Digital Forensics in Small Devices: RFID Tag Investigation

insert into rfid_db (Tag, Value, Date) VALUES
('E0040000E90A4301', '1000','17:19:51 02/07/2010');
insert into rfid_log (Tag, Date) VALUES ('E0040000E90A4301',
'17:19:51 02/07/2010');
Subsequently, the real tag (ID: E004000074251502) with value of $1500 will also be
inserted to the backend database on the Microsoft SQL 2005 Server. Afterwards, the
integrity check of the database files on the backend server will be performed, in order
to set up the baseline, with Tripwire Manager (TM) before initiating the attack case
scenario as TM can give the hash values in different types such as MD5, SHA, and so
forth. However, only MD5 hash values are the interest of this research. Once, the
integrity check report is captured and the database of TM will be updated. Hence, as
mentioned in the Section 3.2.8, the data map, the prototype of the commercial retail
stock management system setup will be completed in a trusted/known operation (see
Appendix 7 for the steps taken before the initial attack case scenario).
3.3.2 Data Generation or Attack Case Scenario
In order to deal with the problems relating to tag data leakage, traceability, tag
spoofing, cloning and the like in RFID technology of the retail BS environment (see
Sections 2.4 and 2.5 ), it is important to implement the tag-reader mutual
authentication and data encryption techniques (Kamoun, 2009; Li et al., 2009; Li &
Deng, 2007). Consequently, many researchers and organizations have previously
proposed variety of different mutual authentication protocols such as “lightweight
symmetric-key authentication protocol” proposed by Juels and Weis (2005),
“EMAP” (An Efficient Mutual Authentication Protocol) proposed by Peris-Lopez et
al., (2006), “One-Way-Reader-To-Tag” scheme proposed by EPCglobal (2010, p. 1),
“Tag-Reader-Mutual-Authentication-Scheme” proposed by Konidala et al., (2007),
just to name a few.
However, as a result of the generally low cost with limited resources; the
encryption methods used in security solution for usual computing environments
cannot be performed by the RFID tags (Li & Deng, 2007). Hence, the mutual
authentication protocol can be violated by the malicious attackers. For instance, Li
71