Disabling RFID tags with visible confirmation

Abstract

Existing solutions to protect consumer privacy in RFID either put the burden on the consumer or suffer from the very limited capabilities of today's RFID tags. We propose the use of physical RFID tag structures that permit a consumer to disable a tag by mechanically altering the tag in such a way that the ability of a reader to interrogate the RFID tag by wireless mean is inhibited. In "clipped tags", consumers can physically separate the body (chip) from the head (antenna) in an intuitive way. Such a separation provides visual confirmation that the tag has been deactivated. However, a physical contact channel may be used later to reactivate it. Such a reactivation would require deliberate actions on the part of the owner of the RFID tag to permit the reactivation to take place. Thus reactivation could not be undertaken without the owner's knowledge unless the item were either stolen or left unattended. This mechanism enables controlled reuse after purchase, making clipped tags superior to other RFID privacy-enhancing technologies.

Classifying RFID attacks and defenses

“…More precisely, for privacy and targeted security threats a broad range of technical solutions have been proposed, including killing or temporarily silencing tags, blocking access to unauthorized readers (Juels et al 2003;Rieback et al 2005), relabeling (Inoue and Yasuura 2003) or clipping (Karjoth et al 2005) tags, using pseudonyms (Juels 2004), distance measurements (Fishkin et al 2004) and encryption techniques (Kinoshita et al 2004;Fedhofer et al 2004).…”

ALGSICS — Combining Physics and Cryptography to Enhance Security and Privacy in RFID Systems

“…For example, the read-range could be limited by the kill command to 1 mm. By a modified antenna system, we mean both an antenna which changes its range (for example, via clipped tags as in [28]) or simply a system consisting of two antennas. The first antenna has a normal range and it gets disabled upon the tag receiving the kill command whereas the second antenna has a very short range and it is not affected by the kill command.…”

“…By changing-tag systems, we mean systems in which the tag or tags change physically. Examples are the works presented in [19,28] as well as [6]. The work in [19] is interesting in that they suggest to physically split the IDs of RFID tags.…”

“…Thus, ideas have been developed such as the kill com-mand 5 , the blocker tag [25,22] and similar blocking/proxy mechanisms [16,40]. More engineering oriented approaches have also been introduced such as the IBM clipped tags [28] or distance bounding protocols [33]. Finally, we have begun to see the development of techniques that take advantage of noise in the communication channel between reader and tag to camouflage their communication [8,9].…”

On the Practicality of UHF RFID Fingerprinting: How Real is the RFID Tracking Problem?

“…Although solutions that prevent a (clandestine) reader to communicate with tags at the physical layer exist (e.g., tag kill and sleep functions, Faraday cages, active jammers, and "clipped" tags [18]), the provided privacy comes at the price of tag functionality (e.g., the kill function permanently disables tags and therefore possible after-sales services or long-term deployments) or requires additional efforts (e.g., user interaction or extra hardware) that could make those solutions impractical and unattractive.…”