Startup Designs Firewall to Ensure RFID Network Security

There are two main business risks associated with RFID networks, NeoCatena contends: that a tag's user data could be utilized to pass malware or viruses onto back-end systems, which could interrupt business processes or expose sensitive business data; and that RFID tags could be cloned, or their data manipulated, with the goal of defrauding an RFID-based transaction process. One example of the latter scenario would be if someone were to manipulate the data encoded to an RFID-based transit card to artificially add monetary value to the tag's data, then use the card to ride a transit system illegitimately.

To thwart that type of tag data manipulation, Grunwald says, the RF-Wall program would employ a digital signature to detect whether the information stored to a transit card's RFID tag was manipulated since it was last read. "The software calculates the signature when the ticket is handed out, and then again when it is being read [presented to a turnstile]," he says. "If the data on the card is not what it is supposed to be, then the signature won't match."

Most RFID tags used for transit applications contain the Mifare Classic chip, made by NXP Semiconductors. While the Mifare protocol uses a proprietary data-encryption method to protect tag data, two separate research teams have recently shown the ability to break the encryption algorithm (see NXP Announces New, More Secure Chip for Transport, Access Cards).

If the RF-Wall software were to detect something indicative of a virus or malware, Wolf says, or if the digital signature on a tag read did not execute as expected, the business processes that would normally allow a tag to be accepted—such as a green light on a portal reader in a supply chain, or the unlocking of a turnstile to allow a commuter passage to a transit system—would not occur. What's more, a rules engine within the software would trigger appropriate alerts to business managers.

According to Wolf, NeoCatena is working on making the RF-Wall appliance scaleable to support multiple readers. The device currently supports reader protocols used by most off-the-shelf RFID interrogators, he says. It may eventually also support EPCglobal's ALE protocol, which would enable end users to install the RF-Wall behind their RFID server or reader networking device—though such an architecture would leave the server or networking device vulnerable to attacks or viruses.

In addition, NeoCatena offers a software product known as RF-Manager, which runs on a server and manages a distributed cluster of RF-Wall appliances. The firm also provides companies an RFID security auditing service through an add-on software module that can run on the RF-Wall appliance. This audit software is intended to act as an early-warning system for companies when it detects tag data that could represent a threat to back-end data security, or to legitimate business processes.

NeoCatena says its auditing service can also help companies comply with such regulations as the Sarbanes-Oxley Act in the United States, Germany's Control and Transparency Act (KonTraG) and Publication Transparency Act (TransPuG), and similar laws in Europe, by detecting business risks in RFID-enabled applications.