From Barcodes to the Internet of Things. Patrick Pype Director European Affairs NXP Semiconductors

Transcription

1 From Barcodes to the Internet of Things Patrick Pype Director European Affairs NXP Semiconductors RFID Security : Theory & Practice Lorentz Center, Leiden, March 28 th, 2008

2 Table of Contents 1. NXP Semiconductors 2. History & Vision 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 2

3 Table of Contents 1. NXP Semiconductors 2. History & Vision 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 3

4 NXP Semiconductors Established in 2006 (formerly a division of Philips) Builds on a heritage of 50+ years of experience in semiconductors Provides engineers and designers with semiconductors and software that deliver better sensory experiences Top-10 supplier with Sales of 4.6 Bln (2007) Sales: China 20%, Netherlands16%, Singapore 9% USA 8%, Taiwan 8%, South Korea 11%, Germany 6%, Other 22% Headquarters: Eindhoven, The Netherlands Key focus areas: Mobile & Personal, Home, Automotive & Identification, Multimarket Semiconductors Owner of NXP Software: a fully independent software solutions company 4

5 NXP: leader in contactless technology RFID: NXP is market leader NXP Semiconductors Tops New RFID transponder IC Vendor Matrix Ranking, ABI Research, December 2007 Public transportation: # 1 in transport ticketing IC s >650 cities incl. London, Moscow, Atlanta, Sao Paulo, Beijing, Seoul, Taipei, Sydney Car immobilizer and keyless entry/go systems: #1 leadership position E-government:#1 in epassport ICs 45 of 53 epassport countries use NXP ICs Banking: #1 in contactless bank cardic s NFC: Shaper of new global standard Click, the BBC Flagship Technology TV Program, names NFC one of the Top Five Technologies for

6 Table of Contents 1. NXP Semiconductors 2. History & Vision 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 6

7 History of RFID US Patent # 2,612,994 1 st commercial use UPC $$$$ IFF transponder WW II Paper H.Stockman Communication by Means of Reflected Power US Patent # 3,713,148 Passive Radio Transponder With Memory US Patent # 4,384,288 RFID Abbreviation 1 st e-passport (Malaysia) 1 st e-ticketing (Paris, RATP) $$$$ NFC Standard Explansion of # Applications 7

8 Identifying people, goods & values people Goods & cattle values Passport ID card Driver License Health card Access Control Car access & immobilizer Retail & supply chain Animal tagging & food safety Libraries & Rental Pharma & Proof-of- Originality Mobile telephony (SIM) Banking Transport ticketing 8

9 NXP RFID Vision RFID technology today is used for replacing bar codes RFID becomes more powerful and starts to process data on the IC, reducing the need for reader and server power RFID networks allow for peer to peer communication, removing the need for reader infrastructure and servers 9

10 towards The Internet of Things On the move Outdoors & indoors Night Daytime Any THING connection Any TIME connection On the move Outdours Indoors away from the PC Indoors at the PC Any PLACE Connection Between PC s Human2Human, not using a PC Human2Thing, using generic equipment Thing2Thing 10

11 Table of Contents 1. NXP Semiconductors 2. History & Vision 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 11

12 Contactless offers many benefits Ease of use, convenience Fast processing (e.g. for transport ticketing) Low reader maintenance costs (no mechanics or magnetic heads) Reliable Secure (various security levels available depending on application) 12

13 Contactless becomes ubiquitous Visual inspection Mag-stripe Visual inspection Visual inspection Bar code Bar code Visual inspection Mag-stripe contact Machine readable Mag-stripe contactless contactless contactless contactless contactless contactless contactless contactless Retail & supply chain Banking Passports Access Control Libraries & rental Animal tagging Transport ticketing Car Access Mag-stripe contactless contactless Car Immobilizer Ski ticketing time 13

14 New Markets for RFID plus Sensors BULK PRODUCE, MEAT, POULTRY, FISH FOOD MEDICAL / PHARMACEUTICALS CUT FLOWERS FLORAL INDUSTRIAL/ OTHER VACCINES, BLOOD, PHARMA FILM, ADHESIVES, PAINT, CHEMICALS Value Proposition for Cold Chain : Reduce waste and over-production Up to 50% shrinkage in Retail sector linked to perished food; US households waste 43B$ / yr Market potential With label prices < $0.50 disposable labels will be used on shipments of perishables goods (over 1B/yr) 14

