a comparative performance measurement and security ... · passive rfid tags, which are all...

A comparative performance measurement and security analysis of UHF passive RFID tags Qinghan Xiao

.

Defence R&D Canada --- Ottawa Technical Memorandum

DRDC Ottawa TM 2008-253 December 2008

A comparative performance measurement and security analysis of UHF passive RFID tags Qinghan Xiao DRDC Ottawa

Defence R&D Canada – Ottawa Technical Memorandum DRDC Ottawa TM 2008-253 December 2008

Principal Author

Original signed by Qinghan Xiao

Qinghan Xiao

Defence Scientist

Approved by

Original signed by Julie Lefebvre

Julie Lefebvre

Section Head

Approved for release by

Original signed by Pierre Lavoie

Pierre Lavoie

Chief Scientist

CANOSCOM

© Her Majesty the Queen in Right of Canada, as represented by the Minister of National Defence, 2008

© Sa Majesté la Reine (en droit du Canada), telle que représentée par le ministre de la Défense nationale, 2008

DRDC Ottawa TM 2008-253 i

Abstract ……..

Radio Frequency Identification (RFID) technology has been implemented in various areas such as transportation, retail sales, supply chain, healthcare and defence. When RFID technology is considered for defence applications in particular, it is necessary to test and evaluate the technology to determine definitively the tag performance and system security issues. In this report, we test and evaluate the readability and security of four ultra-high-frequency (UHF) passive RFID tags, which are all compatible with the Electronic Product Code ™ (EPC) global Generation 2 (Gen 2) standard. The tags were tested in free space. The testing established baseline parameters for passive tags, which allow for comparison between different tags and the evaluation of their security features. The objective of this paper is to identify potential technical and security challenges to the application of RFID technologies in the Canadian Forces (CF) and to suggest potential solutions to these challenges.

Résumé ….....

La technologie de l’identification par radiofréquence (IRF) a été introduite dans plusieurs secteurs d’activité comme le transport, la vente au détail, la chaîne d’approvisionnement, les soins de santé et la défense nationale. Quand on entend utiliser cette technologie, particulièrement pour des applications militaires, il faut la mettre à l’essai et l’évaluer afin de mesurer précisément la performance des étiquettes et de régler les questions de sécurité du système. Le présent rapport porte sur les résultats des tests et de l’évaluation effectués dans le but de mesurer la lisibilité et le degré de sécurité de quatre étiquettes RFID passives ultra-haute fréquence (UHF), toutes conformes à la norme internationale de l’EPC® (code électronique de produit) de 2e génération (Gen 2). Les étiquettes ont été mises à l’essai en espace libre, ce qui nous a permis de fixer les paramètres de base pour les étiquettes passives de sorte que l’on puisse désormais comparer différentes étiquettes et évaluer leurs caractéristiques de sécurité. Le but du présent rapport est de cerner les problèmes techniques et sur le plan de la sécurité qui risquent d’entraver l’introduction de la technologie IRF dans les Forces canadiennes (FC) et de proposer des solutions possibles à ces problèmes.

ii DRDC Ottawa TM 2008-253

This page intentionally left blank.

DRDC Ottawa TM 2008-253 iii

Executive summary

A comparative performance measurement and security analysis of UHF passive RFID tags:

Qinghan Xiao; DRDC Ottawa TM 2008-253; Defence R&D Canada – Ottawa; Décembre 2008.

Introduction or background: RFID (Radio Frequency Identification) is a term applied to a number of technologies that utilize radio waves to automatically identify an object. The object is labelled with an RFID tag that contains a chip and an antenna that can transmit stored data, usually identification information, to a reader. RFID technology has been rapidly implemented in supply systems to enable inventory tracking, management, and data mining. To deal with challenges of the visibility, tracking and traceability of its logistics assets, the Canadian Operational Support Command (CANOSCOM) has been using active RFID technology within the Canadian Forces (CF) Supply Chain. This technology allows the improvements of data quality, asset visibility and maintenance of materiel. Further implementation of passive RFID technology will enable the CF to improve inside the box/pallet visibility.

Results: We started by measuring the read range of different passive tags. The results showed that all the tags tested could be reliably read up to four and a half meters away, which met the US Department of Defense (DoD) RFID mandate: “The DoD approved frequency range for the tags is 860-960 MHz with a minimum read range of three meters” [1]. Then, a comparative evaluation was conducted to determine whether the tags with different sizes and antenna shapes can have significantly different performance. Tag performance is affected by the orientation of the tag relative to the interrogator antenna. The best tag performance occurs when the tag plane and the antenna plane are parallel to each other. As a tag is rotated, its performance can change significantly. Since tags are not always oriented ideally, we performed readability tests on horizontal and vertical perpendicular orientations. The results showed that the orientation had less influence on the performance of the Symbol tag, which has four T-type antennas. We also found that tags perform differently in the presence of such materials as water and metal. Our test showed that, when water or metal was placed between the tag and reader, the readability declined for all the tested tags no matter the shape of their antennas. Finally, we investigated the security features of the passive tags and produced some interesting findings. Significance: Since the CF may use the EPC-based passive UHF RFID tags, it is necessary to conduct a study to:

• evaluate the performance of different passive RFID tags to check the readiness of RFID technology for operational deployment

• understand the security vulnerabilities of implementing passive tags in the supply chain environment

Future plans: A further study is recommended to evaluate tag read rates ⎯ how quickly tags can be read by readers ⎯ for reading single tag and multiple tags with both static and moving conditions.

iv DRDC Ottawa TM 2008-253

Sommaire .....

