Title: A FIRST APPROACH

One of the basic security paradigms which should be applied in the context of RFID as well as it is applied in many other domains is the paradigm of multilateral security . According to this paradigm, each party, entity or stakeholder of a system has its own security goals and does not per se trust the other parties concerned. Hence the conflicting interests require a negotiation to find a compromise which could be accepted by each party.

Applied to RFID this means that the conflicting interests of costumers, producers, retailers etc. have to taken into account then developing PETs for RFID. Moreover at least the design of the three main components should not rely on the assumption that the other components are trustworthy and secure. Instead, when designing the whole RFID system, each component should be treated as potential insecure. If this would lead to impossibility of developing the RFID application, meaning that certain components need to fulfil certain security properties than all the underlying assumptions have to be explicitly named. 

The said could be exemplified using Scenario S1. Here the backend system implicitly assumed that the RFID tag is secure, i.e. the data stored on the RFID tag could not be manipulated. Clearly there is no reason for this kind of trustworthiness and security assumption especially because there are no mechanisms implemented which ensure this kind of manipulation protection. If the system would have be designed with the “trust no-one” presumption in mind and would have explicitly named any assumptions which violates this, one would easily detect the missing mechanisms to protect the backend against malicious or manipulated RFID tags or readers. 

Based on the principles mentioned above and the general ideas of multilateral security in ,  a checklist was proposed with which PETs for RFID can be evaluated. The content of this checklist is as follows:

The Privacy Enhancing Technology (PET) concept …