HID prox card question

[StealthRT]

Hey all. I have been issued a prox card that allows me into my parking lot. Trouble is that everytime i get there in the morinings i have to either take it out of my wallet (or off around my neck), roll down the window and place it in front of the HID reader in order for the gate to go up.

Now, is it possible for me to open up the prox card and, in some way, give it a boost so that i can have it either embedded inside my right external mirror housing thats almost right up aginst the reader outside or have it mounted inside the car? Or is the only way to extend the range is by the reader itself and nothing to do with the card at all?

I found this on wikipedia of a card taken apart and was wondering if just providing some volts (3v?) to the coil would cause it to be picked up further away?

**broken link removed**
**broken link removed**

Any info or suggestions would be great! If this can work out it will be a nice project for me to do in my spare time. Not to mention saving me time with having to get my card, roll down the window, present card, roll up the window and put my card back around my neck or wallet.

David

 

[iceblue]

The power level at the reader is probably too low to easily accomplish what you want. This is for security reasons as well.

Without knowing exactly what is inside the card, it's hard to say whether it can be done easily or not. I would just suck it up and roll down the window each morning.

 

[Jonnies]

There's not too much you can do to increase range, other than to add a larger loop antenna. The RFID chip is powered by rectifying the rf signal transmitted by the reader, which induces a current in the card's loop antenna. The induced current is proportional to the area of the loop and the number of turns of wire (think of it as transformer coupling with one coil in the reader and the other coil in the card).
So you can do better with a bigger card antenna, since you don't care about being limited to credit card size. If you do this, use similar wire and similar number of turns in order to keep the impedance about the same. And make sure you orient the loop parallel to the place of the reader.
Of course you'll have to cut open your card in order to do this.
JS

 

[Diver300]

Those RFID devices are normally tuned quite accurately to the operating frequency which is transmitted by the reader.

Power and signal travel from the reader to the RFID device. The RFID device replies by partially shorting the coil. It is the reply signal that limits the range, and it is quite difficult to boost the reply signal. To reply the coil is partially shorted for a certain number of cycles of the operating frequency. While it would be possible to send out a large signal instead of shorting the coil, it would be very difficult to keep this synchronised with the operating frequency from the reader.

 

[dougy83]

While it would be possible to send out a large signal instead of shorting the coil, it would be very difficult to keep this synchronised with the operating frequency from the reader.

Just keep transmitting, and it's likely that eventually the signal will be close enough in phase that it will be accepted (according to Proximity Cards).

Alternately, you could listen to the signal and sync to it before transmitting - yes, this is a little more involved.

 

[SABorn]

RFID (not HID) is what you are talking about here, and dispite all the good answers, what you want to do wont work, regardless of what you do to the card end.

The whole system is based around the transmiter/receiver/decoder end of the system and is all dependant on the coil size and power applied to this coil, which you have no control over.

The tag is energized by the transmitter antenna (coil) and then read by the same antenna, either in a half duplex or full duplex system, so messing with the tag coil will have little effect, the systems are designed to work within a given proximity and only the power of the transmitter coil can change this operational distance.

Sorry to say you are flogging a dead horse, trying to adapt the card for a greater signal distance.

Pete.

 

[dougy83]

The whole system is based around the transmiter/receiver/decoder end of the system and is all dependant on the coil size and power applied to this coil, which you have no control over.
...only the power of the transmitter coil can change this operational distance.

I don't believe that is correct. While you have no control over the reader coil (transmit/receive), you can control the output power of your personal transmitter to get a greater range. Instead of using the standard backscatter approach (i.e. detuning the tuned circuit) to send data, you drive your coil with the modulated carrier - this presents a much larger signal (& consequently increased range) that is coupled to the receiver coil.

 

[SABorn]

You might well be correct, but dont think its that easy.

I can only base my comments on building RFID systems from scratch, and the knowledge gained from actually working with these systems.

Driving the coil is one thing, but dont forget the coil has 2 purposes and works as a receiver as well as a transmitter.

Your theory might work with half duplex but dont see how it can work with full duplex as almost all these cards are.

Pete.

 

[Diver300]

Your theory might work with half duplex but dont see how it can work with full duplex as almost all these cards are.

Pete.

I did some work on HITAG2 RFID tags. On that the reader transmitted by interrupting the 125 kHz field for a few cycles. The length of time between the gaps in the field was long or short for 1 or 0. The tag transmitted by partially shorting its coil, in a Manchester encoded bit stream at a constant bit rate.