A comparative performance measurement and security analysis of UHF passive RFID tags:

Qinghan Xiao; DRDC Ottawa TM 2008-253; R & D pour la défense Canada – Ottawa; Décembre 2008.

Introduction ou contexte: Le terme « identification par radiofréquence » (IRF) s’applique à plusieurs technologies qui se servent d’ondes radioélectriques pour identifier automatiquement un objet étiqueté. L’objet est muni d’une étiquette composée d’une puce et d’une antenne capable de transmettre au lecteur les données stockées, habituellement des informations d’identification. La technologie IRF a rapidement été utilisée pour les systèmes d’approvisionnement afin de faciliter le pistage et la gestion des stocks, ainsi que l’extraction des données connexes. Pour régler les problèmes de visibilité, de pistage et de traçabilité de ses ressources logistiques, le Commandement de soutien opérationnel du Canada (COMSOCAN) s’est servi de la technologie IRF active pour contrôler la chaîne d’approvisionnement des Forces canadiennes (FC). Cette technologie permet d’améliorer la qualité des données, la visibilité des ressources et l’entretien du matériel. Une application plus vaste de la technologie IRF passive permettra aux Forces canadiennes d’améliorer la visibilité à l’intérieur des caisses-palettes.

Résultats: Nous avons commencé par mesurer la lisibilité de diverses étiquettes passives. Les résultats ont montré qu’elles pouvaient toutes être lues correctement à une distance maximale de 4,5 m, ce qui répond au critère d’IRF du département de la Défense des États-Unis selon lequel les étiquettes dont la gamme de fréquences est de 860 à 960 MHz doivent avoir une portée de lecture minimale de trois mètres. Nous avons ensuite réalisé une évaluation comparative pour déterminer si des étiquettes de différentes grosseurs munies d’antennes de différentes formes auraient une incidence marquée sur la performance. Nous avons constaté que la position de l’étiquette par rapport à l’antenne de l’interrogateur avait effectivement une incidence sur la performance des étiquettes et qu’elles fonctionnent de façon optimale lorsqu’elles sont parallèles à l’antenne. Une rotation de l’étiquette modifie considérablement sa performance. Comme la position des étiquettes n’est pas toujours idéale, nous avons fait des tests de lisibilité en les plaçant horizontalement et verticalement perpendiculaires aux antennes. Nos résultats ont montré que l’orientation avait moins d’incidence sur la performance des étiquettes de fabrication Symbol lesquelles comportes quatre antennes en T. Nous avons également constaté que la présence de certaines substances, comme l’eau ou le métal, nuisait à la performance des étiquettes. En effet, lorsque de l’eau ou des métaux se trouvent entre l’étiquette et le lecteur, la lisibilité des étiquettes diminue, peu importe la forme des antennes. Enfin, nous avons vérifié les caractéristiques de sécurité des étiquettes passives, ce qui nous a permis d’arriver à d’intéressantes conclusions.

Importance: Puisque les FC utiliseront possiblement des étiquettes IRF UHF conformes à l’EPC, il faut de mener des études pour :

• Mesurer la performance de diverses étiquettes d’IRF passives afin de déterminer si la technologie est prête à être implantée.

DRDC Ottawa TM 2008-253 v

• Comprendre les lacunes sur le plan de la sécurité que comporte l’implantation d’étiquettes passives dans la chaîne d’approvisionnement.

Perspectives: Nous recommandons de mener des recherches plus poussées pour déterminer à quelle vitesse un lecteur peut lire une et plusieurs étiquettes stationnaires et en mouvement.

vi DRDC Ottawa TM 2008-253


DRDC Ottawa TM 2008-253 vii

Table of contents

Abstract …….. ................................................................................................................................. i Résumé …..... ................................................................................................................................... i Executive summary ........................................................................................................................ iii Sommaire ....................................................................................................................................... iv Table of contents ........................................................................................................................... vii List of figures ............................................................................................................................... viii Acknowledgements ........................................................................................................................ ix 1 Introduction............................................................................................................................... 1 2 Harware and Software Descriptions ......................................................................................... 3

2.1 Tags ............................................................................................................................... 3 2.2 Reader............................................................................................................................ 5 2.3 Software......................................................................................................................... 5

2.3.1 JRFID GUI...................................................................................................... 5 2.3.2 Data Recording ............................................................................................... 6

3 Performance Measurement ....................................................................................................... 8 3.1 Test Set-up..................................................................................................................... 8 3.2 Variance of Tag Performance vs. Distance ................................................................. 10 3.3 Orientation Sensitivity................................................................................................. 11 3.4 Performance with Different Reader Antenna Heights................................................. 17 3.5 Tags Blocked by Materials .......................................................................................... 18

4 Security Features and Vulnerability Assessment.................................................................... 23 4.1 EPC Gen 2 Security Features ...................................................................................... 23 4.2 Snooping Tagged Boxes Loaded on Vehicle .............................................................. 24

