See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/307964770 Secured Miniaturized System-in-Package Contactless and Passive Authentication Devices Featuring NFC Conference Paper · August 2016 DOI: 10.1109/DSD.2016.34 CITATIONS READS 3 407 7 authors, including: Holger Bock Norbert Druml Infineon Technologies Infineon Technologies 54 PUBLICATIONS 304 CITATIONS 93 PUBLICATIONS 461 CITATIONS SEE PROFILE Some of the authors of this publication are also working on these related projects: PRYSTINE View project Handbook of Research on Solutions for Cyber-Physical Systems Ubiquity View project All content following this page was uploaded by Norbert Druml on 19 October 2017. The user has requested enhancement of the downloaded file. SEE PROFILE Secured Miniaturized System-in-Package Contactless and Passive Authentication Devices featuring NFC Juergen Schilling, Walther Pachler, Bernhard Roitner, Thomas Ruprechter, Holger Bock, Gerald Holweg, and Norbert Druml Infineon Technologies Austria AG, Graz, Austria {juergen.schilling, walther.pachler, bernhard.roitner-ee, thomas.ruprechter, holger.bock, gerald.holweg, norbert.druml}@infineon.com I. I NTRODUCTION HF-based RFID and NFC systems are widely spread nowadays. They can be found in our everyday lives, in applications such as payment, transportation and logistics, healthcare, and access control systems (see also [1]). A particular boost has been recognized since RFID/NFC reader functionality has been integrated into a vast amount of smart phones. The basic principle of such a contactless RFID/NFC system is illustrated in Fig. 1. The reader device emits an alternating magnetic field, which is used to power the transponder and to exchange data with it by means of modulation. The achievable reading distance of such a contactless and passive system depends on several factors. One of the most important factors is the size of the antenna: the larger the antenna, the better the coupling. NFC Reader Device Transponder Power Transfer Data Transfer RF-Interface Abstract—RFID/NFC technology is widely spread nowadays and applications can be found in our everyday life, for example, in payment, transportation, logistics, healthcare, and access control. State-of-the-art contactless and passive authentication solutions implement relatively large coils outside of the chip. Therefore, the minimum size is in the order of a few square centimeters, which limits their use for tagging of certain small-sized goods. On top of that, those miniaturized solutions which are available today provide only limited security measures. Here we introduce miniaturized system-in-package contactless authentication devices. This novel solution integrates Infineon Technologies’ CIPURSETM move IC, which is a state-of-the-art security solution featuring an open security standard, into embedded Wafer Level Ball Grid Array (eWLB) packages, together with HF-antennas, ferrites, as well as discrete elements that improve HF-coupling characteristics. The presented devices provide better HF-coupling characteristics than Coil-on-Chip approaches, which also enable verification of authenticity of tagged products through NFC-enabled smart phones. Thanks to the miniaturized package sizes of 3x3 mm, integration into high-priced products, casings, consumable materials, etc., can be achieved in a discreet way. Furthermore, the integrated CIPURSETM chip enables not only the anticounterfeiting use-case, but also micropayment, ticketing, access control, and password storage in a secured way. Therefore, this miniaturized contactless authentication solution will open up whole new fields of applications. Index Terms—Security, System-in-Package, eWLB, RFID, NFC, CIPURSETM iR(t) v(t) C Shunt Electr onics Fig. 1. Working principle of an RFID-based contactless system. The reader emits an alternating and modulated magnetic field that powers the transponder and through which contactless communication is also enabled. Obtained with changes from [3]. However, the smaller the antenna and the tags are, the higher is typically the variety of products that can be tagged. If such transponders are manufactured small enough, then they can be integrated into various products, casings, or consumable materials in a discreet way. Since counterfeiting of designer products is reported as a major issue with a global economic value of over $ 865bn, as one can see in Table I and in [2], a simple, small-sized, and secured way to check genuineness is eligible. Given this motivation, it is of highest interest to provide small-sized and secured RFID technology, which can be integrated into products in a very discreet way and which can be verified in terms of authenticity with commonly available RFID reader devices. However, to the best of our knowledge, there is a major gap in industry and in academia concerning this field of