RFID chips are simple electronic components we frequently encounter in our daily lives, for instance in the shape of anti-theft security tags in shops, electronic ski passes or elements sown into clothing that are removed after having been purchased. RFID chips have also been integrated in passports for a few years now. In essence “passive radio-frequency identification tags”, as the chips are called in technical jargon, are small, paper-thin rudimentary computers which do not have their own power supply but run only on the energy they receive by means of an antenna. Their typical production cost: a few cents. In theory, they can be used to connect objects with the internet, thus creating an “Internet of Things” (IoT). Devices that exchange data with the internet are expected to increase the efficiency and lower the price of future industrial manufacturing, autonomous driving and many other fields. As with other connected objects of everyday use, security is an issue – smart cars whose brakes may be hijacked via WLAN or internet-enabled toys that are not protected against hacking are just a small sample of the challenges lying ahead. A research group at the Institute of Applied Information Processing and Communication at the Graz University of Technology (TU Graz) has now investigated security issues related to an IoT based on RFID in a project supported by the FWF.
RFID for open systems
“The vision of the Internet of Things as we understand it is to enable computers to be aware of their environment”, says Hannes Groß from TU Graz. “You equip the environment with sensors, connect them to computers and use the data for process optimisation.” RFID chips, also called tags, are particularly suitable for this, Groß explains. Existing applications of RFID tags are used for closed systems such as logistics centres or retail stores and do not really constitute an IoT, says Groß. “We want to design an open IoT with RFID tags, and we studied the security solutions required in this context.”
Groß provides several examples for applications where security is a critical issue. One area is authentication, for instance for passports or touchless car keys. An RFID tag that fulfils these tasks needs to be forgery-proof. Privacy is another such area: in this case it is important for the tag to pass on information only to a recipient it trusts.
Similar requirements as for a mobile phone
All of these issues are known from other areas of computer security, and there are cryptographic solutions for them. “From a cryptography point of view, the requirements are similar to those for a mobile phone”, says Groß. The difference resides in the limited processing power of RFID tags. “Since the tags need to make do with so little power, one usually tries to outsource as many functions as possible to the reader.” RFID tags work only in combination with special RFID readers – in shops, for instance, they are installed at the exit, well visible for everyone, and sound an alarm if a tag comes too close. In order to prevent tags from sharing sensitive information with just any reader, including one used by an attacker, they need to have self-protection capabilities. This means the related processing cannot be outsourced. “All cryptographic computations need to be done on the tag, although there is hardly any processing power available on them.”
This has several consequences: “Every security-enhancing measure makes the tag larger and more expensive”, notes Groß. Processing power is another factor. “We can compute cryptographic processes using relatively little power by breaking them down into simple individual steps to make sure the tag computes only a few things at the same time. But this means it needs more time to do it”, says Groß. All of this has a bearing on the everyday practicability of the technology.
A prototype named PIONEER
Groß and his group analysed various common security protocols and studied their use on RFID tags. “We simulated different attack scenarios and looked at defensive measures”, explains Groß. For demonstration purposes they developed an RFID tag prototype called PIONEER which communicates with a server on the internet via a standard protocol for “virtual private networks” (VPNs). The protocol was adapted to ensure it integrates seamlessly into the existing internet infrastructure and, moreover, safeguards the anonymity of the tags. The prototype is equipped with sensors and can send the data it records in an encrypted form.
Groß considers that it will take a while until the device is ready for practical use. That this is indeed an important issue is illustrated by the criticism sometimes levelled against RFID technology which hinges on the tags’ lack of protection with the resultant data security problems. The new solutions ought to remedy this situation.
Personal details
Hannes Groß (https://www.iaik.tugraz.at/content/about_iaik/people/gross_hannes/) is a doctoral student at the Institute of Applied Information Processing and Communication (https://www.iaik.tugraz.at/) at Graz University of Technology (TU Graz). In his research he focuses on RFID security, secure hardware implementation and measures against side channel attacks.
Publications
Hannes Groß, Marko Hölbl, Daniel Slamanig, Raphael Spreitzer: Privacy-Aware Authentication in the Internet of Things (https://online.tugraz.at/tug_online/voe_main2.getvolltext?pCurrPk=86804) – 14th International Conference on Cryptology and Network Security (CANS 2015) 10-12 December 2015, Marrakesh, Morocco.
Hannes Groß, Erich Wenger, Honorio Martín, Michael Hutter: PIONEER – a Prototype for the Internet of Things based on an Extendable EPC Gen2 RFID Tag (https://www.iaik.tugraz.at/content/research/rfid/rit/publications/papers/pioneer.pdf) – Workshop on RFID Security – RFIDsec 2014, 10th Workshop, Oxford, UK, July 21 -23, 2014, Proceedings.
Hannes Groß: Sharing is Caring–On the Protection of Arithmetic Logic Units against Passive Physical Attacks (https://online.tugraz.at/tug_online/voe_main2.getvolltext?pCurrPk=84553) – Workshop on RFID Security – RFIDsec 2015, 11th Workshop, New York, USA, June 22 – 23, 2014, Proceedings.
Peter Peßl, Michael Hutter: Curved Tags – A Low-Resource ECDSA Implementation tailored for RFID (https://www.iaik.tugraz.at/content/research/rfid/rit/publications/papers/curved_tags_ecdsa.pdf) – Workshop on RFID Security – RFIDsec 2014, 10th Workshop, Oxford, UK, July 21 -23, 2014, Proceedings.
Image and text will be available as of Monday, 24th July 2017, from 9.00 am CET at: http://scilog.fwf.ac.at/en
Scientific Contact
Hannes Groß
Graz University of Technology
Inffeldgasse 16a/I
8010 Graz, Austria
T +43 / 316 / 873 – 5530
E hannes.gross@iaik.tugraz.at
W https://www.tugraz.at/en
Austrian Science Fund FWF
Ingrid Ladner
Haus der Forschung
Sensengasse 1
1090 Vienna, Austria
T +43 / 1 / 505 67 40 – 8117
E ingrid.ladner@fwf.ac.at
W http://scilog.fwf.ac.at/en/
W http://www.fwf.ac.at/en
Distribution
PR&D – Public Relations for Research and Education
Mariannengasse 8
1090 Vienna, Austria
T +43 / 1 / 505 70 44
E contact@prd.at
W http://www.prd.at/en
You must be logged in to post a comment Login