On Mitigating Covert Channels in RFID-Enabled Supply Chains

1. School of Engineering and Applied Science Department of Computer Science University of Virginia, Charlottesville Virginia, USA Web: www.cs.virginia.edu On Mitigating Covert Channels in RFID-Enabled Supply Chains Kirti Chawla, Gabriel Robins, and Westley Weimer {kirti, robins, weimer}@cs.virginia.edu This work is supported by U.S. National Science Foundation (NSF) grant: CNS-0716635 (PI: Gabriel Robins) For more details, visit: www.cs.virginia.edu\robins

2. RFID Technology Overview Frequency Form Factor Type RFID Technology Parameters Tag/Transponder Reader Backend System Aerospace Chip Timing Supply Chain Components Some Applications

3. 02 / 21 Motivating Example – Supply Chains Factory Warehouse YOU Raw Materials Store Reduce Cost Enhance Competitiveness A Supply Chain

4. 03 / 21 Motivating Example – Supply Chains Adversary Supply Chain Market How ? Passive Competitiveness Active Competitiveness Target Supply Chain

5. 04 / 21 Supply Chain Attacks – Tag Tracking Tracked tag serves dual-purpose and is a source of covert channel Adversary Supply Chain

6. 05 / 21 Supply Chain Attacks – Tag Duplication Injected duplicated tag as source of covert channel

7. 06 / 21 Supply Chain Attacks – Tag Modification M Injected modified tag as source of covert channel

8. 07 / 21 User Specific Data USER Vendor Specific Data AFI Tag Capability TB TID ISO/IEC 15963 Class Identifier EPC NSI XPC RESERVED XPC_W1I EPC Number UMI PC Access Password EPC Length CRC-16 Kill Password Supply Chain Attacks – Tag Modification EPC Compliant RFID Tag Writeable banks conceal information Memory Layout of the RFID Tag #

9. 08 / 21 Supply Chain Attacks – Reader Compromise M C Compromised readers as source of covert channel C

10. 09 / 21 Evaluation I – Implications(1) Brand Loyalty Switch Post-attack scenario Pre-attack Scenario Attacks subtly persuading consumers to switch brands

11. 10 / 21 Evaluation I – Implications(2) Brand Aversion Pre-attack Scenario Post-attack scenario Attacks subtly persuading retailers to prefer brands

12. 11 / 21 Mitigating Approach – Model of Supply Chain Supply Chain 1. Item flow = tag flow 2. Multiple Phases 3. Flow verification Purchase Phase Production Phase Distribution Phase

13. 12 / 21 Mitigating Approach – Model of Supply Chain Phase Sink Global Source Global Sink C1 Phase Source C(Q, R) > 0 C2 C(P, Q) = 0 Q NMOF(A) = max(C1, C2) P A 1. Item flow = tag flow 2. Multiple Phases 3. Flow verification R C: E  + Purchase Phase: GUP Production Phase: GPP Distribution Phase: GDP

14. 13 / 21 Mitigating Approach – Taint Checkpoints How ? Supply Chain Flow Graph: G = GUP GPP GDP Taint Checkpoint 1. Item flow = tag flow 2. Multiple Phases 3. Flow verification GUP GPP GDP

15. 14 / 21 Mitigating Approach – Taint Check Cover Taint Check Cover TCC  NP Vertex Cover Polynomial Time Reduction VC P TCC NP-Complete Given a graph G and no. of taint checkpoints T, determine the existence of taint check cover: TCC  G, T GD GU

16. 15 / 21 Mitigating Approach – Heuristics(1) Use approximate algorithm of VC for TCC Time complexity: O(V+E) Solution size: 2OPT From the set of edges E, pick an arbitrary edge , save its endpoints and remove all edges from E that are covered by those endpoints GD

17. 16 / 21 Mitigating Approach – Heuristics(2) Algorithm dependent time-complexity Solution size: OPT to |V| Use cuts to partition graph • Cuts based on topology • Cuts based on flow properties • Random cuts GUP GPP GDP

18. 17 / 21 Mitigating Approach – Heuristics(3) (2) CER =  Use underlying business requirements (1) TNR = |VT| |V| • No. of taint checkpoints • Coverage Vs Efficiency Tradeoff Algorithm dependent time-complexity Solution size: OPT to |V| TNR, CER +, |V|  0 GUP GPP GDP

