RFID People Tracking: Who, and Where, are You?
Written By Louis Sirico
As companies begin investigating the use of RFID technology, they may consider, "Can we also use RFID technology to identify or track the people involved in operations?" The short answer is absolutely, but there are important considerations to think about before putting RFID tags on everyone in the company. The first question to consider is why employee identification would be required. The typical answers are security, quality control, auditing, tracking performance statistics or all of the above.
The second question to ask is at what point does a person need to be identified? Is it to limit access to a restricted area? Does the company want to verify that an employee has the license to operate a fork-lift or other piece of equipment? Do you need to know which employee built the pallet of pharmaceutical products?
By answering these questions, it is easier to determine if RFID is an appropriate technology. Employee identification can be performed using a variety of methods and technologies:
1. A username and password are entered into a computer or terminal.
2. A pass code is entered into a key pad.
3. Magnetic strip cards typically found on the back of employee badges can be used with stripe readers.
4. An RFID-enabled badge can be associated with an individual.
5. Biometric devices such as fingerprint or retina scanners identify a person's features.
6. Humans - a security officer can verify a person's identity with a photo ID.
It's important to remember that just because a badge is read at a particular location, it doesn't mean the person is actually there; it just means the badge is. Depending on the requirements, multiple methods of authentication may be used. For example, to access a certain area of a building, an RFID-enabled badge can be used to open a locked door. There are two standards which are commonly used for individual authentication applications:
A Vicinity Card
is defined by the ISO/IEC 15693 standard. It typically is used in applications involving simple authentication such as facility and parking access. The tag simply contains user data plus a unique identification number.
A Proximity Card
is defined by the ISO/IEC 14443 standard. It is typically used in banking and finance, mobile communications, conditional access, pay TV, government, network access and transportation applications.
The most important difference between the standards is that ISO/IEC 14443 uses encryption and requires one or more passwords to access the data contained on the card. The data on the card may be a PIN number that the employee must punch into a keypad. The combination of the badge and the knowledge of the PIN number provides access to the building. This makes this standard a better solution for applications requiring high security. Visa announced it is endorsing a global payment specification for contactless cards based on ISO/IEC 14443, due to its security capabilities.
Due to the increased complexity of the ISO/IEC 14443 tag, it actually requires more power to operate, which results in a shorter read range: up to 4 inches. The Vicinity Card can be read up to 3 feet away.
Both standards have been in production since 2000. What is important to understand is that these standards are implemented using High Frequency (HF, 13.56 MHz) and not Ultra High Frequency (UHF, 860-960 MHz). UHF is probably what your company will use for RFID supply chain applications.
Which do you use?
HF is less susceptible to the water in the human body than UHF. It also has a shorter read range. For this particular application, a reduced read range is a benefit so a person doesn't unlock a door simply by walking down the hall, but must place the badge within a few inches of the reader.
Some companies have tried ISO/IEC 18000-6C, the technology used on the cases and pallets and put them into an employee badge. After coming up with a design that helped overcome the water in the human body, the results were very positive. A badge with a tag in it can record the operator that builds the pallet of tagged goods.
With the current UHF RFID tags, the PIN could not easily be encrypted if stored on the tag. Reducing the read range with UHF can be achieved by reducing the power emitted from nearby readers. The biggest challenge is that data stored on the current UHF RFID tags can be easily compromised. The level of encryption is not considered strong enough for banking purposes.
Since UHF tags are much less expensive than HF tags, and infrastructures of UHF equipment are being implemented throughout the supply chain, some predict an eventual migration to UHF for employee authentication, but not for high security applications such as Visa's payment system.
Finally, when implementing any kind of system to track people, always keep in mind personal privacy and what your employees may think, or assume, about being tracked. Companies all over the world already use RFID for Access Control purposes. Because it is so common, most employees don't think twice when they are given a keycard to access a building, for example. In fact, people tend to feel safer when working in a secure facility. Employees, however, need to be educated regarding how RFID technology is going to be used so they don't feel they will be tracked when going to the rest room. As humorous as this may sound, it is a legitimate employee concern.