1. License-based Access Control in EPCglobal Networks RFID Systech 2011 May 17-18, 2011 – Dresden, Germany Matthieu-P. SchapranowHasso Plattner Institute

2. Agenda European Pharmaceutical Industry License-based Access Control Related Publications Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 2

3. European Pharmaceutical IndustryMotivation Increasing counterfeit rates in pharmaceutical industry 34 million fake drugs in only two months in Europe [1] Pharmaceuticals: 3rd place / 10% of all intercepted articles [2] Current literature proposes Radio Frequency Identification (RFID)technology or data matrix for anti-counterfeiting [6] Problem: Low-cost tags do not provide security mechanisms But: RFID enables fine-grained tracking and tracing of each item “Minimize the used of personal data” [5] “Privacy by design” [3] Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 3

4. European Pharmaceutical IndustryManufacturing Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 4

5. European Pharmaceutical IndustryCounterfeits Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 5

6. European Pharmaceutical IndustryComponents for Anti-counterfeiting Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 6 Anti-counterfeiting service provider validates authenticity of concrete item for customers, e.g. in a pharmacy Discovery Service supports to identify appropriate Electronic Product Code Information Services (EPCIS) repository EPCIS repository contains all event data for handled products of a certain supply chain partner

7. European Pharmaceutical IndustryRoles Approx. 30 billion pharmaceuticalsper year [13] Main Roles [21] Manufacturers: ≈2.2k Wholesalers: ≈50k Retailers: ≈140k Other Roles Logistics Providers End Consumers Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 7

8. License-based Access ControlSecurity Security := {confidentiality, integrity, availability} [4] Confidentiality := prevent unauthorized reading of event data Integrity := protect event data from being manipulated Availability := provide access only to authorized parties Extension of current EPCglobal networks to guarantee Confidentiality of event data, since it can be abused to derive business secrets, Integrity of business data, i.e. a foundation for automatic anti-counterfeiting, and Fine-grained access for certain business partners. Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 8

9. License-based Access ControlActors Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 9 A := queries details for a certain EPC ACC := checks licenses, decrypts content, and applies access rights EPCIS := stores encrypted event data to serve it to querying parties B := captures EPC event data and stores it in the local EPCIS

10. License-based Access ControlBusiness Process Event owner Encrypts all event data, with individual master key per attribute (encrypter.py) Stores data in local EPCIS event repository Creates unique license per client and encrypt it with owners private key (license-encrypter.py) License contains a unique ID and decryption keys for granted attributes ACC is responsible for Decryption of the license with the help of its public key, i.e. it can decrypted any license(decrypter.py) Enforcing access rights on per-attribute level and EPC lists Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 10

11. License-based Access ControlPython Prototype Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 11

12. License-based Access ControlSecurity Evaluation Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 12

13. Related Publications [1] European Commission: Customs: Millions of illegal Medicines stopped by "MEDI-FAKE" action. IP/08/1980, 2008 [2] European Commission Taxation and Customs Union: Statistics of Customs Detentions Recorded at the External Borders of the EU, EU-wide statistics for 2009, 2010 [3] European Commission: Commission Recommendation on the Implementation of Privacy and Data Protection Principles in Applications supported by Radio-Frequency Identification, Brussel, 2009 [4] Federal Office for Information Security: Standard 100-1 Information Security Management Systems (ISMS) V. 1.5, 2008 [5] Federal Data Protection Act §3a: “Datenvermeidung und Datensparsamkeit”, 2009 [6] European Commission: Public Consultation in Preparation of a Legal Proposal to Combat Counterfeit Medicines for Human Use -- Key Ideas for better Protection of Patients against the Risk of Counterfeit Medicines, Brussel, 2008 [7] Matthieu-P. Schapranow, Alexander Zeier, Felix Leupold, Tobias Schubotz: Securing EPCglobal Object Name Service -- Privacy Enhancements for Anti-counterfeiting, 2nd International Conference on Intelligent Systems, Modeling and Simulation, 2011 [8] Matthieu-P. Schapranow, Alexander Zeier, Hasso Plattner: A Formal Model for Enabling RFID in Pharmaceutical Supply Chains, 44th Hawaii International Conference on System Sciences, 2011 [9] Matthieu-P. Schapranow, Alexander Zeier, Hasso Plattner: A Dynamic Mutual RFID Authentication Model Preventing Unauthorized Third Party Access, The 4th International Conference on Network and System Security, 2010 [10] Matthieu-P. Schapranow, Mike Nagora, Alexander Zeier: CoMoSeR: Cost Model for Security-Enhanced RFID-Aided Supply Chains, 18th International Conference on Software, Telecommunication and Computer Networks, 2010 Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 13

