<< July 2006 | Home | September 2006 >>

Privacy & Security Issues in EPCglobal Network

can I read the tag information on your cellphone and find out your birthday in EPCglobal Network?

One research project is currently at the stage where findings in privacy and security issues will have to be addressed with respect to the EPCglobal Network as proposed by EPCglobal. The discussion given here is based on the information provided in the document, "The EPCglobal Architecture Framework," Final Version as of 1 July 2005, published by EPCglobal. The framework is described in "an open and vendor neutral manner," can be implemented with no implied platform, is designed to be extensible and scalable, secure and privacy-ensured.

The framework consists of "EPCglobal Standards," based on which 'core services' are built. These services are to be "operated by EPCglobal and its delegates" - collectively referred to as "EPCglobal Core Services." Users of these services are driven by the fact that EPC (Electronic Product Codes) are adopted in their business environment. The specific goal is to enhance the supply chain, thus users are likely partners [the term "trading partners" was used] in supply chains. These users are one type of 'end-users', while the other type of end-users are the solutions providers. Standards entails hardware, software and data interfaces, e.g., RFID tag, protocol, and middleware such as Savant's. Core services, e.g., include ONS (Object Name Service).

We now discuss information sharing among partners in a supply chain. The context of discussion is of supply chains, but not"supply chain network." As partners adopted EPC for goods to facilitate management of the physical flow, data of goods can be correctly obtained. As these end-users become part of this EPCglobal infrastructure (standards, services, and EPC), the operational effect is viewed as a EPCglobal Network. As data filters into the centralized EPCglobal, services are offered for end-users to access the data accordingly, or pipe the data into solution providers to obtain target business information.

Different classes of RFID tags (UHF and HF) are defined. The Auto-ID Center originated UHF Class 0 Gen 1 and UHF Class 1 Gen 1 specifications [RF Protocol] (November 2003) are now superceded by EPCglobal's UHF Class 1 Gen 2 specification [Tag Protocol] (December 2004). With 'EPC Tag Data Specification' also ratified, the remaining components in this framework are either in development, or TBD. The security issues need to be identified and the privacy policy needs to be formulated according to established theory or best practices. In both situations, the enforcers have just to be determined, be it embedded components, agents or entitlement services for on-demand privacy and security preference as we propose.

Nomadic RFID Tags

business chain integration

The word 'nomad' projects an image of a family of Tibetans herding furry goats somewhere in a flatland with the horizon always the point of reference. No matter, they are self-sufficient to wherever they move, with a chain of forwarding mailing addresses. You know where they had been, but you may not know why they were where they were. Nomadic computing was interesting, at that time, when I was trying to fine out the differences between 'parallel computing' and 'distributed computing.' Well, I read an article that inititates this posting when I was doing R&R this early August.

A research commentary on nomadic computing [1] (versus ubiquitous computing [6] disccused by the same authors) recap what I knew about nomadic computing when wireless communication was beginning to seep into the business world. I used the word nomadic to describe the nature of RFID tag on business item (a product, a raw material, a part of an airplane) that it (the tag) suffices to energize business processes at any point of contact. 'Energize' may not be the right word to describe the integrative effect it brings to activities within a business process, and subsequently of business processes within and without. Anyhow, as this nomadic RFID tag going about its no residence movement, it leaves a trail of information markers that become what the RFID space.

It was Leonard Kleinrock that coined this term 'nomadic computing'. We all want to "stay" in the same operating environment no matter if we are at home, at office, or at some one-off room when travelling. Of course, this is easily said then done - though not limited by the technology anymore, but more hindered by the lack of integrative plug-and-play gadgets that all computing platforms support. To quote, "Nomadic computing is a technology allowing anyone to leave their office and still have seamless access to the same set of network services as they had at their office, wherever they go with whatever device they're carrying, regardless of the environment they enter." [2] Nomadic computing, in one instance, can be accomplished now with a protected access to my desktop, say my office, via VNC [3], or remote desktop [4] in a Windows environment. If I have Skype [5], or similar software, then calling someone on the phone line will be also be possible given that the local (client) computer's speakers and microphone are mapped to the remote desktop computer. The question about the connectivity remains but largely has been resolved with the availability of hotspots (WiFi) - unlimited access sometimes may not be enabled due to information scoping ("information availability is bounded by the location - for example, in libraries where subscribed materials are downloadable per IPaddress realm at class C level").

Maybe 'nomadic RFID tags' will be a concept to base our comtemplation about the role of RFID technology in business. RFID tags are electronic devices that each individually carry identification data of the unit item that is marked with a tag and no other RFID tag. The data is written onto the tag for some purpose by the purveyor of the unit item. A nomadic RFID tag is an identification marker, its final destination is not necessary known. But its temporary residences are traceable, and at each residence, services to the unit item are executed; and those services are highly efficiency as a result of the data on tag and the information obtained via the identification code of the tag.

Attempting to come up with a definition, here it is. Let it to be scrutinized for a few months...

"Nomadic RFID Tags (nRT) is a technology allowing a business unit item to traverse trading partners enabling seamless access to the same set of network services identifiable by the unit item’s single unique identity with proper on-demand privacy and security facilitation, regardless of the environment they enter."


[1] Lyytinen, K., and Yoo, Y. "Research Commentary: The Next Wave of Nomadic Computing," Information Systems Research 13 (4), Dec 2002, 377-388.
[2] "Kleinrock on Nomadic Computing," Ubiquity, Volume 6, Issue 25 (July 12 - 19, 2005), http://www.acm.org/ubiquity/interviews/v6i25_kleinrock.html
[3] Real VNC (Virtual Network Computing), http://www.realvnc.com/
[4] http://www.skype.com
[5] Remote Desktop, Microsoft website
[6] Lyytinen, K., and Yoo, Y. "Issues and Challenges in Ubiquitous Computing," CACM 45 (12), December 2002, 63-65.