MSc Computer System Security RFID - Essay Example

What is RFID? Radio Frequency Identification (RFID) is a technology to recognize objects. This technology is for eternity ified as a technology similar to Automatic Identification and Data Capture (AIDC). AIDC consists of Barcodes, Biometrics and Smartcards. Apparently, RFID and Barcodes technologies are considered as one of the key drivers in supply chain management operations to categorize objects or merchandize at various workflow stages. In the intervening time, Biometric and Smartcard technologies are employed for access control procedures, banking and communication industry. The prime advantage of RFID technology is its ease of use and minimalism. RFID replaces barcodes and is a time saving, effective and reliable alternative. That is the reason why it is adopted and deployed in multipurpose applications i.e. Supply Chain Management (SCM), Inventory Tracking, Theft Protection, Location based Services, Electronic Health Monitoring for health care systems, RFID integrated travel documents, payment systems and context-aware applications. In recent years, this technology is flourishing robustly due to its extensive usability in upcoming technologies i.e. Ubiquitous Computing, Pervasive Computing or Ambient Intelligence Solutions. RFID technology comprises of transmitters spreading electromagnetic technology in the environment to send and receive signals. The communication is conducted between two elements, transceiver and transponder. 2. Radio Frequency James Clerk formulated its principles in 19th Century [9]. The radio waves propagation is emitted the form of electromagnetic waves and promulgate in speed of light. The applications of radio waves consist of Radar systems, Fixed Mobile and Satellite Communication, Media Broadcasting and Computer Networks. Radio waves can utilize different band of frequencies measured in Hertz (Hz) which represents the natural process of oscillation in waves. RFID technology utilizes Low Frequency (LF), High Frequency (HF) and Ultra High Frequency (UHF) from the electromagnetic spectrum. Light waves have certain limitations when passing through objects. On the other hand radio waves travel through solid objects and opaque materials. The range of radio frequency waves which is currently used illustrates the following ranges; 30 KHz and 30 GHz [9]. Table 1 from [9] defines the bands in the electromagnetic spectrum. 3. Barcodes and RFID There is always a logical concept of analyzing RFID as a better substitute for the barcodes systems. However, the consideration of difference between these two technologies is imperative in order to deploy them successfully. Undeniably, RFID technology does not entail a line of sight to read the tags as compared to barcodes, where it is mandatory to identify the tag optically to scan it within a squat distance. Furthermore, in RFID technology, the space for data in a tag can be more than 100 bytes which is far greater than the maximum space available in barcodes. The available storage space provides the freedom to assign identification numbers not only to a brand but also to each item individually. The valuable functionality of identifying multiple tags concurrently enhances the efficiency in any operational environment employing this technology. On the other hand, RFID technology is prone in terms of attenuation and propagation problems hereditary from radio frequency, more specifically in the existence of metal or liquid. It is also a cheaper deployment as compared to barcode technology. Consequently, RFID industry stakeholders are working tirelessly to minimize the cost of RFID technology. The efforts are making the component prices lower, which are vital in calculating a cost of any RFID solution. As per the report in 2006, the RFID tag price will be around five cents [10]. 4. RFID Privacy and Security The protection related to privacy and security incorporated with RFID technology cannot be rectified without analyzing causes and driving factors. While ease of use and cost are the most significant factors, accumulation of additional intelligence to this technology requires powerful validations. The technology is already deficient in the race of global standardization; this will be an additional hurdle in the adaptation cycle. On the other hand, RFID technology is growing with pace and the systems supporting this technology are employing in multiple service sectors that may interact with our life. Hence, stake holders will not welcome any threat which may disrupt the whole infrastructure which may damage market standing. This propagation may also mean that security and privacy threats may be vindicated in some applications but should not act as an obstruction or to be taken in to account in others. Even though emerging technologies specifically face rejection and support parties for various reasons. Although security and privacy in RFID technology are the highest-flying arguments that opponents assert allegation against. However, it is the utmost responsibility of a professional observer to identify any deception or threats and demonstrate advice to the novice technology users. This is the best way to utilize enormous prospects of this technology for multipurpose applications at the utmost level or to recommend elucidation to mitigate security and privacy threats. Band Designation