NFC Equipped Smartphones

Transcription

1 NFC Equipped Smartphones A two-edged sword for library RFID systems VALA Conference NFC equipped Smartphones NFC Card Emulation Mode Near Field Communications n A form of RFID contactless communications n Built in to most modern Smartphones n Has three modes n Card Emulation mode n Reader / Writer mode n Peer to Peer mode NFC Card Emulation Mode NFC Card Emulation Mode 1

2 NFC Peer to Peer Mode NFC Peer to Peer Mode NFC Peer to Peer Mode NFC Peer to Peer Mode NFC Peer to Peer Mode NFC Reader / Writer Mode smart poster 2

3 NFC Reader / Writer Mode smart poster NFC Reader / Writer Mode smart poster Standards - Hardware & Comms ISO standards and NFC n ISO designed for close operation 2 cm or so n ISO used in library RFID 70 cm or so n ISO used to format tag data & item security What has changed for library RFID? n NXP is largest manufacturer of NFC controllers n Decided to include support for ISO n Potential for longer read range applications n ISO supported in reader / writer mode n Apps have begun to appear using this capability NFC Reader / Writer Mode library NFC Reader / Writer Mode library 3

4 NFC Reader / Writer Mode library NFC Reader / Writer Mode library What has changed for library RFID? n People have always been able to do damage n Would need to source hardware ebay etc n Would need to understand RFID technology n Would need some appropriate software n Incidents would be isolated to specific libraries What has changed for library RFID? n The threat context has changed n Millions of users now have RFID hardware n Only takes one person to write an app n International distribution of apps is rapid n Incidents may not be isolated to a single library What has changed for library RFID? n Potential threats include: n Changing the item s security status Standards Physical Item Security Application Family Identifier Value Description C2 Circulating Item 07 On Shelf Item n ISO uses the tag s AFI for security n AFI is contained in the system memory of the tag n ISO has assigned C2 to represent items on loan n The generic code 07 is assigned for in-house usage 24 4

5 What has changed for library RFID? n Potential threats include: n Changing the item s security status n Locking the security status (denial of service) n Overwriting the library data on the tag n Deleting & locking user memory (denial of service) n Threat evaluation needs to be reassessed Smartphone Chip Apple iphone 5 None N N Google Nexus 4 BCM2079 Y Y HTC One X/XL NXP PN65 Y Y LG Optimus G NXP PN65 Y Y Motorola Droid Razr NXP? Y? Nokia Lumia 920 NXP PN544 Y Y Samsung Galaxy Note II NXP PN65 Y Y Samsung Galaxy S 3 NXP PN65 Y Y Samsung Galaxy S 4 BCM2079 Y Y Sony Xperia S NXP PN65 Y Y NFC Apps 5

6 6

7 NFC Apps 7

8 NFC TagInfo NFC Apps 8

9 icarte Reader NFC icarte for iphone 4 & 5 icarte Reader icarte Reader Determined by the threat assessment: Not all RFID tags have the same features n Need to protect some or all ISO data n Need to protect the integrity of the AFI value or must use a different item security system n Don t lose the interoperability benefit of ISO n At least four types of RFID tag chips in libraries n Texas Instruments Tag-It n ST Microelectronics n NXP SLI n NXP SLIX 9

10 Mitigation strategies Mitigation strategies Data protection Data protection All tags? Lock memory Encrypt data ISO compliant? ISO compliant? All tags? Lock memory Encrypt data ISO compliant? ISO compliant? SLIX-S tags Password data ISO compliant? Mitigation strategies Mitigation strategies Data protection Lock UID Item Security All tags? What to lock Lock all data All tags? Use EM system ISO compliant? Lock whole tag When to lock? New items Existing items Mitigation strategies Mitigation recommendations (1) Item Security Data protection All tags? Use EM system ISO compliant? New items Specify NXP SLIX RFID tags Lock all data objects except content parameter SLIX tags EAS password ISO compliant? AFI password ISO compliant? Existing items Assessment Lock whole tag Lock all objects except content parameter 10

11 Mitigation recommendations (2) Threat assessment Item security New items Existing items Specify NXP SLIX RFID tags Supplier discussions Assessment Passworded EAS n Should be done by individual organisations n Should consider current & future trends n Should be balanced by interoperability requirements n Cost of response should reflect perceived risk level NFC Equipped Smartphones A two-edged sword for library RFID systems VALA Conference