“RFID Sikkerhed og Privacy …”

IT-Arkitekturkonferencen

2.-3. April 2008.

Henrik GranauCEO RFIDsec

Member of AIM EMEA Leadership Council

Member of ATA RFID on Parts Team

Participation in EICTA’s RFID Workgroup

Participation in EU’s open consultation on RFID

Member of EPCglobal

Disposition

� RFID og Privacy – problemstillingerne

� EU’s konsultationer

� Standardiseringsarbejdet (og vores krav)

� Innovationen bag RFIDsec

� RFIDsec’s teknologi

� Interesse/awards/anerkendelser

� Fra ”snak” til handling

� Konkrete cases

� Biblioteks-pilotprojekt(er) i Danmark

� Afslutning med oplæg til debat

Danish Product Award 2007

� Juryens udtalelse:

� ”Mærkning af varer med såkaldte RFID-tags vil eksplodere over hele verden inden for kort tid, fordi fordelene er store for producenter, transportører og forhandlere. Det er en global teknologi. Men eksisterende tags kan læses uden sikkerhed, og det kan føre til misbrug. Her kommer danske RFIDsec nu med næste generations løsning, tags med kryptering. Det er flot at en dansk virksomhed på den måde kan være med i forreste række af et globalt gennembrud. Derfor får RFIDsec Danish Product Award’s kategoripris i kategorien it.”

RFID og ”Internet of Things” …

� ”Embedded intelligence in thingsthemselves will distribute processingpower to the edges of the network, offering greater possibilities for data processing and increasing the resilienceof the network. This will also empowerthings and devices at the edges of thenetwork to take independent decisions. “Smart things” are difficult to define, but imply a certain processing power and reaction to external stimuli.”

Source: ITU Internet Reports 2005: The Internet of Things

Consumer concerns

’Consumer concerns’ ved RFID

� En RFID Tag har en fuldstændig entydig ID

� En RFID Tag svarer med sin ID til en hvilken som helst RFID reader

� En RFID Tag kan være så lille at den ikke er synlig for forbrugeren

� Forbrugeren kan ikke registrere at RFID Tag’ens ID aflæses

� Er et produkts RFID Tag’s ID først en gang blevet knyttet til en person (eks. i tøj) kan personen identificeres indirekte (“Spy Chips”)

� Kommunikationen imellem RFID Tag og reader kan aflyttes

� Kommunikationen imellem RFID Tag og reader kan optages oggenafspilles

� Kommunikationen imellem RFID Tag og reader kan manipuleres (“man in the middle attack”)

� En RFID Tag kan relativt let kopieres

� Eventuelle data på en RFID Tag kan læses af andre

� Eventuelle data på en RFID Tag kan overskrives af andre

Effektivisering af overfald

“Just in case you

want to know, she’s

got 700 Euro and

a Rolex…”

Nye muligheder med RFID

Stephan J. Engberg

RFIDsec

� RFIDsec founded 2005

� Based upon unique Danish innovation 1999 - 2004

� Scientific Paper on RFID October 2004

� Peer Reviewed November 2004

� First Concepts launched June 2006

� First products launched September 2007

EU Consultation 2006-2007

The Commission concluded from the initial analysis of public consultation results that:

� It is necessary to develop an effective set of European rules, based on transparency and choice, to support the development of RFID;

� Particular effort needs to be invested in explaining the risks and benefits of RFID to the general public;

� The issue of privacy needs to be seriously addressed, in particular through ongoing research into privacy enhancing technologies.

Commissioner Reding also highlighted the need to act on a global scale and renewed her commitment to strengthening international dialogue on RFID.

© European Communities 2006Reproduction is authorised provided the source is acknowledged.The views expressed are not an official position of the European Commission

The Commission initiated a new public consultation:

� ”RFID tags are far cleverer than traditional barcodes. They have the potential to link everyday objects into an ’Internet of Things’that greatly enhance economic prosperity and the quality of life. But as with any breakthrough, there is a possible downside – in this case, the implications of RFID for privacy. This is why we need to build a society-wide consensus on the future of RFID, and the need for credible safeguards. Privacy is at the heart ofour European model of society. RFID will therefore only become successful if they do not call into question the capability of every consumer to control the use of his or her personal data. I expect the Industry to assume its responsibilities.”

Commissioner Viviane Reding, Brussels, 5 March 2008.

© European Communities 2008Reproduction is authorised provided the source is acknowledged.

EU Consultation 2008

Summary of Business Requirements

� Prevent unauthorised access to RFID� Access Control functionality on the RFID itself

� RFID only answers to authorised requests

� Differentiated access to data on the RFID� Memory to be structured in areas with individual access rights

� Differentiate on read-only, write, delete etc.

