RFID in the retail industry rapid development at the same time, but also exposed its own existence of a variety of security defects, resulting in security risks (such as hacker attacks, information leakage and privacy issues, etc.) will seriously limit the development of RFID, restricting the large-scale popularization of RFID.
Radio Frequency Identification Technology (RadioFrequencyIdentification, RFID) is a synthesis of automatic identification technology and radio frequency communication technology applications, its application and development will involve and affect all aspects of society, life, economy and military, but also cause logistics, retail and many other areas of the Radical change.
1.The reality of RFID applications
As one of the world’s largest retailers Metro Group, in all of its Cash&Carry brand wholesale stores throughout Germany formally enabled the second generation of RFID facilities, including Intermec’s second-generation IF5UHFRFID readers and IBM’s middleware.
RFID in the retail industry’s rapid development at the same time, but also exposed its own existence of a variety of security flaws, resulting in security risks (such as hacker attacks, information leakage and privacy issues, etc.) will seriously limit the development of RFID, restricting the large-scale popularization of RFID.
In fact, RFID is not a new technology, as early as twenty years ago, RFID technology has been applied to advanced areas such as missile tracking and long-distance detection. As the cost of radio components continues to fall, RFID began to be applied to general business and industry.
As RFID has attracted the attention of more and more retailers, many industry leaders have begun to use the technology, but the security of RFID is easily overlooked. A safe and reliable RFID system needs to ensure that the tag information can only be accessed by authorized users, protect against all kinds of external attacks on the RFID system, and prevent illegal users from illegally tampering with and falsifying the tag information, among other things.
2. The front-end system of RFID is mainly divided into 3 parts
2.1 Tag
Located on the object to be labeled, a unique code and its related information will be stored in its circuit. Due to the tag’s electronic components are generally very small in size, so the tag can be packaged flexibly with a variety of materials.
2.2 Reader
Is to read and write the tag equipment, it through the antenna to the tag to send radio waves, the tag will be activated. Label’s built-in circuitry is activated, will be in accordance with the predetermined procedures for its own information contained in the radio signal back to the reader.
2.3 Antenna
Responsible for transmitting and receiving radio signals to activate the tag and read and write the information on the tag, as a communication bridge between the tag and the reader.
3. RFID security problems
Retail is an important direction of RFID technology application, fast and convenient RFID technology can enable retailers to have an efficient supply chain and logistics management system, to enhance the retailer’s core competitiveness, but RFID there are many security problems.
RFID security and privacy issues are more and more attention by the industry, its importance in the development process of RFID is also becoming more and more obvious, and now there are already many solutions for RFID security and privacy issues, and has achieved certain results. For example: EPCglobal launched the second generation of UHF protocol standards, not only provides a password protection, but also can be encrypted in the process of data transmission from the tag to the reader.
But in many other aspects there are still many problems to be solved, such as whether RFID will become a new target for hackers, whether it will be infected with viruses, whether the tag can be designed to better encryption algorithms, in order to achieve the best balance between confidentiality and performance, etc., these security risks need to be resolved urgently.
4. Difficulty 1: Can privacy be protected
In theory, anyone can remotely access and track the contents of a consumer’s handbag with an RFID device. In response to this privacy issue, EPCglobal, which is committed to promoting RFID electronic product standards, has developed a new standard that includes a “Kill” command, which makes RFID tags second-generation tags. By using the “Kill” command, RFID tags can be rendered non-functional so that readers cannot read the data inside the tags.
However, the “Kill” command is an irreversible operation, and once it is run, the tag is immediately invalidated. In this case, when consumers return to return, RFID tags will not be read out, and tags can not be recycled reuse.
For this situation, IBM has developed a “cut tag” (ClippedTag) technology, consumers will be able to RFID antenna pull off or scrape, so that RFID tags can not be read at will. The use of “clipped tag” technology, although the antenna can no longer be used, but the RFID reader is still able to read the tag content directly.
RSA Labs researchers have come up with a new technology, blocking tags, which is an inexpensive and effective solution to some of the privacy and security concerns associated with RFID technology. The solution uses blocking tag technology to simulate all possible tag serial numbers, which can be programmed to block a portion of the numeric information in the RFID serial number.
5. Difficulties two: interference signal reading
In the real application scenario, there may exist RFID signal conflict area, that is to say, in the region of RFID tags can be read by more than one reader at the same time.
Imagine, if in this case the requirements of the label can only be read by one of the specific reader, then there will be a great security risks.
At this point it is necessary to use active jamming solution, active jamming is a user can actively use the broadcast jamming signal device, used to interfere with the surrounding legitimate RFID system, the purpose is to protect a specific RFID tag can be read by a specific reader.
6. Difficulty 3: Eavesdropping from Man-in-the-middle
In RFID deployment, denial-of-service attacks, man-in-the-middle attacks, and other cyber-attacks may seriously affect the service performance and reduce the confidentiality of the information. hash locks are the controllers of the communication access between the RFID tags and the readers, and general hash locks are unable to solve the problems of location privacy and man-in-the-middle attacks.
