Trust and Security in RFID-Based Product Authentication Systems

Abstract

Abstract-Product authentication is needed to detect counterfeit products and to prevent them from entering the distribution channels of genuine products. Security is a critical property of product authentication systems. In this paper, we study trust and security in RFID-based product authentication systems. We first present a formal definition for product authentication process and then derive the general chain of trust as well as functional and nonfunctional security requirements for product authentication. Most of the scientific literature that covers the topic focuses on cryptographic tag authentication only. This paper, however, provides a broader view including also other known approaches, most notably location-based authentication. To derive the functional security requirements, we employ the concept of misuse cases that extends the use case paradigm well known in the field of requirements engineering. We argue that the level of security of any RFIDbased product authentication application is determined by how it fulfills the derived set of functional and nonfunctional requirements. The security of different RFID-based product authentication approaches is analyzed. To study how RFID supports secure product authentication in practice, we investigate how the current EPC standards conform to the functional security requirements of product authentication and show how the unaddressed requirements could be fulfilled. The benefits of implementing a service that detects the cloned tags in the level of the network's core services are identified.Index Terms-Product authentication, product codes, radio frequency identification (RFID), security, system analysis and design.

An Anti-pattern for Misuse Cases

“…Pauli and Xu give "impersonate user" as a misuse case for "enter appointment," which is mitigated by "recognize user," in a health-care system [11]. Lehtonen, Michahelles, Fleisch give "theft from internal IT" as a misuse case for "tag authentication," which is mitigated by "secure internal IT system," in the RFID context [8].…”

A scientific evaluation of the misuse case diagrams visual syntax

“…All subjects were required to consider two systems; a RFID-based product authentication system [31] (Figs. 9 and 10) and a Swiss portfolio management company system [46] (Figs.…”

“…It is beneficial not to use diagrams that were created by the authors in order to prevent bias. The misuse case diagrams from [46,31] were selected for this experiment as they represent real systems, consequently reducing the external threat to validity. The diagrams were slightly edited for two purposes: (a) to ensure that each diagram contains the Table 9 The dependent variables and their corresponding hypotheses.…”

Low-cost authentication protocol for passive, computation capable RFID tags

“…The reduction in cost and effort to perform product identification is the most prominent advantage of RFID technology in contrast to barcodes [3]. The technology is also considered to extend the superior identification capabilities of RFID to provide product authentication.…”