Complete Defined RFID System Using GNU Radio Aurélien Briand, Bruno B. Albert, and Edmar C. Gurjão, Member, IEEE, Abstract In this paper we describe a complete Radio Frequency Identification (RFID) system, reader and tag, using the approach of software defined radio (SDR). We use the open source GNU Radio development toolkit to implement this SDR. The advantage of this approach is the possibility of to implement and test RFID applications using a flexible software platform. RFID readers in SDR have already been developed by others researchers, and our main contribution is the implementation of an RFID tag in accordance with EPC Gen2 RFID standard. The system is evaluated and it shown that it works with good performance, and as an example of application we implemented a cryptography protocol proposed to RFID. S I. INTRODUCTION OFTWARE defined radio (SDR) is a system where typical signal processing functions (filters, modulators, demodulators, and others) are implemented in software [1]. The main advantages of SDR systems when compared to hardware based ones, are low cost and flexibility to obtain very different radios with the same hardware, just by changing the embedded software. The software implementation allows the use of powerful digital signal processing methods, artificial intelligence techniques, complex control routines and others to obtain advanced radio systems. These techniques allied with the high computer processing turn possible applications that would be very difficult to implement in hardware, like spectrum sensing in a wide range of frequencies [2]. Various software architectures are being proposed to implement SDR, and the most successful one is the open source GNU Radio development toolkit [3]. In GNU Radio, with a connection of individual signal processing blocks it is possible to build real-time SDR. Examples of successful communications systems developed with GNU Radio include a fully function real-time digital television (DVB-T) system [4] and a RFID reader [5]. More examples of projects can be found at Comprehensive GNU Radio Archive Network (CGRAN) repository [6]. To convert digital signals being processed by a SDR to physical signals, it is necessary to use a RF front-end. Due to its flexibility and low cost, the Universal Radio Peripheral () is the most utilized front-end in the SDR area [7]. Aurélien Briand is with ESISAR at Grenoble INP, France. e-mail: aurelienbriand@gmail.com. Bruno B. Abert and Edmar C. Gurjão are with Department of Electrical Engineering of the Federal University of Campina Grande, Brazil. e-mails: albert@dee.ufcg.edu.br, ecandeia@dee.ufcg.edu.br. Edmar C. Gurjão is supported by CAPES grant Proc. no 3826/11-2. In this paper with a combination of GNU Radio and, we extend the work of [8] and to build a complete RFID, tag and reader, SDR system. We describe the system, some performance measurements and the implementation of a cryptography protocol using our system. This paper is organized as follows. Section II presents a general introduction to SDR and to GNU Radio. In Section III some previous works are described and in Section IV the developed system is described. Results of tests for performance evaluation using the developed system are presented in Section V and finally in Section VI some conclusions and future perspectives are presented. A. Introduction II. SOFTWARE DEFINED RADIO The term Defined Radio was used by Joseph Mitola III [1] to describe the implementation of flexible and reconfigurable radio based on software. One of the main advantages of using SDR, compared to tradition hardware implementations, it is the possibility of to implement various radios in the same hardware, or to change the configuration by adjusting the software parameters. Beyond that, with the increase of processing power it becomes possible the use of sophisticated signal processing in the implemented radios. Basically, to implement a SDR is necessary a digital processor to run the software, and to make physical transmission a RF front-end to perform up convert or to down convert of signals, and a interface to convert the received analog signal to digital in the reception, or to convert the digital signal to analog in the transmission. B. GNU Radio GNU Radio [3] is an open source framework for development of SDR. Each SDR in GNU Radio is composed by a set of independent interconnected signal processing blocks, obtained from the built-in library or created by the user. The SDR developed using GNU Radio can run in a general propose processor, as a personal computer, and using an RF interface it is possible to transmit or to receive real signals. C. The Universal Radio Peripheral [8] is a RF front-end composed by a motherboard and a set of daughterboards. In the motherboard there are analog-todigital (ADC) in the reception signal path (antenna to computer), digital-to-analog (DAC) in the transmission path
