RFID Technical Tutorial and Threat Modeling

Radio frequency identification (RFID) uses radio frequency signals to automatically identify objects. RFID is used to pay for gas without going into the store, in automobile immobilizer systems to prevent theft, in toll road systems to automatically pay tolls without stopping, in animal identification, in secure entry cards, and in the supply chain to manage the flow of pallets, cases, and items. Most media accounts of RFID are actually about one form of RFID, the electronic product code (EPC) system used by retailers to manage the supply chain. EPC has standardized chip designs and protocols that have enabled the mass production of low-cost passive RFID tags. EPC provides identification of the product to which the EPC tag is attached like a barcode, except that it can be read at a distance and does not require line-of-sight aiming. This technical tutorial is divided into three parts. Part I describes the RFID technology using EPC as an example. Part II discusses EPCglobal and retail RFID technology because the mass production of EPC tags is creating the largest RFID system that will have a long-term impact on society. The final part categorizes the different security threats to EPC and challenges to overcome.