NIST SP 800-98 日本語訳

Special Publication 800-98

Tom Karygiannis Bernard Eydt Greg Barber Lynn Bunn Ted Phillips

NIST Special Publication 800-98

Recommendations of the National Institute of Standards and Technology

Tom Karygiannis

Bernard Eydt

Greg Barber

Lynn Bunn

Ted Phillips

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

April 2007

US Department of Commerce

Carlos M. Gutierrez, Secretary

Technology Administration

Robert C. Cresanti, Under Secretary of Commerce for Technology

National Institute of Standards and Technology

William Jeffrey, Director

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the US economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. Special Publication 800-series documents report on ITL’s research, guidelines, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.

National Institute of Standards and Technology Special Publication 800-98 Natl. Inst. Stand. Technol. Spec. Publ. 800-98, 154 pages (April 2007)

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

原本PDFの抜粋画像

The authors, Tom Karygiannis of NIST, and Bernard Eydt, Greg Barber, Lynn Bunn, and Ted Phillips of Booz Allen Hamilton, wish to thank Steven Fick, Rick Korchak, Kate Remley, Jeff Guerrieri, Dylan Williams, Karen Scarfone, and Tim Grance of NIST, and Kenneth Waldrop and Beth Mallory of Booz Allen Hamilton. These individuals reviewed drafts of this document and contributed to its technical content.

The authors would also like to express their thanks to several experts for their critical review and feedback on drafts of the publication. These experts include V.C. Kumar of Texas Instruments; Simson Garfinkel of the Naval Postgraduate School; Peter Sand of the Department of Homeland Security; Erika McCallister of MITRE; and several professionals supporting Automatic Identification Technology (AIT) program offices within the Department of Defense (DoD), especially Nicholas Tsougas, Fred Naigle, Vince Pontani, Jere Engelman, and Kathleen Smith.

During the public comment period we received helpful comments from the following Federal Government agencies: the US Departments of Defense, Health and Human Services, Homeland Security, Labor, and State; the Office of the Director of National Intelligence; the Office of Management and Budget; and the General Services Administration. We also received several helpful contributions from commercial industry, including comments from EPCglobal, VeriSign, and Priway.

Finally, the authors wish to thank the following individuals for their comments and assistance: Brian Tiplady, Daniel Bailey, Paul Dodd, Craig K. Harmon, William MacGregor, Ted Winograd, Russell Lange, Perry F. Wilson, John Pescatore, Ronald Dugger, Stephan Engberg, Morten Borup Harning, Matt Sexton, Brian Cute, Asterios Tsibertzopoulos, Mike Francis, Joshua Slobin, Jack Harris, and Judith Myerson.

This page has been left blank intentionally.

Like any information technology (IT), radio frequency identification (RFID) presents security and privacy risks that must be carefully mitigated through management, operational, and technical controls in order to realize the numerous benefits the technology has to offer. When practitioners adhere to sound security engineering principles, RFID technology can help a wide range of organizations and individuals realize substantial productivity gains and efficiencies. These organizations and individuals include hospitals and patients, retailers and customers, and manufacturers and distributors throughout the supply chain. This document provides an overview of RFID technology, the associated security and privacy risks, and recommended practices that will enable organizations to realize productivity improvements while safeguarding sensitive information and protecting the privacy of individuals. While RFID security is a rapidly evolving field with a number of promising innovations expected in the coming years, these guidelines focus on controls that are commercially available today.

RFID is a form of automatic identification and data capture (AIDC) technology that uses electric or magnetic fields at radio frequencies to transmit information. An RFID system can be used to identify many types of objects, such as manufactured goods, animals, and people. Each object that needs to be identified has a small object known as an RFID tag affixed to it or embedded within it. The tag has a unique identifier and may optionally hold additional information about the object. Devices known as RFID readers wirelessly communicate with the tags to identify the item connected to each tag and possibly read or update additional information stored on the tag. This communication can occur without optical line of sight and over greater distances than other AIDC technologies. RFID technologies support a wide range of applications—everything from asset management and tracking to access control and automated payment.

Every RFID system includes a radio frequency (RF) subsystem, which is composed of tags and readers. In many RFID systems, the RF subsystem is supported by an enterprise subsystem that is composed of middleware, analytic systems, and networking services. RFID systems that share information across organizational boundaries, such as supply chain applications, also have an inter-enterprise subsystem. Each RFID system has different components and customizations so that it can support a particular business process for an organization; as a result, the security risks for RFID systems and the controls available to address them are highly varied. The enterprise and inter-enterprise subsystems involve common IT components such as servers, databases, and networks and therefore can benefit from typical IT security controls for those components.

Implementing the recommendations presented in this publication should help organizations improve the security of their RFID systems.

Personnel responsible for designing RFID systems should understand what type of application an RFID system will support so that they can select the appropriate security controls.

Each type of application uses a different combination of components and has a different set of risks. For example, protecting the information used to conduct financial transactions in an automated payment system requires different security controls than those used for protecting the information needed to track livestock. Factors to consider include:

For RFID implementations to be successful, organizations should effectively manage their risk.

Like other technologies, RFID technology enables organizations to significantly change their business processes to increase efficiency and effectiveness. This technology is complex and combines a number of different computing and communications technologies. Both the changes to business process and the complexity of the technology generate risk. The major risks associated with RFID systems are as follows:

Organizations need to assess the risks they face and choose an appropriate mix of management, operational, and technical security controls for their environments. These organizational assessments should take into account many factors, such as regulatory requirements, the magnitude of each threat, and cost and performance implications of the technology or operational practice.

Privacy regulations and guidance are often complex and change over time. Organizations planning, implementing, or managing an RFID system should always consult with the organization’s privacy officer, legal counsel, and chief information officer.

When securing an RFID system, organizations should select security controls that are compatible with the RFID technologies they currently deploy or purchase new RFID technologies that support the necessary controls.

To be most effective, RFID security controls should be incorporated throughout the entire life cycle of RFID systems—from policy development and design to operations and retirement. However, many RFID products support only a fraction of the possible protection mechanisms. Tags, in particular, have very limited computing capabilities. Most tags supporting asset management applications do not support authentication, access control, or encryption techniques commonly found in other business IT systems. RFID standards specify security features including passwords to protect access to certain tag commands and memory, but the level of security offered differs across these standards. Vendors also offer proprietary security features, including proprietary extensions to standards-based technologies, but they are not always compatible with other components of the system. Careful planning and procurement is necessary to ensure an organization’s RFID system meets its security objectives.

This page has been left blank intentionally.

The National Institute of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347.

NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), “Securing Agency Information Systems,” as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III.

These guidelines have been prepared for use by Federal agencies. They may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired.

Nothing in this document should be taken to contradict standards and guidance made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.

This publication seeks to assist organizations in understanding the risks of RFID technology and security measures to mitigate those risks. It provides practical, real-world advice on how to initiate, design, implement and operate RFID systems in a manner that mitigates security and privacy risks. The document also provides background information on RFID applications, standards, and system components to assist in the understanding of RFID security risks and controls.

This document presents information that is independent of particular hardware platforms, operating systems, and applications. The emphasis is on RFID systems that are based on industry and international standards, although the existence of proprietary approaches is noted when they offer relevant security features not found in current standards. Readers are encouraged to supplement this document with vendor publications and other materials if interested in further pursuing proprietary approaches.

Section 6 provides a brief overview of privacy laws and regulations that pertain to Federal agencies. Privacy concerns involve legal and policy issues that are addressed more thoroughly in the documents referenced in that section. Security and privacy concerns are not entirely separable. For instance, security mechanisms designed to protect data confidentiality also serve privacy interests. On the other hand, approaches to privacy protection that involve the temporary or permanent disabling of RFID technology may introduce a security vulnerability because of the potential for these mechanisms to be used in an unauthorized or unanticipated fashion.

This publication primarily focuses on asset management, tracking, matching, process control, and supply-chain RFID applications. RFID technology is also used in contactless smart cards that support personal identification, access control, and automated payment applications. While this document provides information relevant to contactless smart card applications, it does not address the advanced

authentication and cryptography features that are incorporated into many of them.¹

This document has been created for executives, planners, systems analysts, security and privacy professionals, and engineers who are responsible for Federal government business processes or information technology (IT) systems. Professionals with similar responsibilities outside the government should also benefit from the information this document provides. The document addresses both the needs of those considering an RFID implementation and those with an existing RFID system. The document is also useful for researchers, students, market analysts and others who seek an overview of RFID technology and related security issues.

The remainder of this document is organized into seven major sections:

Readers that are already familiar with RFID and primarily are interested in the security aspects of the technology may wish to skip Sections 2 and 3 of this document and start with Section 4.

The document also contains several appendices with supporting material:

This page has been left blank intentionally.

This section provides an introduction to RFID technology. It begins with a discussion of the benefits of RFID relative to other automatic identification and data capture (AIDC) technologies. It then reviews the basic components of RFID systems and provides background information needed to understand later material in the document. Readers who already have a strong understanding of RFID technology and applications can skip this section and the discussion in Section 3 about RFID applications.

Identification processes that rely on AIDC technologies² are significantly more reliable and less expensive than those that are not automated. The most common AIDC technology is bar code technology, which uses optical scanners to read labels.³ Most people have direct experience with bar codes because they have seen cashiers scan items at supermarkets and retail stores. Bar codes are an enormous improvement over ordinary text labels because personnel are no longer required to read numbers or letters on each label or manually enter data into an IT system; they just have to scan the label. The innovation of bar codes greatly improved the speed and accuracy of the identification process and facilitated better management of inventory and pricing when coupled with information systems.

RFID represents a technological advancement in AIDC because it offers advantages that are not available in other AIDC systems such as bar codes. RFID offers these advantages because it relies on radio frequencies to transmit information rather than light, which is required for optical AIDC technologies. The use of radio frequencies means that RFID communication can occur:

The ability of RFID technology to communicate without optical line of sight and over greater distances than other AIDC technology further reduces the need for human involvement in the identification process. For example, several retail firms have pilot RFID programs to determine the contents of a shopping cart without removing each item and placing it near a scanner, as is typical at most stores today. In this case, the ability to scan a cart without removing its contents could speed up the checkout process, thereby decreasing transaction costs for the retailers. This application of RFID also has the potential to significantly decrease checkout time for consumers.

RFID products often support other features that bar codes and other AIDC technologies do not have, such as rewritable memory, security features, and environmental sensors that enable the RFID technology to record a history of events. The types of events that can be recorded include temperature changes, sudden shocks, or high humidity. Today, people typically perceive the label identifying a particular object of interest as static, but RFID technology can make this label dynamic or even “smart” by enabling the label to acquire data about the object even when people are not present to handle it.

RFID systems can be very complex, and implementations vary greatly across industries and sectors. For purposes of discussion in this document, an RFID system is composed of up to three subsystems:

Every RFID system contains an RF subsystem, and most RFID systems also contain an enterprise subsystem. An RFID system supporting a supply chain application is a common example of an RFID system with an inter-enterprise subsystem. In a supply chain application, a tagged product is tracked throughout its life cycle, from manufacture to final purchase, and sometimes even afterwards (e.g., to support targeted product recalls).

The characteristics of RFID enterprise and inter-enterprise subsystems are very similar to those of any networked IT system in terms of the types of computers that reside on them, the protocols they support, and the security issues they encounter.

Sections 2.3 through 2.5 review each of the subsystems in more detail.

To enable wireless identification, the RF subsystem consists of two components:

Both the tag and the reader are two-way radios. Each has an antenna and is capable of modulating and demodulating radio signals. Figure 2-1 shows a simple RF subsystem configuration.