(computer to antenna) and a FPGA to multiplex the data from the reception daughterboard to computer or from computer to daughterboard. Daughterboard perform the down convert (reception) or up convert (transmission). Each daughterboard is projected to a range of frequencies, and in a typical configuration there are up to four daughterboard at the same time in one motherboard. III. RELATED WORKS Previous works have been implemented RFID related aspects in SDR. In [5] using a combination of GNU Radio and, it was developed a flexible UHF RFID reader that enables new PHY/MAC designs to be prototyped and evaluated. In this work, the authors develop the reader and they use commercial tags to test the system. An extension of [5] is done in [8], were it was build a distributed tag-sensing scheme with a reader and a new component called listener, that permits one transmitter to coexist with various receivers. In these previous works the authors are interested in evaluations and extensions of the reader, and they use commercial tags. Due to necessity of testing new features like cryptography in RIFD, and based on the difficulty of building new tags for each protocol test, in this paper we extend these previous works by implementing a complete RFID system via SDR. With this SDR system will be possible to test real transmissions using various protocols just by changing the software. The next section describes the developed system. IV. SYSTEM DESCRIPTION The block diagram of the system is presented in Figure 1. The tag and the reader are composed of similar components: one computer running GNU Radio, the developed software ( or Reader ), one and two antennas, one for reception and the other for transmission. The two receiver antennas (positioned at the same place), the antenna for the s Sender and the antenna for the Reader s sender are placed in order to form an equilateral triangle. With this configuration, both receiver antennas receive a signal of equal amplitude from the tag and from the reader. Antenna Transmitter Reader Antenna Receive r Figure 1 Block diagram of the developed system. For the reader software we used the work developed in [8], downloaded from CGRAN [6], with some improvement, since it was originally developed with GNU Radio 3.5 (old version), and it is being used version 3.6 (latest version) in order to mastering the new features provided by the new version. The tag software is the most important and difficult task to achieve. It is composed into three major parts, as illustrated in Figure 2: the receiver part (Rx), the processing part and the transmitter part (Tx). Figure 2 Subdivisions of the tag software. For the receiver and transmitter parts we use standard blocks provided by the GNU Radio toolkit version 3.6. The reception part uses the block uhd.usrp_source to configure the to read signals using a sample rate of 1x10 6 Hz, frequency 915 MHz and Gain of 10 dbi. The transmission part uses the block uhd.usrp_sink to configure the to transmit with 200x10 3 sample rate, frequency of 915 MHz and gain of 25 dbi, maximum value supported by the RF daughterboard used in the transmission. For the processing part, we create our own blocks. This part is divided into two blocks, as shown in Figure 3. RFID_Gate_: This block gates the signal when the signal doesn t correspond to a reader s question. To achieve its goal, the second block, RFID_Decode_Analyse_Send gives to him the number of sample it needs to block. These samples correspond to tag s answers. RFID_Decode_Analyse_Send: This block is the main block of the tag application. First, it recognizes the values of the pulse: 0-value or a 1- value. If the received signal has low amplitude, this corresponds to a 0-value, if the received signal has high amplitude, this corresponds to a 1-value. To know if the signal has high amplitude or low amplitude, an average of the received amplitudes is realized when the reader powers the tag. If the signal is greater than half the average it is considered high amplitude, otherwise it is low amplitude. Then, depending on how many pulses there are for the 1- value, it determines if it is a data-0 of a data-1. Tx Processing Rx
Transmitter RFID_Gate_ Processing Receiver Receiver Transmitter connection. These daughterboard are used for the part connection TX/RX for the transmitter and connection RX2 for the receiver. The reader software was modified to reduce the amplitude of the transmitted signal. The daughter board used by the reader (RFX900) has a gain much higher than the daughter board used by the tag (SBX 400-4400). The listener Reader records signal that is the sum of the signal of the reader and the tag's signal. However this difference was so significant, that when the Reader listener records the value of the amplitude of the signal, it performs a rounding that canceled the signal from the tag. Because since there aren t other cards RFX900 in the lab where the work was developed, we worked at low gain. After implemented the system we performed some tests to evaluate how it works, these tests are presented in next section. RFID_Decode_Analyse_Sen d: Figure 3 - Subdivision of the Processing block. The next step is to recognize command, depending of the data sequence. Finally, according to the order it will provide to the reader (via the transmission block), the appropriate response. As the main goal of this project was to create both and Reader by SDR following the EPC Gen2 RFID