application. This work addresses the outlined gap and presents a miniaturized, system-in-package, contactless, and passive authenti- TABLE I E STIMATED VALUE OF COUNTERFEIT PRODUCTS , ACCORDING TO [2] Region Internationally traded Domestically consumed Total 2008 [USD bn] 322.5 177.5 500.0 2015 [USD bn] 865.0 470.0 1335.0 cation solution that features NFC and state-of-the-art security measures. This is achieved by integrating Infineon Technologies’ CIPURSETM move chip, which is a security chip featuring an open security standard, into embedded Wafer Level Ball Grid Array (eWLB) packages, together with HF-antennas, ferrites, as well as discrete elements that improve HF-coupling characteristics. Thus, a system-in-package security solution is given that enables not only the anti-counterfeiting use-case, but also micropayment, ticketing, access control, and password storage. Summarizing, this paper makes the following contributions: • It introduces the novel system-in-package contactless authentication devices. • It details design and implementation decisions as well as simulation results. • It proves the applicability of the fabricated devices by means of an access control demonstrator. This paper is structured as follows. Section II gives a short introduction into the related work covering the topic of small-sized RFID solutions. In Section III, the design and the implementation of the miniaturized transponders are presented. Followed by Section IV which shows the final fabricated prototypes as well as the demonstrator. Finally, our results are concluded and some details about our future work are given in Section V. II. R ELATED W ORK Basically, RFID tags consist of the IC itself and the HF antenna. This antenna can either be directly attached on the IC die or it is built on some support material like PVC. While the IC itself is very small (typically in the range of 1 to 2 mm2 ), most of the area is occupied by the antenna and the support material. The larger the antenna, the better the HF coupling and thus the reading distances. The most popular formfactor for RFID tags is ID-1 with a size of 85.60 mm x 53.98 mm, see also [1]. This card format achieves, together with a typical reader device, communication distances of up to 10 cm. However, due to its size, it is not suitable for an integration into small products. Dual interface systems with a coil-on-module implementation can be fabricated much smaller than ID-1 cards. They feature, for instance, a contact based interface on the front and a contactless RFID interface on the backside. They are often used with booster antennas in ID-1 format, which builds a dual interface card. In contrast to conventional ICs with soldered antenna, these modules do not have a mechanical connection between module and antenna. Therefore, they are more robust against mechanic stress in the region of the solder points and are easier to fabricate. The smallest way of producing an RFID tag is the coil-on-chip approach, which has the antenna directly placed on the top of the IC die. These tags are just as big as the IC itself but consequently the reading distance is very short. Furthermore, it is very difficult, if not impossible, to add discrete components in order to improve the HF coupling characteristics. Again, they are often used in combination with booster antennas, as shown by the authors in [4]. Apart from HF RFID tags, there are also small tags using capacitive coupling instead of inductive coupling. According to the authors in [5], such coilon-chip solutions are typically very small (in the range of 1 mm2 ), metallic environments do not influence the communication, and no adjustment on a single resonant frequency is needed. However, the reading distance is below 0.5 mm. In summary, Table II gives a qualitative comparison of the discussed technologies with the packaging technology used in the presented solution. Apart from the mentioned approaches, antennas can also be manufactured by printing them on a carrier material. In [5], the authors present a silver inkjet NFC antenna printed on a ferrite. By employing such a ferrite, the HF characteristics in metallic environments is improved significantly. However, as the authors demonstrate in [6], if ferrites are used, a higher minimum field strength is required to communicate with the transponder. As another solution, the authors of [7] presented a low-cost UHF tag which can be used for tagging batteries and metallic objects. In addition to these research activities, there are also some miniaturized RFID tags commercially available. Table III provides an overview of the most important implementations (please note that a password protection is not considered as a security measure). For instance, Maxell offers coil-on-chip based tags (ME-Y1001 and ME-Y2000 series) with a size of 2.5 mm x 2.5 mm and a communication