Security, privacy most pressing concerns By Shon Seung-won, vice president of ETRI It is well known that Radio Frequency Identification (RFID) technology can be used for the realization of a ubiquitous environment in which IT technology is seamlessly integrated into our everyday lives and then provides useful services to humans. Though conventional Internet technologies such as web services can also provide intelligence to our lives, these technologies are confined to the virtual environment. That is, conventional Internet technology provides intelligence only by manipulating digitized data and the effects are confined to this digitized data. However, ubiquitous technology which is harnessed by RFID technology provides intelligence to our real environment not only by manipulating digitized data but also by sensing and controlling physical devices. RFID technology brings us the visibility of RFID tagged physical devices, control, flexibility, and plenty of higher level applications that make human lives more convenient and comfortable. RFID technology has many benefits over other identification technologies such as bar codes. Unlike bar codes, which need to be scanned manually and read individually, RFID technology does not require line-of-sight for reading due to its intrinsic wireless communication capability between the RFID tag and reader. Within the reading range of an RFID reader, it is possible to automatically read hundreds of tags a second and then isolate one specific tag. Not only can these tags be read faster than bar codes, they also contain more information. They even process the information so they can recall it more efficiently. RFID applications are limited only by the imagination. It means that there are many possible applications for RFID and it also means that the RFID technology is the core technology for making a Ubiquitous World. In the manufacturing and business area, many businessmen can save their money in manufacturing, managing and distributing products. The benefits of this efficiency eventually will be given to customers in terms of the price and quality of products. Also, this efficiency can make another business area. It means more workers can be hired for such a new business area. Additionally, there are many possible RFID applications such as medical applications, people tracking, retail services, and other customer oriented applications. In medical applications, RFID can be used for linking a patient with key drugs, the personnel giving the drugs and biometric measurements. Also, RFID can be used for people tracking. It can be used for entrance management or security, contact management at events, and baby tags in hospitals to manage access to post-natal wards. Also, RFID can be used in retail services for tracking store trolleys in supermarkets and active shelves. As such, RFID technology can be viewed as the promising technology for the future world. However, despite this promise, there are several key issues that must be addressed to make RFID technology flourish in the market. Some of these are summarized as follows: - Overcome Market Immaturity: Application of RFID to item level products is a difficult problem. There are many technical problems to provide visibility to each item. - Cost Overhead Problem: Though physical costs are becoming less important as the cost of tags falls due to semiconductor fabrication characteristics, the implementation costs will remain a challenge for smaller organizations and benefit professional services and systems integrators in the initial stage of roll-out. - Possible Privacy Infringement Problem: It is the key issue for vendors to overcome this fear by the recycling, blocking or disabling tags when they are no longer needed. Many NGOs are strongly opposing the adoption of RFID technology in the real world. And they even regard the RFID as a spy-chip. - Implementation Hurdles: The physical characteristics of RFID tags are also big hurdles to realize RFID tags to real applications. Also, the issues of integrating the data to existing IT applications are big burdens to real applications. - Lack of Adopters: To comply with mandates from Wal- Mart and the US Department of Defense suppliers have had no choice but to adopt RFID. There are best-practice lessons to be learned from these and other interesting pilot programs. Among the stated issues, privacy and security infringement will be the most critical issue to make RFID technology prevalent in real applications. The remaining issues will be solved in the near future. Possible abuse, or just excessive use, by retailers and government agencies of RFID's tracking capability raises questions about potential violations of personal privacy. Also, it is known that RFID tags can be easily cloned and modified. It is also easy to eavesdrop on the communicated message between the RFID tag and reader. Current passive RFID tags only provide naive security capabilities such as a kill password and access password to the user. Unfortunately these conventional security features can be broken easily. What makes the situation worse is the intrinsic characteristics of RFID tags, that is, the resource constraints of RFID tags. Due to the low cost of passive RFID tags and the fact that they operate without a battery, there are some weaknesses associated with RFID-based object identification. Conventional stable security technologies that are used for Internet and Smart Cards cannot be used for RFID environments due to its high resource constraint and special characteristics of RFID applications. It means we have to develop proper security and privacy enhancing technologies to make RFID technology popular in the market. In order to increase consumer acceptance of RFID technology, RFID advocates must promote and implement comprehensive security measures along with consumer education, enforcement guidelines, and research in and development of practical security technologies. Technical organizations such as EPCglobal, Inc. are developing standards for the Electronic Product Code, including its Guidelines on EPCs for Consumer Products. A simple countermeasure -- a built-in option designed to kill the functionality of an RFID tag when the consumer leaves the store -- has been incorporated into the EPCglobal standard. For consumers, its purpose is easy to understand and thus easy to accept. However, killing a tag's functionality curtails the future potential use of RFID in consumer services. So this naive solution to keep privacy may not be acceptable to many consumers and not be appropriate for the ubiquitous world. Many privacy-protection solution mechanisms are being developed in academia and research communities. Among these, the most secure and reliable approach is to use cryptography. Because conventional cryptography techniques cannot be applied to RFID environments, engineers and scientists have to develop proper security solutions to boost the security of RFID environments and preserve the privacy of RFID users. These solutions include lightweight crypto modules, security protocols, security management of RFID tags, security techniques for RFID middleware and Information Services and privacy enhancing technologies. An example of this technology is the anonymous-ID scheme in which an encrypted ID is stored in the tag. The encryption algorithm AES and hash function SHA-1 can be used for this encryption purpose. In response to a reader's request, the tag replies with the encrypted ID to the reader. The reader then sends the encrypted ID from the tag to the RFID back-end system, requesting the back-end system -- middleware, information server, or application -- to decrypt the encrypted ID. The back-end system does so to obtain the real ID of the tag and sends the ID back to the reader. This scheme prevents the leaking of private consumer data by encrypting the ID. RFID privacy and security issues are stimulating topics and these topics are known to critical points to make RFID technology successful in real world. In the research community many researchers are actively studying to develop proper security technologies for RFID from the RFID tag to RFID back-end systems. These efforts involve rich interplay among many disciplines, digital and analog hardware designs, system designs, supply-chain logistics, privacy rights, data management, and cryptography. In addition to these technological efforts, social efforts such as educational along with corporate application policiesy are required to reassure RFID users that their private information is indeed safe. In summary, to reduce the privacy infringement worrisome and the vulnerabilities of RFID applications, comprehensive countermeasures must combine a variety of viewpoints -- legal, social, and technological -- to address any potential security threats to the personal data of tens of millions of consumers worldwide.