5 Conclusion .............................................................................................................................. 27 References ..... ............................................................................................................................... 29 List of symbols/abbreviations/acronyms/initialisms ..................................................................... 31

viii DRDC Ottawa TM 2008-253

List of figures

Figure 1: Tags used in the experiment............................................................................................. 4 Figure 2: Performance of Intermec fixed RFID readers. ................................................................. 5 Figure 3: JRFID GUI....................................................................................................................... 6 Figure 4: Record test data................................................................................................................ 7 Figure 5: Reader and tag set-up....................................................................................................... 8 Figure 6: A schematic diagram of reader and tag set-up. ................................................................ 9 Figure 7: Reader, antenna, router and backend computer. .............................................................. 9 Figure 8: Tag was read from 5 meters away. ................................................................................ 10 Figure 9: Tag performance vs. distance......................................................................................... 11 Figure 10: Definition of parallel, horizontal and vertical orientations. ......................................... 12 Figure 11: Orientation readability test with AD-222..................................................................... 12 Figure 12: Readability variations with orientations (Alien 9554). ................................................ 13 Figure 13: Readability variations with orientations (AD-222)...................................................... 13 Figure 14: Readability variations with orientations (Symbol). ..................................................... 14 Figure 15: Readability variations with orientations (StrongTech). ............................................... 14 Figure 16: Comparison on parallel readability. ............................................................................. 15 Figure 17: Comparison on horizontal readability.......................................................................... 16 Figure 18: Comparison on vertical readability. ............................................................................. 17 Figure 19: Antennas set at different heights. ................................................................................. 18 Figure 20: Readability comparison on different reader antenna height......................................... 18 Figure 21: Bottle filled with water in front of the tag. .................................................................. 19 Figure 22: Tag blocked by empty tin can. ..................................................................................... 20 Figure 23: Tag blocked by metal. .................................................................................................. 20 Figure 24: Tag blocked by Styrofoam........................................................................................... 21 Figure 25: Readability with different material. ............................................................................. 22 Figure 26: Snooping test................................................................................................................ 26

DRDC Ottawa TM 2008-253 ix

Acknowledgements

I would like to express my thanks and appreciation to the Canadian Operational Support Command for their encouragement and support throughout the course of RFID project; Certification and Engineering Bureau of Industry Canada that measured the antenna patterns of IF5 fixed reader and lent me a large free space to perform my experiments; Dr. Maxwell Dondo for his comments on technical review; and Matthew Kellett for his careful correction and editing. Any errors, of course, are the responsibility of the author alone.

x DRDC Ottawa TM 2008-253


DRDC Ottawa TM 2008-253 1

1 Introduction

In the recent years, the use of RFID has grown exponentially across a variety of core industries, such as logistics, manufacturing, retail and healthcare. RFID is an automated identification technology that utilizes radio waves to identify and track cargo, people, animals, and products. An RFID system usually consists of three major components: the tag, the reader, and the backend system. The tags are identification devices and can be categorized as either passive or active. Passive tags are powered by the reader while active tags have a self-contained power source that powers some or all of their functions. Passive RFID tags are typically less expensive to manufacture than active tags. They tend to be much smaller than active tags. Combining their size with a long shelf life —since they are powered externally — means that passive tags have almost unlimited applications for consumer goods and industrial/inventory processes. The benefits of using passive RFID tags in a supply chain include:

• Improving inventory management

• Increasing efficiencies in shipping and receiving of goods

• Enhancing asset tracking and quality control

• A long useful life of twenty years or more

The performance of the Ultra High Frequency (UHF) RFID tags has been significantly improved since the advent of Generation 2 (Gen 2) technology that was adopted in December 2004 and subsequently ratified as the ISO/IEC 18000-6 standard in July 2006. Compared to previous class 1 EPC tags, Gen 2 tags have the following advantages in speed of operation and security:

• Gen 2 tags will be able to approximately write up to about 7 tags per second (versus 4) and read about 1,000 tags per second (versus 300)

• The password has been upgraded from 8bit to 32bit, tag memory and reading can be password protected, and the tag has a kill feature which cannot be reversed once activated

Currently the read/write reliability is at 97%-99% for Class 1 Generation 2 (C1G2) passive RFID tags with a wide variety of products. As a standard, EPC Gen 2 is being adopted readily by users in the development of RFID for supply chain management applications. The US DoD has been planning to use of the standard UHF Gen 2 EPC tag, Class 1 or higher to achieve end-to-end supply chain integration. The tag will operate over the frequency range between 860 MHz and 960 MHz with a minimum read range of three meters (about 9 feet) [2]. A news brief on 6 May 2008 reported that [3]

Last week the US Army issued a request for proposals (RFP) to provide passive Gen 2 RFID equipment potentially worth millions of dollars during the next six years…… The program represents a major new investment in passive RFID. In just the next three years, the Army expects to purchase 5,894 fixed-position readers, 2,199 handheld readers, 646 printer/encoders, 53,642 general-purpose tags, and 3,803 software licenses under the contracts awarded, according to background documents available with the RFP...... Documentation included with the RFP says RFID equipment will be

2 DRDC Ottawa TM 2008-253

used throughout the world by the US Army, Coast Guard, Department of Defense, and other federal agencies, plus NATO and some foreign militaries.