Figure 2-1. An Example of a Simple RF Subsystem

Sections 2.3.1 and 2.3.2 discuss tag and reader characteristics in more detail. Section 2.3.3 explains the fundamentals of tag-reader communication.

The market for RFID tags includes numerous different types of tags, which differ greatly in their cost, size, performance, and security mechanisms. Even when tags are designed to comply with a particular standard, they are often further customized to meet the requirements of specific applications. Understanding the major tag characteristics can help those responsible for RFID systems identify the tag characteristics required in their environments and applications. Major characteristics of tags include:

Sections 2.3.1.1 through 2.3.1.5 examine these characteristics in detail.

Every tag has an identifier that is used to uniquely identify it. There are a number of data formats available for encoding identifiers on tags. System designers often want to use identifiers that have a standard structure, with certain groups of bits representing particular fields. A tag identifier format that is used across many industry sectors is the Electronic Product Code (EPC). This format was developed by the industry group EPCglobal. EPCglobal is a joint venture between Global Standards One (GS1), which was formerly known as European Article Numbering (EAN) International, and GS1 US, which was formerly known as the Uniform Code Council (UCC). The tag identifier format consists of four data fields:

Using a standard identifier format makes it easier for organizations to decode identifiers. When a machine reads a standard identifier, it can parse the identifier and decode its fields. The machine may need to request information from a remote computer to look up an identifier. When the database is distributed across several organizations and many servers, a standard identifier format with specified fields greatly facilitates the look up process. Therefore, standard identifier formats should be used whenever an RFID system will be used across multiple organizations.

If an organization does not expect its tag identifiers to be read by external parties or is concerned that the association of a tag with the organization or specific classes of objects is a business or privacy risk, then it may choose to develop and implement its own identifier format that does not reveal this information. Options include random or serialized identifiers that do not reveal information about the tagged item (e.g., its object class). Such identifiers can be encoded on many standards-based tags. These tags reserve memory for standard identifier formats but the memory does not have to be used for that purpose.

The data format chosen for an RFID system should be adequate for the entire life cycle of the system. Certain data formats may not have enough bits to uniquely encode all the tags that will be used in a particular application. For example, a supply chain RFID system may need longer identifiers to identify the large number of items that it will manage. The identifier data format also has security implications. For example, standard formats such as EPC allow an adversary to quickly obtain intelligence about a business activity by decoding the manager and object class fields.⁴

Tags need power to perform functions such as sending radio signals to a reader, storing and retrieving data, and performing other computations (e.g., those needed for security mechanisms). Tags can obtain this power from a battery or from electromagnetic waves emitted by readers that induce an electric current in the tags. The power requirements of a tag depend on several factors, including the operating distance between the tag and the reader, the radio frequency being used, and the functionality of the tag. In general, the more complex the functions the tag supports, the greater its power requirements. For example, tags that support cryptography or authentication require more energy than tags that are limited to transmitting an identifier.

Tags are categorized into four types based on the power source for communication and other functionality:

A passive tag uses the electromagnetic energy it receives from a reader’s transmission to reply to the reader. The reply signal from a passive tag, which is also known as the backscattered signal,⁵ has only a fraction of the power of the reader’s signal. This limited power significantly restricts the operating range of the tag. It also means that passive tags can only support data processing of limited complexity. On the other hand, passive tags typically are cheaper, smaller, and lighter than other types of tags, which are compelling advantages for many RFID applications.

An active tag relies on an internal battery for power. The battery is used to communicate to the reader, to power on-board circuitry, and to perform other functions. Active tags can communicate over greater distance than other types of tags, but they have a finite battery life and are generally larger and more expensive. Since these tags have an internal power supply, they can respond to lower power signals than passive tags.

A semi-active tag is an active tag that remains dormant until it receives a signal from the reader to wake up. The tag can then use its battery to communicate with the reader. Like active tags, semi-active tags can communicate over a longer distance than passive tags. Their main advantage relative to active tags is that they have a longer battery life. The waking process, however, sometimes causes an unacceptable time delay when tags pass readers very quickly or when many tags need to be read within a very short period of time.

A semi-passive tag is a passive tag that uses a battery to power on-board circuitry, but not to produce return signals. When the battery is used to power a sensor, they are often called sensor tags. They typically are smaller and cheaper than active tags, but have greater functionality than passive tags because more power is available for other purposes. Some literature uses the terms “semi-passive” and “semi-active” interchangeably.

The radio frequencies at which a tag transmits and receives signals have implications for:

Table 2-1. Impact of Selected Materials on RF Transmissions⁹, 10

Table 2-2. Common Sources of RF Interference

The primary function of a tag is to provide an identifier to a reader, but many types of tags support additional capabilities that are valuable for certain business processes. These include:

The form factor of a tag refers to its shape, size, packaging, and handling features. To a large extent, a tag’s form factor is determined by the characteristics previously discussed, such as power source and functionality. Some important aspects regarding a tag’s form factor include the size of the tag, the weight of the tag, and the method by which the tag is affixed to and removed from its associated object. Tags typically vary in size from smaller than a postage stamp to about the size of a common document stapler. Active tags typically are significantly larger and heavier than passive tags because they have an onboard power supply. Tags that integrate environmental sensors are also larger and heavier than those without this functionality. While increasing the computing functionality of a tag increases its cost and power requirements, it may not have an impact on its form factor because the microchip on a passive tag is one of the tag’s smallest components. On most passive tags, the largest component on the tag is its antenna.

Tags can be attached to items using an adhesive or can be embedded within the item. The primary concern when a tag is attached to an item is how easily it might be detached, whether accidentally or maliciously. Tags attached to items also are more vulnerable to harsh environmental conditions such as dust, debris, humidity, precipitation, and extreme temperatures. However, the vulnerability is intentional in some cases. For example, RFID tags known as frangible tags allow users to deactivate tags by tearing the tag’s antenna from its circuitry. Organizations can create frangible tags on-site using a printer similar to the one shown in Figure 2-2. Tags that are embedded in objects (e.g., smart cards, animal tissue, plastic housing) are less vulnerable to tampering and environmental conditions.

Figure 2-2. RFID Tag Printer

The tag and the reader must comply with the same standard in order to communicate. If a tag is based on a proprietary design, a reader must support the same communication protocol to communicate with that tag. In many cases, if proprietary tags are used, only proprietary RFID readers from the same vendor can be used. Reader characteristics that are independent of tag characteristics include:

These reader characteristics are discussed in Sections 2.3.2.1 through 2.3.2.4.

In most cases, standards and regulations will determine the permitted power output and duty cycle of the readers. A reader’s duty cycle is the percentage of time that the device is emitting energy over a specified period. For example, a reader that communicates for 30 seconds every minute has a 50% duty cycle. Readers that communicate with passive tags need greater power output than those that communicate with active tags because the signal must be strong enough to reach the tag and enable the backscatter to return to the reader. In general, readers with greater power output and duty cycles can read tags more accurately, more quickly, and from longer distances, but the greater power output also increase the risk of eavesdropping.

All readers have an RF subsystem interface to communicate with tags. Most also have a second interface to communicate with the enterprise subsystem. The enterprise subsystem interface supports transfer of RFID data from the reader to enterprise subsystem’s computers for processing and analysis. In most cases, the enterprise subsystem interface is used for remote management of the readers. The interface may be a wired (e.g., Ethernet) or wireless (e.g., Wi-Fi or satellite) link. Many systems use Simple Network Management Protocol (SNMP) to monitor the readers and alert administrators of conditions that warrant attention.

A reader’s interface with an enterprise subsystem may be wired or wireless. Most wired readers are in fixed locations and support applications in which the tags approach the reader. Some wired readers offer limited mobility using cables. Figure 2-3 shows a reader portal that reads tags on a pallet of boxes moving through the portal. Figure 2-4 shows reader antennas mounted above each toll lane in a series of toll booths. As vehicles pass through one of the toll lanes, the reader reads a transponder that is attached to that vehicle’s windshield.

Figure 2-3. Fixed Reader in Item Management Application

Figure 2-4. Fixed Reader in Automatic Toll Collection Application

In contrast, wireless readers support applications in which personnel must move around to read tags.¹⁴ Figure 2-5 shows an example of a mobile handheld reader. A mobile reader usually uses different communications protocols on its RF and enterprise subsystem interfaces, even though both interfaces are wireless. Institute of Electrical and Electronics Engineers (IEEE) 802.11, also known as Wi-Fi, is a common protocol for the enterprise subsystem interface, although it is also used for the RF interface on some active tag implementations. The most common RF interface protocols are defined in ISO/IEC standards, which include ISO/IEC 14443, ISO/IEC 15693, and the ISO/IEC 18000-series.

Figure 2-5. Mobile Handheld Reader

Readers use a wide variety of antenna types. Each type has a different coverage pattern. To reduce the likelihood of eavesdropping and minimize interference with other radios, the coverage should only encompass a range sufficient to communicate with the intended tags. Antennas may be integrated into the device or may be detachable. Readers that support detachable antennas are better suited for applications that require specific coverage areas because an antenna can be selected or customized to meet those requirements.

Antennas can be mounted for a particular application. Figures 2-3 and 2-4 in Section 2.3.2.3 show examples of item tracking and automatic toll payment applications. Antennas can also be mounted on forklifts to identify items when they are moved from one location to another. In industrial applications, antennas are often placed in tunnels around a production line’s conveyor belt.

Tag-reader communication is achieved by using a common communications protocol between the tag and the reader. Tag-reader communication protocols are often specified in RFID standards. Prominent international standards include the ISO/IEC 18000 series for item management and the ISO/IEC 14443 and ISO/IEC 15693 standards for contactless smart cards. The most recent EPCglobal Class-1 Generation-2 standard is essentially equivalent to the ISO/IEC 18000-6C standard. A more detailed explanation of RFID standards can be found in Appendix A on RFID Standards and Security Mechanisms.

Tag-reader communication characteristics that affect performance and security include:

These are discussed in detail in Sections 2.3.3.1 through 2.3.3.3.

Tags and readers can initiate RF transactions in two general ways:

Readers and tags in an RFID system typically operate using only RTF or only TTF transactions, not both types. Active tag TTF operation may be easier for an adversary to detect or intercept, because active tags send beaconing signals even when they are not in the presence of a reader. The adversary could eavesdrop on this communication without risking detection because in TTF transactions the adversary never has to send a signal to ascertain the tag’s presence.

Singulation is the process by which a reader identifies a particular tag. This capability is critical whenever multiple tags are in close proximity. For instance, when a reader issues a command to modify a tag’s memory, neighboring tags should not accidentally execute the same command. Similarly, when a reader sends a query to a tag, the reader should not receive a response from multiple tags.

In the EPCglobal Class-1 Generation-2 standard, the singulation protocol requires the reader to broadcast commands to all tags within its operating range. By issuing additional commands, the reader may limit interrogation to tags with specific memory contents. Tags respond with a random number. Once the reader acknowledges this number, verifying that no tag collision has occurred, the tag will transmit its unique ID to the reader. The reader may then request another random number that it uses to address the tag in subsequent communication. The random number has significantly fewer bits than the tag’s identifier, which simplifies the processing of later transactions and prevents transmission of the unique identifier by the reader.

Some RFID technologies do not support singulation. For example, ISO 11784/11785 animal tracking tags have no collision detection or avoidance mechanism because multiple tags are not usually read in close proximity for this type of application.