14. Related Publications [11] Jürgen Müller, Martin Lorenz, Felix Geller, Matthieu-P. Schapranow, Thomas Kowark, Alexander Zeier: Assessment of Communication Protocols in the EPC Network: Replacing Textual SOAP and XML with Binary Google Protocol Buffers Encoding, 17th IEEE International Conference on Industrial Engineering and Engineering Management, Xiamen, China, 2010 [12] Matthieu-P. Schapranow, Jens Krüger, Vadym Borovskiy, Alexander Zeier, Hasso Plattner: Data Loading & Caching Strategies in Service-Oriented Enterprise Applications, Proceedings of IEEE Congress on Services (SERVICES 2009), Los Angeles, CA, USA, 2009 [13] Jürgen Müller, Matthieu-P. Schapranow, Marco Helmich, Sebastian Enderlein, Alexander Zeier: RFID Middleware as a Service - Enabling Small and Medium-sized Enterprises to Participate in the EPC Network, 16th International Conference on Industrial Engineering and Engineering Management (IE&EM), Beijing, China, 2009 [14] Jürgen Müller, Matthias Uflacker, Jens Krüger, Matthieu-P. Schapranow, Alexander Zeier: noFilisCrossTalk 2.0 as Device Management Solution, Experiences while Integrating RFID Hardware into SAP Auto-ID Infrastructure, 16th International Conference on Industrial Engineering and Engineering Management (IE&EM), Beijing, China, 2009 [15] Matthieu-P. Schapranow, Jürgen Müller, Sebastian Enderlein, Marco Helmich, Alexander Zeier: Low-Cost Mutual RFID Authentication Model Using Predefined Password Lists, 16th International Conference on Industrial Engineering and Engineering Management, Beijing, China, 2009 [16] Matthieu-P. Schapranow, Martin Grund, Jens Krüger, Jan Schaffner, Anja Bog: Combining Advantages - Unified Data Stores in Global Enterprises, IEEE Symposium on Advanced Management of Information for Globalized Enterprises, Tianjin, China, 2008 [17] Jürgen Müller, Matthieu-P. Schapranow, Conrad Pöpke, Michaela Urbat, Alexander Zeier, Hasso Plattner: Best Practices for Rigorous Evaluation of RFID Software Components, Proceedings of the 6th European Workshop on RFID Systems and Technologies, Ciudad Real, Spain, 2010 Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 14

15. Related Publications [18] Matthieu-P. Schapranow, Jürgen Müller, Alexander Zeier, Hasso Plattner: Sustainable Use of RFID Tags in the Pharmaceutical Industry, European Workshop on Smart Objects: Systems, Technologies and Applications, Ciudad Real, Spain, 2010 [19] Matthieu-P. Schapranow, Jürgen Müller, Alexander Zeier, Hasso Plattner: RFID Event Data Processing -- An Architecture for Storing and Searching, Proceedings of the 4th International Workshop on RFID Technology - Concepts, Applications, Challenges, Funchal, Madeira, Portugal, 2010 [20] Matthieu-P. Schapranow, Jürgen Müller, Alexander Zeier, Hasso Plattner: Security Aspects in Vulnerable RFID-Aided Supply Chains, Proceedings of the 5th European Workshop on RFID Systems and Technologies, Bremen, 2009 [21] Jürgen Müller, Martin Faust, David Schwalb, Matthieu-P. Schapranow, Alexander Zeier, Hasso Plattner: A Software as a Service RFID Middleware for Small and Medium-sized Enterprises, Proceedings of the 5th European Workshop on RFID Systems and Technologies, Bremen, Germany, 2009 Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 15

16. Thank you for your interest!Keep in contact with us. Responsible: Deputy Prof. of Prof. Hasso PlattnerDr. Alexander Zeierzeier@hpi.uni-potsdam.de Matthieu-P. Schapranow, M.Sc. matthieu.schapranow@hpi.uni-potsdam.de Hasso Plattner InstituteEnterprise Platform & Integration ConceptsMatthieu-P. SchapranowAugust-Bebel-Str. 8814482 Potsdam, Germany RFIDSystech10, Sustainable Use of RFID Tags in the Pharma Industry, Schapranow, June 15-16, 2010 16

17. BACKUP Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 17

18. European Pharmaceutical IndustryData Sizing Assumptions ≈15 billion pharmaceuticals on prescription per year [21] ≥11 relevant events per unique item 1 x manufacturer (create + ship) 2 x wholesaler (receive + 2 x observe + ship) 1 x retailer (receive + sell) 1 x end consumer (check) Assuming 360 days production results in ≈5,300 events/s within the European pharmaceutical supply chain Individual events are very small, i.e. avg. 182 Byte[19] Real-time Security Extensions for RFID-aided Supply Chains, Schapranow, Feb 23, 2011 18