In preparation for the potential use of passive RFID technology by the CF in supply chain operations, we carried out this study to determine the performance metrics and to identify the security threats involved. With the RFID Tool Kit developed by IBM Canada, we focussed our work on the following areas:

• Tag read distance

• Orientation sensitivity of tags

• Variance in tag performance

• Tags near metal and water

• Tags inside of a vehicle

• Security features and risk assessment This report consists of five sections. Section 1 introduces the reader and tags that have been used in the study. Section 2 explains test set-up environment. Section 3 presents the results and findings of the study. Section 4 examines the security features and performs vulnerability assessment. Finally, Section 5 summarizes the important findings, concludes the report, and recommends further work.


2 Harware and Software Descriptions

In this section, all the software and hardware equipment that were used in the test are described in detail.

2.1 Tags

RFID tags consist of a microchip with an antenna, which can be categorized as either ‘active’ or ‘passive’ depending on how they are powered [4]. The passive tags used in the test were received from Alien Technology, Avery Dennison, Symbol Technology and Strongtech (Figure 1). All of them are passive tags operating in UHF band between 902 MHz and 928 MHz. Furthermore, these tags are fully compliant with Electronic Product Code™ (EPC) Global Gen 2 standard as follows:

• Alien M-Tag (Alien 9554)

• Avery AD222

• Symbol Four T

• StongTech


(a) Avery AD-222

(b) Alien 9554

(c) Symbol Four T

(d) StongTech

Figure 1: Tags used in the experiment.


2.2 Reader

An RFID reader is a powered wireless device that communicates with the RFID tags and facilitates data transfer between the RFID tags and the backend system [4]. A fixed reader was used for all our tests. Specifically, we used an Intermec RFID reader, model number IF5. The IF5 is an embedded device that can connect through wired or wireless Ethernet connections to transmit tag read information to the backend system. The IF5 fixed reader was selected because it is a common reader used in supply chain applications. It runs on the Linux operating system and has a software package for demonstration purposes. Figure 2 shows different Intermec fixed readers.

Figure 2: Performance of Intermec fixed RFID readers.

2.3 Software

2.3.1 JRFID GUI

The demonstration software used in our experiment is called JRFID, which is provided by Intermec for fixed readers. The procedures for installing JRFID are as follows:

1. Download JRFIDAppinstall_V139.zip from Intermec’s website ftp://epsfiles.intermec.com/eps_files/eps_download/JRFIDAppinstall_V139.zip

2. Extract the files from JRFIDAppinstall_V139.zip

High Performance

Medium Performance

Basic Performance

Rugged / Industrial Entry-level / General Purpose

IF 4

IF 5

IF 61

IF 30


3. Run JRFIDInstallUtility.msi to install the application

4. Find ‘JRFID BRI App’ shortcut on your desktop to run the application

Once installed, there is a PDF User Guide available in the directory Program Files\Intermec\JRFID BRI App\User Guide. Figure 3 shows the GUI of JRFID that allows the user to use the reader’s controls, such as connect the reader, scan tags, and change settings.

Figure 3: JRFID GUI.

2.3.2 Data Recording

The performance was evaluated based on how many times a tag had been read after the reader completed 10 read cycles. Figure 4 shows an example that a tag 300833B2DDD9048035050000 was read 6 times when the cycle count was set to be 10 times.


Figure 4: Record test data.


3 Performance Measurement

3.1 Test Set-up

The experiments were conducted in an indoor open area that is about 11 meters long and 6 meters wide. The read range was tested from 0.5 meters to 9.5 meters. The reader was positioned on a wood frame and the tag was stuck onto a paper box. The heights of the reader and the tag were 1.07 meters and 0.92 meters, respectively. Figure 5 shows an example set-up in which the distance between the reader and the tag is 2 meters. The system schematic diagram is shown in Figure 6.

Figure 5: Reader and tag set-up.

In the test, a laptop was used as the backend system, which communicated with the reader through a wireless router. A cable was used to connect the read with an antenna. Figure 7 shows the set-up of the antenna, reader, router and backend computer.


Figure 6: A schematic diagram of reader and tag set-up.

Figure 7: Reader, antenna, router and backend computer.


3.2 Variance of Tag Performance vs. Distance

First, we evaluated the performance of different passive tags to address one of the fundamental questions of tag performance: how far away a tag can be read? For this experiment, we measured the tag readability from 0.5 meters to 9.5 meters in 0.5 meter increments. The objective was to observe how different passive tags perform at various distances when they are in parallel orientation (aligned with floor tiles). The other factors that influence the tag performance, such as orientation, materials between the tag and reader, were considered in the succeeding experiments, but not for this test. Figure 8 shows an example set-up where the distance between the tag and reader was 5 meters.

Figure 8: Tag was read from 5 meters away.

Figure 9 presents a graph which demonstrated that all the tested tags could be reliably read within 4.5 meters when the heights of the tag and reader were close to each other. Further than 4.5 meters, the tags performed differently. However, all of them could be read perfectly at 7.5 meters. After examining the antenna patterns presented in an investigative report prepared by the Certification and Engineering Bureau of Industry Canada [5], we believe that the spike in readability was caused by ground reflections. The Symbol Four T tag, benefiting from its antenna shape, showed the best performance. After 4.5 meters, it could be read 10 out of 10 times at the


distances of 6.5 and 7.5 meters, and 7 out of 10 times at the distances of 8.5 and 9.5 meters. The experimental result demonstrated that all the tested tags performed with good readability and satisfied with the DoD plan that requires “passive UHF tags operating between 860 MHz and 960 MHz with a minimum read range of three meters (about 9 feet)”.

