Wireless Notes
Learn NFC with working principle, reader/writer peer-to-peer card-emulation modes, contactless payment tap-to-pay, transit cards, data exchange, and security features for engineering students.
Understanding NFC technology, its electromagnetic coupling principles, operating modes, data exchange protocols, security features, and the applications that make tap-to-pay, access cards, and device pairing possible.
NFC Fundamentals
Electromagnetic Coupling Principle
NFC operates at 13.56 MHz (an ISM frequency) using magnetic induction between two loop antennas. Unlike far-field technologies (WiFi, cellular) where electromagnetic waves propagate independently through space, NFC operates in the near-field region where the magnetic component of the field dominates.
Think of it like two transformer coils. The initiator device generates an alternating magnetic field using its antenna coil. When a target device's coil enters this field, the changing magnetic flux induces a voltage in the target's coil — transferring both energy and data simultaneously. This is why passive NFC tags (like transit cards) need no battery — they harvest energy from the reader's magnetic field.
Near-Field vs Far-Field
| Property | Near Field (NFC) | Far Field (WiFi/BT) |
|---|---|---|
| Distance | < λ/2π ≈ 3.5m (practical: < 4cm) | Meters to kilometers |
| Field type | Magnetic (H-field dominant) | Electromagnetic wave |
| Power transfer | Yes (inductive) | No (too weak) |
| Path loss | 1/r⁶ (very rapid) | 1/r² (free space) |
| Eavesdropping range | < 1-2 meters (difficult) | Many meters (easy) |
| Antenna type | Planar coil | Dipole/patch |
The 1/r⁶ power decay is critical for security. At NFC's operating frequency of 13.56 MHz, the wavelength is 22.1 meters. The near-field boundary is at λ/2π ≈ 3.5 meters. Within this region, the signal drops extremely rapidly with distance, making remote eavesdropping impractical (though not impossible with specialized equipment).
NFC Operating Modes
Mode 1: Reader/Writer Mode
The NFC device (your phone) acts as a reader, powering and reading data from passive NFC tags. The tag has no battery — it is powered entirely by the reader's magnetic field.
Applications: Reading smart posters, URL tags, product information, inventory management
Data flow: Phone → powers tag → tag responds with stored data → phone processes
Mode 2: Card Emulation Mode
The NFC device pretends to be a passive card (like a credit card or access badge). The phone responds to an external reader exactly as a physical card would.
Applications: Mobile payments (Apple Pay, Google Pay), transit cards, access control
Data flow: Payment terminal → sends commands → phone's secure element responds with card data
Mode 3: Peer-to-Peer Mode
Two active NFC devices communicate bidirectionally, taking turns as initiator and target. Both devices generate their own RF field.
Applications: Android Beam (deprecated), device pairing, small file transfer, WiFi credential sharing
Data flow: Device A ↔ Device B (bidirectional, alternating active roles)
NFC Protocol Stack
Physical Layer
| Parameter | Specification |
|---|---|
| Frequency | 13.56 MHz (ISM band) |
| Data rates | 106, 212, 424 kbps |
| Modulation (106 kbps) | ASK 100% (passive) or ASK 10% (active) |
| Modulation (212/424 kbps) | Manchester coding with ASK |
| Coding | Modified Miller (Type A) or Manchester (Type F) |
| Range | < 4 cm typical, 10 cm maximum |
| Field strength | 1.5-7.5 A/m at reader antenna |
Communication Standards
NFC encompasses several underlying communication standards:
| Standard | Origin | Speed | Used For |
|---|---|---|---|
| NFC-A (ISO 14443A) | Contactless smart cards | 106 kbps | Payment cards, access badges |
| NFC-B (ISO 14443B) | Contactless smart cards | 106 kbps | Passports, ID cards |
| NFC-F (FeliCa, JIS X 6319) | Sony (Japan) | 212/424 kbps | Transit cards (Suica, Octopus) |
| NFC-V (ISO 15693) | Vicinity cards | 26 kbps | Library books, asset tracking |
NDEF — NFC Data Exchange Format
NDEF is the standard format for data stored on NFC tags and exchanged between devices. It defines structured messages containing one or more records:
| ├── Record 1 | URL (https://example.com) |
| ├── Record 2 | Text ("Tap for more info") |
| └── Record 3 | Smart Poster (combines URL + text + image reference) |
Each record has a Type Name Format (TNF) that tells the receiving device how to handle the data — whether to open a browser, launch an app, or process custom data.
