Near Field Communication (NFC)

Near Field Communication

NFC supports contactless payments, transit-card reads, data exchange, and device pairing. A smartphone can communicate with a terminal, tag, or another phone when their antennas are brought close together. Near Field Communication, or NFC, is a short-range standard whose behavior is based on inductive coupling and operation at 13.56 MHz.

NFC developed from RFID solutions used for inventory tracking and building access cards. RFID systems often use a reader that queries a passive tag in one direction. NFC profiles also support two-way exchange between powered devices while keeping the close-range setup. In 2002, Royal Philips Electronics and Sony announced joint development of NFC. The Philips semiconductor business, spun out as NXP Semiconductors in 2006, contributed to the technology's subsequent standardization.

The NFC Forum formed in 2004 as an industry association for NFC specifications and certification. Its scope includes active devices, passive tags, card emulation, and data exchange. Its device requirements separate Peer, Reader/Writer, Card Emulation, and Tag capabilities, so a certified device need not implement every role. NFC combines a short connection time with small data payloads, while confidentiality and authentication come from the protocols and application layers in use.

Inductive coupling and NFC range

Unlike many wireless technologies that transmit radio waves over long distances, NFC operates on a different physical principle: magnetic field induction transfers power and data between nearby antennas. The effective distance depends on the antenna, power, alignment, and device profile.

NFC system components

An NFC connection has an initiator and a target. Loop antennas create the coupling, and the target can harvest power from the initiator field.

• The initiator (active device): The initiator starts the exchange in reader mode and generates an electromagnetic field. It uses a power source such as a smartphone battery or the mains supply of a payment terminal.
• The target (passive or active device): The target responds to the initiator. Depending on the mode, it can harvest power from the field or use its own power source:
  • Passive: An unpowered tag such as the NFC chip in a payment card, sticker, or transit card. The chip harvests power from the initiator field.
  • Active: A powered device such as a second smartphone. In active communication, both devices can take turns generating the field.

The induction process

The process unfolds as follows:

1. The initiator device generates an alternating current in its antenna coil, creating a small, oscillating magnetic field around it.
2. When the target enters the field, the distance depends on the antennas, power, and operating profile. NFC Forum defines certified OV5 operation up to 5 mm and OV20 operation up to 20 mm, while typical NFC range is up to about 2 cm.
3. This changing magnetic field induces an electric current in the target's coil, effectively powering up the passive tag's microchip. The passive target harvests all the energy it needs to operate directly from the initiator's magnetic field.
4. Once powered, the target's chip can process information. To send data back to the initiator, it modulates this magnetic field by changing the load on its own antenna. This subtle change in the field is detected by the initiator's antenna, allowing data to be transferred from the passive tag back to the active reader.

The interaction uses $13.56 \text{ MHz}$, specified among others by ISO/IEC 18092. NFC also interoperates with ISO/IEC 14443 and ISO/IEC 15693 profiles, so compatibility depends on the technology and certification supported by the device. ISO/IEC 18092:2023 defines active and passive communication modes, modulation, coding, bit rates, frame format, initialization, and collision control. ISO/IEC 21481:2021 defines mode selection and switching for devices implementing ISO/IEC 18092, ISO/IEC 14443, or ISO/IEC 15693. NFC Forum describes data rates from 46 kbit/s to 1.7 Mbit/s, and one side can provide power for battery-less modes. Certified operating volumes use defined reference coils, so a stated range describes a test condition rather than a universal distance.

NFC operating modes

NFC Forum describes the main Reader/Writer, Peer-to-Peer, and Card Emulation modes. Its specifications also cover Wireless Charging up to 1 W, and a phone can implement a selected set of modes. The Digital Protocol specification names the protocol roles Initiator, Target, Reader/Writer, and Card Emulator, which are distinct from the user-facing scenarios. The Analog specification defines 106, 212, and 424 kbit/s bit rates for the NFC device roles. The same hardware can expose different roles in separate exchanges, depending on the active protocol. A phone therefore acts as a reader for a tag and as a card for a terminal.

1. Reader/Writer mode for tags

   An active NFC device reads a passive tag. A phone can read an NDEF record or write a new message when the tag and application support writing.

   This mode supports interaction with tagged objects. For example, if you see a movie poster at a bus stop with an NFC logo, you can tap your phone to it. In Reader mode, your phone will read the NDEF data stored on the tag embedded in the poster, which might be a URL to the movie's trailer, and an application can open the website. NFC Forum examples also cover phone numbers, short messages, email addresses, points of interest, contact data, Bluetooth pairing information, and Wi-Fi keys. Other uses include tapping an NFC business card to add the contact to your phone, or tapping an NFC-enabled speaker to download its companion app.