Figure 9: Tag performance vs. distance.

3.3 Orientation Sensitivity

In a supply chain application, there is no guarantee that the reader and tag will be always in parallel position. Therefore, we tested the orientation of the tags as parallel, horizontally perpendicular, and vertically perpendicular (Figure 10).


Figure 10: Definition of parallel, horizontal and vertical orientations.

Each tag was attached onto a paper box and the orientation of the paper box was rotated during the test as shown in Figure 11. Note: the perpendicular experiments would have brought the height of the tag lower than that of the parallel experiment.

(a) Parallel (b) Horizontally perpendicular (c) Vertically perpendicular

Figure 11: Orientation readability test with AD-222.

First, for each tag the readability measurements in three orientations were plotted in the same graph for easy comparison. Figures 12 to 15 illustrate the test results for Alien 9554, AD222, Symbol Four T, and StongTech respectively. Then, the readabilities of different tags in different orientations were compared. Examining these results, the Symbol Four T showed the best performance which could be read consistently in all orientations within 4.5 meters (Figure 14). The excellent readability most likely comes from its four T-type antennas. The Alien 9554 had the second best performance when we look at its readability in the parallel and horizontally perpendicular orientations. However, it showed a very poor performance in the vertically perpendicular orientation.

Parallel

Vertically perpendicular

Horizontally perpendicula


Figure 12: Readability variations with orientations (Alien 9554).

Figure 13: Readability variations with orientations (AD-222).


Figure 14: Readability variations with orientations (Symbol).

Figure 15: Readability variations with orientations (StrongTech).


For comparison, Figures 16 to 18 plot the readability measurements of different tags together in each orientation. As discussed in Section 3.2, the tags tested had similar performance in the parallel orientation ⎯ all of them could be reliably read within 4.5 meters. However, there is a dead zone in that orientation for all the tags at 5.5 meters (Figure 16).

Figure 16: Comparison on parallel readability.


In the horizontally perpendicular orientation test, the Symbol Four T tag showed the best performance with the longest readability range. It could be constantly read at 4 meters compared to the other tags that could only be reliably read at a short distance of 2.5 meters. It is interesting to notice that all of them showed a performance rebound at the distance of 8 meters, except for Symbol tag which rebounded at 6.5 meters as well.

Figure 17: Comparison on horizontal readability.


Taking the advantage of its four T-type antennas, the Symbol Four T tag also showed the best performance in the vertically perpendicular orientation test. Actually, it performed almost the same in both the vertical and horizontal perpendicular orientation tests. The Alien 9554 performed the worst. It could not be read at all when the tag was placed in the vertically perpendicular orientation to the reader. The StrongTech and AD-222 tags could hardly be read beyond 1 meter. Figure 18 shows the experimental results.

Figure 18: Comparison on vertical readability.

3.4 Performance with Different Reader Antenna Heights

In the previous experiments, the reader antenna was set at 1.07 m. To understand the effects of the reader antenna and tag heights to the performance, we lowered the height of the reader antenna to 0.79 m while keeping the tag antenna height the same as before so that the reader antenna was slightly lower than the tag antenna. Figure 19 shows these two set-ups. We measured the readability of the AD-222 tag and the experimental results are plotted in Figure 20. The readability has been reduced to 3.5 meters when the reader antenna is set at a lower position than that of the tag antenna. However, comparing the lower and higher reader antennas, the reader antenna with the lower height can create stronger ground reflection that results in a better performance beyond 4.5 meters.


(a) Antenna height is 1.07 m (b) Antenna height is 0.79 m

Figure 19: Antennas set at different heights.

Figure 20: Readability comparison on different reader antenna height.

3.5 Tags Blocked by Materials

The previous experiments were designed to measure the free space performance of passive tags, which can be used as baseline measurements for tag performance. However, even though line-of-


sight is not required to read the tag, in real applications the tag may be blocked by other materials. For example, it has been noted elsewhere that UHF RFID tags are not robust when placed near water or metal because radio waves bounce off metal and are absorbed by water at ultrahigh frequencies [6-8]. To evaluate the tags’ performance under non-line-of-sight circumstances, we carried out the following experiments on tag AD-222:

• Tag blocked by water

• Tag blocked by empty tin bottle

• Tag blocked by metal

• Tag blocked by Styrofoam

Figures 21 to 24 illustrate the corresponding set-ups.

Figure 21: Bottle filled with water in front of the tag.


Figure 22: Tag blocked by empty tin can.

Figure 23: Tag blocked by metal.


Figure 24: Tag blocked by Styrofoam.

Figure 25 shows the experimental results. It can be seen that the reliable reading distance is reduced when the tag is covered by materials. The tag could not be read when it was blocked by metal or a tin can. Among the tested tags, Styrofoam had the least effect on readability compared with the other materials.


Figure 25: Readability with different material.