The communications link between a tag and a reader typically is bi-directional. The reader transmits a signal to a tag over the forward channel. The tag responds on the back channel, which is also called the reverse channel or backscatter channel. When RFID systems use passive tags, signals on the forward channel typically are much more powerful than those on the back channel. Therefore, signals on the forward channel can be detected or properly received over longer distances. This difference has important implications for RFID communications security, including both the vulnerability of RF subsystem traffic and the mechanisms used to protect it. Some relevant operational ranges related to various communications objectives are:¹⁵

Eavesdropping ranges can be significantly greater than the nominal operating ranges listed in product literature. For example, ISO/IEC 14443 tags have a typical operating range that is usually between 7 and 15 centimeters.¹⁶ However, security researchers have used a portable, low-power device to demonstrate that the rogue scanning range of an ISO/IEC 14443 contactless smart card is at least 25 centimeters (cm).¹⁷ Researchers have also successfully eavesdropped on ISO/IEC 14443 communications from distances up to 15 meters using fixed antennas and receivers that were tuned to the frequency of interest.¹⁸

If the potential adversary does not need a reply from a passive tag to achieve its objective, then the adversary can be much farther away. For instance, for many tags, a reader does not need to receive a message from the tag before writing to the tag’s memory. This attack is not possible for certain commands in EPCglobal Class-1 Generation-2 tags, because mandatory cover-coding requires the reader to receive a key from the tag before issuing a command.¹⁹ Cover-coding is a technique used to obscure the content of messages from readers to tags and is described in more detail in Section 5.3.2.1.

Similarly, an adversary can be farther away if that adversary obtains information from the mere detection of the signal, even if the signal is too weak to reliably decode. The presence of a signal indicates that RFID activity is occurring, which an adversary could use to infer that a shipment has arrived. An adversary may also be able to determine the number of transactions taking place even if that adversary cannot identify the nature of those transactions, but this nonetheless could be used infer the level of business activity. This type of intelligence gathering is called traffic analysis, and it can be performed over much greater distances than eavesdropping.

The enterprise subsystem connects readers to computers running software that can store, process, and analyze data acquired from RF subsystem transactions to make the data useful to a supported business process. For example, an RFID system in a retail clothing store has an RF subsystem that can read the identifier associated with each tagged garment. The enterprise subsystem matches the identifier to the garment’s record in a database to determine its price and the number of other items of a similar type that remain in inventory. Some simple RFID systems consist of an RF subsystem only (e.g., RFID-based key systems in which a reader can make an access control decision without access to other computers). However, most RFID systems have both an RF subsystem and an enterprise subsystem.

The enterprise subsystem consists of three major components, which are shown in Figure 2-6, and described in Sections 2.4.1 through 2.4.3:

Figure 2-6. RFID System Architecture

RFID middleware is responsible for preparing data collected from readers in the RF subsystem for the analytic systems that directly support business processes. Middleware hides the complexity and implementation details of the RF subsystem from the analytic systems. This allows the developers and users of the analytic systems to focus on the business implications of RFID data rather than the intricacies of wireless communication. For example, middleware filters duplicate, incomplete, and erroneous information it receives from readers. Middleware filtering is especially useful for applications in which large numbers of tags are in close proximity and for challenging RF environments, such as those containing reflective materials. The middleware can immediately transfer the filtered data to the analytic systems or aggregate and store it for later retrieval.

System administrators also use middleware to monitor and manage readers. For example, system administrators use middleware to adjust the power output and duty cycle to reduce the number of transaction errors. Many middleware products also support event-based triggers that perform actions automatically under certain conditions. Middleware transaction logs help with the identification of anomalous behavior, which could help an organization detect unauthorized use of the RFID system. Many middleware products also provide additional features, such as support for printing RFID labels that provide benefits beyond data and device management.

Analytic systems are composed of databases, data processing applications, and Web servers that process the data outputs of middleware based on business requirements and user instructions. They contain customized business logic for each business process they support. For example, the analytic systems of an RFID system supporting logistics may include customized rules for automated inventory management, procurement, shipping, receiving, and billing.

Analytic systems are often enterprise applications that draw inputs from multiple sources, many of which may not involve the RF subsystem. For example, some RFID systems are designed to co-exist with or complement existing AIDC systems (e.g., bar code technology). Analytic systems also correlate RFID data with non-RFID business records imported from other databases, such as records from business partners, customers, logistics service providers, and suppliers. Therefore, analytic systems are often based on commercial database software or legacy applications²⁰ that support processing of data other than RFID data. Analytic systems that are a part of the EPCglobal Network and process data based on tags that comply with EPCglobal standards are called EPC Information Services (EPCIS).

Network infrastructure enables communication between the RF and enterprise subsystems, as well as among components of the enterprise subsystem. Some important characteristics of network infrastructure include:

The topology of a network describes how network computing elements are physically and logically connected to each other. Physical topology describes the network’s cable plant or air interfaces. Logical topology describes how the communications links between devices are arranged. Network communications devices often are configured so that the logical topology is different than the physical topology. For example, communications equipment can be configured to create virtual private networks (VPN) that logically combine and segment physical networks to achieve performance and security objectives.

The physical topology of a network infrastructure supporting an RFID system depends on the physical location of the components in its enterprise subsystem. For example, the RF to enterprise subsystem connections are physically located near readers.

The appropriate physical location of middleware servers depends on the level of traffic generated by the readers. If RFID transactions are relatively infrequent (e.g., an access control system with relatively small numbers of users), then the location of middleware is not critical. In this context, the middleware can be placed in a central location to serve multiple readers. If the business process requires large numbers of tags to be read quickly (e.g., multiple checkout stations in a busy store), then middleware is located near the readers to avoid latency problems and data throughput restrictions associated with many wide area networks. In some cases, middleware capabilities are incorporated into the communication switches to which the readers connect, so RFID-related traffic does not need to traverse even a single device before it is filtered and processed. This configuration is often termed an edge processing network because the switches are considered at the network’s edges.

The physical location of analytic systems usually depends on how an organization manages its enterprise applications. If the analytic systems are dedicated to the RFID application, then organizations often place these systems near readers and middleware. On the other hand, some organizations locate their analytic systems in remote data centers to take advantage of the centers’ physical security, on-site technical personnel, and business continuity infrastructure (e.g., electric generators, enterprise data backup, high-availability communications equipment). If the analytic systems integrate both RFID and non-RFID information systems, then it is unlikely that the location of the RF subsystem will significantly influence the location of the analytic systems.

When the enterprise subsystem components are distributed across an organization’s network, the resulting physical topology can be complex, but depending on the network’s configuration, the logical topology might be relatively simple. Many organizations create virtual local area networks (VLAN) for the distributed enterprise subsystem devices that make them appear to each other as if they were on the same network segment. VLANs reduce latency that causes performance problems on networks with large numbers of time-sensitive transactions. They also isolate traffic from other systems, which improves security.

Data communications protocols are a critical component of a network’s performance, reliability, and security. A complete discussion of data communications protocols is beyond the scope of this guide, but readers should be able to distinguish between link-layer and network-layer protocols to understand how RFID enterprise subsystem network infrastructures work and are secured. Link-layer protocols specify how devices communicate with each other over a common medium, or link. Network-layer protocols (sometimes called internetwork protocols) describe how data traffic is routed across multiple network links, possibly over many types of media.

The most common link-layer protocol connecting RFID enterprise subsystem components is Ethernet (IEEE 802.3), which is the same link-layer protocol used to connect most office computers to local wired networks. Ethernet has no built-in security functionality, which means other complementary data communications protocols must provide any required protection.

In most RFID implementations, data communication within the enterprise subsystem is wired communication. The exception is mobile readers, which connect to the enterprise subsystem using a wireless link-layer protocol, such as Wi-Fi (IEEE 802.11).²¹ Wi-Fi’s characteristics are significantly different than the link-layer protocols supporting communication between tags and readers. In particular, Wi-Fi equipment supporting Wi-Fi Protected Access (WPA) includes numerous security features, such as strong authentication and encryption.²²

The most common network-layer protocol for enterprise subsystem communication is the IP. Since most modern computers are IP-enabled, enterprise subsystem components, such as middleware and analytic systems, can easily communicate across the enterprise and over external networks, including the Internet. The ability to communicate with a diverse range of computers and their application services also represents a security risk. IP-enabled enterprise subsystem components are subject to the same protocol attacks as any other IP-enabled computer.

The inter-enterprise subsystem connects enterprise subsystems together when information needs to be shared across geographic or organizational boundaries, such as in a supply chain application. Not all RFID systems contain inter-enterprise subsystems. The largest government inter-enterprise subsystem is currently the US Department of Defense’s (DoD) Global Transportation Network. The DoD improves its logistics and operational efficiency by tracking DoD assets and personnel from their origin to their destination.

While many potential methods for building inter-enterprise subsystems exist, EPCglobal’s inter-enterprise approach is a standards-based architecture that has broad industry support and publicly available documentation for review. This section focuses on EPCglobal’s approach to the inter-enterprise subsystem for illustrative purposes, but the basic functional requirements described in the discussion of the EPCglobal standards would also apply to any alternative inter-enterprise subsystem architecture.

RFID systems with inter-enterprise subsystems are called open or online systems because multiple entities have the ability to access tag-related information. In contrast, RFID systems that operate entirely within an enterprise, and thus have no inter-enterprise subsystem, are called closed or offline systems. EPCglobal is developing standards for an open infrastructure that will share data associated with EPCs over the Internet among participating organizations that agree to share such data.

To create an open system, each participating organization grants partner organizations access to its analytic systems. The access can occur over a network dedicated for this purpose, a public network such as the Internet, or a VPN that emulates the characteristics of a dedicated network using the infrastructure of a public or shared network. Both dedicated networks and VPNs are sometimes called extranets, to denote that information is shared outside the enterprise, as opposed to intranets, which are restricted to internal users. To enable extranet access, the implementing organization likely modifies its network firewall to permit RFID-related traffic to traverse the enterprise network boundary and also creates access privileges for external users on the analytic systems themselves. Companies typically sign agreements or memoranda of understanding that describe the roles and responsibilities associated with the access before enabling it.

Figure 2-7 shows how various EPCIS might be connected in an open system network.

Figure 2-7. Inter-Enterprise Architecture

Finding information about a tagged object in an open system is a challenge because the information could be located in any one of a number of analytic systems. To solve this problem, EPCglobal created the Object Naming Service (ONS), which is a global distributed database of EPC tag identifiers. Users query the ONS with a particular EPC, and the ONS returns the address information from the EPCIS that contains information associated with that EPC. The user then queries the EPCIS directly to obtain the desired data. The ONS is a resolution mechanism that directs an EPC query to where information associated with that EPC can be found on the network. In order to do that, the ONS utilizes two tiers of resolution services coordinated with the segments on the EPC string: the Root ONS and the Local ONS.

When a member of the EPCglobal Network queries the network for information about an EPC, the Root ONS utilizes the EPC Manager Number segment to direct the EPC query to the EPC’s data owner (i.e. the EPC Manager). From there, the EPC Manager’s Local ONS utilizes the object class segment to direct the query to the EPCIS that stores information for that EPC.

The ONS extends the Internet’s Domain Name System (DNS) to support resolution of an EPC with its corresponding EPCIS. ONS EPC resolution works similarly to the name resolution that Internet users employ whenever visiting Web sites or sending e-mail messages, but with some significant differences, which are presented in Table 2-3.

