A comprehensive taxonomy of security and privacy issues in RFID

Abstract

Internet of things (IoT) is made up of many devices like sensors, tags, actuators, mobile devices, and many more. These devices interact with each other without human interaction. Radio-frequency identification (RFID) devices are used to track people, assets, objects, etc. Along with the small memory capacity and low-power battery issues, these devices suffer from various security-related issues. These security threats include attacks such as replay, disclosure, tracking, offline guessing, denial of service attacks, and many more. In the last few decades, the researchers have suggested various security approaches to overcome these vulnerabilities. Hence, this paper discusses various possible attacks that can occur on an RFID system, and several security schemes that have been proposed to handle these attacks. First, the works presents the architecture of IoT in detail. Second, all possible attacks are described by categorizing them into confidentiality, integrity, and availability. Then, taxonomy of various security schemes, to deal with these attacks, is discussed under the criteria cryptography approaches, privacy, authentication, authorization, and availability. Finally, the paper describes various issues and challenges to have a better understanding of scope of the future research in the field of RFID security.

Challenges, Applications, and Future of Wireless Sensors in Internet of Things: A Review

“…Numerous efforts are being made to solve the security and privacy issues in WS nodes. Radio Frequency Identification (RFID) and new 5G standards are aiming to solve the privacy concerns at hardware level [121], [122]. Whereas, at software level blockchain and key management systems are proving to be effective solutions against security threats [123], [124].…”

Internet of Things Security Requirements, Threats, Attacks, and Countermeasures

“…It is an attempt to block tag's interaction with the corresponding reader by making tags impractical to be read, and hence, it is indispensable to ensure that RFID tags are not destroyed with an unlawful parity [124] Users or objects authentication [125] Near-Field Communication (NFC) (continued) Secure channel (authentication and encryption) [44] Relay S3, S4, S6, S7 Attackers redirect the calls from the readers of object to a malevolent one and replay backward its reply rapidly [126]. It severely relies on the implementation of the application protocol data unit instructions (ISO/IEC1443) Timing [127], distance bounding of cryptographic challenge-response couples [128] Man in the middle (MITM) S4, S6, S7 Adversary can capture the data, alter and send it to malevolent things in close vicinity making such attacks very complicated, encryption methods also make it difficult to succeed if they are fulfilled correctly [129] A secure channel between the NFC objects Data corruption All An attacker possesses the ability to disrupt communication channels between NFC-armed IoT devices by altering the transmitted data to be unreadable leading to a denial of services attack [130] The discovery of RF spheres throughout the communication of data [44] Data modification All An attacker possesses the ability to attacker modify the content of communicated data between NFC-armed IoT devices [131] Channel securing, Baud rate adjustment, constant checking of RF arena [44] (continued) An attacker attempt to inject some information into transmitted data when the NFC-armed device needs a long time to reply [130] Immediate entities response, securing the channel between two entities [130] Bluetooth Bluesnarfing All An attacker seeks to gain unlawful access to Bluetooth devices with the aim to capture their information and forward the incoming requests to another device [49] Setting mobiles on non-ascertainable style [49], keep on disconnected [64], validate next transmission BlueBugging All An adversary might use some weaknesses in legacy firmware to get into the victim's device to eavesdrop on phone calls, messages, emails, and link up to the internet without the awareness of the owner [49] Updating software and firmware, apply signatures to RF signals [132] Bluejacking S1, S2, S7, S10 An attacker can exploit the ability to transmit a radio business card to send an assault card; nonetheless, this necessitates the attacker to be very close i.e., within 10 m from the victim's device [49] Non-ascertainable style [49], keep on disconnected…”

Using a hybrid encoding method based on the hexagonal resonators to increase the coding capacity of chipless RFID tags

“…While active tags are powered by batteries, passive ones use the electromagnetic waves radiated by the reader, and semiactive tags use both of these sources. [19][20][21] Although active tags can communicate over longer distances (hundreds of meters) compared with passive ones (accessible only from distances of a meter or two), passive tags are lighter, smaller, and by far more economically feasible. 22,23 Moreover, while active tags have limited lifespans, passive tags can operate for practically unlimited periods of time.…”

“…RFID tags can be divided into active, semi‐active, and passive types based on their power source. While active tags are powered by batteries, passive ones use the electromagnetic waves radiated by the reader, and semi‐active tags use both of these sources 19–21 . Although active tags can communicate over longer distances (hundreds of meters) compared with passive ones (accessible only from distances of a meter or two), passive tags are lighter, smaller, and by far more economically feasible 22,23 .…”