standard, it was essential to respect the communication protocol. To implement a real transmission between tag and reader we use the with daughterboard's RF 900 and SBR 400-4400 and Kent Electronics antennas, type WA5VJB, Log Periodic. Two of these antennas give good performance between 850-6500 MHz (used for tag and Reader transmitter) and two give good performance between 900-2100 MHz (used for tag and Reader receiver). Two 1 communicates with the computer via USB 2.0, this permits a full-duplex stream up to 16 MHz. It allows to use two full transmit and receive chains (TX/RX) and two full receives chains (RX2). The RF daughter boards RFX900 are designed specifically for operation in the 900 MHz band. These bandwidths are between 750 MHz and 1050 MHz. Each card has a TX/RX and RX2 connection. These daughterboard are used for the Reader s part: connection TX/RX for the transmitter and connection RX2 for the receiver. The RF daughter boards SBX 400-4400 are designed to 400 MHz and 4400 MHz. Each card has a TX/RX and RX2 V. RESULTS Initially, the reader was tested with a real tag. During one second, the reader will ask the EPC number of the tag respecting the EPC Gen2 protocol. We record the number of received EPC, correct and incorrect. After 30 tests the average o number successful EPC received per test was 5.66, while the average of the number of error EPC per test was 0.75. During the tests, we realized that sometimes the results were well below the average (number of EPC successful received). This poor performance was considered normal due to eletromagnetically noisy environment were tests were realized, a research lab shared with other experiments. Over 100 tests, it happened 6 times, and without these values we obtain an average of the number EPC successful per test of 6.4, while the average of the number of error EPC per test was 0.12. These results are presented in Figure 4. Figure 4 - Tests performed with a real tag. After we performed the same tests (thirty) but with the SDR tag, and the average of the number EPC successful per test was 10, while the average of the number of error EPC per test was 1.35. These results are presented in Figure 5.
Like with a real tag, we noticed that sometime the results were well below the average. Over 100 tests, it happened 8 times. Without these values we obtain an average of the number EPC successful per test of 11.5, and an average of the number of error EPC per test of 0.55. Figure 7 Performance of the receiver part. Figure 5 - Tests performed with the SDR tag. We can notice that the developed tag has a better performance than a real tag. It sends, on average, twice more correct EPC number. This can be explained by the signal amplitude of the SDR tag, higher than that of a real tag. However, the average of number of EPC incorrect is higher. This is a synchronization problem. The reader didn t receive at the good time slot. This is a real problem, due to GNU Radio and Linux buffer and USB interface that introduce latency. The tag was developed in order to limit this problem. The next step was to analyze the performance of the SDR system. First, we analyzed, during thirty tests, the performance of the transmitter part (how many EPC the reader receives per how many the send). These results are presented in Figure 6, and it was observed a ratio of 85%. Finally, we analyze, during fifteen tests, the performance of the algorithm (how many command receive by the tag are the correct command send by the reader). These results are presented in Figure 8, and this ratio was 97%. Even if, sometimes, the communication between the reader and the tag is hard, it didn t impact the performance of the algorithm. Figure 8 Performance of the algorithm. Figure 6 - Performance of the SDR system. Then, we analyze, during fifteen tests, the performance of the receiver part (how many command it receives per how many command the Reader send), this results are presented in Figure 7, and again the ratio was 85 %. With the above results we confirm the functionality of the system and its good performance. However, more tests needs to be done, for example to use a commercial reader with this SDR tag. This test wasn t performed due to our lab doesn t have such reader. The SDR here proposed has as its main motivation the possibility of to test new features for RFID, without the necessity of building physical reader or tag. As an example of such application, it was implemented the security protocol proposed in [9]. The motivation for the system is represented in Figure 9 and corresponds to the classical cryptography protocol, where Alice and Bob, which in this context can be the reader and the tag, must exchange some information and Eve, the intruder, likes to read the message. Eve in the context of this paper can the some equipment projected to read information of the tag without using its answers to the reader query. However, the noisy channel can change some bits and the message reader by Bob and Eve can be corrupted. The objective o the proposed protocol is by taking advantage of the noise to increase the error probability of a spy, Eve, while reduces the error probability of Bob [9].
