IoT Security Blog

Articles and Posts on IoT Security, Embedded Systems, and the Internet of Things

Unique characteristics are first step in identifying counterfeiting

Contributed by Joanne C. Kelleher

Engineering researchers at The University of Arkansas recently announced that they have developed a unique and robust method to prevent cloning of passive radio frequency identification tags. The technology, based on one or more unique physical attributes of individual tags rather than information stored on them, will prevent the production of counterfeit tags and thus greatly enhance both security and privacy for government agencies, businesses and consumers. These researchers have identified that the minimum power response at multiple frequencies is unique for each tag.

Other researchers have also identified ways to make RFID tags unique. The founders of Verayo use Physical Unclonable Function (PUF) technology which exploits the unavoidable integrated circuit fabrication process variations. The University of Exeter and QinetiQ are partnering on a project, recently discussed in this blog, to build products based on physical sciences research in the field of tailored electromagnetic materials made by studying the wings of butterflies.

But with all of these options for anti-cloning, counterfeit tags could still be produced. From an implementation standpoint, the big question is how can you tell these unique tags apart so you know when you have a counterfeit one?

For each business application you would need to have a database that stored all of the individual tag values that were determined when the tag was produced or put into production. When each tag was needed to be validated the unique value would have to be determined again and then compared to the value in the database. If a match was found then you would know that you have a good tag. If the match was not found, because the values are physically unique, then you have a counterfeit.

A similar lookup process would need to occur if you stored a unique identifier in the memory of each tag, except in this case you are looking for duplicate occurrences of a value rather then a missing value.

Having a database of valid values may work for some closed-loop applications, but could quickly become an issue when applied to a supply chain or logistics situation where the tags are read by multiple companies in an environment that may not have access to a centralized database.

Since some of these projects are in the early stages it isn’t clear yet how easily these unique physical characteristics could be identified outside of a laboratory environment and if the process could as fast as what is required when an RFID tag moves through a distribution center. We will have to wait and see.