Protecting Credit Card Owner Privacy

6/3/2011

Science fiction visions of the future have imagined a world in which citizens are monitored through implanted transmitters. The truth is that nefarious villains of today can track almost anyone using inexpensive technology, no implant required. All that they ask of their targets is that they carry a credit card.

An Electrical and Computer Engineering Senior Design Team from Stevens Institute of Technology set out to solve this problem by developing a smart wallet, in the process spreading awareness about this important issue. In recognition of the quality of their fundamental research and the value of their exploration, the team took 3rd place at the RIT IEEE Student Design Contest, held May 7. Team RFnoID consists of Robert Lee-Own, Vincent Lin, Max Sobell, and Scott Velivis, and was advised by Distinguished Service Professor Bruce McNair. Generous support from ITT Electronics Systems allowed the team to purchase equipment to set up a prototype.

"This is a perfect example of a Senior Design project that demonstrates a commitment to fundamental research with a powerful and direct application in the real world," says Dr. Yu-Dong Yao, Department Director for Electrical and Computer Engineering.

Contactless transactions using late-model credit cards and public transit passes in cities such as New York and Boston offer users the convenience of just waving their wallets to make purchases and board trains. Even the newest U.S. passports use this contactless technology to speed travelers through Customs. While cryptography on these cards might thwart would-be thieves if it is successful in rendering illegally retrieved data useless, privacy issues remain a problem. The near-field communications chips in the cards possess unique identities that can be read passively and at great distance to discreetly track individuals.

Currently, the most sophisticated technique for protecting a card against these types of privacy invasions is to carry a wallet lined with aluminum foil. This homespun identity protection defeats the convenience of such cards; but since there is no way of knowing when a card is being queried, the only reliable way to secure a card is to block all communication—whether desirable or not.

Team RFnoID set out to find a balance between convenience and security that is a more effective option than the foil-lined wallet. Their vision is for a smart wallet that defaults to a defensive mode, but with the push of a button will momentarily allow a card to communicate with a near-field reader.

To demonstrate their system, the team created a working prototype that consists of a transmitter and receiver running on a software-defined radio platform that only monitors the 13.56 MHz RFID frequency on which the cards communicate. The receiver listens for energy at this frequency—the signal of an attempted "handshake" from another device—and uses the transmitter to send an interfering signal, disrupting communications.

With interest in security prevailing amongst these seniors, the team is exploring the profitability of patenting their software and continuing to research this subject after graduation.

The annual RIT IEEE Student Design Contest is a celebration of regional student research projects in the areas of Electrical Engineering and Computer Engineering. This is second year in a row that Stevens has brought home a top-three spot in the competition, with the Digital Triage Assistant taking first in 2010. RFnoID took home a $1,000 prize and vigorous kudos from academics and professionals. IEEE members, impressed by the team's technology, invited the group to exhibit at IEEE Region 1 Innovation Day 2011 in New York City. The team is grateful for opportunities to compete and present their research, saying that they received incredible feedback not only from judges and engineering professionals, but also everyday card users concerned about their own privacy.

Visit the team's website,RFnoID, for additional information about the project.