15 NFC turns the mobile phone into a contactless Swiss army knife 1 - Card emulation (payment, transport & event ticketing, access, ) 2 - Card reader (smart posters, tagged promotions, authentication, ) 3 P2P (Easy BT/Wifi pairing, games, data exchange, ) 15

16 Example: SmartConnect Secure transactions based on NFC + smart card IC Additional Smart card Secure In combination with Smart Card Technology Mobile payment & transaction Peer-to-peer communication Access info on-the-move Secure payments Transport access Building access Store digital rights (DRM) battery-less smart object 16

17 The identification IC market grows fast U.S.$ Billions Current View (October 2007) and will be predominantly contactless in 2011 Market Value (EUR M)

18 We are over the technology chasm We Are Here Source Geoffrey Moore, The Chasm Group 18

19 Table of Contents 1. NXP Semiconductors 2. History 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 19

20 Society benefits are significant Saving lives with authenticating medicine Reduce waste and overproduction (for instance vers schakel ) Increasing border and building security. 20

21 but issues remain Technology Choice It is not sufficiently clear to many potential adopters which frequency to use Europe versus Rest-of-the-World Legislation in EU could become more stringent resulting in slower take-off Waste Handling Separating silicon from glass-based products when embedded could cause issues for glass recycling purposes Privacy & Security Privacy concerns around the use of RFID and data management 21

22 Table of Contents 1. NXP Semiconductors 2. History 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 22

23 Privacy & Security What to do? Technology Providers Industry Universities Research Institutes Government All to Play a Constructive Role in the - Debate - Benefit Thinking - Problem Solving System Companies Service Providers Consumers 23

24 Privacy & Security What to do? Technology Providers Industry Universities Research Institutes Government All to Play a Constructive Role in the - Debate - Benefit Thinking - Problem Solving System Companies Service Providers Consumers 24

25 Technology Providers Need to offer a wide range of IC products with different levels of security from low to extremely high Application security depends on the security of the chip, but also the security measures in the rest of the system Security has a price; The highest security levels are not required for all applications Customers (typically the system integrators) select the ICs with the security level fit for their applications & system concept Privacy-sensitive information stored on contactless chips requires adequate security Technology providers typically offer various security mechanisms and options on contactless chips; Customers select the mechanisms and options they want to use in their application NXP takes its responsibility and works with governments & authorities and advices its customers on how to properly protect privacy & security at systemlevel 25

26 RFID tag & Contactless Smart Card technology HIGH Sensitivity of typical information stored LOW WEAK Inventory tracking Animal tagging Transportation ticketing egovernment Cards, epassport evisa Payment Cards Strength of protection of data privacy and security STRONG Personal information Biometric data Secure keys Financial account information Ticket value Electronic product code Unique identifier Source: 26

27 Contactless Card IC Portfolio MIFARE MIFARE Ultralight Ultralight MF0 U10 MF0 U10 MF0 U11 MF0 U11 MIFARE MIFARE Ultralight Ultralight 2 MF0 U20 MF0 U20 MF0 U21 MF0 U21 MIFARE MIFARE Classic Classic MF1 S20 MF1 S20 MF1 S50 MF1 S50 MF1 S70 MF1 S70 MIFARE MIFARE Plus Plus MF1 S61 MF1 S61 MF1 S71 MF1 S71 MIFARE MIFARE DESFire DESFire MF3 D21 MF3 D21 MF3 D41 MF3 D41 MF3 D81 MF3 D81 HW Crypto - 3DES crypto1 crypto1, AES 3DES, AES EEPROM 512 Bit 1500 Bit 320B, 1 KB, 4 KB 2, 4 Kbyte 2, 4, 8 Kbyte Special Features MIFARE Classic compatible - Certification CC EAL 4+ CC EAL 4+ Contactless Interface Design-In Package Reader IC ISO A (13.56MHz, up to 10cm distance, kBaud) PEGODA (CL RD701) MFRC Family 27

28 Technology Providers Research on different means for enhancing security State-of-the-Art encryption methodologies Unique Chip Identification through PUF-technology : measure unique & unpredictable physical process technology variations in order to detect a key avoiding the storage of keys in memories which can be under attack Open dialogue & cooperation with key universities & research institutes Continuous improvement & being ahead of malicious persons ( The Car-Theft Paradigm ) 28

