A Study on Security and Privacy Protection of Low-Cost RFID Systems with Ownership Transfer

Radio Frequency Identification (RFID) system has become pervasive in the past few years. It is often used in supply chain management, logistics, healthcare management and biochips identification and tracking. The American department store, Wal-Mart, insisted their first 100 suppliers to deploy RFID on their product packages and shelves by 2005. Wal-Mart has the 20% of retail sales in the world and 60% of retail sales in American. Wal-Mart predicts that RFID implementation will reduce inventory and labor errors and cost for about 8.4 billions U.S. dollars a year. Therefore, “No RFID, No Business!” will become the trend for the next few years. RFID will be the major technology to modify the business models. A RFID tag will be attached to every product in the future. This kind of tag is called “Low-Cost RFID Systems”. The cost for the tags should be the minimum. However, when there is not enough resource for the tags to operate, the current cryptography will not be suitable for low-cost RFID systems. As a result, security and privacy of tags will become a major problem. There are some approaches using one-way hash function in the tags to protect security and privacy, but it could result an expensive cost. The goal of this project is to design a method that is based on EPCglobal Class 1 Gen 2 tags to provide a better protection of security and privacy in the premise of lower cost, even if tags could be read by anyone. In this project, we hope that tags only need to be added the functions of addition and exclusive OR (XOR) to provide a better protection of data confidentiality, integrity, personal privacy and location privacy. Furthermore, eavesdropping and tracking can be prevented and the probability of being attacked can be reduced. We believe that user’s information security and personal privacy will be efficiently protected when RFID tags are spread through out the world. Besides, we also consider the security and privacy issues of ownership transfer.

Project ID:PF9907-8108
External Project ID:NSC99-2410-H182-030