KWAME NKRUMAH UNIVERSITY OF

SCIENCE AND TECHNOLOGY

COLLEGE OF ENGINEERING
DEPARTMENT OF COMPUTER ENGINEERING
COURSE TITLE: SECURED NETWORK SYSTEMS

COURSE CODE: COE

TOPIC: SECURITY AND PRIVACY IN RFID AND APPLICATION IN

TELEMEDICINE

GROUP MEMBERS: GILBERT DANSO - 3201614

AWORTWE HARUNA – 3201414

OKODJI THOMPSON NNAMDI - 3202614

30th April, 2017

Tile page………………………………………………………………………………………………….i
Abstract……………………………………………………………………………………………………………………………………………………ii

Table of content………………………………………………………………………………………………………………………………....…iii

SECTION 1 ..................................................................................................................................................... 3
INTRODUCTION ......................................................................................................................................... 3
SECTION 2 ..................................................................................................................................................... 4
RADIO FREQUENCY IDENTIFICATION SYSTEM .......................................................................................... 4
SECTION 3 ..................................................................................................................................................... 8
APPLICATIONS OF RFID IN TELEMEDICINE ................................................................................................ 8
SECTION 4 ..................................................................................................................................................... 9
PROPOSE RFID APPLICATION FOR OSEI TUTU (KNUST) HOSPITAL COMPLEX .......................................... 9
SECTION 5 ................................................................................................................................................... 12
SECURITY AND PRIVACY ISSUES AND SOLUTIONS .................................................................................. 12
SECURITY AND PRIVACY THREATS .......................................................................................................... 13
SECTION 5 ................................................................................................................................................... 15
CONCLUSION........................................................................................................................................... 15
RECOMMENDATION .................................................................................. Error! Bookmark not defined.
ABSTRACT
Radio frequency identification systems are used in many applications in manufacturing, supply
chain management, inventory control, and telemedicine and healthcare delivery. We propose two
RFID applications in telemedicine: studying supply and demand of doctors, nurses, physicians
and patients in hospitals and healthcare, and developing mobile telemedicine services. The
security and privacy issues of RFID, and their solutions are discussed in detail.

1
2
 SECTION 1
INTRODUCTION
Radio frequency identification (RFID) systems can identify an object or a person .RFID data
transfer occurs with the connection between a tags also called transponders and a reader (also
called interrogators) over a wireless interface. Data within a tag may provide identification for an
item in manufacture, goods in transit and a location, the identity of a vehicle, an animal or
individual. By including additional data the prospect is provided for supporting applications
through item specific information or instructions immediately available on reading the tag. For
example, the colour of paint for a car body entering a paint spray area on the production line, the
set-up instructions for a flexible manufacturing cell or the manifest to accompany a shipment of
goods. A system requires, in addition to tags, a means of reading or interrogating the tags and
some means of communicating the data to a host computer or information management system.
A system will also include a facility for entering or programming data into the tags, if this is not
undertaken at source by the manufacturer. Quite often an antenna is distinguished as if it were a
separate part of an RFID system. While its importance justifies the attention it must be seen as
feature that is present in both readers and tags, essential to understand and appreciate the
capabilities of RFID systems it is necessary to consider their constituent parts. It is also
necessary to consider the data flow requirements that influence the choice of systems and the
practicalities of communicating across the air interface. By considering the system components
and their function within the data flow chain it is possible to grasp most of the important issues
that influence the effective application of RFID. However, it is useful to begin by briefly
considering the manner in which wireless communication is achieved, as the techniques involved
have an important bearing upon the design of the system components.
RFID has been applied in telemedicine which employs wired or wireless communications to
provide medical information and services. Sanraku Hospital, a 270-bed hospital in Tokyo,
collaborated with Bay Nexus as part of an effort to better manage its medical equipment. It
started with needles. Using a handheld reader with RFID tags in patient wristbands, drugs are
matched with prescription information in electronic medical records. The information can be
accessed by scanning a bar code on the bottle and reading the patient’s ID number coded into the
RFID tag on the patient’s wristband. It also links to the hospital’s injection drug inventory and
traceability system. One way Texas Health Harris Methodist Hospital is also using RFID tags
deployed to patients and staff is to trace people who come into contact with patients with a
contagious potentially dangerous infection such as TB. There is a mission control team who can
crunch data generated by RFID tag scanners to inform people who need to be screened. Again
the RFID systems can be used to cater for medicine and hospital equipment, trace critical care
assets, and aid doctors and nurses to manage tabs on their patients frequently and remotely.

