Researchers at RSA Security Inc.s lab have come up with a technique they said will eliminate many of the privacy concerns surrounding the use of RFID tags and enable enterprises and consumers to use the technology without worry.
The solution, which involves fooling RFID (radio frequency identification) readers into believing all possible tags are present at any given time, is an inexpensive, elegant answer to a number of the privacy and security questions being asked about RFID technology, security experts say.
RFID tags are being used in a quickly expanding array of industrial and corporate applications, most notably inventory control and tracking and security and access control.
The tags are tiny integrated circuits coupled with antennas. Each tag is programmed with a unique identification number, which it sends to a reader on request. The tags can be embedded in just about anything, including clothing, consumer goods, money and credit cards. Tags will be embedded in large euro notes within two years.
Privacy issues have surfaced because any reader can read the numbers on any tag. This means a reader in a department store, for example, could not only see what items a shopper has in her cart but could also see what other items she has purchased at competing stores, as well as how much money is in her wallet and what credit cards shes carrying.
The technology that RSA Labs is proposing would make it simple for corporations and consumers to decide which tags could be read by which readers and when. The solution uses whats known as a blocker tag to simulate all possible tag serial numbers. In doing so, it prevents the reader from discovering whether a specific tag is present.
“The conceptual basis is reasonably simple, and the blocker tags should cost no more than twice what normal tags cost,” said Ari Juels, principal research scientist at RSA Labs, in Bedford, Mass., and co-author of a paper on blocker tags. RFID tags typically cost about 5 cents each.
/zimages/1/26680.gifFor details on enterprise RFIDs ups and downs, check outCIO Insights coverage.
RFID readers cant talk to more than one tag at a time, so when multiple tags reply to a query, the readers detect a collision and revert to whats known as a singulation protocol to communicate with each tag individually. To accomplish this, the reader queries each tag for its next bit, which identifies which portion of a binary tree the tag resides on. When queried, a blocker tag responds with a 0 and a 1 bit. This causes the reader to start over and explore the entire tree.
Such a tag could be programmed to block only a certain range of RFID serial numbers. This would still allow for benign uses of RFID tags while enabling users or corporations to control which tags are readable.
“This is a brilliant idea. Id like to see one of these blocking tags attached to my wallet or car keys so that all RFIDs would be blocked,” said Avi Rubin, associate professor and technical director of the Information Security Institute at Johns Hopkins University, in Baltimore. Rubin has been researching some of the privacy implications of RFID tags. “This is increasingly important as the tags get embedded in clothing and other personal items,” he said.
RSA is in discussions with RFID manufacturers about developing the blocker tags.
“Were going to need a range of solutions here,” Juels said. He and his co-authors, Ron Rivest, one of the founders of RSA, and Michael Szydlo, also of RSA Labs, plan to present their paper on the blocker tags at the Association for Computing Machinerys Conference on Computer and Communications Security in October.