View E5561A-DOW_1858059.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

features ? low-power, low-voltage cmos idic ? contactless power supply , data transmission an d programming of eeprom radio frequency (rf): 100 khz to 150 khz, typically 125 khz programmable adaptation of resonance frequency easy synchronization with special terminators high-security method unilink challenge response authen tication by aut64 crypto algorithm encryption time < 10 ms, optional < 30 ms programmable at 125 khz 320-bit eeprom memory in 10 blocks of 32 bits each programmable read/write protection extensive protection against contac tless malprogramming of the eeprom programming time for one block of the eeprom typically 16 ms main options set by eeprom: ? bit rate [bit/s]: rf/32, rf/64 ? encoding: manchester, bi-phase 1. description the e5561 is a member of atmel ? ?s identification ic (idic) family for applications where information has to be transmitted c ontactlessly. the idic is connected to a tuned lc circuit for power supply and bi-directional data communication (read/write) to a base station. atmel offers an lc circuit and a chip assembled in the form of a transponder or tag. these units are small, smart and rugged data storage units. the e5561 is a read/write crypto ic for applications which demand higher security levels than standard r/w transponder ics can offer. for that purpose, the e5561 has an encryption algorithm block which enables a base station to authenticate the tran- sponder. the base station transmits a random number to the e5561. this challenge is encrypted by both ic and base station. the e5561 sends back the result to the base station for comparison. as both should po ssess the same secret key, the results of this encryption are expected to be equal. any attempt to fake the base station with a wrong transponder will be recognized immediately. the on-chip 320-bit eeprom (10 blocks of 32 bits each) can be read and written blockwise by a base station. two or four blocks contain the id code and six memory blocks are used to store the crypto key as well as the read/write options. the crypto key and the id code can be protected indivi dually against overwriting. likewise, the crypto key cannot be read out. 125 khz is the typical operational frequenc y of a system using the e5561. two read data rates are programmable. reading occurs through damping the incoming rf field with an on-chip load. this damping is detected by the field-generating base station. data transmission starts after power-up wi th the transmission of the id code and con- tinues as long as the e5561 is powered. writing is carried out with atmel's writing method. to transmit data to the e5561, the base station has to interrupt the rf for a short time to create a field gap. the information is encoded in the number of clock cycles between two subsequent gaps. standard read/write crypto identification ic e5561 4699d?rfid?09/06
2 4699d?rfid?09/06 e5561 figure 1-1. transponder system example using e5561 2. internal modes the e5561 can be operated in several internal modes, each providing a special function. these are: start-up id mode programming mode direct-access mode crypto mode stop mode password function the following section gives a short functional description of each mode. a more detailed descrip- tion is given in the section ?operating the e5561? on page 10 . 2.1 start-up after the power-on reset (por) has reset the entire circuit, the e5561 is configured by reading out the configuration da ta bits of the eeprom. 2.2 id mode during id mode, the e5561 transmits an identification data stream (id code) to the base station. as the base station reads out data coming from the transponder, this direction of data transmis- sion will be designated as read . the id code is sent in loop as long as the rf fi eld is applied. the single parts of the data stream and the type of modulation depend on the configuration loaded during start-up. the following options are available during id mode: two different bit rates and modulations two possible lengths of the id code (64 bits or 128 bits) two different terminators a 4-bit preburst followed by terminator 1 between start-up and sending the first data bits of the id code e5561 c o n t r o l l e r c o i l i n t e r f a c e memory transponder base data power response challenge crypto station
3 4699d?rfid?09/06 e5561 2.3 programming mode the e5561 must be programmed before being used in a security system. the e5561 contains a 320-bit eeprom which is ar ranged in 10 blocks of 32 bits each. progra mming the e5 561 is car- ried out blockwise, i.e., every single block has to be programmed separately. the blocks of the eeprom are divided into 4 sections: configuration id code crypto key customer configuration every section consists of one or more eeprom blocks. programming is carried out by sending the programming data sequence to the e5561. when the base station sends data to the tran- sponder, this direction of data transmission will be designated as write . when the base station has sent the data sequence and the specified block has been pro- grammed, the e5561 transmits the content of the programmed eeprom block. the content is always sent in loop with terminator 1. the beginning of the data stream is indicated by a preburst. during programming, the e5561 monitors several fault and protection mechanisms. if a fault or a protection violation is detected, the e5561 switches to id mode. 2.4 direct-access mode if the base station transmits a special data sequen ce to the e5561, it will enter the direct-access mode. the base station can activate two different functions: read the conten t of a single block of the eeprom in this case, the e5561 transmits the block's content in loop, starting with a preburst followed by the terminator which is also used to indica te the beginning of the transmission of the specified block data. reset the e5561 in case of all modes during direct-access mode, the e5561 monitors several fault and protection mechanisms. if a fault or a protection violation is detected, the e5561 switches to id mode. 2.5 crypto mode in crypto mode, a non-linear high-security encryption algorithm called aut64 is used to authen- ticate the e5561. after the base station has identified the e5561 (i.e., read the id code), the base station may authenticate the transponder by transmitting a challenge. receiving th is data sequence causes the e5561 to switch to crypto mode. this initiates the following actions: while calculating the aut64 result, the transponder transmits the checksum of the challenge the e5561 generates the response from the calculated result of the aut64 as soon as the calculation is finished, the e5561 interrupts the transmission of the checksum by sending a terminator the e5561 transmits the response in loop with a terminator back to the base station
