How NFC Product Authentication Works with NTAG 424 DNA

The product-authentication problem

A normal NFC tag can store a URL, but copied static data may be placed on another tag. NTAG 424 DNA is designed for security-sensitive NFC applications and supports AES-128 cryptography and Secure Unique NFC messages, commonly called SUN. Each configured tap can produce dynamic data that a trusted backend verifies.

What happens during a scan

1. A compatible phone reads the tag and opens its configured URL.
2. The URL carries dynamic tag data, such as encrypted information, a read counter and a cryptographic message authentication code, depending on configuration.
3. The web application sends those values to a protected verification service.
4. The backend derives or retrieves the appropriate key material and verifies the message.
5. Business rules evaluate the result, counter behavior, product record and scan context.
6. The customer sees an authenticity result or a controlled fallback experience.

The secret keys must never be exposed in a public web page or mobile bundle. Verification belongs in a trusted backend, with careful key management and access controls.

Authentication is a complete system

A valid cryptographic message indicates that the data was created using the expected tag secret and configuration. The application still needs to manage product assignment, activation, scan history and suspicious behavior. A sudden counter change or scans from implausibly distant locations may deserve review.

The interface must also handle failure honestly. Network problems, unsupported devices and damaged tags are different from failed cryptographic verification. Clear states prevent a technical problem from being presented as proof of a counterfeit.

From authenticity to customer experience

After verification, the same scan can open registration, warranty, product information, loyalty, reordering or support. The CRM can record consented engagement, while inventory or ERP data can confirm the product variant and lifecycle. Authentication should remain separate from marketing permission: a customer scan is not automatic consent to promotional communication.

Implementation checklist

• Define the threat model and acceptable scan behavior.
• Configure diversified keys and protect master secrets.
• Verify SUN data and CMAC on the backend.
• Handle counters and replay signals according to the product flow.
• Keep audit records without collecting unnecessary personal data.
• Test tag encoding, phone compatibility, redirects and failure states.
• Plan secure manufacturing, personalization and replacement processes.

The hardware feature is only one layer. A trustworthy NFC product requires secure provisioning, backend verification, usable customer messaging and operational ownership.

Technical reference: NXP NTAG 424 DNA datasheet.