Speedpass
Encyclopedia
Speedpass is a keychain
RFID device introduced in 1997 by Mobil
Oil Corp. (which merged with Exxon
to become ExxonMobil
in 1999) for electronic payment. It was originally developed by Verifone
. As of 2004, more than seven million people possess Speedpass tags, which can be used at approximately 10,000 Exxon
, Mobil
and Esso
gas station
s worldwide. At one point, Speedpass was deployed experimentally in fast-food restaurants and supermarket
s in select markets. McDonald's
alone deployed Speedpass in over 400 Chicago area restaurants. Additionally, Stop & Shop grocery chain tested Speedpass at their Boston area stores and removed the units in early 2005. The test was deemed a failure and McDonald's removed the scanners from all their restaurants in mid 2004. Speedpass has also been previously available through a Speedpass Car Tag and Speedpass-enabled Timex
watch.
Speedpass was one of the first widely deployed consumer RFID payment systems of its kind, debuting nationwide in 1997 far ahead of today's VISA
and MasterCard
RFID trials, and the RFID/EPC
(Electronic Product Code) privacy controversy.
TIRIS RFID platform. It was originally designed by Verifone
in two configurations; one intended for installation inside the fuel dispensing "pump", and a convenience store model known as the Verifone RF250 (which was a redesign of the SC250 reader for smart cards).
The ExxonMobil Speedpass uses a cryptographically-enabled tag with a Digital Signature Transponder
(DST) which incorporates a weak, proprietary encryption
scheme to perform a challenge-response protocol. On Jan 29th 2005, RSA Security
and a group of students from Johns Hopkins University
broke the proprietary encryption algorithm used by the Exxon-Mobil Speedpass. http://www.rfidanalysis.org They were able to successfully copy a Speedpass and use the copied RFID tag to purchase gas.
In an attempt to prevent fraud, Speedpass users are now required to enter their zip code
into scanners at some gas stations. https://www.speedpass.com/forms/frmDynPage.aspx?pPg=ZipVerification.htm&pgType=N
During the 1998 development of the RF250 convenience store reader some prototype units were shipped from Verifone in Rocklin
, CA, USA to a Verifone office in Florida, USA. The units did not arrive on time and were thought to be lost in transit. They were later found, and despite each unit having a Verifone logo and being encased in boxes showing the Verifone logo; the shipping company had nothing in their lost goods database showing that name. Rather, the units turned up via a query for "flying red horse", apparently since the units displayed a small Mobil
logo—and the Mobil logo was and is a red Pegasus
. The internal codename for the project was thus changed to "Flying Red Horse".
Keychain
A keychain or key chain is a small chain, usually made from metal or plastic, that connects a small item to a keyring. The length of a keychain allows an item to be used more easily than if connected directly to a keyring...
RFID device introduced in 1997 by Mobil
Mobil
Mobil, previously known as the Socony-Vacuum Oil Company, was a major American oil company which merged with Exxon in 1999 to form ExxonMobil. Today Mobil continues as a major brand name within the combined company, as well as still being a gas station sometimes paired with their own store or On...
Oil Corp. (which merged with Exxon
Exxon
Exxon is a chain of gas stations as well as a brand of motor fuel and related products by ExxonMobil. From 1972 to 1999, Exxon was the corporate name of the company previously known as Standard Oil Company of New Jersey or Jersey Standard....
to become ExxonMobil
ExxonMobil
Exxon Mobil Corporation or ExxonMobil, is an American multinational oil and gas corporation. It is a direct descendant of John D. Rockefeller's Standard Oil company, and was formed on November 30, 1999, by the merger of Exxon and Mobil. Its headquarters are in Irving, Texas...
in 1999) for electronic payment. It was originally developed by Verifone
VeriFone
VeriFone is a company that makes point-of-sale equipment. It was founded and incorporated in Hawaii in 1981, and named itself after its first product, the name standing for Verification telephone....
. As of 2004, more than seven million people possess Speedpass tags, which can be used at approximately 10,000 Exxon
Exxon
Exxon is a chain of gas stations as well as a brand of motor fuel and related products by ExxonMobil. From 1972 to 1999, Exxon was the corporate name of the company previously known as Standard Oil Company of New Jersey or Jersey Standard....
, Mobil
Mobil
Mobil, previously known as the Socony-Vacuum Oil Company, was a major American oil company which merged with Exxon in 1999 to form ExxonMobil. Today Mobil continues as a major brand name within the combined company, as well as still being a gas station sometimes paired with their own store or On...
and Esso
Esso
Esso is an international trade name for ExxonMobil and its related companies. Pronounced , it is derived from the initials of the pre-1911 Standard Oil, and as such became the focus of much litigation and regulatory restriction in the United States. In 1972, it was largely replaced in the U.S. by...
gas station
Filling station
A filling station, also known as a fueling station, garage, gasbar , gas station , petrol bunk , petrol pump , petrol garage, petrol kiosk , petrol station "'servo"' in Australia or service station, is a facility which sells fuel and lubricants...
s worldwide. At one point, Speedpass was deployed experimentally in fast-food restaurants and supermarket
Supermarket
A supermarket, a form of grocery store, is a self-service store offering a wide variety of food and household merchandise, organized into departments...