4 4699d?rfid?09/06 e5561 the base station can read the response and authentify the transponder. it is possible to interrupt the calculation of the aut64 result by send ing another data sequence (e.g., if the checksum was found to be wrong). during crypto mode, the e5561 monitors several fault and protection mechanisms. if a fault or a protection violation is detected, the e5561 enters id mode. 2.6 stop mode if two or more transponders are used simultaneously (e.g., in a manufacturing step), it might be useful to be able to set the transponders to a passive state. to avoid a communication conflict, the base station has to transmit a special dat a sequence to the active transponder(s) forcing them to switch to stop mode. in stop mode, the e5561 switches off the damping as long as the rf field is applied. after a power-on reset or after having received the software-reset command, the e5561 enters start-up and id mode again. during the data sequence of the stop mode, the e5561 monitors fault mechanisms. if a fault is detected, the e5561 enters id mode. the stop command can be disabled. note: for correct stop-mode operation it is ne cessary that the field be switched off instantly. 2.7 password function the password function is a separate protection mechanism to prevent a base station from read- ing or manipulating the internal configuration and data blocks of the e5561 without knowing the password. only a transition to the crypto mode is possible. if the password function is active, the base station must first send the password to enable any other operations. during password mode, the e5561 monitors several fault and protection mechanism. if a fault or a protection violation is detected, the e5561 enters id mode. 2.8 mode transitions if the e5561 is in id mode and the base station transmits a write sequence by interrupting the rf field, the internal mode changes according to the received write sequence. if an error has been detected or the password function has been enabled, the e5561 remains in id mode. a transition to and from all other modes (except the id mode) is possible by sending the corre- sponding write sequence. once the id mode is left, switching to another mode is only possible by sending an incorrect data sequence to the transponder.
5 4699d?rfid?09/06 e5561 figure 2-1. state diagram of the e5561 (overview) note: this diagram provides only an overview. in reality, more transitions are possible. reset start-up id mode sequence received crypto mode programming mode direct-access mode stop mode password function gap error transmit data transmit data transmit data gap
6 4699d?rfid?09/06 e5561 3. building blocks figure 3-1. block diagram 3.1 analog front end (afe) the afe includes all circuits directly connected to the coil. it generates the ic's power supply and handles the bi-directional data communication with the base station. it consists of the follow- ing blocks: rectifier to generate a dc supply voltage from the ac coil voltage clock extractor switchable load between coil1/coil2 for data transmission from the ic to the base station (read) field gap detector for data transmission from the base station to the ic (write) 3.2 controller the controller has the following functions: initialize and refresh the eeprom?s configuration register control memory access (read, program) handle correct write data transmission error detection and error handling control encryption operation control the adaptation of resonance frequency configuration data transmission eeprom control error detection encryption coil1 coil2 modulator a n a l o g f r o n t e n d input register b i t d e c o d e r b i t r a t e g e n e r a t o r 64- or 128-bit code controller conf. register h v g e n e r a t o r vdd crypto circuit por test pads crypto key memory a d a p t eeprom test logic vss
7 4699d?rfid?09/06 e5561 3.3 power-on reset (por) the power-on reset is a delay reset which is triggered when the supply voltage is applied. 3.4 configuration register the configuration regist er stores the configuration data r ead out from eeprom blocks 0 and 9. it is continuously refreshed whic h increases the reliability of the de vice (if the initially loaded con- figuration was wrong or modifi ed, it will be correc ted by subsequent refresh cycles). 3.5 adapt the derivation of the resonant frequency between the base station and transponder can be min- imized by switching the on-chip capacitors in parallel to the lc circuit of the transponder. by using an antenna coil in the range of 4 mh matched to 128 khz, a tuning range of about 5% can be achieved by the in ternal switch capacitors. for the adapt bit setting, the related bits (9 to 11) and the activation bit (6) in the configuration block 0 have to be set. the typical resonant frequency range is determined with 128 khz using the 000 setting and 121 khz using the 111 setting. note: due to a mailfunction, adapt bit setting 111 should not be used. 3.6 bit-rate generator the bit-rate generator can deliver bit rates of rf/32 and rf/64 for data transmission from the e5561 to the base station. 3.7 bit decoder the bit decoder forms the signals needed for write operations and decodes the received data bits in the write data stream. 3.8 modulator the modulator consists of two data encoders and the terminator generator. there are two kinds of modulation: manchester ? mid-bit rising edge = data h ? mid-bit falling edge = data l bi-phase ? every bit creates a change, a data 0 creates an additional mid-bit change by using bi-phase modulation, data trans mission always starts with damping on. 3.9 hv generator the hv generator is a voltage pump which generates about 18 v for programming the eeprom.