4 Security Features and Vulnerability Assessment

A US-based information security think tank, Georgia Tech Information Security Center (GTISC), released a report that predicts the top five cyber threats that will increase and mature in 2008 [9, 10]:

• Web 2.0 and Client-Side Attacks: including social networking attacks and new attacks that will exploit Web 2.0 vulnerabilities

• Targeted Messaging Attacks: including Instant Messaging attacks and malware propagation via online video-sharing

• Botnets: specifically the spread of botnet attacks to wireless and peer-to-peer networks

• Threats Targeting Mobile Convergence: including voice spam, vishing and smishing

• Threats to RFID Systems: evolving and varied threats in this emerging technology sector

4.1 EPC Gen 2 Security Features

In light of these threats, we investigated the security features of the EPC Class 1 Gen 2 tags. Although the EPC Global Class 1 Gen 2 standard is not designed with advanced security features because of the limited memory capacity of the tags that implement it [11], it does provide two security mechanisms: (1) access password, and (2) locking.

When applying memory protection, the first technique is to use the password. The access password allows the user to protect data from being written over, but unfortunately the Gen 2 protocol does not provide a way to protect the EPC code from being read. The EPC code in Gen 2 tags is in a read/write memory bank.

• Memory Bank 0: 8 bytes 0 – 3: kill password 4 – 7: access password

• Memory Bank 1: 16 bytes 0 – 1: CRC (Cyclic Redundancy Check) – is computed based on the EPC and used to check for transmission errors 2 – 3: Protocol Control – used to indicate which standard the tag follows (i.e. EPC Gen 2 or an ISO standard) 4 – 15: EPC Code

• Memory Bank 2: 4 bytes 0: 0xE2 1 – 3: Tag Identifier – identifies manufacturer and tag type

• Memory Bank 3: 0 bytes The tags we tested did not have extended memory.

The access password is 4 bytes stored in memory bank 0 at the fourth byte. The following is an example of how to write a password to a tag:


1. Write a password 12345678

Command: WRITE HEX(0:4,4)=H12345678 Output: H3014041A98CF2780000000DA WROK

OK>

2. Display the access password

Command: READ HEX(0:4,4) Output: H3014041A98CF2780000000DA H12345678

OK>

Another security feature is that it is possible to lock the information inside an EPC Gen 2 tag's memory either temporarily or permanently. The lock function/method allows the user to:

• Lock individual passwords – preventing or allowing subsequent reads and/or writes of that password

• Lock individual memory banks – preventing or allowing subsequent writes to that memory bank

• Permalock – make the lock status permanently unchangeable for a password or memory bank

In many applications, it is important to protect the tag from the kill command that permanently disables the tag’s Integrated Circuit. To achieve that, we can use the PROTECT command with the PERMANENT parameter.

1. Command: PROTECT ON PERMANENT HEX(1:0,16) PASSWORD=H12345678

Output: HBBBB041A98CF2780000000DA LCKOK OK>

2. Attempt to write over data with the correct password: Command: WRITE HEX(1:4,2)=HAAAA PASSWORD=H12345678 Output: HBBBB041A98CF2780000000DA PVERR

OK>

In summary, the EPC Global Class 1 Gen 2 standard is not designed with advanced security. The Gen 2 protocol allows the user to protect the tag from the kill command and the unwanted reading of the access password, but it does not provide a way to protect the EPC code from being read.

4.2 Snooping Tagged Boxes Loaded on Vehicle

Since the EPC Gen 2 standard does not address the security functions, such as tag authentication, information theft/exploitation and presence detection, there exists a security threat that an adversary could sniff a truck's payload information from the RFID tags during transportation. In June 2007, researchers from PacketFocus Security Solutions and Atlas RFID Solutions said that they could scan and hack EPC labels on products being transported on 18-wheeler tractor-trailers with standard tag readers and antennas [12]. If a trucker traveled to public truck stops to sleep and


rest, that would be especially vulnerable because “That's vulnerable for RFID stuff sitting in the truck, passive”, said Joshua Perrymon, hacking director for PacketFocus Security Solutions.

To evaluate the risk of such an attack we carried out the following experiment. The tags used in the previous tests ⎯ Alien 9554, Avery AD222, Symbol Four T, and StongTech ⎯ were attached onto paper boxes and put into a mini van (see Figure 26 (a)). The reader, antenna and router were set up atop a wood frame on the side of the road. The router communicated with the backend computer wirelessly. We performed the tests in two situations: (a) when the vehicle was stopped; (b) when the vehicle was being driven at slow speeds, 5km/h to 30 km/h (see Figure 26 (b)). The experimental results showed that the tag could only be read at an angle, through the door’s edge, and not through metal, when the vehicle was stationary and the reader was a short distance away, less than 30 cm.

In summary, with off-the-shelf reader and antenna, our tests showed that the risk from the scenario reported in [12] “Hacking Truckers” was low because the hacker could only sniff RFID tags information from non-metal parts of the vehicle with a reader at very close range.


(a) Tagged boxes in a mini van

(b) Read tag information outside of the mini van

Figure 26: Snooping test.


