Solving the RFID Dilemma |
 |
By Neil Roiter, senior technology editor, Information Security magazine
20 Nov 2007 | SearchSecurity.com |
|
|
Three University of Massachusetts at Amherst researchers have found the key to packing stronger security into those little RFID chips that are starting to find their way onto credit cards and tags on shipping containers and retail items.
|
|
|
|
|
Chips are logically the same, but there are physical variations.
Dan Holcomb
researcher, University of Massachusetts
|
|
|
|
|
|
|
|
|
|
From email to Internet commerce to WiFi, it's axiomatic that criminals will exploit new business technologies once adoption reaches some critical mass that assures high profits with minimal rewards--risk-reward for the bad guys. It's a good bet that then, and only then, will businesses start thinking about investing in securing that new technology--risk reward for the good guys.
RFID apparently hasn't reached that critical mass yet, but it can't be far off with champions like Best Buy, and Wal-Mart, whose suppliers, such as Proctor & Gamble, are falling into lock step with the retail behemoth's requirements for adoption.
Though we haven't seen RFID-based theft or fraud yet, researchers have demonstrated that RFID tags can be spoofed or counterfeited, and customer data, such as credit card numbers, stolen. Businesses seem satisfied with the Electronic Product Code (EPC) Generation 2 (Gen2) RFID specification, but security advocates are pushing for a Gen 3 specification that might include strong encryption and authentication--before RFID becomes ubiquitous.
|
| Podcast: RFID security |
Security researcher Adam Laurie warns of weaknesses in radio frequency identification technology (RFID). The researcher explains how easy it is to copy an RFID tag. Also a look at the week's news.
>>>Download RFID weaknesses MP3 |
|
|
|
|
In addition to businesses' reticence, there are technological challenges, not the least of which is the very limited computing power packed into those little RFID chips' --they are built for efficient inventory control and tracking, not resource-intensive security. The UMass researchers, Wayne Burleson, Kevin Fu and Dan Holcomb, have found a way to use the chips' embedded memory to generate random numbers for encryption and authentication.
"Chips are logically the same, but there are physical variations," said Holcomb, now pursing his doctorate at the University of California at Berkeley. "The promise is you get a physical fingerprint of the chip."
The research, "Initial SRAM State as a Fingerprint and Source of True Random Numbers for RFID Tags," (www.rfid-cusp.org/publication.html) is part of an initiative by the RFID Consortium for Security and Privacy, operating under a $1.1 million National Science Foundation grant. The premise is that RFID chips are dormant until the transmission receiver activates them and the memory cells fluctuate between binary states before settling on a value ("01" or "10"), which, the researchers say, can be used to generate a unique "fingerprint" and random numbers.
An expanded research initiative will address issues--effects of temperature, noise and data retention--that must be overcome before the initial findings can be translated into a viable technology.
"It helps to solve problems, especially cloning and spoofing," said Holcomb. "You get true randomness, which is typically expensive because you need a random-number generator, without a lot of cost--it comes free with the SRAM."
|
|
|
|