8 4699d?rfid?09/06 e5561 3.10 memory the memory of the e5561 is a 320-bit eeprom which is arranged in 10 blocks of 32 bits each. all 32 bits of a block are programmed simultaneously. the programming voltage is generated on-chip. block 0 is reserved for basic configuration data . blocks 1 to 9 are freely programmable. blocks 1 to 4 are used for the id code, blocks 5 to 8 cont ain the crypto key. in password mode, bits 4 to 31 of block 9 contain the password; bits 0 to 3 of block 9 contain the customer-configuration data. if no password is required, the corresponding bits can be programmed freely. note: data from the memory is transmitted seria lly, starting with the least significant bit. the basic configuration data in block 0 contains the following information (see figure 5-4 on page 12 ): type of modulation and bit rate length of id code several lock-bits terminator set the customer-configuration data in block 9 contains (see figure 5-5 on page 12 ): lock-bit for id code (blocks 1 and 4/1 to 4) lock-bit for crypto key (block 5 to 8) lock-bit for block 9 password mode enable figure 3-2. types of modulation dataclk readdata bi-phase manchester 0 00 0 111 start of transmission damping off damping on
9 4699d?rfid?09/06 e5561 figure 3-3. memory map 3.11 crypto circuit the crypto circuit uses the certified aut64 algori thm to encrypt the challenge which is written to the e5561. the computed result can be read out by the base station. comparing the encryption results of the base station and the e5561, a high-security authentification procedure is estab- lished. this procedure requires the crypto key of the e5561 and the base station to be equal. the crypto key is stored in bl ocks 5 to 8 of the eeprom and can be locked by the user to avoid read out or changes. 4. protection mechanisms several protection mechanisms are implemented into the e5561. these are mainly: error mechanisms to detect a fault. these mechanisms are always enabled. programmable protection mechanisms. these mechanisms are optional. when used, they provide protection against attempts to break the security system. 4.1 password protection if the password protection is enabled, the e5561 remains in id mode even if it has received a correct write sequence. the only possible operation is to modify the content of block 9 by send- ing the correct password bits. in all other cases, an error handling procedure is started and the e5561 enters id mode. 4.2 lock-bit protection a lock-bit is a physical part of the eeprom's conten t and is under user cont rol. the lock-bit pro- tection mechanism has two different effects: avoid programming (modifying data) of the eeprom's blocks avoid reading out the cryp to key from the eeprom us ing the direct-access mode if the base station tries to read out the crypto key and the corresponding lock-bit is set, the e5561 will enter id mode i mmediately. once the crypto key lock-b it is set, the cr ypto key can not be modified or read out any more. blocks 5 to 8 block 0 32 bits configuration data 31 0 password blocks 1 to 4 block 9 4 bit conf. 3 crypto key id code
10 4699d?rfid?09/06 e5561 there are several lock-bits available, each affecting a special data region of the eeprom. the main groups of lock-bits are: lock-bits to inhibit programming of the specified blocks of the eeprom lock-bits to inhibit programming of the specified blocks of a specific address range in both cases, an attemp t to modify a data regi on protected by a lock-bi t will cause an error han- dling procedure (i.e., the e5561 enters id mode) 4.3 stop mode the stop mode can also be used as a protection mechanism, e.g., during configuration at manu- facturing. the base station can configure the transponders one by one, forcing them into stop mode after programming. in this way, transponders can be programmed even if there are other transponders in the rf field at the same time. 5. operating the e5561 5.1 general the basic functions of the e5561 are: supply the ic from the coil read data from the eeprom to the base station authenticate the ic receive commands from the ba se station and program the re ceived data into the eeprom. several write errors can be detected to protect the memory from being overwritten with incorrect data. a password function is implemented ensuring that only authorized people can operate the ic. operating modes: id mode: the e5561 sends the id code to the base station programming mode: the e5561 programs the eeprom with data bits rece ived from the base station direct-access mode: the e5561 sends the content of single blocks of the eeprom to the base station crypto mode: the e5561 computes a response according to the challenge received from the base station and sends the response to the base station stop mode: the e5561 stops modulation an additional password function enables the e5561 to be operated only by a person who knows the password programmed in the eeprom memory. 5.2 supply the e5561 is supplied via a tuned lc circuit wh ich is connected to coil1 and coil2 pads. the incoming rf (actually a magnetic field) induces a current into the coil which powers the chip. the on-chip rectifier generates the dc supply voltage (v dd , v ss pads). overvoltage protection prevents the ic from damage due to high field strengths (depending on the coil, the open-circuit voltage across the lc circuit can reach more t han 100 v). the first occurrence of rf triggers a power-on reset pulse, ensuring a defined start-up state.
