Achieving privacy and security in radio frequency identification

Radio Frequency Identification RFID systems are gaining popularity in a wide variety of applications like asset tracking, personnel identification, and sensor networks. However, unique security and privacy issues arise in these systems because (a) low computation capabilities of RFID tags prevent the use of complicated cryptographic protocols, and (b) wide deployment of tags opens up room for illegal tracking of people and objects. In this paper, we first describe a basis-set of requirements that need to be necessarily satisfied to mitigate security and privacy problems in RFID systems. We then outline some recent proposals that try to solve these issues, and then explore in detail a research publication [1] that uses a pseudonym based tree walking security scheme [2], and claims to meet all the requirements. However, we identify some attacks that are still possible in this scheme [1] in the same threat model but more realistic scenarios, and then extend the scheme to mitigate these attacks. We also address the issue of secure establishment of session keys to exchange information between tags, readers, and centralized trusted centers, which had not been proposed earlier. Our extensions make the overall scheme complete, and deal with most issues that had not been addressed comprehensively by other related work in the past. In all, our extensions provide a complete RFID scheme that meets all the security and privacy goals.