1. Mobile RFID Service and Its Security in Korea 17 Nov. 2005 Keon Woo Kim

2. Proprietary::: ETRI, The Future Wave ::: 1 Contents 1.Introduction to mobile RFID 2.Mobile RFID Forum in Korea and security issues 3.Mobile RFID service 4.Mobile RFID system with Privacy 5.Mobile RFID terminal platform

3. Proprietary::: ETRI, The Future Wave ::: 2 Introduction about mobile RFID service NFC(Near Field Communication) 13.56MHz Nokia, Philips, Sony, etc.. Mobile RFID in Korea Mobile RFID forum –http://www.mrf.or.kr –Starts at 03 Feb. 2005 –6 forum division Cooperating with TTA –http://www.tta.or.kr/English/new/main/index.htm One infra structure of IT 839 Interworking of 900MHz RFID system and mobile network RFID reader is built in mobile phone (Portable reader)

4. Proprietary::: ETRI, The Future Wave ::: 3 Mobile RFID Forum in Korea Terminal division H/W interface such as RFID tag chip and reader chip Air interface between mobile phone and reader RFID – WIPI HAL extension Network division Communication interface between tag and reader RFID – WIPI Middleware Message transport protocol RFID data storage

5. Proprietary::: ETRI, The Future Wave ::: 4 Mobile RFID Forum in Korea Application division Mobile RFID service presentation & profile Air interface between mobile phone and reader Mobile RFID service User Profile Interworking for RFID mobile phone location tracking PML DTD for mobile RFID service Security division Privacy protection RFID data protection Authentication protocol between tag and reader

6. Proprietary::: ETRI, The Future Wave ::: 5 Mobile RFID Forum in Korea Main issues in security division Mobile RFID security requirement –Security framework and security requirement for mobile RFID service Mobile RFID service terminal security –Security extension of terminal for security service such as authentication/key management/transport protection Mobile RFID middleware security –Middleware security framework and security protocol Mobile RFID key management –Key transport for tag access control Privacy protection issue

7. Proprietary::: ETRI, The Future Wave ::: 6 Mobile RFID Forum in Korea Standard item about Security Mobile RFID privacy guideline –To provide the solution to limit the connection with personal information in RFID tags and product information. –To perform the Privacy Impact Assessment and validate adult grade before providing mobile RFID services Security Requirements for Mobile RFID Services –Classification of mobile RFID services and –Defines security and privacy considerations –Fundamental security requirements of mobile RFID service network according to the defined security and privacy considerations.

8. Proprietary::: ETRI, The Future Wave ::: 7 Mobile RFID Forum in Korea Standard item about Security WIPI Security APIs for Mobile RFID Services –RFID security API for mobile RFID application to guarantee the security for RFID services WIPI Platform Security Model for Mobile RFID Services Adult certification for mobile RFID service –When mobile RFID service provides adult contents, RFID tag gives adult grade stored in RFID user memory area –Mobile RFID reader decides to grant service to user according to adult grade

9. Proprietary::: ETRI, The Future Wave ::: 8 Mobile RFID Forum in Korea Test division Test/validation Inter-operability test Planning division Policy, IPR management International standardization

10. Proprietary::: ETRI, The Future Wave ::: 9 Mobile RFID service terminal network application privacy Mobile RFID Terminal security - Requirement for Security framework - Security extension for terminal service Mobile RFID Service infra security - mobile RFID security middleware - mobile RFID privacy framework Secure middleware WIPI based

11. Proprietary::: ETRI, The Future Wave ::: 10 Privacy problem in mobile RFID service When does privacy problem happen? When a man obtains goods attached tag When a personal information(name/ID/mobile number) is connected to a tag information(Object information) What is privacy information provided in mobile RFID environment? According to privacy policy and profile

12. Proprietary::: ETRI, The Future Wave ::: 11 Mobile RFID Architecture with Privacy System Mobile phone RFID Reader ODS OTS OIS A Middleware mRFID Application RFID Service Network Mobile Network Root ODS Local ODS RFID User Privacy Service mRFID Privacy System OIS B RFID Middleware

13. Proprietary::: ETRI, The Future Wave ::: 12 One scenario for privacy protection After buying, access by another man not owner information 1. 2. No.659, Black Color \188,000 1. 2. Screen by Privacy Policy DVD 6,900 \ Privacy policy and protection by mRFID Privacy System Top Privacy Level No Privacy Level 1. 2. No.659, Black Color \188,000 1. 2. No.659, Black Color \188,000 2. Medium Privacy Level 1. 2. No.659, Black Color \188,000 1. 2. No.659, Black Color \188,000 Not accessible

14. Proprietary::: ETRI, The Future Wave ::: 13 Privacy Profile Privacy profile for each service Privacy preference profile Schema by service provider Privacy profile for commercial transaction OII information (P1) : EPC code Personal information (P5) Goods information (P3) Manufacture information(P2) Distribution information (P2) Payment information (P4) Privacy profile for commercial transaction OII information (P1) : EPC code Personal information (P5) Goods information (P3) Manufacture information(P2) Distribution information (P2) Payment information (P4) Privacy profile for medical service OII information (P1) : Tag Identifier Personal information (P5) Medical care insurance number (P4) Illness history information (P5) Cure information (P4) Payment information (P3) Privacy profile for medical service OII information (P1) : Tag Identifier Personal information (P5) Medical care insurance number (P4) Illness history information (P5) Cure information (P4) Payment information (P3)

15. Proprietary::: ETRI, The Future Wave ::: 14 Mobile RFID terminal platform Mobile RFID terminal Supports RFID application in the WIPI based platform with RFID reader mRFID security on WIPI architecture Whats WIPI? –Wireless Internet Platform for Interoperability WIPI Handset Hardware HAL (Handset Application Layer) HAL (Handset Application Layer) WIPI Run Time Engine WIPI Crypto Library Basic WIPI Spec APIs WIPI Application Manager WIPI Application Manager CletJletMIDlet WIPI Application Contents WIPI-C/Java, J2ME WIPI-C/Java, J2ME Handset Basic Software (Native System Software) RFID Device Handler RFID Engine RFID C/JAVA API RFID C/JAVA API RFID Security API RFID Security API Mobile RFID Application

16. Proprietary::: ETRI, The Future Wave ::: 15 Mobile RFID security service technology RFID RFID Mobile RFID secure Reader and RFID middleware CDMA / LAN RFID secure M/W - data filterig/logger - System monitering - Server authentication - Access control - Security log-in Security Reader platform based on WIPI RFID security server - Secure communication - Message/tag authentication - Monetering, security policy - XML security mobile RFID Application service RFID Reader RFID Privacy service IBSApplication G/W

17. Proprietary::: ETRI, The Future Wave ::: 16 Thank You !! wootopian@etri.re.kr