1. Ubiquitous Computing Through Mass Adoption of RFID
RFID Network Privacy & Security
Trevor Peirce
ETSI Workshop on RFID and The Internet Of Things, 3rd and 4th December 2007

2. Introduction - Setting the Scene
RFID Networks comprise of:
The networking of RFID events is in it’s infancy. Action now to develop an ethical foundation for the development of RFID networks will multiple the efficiencies available to individuals, organizations large and small while addressing fears over security and respecting established privacy rights
Not all RFIDs are the same. Active is very different from passive and HF from UHF. It is essential to address miss perceptions in driving towards a consensus position
ORGANIZATION
/ INDIVIDUAL
IDs/Data
TAGS
READERS
PREMISES
ORGANIZATION / INDIVIDUAL
1; Me
1.1; My family
2; You
3; Apple
Etc.
At each exchange interface different
data characteristics , values & challenges
RFID and The Internet Of Things, ETSI, December 2007

3. What are we building towards?
Defining reference objectives to measure our progress e.g. A progressive society which:
Encourages economic & social development
Offers equal opportunities
Is safe & trusted
Respects freedom & cultural differences, ……
Clarify and structure the discussion domain
Government / Enterprise / Individual
Direct and associated identification
Data association
And the inter relationships & x-overs
Delay technology or standards until some goals are set
Not exclusive to RFID or RFID Networks but this is already sufficiently broad enough scope
RFID and The Internet Of Things, ETSI, December 2007

4. RFID and The Internet Of Things, ETSI, December 2007
Security
Never about solving a problem 100%: Not always about raising the bar
Associated risks change over time
Scenarios change the nature of problems
Value of Fortresses approach diminishing
Restrict economic development
Provides targets for attack
Can lead to over confidence & when breached no confidence
Costly to maintain
Incompatible with globalization
Mass adoption offers many opportunities to raise levels of security & privacy
RFID and The Internet Of Things, ETSI, December 2007

5. Privacy – Example Checklist
Building confidence
Can I trust that I am protected?
Real and Effective Choice
Can I choose to use the RFID technology I own?
Can I control the access of others to the technology I own?
Visibility
How can I know when RFID is in use?
Convenience
That it provides a positive experience for consumers
Protection
Can I determine when I am threatened & take action when I am?
RFID Enabled Security
Is my RFID an effective deterrent or offer me protection from crime risks?
Safe
Readers must not threaten health, particularly at risk are employees
RFID and The Internet Of Things, ETSI, December 2007

6. RFID and The Internet Of Things, ETSI, December 2007
Opportunities
Knowledge and innovation – engines of sustainable growth. RFID Consumer Purchased Items & Item packaging = An opportunity for SMEs & individuals to gain low cost access to RFID benefits:
Widely accessible
Providing consumer choice e.g. I know RFID is in this label & I can remove it?
Offering consumers convenience e.g. Reduced lost time
Providing the foundation for innovation
Monitorable by the majority of the public = lower cost & effective policing of RFID use
RFID Networks
Build upon established platforms where appropriate e.g. EDI, Internet to broaden access & promote information exchange
Avoid over zealous defenses & associated costs
RFID and The Internet Of Things, ETSI, December 2007

7. Weakness of RFID & RFID Networks
RFID tags & readers
Performance in supply chain applications e.g. Read rates, read reliability, etc..
Actual & perceived RFID infrastructure costs!! (equiv. to complexity)
Tags & reader exposure
Lack of protection from Privacy Intrusive Technologies (PITs)
Over emphasis or expectations upon the reliability of RFID data/events
Poor knowledge of RFID & inconsistent presentation
The challenges of serialized data
Reliance upon RFID generated data/events proportional to:
Criticality: Higher the importance = Lower the reliance
Control over creation, processing & communication
Raise general awareness that single trusted sources can be dangerous e.g. Fabricated events; False events from trusted readers, etc..
RFID and The Internet Of Things, ETSI, December 2007

8. Threats to RFID & RFID Networks
Peoples’ perceptions
Loss of control over private world
Appropriate use across different application domains poorly defined & communicated
Lack of legislation to protect against attack:
Legislation can be a positive contributor to RFID deployment – creating an environment of economic advantage through
Public trust through defined accountability
Protection of RFID’s legitimate use
Defining a level of reasonable responsible care (governments, companies, individuals, etc.)
Overly restrictive security or privacy
Too little OR Too much
Successful security often means adaptive controls, diverse range of counter measures, close monitoring/surveillance and access to new ideas
RFID and The Internet Of Things, ETSI, December 2007

9. Threats to RFID & RFID Networks
Poor knowledge of RFID not assisted by inconsistent presentation
UHF long read range and incompatibility with item level identification of consumer goods/services
Risk
Likeliness of less risks
Likeliness of more risks
Eavesdropping
HF Induction
UHF Radio waves
Covert tracking
Radio noise interference
Jamming
Extract from TACD Presentation by OECD, 2007
Many half truths which require broad expert radio knowledge & experience
RFID and The Internet Of Things, ETSI, December 2007

10. RFID and The Internet Of Things, ETSI, December 2007
Closing Observations
Current RFID privacy and/or security projects appear to lack:
Continuity of broad interest group engagement
Cross project co-ordination
Are PETs being developed with a clear reference to their:
Ethical value?
Contribution to building consumer / individual confidence?
Why is there poor penetration of PETs in most RFID adoptions?
What is being done to ensure that proposed PETs build consumer confidence?
Has consumer convenience been overlooked?
Are the proposals aligned with social inclusion?
How do PETs fit with non technology contributions?
RFID and The Internet Of Things, ETSI, December 2007

11. RFID and The Internet Of Things, ETSI, December 2007
Closing Summary
RFID Network Privacy, Security & Consumer Confidence – underpin the future success of RFID & the speed of RFID adoption
Challenges are multi-dimensional
The identification numbers & their allocation
The tag-2-reader air interface protocol
Frequency selections
The RFID Network interfaces
The applications & their implementations
Network processing & storage capacity
Cost
Communication & participation
Compliance & monitoring of use
Suitable & progressive legislative reference
RFID and The Internet Of Things, ETSI, December 2007

12. RFID and The Internet Of Things, ETSI, December 2007
Recommendation
ETSI’s has proven capability generating Internationally implemented standards across the areas restraining rapid, widespread RFID adoption
Legal and regulatory
Security modelling
Technology Convergence
Networks
Collaboration with multiple standards & regulatory organizations
Radio Spectrum
Allocations
Testing proposals to resolve conflicts, improve performance & promote efficient use
Conformance & Performance testing
RFID and The Internet Of Things, ETSI, December 2007