5 Conclusion

When RFIDs were first introduced for inventory and supply chain management, industry focused on using high frequency (HF) RFID for item-level tagging because they are more tolerant of metal and liquids. The focus shifted, however, when Wal-Mart announced that it would use UHF technology for both item-level and case-level tracking. As a result, sooner or later, the CF may use the EPC-based passive UHF RFID tags in its supply chain. We carried out a study to evaluate the performance of different UHF passive tags to check the readiness of RFID technology for operational deployment, and understand the security vulnerabilities of implementing passive tags in supply chain environment. The following are the important findings:

• The experimental results from both free-space and material-covered tags show that the Symbol Four T tag performed the best overall in readability, benefiting from its four T-type antennas

• The EPC Gen 2 UHF tags allow for reading from a distance. When placed in parallel orientation, all the tags tested can reliably be read up to four and a half meters away, which exceeded the DoD minimum range requirement of three meters

• Tag performance is affected by the orientation of the tag relative to the interrogator antenna. The best readability is achieved when the tag plane and the antenna plane are parallel to each other

• The readability is affected by the presence of various barrier materials, especially water and metal. When water or metal is placed between the tag and reader, the readability degraded regardless of the shape of tag antennas

• The EPC-based passive UHF RFID tags do provide some security against attack in two ways:

─ The access password allows the user to protect data from being written over

─ The permanent lock can make password or the EPC data permanently unchangeable

• It is said that UHF readers operate at 915 MHz in North America. However, it was revealed that the frequency of operation for the reader to tag communication in passive UHF RFID is not fixed [5]. The system works on 902 - 928 MHz frequency hopping technology to prevent readers from interfering with one another. The readers may jump randomly or in a programmed sequence to any frequency between 902 MHz and 928 MHz. This feature makes it more difficult (but not impossible) for an adversary to eavesdrop because the chance of both the reader and eavesdropping receiver operating on exactly the same frequency at the same time is small.

Based on our findings, we recommend UHF passive tags for consideration by the CF for use in its supply chain applications. The tags have password protection and can be protected from alteration or deactivation using the permanent locking feature. Since we cannot prevent unauthorized reading, for sensitive items, such as weapons, we recommend the use of metal containers or surrounding them with water to prevent unauthorized reading.


Further study is recommended in the following areas:

• Test more item-level tags that fit CF profile requirements

• Evaluate tag read rates

• Investigate the readability of multiple tags

• Evaluate the performance of EPC Gen 2 UHF RFID tags on moving objects


References .....

[1] “Radio Frequency Identification (RFID) Policy”, July 30, 2004, [Online]. http://www.acq.osd.mil/log/rfid/Policy/RFID%20Policy%2007-30-2004.pdf (Access date: 16 December 2008).

[2] “Passive UHF RFID Tag Specifications”, Office of the Deputy Under Secretary of Defense (Logistics & Materiel Readiness), [Online]. http://www.acq.osd.mil/log/rfid/purfid_tag_Specs.htm (Access date: 16 December 2008).

[3] John Burnell, “US Army Issues RFP for Large RFID Purchase”, RFID Update, Issue 833, May 6, 2008.

[4] Qinghan Xiao, “RFID: Technology, Applications, Security Threats, and Countermeasures”, (DRDC Ottawa, TM 2007-141), Defence R&D Canada – Ottawa, July 2007.

[5] Joshua Laviolette and Stephane Proulx, “Investigation Report for Defence Research and Development Canada”, Certification and Engineering Bureau of Industry Canada, 124762, March 28, 2008 (66 pages).

[6] Daniel M. Dobkin and Steven M. Weigand, “Environmental Effects on RFID Tag Antennas”, Microwave Symposium Digest, 2005 IEEE MTT-S International, pp.135–138, June 2005.

[7] “Packaging Toolkit”, Meat & Livestock Australia, Revised 2007, [Online]. http://www.mla.com.au/NR/rdonlyres/BD29DC22-0C4A-40BC-BE52-106F802556AF/0/toolkit.pdf (Access date: 16 December 2008).

[8] Judith M. Myerson, RFID in the Supply Chain: A Guide to Selection and Implementation, Auerbach, 456 pages, November 20, 2006.

[9] “Top Five Threats for 2008”, Dark Reading, Oct. 5, 2007, [Online]. http://www.darkreading.com/document.asp?doc_id=135609 (Access date: 16 December 2008).

[10] “GTISC Releases 2008 Cyber Threats Forecast”, GeorgiaTech, Oct. 2, 2007, [Online]. http://www.cc.gatech.edu/news/gtisc-releases-emerging-cyber-threats-forecast-for-2008 (Access date: 16 December 2008).

[11] Lori Porter, “The Gen 2 Standard: What Is It, and What Does It Mean?”, Paxar Corporation, [Online]. http://www.paxar.com/products/BarcodeRFID/documents/Gen2_Standard.pdf (Access date: 16 December 2008).

[12] Kelly Jackson Higgins, “Hacking Truckers”, Forbes.com, June 25, 2007, [Online]. http://www.forbes.com/2007/06/25/cx_0625darkreading.html?partner=alerts (Access date: 16 December 2008).


List of symbols/abbreviations/acronyms/initialisms

CF Canadian Forces

CANOSCOM Canadian Operational Support Command

C1 Class 1

DoD Department of Defense

EPC Electronic Product Code

Gen 2 Generation 2

GTISC Georgia Tech Information Security Center

RFID Radio Frequency Identification

RFP Request for Proposals

S&T Science and Technology

UHF Ultra High Frequency

This page is intentionally left blank

DOCUMENT CONTROL DATA (Security classification of title, body of abstract and indexing annotation must be entered when the overall document is classified)

1. ORIGINATOR (The name and address of the organization preparing the document. Organizations for whom the document was prepared, e.g. Centre sponsoring a contractor's report, or tasking agency, are entered in section 8.) Defence R&D Canada – Ottawa 3701 Carling Avenue Ottawa, Ontario K1A 0Z4

2. SECURITY CLASSIFICATION (Overall security classification of the document including special warning terms if applicable.)