The signals received by the reader was tiny, and a lot of work had to go into spotting the tiny little changes in signal that were on top of the massive 125 kHz signal that was on the reader coil. The RFID tag would transmit shortly after a signal from the reader, and it was difficult to get the detector circuits to settle fast enough after the massive upset of the 125 kHz field stopping, in time to see the tiny reply signal.

I can't see how you could possibly use a system like that in full duplex, because detecting the response relied on the field being really steady.

I know that there are other RFID systems, and maybe you can tell us how they can work in full duplex.

 

[SABorn]

It is a good while ago now i had worked with RFID and its not as clear as it once was, But...

Half duplex is the system you quoted and is often in the 125-138khz range, this is where a 125khz frequency is blasted out and energizes the tag coil/chip then the transmission is stopped and the tag sends back its code between 125-138 khz.
Each time this process is repeated the tag will respond with its code.

Full duplex the carrier frequency is not switched off and the tag responds continuously and the data sent needs to be filtered out of the carrier frequency.

If you would like to read up in greater detail on these RFID systems i would surgest going to Texas Instruments web site and searching for RFID chips as they have excellent data sheets for their chips and other RFID products.

Here is a quote from a set of standards for animal tags using full duplex.

6.1 Full duplex system

An FDX transponder receiving the activation field shall transmit its code during the activation period. The FDX transponder uses a modified DBP encoded sub�carrier, which is amplitude modulated upon the radio frequency carrier. Because the slope of a low�high transition is not infinitely steep, every low�high transition is advanced in time to a maximum of eight cycles to obtain optimal performance (see figure 1). The transponder shall send its message back using the frequency bands 129,0 kHz to 133,2 kHz and 135,2 kHz to 139,4 kHz. The duration of one bit is 32 activation field cycles. This corresponds to a bit rate of 4 194 bits/s.

NOTE � The basic frequency of the sub�carrier, containing the phase encoded data signal, is not influenced by the advancement in time of the low�high transition and remains 4 194 Hz (binary 1: 180º phase shift; binary 0: no phase shift).

Most of what i done was with the 125khz range in half duplex as used in animal eartags.

Here is a few data sheets that might help with a few understandings.

Pete.

 

[dougy83]

Driving the coil is one thing, but dont forget the coil has 2 purposes and works as a receiver as well as a transmitter.

I haven't forgotten that there are 2 coils involved: the one in the reader (tx & rx) and the one in the card. The reader coil has the carrier (which may be >100 volts); its amplitude modulated by the presence of an external tuned circuit (e.g. a card LC) - the modulation may be <0.1 volt). I can't imagine it would be hard to induce <0.1 volt in a tuned circuit from a short distance away.

Your theory might work with half duplex but dont see how it can work with full duplex as almost all these cards are.

I'm guessing garage entry systems are not considered high security & would generally use simplex (not even half-duplex) code spitters. I know for a fact that the one at my university was (looked the same as the photo above) & also the one for the garage at my appartment complex (I made a passive card (using a PIC, coil and 2 caps) after I lost my keys). Half-duplex is more expensive and not really needed for general garage security (I can jump a fence easier than duplicating a simplex card, or I might invite a dodgy friend over - no type of card can protect against that so why pay for a more expensive system?).

 

[dougy83]

Most of what i done was with the 125khz range in half duplex as used in animal eartags.

Cool, I wrote software for processing the cattle ear & rumen tag data & uploading to the NLIS database a few years/jobs back. The tags were simplex though.

 

[SABorn]

Be interested to see your software if you are prepared to share it.

A mate and myself built a tag reader for cattle tags too, as they sell for $1000.00 here and as he had a small farm could not justify spending that sort of money.

We had good success, but it was a big learning curve, and accessing data on the protocol was not easy too.

Like yourself we went through a lot of bench work and R&D to get a fully working prototype with reasonable reading range.

Our next stage was to construct a fixed reader so the animals could be scanned as they were run through a race, its still on the "To Do List" but to many other projects on the go at present.

And i thought we were about the only silly buggers that tackled this sort of select project, as could not find any help on designing a system for animal tags.
I think in the end out prototype costed us about $50.00 in parts and that included lcd etc.

Pete.

 

[dougy83]

Be interested to see your software if you are prepared to share it.

Link sent to your PM

Like yourself we went through a lot of bench work and R&D to get a fully working prototype with reasonable reading range.

Not a lot of bench work for me - only tried 3 times to get my duplicate tag working (which wasfine with me as I didn't want to explain why I was walking down to the garage security panel with a breadboard in my pocket)

Thanks for the link, it was good to see your prototype system.