Categorizing RFID Privacy Threats with STRIDE

IEEE Pervasive Computing, 2000

— This article surveys recent technical research on the problems of privacy and security for RFID (Radio Frequency IDentification). RFID tags are small, wireless devices that help identify objects and people. Thanks to dropping cost, they are likely to proliferate into the billions in the next several years – and eventually into the trillions. RFID tags track objects in supply chains, and are working their way into the pockets, belongings and even the bodies of consumers. This survey examines approaches proposed by scientists for privacy protection and integrity assurance in RFID systems, and treats the social and technical context of their work. While geared toward the non-specialist, the survey may also serve as a reference for specialist readers. A condensed version of this survey will appear in the IEEE Journal on Selected Areas in Communication (J-SAC) in 2006.

In Asiacrypt 2007, Vaudenay proposed a formal model addressing privacy in RFID, which separated privacy into eight classes. One important conclusion in the paper is the impossibility of achieving strong privacy in RFID. He also left an open question whether forward privacy without PKC is possible. In our paper, first we revisit the eight RFID privacy classes and simplify them into three classes that will address the same goal. Second, we show that strong privacy in RFID is achievable. Third, we answer the open question by pointing out the possibility to achieve forward privacy without PKC both within Vaudenay's model and in practice.

2006 Fortieth Asilomar Conference on Signals, Systems and Computers, 2006

RFID Eurasia, 2007 1st Annual, 2007

There is no doubt that managing the flow of goods depends on monitoring the real flow in the physical world meanwhile in the digital world. Today automatic identification (auto-ID) technologies are used to close the gap between these two different environments by online updating of ...

2007

As Radio Frequency Identification (RFID) technology becomes pervasive in our lives, literally woven into the fabric of our society, there exists the danger to personal privacy, loss of anonymity, and violation of location privacy to all individuals. Even cash, which offers true anonymity for consumers, may be threatened by RFID technology.

Lecture Notes in Computer Science, 2012

RFID-based path authentication enables supply chain managers to verify the exact path that a tag has taken. In this paper, we introduce a new oracle Move that models a tag's movement along a designed or an arbitrary path in a supply chain. With this oracle, we refine the existing security and privacy notions for RFID-based path authentication. In addition, we propose a new privacy notion, called path privacy, for RFID-based path authentication. Our privacy notion captures the privacy of both tag identity and path information in a single game. Compared to existing two-game based privacy notions, it is more rigorous, powerful, and concise. We also construct a new path authentication scheme. Our scheme does not require the entities in a supply chain to have any connection with each other except in the initial stage. It requires only 480 bits storage and no computational ability on each tag; thus it can be deployed on the standard EPCglobal Class 1 Generation 2 tags in the market.

Lecture Notes in Computer Science

This paper introduces shortly into the security and privacy issues of RFID systems and presents a simple approach to greatly enhance location privacy by changing traceable identifiers securely on every read attempt. The scheme gets by with only a single, unreliable message exchange. By employing one-way hash functions the scheme is safe from many security threats. It is intended for use in item identification but is useful in other applications as well.

… HIIT, Helsinki University of Technology and …, 2007

Applications, Technology, Security, and Privacy, 2008