Secure Ownership and Ownership Transfer in RFID Systems

Radio frequency identification (RFID) is an upcoming technology with a large potential, but it also introduces a number of threats. Ownership transfer has been introduced to mitigate the risks which are caused by changes in ownership of RFID tags. We present formal definitions for ownership and ownership transfer in RFID systems and their secure variants. These definitions can be used to verify the correctness of ownership transfer protocols. We apply our definitions to existing RFID protocols, exhibiting attacks on desynchronisation resistance, secure ownership, exclusive ownership and secure transfer. We design an ownership transfer protocol using public-key cryptography which satisfies all our requirements. We also design a second protocol using shared-key cryptography which has led to an interesting observation concerning exclusivity of ownership.