RFID Privacy Using Spatially Distributed y g p y Shared Secrets - PowerPoint PPT Presentation

RFID Privacy Using Spatially Distributed y g p y Shared Secrets Marc Langheinrich Marc Langheinrich Remo Marti Remo Marti Inst. for Pervasive Computing Ergon Informatik AG ETH Zurich Zurich Switzerland Switzerland 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 1

Unauthorized RFID Access – Implications Passport : Name: John Doe Nationality: USA Visa for: Isreal Visa for: Isreal Wig Our focus: Consumer items Modell #2342 ries Material: Polyester els, RSA Laborato k (c) 2006 Ari Jue Tiger Tanga : Manufacturer: Woolworth Washed: 736 FID ‐ Man” Artwor Viagra : Wallet Manufacturer: Pfitzer :Contents: 370 Euro :Contents: 370 Euro Original “RF Extra Large Package Disability Card: #2845 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 2

Killing Consumer Item RFID Tags � „Dead Tags Tell No Tales � Dead Tags Tell No Tales“ � Permanently deactivate tag at checkout � Hard Kill � Hard Kill � Cut tag antenna or „fry“ circuit � Soft Kill � Soft Kill Metro RFID De-Activator � Needs password to prevent unauthorized killing � Both Approaches Require Consumer Action � Also voids any post-sales benefits (returns, services, …) Also voids any post sales benefits (returns, services, …) 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 3

What about small businesses? Deactivation terminals? Password management? 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 4

Hypothesis What about small businesses? Consumers Will Forgo Their Privacy if it is Too Much Work to Maintain! Deactivation terminals? Password management? 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 5

Goal: Protecting RFID Readout Without Consumer Effort Goa : otect g eadout t out Co su e o t 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 6

Alternative: Shamir Tags [LaM2007] An Example for Zero-Managament Privacy Protection An Example for Zero-Managament Privacy Protection � Default: Tags Take Long Time To Read Out � Complicates Tracking & Unauthorized Identification � Bitwise release, short range (e.g., one random bit/sec) � Intermediate results meaningless, since encrypted � Decryption requires all bits being read � But: Known Tags Can be Directly Identified f � Allows owner to use tags without apparent restrictions � Initial partial release of bits enough for instant l l l f b h f identification from a limited set of known tags [LaM2007] Marc Langheinrich, Remo Marti: “Practical Minimalist Cryptography for RFID Privacy.” IEEE Systems Journal , Special Issue on RFID Technology, 1(1), December 2007. 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 7

Secret Shares (Shamir 1979) Polynomial of degree n can be described using at least n+1 points P 2 P 1 P 3 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 8

Secret Shares (Shamir 1979) P 2 P 1 P 3 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 9

96 bit EPC C d 96 ‐ bit EPC ‐ Code Secret s 011010111…1101 106 ‐ bit Shamir Share 111000011…101101 101101101…110111 101010011…101101 Shares h i 10 ‐ bit x ‐ value 96 ‐ bit y ‐ value 318 ‐ bit Shamir Tag 111000011101010001010111010101101010100…1010101110101 Shamir Tag g P 2 P 1 P 3 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 10

96 bit EPC C d 96 ‐ bit EPC ‐ Code Secret s 011010111…1101 106 ‐ bit Shamir Share 111000011…101101 101101101…110111 101010011…101101 Shares h i 10 ‐ bit x ‐ value 96 ‐ bit y ‐ value 318 ‐ bit Shamir Tag 111000011101010001010111010101101010100…1010101110101 Shamir Tag g 16 ‐ bit Reply Instant identification 111000011101010001010111010101101010100…1010101110101 Initial Reply of known items of known items +1 bit 111000011101010001010111010101101 0 10100…1010101110101 Time +1 bit +1 bit osure Over T 1110000111010100010101110101011010101 0 0…1010101110101 +1 bit 1110000 1 1101010001010111010101101010100…1010101110101 +1 bit +1 bit Bit Disclo 111000 0 11101010001010111010101101010100…1010101110101 +1 bit Unknown tags will 1110000111010100 0 1010111010101101010100…1010101110101 eventually be identified 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 11