However, there are risks of obtaining secret and confidential information without permission,
consumer/personal privacy validation, and location privacy. Security and privacy are two
important issues RFID systems seek to cure. Tags being used are vulnerable to eavesdropping,
traffic analysis, spoofing, relay Attack (also known as Cloning or denial of service). This allows
unauthorized users to scan tags by eavesdropping on the wireless RFID channel. The unprotected
access to data on the tag might reveal private information if it is stored on the tag. For instance,
dishonest persons could replace the RFID tag on an item to get a cheaper price when checking
out from a supermarket .Currently, the RFID systems in used have not adopted cryptography due
to limited resources. High security RFID systems should have the ability to guard against the
3
security and privacy threats associated with the usage of the system. RFID tags are subject to
clandestine scanning, privacy in the data and thirdly access control achievement but they are
highly mobile and contain sensitive personal information. The most challenging issue is that tags
are highly resource constrained, and therefore cannot support strong cryptographic primitives,
tamper-resistant packaging, and other security enhancing features. In this study we first provide a
brief introduction to RFID. Then two applications of RFID in telemedicine are proposed:
studying supply and demand of doctors, nurses, and patients within the healthcare facilities and
developing mobile telemedicine services. Finally, we present a discussion on security and
privacy issues of RFID, and their solutions.

SECTION 2
RADIO FREQUENCY IDENTIFICATION SYSTEM

An RFID system uses wireless radio communication technology to uniquely identify tagged
objects or people. There are three basic components of an RFID system,
1. A tag (commonly refer to as transponder), which is comprised of a semiconductor chip,
an antenna, and possibly a battery
2. An interrogator (another name reader or a read/write device), which is an antenna, an RF
electronics module, and a control electronics module composition
3. A controller (sometimes called a host), which usually assumes a form of a PC or a
workstation running database and control (often called middleware) software

The tag and the interrogator share information between one another via radio waves. When a
tagged object gets to the read zone of an interrogator, the interrogator signals the tag to transmit
its stored data. Tags may be able to hold many kinds of information about the objects they are
attached to, including serial numbers, time stamps, configuration instructions, and much more.
Once the interrogator has received the tag’s data, that information is relayed back to the controller

4
via a standard network interface, such as an Ethernet LAN or even the internet. The controller can
then use that information for a variety of purposes.

1. RFID TAGS
The basic function of an RFID tag is to store data and transmit data to the interrogator. Basically
a tag consists of an electronics chip and an antenna encapsulated in a package to form a usable tag,
such as a packing label that might be attached to a box. Generally, the chip contains memory where
data may be stored and read from and sometimes written to, as well as other important circuitry.
Some tags may also contain batteries, and this is what differentiates an active tags from a passive
tags. The antenna emits radio signals to activate the tag thus it controls the data attainment and
communication. The electromagnetic field, which the antenna produces, is constantly present
when multiple tags are continually expected. If constant detection is not needed the field can be
activated by a sensory device. Tags are classified according to their abilities:

a) Active
b) Passive
c) Read-Only
d) Write-Once
e) Read-Write

Active Tags
Active Tags have, their own source of energy that is a battery which runs the microchip’s circuitry
and generates an outgoing signal. Active Tag is able to send a stronger signal to the reader due to
battery. It allows a read range of about one hundred feet. Because of this, active tags can
communicate with less powerful interrogators and can transmit information over much longer
ranges, up to hundreds of feet. Furthermore, these types of tags typically have larger memories, up
to 128 Kbytes. They are much larger and more complex than their passive counterparts too, making
them more expensive to produce. The batteries in active tags can last from two to seven years.10.

5
This additional energy provides active tags with several advantages such as Signal strength,
Initiation of the communication, Environmental sensors and Read/Write capacity.
Passive Tags
Passive RFID tags have no on-board power source. Instead, they derive power to transmit data
from the signal sent by the interrogator, though much less than if a battery-were on-board. They
use an incoming radio frequency signal to power up an integrated circuit and transmit a response.
Their antenna must be able to both receive power from an incoming signal and transmit an
outbound signal. Passive tags are typically smaller and less expensive to produce than active tags.
However, the effective range of passive tags is much shorter than that of active tags, sometimes
under two feet. Furthermore, they require more powerful interrogators and have less memory
capacity, on the order of a few kilobytes.