11 4699d?rfid?09/06 e5561 5.3 start-up the various modes of the e5561 are activated after the first read-out of the configuration. the modulation is on during power-on reset and is off while the configuration is read. after this initial- ization period of 190 + por time fcs, the e5 561 activates the adaption bit setting defined by configuration and enters in id mode. if the ic is configured with terminator 1, a data value of fh acc. selected data coding is sent in advance of terminator and read data (see figure 5-2 ). figure 5-1. application circuit figure 5-2. voltage at coil1/coil2 after start-up (e.g., rf/32, manchester, terminator 1) 5.4 configuration the configuration dat a of the e5561 is stored in block 0 of the eepr om which contains the fol- lowing information (see figure 5-3 on page 12 ): type of modulation and bit rate id code length several lock-bits selected terminator stop mode selection for short/long authentication time adaptation of resonance frequency the configuration may be changed by programming block 0. however, this is only possible if the lock-bit l_0 in block 0 has not been set. e5561 coil 1 coil 2 v dd v ss 125 khz energy data tuned lc coil of base station coil1-coil2 load config. (190 fcs) term. 1 v power-on reset read fh read data with selected modulation and bit-rate adaptation setting damping on damping off
12 4699d?rfid?09/06 e5561 figure 5-3. configuration data in block 0 block 9 contains the customer configuration and the password (if password function is enabled). the customer-configuration data in block 9 includes (see figure 5-5 ): lock-bit for id code (blocks 1 and 4/1 to 4) lock-bit for crypro key (block 5 to 8) lock-bit for block 9 password function enable if the password function has been enabled, bits 4 to 31 represent the password of the e5561. figure 5-4. customer configuratio n data in block 9 5.5 data transmission to the base station (read) data transmission from the e5561 to the base station is carried out by switching a load between the coil pads on (damping) and off. this changes the current through the ic coil which can be detected by the base station. figure 5-5. signals from the transponder during reading modulation (0 = manchester, 1 = bi-phase) bit-rate (0 = rf/32, 1 = rf/64) bitcount (0 = 128 bit, 1 = 64 bit) id terminator stop mode (0 = off, 1 = on) adapt (1 = value according to user programmed adapt bit setting) number of aut64-times, 0 = 24 times, 1 = 8 times lock-bit for block 0 (1 = active) tuning bits 20 bit supplier chip id (scid) 31 20 6 4 16 13 11 mod 15 14 [1] [0] 0 1 2 3 7 8 9 19 17 30 10 5 12 18 29 25 22 24 23 28 26 21 27 l_0 br bc t aut adapt bits 111 a s test only terminator terminator no terminator mod br bc t s a aut l_0 adapt bits 0 0 1 0 0 1 1 1 28 bit password 31 20 16 13 15 14 19 17 12 18 6 4 11 0 1 2 3 7 8 9 30 10 5 29 25 22 24 23 28 26 21 27 l_id l_k l_9 pwd pwd password enable ('1' = active) l_9 lockbit for block 9 ('1' = active) l_k lockbit for blocks 5 to 8 (crypto key) ('1' = active) l_id lockbit for blocks 1 and 4/1 to 4 (id code) ('1' = active) coil voltage of the e5560 coil voltage of the base station
13 4699d?rfid?09/06 e5561 5.5.1 id mode the id mode is the default mode after power-up. the id code is read out of the eeprom and sent to the base station. 5.5.2 modulation and bit rate the different bit rates and modulations of the e5561 can be selected using the appropriate bit in block 0. available bit rates are rf/32 and rf/6 4; the e5561 provides bi-phase and manchester modulation. figure 5-6. types of modulation 5.5.3 data streams reading begins with block 1 (lsb first). depending on the selected bit count, block 1 is followed by block 2, 3 and 4 (128-bit bit count) or just by block 4 (64-bit bit count). the id code is transmit- ted in loop or interrupted by the selected term inator, respectively. to avoid malfunction, the mode register is refreshed cont inuously with the content of eeprom blocks 0 and 9 during reading of block 4. the data streams of the id mode are shown in figure 5-7 . figure 5-7. id mode data streams dataclk readdata bi-phase manchester 0 00 0 111 start of transmission damping off damping on block 1 block 2 block 3 block 4 terminator block 1 block 2 block 3 block 4 terminator 128-bit bit-count with terminator block 1 block 4 terminator block 1 block 4 terminator 64-bit bit-count with terminator block 1 block 2 block 3 block 4 block 1 block 2 block 3 block 4 128-bit bit-count without terminator block 1 block 4 block 1 block 4 64-bit bit-count without terminator
14 4699d?rfid?09/06 e5561 5.5.4 terminators terminators are a special pattern to mark the beginning and the end of a code. the terminators may be used to synchronize the base station. they can be detected reliably since they are a vio- lation of the modulation scheme. after a terminator is sent, transmission of the first bit of the id code starts with damping on for a certain detection (if bi-phase modulation is used). note: terminator 2 is only available in id mode; all other modes make use of terminator 1. figure 5-8. terminators 5.6 data transmission to the e5561 (write) data transmission from the base station to the e5561 is carried out by using atmel?s write method. it is based on interrupting the rf field with short gaps. the number of field clock cycles (fc) of two consecutive ga ps encodes the 0/1 bit-information to be transmitted. 5.6.1 start gap the first gap is the start gap which triggers writ ing. during writing the damping is permanently enabled which simplifies gap detection. the start gap has to be longer than the subsequent gaps in order to be reliably de tected. by default, a start gap will be detected at any time after start-up initialization has been finished (field-on plus approximately 2 ms). terminator [3-bit period] bit period first bit last bit 1.5-bit period (damping = off) terminator 1 terminator 2 terminator if bitrate = rf/64 bit period first bit last bit 208 fcs 128 fcs 16 16 16 (damping = off) first bit terminator if bitrate = rf/32 last bit 176 fcs 128 fcs 16 16 16 (damping = off) bit period 64 32 [416 fcs] [384 fcs]
15 4699d?rfid?09/06 e5561 figure 5-9. signals to the transponder during writing 5.6.2 bit decoder the duration of the gaps is usually 50 s to 150 s. the time between two gaps is nominally 24 field clocks for a 0 and 56 field clocks for a 1. th e bit will be interpreted as 0 if there are 16 to 32 field clocks since the last field gap; it will be inte rpreted as 1 if the number of field clock cycles is in a range of 48 to 64. when there is no gap for more than 64 field clocks, writing is carried out (eot). if there is a wrong number of field clocks between two gaps ? i.e., one or more data sent were not a valid 0 or 1 ? the e5561 will detect an error (see section ?error handling? on page 19 ). figure 5-10. bit decoding scheme (number of fcs between two consecutive gaps) 5.6.3 opcodes the opcode is defined as the first two bits of a writing sequence. it is used for changing the operational modes of the e5561. there are three valid opcodes: the programming mode and direct-access mode are entered with the 10 opcode, 01 is used to initiate the authentication of the e5561, and the opcode '00' disables modulation until a por occurs. figure 5-11. opcodes rf_field gap field clock 1 0 start 1 10 >64 fcs = eot reading reading writing 1 16 32 48 64 fail 0 fail 1 eot bit decoder 1 programming mode crypto mode 0 start gap more data... stop mode > 64 clocks 0 more data... 1 10 01 11 direct-access mode 1 1
16 4699d?rfid?09/06 e5561 5.6.4 programming mode programming the eeprom of the e5 561 is carried out blockwise, i.e., every single block has to be programmed separately. the programming-mode write sequence is shown in figure 5-12 . after opcode 10, the 32 data bits have to be s ent followed by the four address bits specifying the block to be programmed (each lsb first). the sequence is completed by sending an eot (end of transmission), i.e., more than 64 field clocks without any gap. figure 5-12. programming mode write sequence when the entire write sequence has been written to the e5561, programming may proceed. there is a 64-clock delay between the end of writing and the start of programming. during this time, the eeprom's programming voltage v pp is measured and the lock-bit for the block to be programmed is examined. further, v pp is continually monitored throughout the programming cycle. if v pp is too low, the chip starts error handling. the programming time is 16 ms (including erase) with a field clock frequency of 125 khz. figure 5-13. programming after programming has been carried out, the e5561 sends an fh preburst followed by terminator 1. after that, the data just programmed is read out of the eeprom and sent in loop with terminator 1. this enables the base station to detect a malprogramming by comparing the data transmitted with the data read out after programming. this mode remains until a por occurs or another gap is detected. figure 5-14. programming mode data stream 10 data bits 31 0 adr 3 0 eot op code data bits block address 0 . . . . . .9 16 ms write mode check v pp v pp on operation write and lock ok? erase eeprom program eeprom read 0.512 ms eot received programming ends programming starts v pp terminator 1 read block read fh terminator 1 read block program block write sequence
17 4699d?rfid?09/06 e5561 figure 5-15. coil voltage in programming mode 5.6.5 direct-access mode the direct-access mode is typically used to r ead out the content of a single block of the eeprom. the write sequence is shown in figure 5-16 . following the opcode 10, the address of the block to be read has to be sent (lsb first). figure 5-16. direct-access mode write sequence it is always possible to read the content of block 0 and the four blocks of the id code. the blocks containing the crypto-key (blocks 5 to 8) can only be accessed when the corresponding lock-bit in block 9 is not set. therefore, there is no possibility for a non-authorized person to read out or modify the crypto key if it is locked. figure 5-18 shows the direct-access-mode data stream. after the write sequence, an ffh preburst is sent followed by terminator 1. after that, the addressed block and terminator 1 are sent in loop. figure 5-17. direct-access mode data stream figure 5-18. coil voltage in direct-access mode 5.6.6 software reset to set up the ics in a defined state, a software reset command can be executed by sending a pseudo block address fh. the write sequence is shown in figure 5-20 on page 18 . the reset command is also accepted during stop mode. figure 5-19. software reset v 16 ms read block term. programming end of programming sequence read fh read block term. coil1-coil2 adr 03 10 eot terminator 1 read block read ffh terminator 1 read block write sequence read block term. end of direct access sequence read ffh read block term. v coil1-coil2 101111eot
18 4699d?rfid?09/06 e5561 5.6.7 crypto mode the crypto mode enables a high-security authen tication of the e5561. for this purpose, a certi- fied algorithm called aut64 is used. th e crypto-mode write sequence is shown in figure 5-20 . after the opcode 01, the challenge is sent to the e5561 (lsb first). figure 5-20. crypto mode write sequence after the write sequence, the aut64-algorithm is started. the computation of the response takes about 30/10 ms (125 khz). during this time, a checksum ? the number of the challenge bits set to 1 ? can be read by the base station. once the response has been computed, the base station can read the response in loop with the terminator 1. this remains until a por occurs or another gap is detected. the data stream of the crypto mode is shown in figure 5-21 . figure 5-21. crypto mode datastream during the encryption calculation, the checksum is sent in loop with a special pattern (see figure 5-23 ). the bits of the checksum are sent with lsb first. if the base station detects an error by comparing the checksum, the calculation of th e response can be interrupted by sending a new challenge. this will start the authentication procedure again. figure 5-22. checksum figure 5-23. coil voltage in crypto mode the encryption time is programmable in two opti ons: the entire algorithm aut64 is executed 8 or 24 times. this feature can be set at block 0, bit 7. 01 challenge bits 63 0 eot write sequence read ffh checksum read 00b terminator 1 response terminator 1 0 0 data 6-bit checksum data ffh 11 1 1 1 1 1 1 00 data data ffh 11 1 1 1 1 1 1 05 coil1-coil2 v read end of programming sequence checksum read response term. read ffh 00b ffh term. response calculated
19 4699d?rfid?09/06 e5561 5.6.8 stop mode if several transponders enter the rf field of the base station one after the other (e.g., in a manu- facturing step), it might be useful to be able to set the transponder in a passive state. in this case, the transponder may be collected one by one and disabled after being read out. to avoid a communication conflict, the base station has to transmit a special data sequence to the active transponder(s) forcing them to enter the stop mode. during stop mode, the e5561 switches off the damping as long as the rf field is applied. after a power-on reset, the e5561 enters the start-up and the id mode again. an other possibility to exit the stop mode is to send the software reset (see figure 5-25 ). this command results in a new initialization of the ic. figure 5-24. stop mode data sequence figure 5-25. write sequence to disab le password function 5.6.9 password function the password function is a separate protection mechanism to prevent that a base station from reading or manipulating the internal configuration and data blocks of the e5561 without knowing the password. the password function may be used to prevent unauthorized programming or reading via direct-access mode. if the passwo rd bit in block 9 of the eeprom is set, only certain operations are possible, i.e., reading the id code in id mode or authentication. for programming or direct-access mode, the password function has to be disabled by receiving the password. if this function is enabled, the customer configuration can only be changed by an authorized per- son using the correct password of the e5561. during password mode, the e5561 monitors several fault and protection mechanism. if a fault or a protection violation is detected, the e5561 enters id mode. 5.7 error handling several error conditions can be detected to ensure that only valid operations affect the e5561. 11 eot 10 password 31 4 eot xxxx 1 0 0 1 x = do not care (both 0 or 1 acceptable)
20 4699d?rfid?09/06 e5561 5.8 errors while writing data there are four detectable errors possible during writing data to the e5561: field gap was not detected wrong number of field clocks between two gaps, e.g., 37 fcs the opcode is not valid (11) the number of bits received is incorrect; valid bit counts are: ? programming mode: 38 bits ? direct-access mode: 6 bits ? crypto mode: 66 bits ? stop mode: 2 bits if any of these four conditions is detected, the e5561 stops writing and enters id mode. this can easily be analyzed using the damping which is usually on during writing. it changes according to the selected modulation scheme in id mode. 5.8.1 errors during programming mode if the writing sequence has been transmitted successfully, there are three errors that may pre- vent the e5561 from programming the data to the eeprom: the programming voltage v pp is too low, i.e., the field strength is not high enough the lock-bit of the addressed block is set the password function is enabled in these cases, the procedure stops immediately after the error has been detected and the ic reverts to id mode. 5.8.2 errors during direct-access mode in addition to the possible errors mentioned before, two errors may occur in direct-access mode: the lock-bit of the addressed block 5 to 8 is set the password function is enabled in these cases, the ic enters id mode after the end of the writing sequence. 5.8.3 errors during crypto mode in crypto mode, one error mechanism is active, that may prevent the e5561 from sending the correct response: error during the crypto writing sequence the e5561 will enter id mode immediately if an er ror in the writing sequence is detected. if the password function is enabled, the e5561 enters id mode after having completed the writing sequence.
