Towards Sensing-Enabled RFID Security and Privacy

Introduction

Passive RFID (Radio Frequency Identification) tags are miniaturized devices that enable automated identification in numerous applications and circumstances (e.g., access cards, contactless credit cards, e-passports and medical implants). Unfortunately, RFID tags are plagued with a wide variety of security and privacy vulnerabilities due to the weaknesses of the underlying wireless communication radio communication. They often store sensitive information and usually respond promiscuously to any read requests. This renders the tag-specific information easily subject to eavesdropping and unauthorized reading, which further allow owner tracking, cloning or impersonation. RFID tags are also susceptible to different forms of relay attacks. They are also likely to get lost or stolen, in which case the services they provide are themselves endangered.

Providing security and privacy services for RFID tags presents a unique and formidable set of challenges. This is due to the constraints of these tags in terms of computation, memory and power resources. The problem is exacerbated by the very strict and somewhat unusual requirements of RFID applications (originally geared for automation) in terms of usability. Consequently, currently deployed or proposed solutions often fail to meet these constraints and requirements. Many security vulnerabilities remain unsolved. This motivates the need for new security and privacy mechanisms suitable for different RFID applications in terms of not only efficiency and security, but also usability.

Recent technological advancements make the fusion of RFID and sensors viable and enable many RFID tags with low-cost sensing capabilities. Intel’s Wireless Identification and Sensing Platform (WISP) is a representative sensing-enabled tag which extends RFID beyond simple identification to in-depth sensing and computation (Smith, 2006; Sample, 2007). It uses an ultra-low power 16-bit general-purpose micro-controller for sensing, computation and RFID communication. Such sensor nodes (with RFID communication interface) can be powered by harvesting Radio Frequency (RF) power from a reader. Harvested energy is stored on a capacitor that can sustain virtually unlimited charging cycles, enabling an RFID sensor to have a potentially very long lifespan and few or no requirements vis-a-vis maintenance. Also, being battery-less, these devices can have smaller form factor, which allows them to be used for sensing and computation in places where a battery-powered device cannot be placed. This new generation of RFID+sensor devices can facilitate new application domains where long life and small size (as well as, possibly, deployment in inaccessible locations) are important. They have seen use in studies on a variety of topics, from critical infrastructure health monitoring to human behavior monitoring. They also suggest new ways of providing security and privacy services by leveraging the unique characteristics of sensor data and sensing technologies for current RFID systems: First, a sensor-enabled RFID tag can acquire useful contextual information about its environment (or its owner, or the tag itself) so as to make informed decisions (for better security and privacy). Second, sensor-based communication channels can be established for tags to interface with its reader, or with other smarter devices for enhanced and finer-grained security. Third, the variability and unpredictability of certain sensed data across time, space and individuals allow extraction of randomness – an essential requirement for many cryptographic functions and protocols.

In this chapter, we highlight these potential opportunities brought by the new sensing capabilities of RFIDs, and discuss in details how different sensing technologies can be leveraged to provide efficient and user-friendly security and privacy solutions. The use of sensors can be quite straightforward in some cases and pretty complicated in some other cases. Therefore further study and investigation are needed. The purpose of this chapter is to bring awareness of these opportunities to both the research and industrial community, and to incite interests in sensing-centric RFID security and privacy research and development for the future generation of RFID systems.