Hash lock is divided into fixed read control Hash lock method and random read control Hash lock method. In the fixed read control hash lock method, the RF tag acts only on the authorized reader and it represents an authentication process with a fixed authentication key.
This is only a low cost solution to security and privacy issues, but it does not prevent tracking and the random key and tag ID can be eavesdropped.
To avoid tracking, the response of RF tags cannot be predicted but is random. This method is not suitable for a large number of RF tags because an authorized reader recognizing one RF tag needs to search and calculate the IDs of all tags.
Improvements have been made to the random read control hash lock method to avoid the defects of human attack and malicious tracking in the fixed read control hash lock method and to overcome the shortcomings of excessive computational load in the random read control hash lock method.
7. The expert view
The standard decides the security
Unisys global visualization business department vice president PeterRegen
RFID in the standard question, the industry has for the low-frequency and the high-frequency RFID system formulated the standard quite well, but most of the enterprises want to use in the supply chain the ultra-high-frequency technology (UHF), the UHF radio frequency is able to read the electronic label in the 20-foot range, but this kind of technology Only in recent years has come out, the relevant standard is still revising.
For example, the International Organization for Standardization (ISO) is working on the development of the supply chain using high RFID tags (ISO18000-3) and UHF RFID tags (ISO18000-6) to track goods standards.
In addition, in the past, many RFID systems are based on proprietary technology, “closed system”, so unless the two companies are using the same manufacturer’s RFID equipment, or they may not be in the transportation of goods RFID collaboration, but with the global supply chain has become the trend, RFID needs to be towards open, universal standards of the The direction of progress.
In some important aspects, RFID in 2005 made a breakthrough development, such as “the second generation of passive RFID standard” (Gen2PassiveRFIDStandard) the completion of the high security standards can be passed in the world, widely adopted by different industries.
Enterprises adopting RFID technology will have an impact on their operation mode, risk management, supply chain management, human resources support, etc. Therefore, it is a more practical and reliable way to entrust a technical service and consultant company with rich experience to assist in building their RFID system.
8. The Bottom Line of RFID Security
Chengdong Xu, RFID Technology Specialist, Intermec China
Standard EPC tags have tamper-proof security protection, and standard communication protocols include data encryption requirements and require a secure connection between the tag and reader before data transmission, which makes tampering with the EPC code very difficult.
The need to protect customer privacy by deactivating the tag so that the data in it can never be read out again is a demand from the retail and FMCG industries, so this follows the need for authentication applications to prevent unauthorized or accidental deactivation of the tag.
Extensions of security from the standard Gen2 product can be achieved in a number of ways, with a “shell” feature that allows the tag to communicate only with authorized readers. The reader must provide a password before the tag can respond to a communication request, and the same applies to writing data or deactivating the tag.
Newer applications, such as batch or expiration date tracking, may take advantage of Gen2’s data content flexibility. Additional data does not automatically receive the same security protection as the EPC number originally written, so the user must take appropriate measures to protect and validate the data.
It is necessary to verify that the additional data written to the tag is protected. Data appended to the tag can also be password protected to ensure that they can only be read by authorized partners or internal users. Write-protection and password-protection are not standard features and are not available on all Gen2 tags.
9. Frequently Asked Questions
9.1 What are the biggest security risks of RFID technology?
The main risks include:
- Data interception (eavesdropping via radio signals).
- Cloning/counterfeiting (copying RFID tag data).
- Unauthorized tracking (privacy invasion through surreptitious scanning).
- Denial-of-Service (DoS) attacks (jamming or disabling RFID systems).
9.2 Can RFID tags be hacked? How?
Yes, common hacking methods include:
- Skimming: Using portable readers to steal data from unprotected tags.
- Replay attacks: Capturing and re-transmitting RFID signals to impersonate valid tags.
- Side-channel attacks: Exploiting power fluctuations or timing delays to extract encryption keys.
Solution: Use encrypted RFID tags (e.g., AES-128) and secure authentication protocols.
9.3 How can businesses mitigate RFID security risks?
Key strategies:
- Encryption: Deploy RFID tags with built-in encryption (e.g., ISO 29167).
- Access control: Restrict RFID reader permissions and use mutual authentication.
- Shielding: Use Faraday cages or RFID-blocking materials for sensitive tags.
- Regular audits: Monitor systems for unusual activity or vulnerabilities.
9.4 Does RFID pose privacy risks for consumers?
Yes, especially with unprotected UHF tags (e.g., in retail or passports). Risks include:
- Location tracking without consent.
- Exposure of personal data (e.g., credit card info in RFID-enabled wallets).
Protection: Consumers can use RFID-blocking sleeves or demand tag deactivation post-purchase.
9.5 Will security issues prevent RFID from becoming mainstream?
Not necessarily—while security concerns slow adoption, advancements like:
- Blockchain-integrated RFID (for tamper-proof records).
- EPC Gen2v2 tags (with enhanced encryption).
- AI-driven anomaly detection.
…are addressing these constraints and driving wider use.