I was fortunate to present our work on the RFID Ecosystem at the EMC Innovation conference in Franklin, MA today.  The conference marks the second annual gathering of EMC Corporation’s Innovation Network, a worldwide collaboration of advanced technology researchers exploring a variety of areas such as service-oriented infrastructures, web 2.0 storage, information-centric security, virtualization and information grids.

Our friends at RSA Labs (the Security Division of EMC) invited a talk on the RFID Ecosystem as one of three talks in a session on academic research.  In my talk I presented an overview of the RFID Ecosystem project and then drilled-down to describe some key challenges for pervasive RFID data management (e.g., uncertainty, privacy) and how we address them with the Cascadia system (my talk is available here).  The talk went quite well and was followed by some great questions and discussion with a few of the more than 1,000 attendees.  After the talk I had a chance to meet with researchers from RSA as well as ERC, EMC’s new research center in Beijing, China.  I received a lot of great feedback from these very interesting groups - the conference was a fantastic experience overall!

The Federal Trade Commission (FTC) and the University of Washington’s Law school are co-hosting a Town Hall meeting today at UW’s Law building.  The event is titled “Pay on the Go: Consumers and Contactless Payment” and features a series of panel discussions which will include representatives from government, banking, credit card companies, RFID industry consortiums, organizations for consumer rights and privacy as well as technical experts from industry and academia.  The goal of the meeting is to “examine the increasing prevalence of contactless payment devices in everyday consumer transactions, including credit card purchases and public transit use; consumer awareness and education initiatives regarding these developments; security and privacy threats and proposed solutions; and emerging technologies and practices that may shape the contactless payment marketplace over the coming years.”
A few notable participants include Prof. Kevin Fu from the University of Massachusetts, Amherst and our very own Prof. Tadayoshi Kohno and Prof. William Covington.  Should be a fascinating discussion, watch the streaming video of the Pay on the Go Town Hall Meeting here!

The Journal of the American Medical Association published a report on Wednesday that showed certain RFID systems may induce hazardous incidents in nearby critical care medical equipment.  The study examined the effects of a 128 kHz active RFID system and a 868 MHz passive RFID system on 41 different types of medical devices.  Out of 123 tests, 34 led to electromagnetic interference incidents, 22 of which were classified as hazardous, 2 as significant, and 10 as light.

Though many consider the result of this study to be a serious and shocking failure in engineering, some RFID vendors claim that the problem could be avoided by lowering the power output of the RFID readers.  In any case, this study highlights a key obstacle for pervasive RFID systems: it will probably not be possible to deploy RFID readers in all locations of interest due to a variety of issues including electromagnetic interference, budgetary issues, or aesthetic concerns.  As such, a successful RFID system will have to infer when a tag enters a location which is not covered by an RFID reader.  This is one of the challenges which we designed Cascadia, the RFID Ecosystem’s event detection middleware, to address.  In particular, Cascadia allows an admin to define a graph that describes locations of interest (which may or may not be covered by an RFID reader - see image below).  Cascadia then tracks tags over this graph and can infer with some probability when a tag enters a location that is not covered by an RFID reader.  See our MobiSys 2008 paper for details!

The Guardian reports that London’s Oyster transit card may have been hacked by a group of Security researchers at Radboud University in Holland.  The hack allows an attacker to clone the Oyster card’s RFID chip after cracking its encryption in just a few seconds.  This is the latest in a series of Mifare smartcard hacks which have compromised European transit card systems in the last year.

It’s interesting to note that the authorities are not considering the hack to be a serious threat.  London Transport has claimed not only that they can detect fraudulent use within 24 hours using checks in software (a level of security often ignored by hardware hackers), but that a criminal could gain at most about £3 per cloned card.  As such, the incentive to clone Oyster cards probably isn’t that great.  One point which the article does not highlight and which is perhaps more concerning from a privacy standpoint, however, is that London Transport collects and can process data on 38 million journeys per week to identify individual instances of fraudulent use (and who knows what else?).