19. 18 / 21 Mitigating Approach – Local Verification Algorithm Verifying flow locally at every taint checkpoints • Check flag enables check for duplicate tags • Tag data verification enables check for modified tags GUP GPP GDP

20. 19 / 21 Mitigating Approach – Global Verification Algorithm Verifying flow globally along a path or at central site Heuristics combined with global verification enables check for compromised readers GUP GPP GDP

21. 20 / 21 Evaluation II – Cost • Supply Chain flow graph nodes = 2000 • No. of taint checkpoints = 10 to 1000 • Workload = 100 items per case  1000 cases per time interval Cost of solution Local verification time cost as a function of no. of taint checkpoints Local, and global (with constant and variable link cost) verification time cost as a function of no. of taint checkpoints

22. 21 / 21 Countermeasures to Covert Channels Suggested Countermeasures Passwords Pseudonyms Re-encryption Direct mitigation PUF

23. References • Hokey Min and Gengui Zhou, Supply Chain Modeling: Past, Present and Future, Journal of Computer and Industrial Engineering, Elsevier Science Direct, Volume 43, Issue 1-2, pp. 231-249, July 2002. • Rebecca Angeles, RFID Technologies: Supply-Chain Applications and Implementation Issues, Information Systems Management, 22:1, pp. 51-65, 2005. • David Molnar, Andrea Soppera and David Wagner, A Scalable, Delegatable Pseudonym Protocol Enabling Ownership Transfer of RFID Tags, Selected Areas in Cryptography, Ontario, Canada, 2005. • Daniel V. Bailey, Dan Boneh, Eu-Jin Goh and Ari Juels, Covert Channels in Privacy-Preserving Identification Systems, 14th ACM International Conference on Computer and Communication Security, Alexandria, Virginia, pp. 297-306, 2007. • Simson L. Garfinkel, Ari Juels and Ravi Pappu, RFID Privacy: An Overview of Problems and proposed Solutions, IEEE Security and Privacy, Volume 3, Issue 3, pp. 34-43, May 2005. • Aikaterini Mitrokotsa, Melanie R. Rieback and Andrew S. Tanenbaum, Classification of RFID Attacks, International Workshop on RFID Technology, Barcelona, Spain, pp. 73-86, June 2008. • Melanie R. Rieback, Bruno Crispo and Andrew S. Tanenbaum, RFID Guardian: A Battery-Powered Mobile Device for RFID Privacy Management, Lecture Notes in Computer Science, Springer, Volume 3574, pp. 184-194, July 2005. • Ira S. Moskowitz and Myong H. Kang, Covert Channels - Here to Stay, In 9th IEEE International Conference on Computer Assurance, pp. 235-243, July 1994.

24. References • Leonid Bolotnyy and Gabriel Robins, Physically Unclonable Function-Based Security and Privacy in RFID System, 5th International Conference on Pervasive Computing and Communications, New York, USA, pp. 211-128, March 2007. • Thomas H. Cormen, Charles E. Leiserson, Ronald L. Rivest and Clifford Stein, Introduction to Algorithms – Third Edition, MIT Press, Cambridge, 2009. • EPCGlobal, UHF C1 G2 Air Interface Protocol Standard, http://www.epcglobalinc.org/standards/uhfc1g2/uhfc1g2_1_1_0-standard-20071017.pdf • EPCGlobal, Tag Data Standards Version 1.4, Revision June 11, 2008, http://www.epcglobalinc.org/standards/tds/tds_1_4-standard- 20080611.pdf • Anylogic Professional 6, AB-SD Supply Chain Model Simulator, http://www.xjtek.com • Gildas Avoine, Cedric Lauradoux, and Tania Martin, When Compromised Readers Meet RFID, Workshop on RFID Security, Leuven, Belgium, 2009. • Mike Burmester and Jorge Munilla, A Flyweight RFID Authentication Protocol, Workshop on RFID Security, Leuven, Belgium, 2009. • Khaled Oua, and Serge Vaudenay, Pathchecker: A RFID Application for Tracing Products in Supply-Chains, Workshop on RFID Security, Leuven, Belgium, 2009. • A. Karygiannis, T. Phillips, and A. Tsibertzopoulos, RFID Security: A taxonomy of Risks, Conference on Communications and Networking in China (ChinaCom), Beijing, China, pp. 1-8, 2006.

25. Questions