Some RFID Guidelines 4 January 2016 John Greaves This material and content are © John Greaves, 2007. Reproduction or use without the express written permission of the author or DCGL is prohibited. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 INTRODUCTION DCGL offers Radio frequency Identification (RFID), Real Time Locating Systems (RTLS), and Satellite-based (GPS) asset tracking solutions for fixed and mobile assets in the: oil & gas, logistics and health industries - including equipment, drill pipe, and rig management systems onshore and offshore; vehicle/vessel/train/’plane and cargo tracking; pharma/instruments/people/facilities tracking and monitoring. These systems improve operational efficiency and minimise the costs associated with lost, misplaced or stolen assets and improve operational efficiency. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 RFID: Basic Elements RFID has 3 basic elements f = Frequency t = Technology d = Data 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 f = Frequency Frequency is the band in which the SRD (Short Range Device) operates in the Radio Spectrum. The Spectrum Allocations for RFID (SRD) are: 125KHz 13.56 MHz 315 MHz 433 MHz 900 MHz 2.45GHz These are all used internationally and benefit from flexible spectrum regulation in each region of the ITU-R. (International Telecommunications Union – Radio), based in Geneva, Switzerland and the global regulator for spectrum use. All RFID devices share spectrum and can often be subject to device conflict. Device conflict has to be assessed in each facility and then mapped to spectrum to ensure that even certain IR and UV propagators do not interfere. The majority of ID and Asset ID systems are based on a radio propagation in the electro -magnetic field even those named biometric. Any device that propagates a field of energy can be intercepted and corrupted, that includes basic considerations like the security of the electrical power supply. These spectra are all used internationally and benefit from flexible spectrum regulation in each region of the ITU-R. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 t = Technology The technology components of an RFID system are: Chip: a <400 micron particle of silicon developed to respond to radio propagation and to carry a memory packet relevant to the use model. Tag: a label carrying the chip, an antenna to listen for Radio signals and reflect the response from the chip, the tag is based on a sub-strate, the material developed or used to carry the antenna and chip bonded together and a form factor, the shape and other physical dimensions to enable the fitting of the Tag to the asset or item in a maximized performance and least intrusive format. Reader: the device which polls the tags through antenna (not the same as tag Antenna) to enable the transmission of the Data Data: the means of storing, according to standards determined by co-operating Partners, data to be transmitted bi – directionally in a field of read thereby providing an information flow of value to the user at any point in the Chain of Custody. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 d = Data Data: consists of the approved standards, whether internal or external to the User, of the required elements known to the host system that provide for Effective and efficient transmission of qualified and quantitative data of benefit to the user when processed into information of value. An RFID chip is designed to accommodate the memory you, the user, need; An RFID chip, and the RFID system, is indifferent to the amount of data, the type of data and the constructs, syntax or symbology pattern represented; In other words the real value of RFID is in the ability of the reader to discriminate between memory fields and to provide the data the CURRENT user needs…………….let me explain with regard to NAW members. Copyright Durham Consulting Group Limited 2016 27/11/2018

Seven Steps to RFID Success© Global and/or Corporate policy on RFID; Application Analysis; Site Survey; Client Analysis, Client demand or competitive advantage? Design of system, tag, architecture; Develop solution; Deploy. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 Looking for 0HIO© 1 0HIO, Zero Human Intervention Operations, is the key to successful adoption and deployment of RFID technology. The method by which we assess the value and the means by which you can strategically deploy RFID are all derived from this important principle. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 Looking for 0HIO© 2 If the provider is based on a single frequency then you need to change provider; If the provider manufactures the hardware you need to change provider; If the system is not an integrated part of a wireless domain through a IT architecture that is transparent to you, you need to consider change; If the system is not double jeopardy, in terms of visibility of operational status at more than one level of supervision in you, the clients, security team, change is in order; If the system is not linked in double jeopardy to more than one identifying technology then change must be considered; If the system is not cannot be escalated by your access authority then you need to change; If the provider is using an ISO standard you need to change. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 Looking for 0HIO© 3 If the provider is using a visible fixed portal you need to change; If the providers software information flow is not automatically auditing the ready status of all devices and all technologies and is not a part of the keying audit trail and the enterprise wide data guardian system you need to change ; If the facility security cordon, for both visible and invisible breach event management is not mapped and not subject to team revision on at least a quarterly basis, then you have a problem. It is rather like knowing you have an insect problem but not knowing where they hide; If the badging / labelling or identifying of an asset, personnel or media is based on a single unit of identification containing all of the identifying methods, silicon, reflective coatings, bar code, biometric, NFC, Hologram, photograph or more than one of any of the above then you are NOT SECURE; If the system does not react to a breach at a given level of access that calls for shutdown and lockdown then you need to know you are absolutely NOT SECURE. 27/11/2018 Copyright Durham Consulting Group Limited 2016

Copyright Durham Consulting Group Limited 2016 Looking for 0HIO© 4 Are the providers devices certified, if so, by whom and for what purpose: ETSI CEPT SE 24 FCC A trade body or organization A governmental agency IEEE If the parties in the room with you are not able to answer and/or do not know who ETSI is, then you are not in the company of a qualified provider. (European Telecommunications Standards Institute) Answer meaning on the spot, not call the office! 27/11/2018 Copyright Durham Consulting Group Limited 2016