LF Low Frequency MF Medium Frequency HF High Frequency VHF Very High Frequency UHF Ultra High Frequency SHF Super High Frequency Frequency 30–300kHz 300kHz–3MHz 3–30MHz 30–300MHz 300MHz–3GHz 3–30GHz Wavelength 10–1km 1000–100m 100–10m 10m–1m 1m–0.1m 0.1–0.01m Table 1 - Radio Wave Bands On the other hand, the most successful methodology for generating radio waves is by utilizing an electronic circuitry with an integrated antenna. These certain can transmit radio waves at a pre-nominated frequency and amplitude sustained by a power source. The fluctuation phenomenon modifies travelling nature of waves which can transmit modulated and encoded data. Furthermore, an antenna is mandatory to receive the wave signals in order to transmit them to the electric circuit. The power source is not mandatory for this circuit as it replenishes from the radio waves. However, there are some circuitries with integrated power source to route the incoming encoded signals to required destination. It appears that the receiving points should share a standard protocol to encode the decoded data, this phenomena is called a physical layer protocol or air interface. Patently, the radio waves penetrate in the environment to a maximum distance which is controlled by features consisting of wave power, vacuum in which these waves propagate, interference (if any), and the capacity of the receiver. This feature lays a foundation for radio wave attenuation. Without hesitation, the antenna plays a vital role in receiving and sending circuit design issues. Consequently, the characteristics if the antenna relies on the wave utilization frequency. While the antenna receives the entire wavelength, it is in general the same length as the wavelength calculated in meters. Therefore, undersized frequencies use elevated antennas and high frequencies use squat antennas. In the case of normal cases the transmitting and receiving antennas ought to be parallel, equally circulated and polarized and do not abide to this limitation. 5. RFID Standards RFID standards are an encumbering factor in the approach of extensive acceptance of RFID technology. In RFID standardization discussion, it is vital to emphasize on the interoperation of dissimilar suppliers and products from various countries. However, applications of RFID technology are conformance to standards. The International Organization for Standardization (ISO) is issuing standards for RFID. They started by creating standards for cattle tagging [12]. The composition on the tag itself is defined by ISO 11784, whilst ISO 11785 is in relation to the air interface protocol. Furthermore, for payment systems and contactless smart cards, they designed and issued ISO 14443 and for vicinity cards they issued ISO 15693 [12]. Auto-ID centre was first launched in MIT and it had a generous impact on the state of the present RFID technology. The Electronic Product Code (EPC) was one of the major achievements. It was later licensed to ‘EPCglobal’, which concludes that it will be available for users and manufacturers as a royalty free source [12]. The development of network architecture took place by Auto ID centre for enabling the integration with the Internet. The Auto ID standard is based on the ISO air interface protocols. [12]. It is essential for mentioning the class 0 and class 1. The releases in class 1 are non interoperable and at the same time they lack compatibility with ISO protocols. For example, class o receives data on a precise frequency and transmits that data on another frequency. Nonetheless, generation 2 from ‘EPCglobal’ has met all the requirements as per the ISO protocols and has achieved global acceptance specifically in Supply Chain Management (SCM) Systems [12]. Recently, ISO has released ISO 18000, which is a series of standards for automatic identification and item management but are specialized in the air interface. This standard comprises seven parts according to the frequency used [12]: 18000 -1: is a general air interface protocol for frequencies accepted worldwide. 18000 -2: is specialized for low frequency at 135 KHz 18000- 3: is specialized for high frequency at 13.56 MHz. It has two modes, the first one is compatible with ISO 15693 with some improvements and the second one proposes a new high speed interface. Those modes are not interoperable [9]. 18000- 4: is specialized for microwave at 2.45 GHz 18000- 5: is specialized for super high frequency at 5.8 GHz 18000- 6: is specialized for ultra high frequency at 860-930 MHz, two operation modes are available named A and B [9]. 18000- 7: is specialized for ultra high frequency at 433.92 MHz Apparently, EPCglobal Generation 2 standard and efforts from Global Tag (GTAG) initiative, that is supervised by the European Article Numbering (EAN) international and Uniform Code Council (UCC), have been fused and merged in the ISO 18000-6 [9]. 