distance of around 2 mm. This tag is based on a proprietary communication protocol. For use in metallic environments also a version with ferrite is available (Metal Compatible Small RFID Tag). These tags are rather large and thick but provide a longer communication distances. Murata also offers HF RFID tags (MAGICSTRAP R ) with a size of 3.2 mm x 3.2 mm and a reading distance up to 15 mm and smaller UHF-based tags with a reading distance of 7 mm. A smart phone readable TABLE III C OMPARISON OF THE PROPOSED TAGS WITH STATE - OF - THE - ART TABLE II C OMPARISON OF THE TECHNOLOGIES SUITED FOR RFID SOLUTIONS PRODUCTS Product Technology Size ID-1 Coil-on-Chip Coil-on-Module Cap. Coupling eWLB -++ o ++ + Reading Distance ++ o -o Additional Components X X X X X Size HF Properties + -o o ++ Maxell CoC Maxell Mini Murata Murata inlay This approach + o + o + Reading Distance o + + + o Metallic Env. X X X X X Security --o o ++ Protocol proprietary ISO 15693 ISO 15693 ISO 14443 ISO 14443 • NFC • Power Transfer • AUTHENTIC ? State-of-the-art security features and measures against security attacks must be included. The HF coupling properties shall be good enough to enable communication with commonly used smart phones. The transponders should be cheap and easy to fabricate. B. Packaging Technology - eWLB Authentification Fig. 2. Possible application scenario: anti-counterfeiting application by means of the CIPURSETM based authentication device. Authenticity of a high-priced product is verified with a typical smart phone. tag comes also from Murata. This 8.3 mm x 8.3 mm big inlay is readable from a distance of up to 25 mm. The ICs used by Murata come with basic security support, featuring an originality signature only. This means that the origin of the IC can be verified using an asymmetric cryptographic scheme. Therefore, the UID of the IC is signed and stored during production. Nevertheless, how important it is to integrate proper security measures into RFID-based solutions is stressed by Hutter et al. in [8]. Summarizing, even though there are some miniaturized RFID solutions available, there is a major gap concerning miniaturized and secured RFID/NFC solutions. Therefore, this paper provides an innovative contribution to the ongoing discussion in this important field of research. III. S YSTEM - IN -PACKAGE C ONTACTLESS AUTHENTICATION D EVICES The vision of our concept is depicted in Fig. 2. Miniaturized system-in-package security devices shall enable tagging of products (such as medical devices, casings, or consumable materials) in a discreet way. By using standardized and secured protocols, communication with the transponders will be enabled through commonly available reader devices. Thanks to the employed CIPURSETM security technology, various kinds of use-cases will be enabled, such as anti-counterfeiting, micropayment, ticketing, access control, and password storage. As an example, if integrated into a watch, the watch can be used also as a personal password storage or as a novel type of electronic key to your home. The following section describes the involved concepts, technologies, and the overall system-in-package design in detail. Please note that due to disclosure policies some critical details are omitted in the following and in the results chapter. A. Requirements Based on the described vision, the following requirements can be derived for the system-in-package contactless authentication devices: • They must be small (3x3mm) and flat. • Additional discrete components, such as capacitors, must be integrateable into the package. The integration density of modern ICs increases continuously, but the number of required input and output pads increases at the same time. This so-called interconnect gap poses a huge challenge for the chip development industry. However, there are novel packaging technologies, such as the eWLB technology, that are able to tackle this challenge. In this work the embedded Wafer Level Ball Grid Array (eWLB) packaging technology, see also [9], is employed in order to accomplish the visioned system-in-package solution. The original purpose of the eWLB technology was to surround an IC with a mold compound which provides additional area for the required soldering balls. The pads on the IC and the soldering balls were then connected via a redistribution layer (RDL). In the proposed solution, the mold compound is exploited as antenna carrier and the redistribution layer is exploited to build the antenna of the RFID/NFC transponder, as inspired by a work of the authors in [10]. In contrast to the substrate, which is the base material for the antenna in coilon-chip devices, eWLB’s mold compound as base material grants much better HF characteristics. In addition, the eWLB technology enables the integration of discrete components (such as resistors and capacitors) and