Read-Only (RO)
In RO memory, the memory can be read only. RO tags are similar to bar codes.They are
programmed once, by a product manufacturer and is hardly altered, much like the way a CD-ROM
cannot be altered after it’s burned at the factory. These types of tags are usually programmed with
a very limited amount of data that is intended to be static, such as serial and part numbers, and are
easily integrated into existing bar code systems.

Read/Write (RW)
Read/Write (RW) tags are often called “smart” tags. Smart tags present the user with much more
flexibility than RO tags. They can store large amounts of data and have an addressable memory
that is easily changed. Data on an RW tag can be erased and re-written thousands of times, much
the same way a floppy disk can be erased and re-written at will. Because of this, the tag can act as
a “traveling” database of sorts, in which important dynamic information is carried by the tag, rather
than centralized at the controller. The application possibilities for smart tags are seemingly endless.
This, in addition to recent advances in smart tag technology that have driven production costs
down accounts for much of the present interest in RFID systems.
There are a few variations on RO and RW types of memory that need mentioning.
First, there is another memory type called write-once-read-many (WORM). It is similar to RO in
that it is intended to be programmed with static information. Drawing on the analogy above, if RO

6
is similar to a CDROM, then WORM would be akin to CDRW, in which an end-user, a PC owner
for instance, gets one chance only to write in its own information, i.e., burn a blank CD. This type
of memory could be used on an assembly line to stamp the manufacturing date or location onto a
tag after the production process is complete.
In addition, some tags could contain both RO and RW memory at the same time. For example, an
RFID tag attached to a pallet could be marked with a serial number for the pallet in the RO section
of the memory, which would remain static for the life of the pallet. The RW section could then be
used to indicate the contents of the pallet at any given time, and when a pallet is cleared and
reloaded with new merchandise, the RW section of the memory could be re-written to reflect the
change.

Write-Once
Write-once tags allow a user to write information into the tag one time during the production. The
information can be something like a batch or serial number.
2. INTERROGATOR
RFID interrogators are essentially small computers. They are also composed of roughly three parts:
an antenna, an RF electronics module, which is responsible for communicating with the RFID tag,
and a controller electronics module, which is responsible for communicating with the controller.
The reader releases radio waves in ranges from one inch to 100 feet or more. The range depends
on its output power and the radio frequency used. When the RFID tag passes through the
electromagnetic field it will then detect the reader’s activation signal. At this point the reader will
decode the data programmed in the tag’s circuit. Finally, the data is passed to the host computer to
be processed. It is a link between RFID tags and the Server or PC. In summary, what the
interrogator does are:
1. Read the data contents of an RFID tag
2. Write data to the tag (in the case of smart tags)
3. Relay data to and from the controller
4. Power the tag (in the case of passive tags)

Interrogators are able to perform three more critical functions such as

7
  Implementing anti-collision measures to ensure simultaneous RW communication with
many tags.
 Authenticating tags to prevent fraud or unauthorized access to the system.
 Data encryption to protect the integrity of data.

3. CONTROLLER
RFID controllers are the “brains” of any RFID system. They are used to network multiple RFID
interrogators together and to centrally process information. The controller in any network is most
often a PC or a workstation running database or application software, or a network of these
machines. The controller could use information gathered in the field by the interrogators to:
a) Keep inventory and alert suppliers when new inventory is needed, such as in a retailing
application
b) Track the movement of objects throughout a system, and possibly even redirect them, such
as on a conveyor belt in a manufacturing application.
c) Verify identity and grant authorization, such as in keyless entry systems.
d) Debit an account, such as in Point of Sale (POS) applications.

SECTION 3
APPLICATIONS OF RFID IN TELEMEDICINE
RFID can be applied in a variety of utilization schemes within the hospital settings. Specifically,
it can be applied to patient tracking, pharmaceutical tracking, prevention of pharmaceutical
counterfeiting, blood tracking, device and supply tracking, etc.
Hospitals have begun to incorporate products to control and evaluate equipment that moves in
and out of the organization through the use of radio-frequency identification (RFID), a wireless
system utilizing radio-frequency electromagnetic fields to obtain data for tracking and
identifying items. RFID tags enable scanning of an item or device so that its contents, location,
manufacture date, order numbers, and shipping data can be transmitted to the correct person for
use within the company.4 Even though adoption of this technology has been slow, several areas
within healthcare have started using RFID. For example, pharmaceutical companies use RFID to
track prescriptions for clinical trials, track counterfeit products, and manage inventory. In
hospitals, RFID is used to track expensive medical equipment, patients, blood, and inventory.
Because supply costs are the second largest expenditure in hospitals, accounting for about 30 to 40
percent of the average hospital operating budget, careful and efficient control of supply costs is critical
for a hospital’s success.6 In the hospital industry, the supply chain can be a complex system that requires
the adequate flow of products and services in order to fulfill the needs of providers.