6. The Facts and Hoax A simple research on the Internet concludes lot of information consisting of websites, documents and journals related to RFID privacy and security. In fact, security is only provided only if threats are available. The following examples will illustrate the significance of deploying security infrastructure and mitigation privacy in RFID technologies. Furthermore, hacking and penetration in RFID infrastructure is detected. This threat is sufficient to proof that the technology is vulnerable to hackers and there should be counter measures in terms of protection and security. The practice code for utilizing Radio Frequency Identification Technology in UK is in retail outlets [14] initialized in March 2006 by the Chartered Institute of Logistics and Transport (UK). Furthermore, the study of this [15] document was accomplished by the Parliamentary Office if Science and Technology located in UK In Addition, this practice code [15] study is accomplished in Parliamentary Office of Science and Technology UK which illustrates the RFID privacy issues and significance of valuable regulations. Furthermore, espouse is conducted by EU and is illustrated on the European consultation website [16]. In addition, a publication in 2009 related to privacy and data protection principles of RFID applications is viable on EU website [17]. Those documents related to RFID privacy and security provides sufficient evidence of imposed rules, code of practice and regulations. The documents would not have been propagated by legislators except there was a profound insight of potential and present threats. Multiple US states supplies RFID toll collection system named as EZ-Pass. This technology consists of a RFID tag that position itself behind the rear-view mirror inside a vehicle. The tag communicates with RFID reader located at the collection gate to deduct amount from pre-paid account. As exemplified in the news article [18], records were extracted from the database. RFID systems logs the entry supported by a court decision in case of divorce. This is a well thought out privacy violation which was only made a success with RFID. It enabled governmental surveillance obligatory (Big Brother). According to [19], a best paper award winner that received massive worldwide publicity [20], the RFID virus is a veracity, the working mechanism involves contaminated tags which can affect other tags, and the inferior part is to influence back end systems adjacent to the scenarios revealed for instance superstores, animal clinics and airports. The tags utilized in the above research are Philips UHF I-Code SL1 chip that has 896 bits of memory. In RFID Journal [21], technology proponents assert on small memory size of passive RFID tags (96 bit), availability of read-write tags, and ultimately the weak back-end system security are all limitations for that virus specific case to be functional. Moreover, experts indicate that applied security feature in Class 1 Gen 2 tags make it sheltered against such viruses which means that security features are critical in the standards to evade viruses. Conversely, the ThingMagic website concludes [22] the consideration of the scenario which is excessively theoretical and the probability is low as compared to the real world scenario and they aver that every well designed solution will not be level for these kind of viruses. Further, they reduce importance of the “power-analysis” attack that was presented in RSA security annual conference in 2006. Ever since the experiment is too difficult to be executed by hackers and the Gen 2 tags supporting the 32-bit password protection append more complexity to eavesdropping. The researchers from Johns Hopkins University and RSA laboratories in [23], lucratively cracked the 40-bit key for the Texas Instrument RFID Digital Signature Transponder (DST) which is used to facilitate vehicle immobilizers, e.g. Ford models in 2005, and by ExxonMobil SpeedPass system. Even though, the RFID tags do not apply EPC implementations, this paper illustrates evidently the significance of strong password protection in RFID solutions. A news article [24] related to a school puts a chip on pupils, the school is located in Edenthorpe, England named as Hungerhill; an immense violation of privacy was detected in a student tracking project that was started as a pilot project on ten students in February 2007. The impact of this privacy invasion formulated an opposing group [25] opposing the usage of RFID as a tracking tool. In addition, the capability of monitoring students through RFID fixed in school badges also elevate the concern that the authority of the students who are monitored should always be considered. According to the widespread news coverage, including BBC [26], Dr. Mark Gasson from the University of Reading claims that he is the foremost human to receive a computer virus. He acknowledge in his challenge of principle experiment, a fixed RFID tag which was utilized to surpass in the course of security doors and to secure his cellular phone which was infected with a computer virus proficient for transmission the virus to other control systems that read this tag. This provides evidence for the existence of RDIF tag virus. Hence, securing tags is crucial to the RFID technology. Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN) [27] founded by Dr. Katherine Albrecht in 1999 is an 18,000-member organization to combat shopper surveillance that is operated by superstores via loyalty cards. The founder express this organization and discussed adjacent to RFID in an interview on television [28] exemplifying severe privacy concerns and illustrating RFID tracking competence. This organization is dedicated to increase consumers’ awareness, to criticize all-encompassing marketing strategies, and for customer encouragement’ privacy-aware shopping. RFID shares a separate part on CASPIAN website to enable people aware of its insidious nature. Dr. Katherine Albrecht and Liz McIntyre authored a book named Spychips [29] which describes itself as a devil dictionary for RFID since it condemns RFID as a tracking technology. There is also a website [30] that promotes for the ideas presented in that book. Authors built their allegations based on two published patents [6, 7] about tagging people for tracking and identification. Based on those patents, if that were the capabilities in 2001 and 2006; I think it is now possible to do more accurate tracking and identification. RFID Right to Know Act of 2003 was proposed by CASPIAN and in 2004; a Subcommittee on Commerce, Trade, and Consumer Protection House Committee on Energy and Commerce requested the testimony on Radio Frequency Identification (RFID) Technology: What the Future Holds for Commerce, Security, and the Consumer [31]. Additionally, this link is the privacy rights [32] issued by several organizations regarding RFID usage. A university research [33] in Radboud University Nijmegen in Netherlands was demeanour by a student research group and they were able to break the Mifare RFID chip security. The Mifare RFID chips is integrated in Oyster cards for e-payment solutions for London’s underground and buses. In addition, students tested their cracked RFID cards and they got success. This hack by students was reported in BBC [34], but another unpleasant incident of hacking was reported by BBC [35] related to identical Oyster cards within a short duration hacked by a student. A company specialized in RFID security works on developing secure RFID tags and their website [36] express some of the threats and risks that are present in RFID technology. RFDump [36] is a ready-software that was developed in Germany. The software is capable of reading RFID tags and writing them back easily to a replica chip. This software can be downloaded from the Internet easily and executes on a personal computer but it requires a connected RFID reader/writer. Disseminated of law took place in the state of Washington which rule out "malicious" RFID spying in 2008 and was reported in the news [37]. According the new law, anyone found scanning another person without getting his authority or permission earlier, will be castigated .Evident criminal abuse of RFID technology highlights this law. Although, in its outline version, it incorporated the same requirement against retailers and other commercial users who use this technology to track customers’ activities by issuing discount or loyalty cards. Unluckily, this prerequisite was waived from the law, observably after due to intense demands from corporate lobbying. This news article involves [38], a battle is concoct over RFID chip-hacking demonstration. This article involves the illustration of RFID threats from stakeholders published in 2007, “HID Corp” are used against IOActive conference in Washington that had an exposure of hacking tool on their chips. This video [39] is for the hacker Chris Paget, underlines the importance of security on RFID tags and readers. There are other news articles for instance “Is RFID secure” [40] and “RFID and privacy: contest heating up in Washington” [41] point towards the arguement around RFID security and they both invite for regulating the technology to avoid privacy and security problems. In a improved article [42], the author has written a previous article related to RFID security in 2005 and author validate again in a new topic in 2009 which concludes risk in using this technology that needs to be addressed and gives the example of Chris Paget. Author highlights the importance of using security in the correct application and scenario. Boycott Tesco [43] is a website that show how some Tesco products are tagged to track clients. In a news article related to e-passports, “Think Electronic Passports Are Secure? Think Again” [44] , a graduate student claims that the RFID tags used on the passports can be hacked or forged and may enable passport holders vulnerable to terrorist attacks. On the other hand, the manufacturing company says that there are about 50 security features available in the tag which underlines the importance of security in RFID. There are two videos in [45] and [46] that demonstrate a denial-of-service attack and a reply attack on RFID technology using logical and scientifically sound methodologies. 7. RFID Attacks and Defenses In this section, the description of attacks on RFID technology will be presented from different perceptions in addition to available solutions to diminish them. 7.1. Physical Viewpoint Attacks in RFID technology attacks the physical interface, RFID devices themselves and the radio waves in between. The attacker of the physical components access the wireless communications nature of RFID, this is a fact that it is unprotected physically and that it is vulnerable to physical management. Attacks on this level may disable tags temporarily or permanently in addition to relay attacks. 