ferrites into the package. This feature is essential and is exploited to improve the HF coupling characteristics of the proposed secured system-inpackage solution. C. Security IC - CIPURSETM move Infineon Technologies’ CIPURSETM move IC, see also [11], is used as the main security measure within the proposed transponders. This miniaturized and cost-efficient IC implements the CIPURSETM L profile which is standardized by the Open Standard for Public Transportation (OSPT) Alliance, as described in [12]. It communicates through the ISO/IEC 14443 Type A interface (specified in [13]) and supports a 3way mutual authentication scheme to securely authenticate the tag to the reader and vice versa using AES-128. The integrity during data exchange is secured with an AES-MAC and APDU sequence integrity protections. The employed data exchange protocol provides inherent resistance against DPA (differential power analysis). Furthermore, attacks are prevented by both hardware and software countermeasures. One of the most important features of the CIPURSETM move IC is the support of various types of secured applications. It enables not only the anti-counterfeiting use-case, but also micropayment, ticketing, access control, password storage, and others. Summarizing, thanks to the CIPURSETM move IC, a highly integrated, miniaturized, and programmable security solution is available which can be efficiently integrated into the presented system-in-package concept. 3 mm TABLE IV M ATERIAL PARAMETERS USED FOR 3D SIMULATION OF THE MAGNETIC eWLB Package with Ferrit 3 mm Underpass for HF Coil CIPURSE™ IC Capacitor FIELD DISTRIBUTION Material Ferrite Silicon FR4 (Epoxy) PET Air Vacuum Glass Gold Relative Permittivity r [1] 12.0 11.9 4.4 3.2 1.0006 1.0 5.5 1.0 Relative Permeability µr [1] 1000 1.0 1.0 1.0 1.0000004 1.0 1.0 0.99996 Electrical Conductivity σ [ siemens ] m 0.01 0 0 0 0 0 0 41·106 HF Coil Fig. 3. Layout of the system-in-package authentication device featuring the CIPURSETM move IC, a capacitor for HF tuning, HF antenna, and an underpass for connecting the HF antenna with the IC. D. System-in-Package Design Fig. 3 illustrates the design of the proposed system-inpackage contactless authentication devices. In its current design version, a package size of 3x3 mm is targeted. The design comprises the following six layers (from bottom to top). The first or the sixth layer implement an optional ferrite, which is used to improve the HF characteristics in metallic environments. The second layer integrates the CIPURSETM move security IC as well as all the needed additional discrete components, such as capacitors and resistors. These additional discrete components are required to tune the transponder to a frequency of 13.56 MHz and to improve the HF characteristics in general. For example, the integration of an increased capacitor value reduces the negative effects (in particular dangerous supply voltage drops) of executed operations consuming high amounts of electrical power (such as cryptographic operations). A simulation, which is carried out with the tool Advanced Design System (ADS), evaluating the tuning behavior Fig. 4. Simulated HF properties of the proposed system-in-package contactless authentication solution. The design is tuned towards 13.56 MHz. towards a resonance frequency of 13.56 MHz is presented in Fig. 4. In order to connect the antenna with the IC, a discrete underpass component is employed. Since the present design has still considerable amounts of free space available, one may also integrate micro batteries (for instance, see [14]) in order to achieve a boosted NFC system that features an increased communication distance. Layers three and five of the package are made of the dielectric material. This material enfolds the important HF antenna in layer number four. The antenna itself is implemented by exploiting the redistribution layer of the eWLB packaging technology. Thanks to this novel combination of a miniaturized package design of only 3x3 mm and the usage of state-of-the-art security technologies, an attractive solution for various kinds of application scenarios is provided. As mentioned earlier, the proposed transponders are designed to be integrated into or to (a) Air (b) Air + ferrite (c) Glass (d) Glass + ferrite (e) Gold (f) Gold + ferrite Fig. 5. This figure illustrates the simulation of the magnetic field distribution dependent on various types of materials. Fig. 6. 