Essay in the course TTM4137 Wireless Network Security at NTNU. Chosen as curriculum in the course.
Radio-frequency identification (RFID) technology uses radio frequency signals to automatically identify objects. RFID tags are gradually being included into most objects on Earth — from library books to passports to animals and all other things imaginable. An RFID tag is a small wireless device that reacts to electromagnetic fields generated by an RFID reader2. RFID technology is one of the most promising technologies in the scope of ubiquitous computing1, and for every information technology being deployed in such great numbers, security is essential.
In this essay I will try to identify security threats and see how they can be guarded against.
RFID is a system for no-contact, non-line-of-sight and invisible identification3, and is comprised of three main components8:
There are basically three types of RFID tags13: active, semi-passive and passive. The difference is that active tags have an on-tag power supply and actively send RF signals, while passive tags receive the power from an RFID reader. The semi-passive tag has both an on-tag power supply and rely on power from a reader.
A passive RFID tag has a short communication range, a very small memory footprint — typically just hundreds of bits — and very limited computational power. With these very limited resources it is difficult to implement strong cryptographic functions3.
The primary focus of this essay is the RFID tag itself, and not the entire system. I will focus on passive RFID tags since they are the most limited tags, and because both semi-passive and active tags can handle far more resource intensive security protocols.
The Internet Security Glossary defines a security threat as “A potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm.”4
To get a grasp of the security threats in RFID I will use the STRIDE threat model developed by Microsoft5. STRIDE includes the following six categories of threats:
Categorizing security threats with STRIDE identifies potential strategies for mitigating them9.
An example of a spoofing attack is when an attacker masquerades as a legitimate tag. To guard against the threat of spoofing, authentication is needed. There exists several strong authentication protocols, such as EAP and Kerberos, but as mentioned the problem with RFID tags, and especially passive tags, is that they are very resource limited. This severely limits the set of possible authentication protocols that can be used.
According to Peris-Lopez et al. a passive RFID tag roughly has between 5000 and 10000 logic gates1. 250 to 3000 of these gates are available for security measures. A typical implementation of AES needs in the order of 20000 logic gates. Lightweight authentication protocols specifically created for, or adapted to, RFID have been introduced by several authors6,7.
Tampering with data can for example occur when an attacker is able to modify the tag in a passport to remove unwanted information. There are two kinds of protection against tampering10: tamper-evidence, in which the system detects tampering, and tamper-resistance, in which the system is able to resist tampering.
In Electronic Product Codes (EPC), which are based on passive RFID tags, a 32 bit PIN is needed to get access to the internal memory of the tag11. Because of the difficulty of tampering with transmitted data and the length of the PIN needed, Garcia-Alfaro et al. classify integrity threats as unlikely11 (but as a side-note, they don’t seem to have considered the fact that this approach is vulnerable to eavesdropping). Gandino et al. examines the most recent studies of tampering in RFID, and notes that data tampering is still in 2009 a critical threat in RFID based systems10.
A repudiation is, for example, when a retailer denies receiving a certain pallet. To ensure that neither sender nor receiver can deny an action, a non-repudiation protocol is required3.
Mitigation techniques for repudiation include digital signatures, timestamps and audit trails9, but this is a challenge because of the limited computational power of RFID tags. The tag itself does not have enough memory to save an audit trail, so this must be done externally. This puts a much higher demand on the data processing subsystem.
An information disclosure attack is, for example, when a thief queries tags carried by potential victims to determine what they have in their bags. To guard against this, it should not be possible for the thief to determine the object he is trying to identify. Authentication will make it significantly more difficult to determine the identity, but it is still possible to track the specific tag, since it always will have the same identification. For example a thief queries a tag on an expensive watch in a store, and thereby learns its unique identificator. He then waits outside the shop, querying all the tags that pass. When someone buys the watch, the thief will know who. To remedy this Good et al. suggest that RFID tags should be relabeled on checkout14. Juels names other possible solutions, including killing the RFID tag or rotating between a collection of pseudonyms to identify it13.
Since RFID if based on radio communication, an example of a denial of service attack is to shield a tag with a Faraday Cage, and thereby make it unreadable. Another possibility is to send radio signals that collide with legitimate RFID signals, making it impossible for the reader to communicate with the tag. Since all wireless devices are subject to radio jamming, this is not an issue that is specific to RFID 14. Sarma et al. suggest a method requiring physical contact for critical functionality, which will help defend against denial of service attacks8.
Since RFID is such a limited system, most passive tags only have two types of access: no access and access to everything, i.e. two states: locked and unlocked. A tag only enters the unlocked state when it receives an appropriate command. Privilege elevation means putting a tag into the unlocked state. The success of this attack is dependent on the choice of anti-tampering approaches10. The privilege elevation threat is far more important when considering the entire RFID system.
By using the STRIDE model, we have been able to get a better understanding of the security of passive RFID tags, and identified several major and critical security threats there. According to Rathinasabapathy and Rajendran a major challenge with RFID is the immaturity of the industry, and that the standards are being developed while RFID is being globally deployed12.
RFID is already widely used, and will be globally deployed into more and more areas of life in the coming years. It is therefore important to know that there are security threats related to the use of RFID, and that many of them are major.