To Lock or Not to Lock…
By Rick Pestian, Checkpoint
While working with customers on RFID implementations over the years, I’ve noticed that a large number of retailers don’t lock their RFID labels. Possibly, they don’t know they can — or in many cases, that they should — lock them.
When an RFID reader “reads” an RFID label, the EPC data “written” to the label’s integrated circuit chip’s memory is collected by the RFID reader. If this data in the RFID label is not locked, anyone with an RFID reader and simple RFID software can change the data on the RFID label and, in turn, corrupt the system.
Today, most retailers are using RFID primarily to perform lightning fast cycle counts. Usually this is accomplished with a hand-held RFID reader as opposed to a fixed reader infrastructure. In such cases, if someone happened to maliciously tamper with RFID label encodings, it wouldn’t result in massive losses.
But there is a significant move towards a more hands-free implementation of RFID. This includes fixed readers and antennas throughout the retail store, with those readers integrated into the retailer’s network to allow for efficient data collection and system health monitoring. With the readers all tied to the same network, it is possible for a hacker to run a malicious virus that could potentially erase, kill or even reassign every RFID label in every retail outlet overnight. This would effectively render that retailer’s RFID investment useless until the retailer could either perform new RFID label encodings or apply new RFID labels.
Today it is possible to purchase an RFID label reader/writer for your smart phone for a few hundred Euros or dollars. As retailers move to use RFID at the point of sale, if RFID labels are not locked, an average thief could capture the EPC number from a less expensive item and write that number to a more expensive one prior to taking the merchandise to the point of sale.
The various memory banks of Class 1 Gen 2 RFID labels being used today can be categorised in one of four lock states: unlocked, perma-unlocked (can never be locked), locked and perma-locked (can never be unlocked). The tag identification number (TID) is one example of a perma-locked memory bank.
Retailers locking an RFID label can change information on the label in the future using a password. But the costs associated with maintaining passwords — as well as the time and expense to unlock, rewrite and re-lock the label — may be far more expensive than just replacing the RFID label. And even if you do lock the labels and hide the password, it is always possible that someone could discover the password, rendering the security useless. For those reasons, I recommend that retailers perma-lock the EPC data bank on all RFID labels unless there is a valid reason to change the label’s EPC data in the future.
The process of locking the EPC data bank of an RFID label occurs at the same time the label’s EPC data is encoded and only takes milliseconds, but it does take more time than just encoding the EPC number to the label. For this reason, although minimal, there may be added expense. This needs to be quantified depending on the complexity of the situation.
All retailers adopting RFID should review, understand and make a conscious decision regarding a tag locking policy. Even if that policy is to not to have the encoded RFID labels they purchase or produce locked, they should be aware of the possible implications of someone tampering with their RFID labels.
So, whether you lock, perma-lock or do not lock at all, you should have a comprehensive RFID label locking policy in place to ensure your team members understand your choices. Please note that RFID experts at Checkpoint are available to discuss with retailers any questions they may have about locking policies or other issues of interest to them. Feel free to reach out to us at firstname.lastname@example.org.