3D electromagnetic field simulation carried out with the ANSYS HFSS tool. be mounted on high-priced products that can be made of metal. Because of this application scenario, detailed 3D simulations are carried out in order to evaluate the distribution of the magnetic field on materials typically found in this context. Fig. 5 illustrates simulations of the transponder in air, glass, and gold environments (simulation parameters are detailed in Table IV) performed with ANSYS HFSS, a tool that is based on finite element analysis. It can be clearly seen that the distortion of the magnetic field caused by eddy currents on conductive materials, like gold, can be avoided by the usage of a ferrite layer (see also further analyses performed by the authors of [15]). Therefore, a magnetic field is maintained that is suitable for contactless communication. Non-conductive materials, such as glass, do not degrade the magnetic field. Fig. 6 shows a 3D evaluation of the electromagnetic field of one of the designs in a non-conductive environment. E. Design Variants During the development of this work, several design variants were fabricated and evaluated. In the following, some design variations are mentioned that can be of interest for applications: • • • • • In order to improve the HF properties, one can integrate a second layer for the HF antenna coil. Another possibility for even better HF properties is achieved by an increased package size of, e.g., 5 x 5 mm. Since the maximum communication distance correlates with the root of the antenna dimension, the package and the antenna size represent effective optimization parameters. Changing the coil width has a significant impact on the achieved gain. Integration of larger capacitors improves the supply voltage drop behavior, which is a sever issue in passively powered contactless systems. Micro batteries integrated into the package may be used as a boosted NFC approach in order to improve the communication distance. Fig. 7. Manufactured system-in-package contactless authentication device. CIPURSETM move IC, capacitor, antenna, and underpass are integrated into one eWLB package. • If no security is required (which is for certain application scenarios valid), other RFID/NFC ICs (such as Infineon Technologies’ My-D family) with a reduced minimum operating field strength may then be integrated. IV. R ESULTS In the following section the manufactured prototypes are shown and a possible application scenario is demonstrated. A. Fabricated Prototypes Fig. 7 depicts one of the manufactured contactless authentication devices which corresponds to the design presented in Fig. 3. Components, such as the capacitor or the CIPURSETM move IC, can be easily seen due to the thin dielectric top layer. The ferrite can either be mounted on top or on bottom of the package, which depends on the application scenario. Fig. 8 shows the measurement of the resonance frequency of one of the manufactured devices carried out Fig. 8. Measurement of the resonance frequency, which equals 13.75 MHz, of one of the manufactured system-in-package contactless authentication device. System-in-Package Contactless Authentication Device Reader Device Secured Communication Open Verify Authenticity of Key Open Lock Relay Board Fig. 9. Basic concept of the access control demonstrator featuring a mechanical key that is enhanced with the system-in-package contactless authentication device. with a network analyzer from Omicron Labs. Accordingly, a resonance frequency of 13.75 MHz was measured, which deviates a bit from the simulated and targeted 13.56 MHz due to component tolerances and manufacturing variabilities. 3x3mm System-in-Package Contactless Authentication Device Fig. 10. Simple metallic key, enhanced with the system-in-package contactless authentication device. In this work, we introduced the system-in-package contactless authentication devices that represent a miniaturized and secured solution for the HF-based RFID and NFC application domains. These devices are realized by integrating Infineon Technologies’ CIPURSETM move security IC, discrete components, ferrite, and the HF antenna into one single eWLB package. Thus, forming a novel system-in-package solution featuring a size of only 3x3 mm and which can be easily integrated in various products in a very discreet way. This secured system-in-package solution enables not only the anti-counterfeiting use-case, but also micropayment, ticketing, access control, and password storage. Furthermore, we presented a manufactured prototype and demonstrated the feasible application of such a security device by means of the access control use-case. Our future work concerns the evaluation of additional design variants that improve the HF properties of the eWLB approach. Furthermore, boosted NFC solutions tend to be a promising research field in this particular context. B. Access Control Demonstrator In the following, an access control demonstrator is presented which showcases how such miniaturized security solutions may be used in the future. The basic concept of this demonstrator is illustrated in Fig. 9. Our system-in-package contactless authentication device is attached (in this case by glueing) to a typical mechanical key, as depicted in Fig. 10. The mechanical