RFID Cyber-Security

By Richard Bach, GlobeRanger Corporation and Suku Nair, Omar Al Ibrahim, SMU HACNet Lab.

Cybersecurity keeps growing in importance as more and more of our daily lives depend on networked computer systems. Network security breaches have been making headlines in recent years. Cybersecurity is on everyone's mind these days including that of President Barack Obama. On March 29, 2009 the President ordered a 60-day review of government's cybersecurity. He is in the process of selecting a Whitehouse cybersecurity coordinator, or czar, to oversee and improve the cybersecurity for the government and the nation.

Cybersecurity is about protecting information and information systems from unauthorized users and attacks. Its goal is to ensure confidentiality, integrity, authentication, availability, and non-repudiation of information stored in networked information systems. RFID systems are now part of the information system universe and require security protections just as all other information system.

In our discussions, we divide the spectrum of RFID security into two non-disjoint however, functionally distinct categories – security for RFID deployment and RFID deployment for security. The focus of this paper is on two areas of cybersecurity concern in RFID deployments: RFID tag security and the RFID edge server security. RFID tag security includes protecting tag data, preventing tag cloning and protecting privacy. RFID edge server security includes implementing edge applications using best security practices, ensuring the edge server and edge application interoperability with security software and mechanisms, and ensuring the edge server and edge application adhere to network and site security policies.

In the "RFID for security" discussion, we cover various deployment scenarios for RFID with the intent to increase the security in many industrial and commercial applications. A synopsis of several RFID applications that enhance operational as well as system security will close the paper.