Abstract:

In the 2024 EDULEARN conference, we presented, for the first time, an innovative hands-on tool for self-learning of RFID technologies by means of a self-contained Student Box with all items required to develop a practical and real use case. Our main purpose at that moment was to motivate students to “learn by doing”, through the application of theoretical concepts to an actual system that they themselves could build.

One year later, in the 2025 EDULEARN conference, we extended the capabilities of our previous version with brand-new features to enhance the functionalities of the RFID Student Box in two key areas: virtualization of RFID tags and implementation of a security layer on top of the RFID protocol stack.

Both papers were part of an Educational Innovation project funded by the Technical University of Madrid (UPM) Spain and jointly developed by the Group of Radio Communications (GRC) at UPM and the Group of Radiofrequency, Electromagnetism, Microwaves and Antennas (GREMA) at University Carlos III of Madrid.

This year, it is proposed to go further by creating a third version that enhances the capabilities of the two previous models, replacing the Arduino microcontroller with a more powerful Raspberry PI to enable concurrent programming, Wi-Fi connectivity, and increased local storage memory, adopting MIFARE DESFire EV1-3 cards with AES-128 for secure closed-loop access. A central transport-network server is designed and implemented, incorporating a REST API over Wi-Fi, a mutual AES-CMAC security layer, two centralized JSON databases (Users and Blacklist), and a multi-platform web client for full system administration.

At the hardware level, the system now features fully functional, bidirectional turnstile logic. It also integrates dual RFID readers for entry and exit tracking, infrared sensors to determine pedestrian direction and prevent tailgating, and a servomotor for physical actuation. Furthermore, a physical hardware switch is implemented, allowing the system to seamlessly toggle between ticket validation and ticket recharge modes.

On the software and data management side, the project relays on simple UID reading to implement read/write operations on MIFARE DESFire EV1-3 RFID tags, enabling students to understand and deploy complex ticketing logic (e.g., single-use, multi-trip, or unlimited passes). The central server, built in Python with Flask, exposes a REST API managing five key processes: new user registration, user data update, logfile upload, blacklist download, and server queries. All reader–server sessions are secured through a mutual AES-CMAC protocol, ensuring message integrity and authenticity. To guarantee system security and traceability, the server maintains two centralized open-format JSON databases: users and blacklist, while each RFID reader incorporates a persistent JSON logfile for access tracking, as well as an IoT Wi-Fi client for both to synchronize logs with the server and download the blacklist for the RFID reader to block fraudulent cards.

This hands-on tool provides students with a comprehensive learning experience, bridging the gap between low-level hardware control (GPIO, SPI, I2C) and high-level system architecture. In this paper, we will present the objectives met in this evolutionary phase, detail the technical implementation, and review the outcomes achieved through pilot studies involving engineering students at UPM.

Keywords:

Self-learning, Learning by Doing, Educational Innovation Projects, RFID, Internet of Things (IoT), Access Control, MIFARE, RASPBERRY, REST API, AESCMAC.