Shamir tag challenge � Range vs. readability g y � If read range is too long, easy to read long enough � Ideal: very short range to force very close readout y g y 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 12

Shamir tag challenge � Range vs. readability g y � If read range is too long, easy to read long enough � Ideal: very short range to force very close readout y g y � But where is the tag located? But where is the tag located? � Short range: tag hard to find 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 13

Goal: make finding the (short range) tag easy � Idea: spread the Shamir shares across the item p � E.g., woven into the garment � No single locus of information g � „Super-distributed RFID tag infrastructures“ � [Bohn & Mattern 2004] [Bohn & Mattern 2004] � Sweep reader across surface � Effort aries � Effort varies with spatial distribution, ith spatial distrib tion # of different Shamir shares, Shamir threshold (shares needed) Shamir threshold (shares needed) 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 14

Multi-item identification � Problem: multiple overlapping polynomials p pp g p y Item? 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 15

Multi-item identification � Problem: multiple overlapping polynomials p pp g p y Item 1 Item? Item? Item 2 Item 2 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 16

Multi-item identification � Problem: multiple overlapping polynomials p pp g p y Item 1 Item 1 Item? Unable to differentiate Shamir shares from different items! Item? Item 2 Item 2 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 17

Separating Shamir polynomials � Use prefix? Makes tags trivial to track! p g � Idea: cluster Shamir shares to keep items apart � Allows separation if enough shares have been read Allows separation if enough shares have been read 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 18

Separating Shamir polynomials � Use prefix? Makes tags trivial to track! p g � Idea: cluster Shamir shares to keep items apart � Allows separation if enough shares have been read Allows separation if enough shares have been read Lagrange interpolation 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 19

Separating Shamir polynomials � Use prefix? Makes tags trivial to track! p g � Idea: cluster Shamir shares to keep items apart � Allows separation if enough shares have been read Allows separation if enough shares have been read Lagrange interpolation 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 20

Cluster methods for Shamir shares Grid ‐ based Line ‐ based � � Choose random grid Choose „random“ slope, origin dimensions and origin � Use points within known width � Select grid subset & use points Select grid subset & use points � � To detect: begin with random To detect: begin with random � To detect: Substractive point and find line (8 directions) Clustering Algorithm [Chiu‘94] � Repeat until all points assigned � Collisions: Detect larger clusters � Collisions: Line crossings 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 21

Evaluation � Unauthorized readout? Instant identification? � Traceability of bitwise released Shamir shares? � See [LaM2007] for details on both See [LaM2007] for details on both � Here: how well does item discrimination work? � Here: how well does item discrimination work? � And: how does clustering affect traceability? [LaM2007] Marc Langheinrich, Remo Marti: “Practical Minimalist Cryptography for RFID Privacy.” IEEE Systems Journal , Special Issue on RFID Technology, 1(1), December 2007. 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 22

Detection rates (item discrimination) � Using simulator, we ran 100 iterations of g � Generate 1-10 items with 400-800 tags each (Shamir threshold of 40-80% of tags) � Read 80-100% of all tags � Run clustering algorithm & note identification rates 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 23

Detection rates (simulation, 1-10 items) 100.00% 98.00% 98 00% 96.00% rate etection r 94.00% cluster 92.00% line De 90.00% 88.00% 86.00% 100% 90% 80% Percentage of Shamir shares read Percentage of Shamir shares read 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 24

Detection rates (simulation, 1-20 items) 100.00% 98 00% 98.00% 96.00% rate etection r 94.00% cluster 92.00% line De 90.00% 88.00% 86.00% 100% 90% 80% Percentage of Shamir shares read Percentage of Shamir shares read 11/26/2007 RFID Privacy using Spatially Distributed Shared Secrets 25