29 Privacy & Security What to do? Technology Providers Industry Universities Research Institutes Government All to Play a Constructive Role in the - Debate - Benefit Thinking - Problem Solving System Companies Service Providers Consumers 29

30 System Companies / Service Providers Need to be informed & aware of various levels of security provided The RFID chip as such is only a first layer in a total system Different security levels can already be offered in the RFID chip The database handling & people involved are also key in the total system Need to make decision in trade-off space, while maintaining conformity with legislation : Level of Security Cost Risk 30

31 Privacy & Security What to do? Technology Providers Industry Universities Research Institutes Government All to Play a Constructive Role in the - Debate - Benefit Thinking - Problem Solving System Companies Service Providers Consumers 31

32 Consumers Need to be aware of benefits & risks Education! Objective information handling What does it provide? What does it not provide? How does it compare to other technologies? Gradual acceptance building From Pilot Demonstrator Projects Vers Schakel RFID in the supply chain of fresh vegetables (with a.o. : NXP, Schuitema, Capgemini, CBL, Heemskerk, Intel, KPN, Wageningen University) to Full Deployment 32

33 Privacy & Security What to do? Technology Providers Industry Universities Research Institutes Government All to Play a Constructive Role in the - Debate - Benefit Thinking - Problem Solving System Companies Service Providers Consumers 33

34 Government Governments should take up responsibility : Set legal framework to avoid mis-use of technologies Create platform for economic growth of their industry Pro-actively define vision of future societies Several initiatives are being taken US FTC a good example : keep-an-eye and take action whenever a need occurs EU RFID Expert Group : investigate societal impact of RFID-usage incl. evolution towards Internet of Things Society in cooperation with different stakeholders EU Member States NL - Platform RFID, College Bescherming Persoonsgegevens GE RFID Informationsforum, BSI (German Federal Office for Information Security) etc 34

35 Table of Contents 1. NXP Semiconductors 2. History 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 35

36 EU RFID Expert Working Group Official kick-off : June 2007 Industry Member States Consumer Groups + Invited Speakers Standardisation Committees Objective : Provide Recommendation towards Member States & Stakeholders on the design & operation of RFID applications in a lawful, ethically admissable, and socially and politically accepted way, respecting privacy and ensuring appropriate information security Look into different application areas : logistics, working place, government Set of Guidelines to harmonize amongst Member States, published by European Commission 36

37 Main Items of EU Recommendation No new legislation needed Existing data protection directive is sufficient to protect privacy (95/46/EC, 99/5/EC, 2002/58/EC) Need to conduct a Privacy Impact Assessment Study Fully supported by industry Need to further define when data becomes personal data 37

38 Main Items of EU Recommendation Need to further work on Awareness Raising Activities / Best Available Techniques Some Examples : Technical Guidelines for Implementation & Utilization of RFID-based Systems (cooperation NXP German Federal Office for Information Security BSI) RFID-usage in eticketing for Public Transport RFID-usage in eticketing for Stadiums and Events NFC-based mobile eticketing RFID-usage in Logistics & Retail Vers Schakel RFID in the supply chain of fresh vegetables (with a.o. : NXP, Schuitema, Capgemini, CBL, Heemskerk, Intel, KPN, Wageningen University) 38

39 Main Items of EU Recommendation Different rules for different types of applications RFID containing Personal Data RFID in Retail Sector ( Tagged Items ) Need to inform customers about presence of RFID tags / readers -> logo De-activiation (permanent or temporary) on request of customers ( opt-out ) and if there is not a necessary feature of the product behind the Point-of-Sales Need to enhance R&D work Security & Privacy by Design principle More focus to be put on applied research & pilot trials 39

40 Table of Contents 1. NXP Semiconductors 2. History 3. Contactless Benefits & Future Perspectives 4. Impact on Society 5. Privacy & Security Aspects 6. EU RFID Expert Working Group 7. Conclusions 40

41 Conclusions Contactless identification (RFID, NFC, contactless smartcards) offers significant benefits in an increasing number of applications The Internet-of-Things era is approaching and will become reality Industry & Government Officials all over the world should work together to create solutions that ensure that the societal benefits of RFID are gained while ensuring that protecting privacy and advancing security are top priorities along the way. All RFID-stakeholders need to educate consumers about RFID and its use in a fact-based manner 41

42 Final Remark to Reflect upon Not the Technology itself is the Issue, But it s the People who are Handling it! 42

43 43