2. Peer-to-Peer (P2P) mode

   Two powered devices can establish a two-way channel and exchange contacts, photos, or documents. The protocol assigns the Initiator and Target roles, and both devices can take part in the exchange.

   NFC can pass data that starts a faster connection. The digital protocol is half-duplex, so devices take turns transmitting. In a profile with a rate up to 424 kbit/s, it can select devices before an application uses Bluetooth or Wi-Fi Direct for a larger file. Android Beam was an example of this approach, but it has been discontinued.

3. Card Emulation mode

   A smartphone or wearable emulates a contactless card and responds to a terminal or gate reader. The emulated card does not start the communication on its own.

   BLIK Zbliżeniowy, Google Pay, and Apple Pay use this mode, as do selected hotel keys and transit cards. The terminal starts the exchange through its NFC field. Payment security then depends on EMV, tokenisation, a Secure Element or HCE, user authentication, and issuer rules.

NFC Data Exchange Format NDEF

For devices to understand the data they read from an NFC tag, the information must be stored in a standardized format. The NFC Forum defined the NFC Data Exchange Format (NDEF) for this exact purpose. NDEF specifies a lightweight, binary message format that can be used to encapsulate one or more application-defined pieces of information.

NDEF message structure

An NDEF message contains one or more records. A record includes a header with flags, TNF, lengths, and an optional identifier, followed by its payload. A Smart Poster can combine records for a URI, descriptive text, and an icon in one message:

• The record header: The first part of the record contains flags and metadata including:
  • Type Name Format (TNF): A 3-bit field indicating the type of the payload. It tells the reading device whether the payload is a well-known type defined by the NFC Forum, a MIME media type, a URL, or a custom type.
  • Record flags: Message-boundary, short-record, and identifier flags describe how the record is encoded.
  • Payload Type: Defines the specific type of data in the payload, like "text/plain" or a URL.
  • Payload Length: The size of the payload in bytes.
• The record payload: This is the data delivered to the receiver, such as a web address, text, or contact information.

NDEF record types

NFC Forum record types help devices interpret common data. Its examples map an Internet link to a website, a phone number to a call, an email record to a message, and contact data to stored contact information. The application chooses the action after reading the record.

• URI Record: Used to store a Uniform Resource Identifier, which is most commonly a web address (URL). This is what a smart poster uses. A phone that reads this record type knows it should open its web browser.
• Text Record: Used for storing plain text in a specific language encoding (like UTF-8).
• MIME Media Type Record: Can be used to store any kind of data that can be represented by a MIME type, such as image/jpeg or application/pdf, although the small size of most NFC tags makes this impractical for large files.
• Smart Poster Record: A special type of message that can contain multiple records, such as a URL, some descriptive text, and perhaps an icon, all bundled together.

NFC security and its limits

NFC short range limits the area from which an attacker can interact with a connection. The radio layer alone does not provide confidentiality or authentication. Those properties come from the protocols and application security layers in use.

The magnetic field decreases with distance, so the reader and target must be within their operating volume. Proximity limits attack geometry, but NIST lists eavesdropping, injection, and relay attacks among the threats to wireless connections including NFC. Data exchange needs protection suited to the application:

• Eavesdropping: Placing an additional antenna close to the devices is harder than attacking a long-range network, but proximity does not remove eavesdropping. Confidentiality requires encryption and authentication defined by the protocol or application. NIST treats NFC as a wireless connection and lists eavesdropping among its possible threats.
• Injection and relay: An attacker can try to forward or modify messages, so applications should use authentication, integrity protection, and procedures that limit relay. NIST requires an encrypted activation secret for a wireless authenticator connection with an effective range below 1 meter and recommends an authenticated connection.

Payment security layers

Mobile payments use application layers built above the NFC link. Depending on the solution, they include EMV, tokenisation, a Secure Element or HCE, and user authentication. EMVCo describes tokenisation as replacing the primary account number with an alternative value constrained to a merchant, device, or payment scenario:

1. Secure Element (SE): Payment keys and applications can be stored in a Secure Element (SE). It is a separate component for protecting applications and cryptographic data. A wallet can instead use host card emulation, where the operating system and payment application provide the emulation path. The isolation from the operating system depends on the device architecture and payment solution.
2. Tokenization: An EMV Payment Token replaces the PAN with an alternative value constrained to a merchant, device, or payment scenario. Supported wallets can use that value instead of the PAN, while the exact behavior depends on the issuer, payment network, and terminal.
3. User authentication: A wallet may require a fingerprint, face recognition, or device PIN before a transaction. The requirement and exceptions depend on wallet settings, amount, country, and issuer rules. NFC carries the contactless exchange, while these controls belong to the wallet and payment system.