UNCLASSIFIED

3. TITLE (The complete document title as indicated on the title page. Its classification should be indicated by the appropriate abbreviation (S, C or U) in parentheses after the title.) A Comparative Performance Measurement and Security Analysis of UHF Passive RFID Tags

4. AUTHORS (last name, followed by initials – ranks, titles, etc. not to be used) Xiao, Q.

5. DATE OF PUBLICATION (Month and year of publication of document.) December 2008

6a. NO. OF PAGES (Total containing information, including Annexes, Appendices, etc.)

46

6b. NO. OF REFS (Total cited in document.)

12 7. DESCRIPTIVE NOTES (The category of the document, e.g. technical report, technical note or memorandum. If appropriate, enter the type of report,

e.g. interim, progress, summary, annual or final. Give the inclusive dates when a specific reporting period is covered.)

Technical Memorandum

8. SPONSORING ACTIVITY (The name of the department project office or laboratory sponsoring the research and development – include address.) Defence R&D Canada – Ottawa 3701 Carling Avenue Ottawa, Ontario K1A 0Z4

9a. PROJECT OR GRANT NO. (If appropriate, the applicable research and development project or grant number under which the document was written. Please specify whether project or grant.)

Pre-Comm: 26439PA001 Ln 03

9b. CONTRACT NO. (If appropriate, the applicable number under which the document was written.)

10a. ORIGINATOR'S DOCUMENT NUMBER (The official document number by which the document is identified by the originating activity. This number must be unique to this document.) DRDC Ottawa TM 2008-253

10b. OTHER DOCUMENT NO(s). (Any other numbers which may be assigned this document either by the originator or by the sponsor.)

11. DOCUMENT AVAILABILITY (Any limitations on further dissemination of the document, other than those imposed by security classification.)

Unlimited

12. DOCUMENT ANNOUNCEMENT (Any limitation to the bibliographic announcement of this document. This will normally correspond to the Document Availability (11). However, where further distribution (beyond the audience specified in (11) is possible, a wider announcement audience may be selected.)) Unlimited

13. ABSTRACT (A brief and factual summary of the document. It may also appear elsewhere in the body of the document itself. It is highly desirable that the abstract of classified documents be unclassified. Each paragraph of the abstract shall begin with an indication of the security classification of the information in the paragraph (unless the document itself is unclassified) represented as (S), (C), (R), or (U). It is not necessary to include here abstracts in both official languages unless the text is bilingual.)

Radio Frequency Identification (RFID) technology has been implemented in various areas suchas transportation, retail sales, supply chain, healthcare and defence. When RFID technology isconsidered for defence applications in particular, it is necessary to test and evaluate thetechnology to determine definitively the tag performance and system security issues. In thisreport, we test and evaluate the readability and security of four ultra-high-frequency (UHF)passive RFID tags, which are all compatible with the Electronic Product Code ™ (EPC) globalGeneration 2 (Gen 2) standard. The tags were tested in free space. The testing establishedbaseline parameters for passive tags, which allow for comparison between different tags and theevaluation of their security features. The objective of this paper is to identify potential technicaland security challenges to the application of RFID technologies in the Canadian Forces (CF)and to suggest potential solutions to these challenges.

La technologie de l’identification par radiofréquence (IRF) a été introduite dans plusieurssecteurs d’activité comme le transport, la vente au détail, la chaîne d’approvisionnement, lessoins de santé et la défense nationale. Quand on entend utiliser cette technologie,particulièrement pour des applications militaires, il faut la mettre à l’essai et l’évaluer afin demesurer précisément la performance des étiquettes et de régler les questions de sécurité dusystème. Le présent rapport porte sur les résultats des tests et de l’évaluation effectués dans lebut de mesurer la lisibilité et le degré de sécurité de quatre étiquettes RFID passives ultra-hautefréquence (UHF), toutes conformes à la norme internationale de l’EPC® (code électronique deproduit) de 2e génération (Gen 2). Les étiquettes ont été mises à l’essai en espace libre, ce quinous a permis de fixer les paramètres de base pour les étiquettes passives de sorte que l’onpuisse désormais comparer différentes étiquettes et évaluer leurs caractéristiques de sécurité. Lebut du présent rapport est de cerner les problèmes techniques et sur le plan de la sécurité quirisquent d’entraver l’introduction de la technologie IRF dans les Forces canadiennes (FC) et deproposer des solutions possibles à ces problèmes.

14. KEYWORDS, DESCRIPTORS or IDENTIFIERS (Technically meaningful terms or short phrases that characterize a document and could be helpful in cataloguing the document. They should be selected so that no security classification is required. Identifiers, such as equipment model designation, trade name, military project code name, geographic location may also be included. If possible keywords should be selected from a published thesaurus, e.g. Thesaurus of Engineering and Scientific Terms (TEST) and that thesaurus identified. If it is not possible to select indexing terms which are Unclassified, the classification of each should be indicated as with the title.) UHF Passive RFID, Performance Measurement, Security Issues

a comparative performance measurement and security ... · passive rfid tags, which are all...

Documents