7.2. Attacks If a malicious attacker breach in to the system to permanently disable an RFID tag, the hacker will pose a considerable risk related to that when entirely destroying the tag or fetter it in the process for a sufficient duration. The attacker will try to physically remove the tag or cause a physical harm to it in order to make an RFID tag malfunction. Moreover, ‘kill’ command is executed for disabling a tag; the hacker can execute this command to illegally execute tags which will assure to achieve malicious goals. Switching tags among two different items will eventually split their prices. This kind of attacks is proficient and applicable on barcodes by shoplifters. Even though, RFID tags are embedded with physical protection to eliminate these kinds of attacks. There are various other tags which are vulnerable and easy to split from one item to another to pay less at the checkout point. This hacker does not require any technical knowledge to perform this kind of attack. This attack has certain limitations and cannot be executed on large number of tags. Correspondingly, the destruction of tag follows same rules and theory. Attacker may attempt to apply pressure or extend efficient chemical substances or the cause of having a tiny cut to the visible antenna to render the tag to pass it through check points. Essentially, physical damage is not the cause of attacker only; the tags can also be tempered by friction or high temperatures. Some tags becomes dead due to consumption of the batters installed in them, as passive tags are better in this scenario because they generate power from radio waves. Furthermore, RFID tags can be easily damaged quickly by applying an electrostatic discharge from a conveyor belt in any industrial environment or any produced high energy waves due to their compassion to static electricity; this damage is carried out with both intentionally and accidentally. In 2006, two students, from Berlin, Germany, utilized an old camera with a flash to simply make an RFID tag disabler named RFID-Zapper [47]. This device can entirely disable passive RFID-tags. The functionality involves rendering of tag's circuitry inoperable by overfilling it by an electromagnetic pulse breaded by a coil replacing the camera’s flash. Alternatively, privacy support and RFID opponents are willing to employ this device for selling it to customers, enabling them to immobilize RFID tags permanently. The Auto-ID centre [48] and EPCglobal published “protocol specification for a 900 MHz Class 0 Radio Frequency Identification Tag”. This is a command set for killing the tag to mitigate consumer’s privacy concerns by deactivating an RFID tag, for example, after a tagged product is sold, the kill command is executed which is a unique password for each tag or group of tags and can be defined by the tag manufacturer. Furthermore, some command modification may also erase any data stored partially or completely. As mentioned previously this feature can be used by attackers to render tags not functional and it denies the user form accessing those tags in smart appliances. Some attackers will look for temporarily disabling tags which also contributes for the malicious purposes. A Faraday cage is used to wrap the tagged item and shield the tag to block readers form sending requests to them. It can be made of an aluminium foil bag that fits the product. Radio interference can also deactivate a tag temporally; the interference source could be generated from working environment or can be due to the existence of materials that cause attenuation such as metal or water. Besides, Interference can be originated by a jamming attack exploiting the fact that a tag listens without recognizing the source of the incoming wave. Moreover, some techniques exploit the simulation process to make a blocker tag [49] respond always which will result in collisions and render the original adjacent tag unreadable. The reader is also subject to physical attacks. Sometimes, readers are deployed in unattended locations which we make the susceptible to destruction, theft or long-duration hacks. Some RFID readers contain cryptographic credentials and keys that can be exploited by malicious attacker not only to get access to tags but also may gain access to back-end systems and then the results will be catastrophic. Some attackers will only render unattended RFID readers inoperable. In relay attacks, an adversary listens to the forth and back messages between an authorized reader and an authenticated tag. The attacker can then reutilize the recorded communications between the two parts with or without some modifications to play the role of an authenticated tag or an authorized reader maliciously. The legitimate tag or reader on the other side will still continue to assume that they are communicating with authentic parties. Some relay attackers, willing to make their attack more harmful, make a specialized device for recording tag activities and another specialized one for recording reader activities. As a demonstration of relay attacks, Roel Verdult, MSc. student from the Raboud University of Nijmegen, successfully conducted a relay attack on Mifare Ultralite card. According to [50] This student built an RFID tag emulator to conduct a practical relay attack on Dutch transit ticket. The student utilized a previous model called “ghost and leech” published by Kfir and Wool's [51]. This break has launched a big investigation by the local government since two billion US dollars were invested in this project. As a result, the researchers were invited to testify before the local parliament. 