8
 SECTION 4

PROPOSE RFID APPLICATION FOR OSEI TUTU (KNUST) HOSPITAL COMPLEX.

We propose two RFID application in telemedicine to be used by the KNUST Hospital. The first is the
study of supply and demand in the hospital and the second is the use of mobile telemedicine service for
the hospital. Its related security and privacy issues are also elaborated.

SUPPLY AND DEMAND IN HOSPITAL AND HEALTHCARE AS A WHOLE

In this application program supply and need can be studied for physician, doctors, and patient s in
hospitals and health care inspection and repair. Doctors, nanny, and patients have RFID tag end
attached so that tightness of supply and demand among them can be identified and proper execution
can be made possible. RFID tags can be built as plastic set strap onto wrists. The doctors, nursemaid,
PCP and other stave members wear a “smart badge” storing their employee ID turn. In the tags only an
ID is stored to reduce security and privacy attacks. The unique ID is associated with a database book
saved in a server connected to RFID readers. In the database the disc of a patient may include patients
biometric details, a medical record number, billing, medical insurance, pharmaceutics, and so on. RFID
readers can be fixed in each elbow room or Mobile in pad -style PC with wireless LAN connections. For
doctors and nurses, tags are embedded in their access IDs, which are normally used to access all kinds of
rooms. Analysis of activities of doctors and nurses can be performed, especially in emergency rooms,
such as measuring the movement of doctors and nurses, including the amount of time they spend on
some patients other than waiting for some conditions such as resourcefulness conflicting before doing
something. Therefore, constriction can be identified and properly executed with high parallelism and
reducing resource difference of opinion can be also be achieved. Analysis of patient access service of
process can also be performed, such as measuring patient access to the facility including the time
spending by patients on each stage of their treatment like out-patient department, joining the cue, and
lying on the bed, etc. The RFID tags can monitor and track their position and times (e.g., the time it takes
to move from one country to another), as well as some medical tests. There are privacy and security
issues in this application. For the privacy issues, personal selective information of like patients, doctors,
and nurse’s information may be released to attackers or outside personnel. People who are involved
in the usage of RFID systems must be aware of it.. A voluntary scheme can be considered, but
may not be effective since not all persons and places are captured. Prior agreements may be
considered as a better approach. Furthermore, security mechanisms should be used to protect the
privacy of people who may be involved. For instance, just an ID of patient can be stored in a tag
to reduce security and privacy attacks. No one among the users can access the tag database in
which sensitive information is stored. Security mechanisms should also be applied to the
computer/communication system in which the database is located to prevent physical and remote
access by any unauthorized personnel.For security issues, first, tags are subject to cloned attacks.
An attacker can clone an authorized person’s tag ID if he/she can physically access the tag ID or
scan the tag ID using an unauthorized reader, and then use the cloned tag ID to access places in
the hospital.
To reduce this kind of attack, the database should monitor all active tags’ activities so that if
there are tags with the same ID, an alert is produced to inform related personnel, and some
proper security procedures should be followed. The above approach can also avoid multiple-ID
attack in which an attacker using multiple cloned tags pretends to have multiple identities.
Second, tags are subject to revealing their IDs to an unauthorized reader. These are some of the
solutions that can be used to prevent revealing a tag’s ID to an unauthorized reader. A more
9
effective way is that a tag should be able to authenticate the reader via a procedure as follows.
The tag randomly chooses a challenge text to ask the reader; the reader then encrypts the
challenge text using a pre-agreed key and sends back the output; then the tag judges whether the
reader is authorized or not. When the reader is authenticated, the tag can issue its encrypted ID.
The cost of this kind of tag may be a little bit higher, but it is reasonable
for the particular application. More sophisticated schemes can be designed if cost is not an issue.

