Contributors - CyberSecurity Malaysia

29.InternetRadio Frequency Identification (RFID)Hypertext Transfer Protocol Secure (HTTPS) is acombination of the Hypertext Transfer Protocol withthe SSL/TLS protocol to provide encryption and secureidentification of a web server. HTTPS connections are oftenused for payment transactions on the World Wide Web andfor sensitive transactions in corporate information systems.Web browsers typically use HTTP to communicate withweb servers, sending and receiving information withoutencrypting it. For sensitive transactions such as Internete-commerce or online access to financial accounts, thebrowser and server must encrypt this information.The main idea of HTTPS as shown in Figure 2 is to createa secure channel over an unsecured network. This ensuresreasonable protection from eavesdroppers and man-in-themiddleattacks, provided that adequate cipher suites areused and that the server certificate is verified and trusted.The administrator needs to create a public key certificatethat is signed by a trusted certificate authority for a webserver to accept the HTTPS connection. Web browsers aregenerally distributed with the signing certificates of majorcertificate authorities so that they can verify certificatessigned by them.Figure 3: RFID tagRadio Frequency Identification (RFID) is an emergingtechnology that brings enormous productivity benefitsin applications where objects have to be identifiedautomatically. RFID systems are used for automaticretrieval of data on goods, persons, animals and objects.The object is equipped with a small circuit, called an RFIDtag (Figure 3), and the information stored on the mediumcan be automatically retrieved by a reader device. This itemcan be used in industrial applications for tracking of goodsor in access systems.Figure 4: Some applications for an RFID system.Figure 2: HTTPS ConnectionTransport Layer Security (TLS) is a cryptographic protocolthat provides security for data integrity and confidentialitycommunications over open networks such as the Internet.TLS provides a protection which ensures that the datais both consistent and correct, in both client and serverapplications. Several versions of the protocol are widelyused in applications such as instant messaging, webbrowsing and E-mail. TLS is a standards track protocol,which means there are definite specifications of themethodology or technology applicable to the Internet.Transport Layer Security consists of two layers, the TLSRecord Protocol and the TLS Handshake Protocol. TheTLS Record Protocol provides connection security withencryption methods such as the Data Encryption Standard(DES). The TLS Record Protocol can also be used withoutencryption. The TLS Handshake Protocol generates secretkeys unique to each connection and allows the serverand client to authenticate each other and negotiate anencryption algorithm and cryptographic keys before datais exchanged.RFID systems do not require line-of-sight and work contacts.Data and energy are transmitted via radio frequency. EachRFID system consists of a tag, which is attached to theobject it identifies, and a reader, which is able to retrievedata from the tag. The reader may also be able to write oradd data to the tag’s memory. Additionally, to implementan application (Figure 4) on data received from the tags,a host is used. Host commands are converted into readerrequests and broadcasted via radio frequency. If a tag isinside the reader’s field, it sends a response. Tag responsescan be processed by the host corresponding to the currentapplication.It looks like RFID will be very popular technology in thenear future, leading people to think about its security andprivacy issues. Enhanced security always comes with extracosts. Although the industry claims low-cost tags, sooneror later the security issue has to be confronted in order tomake RFID an everyday technology. The implementation ofan authentication method for RFID systems using strongcryptography is very useful. The Advanced EncryptionStandard (AES) is used as a cryptographic primitive,because it is standardized and considered to be secure.e-Security | CyberSecurity Malaysia | Volume 21 - (Q4/2009)