1. A Comparative Study of RFID Solutions for Security and Privacy: POP vs. Previous Solutions Advanced Information Systems Engineering Lab Saitama University, Japan 2008-April-17 K.H.S Sabaragamu Koralalage and J. Cheng Department of Information and Computer Sciences, Saitama University, Japan {krishan, cheng}@aise.ics.saitama-u.ac.jp

2. Agenda POP Architecture The Problem Goal Evaluation Conclusion Future Works

3. 17-April-2008ISA 20083 What is POP What is Product-flow with Ownership-transferring Protocol A comprehensive mechanism used to ensure the security and privacy of the passive RFID systems used in a product lifecycle How Tagged-product flow with an anonymous ownership transference Robust communicational protocol

4. 17-April-2008ISA 20084 How to change the ownership PRIVACY SECURITY KaKa SaSa EPC E KbKb SbSb E KdKd SdSd E KeKe SeSe E KfKf SfSf E KgKg SgSg E KhKh ShSh E KiKi SiSi E KjKj SjSj E KkKk SkSk E KlKl SlSl E E E E KcKc ScSc E

5. 17-April-2008ISA 20085 The Problem Position of POP Architecture ? Level of Security ? Level of Privacy ? Level of Functionality ?

6. 17-April-2008ISA 20086 Goal and Objectives Goal Compare and contrast previously proposed RFID solutions against the POP Architecture Objectives 1. Define security criterion 2. Define privacy criterion 3. Define desired functionalities 4. Evaluate available RFID Solutions

7. 17-April-2008ISA 20087 Previous Solutions 1. Faraday Cage[1] 2. Blocker Tag[1] 3. Active Jamming[1] 4. Frequency Modification[12] 5. Kill Tag[1] 6. RFID Guardian[10] 7. Renaming[3] 8. Hash Based Schemes[12,11,9] 9. Delegated Pseudonym[7] 10. Zero knowledge[5] 11. Re-encryption Method[8,2]

8. 17-April-2008ISA 20088 Security Objectives Authentication Authorization Confidentiality Anonymity Data Integrity No-Repudiation Availability Forward Security Anti-Cloning Anti-Reverse Engineering

9. 17-April-2008ISA 20089 Achievement of security objectives

10. 17-April-2008ISA 200810 Attacking RFID Tags Attacking Interrogators Access-key/Cipher-text Tracing Eavesdropping Spoofing Man-in-the-middle Replay Attack Brute-force Attacks Security Attacks

11. 17-April-2008ISA 200811 Protection Against the attacks

12. 17-April-2008ISA 200812 Corporate espionage Competitive marketing Action threat Association threat Location threat Preference threat Constellation threat Transaction threat Breadcrumb threat Privacy Threats

13. 17-April-2008ISA 200813 Protection against privacy threats

14. 17-April-2008ISA 200814 Interoperability Reliability Usability Feasibility Scalability Manage new and damaged tags Control Accessing Transfer ownership online/offline Achieve multiple authorizations Recycle the tagged products Desired Functionalities

15. 17-April-2008ISA 200815 Functional Abilities

16. 17-April-2008ISA 200816 Evaluation POP Achieves Highest security objectives, attack prevention throughout the product lifecycle Highest protection against the privacy threats Highest interoperability Highest level of feasibility, scalability, manageability of new and damaged tags and self controllability Resolve multiple authorizations issue

17. 17-April-2008ISA 200817 Evaluation No solution provides both online/offline anonymous ownership transference other than POP But POP yields for universal customer card and PIN only for after purchase use

18. 17-April-2008ISA 200818 Our evaluation reveals that the POP Architecture is the best out of all those solutions as no one provides such level of achievement so far. Conclusion

19. 17-April-2008ISA 200819 Future Works We hope to analyze the performance of POP Tags in following aspects Computational Overhead Storage Overhead Communication Overhead Cost Overhead

20. 17-April-2008ISA 200820 Thank you very much for your attention !!!..... Please feel free to ask questions…………or put forward your opinions……..

21. 17-April-2008ISA 200821 Q & A

22. 17-April-2008ISA 200822 Thank you

23. 17-April-2008ISA 200823 K. H. S. Sabaragamu Koralalage and Jingde Cheng: A Comparative Study of RFID Solutions for Security and Privacy: POP vs. Previous Solutions, Proceedings of the 2nd International Conference on Information Security and Assurance (ISA '08), pp. 342-349, Busan, Korea, IEEE Computer Society Press, April 2008.