Anti-counterfeiting via Federated RFID Tags’ Diversities Lei Yang Tsinghua University Pai Peng, Fan Dang, Xiang-Yang Li, Yunhao Liu

Diversity

Fingerprinting genuineness 04. Outline Overview 02. Fingerprinting tags 03. Discussion 06. Validating genuineness 05. Motivation 01. Implementation and evaluation 07. Conclusion 08.

Motivation

WHO ： 7~10% of the world’s pharmaceuticals are counterfeits in developed countries, 25%~50% in developing countries. Online counterfeit sales cost about $135 billions in Hong Kong Customs seized 55,000 fake drugs, worth around 5Millions HK$ each year. China loses about 600 billion per year due to fake goods.

State-of-art

How to deal with counterfeiting using RFID technology?

“5F8KJ3” “ ” “74AB8” Serial number based anti-counterfeiting State-of-art Eavesdropping Cloning Replaying RFID enabled anti-counterfeiting

State-of-art Tag Side-channel Reverse engineering Encryption based anti-counterfeiting Cloning RFID enabled anti-counterfeiting

Our approach Tagrint RFID diversity based anti-counterfeiting TagPrint

How TagPrint works? Overview the basic idea

RFID Diversity

RFID diversity Antenna size, impedance matching, clock skew, gain, …..

Validation is totally offline. The validation must be user-friendly. The price is cheap enough. Defending against various attacks, reverse engineering, eavesdropping, cloning, etc. Goal

System Entities (Roles) Tag Provider Product Manufacture Consumer

Overview

Tag Provider The tag provider manufactures the RFID tags, like Alien or ImpinJ Corp.

Overview Product Manufacture The product manufacturer utilizes the technique of RFID to protect their products from being counterfeited.

Overview Consumer The consumer, as a purchaser of product, desires to know whether the product is genuine.

Threat Model The Counterfeiter can eavesdrop any wireless communications between the reader and tags. read and write any tags’ memory. clone a tag’s memory to another one (cloned tag). find a tag with the phase fingerprint as same as the genuine one’s at a price.

Threat Model not recycle the tags from products and re-attach them on the forged product. His purpose is to pursue huge profits. There is no motivation for counterfeiter if the counterfeiting is unprofitable. The Counterfeiter can not

Workflow Consumer ❸ Validating Genuineness ❶ Fingerprint Tags Tag Provider Product Manufacture ❷ Fingerprinting genuineness

How to fingerprint tags? Over the domain of tag provider

Acquiring Phase Fingerprint How to acquire the phase fingerprint? How to automatically, fast, reliably and accurately measure the phase fingerprint?

Acquiring Phase Fingerprint Conveyor-style method

Acquiring Phase Fingerprint Nonlinear least square

Acquiring Phase Fingerprint

Randomness test The phase fingerprint follows the uniform distribution with 0.95 significance level.

Randomness test The reader takes impact on the phase fingerprint.

How to fingerprint genuineness? Over the domain of product manufacture

Challenges

Fingerprint a product Geometric constraint Acquisition constraint Private key checksum

How to validate genuineness? Over the domain of consumers

Hyperbola based Localization Geometric constraint

Hyperbola based Localization If we have three tags as reference, we can build two hyperbolas and their intersection is the location of the reader.

Unfortunately The measured phase difference contains the impact from the diversity!

Hyperbola based Localization Measured phase difference Diversity difference In details, the measured phase difference implicitly contains the diversity difference, while we store the real diversity difference in the tag’s memory. If two values are matched, the diversity influence can be eliminated.

Hyperbola based Localization The reader’s impact is removed by the difference Acquisition constraint

Validation Procedure

Discussion

How about the security?

Security analysis

How about the cost?

Cost analysis MethodCostSecurity TagPrint50~60 centshigh Serial based10 centslow Encryption based50 dollarsmiddle PUF based100 dollarshigh

Implementation & Evaluation

Evaluation

Classification rate

Evaluation Validation result 0.09% 0.12%

Impact of frequency

Impact of distance

Impact of antenna

Conclusion We exploit a new kind of fingerprint for a pair of reader and tag from their backscatter signals. A large-scale experiment involving 6,000 tags is performed to demonstrate the stability and randomness of phase fingerprint. We jointly utilize federated tags’ fingerprints and geometric relationships for the genuineness validation. Our approach is a totally offline solution without any communication between consumer and product manufacturer.

Questions? hank you T