Encrypting the Hyperlinks from NFC Chips

Question

First, forgive my complete ignorance. I've tried to research this, but I clearly don't know the correct terminology for what I'm trying to accomplish.

I'm trying to set up NFC chips that link to separate, unique profiles. The profiles will be to a web app, but I want to hide the hyperlink to prevent someone from being able to copy the direct link to the profile and put it into another NFC Chip.

Example: A Plastic Business Card with an NFC chip that takes someone to a unique web app profile on their phone. I want to make sure someone can't create a new card and copy/paste the profile link into the new card on their own.

• Note: The NFC Chip at this current moment will NOT be used for contactless payments.

Thanks.

Answer 1

So first point, security on NFC is hard, you can make it more difficult but not impossible to get the data from the card depending on how tightly you can control access to readers etc.

But from the sounds of it you are looking just to prevent casual copying.

It also sounds that you want the reading device to be a reading device.

So there are various techniques you can use to prevent casual copying, below I'll list a few in some order of complication (some can be used in combination with others):-

There is a common theme and drawbacks to some of these techniques.

You have to write your own phone App and get it to display the web App in it's own webview as you do not want the URL shown in a standard web browsers address bar.

Any protections you put in the phone App can be extracted from it by reverse engineering the phone App.

1. Use a NFC Tag like the Ntag21x range that has read password protection. You would write a phone App that knows the password to read the URL and then the App displays it
2. Encrypt the data on the card using standard encryption method and write an phone App that knows how to decrypt it and has the encryption keys to read the URL
3. Don't use a standard data format like Ndef but use your own data format again you phone app needs to know how you formatted the data to display

You can make reverse engineering of item 1 and 2 harder by not storing the "secrets" in the App itself but have it get it across the network at run time, but getting the secret can be reverse engineered or sniffed from the network.