Alice 0111011 Eve 001100 010101 Bob Figure 9 Communication sytem with a spy, Eve, and noise in the transmission. Protocol details can be found in [9] and it was implemented using the developed SDR, Alice as tag and Bob and Eve as readers. Such implementation implies in just inserting the source codes related to the protocol, and after rebuild the system. The protocol was implemented in our SDR, system and in Table I the obtained results for the error probabilities observed by Bob are presented. Table I - Initial and Final bit error rate for Bob. was shown that it works and with 85% of correct EPC receptions With the implemented system it is possible to test new features for RFID systems with the necessity of to build physical reader or tag. As an example, it was implemented a security protocol proposed to improve security in RFID. The implementation of such protocol in the presented SDR implies in to insert the related source code and to rebuild the system. The protocol implementation was tested and the theoretical results were confirmed. The implemented system needs improvements and more performance tests. Initially the latency problem in the reception of commands must be solved, what will improve the system performance. After, it he must be considered the use of one antenna for reader and one in the tag, instead of two as in the actual version of the SDR. Finally it can be observed that this SDR opens new possibilities for research groups interested in RFID, and with difficulties in to have hardware to develop their work. Initial Error Final Error 0.1875 0.091 0.28 0.11 0.125 0 0.25 0 0.22 0.11 0.25 0.1 0.22 0.17 0.25 0.2 0.1875 0.091 0.281 0.182 Average: 0.2251 0.1054 For all values of Table I the error probability of Alice was increased up to 0.5. With this implementation it was possible to show the utilization of our SDR to test new features for RFID. In future works we will implement new security protocols. REFERENCES [1] J Mitola III, Radio Architecture: Object-Oriented Approaches to Wireless Systems Engineering. Third John Wiley and Sons, 1996. [2] T. Yucek and H. Arslan. A Survey of Spectrum Sensing Algorithms for Cognitive Radio Applications, IEEE Communications Surveys \& Tutorials, Vol. 11, First Quarter, pp. 116-130. 2009. [3] GNU Radio home page, http://gnuradio.org/trac, last access 2012. [4] V. Pellegrini, G. Bacci, M. Luise, Soft-DVB, a Fully, GNURadio Based ETSI DVB-T Modulator. Proc. WSR'08, Karlsruhe, Germany, March, 2008. [5] Challenge: towards distributed RFID sensing with software-defined radio. Danilo De Donno, Fabio Ricciato, Luca Catarinucci, Angelo Coluccia, and Luciano Tarricone. Proceedings of the sixteenth annual international conference on Mobile computing and networking, 2010. [6] Comprehensive GNU Radio Archive Network (CGRAN) website, https://www.cgran.org/, accessed march 2012. [7] Universal Radio Peripheral website, http://www.ettus.com/, accessed March 2012. [8] A Radio-based UHF RFID Reader for PHY/MAC Experimentation. Michael Buettner, David Wetherall. IEEE RFID 2011. [9] H. Chabanne and G. Fumaroli. Noisy Cryptography Protocols for Low-Cost RFID s. IEEE Transactions of Information Theory, Vol. 52, No 8, August 2006. VI. CONCLUSION Motivated by the necessity of to test new functions in RFID systems without the necessity of building a new hardware for each test, a typical problem where SDR is well fitted, in this work a previous work that implements a RFID reader was extended and it was obtained a complete RFID (reader and tag) SDR system based in the EPC Gen2 standard. Various tests was realized to evaluate the system, initially using a real tag it was confirmed the perfect communications between the implemented reader and a tag. After the performance of the implement system was evaluated, and it