MOBILE TELEMEDICINE SERVICE

Telemedicine is the exchange of medical information from one site to another via electronic
communications to improve patients’ health status. RFID tags can be functioned along with
micro sensors, which can be attached non-invasively to patients to collect electrocardiogram
(ECG), pulse rate, basal temperature, and other vital signs. RFID tags can be used to monitor the
activities of the elderly at home and help caregivers to improve the quality of healthcare. In
addition to in-home monitoring, RFID tags can be used to monitor patients in a hospital, in an
ambulance, and even in a disaster area. Intelligent location tracking. Wireless micro sensor generation
gives a precise possibility for turning in nice healthcare
to patients inside and outside hospitals. RFID tags can be used to monitor the activities of the
aged at home and help caregivers to improve the quality of healthcare. In addition to in-home
tracking, RFID tags may be used to reveal sufferers in a health center, in an ambulance, and even
in a catastrophe vicinity. In the following we advise a real-time patient tracking gadget which
could use clever sensors to acquire patients’ crucial signs in order that medical experts can carry
out far off prognosis everywhere and at any time. Intelligent vicinity monitoring capabilities can
also be incorporated to locate cell patients in case of emergencies. This device can appreciably
reduce response time to medical emergencies and improve the accuracy of faraway analysis. The
impact of the real-time affected person tracking gadget can be superb in reaping benefits
healthcare companies in addition to the entire healthcare enterprise, and improving the health of
our society.
A large Sensor networks can track patients, doctors, and medical instruments, monitor patient’s
physiological data and control the drug administration, track and monitor inside the hospital.
Wireless Sensor Networks in-home and nursing home can provide continuous medical
monitoring, medical data access, and emergency communication to the linking hospital, thus
providing physiological and environmental data. Focus of healthcare is shifting from treatment to
prevention that also at home. This type of monitoring helps in detecting abnormal situation
where the computer can alert the concerned medical personal. The medical sensor network
system normally integrates heterogeneous devices, some wearable on the patient and some
placed inside the patient’s room. This includes pressure sensor, oriental sensor, RFID tags, floor
sensor, environmental sensor, dust sensor.
Body sensor network comprises tiny portable devices equipped with a variety of sensors such as
heart rate, temperature, oximeter, and accelerometer, and perform biophysical monitoring,
patient identification, location detection, and other desired tasks. They support fall detection,
unconsciousness detection, vital sign monitoring and dietary/exercise monitoring. The nodes are
small in size to be worn comfortably for a long time; the energy consumption should be
optimized so that battery is not required to be exchanged regularly. They may use ‘kinetic’
recharging. A backbone network connects PDAs, PCs, and database servers to the sensor
network that provide richer interfaces with historical data, in real time. These systems are also
capable of monitoring the health status of individuals who perform very high risk jobs such as

10
soldiers in battle field, firefighters, and underground mineworkers. RFID can eliminate
inefficient, long manual searches for assets (surgical equipment, wheel chairs, oxygen cylinders,
etc.) and can maintain up to-date equipment status. This results in significant labor saving,
improved efficiency, and good return on investment. Doctors and medical staff can immediately
identifies a patient with handheld palmtop reader and provide current information to the system
of the patient. There is no mix up with medication or any treatment that the patient should get.
RFID tags are used to become aware of victims location so that during case of emergency,
patients can effortlessly be found. Those scientific sensors can transmit their facts wirelessly to a
few unique sensors, referred to as cluster heads, for similarly processing inclusive of
compression. The processed facts are then transmitted to a table style computer, a wireless non-
public digital assistant (PDA), or a cellular phone. those devices now not simplest display and
store the facts domestically, but additionally ahead the information to far off scientific experts
over a wireless LAN (WLAN)/metropolitan location network (MAN) or cellular network.
Clinical experts can display patients’ crucial signs and symptoms, everywhere and at any time,
and carry out far off diagnosis as well as commands/queries to the sensor network (e.g., to
prompt greater sensors in a specific location). Shrewd place tracking capabilities the use of RFID
are adopted to discover mobile patients in case of emergencies. The figure below illustrates a
likely structure for any such affected person monitoring utility.
In a typical ambulance system, a camera takes an ambulance patient’s video clips and transmits it
to the consultation unit of a medical center. At the same time, the emergency medical paramedics
(EMPs) use a wireless cellular connection to talk to doctors or medical professionals. An
ambulance workstation continuously collects data from the patient’s body and sends it to the
doctors.