Table 2-3. Comparison of Traditional DNS and ONS Resolution Transactions

Much like the DNS, the Root ONS is accessible by any Internet user. Some organizations may choose to implement their own Local ONS that is not connected to the EPCglobal Root ONS. Using an independent ONS limits the applications and users that can access it. This characteristic is a beneficial feature for organizations that require their EPCs to remain confidential, but is overly restrictive for organizations that expect large numbers of external users or that cannot anticipate a priori who will have a legitimate need for the EPC records (e.g., individual retail consumers seeking support after purchase of a tagged object).

The EPCglobal Discovery Services are still in the early phases of development and use cases are still being developed to better understand the needs and requirements for this service. The concept of the EPCglobal Discovery Services is similar to ONS in that it is envisioned to return network addresses where data related to an EPC can be found. However, the Root ONS only provides information regarding where a particular tag was commissioned. It does not provide information regarding the history of a particular tag’s transactions. Multiple entities along the supply chain would benefit from having quick access to this information that ONS does not offer. Discovery services offer a potential mechanism to make this information available over an inter-enterprise subsystem.

The EPCglobal Discovery Services can be viewed as a search engine that provides a means to locate the network addresses of all EPCIS services that may have information about a specific EPC (not just the EPCIS service of the EPC Manager). For instance, it is envisioned that the EPCglobal Discovery Services will ultimately return multiple pointers from the multiple organizations that have collected information about the tagged object at some point in the object’s life cycle. In addition, the EPCglobal Discovery Services may provide a cache for selected EPCIS data and may enforce authorization policies with respect to access of the aforementioned data. It is envisioned that more than one EPCglobal Discovery Service may operate in parallel, and may compete against each other and/or cater to particular audiences with specific information requirements.

RFID is an innovation in AIDC technology that provides significant advantages over earlier technology, such as optical scanning of bar codes. These advantages include the ability to identify objects without optical line of sight over significant distances and the ability to work reliably both indoors and outdoors.

The components of an RFID system can be categorized into three subsystems:

Every RFID system includes an RF subsystem, which is composed of (1) tags attached to or embedded in objects and (2) readers that query the tags. Important characteristics of tags include their identifier format, the source of their power, the radio frequencies over which they operate, their size and shape, and additional functionality they support, such as security features and connections to environmental sensors. Important characteristics of readers include their power output, duty cycle, antenna design, and interface to the enterprise subsystem, which can be either wireless or wired. A wireless enterprise interface enables the reader to be mobile. Important aspects of tag-reader communication include the singulation protocol, the encoding scheme, and the distance over which tag and reader signals can be reliably received.

In many RFID systems, the tags and readers are supported by an enterprise system that is composed of middleware, analytic systems, and networking services. The middleware filters data, aggregates data, and manages readers and other RFID devices. Analytic systems process and store this information to support business processes. Lastly, the networking services are used to provide the connections among the components of enterprise subsystem and between the enterprise subsystem and the RF subsystem.

RFID systems that share information across organizational boundaries, such as supply chain applications, also have an inter-enterprise subsystem. The RF, enterprise, and inter-enterprise subsystems together allow an RFID system to support business processes. The versatile components of these subsystems allow an RFID system to be tailored to the needs of a particular application. If an inter-enterprise subsystem is constructed to EPCglobal specifications, then it will have a local ONS and an EPCIS, and may utilize the EPCglobal Root ONS and Discovery Services. The Root ONS provides an authoritative lookup for an EPC identifier that returns pointers to the resources from the organization that created that identifier. Finally, EPCglobal Discovery Services are envisioned to serve as a type of search engine for an EPC identifier that can return pointers to multiple organizations that have information related to that EPC identifier (e.g., companies in the supply chain that have completed a transaction with a particular tag and registered information related to its EPC in their EPCIS).

RFID technologies are being deployed by many organizations because they have the potential to improve mission performance and reduce operational costs. To achieve these goals, RFID systems must be engineered to support the specific business processes that the organization is automating. Applications for RFID technologies are diverse because of the wide range of business processes that exist.

RFID security risks and the controls available to mitigate them are also highly varied. Typically, only a subset of the full range of technologies, risks, and controls is applicable to any given RFID implementation. Important business drivers that shape RFID application requirements and the resulting characteristics of RFID systems include:

This section discusses each of these characteristics in greater detail and provides an overview of common types of RFID applications.

There are many types of RFID applications, of which some of the most common are asset management, asset tracking, automated payment, and supply chain management. The key characteristic differentiating one RFID application from another is the purpose of identifying the tagged items. Table 3-1 lists reasons why an organization might want to identify an item and the general application type that best corresponds to those reasons.

Table 3-1. RFID Application Types

Application types are not mutually exclusive; an implementation can combine elements of several application types. For example, both access control systems and sophisticated asset management systems include tracking features. Supply chain management is a tracking application that spans organizational boundaries and often includes process control and payment transactions.

Personnel responsible for designing and implementing RFID systems should understand what application types apply to their implementation so that they can select appropriate security controls. For example, the security controls needed to protect financial transactions in automated payment systems are different than those needed for tracking applications. The personnel should also understand that an adversary may leverage RFID technology for an unintended purpose. For example, a warehouse may use RFID technology to determine what items it has in its current inventory, but an adversary may use the same system to track an item’s whereabouts after it leaves the warehouse. In this case, an asset management system is later used to enable an unauthorized tracking application, perhaps used by an adversary to locate high value targets.

The remainder of Section 3.1 examines each of the application types mentioned in Table 3-1, as well as supply chain management. The section uses hypothetical examples to illustrate the key characteristics of each application type and highlights how they differ from one another. The section also incorporates other examples of each application to provide additional information on current and potential applications of the technology.

RFID-based asset management systems are used to manage inventory of any item that can be tagged. Asset management systems using RFID technology offer significant advantages over paper-based or bar code systems, including the ability to read the identifiers of multiple items nearly simultaneously without optical line of sight or physical contact. These features increase the speed of common asset management tasks, which improves operational efficiency and effectiveness.

Perhaps the simplest form of asset management is Electronic Article Surveillance (EAS), which accounts for items in retail stores.²³ For example, EAS tags are placed on electronic equipment, clothing, books, and many other consumer goods at major retailers. After a customer purchases an item, the sales clerk deactivates the tag. If a person attempts to leave the shop with unpurchased goods, readers at the doors will detect the activated tag and trigger an alarm. In this case, the RFID technology determines only one thing: whether or not the EAS tag is still operating, indicating that the item has not been properly checked out.

Most RFID-based asset management systems provide additional functionality. For example, at a doctor’s office, the medical records clerk can quickly scan the filing system on a monthly or quarterly basis to determine how many medical records are present or missing. The records clerk can also instantly compare the list of missing records with a list of those known to be checked out of the filing system. Without RFID technology, this task could take hours or days to complete by hand. Bar code technology, such as that found at a supermarket, would require physical handling of each medical record, which is labor-intensive.

RFID is also an enabling technology for smart shelves and smart cabinets, which automatically maintain continuous inventories of the items they hold by tracking items entering and leaving. Items are reordered automatically when inventory is low. The smart shelves and cabinets can also be used for theft prevention, alerting personnel when many high-value items are taken at the same time, and perhaps activating a camera to record the event.

Tracking applications are used to identify the location of an item, or more accurately, the location of the last reader that detected the presence of the tag associated with the item. Many tracking applications are part of an asset management system. One difference between relatively simple asset management systems and tracking systems is that an asset management system can detect the presence of an item with readers at a single location. In contrast, tracking systems require more than one reader, as well as a network, so that a central system can aggregate and correlate information received from each of the readers.

At transportation hubs (such as ports or train stations), readers are placed throughout the facility. The security staff can track the location of its employees wearing RFID-equipped identification badges as they pass through doors or gates. In addition to restricting access to specific areas of the facility, these RFID-enabled identification badges help the security department locate specific staff members during emergency situations and to monitor building evacuations during fire alarms.

Tracking applications can also be used to measure sports performance. Some companies sell systems to track athletes during races. This application requires each racer to wear a unique tag that is registered with the tracking system. Such systems can be used for any mass start event, including bicycling, running, or triathlons. Different events may require the athletes to wear the tags in a certain way to be detected by the system. For example, runners may be required to put the tag in one of their shoes or cyclists may be required to mount the tag on their bicycles.

In authenticity verification applications, the tag provides evidence of the source of a tagged item. Authenticity verification often is incorporated into a tracking application. The originating source of the tag creates a record of the initialization transaction, either on the tag or in an enterprise subsystem database. When readers subsequently query the tag, they can determine if it originated from a proper source. For authenticity verification systems to provide appropriate levels of assurance, they typically need to incorporate cryptography and mechanisms to prevent cloning.²⁴ Digital signatures use cryptography to provide the property of non-repudiation, which means the signatory cannot later deny creating the signature.²⁵ Authenticity verification applications can use digital signatures to establish evidence of authenticity and enable later verification. The pharmaceutical industry is using RFID for authenticity verification to reduce the prevalence of counterfeit drugs.

In a matching application, two tagged items are matched with each other and a signal (e.g., a light or tone) is triggered if one of the items is later matched with an incorrect tagged item. The most common matching application today occurs in hospitals and involves placing bracelets with tags on mothers and their newborn babies. If a new mother is accidentally given another woman’s infant, the system issues an alert. Similar technology allows day care centers to match children to parents or guardians, and hospital patients to their medicines and designated visitors. In the future, RFID tags might match airline passengers with their checked luggage to prevent theft and inadvertent mistakes.

Process control applications allow business processes to use information associated with a tag (or the item attached to the tag) to take a customized action. A common process control application is the facilitation of product design variations in manufacturing processes. For example, a tag might be affixed to the frame of a product on an assembly line in a manufacturing plant. The tag’s identifier would be associated with desired features of the finished product. At each station in the assembly process, a reader would read the tag and take an appropriate action, such as adding a specialized component or using a particular color of paint. In another typical application, sensors are attached to tags to measure factors such as temperature, humidity, or shock. Information from the sensors can be used to make decisions regarding the tagged items. For example, a perishable product may be discarded if it has been exposed to room temperature for more than a threshold period of time.

In asset management, tracking, and matching applications, each reader only needed to capture the tag’s identifier (a number permanently assigned to the tag) and apply a timestamp to the transaction. In process control applications, additional information beyond the tag’s identifier is normally associated with each tag. That information could reside on the tag itself or in a networked database. In either case, the additional information introduces a level of complexity not found in the previously discussed applications. Implementing organizations have additional design issues to consider, such as exactly what information needs to be recorded, where it should be stored, how it should be protected, and their customers’ expectation of privacy for that information.

Access control systems use RFID to automatically check if an individual is authorized to physically access a facility (e.g., a gated campus or a specific building) or logically access an information technology system. Some systems are implemented using contactless RFID smart cards instead of mechanical keys. Every individual that is given access to specific areas must carry one of these cards. Locked doors or turnstiles typically protect the areas. To unlock them, authorized personnel must present their smart cards near the appropriate reader.²⁶ The door or turnstile will unlock once the reader has authenticated the smart card. The system can be configured such that only certain cards can be used to unlock certain doors or turnstiles. The possession of the cards may also be combined with a password, personal identification number (PIN), or biometric (e.g., fingerprint or retina scan) for additional security.

There are two general types of access control systems: online and offline. Online systems have readers that are networked to a central computer. In an online system, each card is linked to a specific person. Each reader is supplied by the central computer with a list of individuals that can access the corresponding area. Since this system is networked, the central computer can provide updated access lists to the readers. In contrast, offline systems are not networked. In offline systems, the card lists the rooms that the holder can access, perhaps also listing an expiration date. When someone attempts to access a room using the card, the reader checks that the card contains one of the permitted identifiers before allowing entry.

