CEN/TR 16670:2014

Foreword
Introduction
1 Scope
2 Terms and definitions
3 Symbols and abbreviations
4 Threats and Attack scenarios
5 Vulnerabilities
6 Mitigation measures
7 Conclusions
Annex A (informative) - Attack scenarios
Annex B - Original Test Set ups and Results
Annex C - Additional Test Set ups and Results
Bibliography

The scope of the Technical Report is to consider the threats and vulnerabilities associated with specific characteristics of RFID technology in a system comprising:—the air interface protocol covering all the common frequencies;—the tag including model variants within a technology;—the interrogator features for processing the air interface;—the interrogator interface to the application.The Technical Report addresses specific RFID technologies as defined by their air interface specifications. The threats, vulnerabilities, and mitigating methods are presented as a toolkit, enabling the specific characteristics of the RFID technology being used in an application to be taken into consideration. While the focus is on specifications that are standardized, the feature analysis can also be applied to proprietary RFID technologies. This should be possible because some features are common to more than one standardized technology, and it should be possible to map these to proprietary technologies.Although this Technical Report may be used by any operator, even for a small system, the technical details are better considered by others. In particular the document should be a tool used by RFID system integrators, to improve security aspects using a privacy by design approach. As such it is also highly relevant to operators that are not SME’s, and to industry bodies representing SME members.Although this Technical Report may be used by any operator, even for a small system, the technical details are better considered by others. In particular the document should be a tool used by RFID system integrators, to improve security aspects using a privacy by design approach. As such it is also highly relevant to operators that are not SME’s, and to industry bodies representing SME members.