NFC/RFID for access control: Sniffing for cards

 RFID cards or badges are commonly used to enable contactless access control.  This is commonly seen in office buildings to provide access to the building and restrict access to certain areas.  Near Field Communication (NFC), which uses the same ISO and IEC standards and protocols utilized by 13.56 MHz RFID, is also available in many smartphones. These devices enable new access control applications in the home that communicate with the phone as well as an RFID-enabled badge or card. When designing such an access control system, one of the main concerns is often low-power consumption.

The NFC/RFID badge or card does not contain a battery and receives power from inductive coupling with the magnetic field of the reader device.  An NFC/RFID reader/writer then uses modulation to send a command, which the RFID card will respond to by load modulating the field provided by the reader.  The communication must always be initiated by the Reader device and not the badge or card.  In order for your access control system to be prepared to read a card any time one is presented, it must go into a polling loop where the field is turned on, a command is transmitted, and then waits for a response to determine if a card is within range.  The problem with this scheme is that the current consumption of a transceiver is highest when the field is turned on and the field must remain on for a significant time while waiting for a response from a card that will not be there 99 percent of the time. 

In order to achieve the benefits of ultra-low-power and an “always ready” user experience, a developer must implement a technique to “sniff” for badges without going through the entire process of sending a command and waiting for a response.  Traditionally, methods to reduce power include using a mechanical or optical switch, a resonator, RSSI (received signal strength indicator) or a capacitive proximity sensor.  TI has developed an ultra-low-power method that uses a comparator to measure the decay time of the RF transmitter signal after it is turned on for a very short burst (~20uS).  When the transmitter is turned off and a card is within range of the antenna, there will be some coupling between the reader antenna and the card, which will create a change in the decay time and trigger a system wake-up where the card’s memory can be authenticated and provide access. 

The required components for the ultra-low-power card “sniffer” circuit and signal analysis diagrams can be seen below (relevant components in blue).  The signal from the antenna is rectified with the Schottky diode and then fed to the CA1 comparator input where the decay time is measured to determine if a card is present.    


Using this card-sniffing technique with a polling frequency of three times per second, the average current is incredibly low at only 31uA – which makes this an ideal solution for battery-powered applications.  For more details including source code for the MSP430™ microcontroller and TRF79xxA transceiver, please see one of TI’s applications notes.

To read more posts related to Smart Home/Buildings, check out the blogs below:

Click here for more on how TI helps create a smarter city!