8. Defences The physical attacks against the component of an RFID system, such as switching or disabling tags, require traditional relevant countermeasures. The physical traditional countermeasures include camera, doors, guards and fences [52]. Actually, the nature of these attacks as a physical ones require physical defences to be mitigated. To address tag removal threats, strong surveillance systems are required to support RFID solutions. Currently, RFID implementers use strong glue or a kind of a mechanical attachment between the tag and the tagged object that makes tag removal nearly impossible and would additionally render the tagged object damaged or coloured to indicate the instance of removal. Some retailers found that embedding or integrating the RFID tag within the product will make it harder for the attacker to remove the tag. However, active RFID tags can transmit an alert to generate an alarm when it is illicitly removed. On the other hand, the implementer should supply adequate readers to gather alerts generated. According to [52], interference and jamming could be relegated by building room walls or utilizing partitioned stalls that are opaque to relevant radio frequencies used by the deployed RFID system. To deal with the misusing the kill command, RFID systems should use an effective and strong password management. For example, Class 1 Gen 2 tags require a 32-bit password [53]. Other solution propose the use of a master kill command for bulk killing of tags, indeed, although this solution is practical and simplify the killing process for large number of tags at the same time; it poses a bigger threat on the system if that single kill command code was compromised. To fight back relay attacks, encryption is an effective approach to disguise the communication between the involved parties. Moreover, authentication of the two parties to each other or authentication of tags alone, which are the most compromised part of an RFID system, would alleviate relay attacks. Obviously, encryption and authentication will add complexity to RFID solutions and will relevantly slower its response time. Additionally, RFID tags in particular are limited in all kinds of resource and evidently the encryption and authentication will require computational powers that may exceed the tag’s capabilities. The short distance between the reader and the tag is considered a natural guard for any RFID system; since if the distance is shorter; attacker will have a harder job and will be within a short visible range. This case is not always valid since there are long range enhanced readers that can be utilized to read tags from a longer distance than the normal distance proposed by the original system’s readers. According to [54], the normal distance between the tag and the reader can serve as a metric to detect relay attacks by measuring round trip delay of the request and response or signal strength. In [55], authors discussed a distance bounding protocol through using a challenge response based on XOR function which allows the reader to verify actually the presence of the tag but lessens the operating range. The proposed solution was experimented in a simulation environment on ISO 14443 complaint tags. 9. References [1] J. Heidrich, D. Brenk, J. Essel, S. Schwarzer, K. Seemann, G. Fischer, and R. Weigel, "The Roots, Rules, and Rise of RFID," Microwave Magazine, IEEE, vol. 11, pp. 78-86, 2010. [2] J. Landt, "The history of RFID," Potentials, IEEE, vol. 24, pp. 8-11, 2005. [3] D. B. Harris, "Radio transmission systems with modulatable passive responder," US Patent 2,927,321, 1960. [4] S. Shepard, RFID: radio frequency identification: McGraw-Hill Professional, 2005. [5] S. Sarma, "A History of the Auto-ID Center," in RFID: Applications, Security, and Privacy, S. Garfinkel and B. Rosenberg, Eds.: Addison-Wesley Professional, 2005. [6] J. R. Hind, J. M. Mathewson, and M. L. Peters, "Identification and tracking of persons using RFID-tagged items," Google Patents, 2001. [7] J. R. Hind, J. M. Mathewson, and M. L. Peters, "Identification and tracking of persons using RFID-tagged items in store environments," Google Patents, 2006. [8] M. Cavalleri, R. Morstabilini, and G. Reni, "A wearable device for a fully automated in-hospital staff and patient identification," in Engineering in Medicine and Biology Society, 2004. IEMBS '04. 26th Annual International Conference of the IEEE, 2004, pp. 3278-3281. [9] S. Hodges and M. Harrison, "Demystifying RFID: Principles & Practicalities," Auto-ID Centre, Institute for Manufacturing, University of Cambridge 2003. [10] C. B. Soon, "Radio Frequency Identification History and Development," Auto-Identification and Ubiquitous Computing Applications: RFID and Smart Technologies for Information Convergence, 2009. [11] H. Barthel, "Regulatory status for RFID in the UHF spectrum," EPCGlobal, Brussels, Belgium, Sep, 2007. [12] "A Summary of RFID Standards," in RFID Journal: [Online]. Available: http://www.rfidjournal.com/article/view/1335/2 . [Accessed: 10/7/2010]. [13] K. Finkenzeller, RFID handbook: fundamentals and applications in contactless smart cards and identification: John Wiley & Sons Inc, 2003. [14] CILT(UK), "UK RFID Code of Practice: A UK code of practice for the use of Radio Frequency Identification (RFID) in retail outlets," Chartered Institute of Logistics and Trasnport, Release 1.0, Issued by the UK RFID Council, [Online]. Available: http://www.ciltuk.org.uk/download/codeofpracticerfid.pdf . [Accessed: 7/9/2010]. 