RFID technology is also used in automobile key applications, which is effectively a type of access control. There are two basic types: immobilizers and push-button keyless start. With immobilizers, a tag is embedded into a key similar to a traditional vehicle key; the tag in the key is read by a reader in the dashboard or steering column. For the key to start the vehicle, it must both have the right shape for the ignition system and contain the tag. Duplication of these keys is significantly more difficult and costly than traditional keys, which has helped to reduce vehicle thefts. The second automobile key application type is push-button keyless start, which allows a driver to start a vehicle without putting a physical key in the ignition. Instead, each driver simply carries a key fob into the vehicle. Once the key fob is detected, the vehicle is started by pushing a start button on the dashboard.

RFID technology automates a variety of financial transactions, including fare collection on public transit systems,²⁸ toll collection on roads, fuel charges at gas station pumps, and retail payment using credit cards with embedded RFID tags. The US General Services Administration (GSA) Smart Card Program provides RFID-based cards that support financial transactions.²⁹ The main advantages over other payment forms are speed and convenience; RFID-based automated payment systems do not require users to physically exchange cash or cards with clerks or machines.

Automated payment systems are a specialized form of access control in which access is granted to credit or debit a financial account. Like other access control systems, they require additional security protections to prevent fraud and abuse. In the case of automated payment, integrity and confidentiality controls are needed as well as protection against duplicating or modifying tags; users should not be able to alter debit and credit amounts, and bystanders should not be able to record account numbers or other transaction details. For these reasons, the protocols and cryptography that support automated payment systems typically are considerably more complex than those that support physical access control systems.

Automated payment systems can be online or offline. Online systems, which are the most common, store and process the financial data in a central system networked with the readers. Offline systems require the smart card to store “electronic cash” and handle debit and credit transactions, which involve more sophisticated computing and increase the cost of each card. One advantage of offline systems is that they can support the same user anonymity achieved with cash, while centralized systems must link users to their accounts. However, because most users do not demand complete anonymity, the additional complexity and expense of offline systems make them relatively uncommon.

One example of an automated payment system is currently being used by large resorts and cruise ships. Guests are issued RFID-enabled identification cards upon check-in. These cards are linked to credit card accounts and enable passengers to pay for meals and gift shop items. They are also used for identification when guests disembark the ship or leave the resort grounds.

Supply chain management involves the monitoring and control of products from manufacture to distribution to retail sale. Supply chain management typically bundles several application types, including asset management, tracking, process control, and payment systems. An important distinguishing feature of supply chain management systems is that they span multiple organizations, each of which uses RFID technology that interoperates with the others. When a system is not under one organization’s control, it is referred to as an open system. The previously discussed systems are closed systems because a single organization manages them.³⁰ Open systems are inherently more vulnerable than closed systems because the network, application and operational interfaces between organizations provide an adversary with more potential avenues to attack the system.

Supply chain systems can record information about products at every stage in the supply chain. Ideally, tags are affixed to products during the manufacturing process or soon afterward. As a product moves through the supply chain, to the end customer, and later to post-sale service, the tag’s identifier can be used by all supply chain participants to refer to a specific item. In addition, supply chain systems that use active tags can track larger objects such as cargo containers. Tags on these containers can store a manifest of the items shipped in each container. This manifest can be automatically updated when items are removed from the container.

The information collected by a supply chain RFID system offers many benefits. By more accurately tracking products throughout their life cycle, participants can realize improved speed and accuracy of ordering, automated invoicing and payment, fewer supply shortages with lower inventory levels, and reduced shrinkage (product loss or theft). Furthermore, RFID-based supply chain systems give management programs better visibility into the supply chain, which enables identification of bottlenecks, targeted recalls, and new forms of market research. Such systems also generate an electronic pedigree for each item. This feature gives buyers evidence of the item’s freshness, so they can identify if its useful life has expired. It also provides buyers evidence of a product’s authenticity, so buyers can determine if it is an unauthorized clone.

Once an organization determines the general application type that corresponds to the business process it wants to enhance or enable with RFID technology, it should characterize the information that will be processed by the system. At the low end of the data requirement spectrum is the case of EAS. In EAS, systems, the necessary information is conveyed in a single bit: either the tag is functioning (the item has not yet been sold), or it is has been deactivated (the product has been sold). For this reason, EAS is referred to as a one-bit or single-bit application. Similarly, in the case of relatively simple asset management systems, the only data required is the identifier on the tag. The RFID system merely records which items are present or have been read by the reader. Matching applications also have relatively simple data requirements because they just link one identifier with another.

Data storage requirements increase in tracking applications. The system needs to record which of multiple readers last read the tag and at what time. As the tracking systems get more complex, more data is collected, such as changes in the possession of the item (e.g., someone signing for a package) or the particular contents of a container. Process control applications further increase data requirements because they use the recorded specifications of an item to customize actions in the business process.

Supply chain management systems are the most data-intensive RFID application. They not only process data, but they must also maintain information about the data, such as the formats the various organizations in the supply chain use to store and transmit data and the network addresses of database servers that contain data about tagged items.

When determining the appropriate RFID technology and security controls for a given RFID application, the personnel responsible should ask three questions regarding each data element in the RFID system:

In many cases, the data element is not sensitive. Organizations need to examine and invest in security controls to protect RFID data depending on the sensitivity level of that data. They also need to consider how data elements might be combined with other data to make inferences or build profiles, particularly if data elements are shared across organizations or stored for long periods of time.

Another important characteristic of the data is whether it changes over time. In general, tag identifiers never change, but the data associated with the identifier can change. For example, in asset management applications, the RFID system may maintain information about product features such as make, model, size, color, and serial number. These product features typically will be written once and then will not change while the item remains in the system. However, if the asset management application’s primary focus is tracking containers rather than specific items, then the data changes frequently as the container is reused to store and transport new items. In access control applications, if a tag acts as a key for a particular item, such as an automobile, then nothing should change once the tag is linked with that item. If the access control application allows a security administrator to change someone’s access to different areas and rooms based on changing business roles, then the system must store data related to the access rules.

In general, the implementation specifics rather than the application type determine the extent to which data must be modified. When data elements change, the supporting technology must support write transactions and must have an access control mechanism to protect the integrity of the data. Sections 5.3.1 and 5.3.3.1 provide information on authentication and access control methods. When an element does not change, it does not require this support. Organizations planning RFID implementations should analyze what data is required to support the business process and which elements must be modifiable. One important factor is whether tags and their identifiers will be used once and discarded, or reused. The results of this exercise will help organizations identify appropriate RFID technology and security mechanisms to meet their requirements.

The conditions under which readers query tags are a significant determinant of an RFID system’s technology requirements. The most important parameters regarding the RFID transaction environment include:

Sections 3.3.1 through 3.3.3 discuss these parameters.

Distance requirements often determine the type of tag that can be deployed. The distance between the reader and the tag also has security implications. In general, longer distances between the reader and the tag could make it easier for an adversary to eavesdrop on their communications. Longer distances also allow an adversary to use their own reader to perform unauthorized transactions more easily (as discussed in Section 2.3.3.3).

In some cases, the RFID system designer has considerable latitude in setting the distance between reader and tag. For example, an application controlling access to a garage might require drivers to place an RFID-enabled badge within inches of a reader or it might require a general proximity of several feet to a RFID-enabled transponder within the vehicle. The choice is essentially an application design decision that may include such factors as cost and convenience.

In other cases, the distance between reader and tag is dictated by the environment in which the RFID system will be deployed. For example, a toll payment application that identifies vehicles on a highway may require that readers query tags from a distance of several meters. In this case, the minimum read distance is a requirement for the design of the RFID system.

Transaction speed can be measured in a variety of ways. A common metric is the number of tags read per second. The main reasons why an application has requirements related to the speed of transactions are:

For example, in some inventory applications, operators may need to confirm the entire inventory at the end of each business day. In this case, each transaction must be completed within a small fraction of a second or the process may take too long to finish. Similar issues may arise when trying to read the tags of athletes in a tracking system designed to measure race times. In this case, if the transactions take too long, there is a chance that some participants in the race may go out of range before the reader identifies them.

Many security mechanisms introduce latency into RFID transactions. Additional steps are needed to perform authentication, encryption, cover-coding, and other security-related procedures. Each additional step takes time. When considering security controls, organizations need to balance the business impact of each security control’s effect on transaction speed with the protection it provides.

Whether or not an RFID system’s readers are networked with database applications has major implications for the architecture of the RFID system and its security. When an application needs to link data with tags, the data needs to be stored somewhere. If the readers are networked with databases, then the data can be stored in the databases. Otherwise, the data must be stored on the tags.

When data is stored centrally on database servers, the tag only needs to contain an identifier, which links the tag to its associated information. In this architecture, the vast majority of the data processing occurs on the supporting systems to which the reader is connected. On the other hand, when data is stored on tags, the tags must have some form of memory and support both write and read transactions.

Regardless of where data is stored, the data’s integrity must be protected. If the data is sensitive, its confidentiality must also be protected. The methods for achieving this include authentication, access control, encryption, and physical security. However, database servers and tags implement these methods in different ways. Nearly all commercial database servers support a wide variety of configurable security controls, but most tags do not. In general, RFID systems that use networked readers to access database servers are preferable to those that store data on tags, both in terms of cost and security. However, a system may require local storage of data on tags for several reasons, including:

RFID system requirements depend on what happens between transactions, as well as during transactions. Relevant factors before and after reader communication include:

These factors are discussed in Sections 3.4.1 and 3.4.2.

In some applications, each tag is attached to a sensor that stores data in memory that is accessible to the tag. The memory may belong to the sensor, to the tag, or to a combined device. In some cases, the application’s core purpose is to capture this data, and RFID technology merely provides a vehicle to access it remotely. In other cases, the sensor data supports an asset management or tracking application, and the objective is to take measurements to ensure that storage or transport conditions are as expected.

Tags are vulnerable to a variety of threats that could adversely impact the business processes that they support. Selecting appropriate RFID technology and security controls depends on the level of the threat in the environments in which the tags are expected to reside. Some human threats to tags include the ability of an adversary to:

For example, in an EAS application, someone might remove or disable a tag to steal an item from a store without triggering an alarm. Alternatively, someone could replace a tag with one from a lower-priced item before purchasing the tagged item. In an access control application, someone might replace a tag with one that has greater access. If the replaced tag were attached to a picture identification badge, an adversary might be able to effectively gain the privileges of another person while appearing legitimate to personnel who visually check the badge.³¹

Environmental threats to tags include extreme heat, cold, moisture, vibration, shock, and radiation (including sunlight). Any risk assessment of environmental threats should also consider the impact of these conditions to the material to which the tag is attached and the glue or other mechanism that attaches the tag to the item. Impacts of harsh environmental conditions include degradation of tag performance, destruction of the tag, and separation of the tag from its associated item.

Organizations need to assess the likelihood of these threats in their environment and set requirements for their RFID technology accordingly. In general, human threats are more likely to be realized if outsiders (e.g., customers or members of the general public) have physical access to the tags and therefore the means to engage in malicious behavior. Human threats are also more likely if people have an incentive to perform the attack, such as some form of financial gain or access to a restricted resource.

Cost-benefit tests can be applied to any technology project, but the RF subsystem of an RFID system has differentiating characteristics, especially regarding security. Table 3-2 examines the key factors to consider.

Table 3-2. Economic Factors for Traditional IT Systems versus RFID Systems

RFID technology can support a wide range of applications—from asset management and tracking to access control and automated payment. The business requirements for these applications are as varied as the applications themselves. In particular, they are implementation-specific and depend on such factors as:

This page has been left blank intentionally.