� Communication between Reader and RFID should be unique for each transaction, to prevent eavesdropping, record & replay etc.

� Prevent RFID’s from being cloneable

RFIDsec input on ICTSB Seminar on RFID standardization 24. October 2007.

Standardization ?

� Is there a need for standardization on enhanced RFID Security & Privacy ?

� If, then when is the right timing ?

� And if, then please keep standardization on a ”semantic level”, to open up for diversification and especially to open up for new innovation !

RFIDsec input on ICTSB Seminar on RFID standardization 24. October 2007.

RFID on Airplane parts

� RFIDsec is member of Air Transportation Association e-business program ”RFID on Parts”, by invitation from Boeing

� RFID’s to be used in the usual manner in Supply Chain

� RFID’s to be ’deactivated’ when the drug is leaving the Pharmacy

� RFID’s can not be read in ’Public space’

� RFID’s to be ’reactivated’ when ready for consumption (Home medication, Hospitals)

RFID on Pharmaceuticals

The RFIDsec world…

Ownership / Access ManagementDifferentiated access / context specific information

Protection: Threats/Vulnerabilities-Counterfeit

-Theft

Logistics

-Authentication-Tracing-Tracking

After Sales

-Warranty-Home Medication

-Resell-Recall-CRM

POINT

OF

SALE

ConsumerSpace

RFID – extending the scope

� Primary focus for RFID has been replacement of barcodes

� Driven by retail concentrating on Supply Chain Management (SCM) and Logistics

� What’s in it for the Product Manufacturer ?

� What’s in it for the End Customer ?

� Change focus from just SCM to full Product Life Cycle

� Add values for both Product Manufacturers and End Customers

Remove the barriers

� By solving the fundamental security issues with RFID technology, we can

� Extend the use of RFID in Supply Chain

� Create business value for the Product manufacturers

� Make it easy to detect counterfeit products

� Build trust to open up for post-sales advantages:

� Recall of products to the point of consumption

� Warranty

� Asset Management

� Lost & Found

� Product usability

� Intelligent products

Next Generation / “RFID 2.0”

DumbTags

Average $ Value per Tag

Dumb Tags+ Tracking

Dumb Tags+ Tracking + e Pedigree S/W

Smart Tag+ Secure Data Access+ Tracking+ e Pedigree S/W

RFID Tag Evolution

IntelligentProducts

RFID 1.0

� Intelligent barcode

� Static

� Single purpose

� One Access Point

� Auto ID

� Limited security

� Use in Supply Chain

RFID 2.0

� RFID as a computer

� Dynamic

� Context aware

� Multiple Access Points

� Collaborative usage

� Rich security

� Use in full Product Life Cycle

From ”RFID 1.0” to ”RFID 2.0”

RFID 2.0 Article

Privacy Mode

� ”If RFID tags are to be active after Point-Of-Sale (in Consumer Space), there has to be a complete transfer of ownership to the consumer to guarantee that RFID tags can never be used as unwanted tracking devices”(Stephan Engberg, Priway) ;

� The tag must be set into Secure Mode

� All unique identifiers must be deleted from the tag

� The ”Owner key” must be transfered to the new owner

� This is ’Privacy Mode’ and if these requirements cannot be met, the tags will have to be killed at Point-Of-Sale

Traditional consumer goods

ProductManufacturer

ProductWholesales

ProductRetail Sales

ProductConsumer

RFID Tag is in Public Mode using the EPCor similar as a unique product identifier

RFID Tag is in Secure Modewith no unique product identifier

Set RFID tag into ’Privacy Mode’:• Call back to Product Manufacturer using URL from the RFID tag• Use a service the Product Manufacturer has set up on the web to set tags into Privacy Mode• Have the key transfered to the Product consumer via PDA, Mobile, paper or other• The new owner can see all keys on the RFID tag

Tag-ID Product-ID

123456 Prod-1

234567 Prod-2

345678 Prod-3

456789 Prod-4

567890 Prod-5

678901 Prod-6

789012 Prod-7

ProductManufacturer

(PM)

Auth CheckServer

Reader/TagLocation

(POS)