2006. [15] "Postnote July 2004 Number 225 Radio Frequency Identification (RFID)," Parliamentary Office of Science And Technology, UK, [Online]. Available: http://www.journalofphysics.org/education/higher_education/fellowship-and-intern-schemes/file_43356.pdf . [Accessed: 7/9/2010]. 2004. [16] "Security & confidence," RFID Consultation Website, [Online]. Available: http://www.rfidconsultation.eu/workshops/19/144.html . [Accessed: 7/9/2010]. [17] "Commission Recommendation of 12.5.2009 on the implementation of privacy and data protection principles in applications supported by radio-frequency identification," Commission of The European Communities, Brussels, [Online]. Available: http://ec.europa.eu/information_society/policy/rfid/documents/recommendationonrfid2009.pdf . [Accessed: 7/9/2010]. 2009. [18] C. Newmarker, "E-ZPass records out cheaters in divorce court," msnbc.com, [Online]. Available: http://www.msnbc.msn.com/id/20216302/ . [Accessed: 7/9/2010]. 2007. [19] R. R. Melanie, C. Bruno, and S. T. Andrew, "Is Your Cat Infected with a Computer Virus?," in Proceedings of the Fourth Annual IEEE International Conference on Pervasive Computing and Communications: IEEE Computer Society, 2006. [20] P. N. D. S. Melanie R. Rieback, Bruno Crispo, Andrew S. Tanenbaum, "RFID Viruses and Worms," Department of Computer Science, Vrije Universiteit Amsterdam, [Online]. Available: http://www.rfidvirus.org/ . [Accessed: 7/9/2010]. [21] J. Collins, "Can Tag Viruses Infect RFID Systems?," RFID Journal, [Online]. Available: http://www.rfidjournal.com/article/articleprint/2201/-1/1 . [Accessed: 7/9/2010]. 2006. [22] "RFID Security issues - Generation2 Security ": ThingMagic: The Engine in RFID, [Online]. Available: http://www.thingmagic.com/rfid-security-issues . [Accessed: 7/9/2010]. [23] S. C. Bono, M. Green, A. Stubblefield, A. Juels, A. D. Rubin, and M. Szydlo, "Security analysis of a cryptographically-enabled RFID device," in Proceedings of the 14th conference on USENIX Security Symposium - Volume 14 Baltimore, MD: USENIX Association, 2005. [24] C. Walker, "School puts a chip on pupils," [Online]. Available: http://www.doncasterfreepress.co.uk/free-press-news/School-puts-a-chip-on.3391369.jp . [Accessed: 7/9/2010]. 2007. [25] "LTKA © against schools fingerprinting our children," [Online]. Available: http://www.leavethemkidsalone.com/ . [Accessed: 7/9/2010]. [26] R. Cellan-Jones, "First human 'infected with computer virus'," BBC, [Online]. Available: http://www.bbc.co.uk/news/10158517 . [Accessed: 7/9/2010]. 2010. [27] CASPIAN: Consumers Against Supermarket Privacy Invasion and Numbering, [Online]. Available: http://www.nocards.org/ . [Accessed: 7/9/2010]. [28] "How RFID works ": [Online]. Available: http://www.youtube.com/watch?v=yNPDgudPmXE&feature=related . [Accessed: 7/9/2010]. 2007. [29] K. Albrecht and L. McIntyre, Spychips: how major corporations and government plan to track your every move with RFID: Thomas Nelson Inc, 2005. [30] "RFID Privacy Issues and News ": Spychips.com , [Online]. Available: http://www.spychips.com/ . [Accessed: 7/9/2010]. [31] EPIC, "Testimony and Statement for the Record of Cedric Laurant on: Radio Frequency Identification (RFID) Technology: What the Future Holds for Commerce, Security, and the Consumer," Electronic Privacy Information Center, [Online]. Available: http://epic.org/privacy/rfid/rfidtestimony0704.html . [Accessed: 7/9/2010]. 2004. [32] "RFID Position Statement of Consumer Privacy and Civil Liberties Organizations," Privacy Rights Clearinghouse / UCAN, [Online]. Available: http://www.privacyrights.org/ar/RFIDposition.htm . [Accessed: 7/9/2010]. 2003. [33] "RFID: Security Flaw in Mifare Classic," Digital Security Group, Faculty of Science, Radboud University Nijmegen, [Online]. Available: http://www.ru.nl/ds/research/rfid/ . [Accessed: 7/9/2010]. 2008. [34] P. Price, "Oyster card hack details revealed ": BBC, [Online]. Available: http://news.bbc.co.uk/1/hi/programmes/click_online/7655292.stm . [Accessed: 7/9/2010]. 2008. [35] "Card fault hits London transport ": BBC ,[Online]. Available: http://news.bbc.co.uk/1/hi/england/london/7503197.stm . [Accessed: 7/9/2010]. 2008 [36] "RFID Security Risks," NeoCatena Networks INC.: Next Generation RFID Security, [Online]. Available: http://www.neocatena.com/technology/risks/ . [Accessed: 7/9/2010]. [37] T. Ricker, "New law makes "malicious" RFID spying illegal, corporations can do as they please," Engadget, [Online]. Available: http://www.engadget.com/2008/03/26/new-law-makes-malicious-rfid-spying-illegal-corporations-can/ . [Accessed: 7/9/2010]. 2008 [38] P. F. Roberts, "Battle brewing over RFID chip-hacking demo: Card maker HID calls foul over Black Hat presentation," InfoWorld, Security Central, [Online]. Available: http://www.infoworld.com/d/security-central/battle-brewing-over-rfid-chip-hacking-demo-696 . [Accessed: 7/9/2010]. 2007. [39] "Cloning passport card RFIDs in bulk for under $250," [Online]. Available: http://hackaday.com/2009/02/02/mobile-rfid-scanning/ . [Accessed: 7/9/2010]. 2009. [40] C. Ajluni, "Is RFID secure?," Mobile Dev & Design, [Online]. Available: http://mobiledevdesign.com/hardware_news/rfid-security-defcon/ . [Accessed: 7/9/2010]. 