RFID technology enables an organization to significantly change its business processes to:

The RFID technology itself is complex, combining a number of different computing and communications technologies to achieve the desired objectives. Unfortunately, both change and complexity generate risk. For RFID implementations to be successful, organizations need to effectively manage that risk, which requires an understanding of its sources and its potential characteristics.

This section reviews the major high-level business risks associated with RFID systems so that organizations planning or operating these systems can better identify, characterize, and manage the risk in their environments. The risks are as follows:

An important characteristic of RFID that impacts all of these risks is that RF communication is invisible to operators and users. In other AIDC and IT systems, it often is easier to identify when unauthorized behavior is occurring. This section characterizes the risks listed above in more detail. The security controls that mitigate these risks are discussed in Section 5.

RFID systems typically are implemented to replace or enhance a paper or partially automated process. Organizations implementing RFID systems could become reliant on those systems, which if not implemented properly with business continuity planning might be less resilient to disruptions than the systems they replace. For example, suppose that a warehouse replaces its paper-based inventory management system with an RFID-enabled system. The paper system involves storing completed forms at the warehouse and sending form duplicates to a central office, while the new RFID system locates its backend database servers at a single computing center. In this environment, the paper system might be more resilient to a local disaster than the RFID system, despite the increased efficiency, accuracy, or effectiveness of the RFID-enabled business process.

Failure in any component or subsystem of the RFID system could result in system wide failure. In the warehouse example, system wide failure might result from many causes, such as loss of the network connection between the warehouse and the computing facility, a software virus that disables critical middleware functionality, or a new source of radio interference that prevents readers from accurately reading tags. If an RFID system is rendered unavailable for any reason, then potential impacts can range from a deceleration of the business process to the loss of critical business or operational records. If the system is mission critical, then the consequences could be devastating to the organization’s performance.

Table 4-1 reviews some of the factors that determine the level of business process risk.

Table 4-1. Factors Influencing Business Process Risk

Unlike most of the other risks, business process risk can occur as a result of both human action and natural causes. Moreover, human causes may be intentional or unintentional. For example, a tag might fail to perform its intended function because someone removed it from its packaging, an employee accidentally damaged it with a box cutter, or a severe storm covered it in ice.

An example of an intentional attack on an RFID business process is cloning, which occurs when an adversary reads information from a legitimate RFID tag and then programs another tag or device to emulate the behavior of the legitimate tag. Documented examples of cloning have occurred in tags used for financial payment³² and access control.³³ Another attack on an RFID business process would be removing a tag from the item it is intended to identify and attaching it to another unrelated item. Someone might, for example, perform such an attack to get a better price on an expensive item in a store.

Potential problems are not just limited to the RF subsystem. If the network supporting the RFID system is down, then the RFID system is likely down as well. In supply chain applications, network failures at any point in the chain have the potential to impact the business processes of any subsequent link in the chain. For example, if a supplier is unable to write manifest data to a tag, then the recipient cannot use that data in its operations even if its RFID readers and network infrastructure are fully functional. Servers hosting RFID middleware, databases, analytic systems, and authentication services are all points of failure. Any efforts to assess business process risk need to be comprehensive, because such a wide variety of potential threats exist. All of these threats have the potential to undermine the supported business process and therefore the mission of the implementing organization.

RFID is a powerful technology, in part, because it supports wireless remote access to information about assets and people that either previously did not exist or was difficult to create or dynamically maintain. While this wireless remote access is a significant benefit, it also creates a risk that unauthorized parties could also have similar access to that information if proper controls are not in place. This risk is distinct from the business process risk because it can be realized even when business processes are functioning as intended.

A competitor or adversary can gain information from the RFID system in a number of ways, including eavesdropping on RF links between readers and tags, performing independent queries on tags to obtain relevant data, and obtaining unauthorized access to a back-end database storing information about tagged items. Supply chain applications may be particularly vulnerable to this risk because a variety of external entities may have read access to the tags or related databases. The risk of unauthorized access is realized when the entity engaging in the unauthorized behavior does something harmful with that information.

In some cases, the information may trigger an immediate response. For example, someone might use a reader to determine whether a shipping container holds expensive electronic equipment, and then break into the container when it gets a positive reading. This scenario is an example of targeting.

In other cases, data might also be aggregated over time to provide intelligence regarding an organization’s operations, business strategy, or proprietary methods. For instance, an organization could monitor the number of tags entering a facility to provide a reasonable indication of its business growth or operating practices. In this case, if someone determined that a warehouse recently received a number of very large orders, then that might trigger an action in financial markets or prompt a competitor to change its prices or production schedule.

Table 4-2 reviews some of the factors that determine the level of business intelligence risk.

Table 4-2. Factors Influencing Business Intelligence Risk

RFID technology raises several important privacy concerns. One concern is that organizations may collect personal information for a particular purpose, such as to complete a financial transaction or grant an individual access to a facility, and then later use that information for a different purpose that the individual finds undesirable, such as to conduct a direct marketing campaign. Another concern is that organizations that are implementing RFID systems to serve a particular business process might not be aware of how the RFID information could be used for unintended purposes, such as the targeting or tracking of individuals, or the potential disclosure of personal practices or preferences to unauthorized third parties.

There are privacy risks from the perspective of the individual and from the perspective of the organization implementing RFID technology. The privacy risk from the perspective of the individual is the unauthorized revelation of personal information and the personal consequences of that breach. The privacy risk from the perspective of the implementing organization might include:

Business objectives often conflict with privacy objectives. Organizations can benefit from the analysis and sharing of personal information obtained with RFID technology. At the same time, these activities may potentially violate the privacy rights or expectations of citizens and consumers. Similarly, methods to protect personal privacy may pose a business process risk. For example, consumers may want tags to be disabled at point-of-sale so that they cannot be used for tracking purposes afterwards. However, if it is easy to disable a tag at point-of-sale, then it may also be easier for adversaries to disable tags prior to point-of-sale, thereby disrupting the business process. Moreover, organizations may want to use tags after point-of-sale for post-sale support, recalls, and other purposes.

Privacy risk may increase when an individual possesses tags from multiple organizations because someone reading the tags can now combine and correlate information to profile individuals in ways that none of the organizations alone might have anticipated. For example, if a consumer purchases a tagged item and the tag is not disabled or removed, then the seller or someone else could subsequently use the tag to reveal the presence of that person at a another location and time. The consumer may have purchased the item with cash, presuming to remain anonymous in the transaction. However, if she also carries another tag that reveals her identity, such as an RFID-enabled identification card, then someone may be able to surreptitiously read both tags to establish an association between the purchased item and her identity that had not previously existed. As people possess more tagged items and readers become more prevalent in everyday life, the potential for more complex associations and inferences increases.

Other factors that impact the level of privacy risk include:

For additional information on privacy considerations, see Section 6.

RFID systems typically are not isolated from other systems and assets in the enterprise. Every connection point between the RFID system and something outside the RFID system represents a potential vulnerability for the entity on the other side of the connection, whether that is an application process, a valued asset, or a person. Externality risks are present for both the RF and enterprise subsystems of an RFID system. The main externality risk for the RF subsystem is hazards resulting from electromagnetic radiation, which could possibly range from adverse human health effects to ignition of combustible material, such as fuel or ordnance. The main externality risk for the enterprise subsystem is successful computer network attacks on networked devices and applications. Computer network attacks can involve malware (e.g., worms and viruses) or attack tools that exploit software vulnerabilities and configuration weaknesses to gain access to systems, perform a denial of service, or cause other damage. The impact of computer network attacks can range from performance degradation to complete compromise of a mission-critical application.

Because the externality risk by definition involves risks outside of the RFID system, it is distinct from both the business process and business intelligence risks; externality risks can be realized without having any effect on RFID-supported business processes or without revealing any information to adversaries.

RFID technology, like any other radio technology, relies on the use of electromagnetic radiation to communicate information. The potential risk of electromagnetic radiation includes:

As of the publication of this document, no documented examples have been identified that any of these hazards have been realized with respect to RFID technology, which typically operates at power levels below those that would cause a concern. Moreover, no research has suggested the realization of these risks with respect to RFID technology is likely, although interaction with some medical devices has been the subject of research studies.³⁴ The US Federal Communications Commission (FCC) promulgates regulations to protect citizens against unsafe radio transmissions by requiring equipment testing and certification. The FCC limits for general population/uncontrolled exposure are tabulated in Appendix E.

In addition, DoD regulations require HERO and HERF evaluation of RF systems.³⁵ It is important to note that RFID systems may be within exposure limits when initially installed, but later exceed limits if operators increase the emitted power of readers, perhaps to improve the performance and reliability of the system.

Nevertheless, the critical consequences that would result from any realization of the risk suggest that organizations exercise prudence when fielding RFID technology, especially in complex electromagnetic environments. Electromagnetic signals and waves can reflect, interfere, and resonate in unintended ways in complex electromagnetic environments that include metal objects such as metal doors, window frames, and metal enclosures. This can result in unexpected or unintended signal and field cancellation, interference, summation, or resonance. This makes it difficult to accurately predict specific localized field levels from radiated power alone. Some factors that may warrant additional examination of electromagnetic radiation hazards include:

RFID technology represents a new attack vector on an enterprise network. Once RFID systems are implemented, a possibility exists that attackers could reach non-RFID and enterprise subsystem computers through a reader, although no such attack is known to have successfully occurred to date. If the system involves wireless handheld readers, then the wireless link between the reader and the networked middleware servers is another point of entry. Once RFID servers are compromised, they can be used to launch attacks on other networked systems. Attack possibilities include the introduction of malware (e.g., a worm or virus) or the exploits of a single adversary compromising one computer at a time. Once additional systems are compromised, all types of adverse consequences to the IT infrastructure are possible, including loss of confidentiality, integrity, and availability.

While the risk of network compromise through an RFID interface is considered low, it is possible, especially as the number of RFID reader, middleware, and enterprise applications increases. RFID air-interface protocols do not support the execution of remote commands on the RFID interface, but if the reader accepts data formats outside those expected by the protocol, then conceivably an adversary could exploit a buffer overflow vulnerability on a reader by sending it non-compliant data. If the system is poorly designed, the adversary may be able to insert code or commands in memory buffers read by processes that can execute administrative functions such as disabling security controls. The potential consequence is that the adversary could gain full control of the device and use that control to attack other systems.

Although no known instance of this type of attack has occurred in a real-world application, RFID security specialists have demonstrated RFID viruses in a controlled laboratory environment.³⁸ An RFID virus is a small program encoded on a tag that becomes active once it has been read and is then passed to the middleware or database of an IT system. If the system is poorly designed, the virus could possibly take advantage of internal software weaknesses in middleware or database products to replicate itself to other tags. This distinguishes the risk from AIDC technologies such as bar codes that cannot be changed after manufacture because they do not contain modifiable memory.

Some factors influencing the magnitude of the risk to the IT infrastructure and the applications they support are presented in Table 4-3.

Table 4-3. Factors Influencing Cyber Attack Risk

For RFID implementations to be successful, organizations should effectively manage their risk. The major categories of risk are as follows:

This page has been left blank intentionally.

This section discusses security controls that can potentially mitigate the business risks associated with RFID systems. As previously discussed, RFID implementations are highly customized. As a result, the security controls listed are not all applicable or effective for all RFID applications. Organizations need to assess the risks they face and choose an appropriate mix of controls for their environments, taking into account factors such as regulatory requirements, the magnitude of the threat, cost and performance.

