Verayo launches security chips for fool-proof transit passes

Electronic transit passes have been incredibly easy to hack. But a new generation of chips from Verayo could give would-be transit freeloaders a much harder time.
Verayo makes radio frequency identification chips, or RFID chips. Most of these are easy to for hackers to clone, allowing them to take a transit pass and put unlimited funds on it. But Verayo specializes in making unclonable chips. It does so by taking advantage of the minute, molecular flaws in chips. (See the company’s video that explains this here).
Verayo’s technology was dreamed up by Srini Devadas, an electrical engineering and computer science professor at the Massachusetts Institute of Technology. Devadas started the company in 2005 and developed the technology for two years with funding from the U.S. government.
Devadas figured out that each chip has minute physical characteristics that are often viewed as manufacturing flaws on an atomic level. But Devadas thought of them as unique, unclonable identifiers that could verify the authenticity of a chip.
If you send an electrical signal into a chip, you will get a unique response due to the chip’s unique  physical unclonable functions, or PUFs. The good thing about these PUFs is they are cheap; they are tiny circuits that add virtually no cost to a chip. The technology fits well with basic tests for authenticating products. You can give a chip 50 different challenges that produce 50 different responses.
You store the responses on a server. Then you put the chip into an RFID tag that can be attached to a retail product as if it were a bar code. When someone buys that product, a reader at the cash register will read the serial number on the tag. The reader then sends the serial number back to the centralized computer in a data center. That server will look up the serial number in its database and send one of the 50 challenges associated with that specific chip. The reader receives the challenge and it prompts a response from the chip in the tag. That response goes back to the server. If it’s a match, then the chip is verified as authentic.
When you take a transit pass, you are passing the RFID chip in front of a reader. That reader will decrypt the data on the chip and issue a query based on the unique features on the chip. The chip will respond to that query by providing the right answer that is unique to its own silicon fingerprint, a kind of digital genetic code. The authentication is verified and the transit pass is approved.
Others can create this kind of system, but Verayo can do it without any extra circuitry for cryptographic computation, because it is relying on the silicon fingerprint. That means Verayo’s solution uses less circuitry and by default is much less expensive, said Anant Agrawal, chief executive of Verayo, in an interview.
Its first series of chips debuted last year and required connection to a network to confirm the authenticity of the chip. Now the Palo Alto, Calif.-based company is producing a second generation of chips — the Vera M4H and the Vera M4HW — that will be good for transit passes and other applications. The other applications include secure identification cards and product anti-counterfeiting measures.
The Vera M4H can be used in transit tickets, secure IDs, access cards and product anti-counterfeiting devices. These are super low-cost chips, and the interesting thing about them is that they do not to connect to a network, yet they can be used an unlimited number of times. This feature is useful in transit tickets, because ticket machines aren’t necessarily networked and there is no time to check a database in a far away server to validate a particular card.
The Verayo M4H is immediately available for production. The second version, the Verayo M4HW, has built-in read-write memory and will be available for production later this year. That chip will have a higher level of security because it can authenticate the device that is reading the chip, and vice versa.
Customers, including mass transit agencies, are running tests with the chip now, Agrawal said. Pilot tests are also being run in the secure ID and access control applications. Verayo’s business model is to make the chips, which are then processed by other companies. Those other companies package the chips with antennae and then sell them as RFID tags. About 10 vendors are making Verayo tags.
The Verayo technology will address some huge problems. Product counterfeiting is a $600 billion worldwide problem according to various estimates.
Agrawal spent 17 years at Sun Microsystems before moving on to startups. He was previously the chief executive of inSilica, a custom chip maker that used low-cost teams in India and Slovenia to design chips. Verayo’s sole investor is Khosla Ventures.
Companies: Verayo