Due to low-cost and its practical solution, the integration of RFID tag to the sensor node called smart RFID has become prominent solution in various fields including industrial applications. Nevertheless, the constrained nature of smart RFID system introduces tremendous security and privacy problem. One of them is the problem in key management system. Indeed, it is not feasible to recall all RFID tags in order to update their security properties (e.g. update their private keys). On the other hand, using common key management solution like standard TLS/SSL is too heavy-weight that can drain and overload the limited resources. Furthermore, most of existing solutions are highly susceptible to various threats reaching from privacy threats, physical attacks to various technics of Man-in-the-Middle attacks. This paper introduces novel key management system, tailored to the limited resources of smart RFID system. It proposes light-weight mutual authentication and identity protection to mitigate the existing threats.
Keywords -RFID and Sensor Node Integration; Key Management System; Security and Privacy; Industrial Applications
I. INTRODUCTIONThe emerging of smart RFID, which is the integration of sensor node to the active RFID system, has been seen as a prominent solution in various fields including industrial applications. Such pervasive computing technology introduces various advantages ranging from low cost, ease of centralized management, practical and comprehensive solution which covers the combination of tracking and sensor applications, to its flexibility to be deployed in large-scale system. Nevertheless, smart RFID system introduces tremendous security and privacy problems. One of them is the complex problem in large-scale key management system. Indeed, the enforcement of common key management solution like using standard Transport Layer Security (TLS/SSL) requires advanced resources including more memory storage, as well as more communication and computation overhead. Thus, it is infeasible for smart RFID system that associates to limited resources (i.e. limited CPU power, limited memory, limited battery/power, and low bandwidth/data-rate). On the other hand, enforcing manual key management solution by recalling all the RFID tags in order to update the security property (e.g. update the new private key) is infeasible to be applied in largescale and distributed system. Furthermore, most of existing solutions in key management system for wireless communication are highly susceptible to various security and privacy threats. For instance, an adversary may have chance to perform various techniques of Man-in-the-Middle attacks to compromise the key management system. In this case, an adversary may impersonate as legitimate devices in order to trick the legitimate RFID tag and RFID reader to reveal their sensitive information. In this regards, an adversary may reveal the privacy ranging from the location information, data applications, to the most critical information like security properties (e.g. the private key).