## 3 Electromagnetic Security of Selected HF-Band RFID Card Readers and Access Control Systems
### Reader Systems
#### 3.1.1 Access Control System  
The diagram of the complete access control system and its practical implementation is presented in Figure 22.  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**Device** & **Type** & **Producer** \\ \hline Oscilloscope & DSO90404A & Agilent \\  & & Santa Clara, CA, USA \\ Measuring receiver & R1550 & Dynamic Sciences \\  & & Chatsworth, CA, USA \\  & HE525 & \\ A set of measurement antennas & HE526 & [PERSON]\& [PERSON] \\  & HE527 & Munich, Germany \\ Reader HF-band RFID: & & \\ \(\bullet\) Reader LF-band RFID and HF-band & NS106 RFID Reader Writer & YiToo \\ \(\bullet\) Access Control System Reader & & \\  & (Complete System) & S1-RX & SecuKey \\  & & Shenzhen, China \\ \(\bullet\) Smartphone (as a reader) & Galaxy A32 & Samsung \\  & & Suwon, South Korea \\ ID card & NTAG213 & \\ Computer with reduced electromagnetic & & Military Communication \\ emission (for cooperation with NS106 reader) & & Institute-National Research Institute, \\  & & Zegrze Poludniowe, Poland \\ \hline \hline \end{tabular}
\end{table}
Table 8: List of equipment used to carry out measurements of selected HF-band RFID readers.  
Figure 22: (a) Diagram of the access control system and (b) its practical implementation.  
The recorded signals from the tested system include both signals from the reader queries and signals from the identifier responses, which are shown in Figure 23.  
If no identifier is in the immediate vicinity of the reader (within its range), then the reader continuously sends queries (in the case of the access control system reader it is approx. every 10 ms, and approx. every 1 ms in the case of the used reader-programmer). This is shown in Figure 24.  
When the identifier is brought closer, a signal with a lower amplitude appears in response to the query, which is the response of the identifier. The lower amplitude of the response is related to the identifier's method of functioning, which does not have its own power source and \"takes\" the necessary energy from the reader's signal. However, it does not introduce additional electromagnetic energy into the environment, but only affects the signal sent by the reader, modulating it to a depth usually not exceeding 40%.  
Figure 23: An example of a signal waveform recorded from the reader–identification system.  
Figure 24: The time waveform of the signal corresponding to the queries sent by the reader when there is no identifier in range.  
The time waveform of an example of a recorded signal containing a number of questions and answers, as shown in Figure 25.  
The measuring system in which the measurements were carried out is presented in Figure 26. The measurements for this case were carried out in the frequency range from 1 MHz to 1 GHz. Potentially dangerous frequencies may be, for example, the basic frequency of the reader's operation (13.56 MHz) and its harmonics.  
A graph showing the signal level at individual frequencies is presented in Figure 27.  
Figure 26: Measuring system for testing revealing emissions from the access control system under test.  
Figure 25: Time waveform of the signal corresponding to the reader’s queries and ID responses.  
Figure 28 shows waveforms recorded with an oscilloscope connected to the \"VIDEO\" output of the measurement receiver after tuning to selected frequencies. The used FSWT26 receiver has two programmable outputs. Measured VIDEO signal can be redirected to any of these outputs. For our tests, the oscilloscope connected to one of these outputs was used. The oscilloscope allows recording of binary and text files. This function was used during the conducted tests.  
Figure 28: Sample images of the obtained waveforms for frequencies equal to (**a,b**) 13.56 MHz; (c) 27.12 MHz; and (**d,e**) 40.68 MHz.  
Figure 27: Level of electromagnetic disturbances from the tested set of access control.