Setting the RFID into Privacy Mode

Key Memory

Auth-Key Prod ID

Owner Key PM URL

Key Memory

Owner Key PM URL

Step-1: Access PMService via URL

Auth-Key Tag-ID

1q2w3e4 123456

2w3e4r5 234567

3e4r5t6 345678

4r5t6y7 456789

5t6y7u8 567890

6y7u8i9 678901

7u8i9o0 789012

Step-2: Delete Prod IDfrom RFID tag

Step-3: Transfer Owner keyto Consumer

When in Privacy Mode

� The RFID tag will only answer to authorised requests

� The Owner (the consumer) can use the Owner key to access the RFID tag

� Read/Write/Update/Delete information

� The Owner can add new keys which tell nothing about the product

� The Owner can allow others to access the RFID via keys

� Even with a key, it would not be possible to recognize a certain RFID, hence unwanted tracking is avoided

Benefits for everyone

� Product Manufacturer can get information from POS

� Even with sophisticated technology a counterfeiter can not make a clone

� Retailer can let the RFID tag be alive after POS

� The End Customer can have RFID based post-sales services

The Press’ opinion

RFID Journal Editorial;

� The most attractive security solution to hit the market so far, in my view, comes from the Danish Company RFIDsec. This solution gives control of a tag to the consumer, who would essentially have to give someone permission to read the tag for after-sales support, returns or other business applications.

RFID Gazette;

� In the backdrop of hectic debate on the privacy concerns of RFID technology, RFIDsec's RFID tags are likely to reduce the skepticism of theusers.

The Press’ opinion

RFID Update;

� “…RFIDsec headquartered in Copenhagen, which has developed an RFID tag-software system that employs a number of techniques to protect privacy without handicapping valuable functionality.Rather than "killing" a tag forever, the RFIDsec solution "silences" it so that it can be reawakened later by an authorized party.

RFID Journal;

� Danish RFID startup RFIDsec announced that its first RFID tags will be available in commercial quantities in the first half of 2007. These tags were designed specifically to protect consumer privacy.

…and the rest

EU Consultation 2006-2007

The Commission concluded from the initial analysis of public consultation results that:

� It is necessary to develop an effective set of European rules, based on transparency and choice, to support the development of RFID;

� Particular effort needs to be invested in explaining the risks and benefits of RFID to the general public;

� The issue of privacy needs to be seriously addressed, in particular through ongoing research into privacy enhancing technologies.

Commissioner Reding also highlighted the need to act on a global scale and renewed her commitment to strengthening international dialogue on RFID.

© European Communities 2006Reproduction is authorised provided the source is acknowledged.The views expressed are not an official position of the European Commission

Fra ”snak” til handling

� Pilot-projekter:

� Carl Hansen (møbler)

� DGM (Farligt gods)

� TagVision (Biblioteker)

� Reusable Containers

� Flyindustrien

� Asset Management

� Militæret

� Pharma

� ”Consumer Privacy” sammen med Priway

Carl Hansen

Dangerous Goods

� RFIDsec Partner DGM-SS using RFIDsec secure tags for Dangerous Goods Management

Dangerous Goods

TagVision (Biblioteker)

� Using RFIDsec secure tags for libraries

Primær årsag: at RFID Tags kan tie stille når de er uden for biblioteket!

Første Pilot-projektmed RFIDsec’ssikre RFID tagsstarter i maj på etkommunalt biblioteki Jylland.

I juni-august følgesdette op med ind-førelse i en rækkeandre kommunalebiblioteker i Danmark.

Privacy Enhancing Technologies

� Teknologien skal være designet således at brugeren af teknologien er i fuld kontrol over information

� Dette har ikke tidligere været et væsentligt design-kriterie

� Hvis brugere generelt fortsætter med ’at leve med generne’ kommer vi ikke videre!

� RFIDsec er en privat finansieret virksomhed, der uden offentlig støtte, har investeret et betydeligt beløb i at vise at det kan lade sig gøre ....

More information ....

� Teknologirådet 2006:

� http://www.tekno.dk/pdf/projekter/p04_RFID.pdf

� EU’s konsultation 2006/2007:

� http://www.rfidconsultation.eu/

� Dansk Industri /ITEK:

� http://itek.di.dk/Viden+om/IT/RFID/

� RFIDsec’s Scientific Paper:

� http://www.rfidsec.dk/docs/PST2004_RFID_ed.pdf

� European Standardization (CEN) seminar 2007:

� http://portal.etsi.org/docbox/Partners/ICTSB_Open/RFID/ICTSB_RFID_seminar_2007-10-24/ .

� RFIDsec’s ”Next Generation RFID / RFID 2.0”:

� http://www.rfidsec.dk/docs/RFID%202.0%20article%2012-11-2007.pdf

Thank You

� Questions ?

RFIDsec

Rued Langgaardsvej 7, 5te

DK-2300 S Copenhagen

Telephone: +45 39169444

E-mail: info@rfidsec.com

Web: www.rfidsec.com