2006. [41] G. Gross, "RFID and privacy: Debate heating up in Washington: The FTC is beginning to gather facts on the issue," InfoWorld, Security Central, [Online]. Available: http://www.infoworld.com/d/security-central/rfid-and-privacy-debate-heating-in-washington-167 . [Accessed: 7/9/2010]. 2004. [42] J. Rapoza, "RFID Puts Us All at Risk," in eWEEKeurpoe: [Online]. Available: http://www.eweekeurope.co.uk/comment/comment-security/rfid-puts-us-all-at-risk-165 . [Accessed: 7/9/2010]. 2009. [43] "Tesco is Leading the Push for RFID: Live trials underway, tens of thousands of UK shoppers affected," CASPIAN, Consumers Against Supermarket Privacy Invasion and Numbering, [Online]. Available: http://www.boycotttesco.com/spychips.html . [Accessed: 7/9/2010]. [44] G. Hulme, "Think Electronic Passports Are Secure? Think Again," in InformationWeek: [Online]. Available: http://www.informationweek.com/blog/main/archives/2009/02/think_electroni.html . [Accessed: 7/9/2010]. 2009. [45] "RFID reader denial of service," [Online]. Available: http://www.youtube.com/watch?v=k_PhFjUviBw&feature=related . [Accessed: 7/9/2010]. 2008. [46] "RSA: Door cards - the enterprise's weakest link," [Online]. Available: http://www.youtube.com/watch?v=oj3V0rAqBG0&feature=related . [Accessed: 7/9/2010]. 2007. [47] J. Collins, "RFID-Zapper Shoots to Kill," in RFID Journal: Department of Computer Sciences, Faculty of Sciences, VU University, Amesterdam [Online]. Available: http://www.rfidjournal.com/article/view/2098/1/1. [Accessed: 2/8/2010], 2006. [48] "Draft protocol specification for a 900 MHz Class 0 Radio Frequency Identification Tag," MIT Auto-ID Center [Online]. Available: http://www.epcglobalinc.org/standards/specs/900_MHz_Class_0_RFIDTag_Specification.pdf. [Accessed: 3/8/2010], 2003. [49] A. X. Liu and L. A. Bailey, "RFID Authentication and Privacy," in RFID and Sensor Networks: Architectures, Protocols, Security and Integrations, Yan Zhang, L. T. Yang, and J. Chen, Eds.: CRC, 2010. [50] "Dutch Public Transit Card Broken: RFID replay attack allows free travel in The Netherlands," Department of Computer Sciences, Faculty of Sciences, VU University, Amesterdam [Online]. Available: http://www.cs.vu.nl/~ast/ov-chip-card/ . [Accessed: 3/8/2010], 2008. [51] K. Ziv and W. Avishai, "Picking Virtual Pockets using Relay Attacks on Contactless Smartcard," in Proceedings of the First International Conference on Security and Privacy for Emerging Areas in Communications Networks: IEEE Computer Society, 2005. [52] T. Karygiannis, B. Eydt, G. Barber, L. Bunn, and T. Phillips, "Guidelines for securing radio frequency identification (RFID) systems," NIST Special Publication, vol. 800, p. 98, 2007. [53] "EPC Radio-Frequency Identity Protocols Class-1 Generation-2 UHF RFID Protocol for Communications at 860 MHz-960 MHz Version 1.2.0," EPCglobal [Online]. Available: http://www.epcglobalinc.org/standards/uhfc1g2/uhfc1g2_1_2_0-standard-20080511.pdf. [Accessed: 3/8/2010], 2008. [54] D. Singelee and B. Preneel, "Location verification using secure distance bounding protocols," in Mobile Adhoc and Sensor Systems Conference, 2005. IEEE International Conference on, 2005, pp. 7 pp.-840. [55] R. Jason, M. G. N. Juan, T. Tee, and S. Bouchra, "Detecting relay attacks with timing-based protocols," in Proceedings of the 2nd ACM symposium on Information, computer and communications security Singapore: ACM, 2007. [56] A. Laurie, "Practical attacks against RFID," Network Security, vol. 2007, pp. 4-7, 2007. [57] "Security Aspects and Prospective Applications of RFID Systems," Federal Office for Information Security, Bonn, Germany [Online]. Available: https://www.bsi-fuer-buerger.de/cae/servlet/contentblob/475744/publicationFile/27965/RIKCHA_englisch_Layout_pdf.pdf. [Accessed: 4/8/2010], 2004. [58] "Information technology -- Security techniques -- Entity authentication ": ISO/IEC Part 1 to 6 [Online]. Available: http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=53634 . [Accessed: 4/8/2010], 2010. [59] A. Juels, "Strengthening EPC tags against cloning," in Proceedings of the 4th ACM workshop on Wireless security Cologne, Germany: ACM, 2005. [60] S. Devadas, E. Suh, S. Paral, R. Sowell, T. Ziola, and V. Khandelwal, "Design and Implementation of PUF-Based "Unclonable" RFID ICs for Anti-Counterfeiting and Security Applications," in RFID, 2008 IEEE International Conference on, 2008, pp. 58-64. [61] L. Mirowski and J. Hartnett, "Deckard: a system to detect change of RFID tag ownership," IJCSNS, vol. 7, p. 89, 2007. [62] S. A. Weis, "Security and Privacy in Radio-Frequency Identification Devices," in Department of Electrical Engineering and Computer Science. vol. Master’s thesis: Massachusetts Institute of Technology, 2003. [63] S. Weis, S. Sarma, R. Rivest, and D. Engels, "Security and privacy aspects of low-cost radio frequency identification systems," Security in Pervasive Computing, pp. 50-59, 2004. [64] M. Ohkubo, K. Suzuki, and S. Kinoshita, "Cryptographic Approach to “Privacy-Friendly” Tags," in Proceedings of RFID Privacy Workshop. Cambridge: MIT, 2003. [65] J. Ayoade, "Roadmap to solving security and privacy concerns in RFID systems," Computer Law & Security Report, vol. 23, pp. 555-561, 2007. [66] A. Karygicmnis, T. Phillips, and A. Tsibertzopoulos, "RFID Security: A Taxonomy of Risk," in Communications and Networking in China, 2006. ChinaCom '06. First International Conference on, 2006, pp. 1-8. [67] B. Gillham, Developing a questionnaire: Continuum Intl Pub Group, 2000.  Read More