂ = 33.7 pF. Graphically, the frequency dependence of the measured and approximated transfer function is shown in Figure 21. After carefully cutting the card No. 3, the resistance of the chip was measured with a standard multimeter, and its value was 722 Ω. The capacity of the chip was not measured because a relatively small chip resistance shunts it. Cards were cut at the location of the chip, and parameters (inductance and loss resistance) of antenna coils were verified to make sure that the chips and not the antenna coils were destroyed in the damaged cards. Even in damaged cards, these parameters followed the recommended values [63] within a tolerance of ±5%.

9. Results and Discussion

Based on measurements of the Mifare chip characteristics using an alternating signal for small currents (up to 40 mA), it was calculated and simulated in Section 5 and Section 6 that the voltage limiter of this chip built into the format of a standard plastic card starts to work only when current pulses in the conductor distant from several tens of centimetres reach a peak value of the order of kA (Figure 10). In this case, there is no risk of damage to the RFID transponder. Note that for these calculations, the Zener diode model based on a hyperbolic tangent was used instead of classical models. This model is better for calculations with both polarities of currents and voltages. However, it is more demanding of computing power and is limited by the maximum allowable argument of hyperbolic tangent calculation.

In Section 7, based on the pulse measurement of the characteristics of the Mifare chip for higher currents and measurements in which the peak value of the current pulse destroying the chip was found, the energy required for the destruction of this chip was calculated. Energy values range from 124 µJ (the pulse measurement of the characteristic in Section 3.2) through 261 µJ from the simulation up to 407 µJ from the measurement with the combination wave generator (Figure 18). These results in the decibel scale show a difference of about 5 dB, bearing in mind that the measurement in Section 3.2 has a different time course of the instantaneous power in the chip (practically constant during the pulse time of 12.4 µs) from the instantaneous power injected from the combination wave generator (fast rise and fast fall).

The frequency characteristics of cards with damaged chips were compared with an undamaged card using the measurement in Section 8. The undamaged card shows significant resonant characteristics with a resonant frequency dependent on the level of the measurement signal. Damaged cards show a characteristic damped by a relatively small resistance independent of the measured signal level. It can be assumed that this is caused by the thermal destruction of the voltage limiter of the chip, which prevents the data reading from such a damaged card.

The measurement of the ampere–volt characteristic of the voltage limiter in the Mifare Classic chip in Section 3 was mainly carried out in the area where chips do not work under normal conditions. The measurement aimed to find out the behaviour of the chip in the boundary conditions in which irreversible chip damage can occur. Measurement results can be compared with the results of RFID chip impedance measurements in [17,18]. In the work of [17], the authors present the measurement of the real resistance and capacitance of various identification chips, including the Mifare Classic. In the area of working voltages up to 3 V RMS, the resistance of the Mifare Classic chip is in the range of approx. 10 to 80 kΩ; at higher voltages activation of the voltage limiter occurs, and the resistance of the chip falls to approx. 50 Ω at a voltage of 3.3 V RMS. In the article [18], a similar measurement of the resistance and capacitance of an identification chip conforming to the standard [2] is presented, but without an exact specification of its type. The graphical results in [18] confirm a sharp fall in the chip’s dynamic resistance at voltages above 3 V RMS. These features of the chip are also confirmed within our measurements and approximations presented in Section 3.1. The voltage at which, according to our measurement, the voltage limiter of the Mifare Classic chip is activated is in the range of 3.4 to 3.9 V, and the equivalent dynamic resistance of the chip drops to a value of approx. 8 Ω according to the best approximation. During pulse measurement of the chip with higher currents (Section 3.2), the resistance of the chip increases and it is possible from the graph in Figure 6 and from Table 3 to determine its approximate dynamic resistance of about 44 Ω. When the current through the Mifare chip is further increased, there is even a region with negative dynamic resistance.

The measurement of the magnetic field strength at which the ID-1-sized identification card is capable of operating is also reported in [17]. However, this measurement focuses on the minimum field intensity value, the measurement in our research looks for the maximum intensity value up to the limit of permanent damage to the chip.

The comparison of our research regarding chip damage with other similar works is summarized in

Table 4. Comparison of studies focused on RFID transponders testing using a destructive magnetic field.

Reference	Frequency of Magnetic Field	Field Strength	Transponder Type	Destruction of Transponders	Experiment Performed
[49]	NA	12 A/m	HF 13.56 MHz	N/A	No
[50]	12.7 MHz	(DC) 0.3 T (AC) N/A	HF 13.56 MHz	No	Yes
[52]	145 kHz	10 kA/m	LF 134.2 kHz	Yes	No
Our	Pulse 8/20 µs	6.8 kA/m	HF 13.56 MHz	Yes	Yes

. In contrast with our work, some works only estimate the intensity of the magnetic field needed to damage RFID transponders [49]; some do not even mention the experiment and instead of the results of the measurements, they only provide an estimation of possible damage [52].

10. Conclusions and Further Research

The research described in this article proposed a method for testing RFID cards, also applicable to other mechanical forms of RFID transponders, and universally applicable to passive and semi-passive RFID transponders with inductive coupling, i.e., with an antenna in the form of a coil and working in LF and HF frequency bands. The active transponders usually work in the UHF band, where the influence of interfering 8/20 µs current pulses with the dominant spectrum in the LF band will be negligible [20]. However, semi-passive transponders with inductive coupling and coil antenna will be sensitive to such interfering pulses, since the interface for connecting the coil antenna is similar to that of passive transponders [22].

The results of the analysis and simulation prove that the accidental destruction of the identification card by a current pulse from a nearby conductor is unlikely but possible. The current pulse would have to have a peak value of a few kA to destroy the identification card tuned to a frequency of 13.56 MHz. Moreover, the card must be placed in a distance of 20–30 mm from the conductor. Such pulses are unlikely in a typical 230 V AC mains voltage distribution. High-voltage and traction lines, where the given impulses could occur, usually have long distances from identification cards (excluding special applications of RFID transponders, such as underground cables and pipelines, railway vehicles and track marking, etc.). Of course, the targeted destruction of the RFID card could be performed in a relatively simple manner, e.g., by discharging a capacitor with a relatively large capacity into a loop inductively coupled with the identification card. In further analyses, it will be interesting to monitor the sensitivity of the RFID cards to current pulses with various rise and fall times depending on the resonant frequency of the cards. The authors will plan to construct a specialized device that enables the accurate measurement of the energy needed to damage various RFID chips (e.g., Desfire, I-Code) and can destroy RFID cards to prevent an information leak from cards no longer in use. For this purpose, the simulation models developed in the presented research will be used.

On the other side, the analyses in this paper prove that the possibility of RFID card damage is minimal. Therefore, RFID-based gates and sensors can be used for testing and measuring during driving or crash tests with electrical vehicles (e.g., car vs. car scenario or pedestrian crash test).