21 4699d?rfid?09/06 e5561 5.8.4 error handling during password mode if password function is enabled and the password transmitted does not match the programmed password, the full programming sequence is performed but without programming block 9. this makes it more difficult to find out the correct password by trial and error because in each case the result of the operation can only be recognized after the whole sequence has been pro- cessed. this increases the time needed to check a certain number of combinations. figure 5-26. simplified error handling of the e5561 fail fail fail start-up fail fail receive data fail ok password function send id code fail ok power-on reset number of bits lock-bit ok v pp program receive opcode eot password ok or disabled ok error handling
22 4699d?rfid?09/06 e5561 5.9 authentication especially for applications with high-security demands such as immobilizer systems, the e5561 contains an optimized authentication procedure with the following advantages: secure and fast authentication (< 100 ms) application-optimized high-security algorithm customer-specific generation of unique keys therefore, a high-security data transmission and encryption as well as a short authentication time is achieved. for further information, some additional documentation and programs are available under nda: the encryption process of the e5561 key generating program algorithm program figure 5-27. authentication procedure aut64 with r as input value base station e5561 generation of random number r calculation of the challenge r' decryption of r' to r transmit the checksum aut64 with r as input value receive the checksum calculation of the response calculate the valid response response in loop receive the response generated by the e5561 interrupt transmission of checksum transmit response transmit id code receive the id code and select the crypto key authenticate by comparing transmit the challenge receive the datastream generate rf field (encrypted random number r) the responses of e5561 to its own result checksum in loop challenge id code
23 4699d?rfid?09/06 e5561 5.9.1 initialization before using the e5561 in crypto mode, it has to be initialized. first, the crypto key to be used by the crypto algorithm has to be generated by the key-generat- ing program. this program guarantees that each crypto key is unique, no other e5561 has the same key. this key has to be stored in the memory (block 5 - block 8) of the e5561 via the pro- gramming mode. once the crypto key is locked, it can not be overwritten or read out anymore with direct-access mode. for correct authentication it is necessary that base station and transponder both use the same key. therefore, the base station needs to know wh ich transponder is currently in the field. only then, the base station can select the key corresponding to this particular transponder. for this identification the e5561 sends a string of data after it has been powered up. this id code must also be stored in the e5561. 5.9.2 starting the authentication after power-up the various modes (bit rate, enc oding) are read out of block 0. then, the e5561 transmits the id code to identify itself. thereby, the base station can identify the transponder and knows which crypto key to use. the base station forces the e5561 into crypto mode by sending the opcode 01 followed by a 64-bit string, the challenge. 5.9.3 challenge the base station generates a 64-bit random number r. this number is the starting value of the actual encryption algorithm. to improve security, this random number is not sent directly to the transponder, but is encrypted by means of a part of the crypto key. the encoded result r' is then transmitted as challenge to the transponder. once the transponder has received the encoded random number r', it recovers the random number r originally generated by the base station. both devices, the base station as well as the transponder, then start with the encryption of this number. if the number of received bits is incorrect, the e5561 leaves the crypto mode and enters read mode immediately, transmitting the id code. 5.9.4 checksum for verification of the received challenge, the e5561 sends a checksum (representing the num- ber of 1 of the challenge) with a special pattern in loop until the encryption is finished (less than 10 ms to optionally 30 ms). 5.9.5 encryption for encryption, the optimized high-security al gorithm aut64 is used. the elementary parts of this 64-bit block cipher are transposition and substitution ( figure 5-29 ). for more detailed infor- mation on this algorithm additional documentation is provided. the entire algorithm aut64 is executed 24 times. at each of these 8/24 times, another key is generated out of the crypto key. therefore, the algorithm keeps changing and a high -security level is achieved. this is confirmed by statistical analysis. for more detailed information, the description 'the encryption process of the e5561' can be pro- vided under nda.
24 4699d?rfid?09/06 e5561 5.9.6 response the 64-bit result of the algorithm is reduced to 32 bits using logical operations. this 32-bit response is sent back to the base station for comparison. if the correct keys were used, the result generated inside the base station is identical to the result sent by the e5561. the response is transmitted in loop including the terminator until the ic is powered by the rf field. this gives the base station enough time to check the validation of the response. figure 5-28. atmel?s crypto algorithm aut64 function f a0 a1 a2 a3 a4 a5 a6 a7 byte permutation a0 a1 a2 a3 a4 a5 a6 a7 a0 a1 a2 a3 a4 a5 a6 a7 substitution substitution bit permutation input of aut64 in round n input of aut64 in round n+1
25 4699d?rfid?09/06 e5561 figure 5-29. authentication example start-up id mode challenge checksum id mode response checksum send challenge power-on reset read id code 5 ms 20 ms 30 ms < 10 ms 30 ms option 10 ms response encryption and checksum and encrypt and encrypt (aut64) t < 75 ms (8 times of aut64) (if 64 bit id used, < 10 ms possible) (8 times of aut64) (24 times of aut64) t < 65 ms (8 times of aut64 and reduced id used) t < 95 ms (24 times aut64)
