RFID Fingerprints To Fight Tag Cloning

Bourdain writes with news out of the University of Arkansas, where researchers are looking for ways to combat counterfeit RFID tags. Passive tags typically wait for a reader to transmit a signal of the appropriate strength and frequency before sending their own transmission. The scientists found that the amount of power required to trigger this varies quite a bit from one tag to the next, especially when many different frequencies are sampled. This and other physical characteristics give the tag its own "fingerprint" that is independent of the signal information stored in its memory, which the researchers say will facilitate the detection of cloned tags.

Comments

Security enhancement at best

[Anonymous Coward]

If you can read the fingerprint, so can anyone...

So what's to stop a dedicated attacker from reading the fingerprint when they read the tag contents, and then devising a method to duplicate all the data?

An active tag might even be programmed to emulate the fingerprint characteristics.

Re:Security enhancement at best

[vojtech]

It just means the clone will have to be a bit more expensive.

Cloned tags aren't using the same cheap chips that the common passive tags do. An attacker can afford to carry batteries with him and make the tag completely locally powered. Then he has much more powerful electronics at his disposal and can simulate whatever frequency response the original tag had due to its cheap (few cents per tag) design.

This fingerprinting will do no more than to force the attacker to pay a few bucks more to create a clone.

Re:What's the point?

[cortesoft]

Crypto wouldn't work... the cloner doesn't have to break the encryption to copy the chip.

Imagine in this way.... you have an encrypted hard drive, and someone wants to pass off their hard drive as yours. They don't have to break the encryption... they can copy the drive byte for byte, and hand it to the person who if verifying that is the original. The person checking the data is the one who does the decrypting.

Are we actually fixing anything here?

[Anonymous Coward]

So... we're now looking into methods of physical authentication for digital authentication data that was intended to replace physical authentication?

Wouldn't it be easier (and cheaper) to go back a step?

Solving the wrong problem

[lhunath]

RFID tags are not security devices, they are hyped barcodes. They do not provide any authentication.

If you're worrying about your RFID tags being cloned for a malicious purpose, you are using them for the wrong thing.

Re:What's the point?

[AdamInParadise]

Encrypting a hard drive protects the confidentiality of its data. It does not prevent you from cloning the hard drive i.e. it does not protect the authenticity of the hard drive.

In many applications that use RFID tags, authenticity is much more important than confidentiality. Those researchers seem to propose a way to authenticate the RFID tag using its "fingerprint". What I'm saying is that a dynamic challenge-response scheme is much more practical and more reliable.

Crypto is not only about encrypting data.

Fingerprinting capability very limited.....

[jcochran]

given what the article says.

What they're measuring is the minimum power level that a given RFID will respond to. This opens up two major issues.

1. A database of the response curves is needed in order to uniquely identify the RFID chip in question.
2. Since the power received follows the inverse square law, one of the major advantages of an RFID chip is negated. Namely the ability to scan for it's presence without having to have exact location. They need to precisely control the distance from the RFID chip and the reader in order for that technology to work. And if they need that level of control, why not use a contact based technology?