11
Mobile Telemedicine architecture

SECTION 5
SECURITY AND PRIVACY ISSUES AND SOLUTIONS
In RFID systems universal deployment of tags may create new security and customer privacy
issues. Privacy: the ability of the RFID system to keep the meaning of the information
transmitted between the tag and the reader secured from non-intended recipients whiles Security:
the ability of the RFID system to keep the information transmitted between the tag and the reader
secure from non-intended recipients. The issues have very different repercussions and different
solutions. In a given environment, an RFID solution may pose security risks without affecting
the issue of privacy. An example of this scenario is when a tag broadcasts its unique
identification number in a consistent and unencrypted manner. This enables the tag to be
detected by any reader that can decode the RF signal. If all that is read is the tag’s unique
identifier – and no association can be made to what that identifier means without access to the
backend database that maintains the relationship between the tag IDs and the objects that they
represent – there is no privacy issue. However, issues of traceability and inventorying may
remain. Traceability and inventorying relate to the ability of an unauthorized entity to read the
identifiers sent by RFID tags without necessarily being concerned as to what the tag is affixed to
or who/what is carrying it. In other words just by capturing the signals emitted by an RFID tag, a
third party could trace where the tag is or has been (traceability) as well as to what tags have
been detected (inventorying). A standard EPC tag conveys information associated with a
particular item, its model or product class and its manufacturer. Anyone with a standard EPC
reader could get close enough to a shopper leaving a store to determine what products and what
quantities were purchased. Furthermore, the unauthorized reader could track the shopper from a
distance utilizing a high-powered reader.

12
SECURITY AND PRIVACY THREATS

High security RFID systems should have the ability to guard against the following categorized
security and privacy threats:

 Eavesdropping

RFID tags are designed to transmit stored information to an inquiring reader. This allows
unauthorized users to scan tags by eavesdropping on the wireless RFID channel. The unrestricted
access to tag data might reveal private information if it is stored on the tag.

 Spoofing

If the security protocol used in the RFID channel is revealed, attackers can write blank RFID
tags with the same formatted data that has been collected. For instance, dishonest persons could
replace the RFID tag on an item to get a cheaper price when checking out from a supermarket.

 Relay Attack (also known as Cloning)

Relay devices can intercept and retransmit RFID queries. With this kind of device, offenders can abuse
various RFID applications by replaying the data in order to imitate a genuine data carrier.
The security and privacy issues of RFID in our proposed system for KNUST hospital and their solutions
are discussed. We first analyze several mechanisms to enhance privacy and security such as killing
command, RSA selective blocker Tag, faraday cage, Logical “Hash Lock”, Tag Passwords and
pseudonyms, Universal re-encryption and Hash chain scheme are discussed. Since security and privacy
are closely related, we do not make explicit distinctions between security solutions and privacy solutions
in this study

Faraday Cage
An RFID tag can be shielded with a container made of metal mesh or foil, known as a “Faraday
Cage”. This foil-lined container can block radio signals of certain frequencies and thus protect
tagged products from being detected. However, this approach might not work in some situations.
For example, it is difficult to wrap foil-lined containers around tags used in clothing for pets and
people. While extremely effective, this solution requires a conscious, manual action in which the
user must cover and uncover the tag every time he or she wants the tag to function. This method
does not offer any protection when the tag is not within the Faraday cage.

Kill Tag

By executing a special “kill” command on a tagged product, the RFID tag will be “killed” and
can never be re-activated. This “kill” command may disconnect the antenna or short-circuit a
fuse. This ensures that the tag cannot be detected any further, and thus protects the privacy of the
individual who possesses the product. However, there may be instances where tags should not be
“killed”. A store may wish for example to re-detect the tags on defective products returned by

13
customers. Also, smart-cards embedded with RFID chips for access control will need to be
activated continuously.

“RSA” Selective Blocker Tag

A blocker tag is a passive RFID device that uses a sophisticated algorithm to simulate many
ordinary RFID tags simultaneously. It provides an endless series of responses to RFID readers
through the use of two antennas to reflect back two bits simultaneously, thereby preventing other
tags from being read, performing a kind of passive jamming. However, this approach gives
individuals a lot of control. In addition, a blocker tag may be used maliciously to circumvent
RFID reader protocols by simulating multiple tag identifiers.