s in select markets. McDonald's
McDonald's
McDonald's Corporation is the world's largest chain of hamburger fast food restaurants, serving around 64 million customers daily in 119 countries. Headquartered in the United States, the company began in 1940 as a barbecue restaurant operated by the eponymous Richard and Maurice McDonald; in 1948...
alone deployed Speedpass in over 400 Chicago area restaurants. Additionally, Stop & Shop grocery chain tested Speedpass at their Boston area stores and removed the units in early 2005. The test was deemed a failure and McDonald's removed the scanners from all their restaurants in mid 2004. Speedpass has also been previously available through a Speedpass Car Tag and Speedpass-enabled Timex
Timex Group
Timex Group B.V., or Timex Group, is a Dutch holding company headquartered in Hoofddorp, the Netherlands, and the corporate parent of several watchmaking companies around the globe including Timex Group USA, Inc., TMX Philippines, Inc., and Timex Group India Ltd...
watch.
Speedpass was one of the first widely deployed consumer RFID payment systems of its kind, debuting nationwide in 1997 far ahead of today's VISA
VISA (credit card)
Visa Inc. is an American multinational financial services corporation headquartered on 595 Market Street, Financial District in San Francisco, California, United States, although much of the company's staff is based in Foster City, California. It facilitates electronic funds transfers throughout...
and MasterCard
MasterCard
Mastercard Incorporated or MasterCard Worldwide is an American multinational financial services corporation with its headquarters in the MasterCard International Global Headquarters, Purchase, Harrison, New York, United States...
RFID trials, and the RFID/EPC
Electronic Product Code
The Electronic Product Code is designed as a universal identifier that provides a unique identity for every physical object anywhere in the world, for all time. Its structure is defined in the EPCglobal Tag Data Standard , which is an open standard freely available for download from the website...
(Electronic Product Code) privacy controversy.
Technology behind the Mobil Speedpass
The ExxonMobil Speedpass is based on the Texas InstrumentsTexas Instruments
Texas Instruments Inc. , widely known as TI, is an American company based in Dallas, Texas, United States, which develops and commercializes semiconductor and computer technology...
TIRIS RFID platform. It was originally designed by Verifone
VeriFone
VeriFone is a company that makes point-of-sale equipment. It was founded and incorporated in Hawaii in 1981, and named itself after its first product, the name standing for Verification telephone....
in two configurations; one intended for installation inside the fuel dispensing "pump", and a convenience store model known as the Verifone RF250 (which was a redesign of the SC250 reader for smart cards).
Security of the Mobil Speedpass
Digital Signature Transponder
The Texas Instruments Digital Signature Transponder is a cryptographically-enabled radio-frequency identification device used in a variety of wireless authentication applications...
(DST) which incorporates a weak, proprietary encryption
Encryption
In cryptography, encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information...
scheme to perform a challenge-response protocol. On Jan 29th 2005, RSA Security
RSA Security
RSA, the security division of EMC Corporation, is headquartered in Bedford, Massachusetts, United States, and maintains offices in Australia, Ireland, Israel, the United Kingdom, Singapore, India, China, Hong Kong and Japan....
and a group of students from Johns Hopkins University
Johns Hopkins University
The Johns Hopkins University, commonly referred to as Johns Hopkins, JHU, or simply Hopkins, is a private research university based in Baltimore, Maryland, United States...
broke the proprietary encryption algorithm used by the Exxon-Mobil Speedpass. http://www.rfidanalysis.org They were able to successfully copy a Speedpass and use the copied RFID tag to purchase gas.
In an attempt to prevent fraud, Speedpass users are now required to enter their zip code
ZIP Code
ZIP codes are a system of postal codes used by the United States Postal Service since 1963. The term ZIP, an acronym for Zone Improvement Plan, is properly written in capital letters and was chosen to suggest that the mail travels more efficiently, and therefore more quickly, when senders use the...
into scanners at some gas stations. https://www.speedpass.com/forms/frmDynPage.aspx?pPg=ZipVerification.htm&pgType=N
During the 1998 development of the RF250 convenience store reader some prototype units were shipped from Verifone in Rocklin
Rocklin, California
Rocklin is a city in Placer County, California located in the metropolitan area of Sacramento. It shares borders with Roseville, Loomis, and Lincoln...
, CA, USA to a Verifone office in Florida, USA. The units did not arrive on time and were thought to be lost in transit. They were later found, and despite each unit having a Verifone logo and being encased in boxes showing the Verifone logo; the shipping company had nothing in their lost goods database showing that name. Rather, the units turned up via a query for "flying red horse", apparently since the units displayed a small Mobil
Mobil
Mobil, previously known as the Socony-Vacuum Oil Company, was a major American oil company which merged with Exxon in 1999 to form ExxonMobil. Today Mobil continues as a major brand name within the combined company, as well as still being a gas station sometimes paired with their own store or On...
logo—and the Mobil logo was and is a red Pegasus
Pegasus
Pegasus is one of the best known fantastical as well as mythological creatures in Greek mythology. He is a winged divine horse, usually white in color. He was sired by Poseidon, in his role as horse-god, and foaled by the Gorgon Medusa. He was the brother of Chrysaor, born at a single birthing...
. The internal codename for the project was thus changed to "Flying Red Horse".
External links
- ExxonMobil Speedpass site
- ExxonMobil Speedpass Location Finder site
- Business Week, Mar. 10, 1997 (Retrieved May 30, 2007)