Circuit delay for an RF receiver/transmitter

Yes, 10ns is achievable, especially if you're working in the microwave region. In low VHF probably not possible.

But why do you desire

Wouldn't 10ns risetime imply a system bandwidth well over 100 Mhz?

How do you achieve that with an 847kHz carrier?

I can see how delay is not quite the same thing as rise time, but good luck measuring (or benefiting from) a delay much shorter than the shortest possible time over which you can produce a measurable change in the signal going through it.

BW = 0.35/tR

You don't.

...Jim Thompson

Oops, I left out the factor of four in the comparison between a single edge and 360 degrees of phase.

That equation then gives the answer for 10%-90% rise vs -3dB bandwidth

- neither of which is probably the right choice for the problem at hand, but it does give a sense of the difficulty - you want fast edges to communicate information with low latency, you need a (very) wide bandwidth.

My reading of his post is that:

1. He wants to "fake" the presence of a smartcard that isn't physically present at the reader.

1. The smartcard really is up to 100 meters away.

2. He desires to relay the smartcard signals (13.56MHz with 0.847MHz subcarrier is the HF standard) using some kind of RF link.

1. Someone has convinced him that the group delay through the RF link (modulo transit time) must be less than 10ns.

I could be wrong at any one or more of my readings. All together they certainly do not add up!

Tim.

I would like to detect when somebody is attempting to fake the presence of a card

Yes, the attacker uses an RF relay

I need to know a rough lower bound on the delay the relays introduce to determine if it is practical to detect their presence via (accurate) timing.

Rotor451

Hello,

You will be out of the reg limits. 847kHz sidebands on a 13.56kHz carrier? Ain't going to fly with the regulators.

Generally, yes. Even with a gorilla-size DSP.

Regards, Joerg

the lower bound is the speed of light

How long does it take RF to travel 100 meters and back?

Mark

Yes, it would seem that the attacker could use arbitrarily high bandwidth for the link (much higher bandwidth than the standard interface doing the measuring) so the only way you might get a substantial delay would be in propogation. But even then, the delay is probably small compared to unpredictability in the response time of the card, which is designed to talk on a bandwith limited interface.

You might be able to build something that uses varous tricks on the borderline or beyond the specification to verify a specific card model... but probably not a genunine card in general. However if you are trying to detect a specific unique in the world card, it's behaviour beyond the spec could be useful. I believe cell phone providers experimented with doing that for a while to detect cloned analog phones - looking for changes in the 'flaws' in the signal from those previously recorded for a given phone.

What advantage does the attacker gain from distance? Hiding from a surveillance camera? Is there a way you can surveil other things, such as the RF spectrum, for activity suspiciously coincident with transmissions to/from the "card"? (Of course the smart attacker leaves the link on for the entire session, is so wideband that he looks like noise, and ramps the link power up and down slowly at the beginning/end of the session)

Are you saying that the 13.56 MHz carrier is ASK modulated at a rate of

Well, why wouldn't the attacker take the 13 MHz carrier and mix it up to microwave? This isn't my field, but I believe this would allow very low latency operation at the RX. The RX could then, at a minimum, reproduce the 13 MHz signal. But since it is ASK, the baseband signal could probably be recovered directly from the microwave signal.

I believe it is.

Definitely. If you try to do this with a DSP, 10 ns is out the window for sure.

Wide bandwidth microwave equipment is not cheap.

But the flight time for 5 meters is like 17 or 18 ns. The flight time for

It might be a good idea for you to explain your proposed method a little more clearly.

--Mac

Is that 100mm correct ???

Doesn't sound very useful for tolls.

...Jim Thompson

It sounds like it's for the transit fare half of applications space rather than the road toll half.

"please wave card again at this turnstyle"

Make it an order of magnitude bigger and you have the problem that you might sense the car/person in an adjacent toll lane. Which is sometimes in the oppositte direction.

My head butts up against this issue in my day job regularly. Folks have more than one smart card in their wallet or car in many instances, and you don't want to charge the wrong one. But then you try to integrate two readers (two standards, four vendors!) into the same physical space and life gets really hairy. (Irregardless of how much hair there is on my head or butt... which is where my smartcards mostly reside!)

Then there was what the vendors promised vs delivered, vs what the politicians promise vs what you deliver, and then promises vs engineering reality. And then the accountants come in! Engineering is SOOOO much easier when you don't have the accountants watching over your shoulder! Never mind the fare collection cops on the money train and their shotguns!

Getting back to the original poster's question, most security systems that depend on smart cards deal with "faked"/"duplicate" issues through physical barriers and things like "you can't go in this door twice without going out in between". (Reminds me of the Fenyman story at Los Alamos where he entered the security gate 4 times without leaving, and the guard tried to figure out what rule that broke...) It doesn't help you catch the first instance but it will alert you that something's fishy.

Tim.

I think he wants to steal the smart card encoding:

"For collections of road tolls and transit fares, contactless smart cards are gaining notice. These cards contain special circuitry that allows them to work without electrical contacts and even without directly applied power. A coil antenna in a card receives RF energy transmitted by a card reader unit via the clock signal. The card then converts the energy for storage in a capacitor and uses the stored energy to power short RF data exchanges.

An examination of the Siemens SLE44R35/MIFARE smart-card controller illustrates a typical application for contactless smart cards. This chip, intended for use in automatic fare-collection systems, contains its own contactless interface, including an antenna. Unlike most chips for contactless smart cards, which operate between 1 and 5 MHz, its operating frequency is 13.56 MHz. The chip allows communication between card and reader over distances as great as 100 mm."

not with any sort of tuned circuit in the repeater...

I'd say 10us would be quite possible.

Bye. Jasen

...

requiring the card coming within 4" of the reader

at freeway speeds that could prove exciting.

Maybe an external antenna (not mentioned) could increase the range?

Bye. Jasen