Efficient Key Management System for Large-scale Smart RFID Applications

Abstract

Due to low-cost and its practical solution, the integration of RFID tag to the sensor node called smart RFID has become prominent solution in various fields including industrial applications. Nevertheless, the constrained nature of smart RFID system introduces tremendous security and privacy problem. One of them is the problem in key management system. Indeed, it is not feasible to recall all RFID tags in order to update their security properties (e.g. update their private keys). On the other hand, using common key management solution like standard TLS/SSL is too heavy-weight that can drain and overload the limited resources. Furthermore, most of existing solutions are highly susceptible to various threats reaching from privacy threats, physical attacks to various technics of Man-in-the-Middle attacks. This paper introduces novel key management system, tailored to the limited resources of smart RFID system. It proposes light-weight mutual authentication and identity protection to mitigate the existing threats. Keywords -RFID and Sensor Node Integration; Key Management System; Security and Privacy; Industrial Applications I. INTRODUCTIONThe emerging of smart RFID, which is the integration of sensor node to the active RFID system, has been seen as a prominent solution in various fields including industrial applications. Such pervasive computing technology introduces various advantages ranging from low cost, ease of centralized management, practical and comprehensive solution which covers the combination of tracking and sensor applications, to its flexibility to be deployed in large-scale system. Nevertheless, smart RFID system introduces tremendous security and privacy problems. One of them is the complex problem in large-scale key management system. Indeed, the enforcement of common key management solution like using standard Transport Layer Security (TLS/SSL) requires advanced resources including more memory storage, as well as more communication and computation overhead. Thus, it is infeasible for smart RFID system that associates to limited resources (i.e. limited CPU power, limited memory, limited battery/power, and low bandwidth/data-rate). On the other hand, enforcing manual key management solution by recalling all the RFID tags in order to update the security property (e.g. update the new private key) is infeasible to be applied in largescale and distributed system. Furthermore, most of existing solutions in key management system for wireless communication are highly susceptible to various security and privacy threats. For instance, an adversary may have chance to perform various techniques of Man-in-the-Middle attacks to compromise the key management system. In this case, an adversary may impersonate as legitimate devices in order to trick the legitimate RFID tag and RFID reader to reveal their sensitive information. In this regards, an adversary may reveal the privacy ranging from the location information, data applications, to the most critical information like security properties (e.g. the private key).

Investigation and Penetration of Digital Attacks on Zigbee-Based Iot Systems

“…The following were examples of organizational policy rules [1], [2]. Prevention with authentication techniques and access control could be seen from examples [3]- [9]. Then, monitoring and detection could be adopted through methods [10]- [21].…”

Anomaly Detection in Zigbee-Based Iot Using Secure and Efficient Data Collection

“…A security system in general can be implemented through three stages, namely organizational policy rules, prevention with authentication and access control techniques, monitoring and detection. This study cited some examples of organizational policy rules from Mohammad [1] and Sadikin [2], and several examples of prevention with authentication techniques and access control from Sadikin and Mkyas [3]- [9]. The monitoring and detection was adopted from the previous research [10]- [21].…”

Intrusion Detection System for Zigbee-Based Iot Using Data Analysis Rules

“…Following are examples of organizational policy regulations [1], [2]. Examples [3]- [9] illustrate the use of authentication and access control techniques for prevention purposes. The monitoring and detection methods [10]- [21] can then be utilized.…”