Logical “Hash-lock”

When a tag is locked, it is given a value (or meta-ID) that is a hash value of the corresponding
key or PIN. The tag will refuse to reveal its ID until it can be unlocked by presenting the value of
the key or PIN value. For example, tags may be locked at checkout time in a supermarket and
then unlocked by the individual using a given meta-ID and PIN after returning home. These
meta-ID and PINs may be read optically by individuals, and be printed on the interior of the
package or on the payment bill after purchasing, rather than transmitted by radio. The limitation
of this approach is that individuals need to manage the lock/unlock features and the associated
PINs for a whole collection of tags and purchases, and need to keep track of which objects
carrying which RFID tags. This approach also incurs additional cost as it involves a
cryptographic operation on tags.

TAG PASSWORDS AND PSEUDONYMS

Basic RFID tags already have sufficient resources to verify PINs or passwords, which could be a possible
solution for data protection. For example, a tag could emit critical information only if it receives the
correct password. However, password management poses a significant challenge. Another approach to
password-based security is the use of tag pseudonyms. Under this approach, RFID tags aren’t
programmed with passwords, but change serial numbers each time they are read. This approach would
make unauthorized tag tracking more difficult, but also introduces issues of pseudonym management

UNIVERSAL RE-ENCRYPTION

Universal re-encryption may be used to enhance the privacy of RFID tags. The idea is to permit
powerful computing agents external to RFID tags to universally re-encrypt the tag data (recall
that the tags lack the computing power necessary to do the re-encryption themselves). Thus, for
example, a consumer walking home with a bag of groceries containing RFID tags might have the
cipher texts on these tags re-encrypted by computing agents that are provided as a public service
by shops and banks along the way. In this case, the tags in the bag of groceries will periodically
change appearance, helping to defeat any tracking attempt. In re-encryption function, without
decryption one cipher text is generated from another cipher text by using only the public key.

14
Regardless of the number of times re-encryption is performed, the plain text can be obtained by
performing decoding once. If this encryption function is used, the encrypted ID can be stored
inside the tag, and even the danger of disclosing the original ID due to tampering can be abated
Hash-chain Scheme
When a tag updates the ID, local variable α is input into Hash function H and α is updated.
Next, α is input into Hash function G, and Hash value β is updated as the Anonymous-ID. At
the next transmission opportunity, the tag transmits β . The corresponding relationships between
the original ID and the initial value of α are safely managed in the server as secret information.
Based on the randomness of Hash function G, the Anonymous-IDs, β , generated each time are
different and unlikable to one another. Since this process is one way, there is no way to retrieve
the internal secret information, α , from β . The secret information inside the tag, α , is updated
one-way each time α is read using Hash function H. For this reason, even if a third party knows α
through tampering, the third party cannot know the retroactive values of α . As a result, previous
values of the Anonymous-ID, β , cannot be investigated. In this way, even if tampering of the
secret information in the tag occurs, the previous information up to that point (cipher text,
signature, etc.) is protected by the Characteristic called forward security. The Hash-chain scheme
provides this characteristic. However, the main issue of this scheme is the limited scalability of
resolving the IDs at the security server. Different from encryption, hash functions are one-way
functions. For this reason, to resolve the original ID, the server must repeat its calculation until it
obtains the identical match to the Anonymous-ID ( β ) received from the tag by retesting the
same procedures that are performed by the tag for each of the initial values of α , which has an
one-to-one correspondence to the original ID. As a result, as the number of IDs managed at the
server increases the decoding processing time increases. However, if the server disk capacity is
sufficiently large that the corresponding tables for all of the β values and IDs can be generated
beforehand, the IDs can be resolved in a log2 (N× M) level of retrieval processing time, where N
is the number of IDs and M is the envisioned maximum number of reads.

SECTION 5
CONCLUSION
RFID technologies are being applied in telemedicine to improve the quality of healthcare
and reduce medical errors because of the aging population, shortage of qualified healthcare
personnel, increasing medical errors due to drug management and site infection, and so on.
IN this study we have proposed two RFID applications in telemedicine to study supply and
demand of doctors, nurses, and patients in hospitals and healthcare, and to develop mobile
telemedicine services. We have provided a comprehensive survey on security and privacy issues
in RFID systems, and their solutions. On the other hand, there are many open practical issues
such as designing more realistic and efficient security and privacy solutions, and at the same time
there should be strong mechanisms against all kinds of threat and attack.

15
16