We just returned from two weeks at the SIGMOD and MobiSys conferences where we presented demos of the RFID Ecosystem’s event detection infrastructure, Cascadia. Cascadia allows developers and end users to declaratively specify meaningful high-level events (e.g. “a nurse has entered patient X’s room with equipment Y”, “I leave the building without my car keys”) using a SQL-like sequence language or with an intuitive GUI called Scenic. Cascadia can then continuously extract these events over a stream of incoming, uncertain RFID data using probabilistic data management techniques. The Cascadia demos at SIGMOD and Mobisys illustrated Cascadia’s operation from end-user event specification, to event detection, to event notifications for one of two demo applications. The original demo proposals are available on our publications page; both demos are also entirely web-based and will be posted online sometime in the coming weeks.

A group of delegates from various Korean RFID associations visited UW CSE today to learn about the RFID Ecosystem project, to discuss challenges, and to share findings on future scenarios for RFID use. We shared demonstrations, presentations, and experience over the course of the morning and found that we share many of the same challenges (e.g. uncertainty in sensor data, system scalability, user privacy). The 20 RFID experts represent Korea’s large and growing interest, investment, and innovation in RFID technology. Korea’s focus on RFID is driven forward by projects like New Songdo City, a planned “U-city” and international business center which will include many elements of ubiquitous computing infrastructure including, possibly, RFID readers deployed throughout the city. In this scenario, RFID would be used to promote recycling of tagged products as well as possibly for health care applications; whether the ubiquitous RFID deployment becomes reality or not, the $25 billion project will include a $297 million RFID research center when completed. After their visit the delegates continued on to the RFID World conference in Las Vegas.

Today’s talks covered a variety of topics, from effective and efficient strategies for managing RFID data in the supply chain, to a framework for security in interoperable RFID networks, to probabilistic RFID data cleaning and even RFID in mobile E-commerce.

One interesting talk on “Interoperable Internet Scale Security Framework for RFID Networks” was given by Tingting Mao at the MIT AUTO-ID lab. This work describes a framework whereby businesses can define policies for sharing EPC data and the associated business events. A key feature of this system is that it uses authentication and authorization based on an aggregation of business rules, enterprise information, and RFID tag information. In another talk, Antti Sirkka from TietoEnator discussed “Modelling Traceability in the Forestry Wood Supply Chain”. This work aims to use RFID to improve information on processes in the forestry wood production system - a pressing problem given the equivalent of Є5 billion of wood raw material going to waste in Europe.

There were also great talks and discussion from panelists Yanlei Diao (University of Massachusetts, Amherst) and Fusheng Wang (Siemens Corporate Research).

Slides from the talks will eventually be posted online at: http://rfid.cs.washington.edu/rfdm08/

The first annual International Workshop on RFID Data Management (RFDM’08) is happening in Cancun today in conjunction with the International Conference on Data Engineering (ICDE). The workshop brings together researchers and practitioners that work on problems related to managing data produced by RFID or other traceability and automated identification (Auto ID) technologies. The goal is to fill an important gap in the community by bringing interested researchers together to identify future research challenges and opportunities. The workshop is co-chaired by Prof. Magdalena Balazinska and Dr. Karin Murthy (IBM).

Prof. Jiawei Han (UIUC) just gave a great keynote talk titled “Warehousing and Mining Massive RFID Data Sets”. It covered some recent work he an his student Hector Gonzalez have done on techniques for managing the massive (i.e. peta-byte scale) RFID data sets that are generated by supply chain applications of RFID. He concluded with some interesting work that applies these techniques to the analysis and aggregation of traffic patterns using EZ-pass and FasTrak data.

Karsten Nohl spoke today at Prof. Yoshi Kohno’s weekly UW Security group lunch. The topic of the talk was “The (Im)possibility of Hardware Obfuscation”. In the talk, Karsten described the impracticality of hardware obfuscation techniques with a focus on the recent OV-chipkaart hack in which he played a key role. He also emphasized that it was quite feasible to reverse engineer Mifare Classic and similar hardware with a small budget and readily available tools (e.g. polishing paper, a microscope, Matlab).

Also in attendance were Starbug (Jan Krissler) from the CCC in Berlin and 3ric Johanson, a Seattle-area security professional, RFID hacker, and member of Shmoo. The presentation and discussion were great! A video of a similar talk which Karsten gave at Google can be found on his homepage: http://www.cs.virginia.edu/~kn5f/