1. Anti-counterfeiting via Federated RFID Tags’ Diversities Lei Yang Tsinghua University Pai Peng, Fan Dang, Xiang-Yang Li, Yunhao Liu

2. Diversity

3. Fingerprinting genuineness 04. Outline Overview 02. Fingerprinting tags 03. Discussion 06. Validating genuineness 05. Motivation 01. Implementation and evaluation 07. Conclusion 08.

4. Motivation

5. WHO ： 7~10% of the world’s pharmaceuticals are counterfeits in developed countries, 25%~50% in developing countries. Online counterfeit sales cost about $135 billions in 2011. Hong Kong Customs seized 55,000 fake drugs, worth around 5Millions HK$ each year. China loses about 600 billion per year due to fake goods.

6. State-of-art

7. How to deal with counterfeiting using RFID technology?

8. “5F8KJ3” “949837428” “74AB8” Serial number based anti-counterfeiting State-of-art Eavesdropping Cloning Replaying RFID enabled anti-counterfeiting

9. State-of-art Tag Side-channel Reverse engineering Encryption based anti-counterfeiting Cloning RFID enabled anti-counterfeiting

10. Our approach Tagrint RFID diversity based anti-counterfeiting TagPrint

11. How TagPrint works? Overview the basic idea

12. RFID Diversity

13. RFID diversity Antenna size, impedance matching, clock skew, gain, …..

14. Validation is totally offline. The validation must be user-friendly. The price is cheap enough. Defending against various attacks, reverse engineering, eavesdropping, cloning, etc. Goal

15. System Entities (Roles) Tag Provider Product Manufacture Consumer

16. Overview

17. Tag Provider The tag provider manufactures the RFID tags, like Alien or ImpinJ Corp.

18. Overview Product Manufacture The product manufacturer utilizes the technique of RFID to protect their products from being counterfeited.

19. Overview Consumer The consumer, as a purchaser of product, desires to know whether the product is genuine.

20. Threat Model The Counterfeiter can eavesdrop any wireless communications between the reader and tags. read and write any tags’ memory. clone a tag’s memory to another one (cloned tag). find a tag with the phase fingerprint as same as the genuine one’s at a price.

21. Threat Model not recycle the tags from products and re-attach them on the forged product. His purpose is to pursue huge profits. There is no motivation for counterfeiter if the counterfeiting is unprofitable. The Counterfeiter can not

22. Workflow Consumer ❸ Validating Genuineness ❶ Fingerprint Tags Tag Provider Product Manufacture ❷ Fingerprinting genuineness

23. How to fingerprint tags? Over the domain of tag provider

24. Acquiring Phase Fingerprint How to acquire the phase fingerprint? How to automatically, fast, reliably and accurately measure the phase fingerprint?

25. Acquiring Phase Fingerprint Conveyor-style method

26. Acquiring Phase Fingerprint Nonlinear least square

27. Acquiring Phase Fingerprint

29. Randomness test The phase fingerprint follows the uniform distribution with 0.95 significance level.

30. Randomness test The reader takes impact on the phase fingerprint.

31. How to fingerprint genuineness? Over the domain of product manufacture

32. Challenges

33. Fingerprint a product Geometric constraint Acquisition constraint Private key checksum

34. How to validate genuineness? Over the domain of consumers

35. Hyperbola based Localization Geometric constraint

36. Hyperbola based Localization If we have three tags as reference, we can build two hyperbolas and their intersection is the location of the reader.

37. Unfortunately The measured phase difference contains the impact from the diversity!

38. Hyperbola based Localization Measured phase difference Diversity difference In details, the measured phase difference implicitly contains the diversity difference, while we store the real diversity difference in the tag’s memory. If two values are matched, the diversity influence can be eliminated.

39. Hyperbola based Localization The reader’s impact is removed by the difference Acquisition constraint

40. Validation Procedure

41. Discussion

42. How about the security?

43. Security analysis

44. How about the cost?

45. Cost analysis MethodCostSecurity TagPrint50~60 centshigh Serial based10 centslow Encryption based50 dollarsmiddle PUF based100 dollarshigh

46. Implementation & Evaluation

47. Evaluation

48. Classification rate

49. Evaluation Validation result 0.09% 0.12%

50. Impact of frequency

51. Impact of distance

52. Impact of antenna

53. Conclusion We exploit a new kind of fingerprint for a pair of reader and tag from their backscatter signals. A large-scale experiment involving 6,000 tags is performed to demonstrate the stability and randomness of phase fingerprint. We jointly utilize federated tags’ fingerprints and geometric relationships for the genuineness validation. Our approach is a totally offline solution without any communication between consumer and product manufacturer.

54. Questions? hank you T