NFC Tag Types
The NFC Forum defines five tag types with different capabilities:
| Tag Type | Standard | Memory | Speed | Features |
|---|---|---|---|---|
| Type 1 | ISO 14443A | 96B-2KB | 106 kbps | Read/write, no collision detection |
| Type 2 | ISO 14443A | 48B-2KB | 106 kbps | Read/write, anti-collision, cheapest |
| Type 3 | FeliCa | 1-9 KB | 212 kbps | Read/write, faster |
| Type 4 | ISO 14443A/B | 32KB | 424 kbps | Read/write, ISO 7816 APDUs |
| Type 5 | ISO 15693 | 64B-8KB | 26 kbps | Longer range (~1m), inventory |
Type 2 tags (like NTAG213/215/216) are the most common due to their low cost ($0.05-0.20 per tag in volume) and sufficient memory for URLs and short text.
Security in NFC
Inherent Security from Short Range
NFC's primary security advantage is its very short operating range. An attacker would need to be within centimeters of the transaction — making surreptitious interception extremely difficult in practice. However, "difficult" is not "impossible."
Potential Attack Vectors
| Attack | Description | Mitigation |
|---|---|---|
| Eavesdropping | Capturing RF signal from meters away (requires sensitive equipment) | Range is limited; encrypted channels |
| Data modification | Altering bits during transmission | CRC checks, secure protocols |
| Relay attack | Forwarding NFC communication over long distance | Distance bounding protocols, user verification |
| Tag cloning | Copying a passive tag's data | Cryptographic authentication (DESFire, JCOP) |
Secure Element Architecture
For payment applications, sensitive data (card numbers, cryptographic keys) is stored in a Secure Element — a tamper-resistant chip separate from the main processor. Three architectures exist:
- Embedded SE — Chip soldered onto phone motherboard (Apple's approach)
- SIM-based SE — Secure storage on the SIM card (carrier-controlled)
- HCE (Host Card Emulation) — Software emulation with cloud-based security (Google's approach)
NFC vs Other Short-Range Technologies
| Feature | NFC | Bluetooth | QR Code | RFID (UHF) |
|---|---|---|---|---|
| Range | < 4 cm | 10-100 m | Line of sight | 1-12 m |
| Setup time | < 0.1 s | 2-6 s (pairing) | 1-2 s (camera) | < 0.1 s |
| Two-way | Yes | Yes | No (static) | Limited |
| Power (tag) | None needed | Battery required | None | None needed |
| Security | High (range) | Medium (encryption) | Low | Low-Medium |
| Data rate | 424 kbps | 2 Mbps | ~3 kbps (visual) | 40-640 kbps |
| Cost per tag | $0.05-0.50 | $5+ (module) | ~$0 (printed) | $0.05-0.15 |
Real-World Applications
Contactless Payments
NFC payments (Apple Pay, Google Pay, contactless cards) use card emulation mode. The phone's secure element stores tokenized card credentials. During a transaction:
- Phone enters reader's RF field
- Reader selects payment application via AID
- Secure element generates a one-time cryptogram
- Transaction data (amount, cryptogram) sent to payment network
- Authorization returned — total time under 500 ms
Public Transit
Cities worldwide use NFC for transit (London Oyster, Tokyo Suica, Hong Kong Octopus). The speed requirement is critical — passengers must tap and pass through gates in under 200 ms. NFC-F (FeliCa) at 212 kbps is preferred in Japan for its faster transaction time.
Access Control and Smart Home
NFC tags placed at home locations can trigger smartphone automations — tap a tag on your nightstand to set an alarm and enable silent mode; tap one at your desk to connect to work WiFi and open email.
Key Takeaways
- NFC operates at 13.56 MHz using magnetic induction in the near-field region, enabling energy transfer to passive tags that need no battery
- The extremely short range (< 4 cm) is a deliberate security feature — not a limitation — making interception impractical without physical proximity
- Three operating modes (Reader/Writer, Card Emulation, Peer-to-Peer) cover the full spectrum from reading cheap tags to secure payments
- Signal power decays as 1/r⁶ in the near field — vastly faster than far-field's 1/r² — providing inherent eavesdropping protection
- NFC transactions complete in under 500 ms with zero user configuration, making it ideal for high-throughput applications like transit gates
- Secure Elements protect payment credentials in tamper-resistant hardware separate from the phone's main processor
- At $0.05-0.20 per passive tag, NFC enables mass deployment for asset tracking, smart posters, and authentication tokens
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for NFC Near Field Communication Working Applications.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Wireless Communications topic.
Search Terms
wireless-communications, wireless communications, wireless, communications, network, technologies, nfc, nfc near field communication working applications
Related Wireless Communications Topics