26 4699d?rfid?09/06 e5561 figure 7-1. application example 6. absolute maximum ratings stresses beyond those listed under ?absolute maximum ratings? may cause permanent damage to the device. this is a stress rating only and functional operation of the device at these or any other conditions beyond t hose indicated in the operational sections of this specification is not implied. exposure to absolute maximum rati ng conditions for extended periods may affect device reliability . all voltages are given corresponding to v ss . parameters symbol value unit supply voltage v dd ?0.3 to +7.0 v input voltage v in v ss ?0.3 v in v dd +0.3 v current into coil1/coil2 i c1/c2 10 ma power dissipation (dice) (1) p tot 100 mw operating temperature range t amb ?40 to +85 c storage temperature range (2) t stg ?40 to +125 c assembly temperature (t 5 min) t ass 170 c notes: 1. free-air condition. time of application: 1 s. 2. data retention reduced. 7. operating range t amb = 25c; reference terminal is v ss ; dc operating voltage v dd ? v ss = 2 v (unless otherwise noted). parameters test conditions symbol min. typ. max. unit rf frequency range f rf 100 125 150 khz supply current f rf = 125 khz, read and write i dd 15 a f rf = 125 khz, programming i dd 100 a no clock i dd 100 250 500 na clamp voltage current into coil1/coil2 = 5 ma v cl 7.5 9.0 10.2 v equivalent coil input capacitance (without self-adapt) c 1,2 30 pf programming voltage v pp 15 16 19 v programming time f rf = 125 khz t pp 16 ms data retention t retention 10 years programming cycles n cycle 100,000 ? lowest operating voltage for programming v mfs 1.8 v e5561 125 khz coil 1 coil 2 4.2 mh 386 pf to base station 386 pf 4.2 mh from oscillator energy data khz lc f res 125 2 1 = = p
27 4699d?rfid?09/06 e5561 note: for normal (coil-driven) operation, the e5561 needs only coil1 and coil2. 10. chip dimensions 11. revision history 8. ordering information extended type number package remarks E5561A-DOW dow ? 9. pads name pad window function coil1 136 136 m 2 1 st coil pad coil2 136 136 m 2 2 nd coil pad v dd 78 78 m 2 positive supply voltage v ss 82 82 m 2 negative supply voltage (gnd) coil1 coil2 4930 m 1 6 0 0 m v dd v ss test pads e5561 please note that the following page numbers referred to in this section refer to the specific revision mentioned, not to this document. revision no. history 4699d-rfid-09/06 ? put datasheet in a new template ? features on page 1 changed ? section 3.5 ?adapt? on page 7 changed ? figure 5-2 ?voltage at coil1/coil2 after start-up (e.g., rf/32, manchester, terminator 1) on page 11 changed ? section 5.4 ?configuration? on page 11 changed ? figure 5-3 ?configuration data in block 0? on page 12 changed 4699c-rfid-08/05 ? last page: disclaimer text changed 4699b-rfid-03/05 ? put datasheet in a new template ? section 5.9 ?authentication? on page 22 changed ? section 5.9.5 ?encryption? on page 23 changed
disclaimer: the information in this document is provided in connection with atmel products. no license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of atmel products. except as set forth in atmel?s terms and condi- tions of sale located on atmel? s web site, atmel assumes no liability whatsoever and disclaims any express, implied or statutor y warranty relating to its products including, but not limited to, the implied warranty of merchantability, fitness for a particu lar purpose, or non-infringement. in no event shall atmel be liable for any direct, indirect, conseque ntial, punitive, special or i nciden- tal damages (including, without limitation, damages for loss of profits, business interruption, or loss of information) arising out of the use or inability to use this document, even if at mel has been advised of the possibility of such damages. atmel makes no representations or warranties with respect to the accuracy or co mpleteness of the contents of this document and reserves the rig ht to make changes to specifications and product descriptions at any time without notice. atmel does not make any commitment to update the information contained her ein. unless specifically provided otherwise, atmel products are not suitable for, and shall not be used in, automotive applications. atmel?s products are not int ended, authorized, or warranted for use as components in applications in tended to support or sustain life. atmel corporation atmel operations 2325 orchard parkway san jose, ca 95131, usa tel: 1(408) 441-0311 fax: 1(408) 487-2600 regional headquarters europe atmel sarl route des arsenaux 41 case postale 80 ch-1705 fribourg switzerland tel: (41) 26-426-5555 fax: (41) 26-426-5500 asia room 1219 chinachem golden plaza 77 mody road tsimshatsui east kowloon hong kong tel: (852) 2721-9778 fax: (852) 2722-1369 japan 9f, tonetsu shinkawa bldg. 1-24-8 shinkawa chuo-ku, tokyo 104-0033 japan tel: (81) 3-3523-3551 fax: (81) 3-3523-7581 memory 2325 orchard parkway san jose, ca 95131, usa tel: 1(408) 441-0311 fax: 1(408) 436-4314 microcontrollers 2325 orchard parkway san jose, ca 95131, usa tel: 1(408) 441-0311 fax: 1(408) 436-4314 la chantrerie bp 70602 44306 nantes cedex 3, france tel: (33) 2-40-18-18-18 fax: (33) 2-40-18-19-60 asic/assp/smart cards zone industrielle 13106 rousset cedex, france tel: (33) 4-42-53-60-00 fax: (33) 4-42-53-60-01 1150 east cheyenne mtn. blvd. colorado springs, co 80906, usa tel: 1(719) 576-3300 fax: 1(719) 540-1759 scottish enterprise technology park maxwell building east kilbride g75 0qr, scotland tel: (44) 1355-803-000 fax: (44) 1355-242-743 rf/automotive theresienstrasse 2 postfach 3535 74025 heilbronn, germany tel: (49) 71-31-67-0 fax: (49) 71-31-67-2340 1150 east cheyenne mtn. blvd. colorado springs, co 80906, usa tel: 1(719) 576-3300 fax: 1(719) 540-1759 biometrics/imaging/hi-rel mpu/ high-speed converters/rf datacom avenue de rochepleine bp 123 38521 saint-egreve cedex, france tel: (33) 4-76-58-30-00 fax: (33) 4-76-58-34-80 literature requests www.atmel.com/literature 4699d?rfid?09/06 ? 2006 atmel corporation . all rights reserved. atmel ? , logo and combinations thereof, everywhere you are ? , idic ? and others, are regis- tered trademarks or trademarks of atmel corporation or its subsid iaries. other terms and product names may be trademarks of oth ers.

▲Up To Search▲

Price & Availability of E5561A-DOW

	To Download E5561A-DOW Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .