Selective Blocking of RFID Tags for Consumer Privacy Ari Juels and Ronald L. Rivest and Michael Szydlo Presented by Aviram Shmueli 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags RFID – What is it? RFID – Radio-Frequency Identification RFID implementation consists of the following three parts: Tag (small integrated circuit attached to an antennae) Tag reader Database & software Tag holds a unique serial number which identifes the item it attached to 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags RFID Uses Retail & Distribution Automated Checkout Keyless Entry Theft Detection Pet Identification Logistic Assets 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags RFID Vs. Barcode Barcode RFID Optical technology RF technology Line of sight only Non line of sight Read only Read only or read/write capable Smaller range (few cm) Longer range (few meters) Can carry data (2D) Can carry more data Not reusable reusable Sensitivity to dust, moisture and packaging Insensitivity to enviromental factors 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags RFID Benefits More information Individual item data & tracking Small As small as 0.4mm x 0.4mm Ability to be embedded in almost every product Fast Data retrieval done in miliseconds No contact Cheap 0.05$/unit 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags RFID Tag Attributes Active RFID Passive RFID Tag Power Source Internal to tag Energy transferred using RF from reader Tag Battery Yes No Required signal strength Very Low Very High Range Up to 100m Up to 3-5m, usually less Multi-tag reading 1000’s of tags recognized – up to 100mph Few hundred within 3m of reader Data Storage Up to 128 Kb or read/ write & search 128 bytes of read/write 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Passive RFID Tags Example: passive tags in retail security applications Tag contains antenna and a small chip Tag is powered by the electromagnetic field generated in doorways, reflecting back a weak signal containing data 4/22/2019 Selective Blocking of RFID Tags

RFID Drawback – Threat to Privacy RFID technology faces a clear potential for privacy violations Location tracking Belongings tracking Ability to cross information with databases containing personal data 4/22/2019 Selective Blocking of RFID Tags

The “Kill Tag” approach Solution: “Kill” RFID tag upon purchase No purchased goods would contain active RFID tags Not Perfect: Returned products RFID receipts Indentification of food in the refrigarator Business cards 4/22/2019 Selective Blocking of RFID Tags

2. The Faraday Cage approach Solution: Protecting an RFID tag by a metal container Container is impenetrable by radio signals Not Perfect: Objects which can’t be placed in containers: Clothing Human beings 4/22/2019 Selective Blocking of RFID Tags

3. The Active Jamming Approach Solution: Carrying a device that broadcasts radio signals Device blocks/disrupts the operation of any nearby reader Not Perfect: May disrupt all nearby RFID systems, even those in legitimate application Dummy, Crude and brutal way 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags 4. The “smart” Approach Solution: When tag is locked it’s given a value y. Tag is unlocked by presenting a PIN value x such that h(x)=y, where h is a one way has function Not Perfect: Tracking tags through their y value Uncomfortable management Small budget 4/22/2019 Selective Blocking of RFID Tags

The Tree-Walking Singulation Algorithm Used by the RFID-tag reader Identifies serial numbers of nearby tags (usually 64,96,128 bits long) Based on a DSF of a binary tree Iniation: Assumes a subtree to be the starting point. Queries tags lying in the corresponding subtree: Tags reply: ‘0’ – if lies in the left subtree ‘1’ – if lies in the right subtree Collision – occurs when tags broadcast simultaneously ‘0’ and ‘1’ When Collision is detected, tag reader recurses beginning in the left child Outputs list of the ID numbers of all tags within range Complexity = ? 4/22/2019 Selective Blocking of RFID Tags

The Tree-Walking Singulation Algorithm 001 011 110 1 00 01 010 100 101 111 000 10 11 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags What is a Blocker Tag? Privacy Protection Performs a “Passive Jamming” Interferes with the tree-walking singulation protocol Simulates the full spectrum of possible serial numbers for tags Forcing reader to sweep a full space of all possible tags DoS attacks? 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Blocker Tag – type 1 Universal Blocker Simultaneously broadcasts both ‘0’ and ‘1’ Creates a forced collision Tag reader must explore the all tree Exploring tree in depth 128 would never end Blocks reading of all tags Lack of flaxiblity 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Blocker Tag – type 2 Selective Blocker Blocks only a certain zone (subtree) Simultaneously broadcasts both ‘0’ and ‘1’ only to queries which match certain condtions Use of regular expressions Reader might be stuck in a restricted subtree 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Blocker Tag – type 3 “Polite” Blocking Involves protocol extension Several options New query: “Is this subtree blocked?” Policy declaration Enables flexible selective blocking of any node in the tree Defining privacy zones 4/22/2019 Selective Blocking of RFID Tags

Malicious Use of Blocker Tag Universal blocker Total DoS Simulation of actual tags Actual tags may not be distinguished Attacking the tag-reader software Gain control over the tag-reader software Gain access to the system DB 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Privacy Zone Consists of a restricted range of tag serial numbers targeted for protection Once enteres privacy zone, reader is distrupted by the blocker-tag While reader remains outside the privacy zone, blocker-tag is inactive Enables transfering serial numbers from one zone to another 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Glance to the future Clothing and personal appliances are marked with “zone-one” prefix Groceries are marked with “zone-one” prefix Alice might carry a “zone-one” blocker tag in her wrist-watch On groceries purchase, Alice is given “privacy stickers” carrying “zone-two” blocker tags In her Car, Alice uses a blocker tag of all the possible zones 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Conculsions RFID tags are supposed to enormously widespread in the following years Usage of RFID technology raises potential for private threat Blocker tag approaches intend to significally reduce this threat Blocking is done “universally” or “selectively”, enabling defining “private zones” 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Thank You 4/22/2019 Selective Blocking of RFID Tags

Selective Blocking of RFID Tags Home Assignment Describe the tree-walking singulation protocol. Describe the complexity of traversing through the all tree, using K (tree depth) and N (number of tags present). Name one advantage and one disadvantage of any of three mentioned blocking methods In your opinion, which of the proposed blocking methods should be adapted? aviram.shmueli@gmail.com 4/22/2019 Selective Blocking of RFID Tags