Federal agencies should refer to Federal Information Processing Standards (FIPS) Publication 200, Minimum Security Requirements for Federal Information and Information Systems and NIST Special Publication 800-53 (as amended), Recommended Security Controls for Federal Information Systems, when developing or revising policies related to an RFID system. NIST Special Publication 800-100, Information Security Handbook: A Guide for Managers may also be helpful as it provides a broad overview of information security program elements to assist managers in understanding how to establish and implement an information security program.

This section covers security controls applicable to most RFID implementations. It does not address the security of RFID-enabled smart cards and payment systems. This section also does not discuss security controls related to general IT systems, such as network infrastructure, databases, and Web servers because these are already covered by other security requirements and guidelines. For example, EPCIS servers, which can be accessed by trading partners through the Internet, should be protected by the same types of controls that would be used for any other Internet-facing system (e.g., encryption of sensitive communications, access control to prevent unauthorized access to data and systems) to ensure the security of the data collected by the RFID system. Guidelines on topics such as IT server, application, database, and network security are available from many sources, including NIST’s Computer Security Resource Center (CSRC).³⁹

RFID security is a rapidly evolving discipline. Although promising research is noted when applicable, this section focuses on controls that are presently commercially available.

The RFID security controls discussed in this section are divided into three groups:⁴⁰

The information provided for each control includes:

The summary at the end of Section 5 summarizes the controls and maps them to the risk categories discussed in Section 4.

Management controls are typically involved in risk assessment, system planning, and system acquisition, as well as security certifications, accreditations, and assessments. The sub-sections below discuss management controls for RFID systems in more detail.

Control: An RFID usage policy describes the authorized and unauthorized uses of RFID technology in an organization and the personnel roles assigned to particular RFID system tasks. Federal agencies should follow FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, when developing the RFID usage policy.

The usage policy also should be consistent or integrated with the organization’s privacy policy, which addresses topics such as how personal information is stored and shared. The RFID usage policy should also address privacy issues associated with the tag identifier formats and the potential disclosure of information based on solely on the tag identifier format selected. Additional information resources are found in the privacy guidelines in Section 6.

Applicability: All organizations that use RFID technologies or are considering using them.

Benefits: The policy establishes the framework for many other security controls. It provides a vehicle for management to communicate its expectations regarding the RFID system and its security. It enables management to take legal or disciplinary action against individuals or entities that do not comply with the policy.

Weaknesses: The existence of a policy does not ensure compliance with the policy. A policy needs to be coupled with the implementation and enforcement of appropriate operational and technical controls to be effective.

Control: IT security policies describe the approach to achieve high-level security objectives of the usage policy. The IT security policies related to RFID should cover each RFID subsystem, including network, database and application security in the enterprise and inter-enterprise subsystems; they should not just be limited to security of tags and readers in the RF subsystem.

IT security policies for RFID systems should address:

Applicability: All RFID implementations, particularly those with enterprise subsystems or inter-enterprise subsystems.

Benefits: Well-crafted security policies govern the mitigation of business risks associated with the use of RFID technologies. The policies provide requirements and guidelines for the individuals designing, implementing, using, and maintaining RFID systems. For example, IT policies help the personnel designing RFID systems or procuring system components to make appropriate decisions. Similarly, they help system administrators correctly implement and configure software and related network components.

Weaknesses: The existence of a policy does not ensure compliance with the policy. A policy needs to be coupled with the implementation and enforcement of appropriate operational and technical controls to be effective.

Control: When data associated with an RFID system needs to be shared across organizational boundaries, formal agreements among the participating organizations can codify the roles and responsibilities, and in some cases the legal liability, of each organization. These formal agreements are usually documented as a Memorandum of Agreement (MOA) or Memorandum of Understanding (MOU). The MOU or MOA specifies the network connections and authentication mechanisms to be used, the data to be shared, and the manner in which data should be protected both in transit and at rest. It may also address controls on vendors, subcontractors, and other third parties to the extent they have access to the system.⁴²

If the inter-enterprise application requires tag passwords to be shared across organizations, then the MOU or MOA should specify how these passwords will be generated, stored, and shared. The memorandum may specify IT security controls such as methods of authentication, access control, or encryption that participating organizations shall implement to protect the passwords.

Applicability: Any RFID system involving more than one organization, which is most common in supply chain applications.

Benefits: Having an MOA or MOU significantly reduces the potential for subsequent misunderstandings and security breaches. They enable signatories to communicate their respective security requirements while also realizing the benefits of the business partnership that led them to collaborate in the development and use of the RFID system.

Weaknesses: Monitoring an external organization’s enforcement of an agreement is difficult without full access to its systems and personnel, which is unlikely. As a result, violations may occur without detection. This risk can be mitigated with independent audits if signatories agree to hire third-parties to conduct such audits.

Control: Instead of placing sensitive data on tags, the data could be stored in a secure enterprise subsystem and retrieved using the tag’s unique identifier.

Applicability: Applications that use tags with on-board memory and process data that is either considered sensitive or that could be combined with other data to infer sensitive information.

Benefits:

Weaknesses:

There are several types of operational controls:

The sub-sections below discuss operational controls for RFID systems in more detail.

Control: Physical access controls include fences, gates, walls, locked doors, turnstiles, surveillance cameras, and security guards. When the objective is to limit radio communication over a short distance, room walls or partitioned stalls might provide adequate protection if they are opaque to the relevant radio frequencies that the RF subsystem uses.

Applicability: All RFID implementations except those in which RFID tags or other system components are in public areas.

Benefits: Physical access controls limit the ability of an adversary to get close enough to RFID system components to compromise RFID data security or to modify, damage, or steal RFID system components. Physical security applies to all RFID subsystems. In the RF subsystem, the primary objective of the control is to prevent unauthorized radio communications. In the enterprise and inter-enterprise subsystems, the primary objective is to prevent physical access to system components.

Examples of risks that are mitigated by physical access controls include:

Weaknesses:

Control: RFID system equipment can be placed to minimize unnecessary electromagnetic radiation. Tags and readers can be kept away from:

Applicability: All environments in which the organization deploying RFID systems determines the location of the RF equipment (which excludes many consumer and supply chain applications).

Benefits:

Weaknesses:

Control: Secure disposal involves physically or electronically destroying tags, as opposed to just discarding them, when they are no longer needed to perform their intended function. Physical destruction may involve manual tearing or shredding using a paper shredder. Electronic destruction can be accomplished by using a tag’s kill feature or using a strong electromagnetic field to render a tag’s circuitry permanently inoperable. When a tag supports an electronic disabling mechanism, it usually is the preferred way to disable a tag before it is disposed because it can be accomplished without touching each tag, thereby reducing the cost of the effort. The kill feature is also discussed in Section 5.3.3.3.

Applicability: RFID applications in which the continued operating presence of a tag after it has performed its intended function poses a business intelligence or privacy risk (e.g., an adversary can subsequently use the presence of the tag to track items or people).

Benefits: Destroying or disabling tags:

These benefits apply to both business intelligence and privacy risks.

Weaknesses:

Control: Operator and administrator training provides personnel with the skills and knowledge necessary to comply with RFID usage, IT security, and privacy policies, as well as agreements with external organizations. In most RFID implementations, personnel will perform various roles, which might require different training materials for each role. For example, an administrator of middleware might need different information than an operator of a mobile reader. Appropriate security and privacy training addresses at least three points:

If HERF/HERO/HERP risks are present, appropriate security training covers mitigation techniques, such as safe handling distances.

If tags are destroyed or recycled, training should cover how to perform these functions. For example, operators might be trained how to clear tag memory before reuse.

Applicability: All RFID implementations.

Benefits: Operator training helps ensure that the system is used and maintained properly. Training also helps operators identify security violations and take appropriate actions to prevent their reoccurrence.

Weaknesses: Training alone cannot ensure proper operation of the system or compliance with policy.

Control: A written message is affixed to or distributed with each tag or is posted near readers. The notice may inform users of the purposes of the RFID system or advise users on how to minimize privacy or other risks (e.g., place an RFID-enabled access card or transponder in metal foil or a sleeve that shields RF radiation when the card or transponder is not in use).

Applicability: All applications in which there is a risk that could be mitigated with simple informational messages. The control is particularly relevant to consumer applications in which privacy is a concern.

Benefits: Information labels or notices can communicate basic information about risks that might otherwise be left unknown by users that are able to take simple steps to mitigate the risk (e.g., remove a tag or place it in a shielded sleeve).

Weaknesses: Distributing a notice is no guarantee that it will be read or understood. Notice is not an appropriate communications medium for complex concepts or instructions that may require formal training.

Control: RFID system duties are distributed among various personnel roles to minimize the damage resulting from an inadvertent or malicious activity of a single person. The general principle of the control is that malicious collusion between two or more authorized users is much less likely than one person engaging alone in inappropriate behavior.

One example of separation of duties is having different personnel (1) attach tags to objects and (2) read the tags. If an individual performed both functions, the individual could intentionally put the wrong tag on an object to circumvent the objectives of the business process. For example, a store clerk could affix tags intended for low-priced items on high-priced items, and then later work the checkout scanner while the clerk’s accomplice purchased the items. The system would not know that the tags had been switched, but if another person performed the checkout, he or she might be suspicious of the checkout total, which could uncover the plot.

Applicability: RFID applications in which an insider might have a motive to perform unauthorized RFID transactions. This scenario is most likely to occur when tags support commercial transactions, especially those related to high-value objects.

Benefits: Separation of duties helps to reduce fraud and malicious damage, because any user attempting to engage in such activities would be forced to collude with at least one other user. Separation of duties also reduces errors, because a second operator will often catch mistakes made or missed by the first.

Weaknesses: Multiple employees still could collude to commit fraud or violate the RFID usage policy. Also, organizations with a limited staff may not be able to perform complete separation of duties.

Control: RFID tags are assigned identifiers using identifier formats that do not reveal any information about tagged items or the organization operating the RFID system. Non-revealing identifier format options include serially assigning identifiers and randomly assigning identifiers.⁴⁴

In contrast, if an adversary reads an identifier that is encoded with a standardized format, such as the EPC format, that adversary may be able to discern the manufacturer or issuer of the item, as well as the type of item. For example, all cans of a soft drink from a certain manufacturer will have the same EPC manager

ID and object class bits if their identifiers are encoded in an EPC identifier format. Figure 5-1 shows an example 96-bit EPC and how it can be parsed into the four aforementioned, individual fields.

Figure 5-1. Example 96-bit EPC

Tags must have programmable identifiers to support the control. Even tags that are designed to support standard tag formats can still be assigned non-standard identifiers in the field. However, some tags have factory-initialized identifiers that cannot be modified after manufacture.

Applicability: Any applications in which the implementing organization determines that the revelation of a tag’s identifier is a business intelligence risk.

Benefits: Adversaries cannot obtain information about tagged items from the identifier alone.

Weaknesses:

Control: A fallback identification system provides an alternative means to identify, authenticate, or verify an object when the RFID system is unavailable or an individual tag is inoperable. Options include text labels and AIDC technology such as bar codes.⁴⁶ The fallback may consist of just an identifier, or it may also include additional data about the tagged object. The fallback system is accompanied by standard operating procedures and operator training to ensure that personnel know when and how to use it.

Applicability: All RFID applications.

Benefits: Duplicating tag identifiers and data on a label provides a fallback in case of malicious or accidental tag damage, reader malfunction, or enterprise subsystem network outage. The redundant data can also be used to verify that tag data has not been altered improperly.

Weaknesses: This control has several potential weaknesses, including:

There are a number of technical controls currently available for RFID systems, and many others are under development in industrial and university research labs. This section focuses on technical controls that are commercially available as of the publication date of this document. Supplementary information on selected emerging security technologies is provided in footnotes. Many of the technical controls listed are specified in standards, while others are available only in proprietary systems.

Many technical controls related to a tag require the tag to perform additional computations and to have additional volatile memory. Accordingly, a tag that uses such technical controls requires a more sophisticated microchip than those that do not use such controls. In the case of passive tags, the tags may also need to be closer to readers to obtain the required power to perform these computations. Alternatively, readers may need to operate at greater power levels, although this may not be feasible or permitted in many cases. These inherent characteristics of passive tags can limit the use of certain technical controls in some environments.

Technical controls exist for all components of RFID systems, including the RF, enterprise, and inter-enterprise subsystems. This section focuses on technical controls for the RF subsystem. Many controls also exist for the enterprise and inter-enterprise subsystems, but these typically apply to IT systems in general rather than to RFID systems in particular. Readers are encouraged to read other NIST IT system and network security guidelines, many of which are listed in Appendix D.

The general types of RF subsystem controls include controls to:

Examples of each of these types of controls are discussed in depth in Sections 5.3.1 through 5.3.3, respectively.

While a wide variety of authentication methods exists for IT systems, the most common techniques for the RF subsystem of RFID systems are passwords, keyed-hash message authentication codes (HMAC), and digital signatures. In some cases, the primary objective of the authentication technology is to prevent unauthorized reading from or writing to tags. In other cases, the objective is to detect cloning of tags. Authentication techniques based on cryptography often provide integrity services for data included in the authentication transaction; in other words, an adversary cannot modify data in the transaction without the reader or tag detecting the change.

Control: A tag does not permit password-protected commands to be executed unless they are accompanied by the correct password. Protected commands may include those that support reading and writing of tag data, memory access control (Section 5.3.3.1), and the kill feature (Section 5.3.3.3).

Organizations properly implementing this control will develop a password management system to support it. The password management system addresses all stages of the password, including generation, conveyance, and storage. From a security perspective, effective password generation involves random selection of each password. 47 Whenever possible, the passwords are assigned to each tag in a physically secure environment to reduce the likelihood of eavesdropping. Tags should not share passwords, although this may not be administratively feasible in some environments, such as those in which the reader is not expected to have access to a networked database of tag passwords. In inter-enterprise applications such as supply chains, multiple organizations may need to access databases that contain tag identifiers and passwords. Authenticating external entities likely will require additional security systems. While in traditional IT systems, passwords are often changed on a periodic basis (e.g., every 90 days); in RFID systems, such changes may be infeasible, especially if the tags are not always accessible to the organization assigning the passwords.

Applicability: Any application where authorized execution of a particular command represents a business process, business intelligence, privacy, or externality risk.

Benefits: The likelihood that tags will be used for unauthorized purposes is greatly reduced.

Weaknesses:

Control: Both the reader and the tag share a common secret key that can be used in combination with a hash algorithm to provide one-way or mutual authentication between tag and reader. When HMAC is applied to messages, it also ensures the integrity of data in the messages. HMAC is specified in FIPS Publication 198.51 HMAC supports any cryptographic hash algorithm, but Federal agencies must use one of the secure hash algorithms (SHA) specified in FIPS Publication 180-2.52 HMAC is not specified in any RFID standard, but it is available in proprietary designs.

Applicability: Applications in which passwords are considered to offer an inadequate authentication mechanism, perhaps because the risk of eavesdropping is high. Applications that require evidence of a tag’s authenticity.

Benefits: The advantages of HMAC relative to password authentication include that HMAC:

Weaknesses:

Control: Readers digitally sign tag identifiers, time stamps, and related event data to provide for non-repudiation of tag transactions. The resulting signatures are stored on tags for subsequent verification, although recording signatures in enterprise subsystem databases provides additional assurance of the tag’s chain of custody.

Digital signatures are based on asymmetric cryptography, also commonly referred to as public key cryptography. Federal agencies implementing digital signature technology must comply with FIPS Publication 196, Entity Authentication Using Public Key Cryptography. The use of digital signature technology in the context of RFID systems is also referred to as authenticated RFID. It typically works as follows:

Applicability: Applications that require more robust evidence of authenticity than provided by HMAC technology, including authentication of multiple chain of custody events. Applications that require verification of authenticity without network connectivity.

Benefits: Digital signatures offer several advantages relative to HMAC authentication, including:

Weaknesses:

Several types of technical controls focus on the RF interface to tags, including:

These controls are discussed further in Sections 5.3.2.1 through 5.3.2.8.

Control: Cover-coding is a method for hiding information on the forward channel from eavesdroppers.

In the EPCglobal Class-1 Generation-2 standard, cover-coding is used to obscure passwords and information written to a tag using the write command. The EPCglobal Class-1 Generation-2 cover-coding protocol works as follows:

Cover coding is an example of minimalist cryptography because it operates within the challenging power and memory constraints of passive RFID tags.⁵⁸ By itself, the XOR operation would be considered a trivial encryption algorithm in traditional cryptography, but it nonetheless mitigates risk to an acceptable level in many RFID environments.

Figure 5-2 illustrates how cover-coding works. As shown in the figure, the passive tag’s back channel signal is weaker than the reader’s forward channel signal. This will always be the case for a passive tag, which must use the forward channel to power both its computations and the backscattered signal. In the figure, the adversary is able to eavesdrop on the forward channel but not the back channel. So long as this condition holds, the adversary will not be able to learn the random number sent from the tag and therefore will be unable to decipher cover coded information.

Figure 5-2. Cover-Coding

Applicability: Cover coding is useful when eavesdropping is a risk that requires mitigation, but adversaries are expected to be at a greater distance from the tags than readers. Intelligible reception of back channel signals from a passive tag requires proximity of less than four meters in most applications. In many applications, an adversary’s reception equipment would be conspicuous if it were located within this range. In contrast, reader signals can be detected at distances of a kilometer or more under ideal conditions.

Cover-coding is designed for RF subsystems in which the forward channel carries stronger signals than the back channel, which essentially limits the control to passive tags. EPCglobal Class-1 Generation-2 technologies support cover-coding. Proprietary technologies support similar features.

Benefits: Cover-coding helps prevent the execution of unauthorized commands that could disable a tag or modify the tag’s data. Consequently, cover-coding mitigates business process, business intelligence, and privacy risks.

Weaknesses:

Control: Data collected or processed by the tag is encrypted prior to over-the-air transmission.

Applicability: Applications that require an effective countermeasure to the threat of eavesdropping and for which cover coding offers inadequate protections. Tags typically only require on-board encryption capabilities to protect the confidentiality of data in transit if they collect or process data from sensors or other directly connected sources. In these cases, no alternative exists to hide the content of the data over-the-air because the data originates on the tag.

On-board cryptography for confidentiality is not required for applications in which readers are the only source of data. In these cases, the data can be encrypted in the enterprise subsystem or by a reader before it is written to the tag and then retrieved in its encrypted form from the tag when needed. If the tag never has to perform computations on the data, then it never has to decrypt it, but merely store it. Encryption of data at rest is also discussed in Section 5.3.3.2.

Proprietary tag designs support encryption for over-the-air confidentiality, but EPCglobal and ISO/IEC 18000 standards do not as of the date of this publication.

Benefits: Encryption of data in transit prevents successful eavesdropping of over-the-air RFID transactions.

Weaknesses:

Control: RF shielding encloses an area with a conducting material that limits the propagation of RF signals outside of the shielded area. Shielding can vary in size and form depending on the application.

For example, some RFID-enabled travel documents are protected by a metallic anti-skimming material. This material helps to prevent adversaries from reading the embedded tag when the passport cover is closed. Shipping containers are sometimes shielded to prevent the reading of tags during transit. Shielding is also placed in walls, partitions, or stalls to prevent RF emissions from leaving a confined area. When readers are placed in tunnels on industrial production conveyor belts, the tunnels may be shielded to reduce radio interference. Wrapping a tag in aluminum foil is also an effective means of shielding.

Figure 5-3 shows how shielded partitions can separate collocated readers to prevent interference. The readers near forklift A can operate without inadvertently reading tags on boxes on forklift B due to the shielding in the partition that separates the portals. Shielding may be necessary when middleware is unable to correctly filter duplicate read events from the two portals.

Figure 5-3. Grounded Metal Fencing as Shielding

Applicability: Shielding is applicable for contexts in which eavesdropping or RF radiation is a concern, and the use of temporary shielding would not stop valid transactions.

Benefits: Shielding can limit the ability of eavesdroppers or unauthorized readers to collect data from an RFID system.

Weaknesses:

Control: RFID technology can communicate over various radio frequencies, including those in the LF, HF, UHF, and microwave bands. Particular fixed frequencies can be assigned to an RFID application to avoid or reduce the effects of radio interference. Some tag technologies can perform frequency hopping within a limited frequency range, but in these cases, the technique is used primarily to avoid collisions with other tag transactions, not radio interference with different types of radio systems.⁶⁰ In some cases, the implementing organization may need to obtain a license to use a particular desired frequency. Table 2-2 in Section 2.3.1.3 lists potential sources of interference on common RFID frequencies.

Ideally, an RF site survey will be performed before an RFID system is installed to determine what frequencies are already in use. After the RFID system is installed, site surveys can be conducted to determine if the RF characteristics of the site have changed (e.g., new sources of interference).

Applicability: All implementations whose radio frequency is not determined by other application requirements. Organizations that implement a closed RFID system have more freedom to select an operating frequency because they do not have to interoperate with other organizations. However, if tags are based on a particular air interface standard, the range of potential frequencies will be limited to those supported by the standard.

Benefits: Radio frequency selection permits the avoidance of RF interference with other radio systems that could disrupt the RFID system or other technologies. A particular frequency might be desirable because of radio interference on other frequency bands. Some frequencies also have desirable propagation characteristics, such as the ability to penetrate certain materials.

Weaknesses:

Control: Operators adjust the level of transmitted RF energy from a reader or active tag. The use of particular antenna types and configurations can also determine the direction of transmitted RF energy. Additionally, the duty cycle of a reader can be controlled.

Applicability: All applications for which eavesdropping, radio interference, or hazards of electromagnetic radiation are a concern.

Benefits: Reducing transmitted power can:

Weaknesses: The drawback of reducing transmission power or the duty cycle is performance degradation, especially with respect to back channel communication from a passive tag. For instance, readers might fail to detect the presence of valid tags. Also, changes in the physical environment or the introduction of new radio equipment can impact the power levels required for consistently successful transactions. Consequently, the benefits of power adjustments based on a site survey can be negated by changes to the environment.

Control: The RF interface on some proprietary tags can be turned off temporarily. Tag manufacturers have different methods of turning their tags on and off. For example, some tags are designed so that the tag is on or off depending upon which end is inserted into a mounting clip. Other tags have replaceable batteries that can be removed to deactivate them.

If the control is implemented, tags would be turned on inside a designated area where the RF subsystem operates. When the tags leave that area, they would be turned off. For example, in a supply chain application, tags may be turned off to prevent unauthorized transactions during shipment. When the tags arrive at their destination, they would be powered on again and managed. Conversely, tags used for in-transit visibility may be turned on for their trip and turned off when they reach their destination.

Applicability: This control is most useful when communication between readers and a tag is infrequent and predictable. For example, a warehouse might store items for an annual event, such as a holiday celebration or parade. In this case, the RFID confers a benefit only for a short period each year, but could remain vulnerable to rogue transactions if left operational for the rest of the year.

Benefits: Deactivating tags temporarily:

Weaknesses: