Design Trade-Offs for Realistic Privacy

The integration of RFID technology into consumer products raises serious privacy concerns, but no privacy protection scheme that can be implemented on passive RFID tags is readily available. Existing proposals either sacrifice a core property of RFID systems, such as availability or scalability, or offer only limited privacy. The most promising approaches appear to be tree-based hash protocols, which sacrifice some privacy to maintain scalability. The amount of information that is leaked by these tree-based protocols depends on the tree setup, as well as the number and position of disclosed secrets. This leaked information is valued differently by different attackers. Some attackers aim to collect most information from many tags to build customer profiles; some need detailed information from a representative subset of tags to derive turnover rates of goods while others need very detailed information on selected tags to track individuals. Modifications of the tree protocol can improve privacy but need to be evaluated under the applicable attacker model. In this chapter, we first introduce privacy issues in RFID systems and techniques for measuring achieved privacy. Then, we describe protocols designed to enhance privacy and evaluate their effectiveness against different types of attackers. We find that some measures such as pseudonyms and periodic key updates improve privacy against some attackers, while hurting privacy against other attackers. Some measures such as restructuring the tree improve privacy against all attackers but incur additional computational cost for the legitimate reader. To find the best privacy protocol for a known attacker all available trade-offs should be considered.