lock is enhanced with a small booster antenna that fits into the lock’s housing. The booster antenna is connected to a commercial available RFID/NFC reader device which is connected to a host PC. The front and the back of the demonstrator’s assembly is shown in Fig. 11. When the user puts the key into lock, a two-way security verification is performed. First, the mechanical key has to fit properly into the lock. Second, a verification of the authenticity of the CIPURSETM move IC is carried out by the host PC. Only if both verifications succeed, then the host PC issues a command to an electrical relay that triggers a lifting magnet ultimately releasing the lock. This example demonstrates the versatile applicability of the proposed and manufactured secured system-in-package contactless authentication devices. We would like to thank our colleagues from Infineon Technologies in Regensburg for their valuable support regarding the eWLB packaging technology. V. C ONCLUSION In recent years, RFID- and NFC-based solutions have become omnipresent in our everyday life. They can be found in applications such as payment, transportation, logistics, healthcare, or access control. Very famous are passive solutions of check card format. However, their usage is sometimes limited, in particular, in the fields of anti-counterfeiting and logistics due to their large and indiscreet HF antennas. There are only few miniaturized HF-based RFID and NFC solutions available, and most of them disregard the very important security aspect. Therefore, there is a gap concerning miniaturized and secured solutions for the HF-based RFID application domain. Fig. 11. Frontside and backside of the access control demonstrator showing the electronics and the lifting magnet responsible for releasing the lock. The booster antenna is integrated into the lock and thus cannot be seen. ACKNOWLEDGMENTS R EFERENCES [1] K. Finkenzeller, RFID Handbook: Fundamentals and Applications in Contactless Smart Cards and Identification, 3rd ed. John Wiley & Sons, Inc., 2003. [2] “Estimating the global economic and social impacts of counterfeiting and piracy,” International Chamber of Commerce, Tech. Rep., February 2011. [3] N. Druml, M. Menghin, A. Kuleta, C. Steger, R. Weiss, H. Bock, and J. Haid, “A Flexible and Lightweight ECC-Based Authentication Solution for Resource Constrained Systems,” in 17th Euromicro Conference on Digital System Design (DSD), August 2014, pp. 372–378. [4] W. Pachler, W. Bosch, G. Holweg, and G. Hofer, “A novel booster antenna design coupled to a one square millimeter coil-on-chip RFID tag enabling new medical applications,” in European Microwave Conference (EuMC), October 2013, pp. 1003–1006. [5] W. Pachler, J. Grosinger, W. Bosch, P. Greiner, G. Hofer, and G. Holweg, “An on-chip capacitive coupled RFID tag,” in 8th European Conference on Antennas and Propagation (EuCAP), April 2014, pp. 3461–3465. [6] M. Gebhart, R. Neubauer, M. Stark, and D. Warnez, “Design of 13.56 MHz Smartcard Stickers with Ferrite for Payment and Authentication,” in 3rd International Workshop on Near Field Communication (NFC), February 2011, pp. 59–64. [7] K. Jaakkola and P. Koivu, “Low-Cost and Low-Profile Near Field UHF RFID Transponder for Tagging Batteries and Other Metal Objects,” IEEE Transactions on Antennas and Propagation, vol. 63, no. 2, pp. 692–702, February 2015. View publication stats [8] M. Hutter, J.-M. Schmidt, and T. Plos, “RFID and its Vulnerability to Faults,” in International workshop on Cryptographic Hardware and Embedded Systems (CHES), August 2008, pp. 363–379. [9] M. Brunnbauer, T. Meyer, G. Ofner, K. Mueller, and R. Hagen, “Embedded Wafer Level Ball Grid Array (eWLB),” in 33rd IEEE/CPMT International Electronic Manufacturing Technology Symposium (IEMT), November 2008. [10] K. Pressel, G. Beer, T. Meyer, M. Wojnowski, M. Fink, G. Ofner, and B. Römer, “Embedded wafer level ball grid array (eWLB) technology for system integration,” in IEEE CPMT Symposium Japan, August 2010. [11] “CIPURSETM Move,” Preliminary Product Brief, Infineon Technologies AG, March 2015. [12] “The CIPURSE Open Standard,” Open Standard for Public Transportation Alliance (OSPTAlliance), 2012. [13] “Identification cards – Contactless integrated circuit cards – Proximity cards – Part 1: Physical characteristics,” International Organization for Standardization, Geneva, Switzerland, Tech. Rep. ISO/IEC 144431:2008, 2013. [14] M. Sternad, M. Forster, and M. Wilkening, “Powering the Digital Revolution: A Miniaturized Lithium Battery Made of Single-Crystalline Silicon,” in 18th International Meeting on Lithium Batteries, June 2016. [15] X. Qing and Z. N. Chen, “Proximity effects of metallic environments on high frequency rfid reader antenna: Study and applications,” IEEE Transactions on Antennas and Propagation, vol. 55, no. 11, pp. 3105– 3111, November 2007.