Tag Archives: RFID

RFID at Luke AFB

As I explained in a previous post (Helicopter and the risk of RFID hacks) RFID applications are spreading also within the world of aviation. The article I propose below deals with the implementation of an RFID inventory tracking system to manage the 56th FW storage warehouse at Luke AFB in Arizona to replace the old bar codes and to solve a series of bar code-related issues, among which also security ones. The warehouse is used to send out aircraft pallets carrying everything a combat unit deployed in theatre needs to survive for five days without base support: weapons, radio equipment, generators, food and water. The pallets must be assembled and ready to be shipped within 24 hours from the order. The RFID systems provides also alerts to warn base personnel if they have forgotten something on the readiness pallet.

RFID Improves Inventory Accuracy
Luke Air Force Base (AFB) manages mission-critical inventory in real time.

Integrated Solutions, October 2009
Written by: Brian Albright
Inventory accuracy is important no matter what business you’re in, but when your inventory is used to support military personnel and has to be deployed halfway around the world on short notice, the reliability of your inventory data can be the difference between life and death.

Luke AFB in Glendale, AZ is home to the Air Force’s 56th Fighter Wing. The 56th Security Forces Squadron (SFS) at Luke recently replaced a bar code tracking system in its 25,000-square-foot storage warehouse with an RFID (radio frequency identification) solution to better manage equipment inventory for staff on the base and personnel deployed abroad. The warehouse stocks two types of inventory. Supply inventory is used to support on-base staff and includes everything from pens and pencils to body armor, all-terrain vehicles (ATVs), and gun holsters.

Mobility inventory, on the other hand, is used to build 463L aircraft pallets that can hold up to 10,000 pounds of equipment and must be ready to ship within 24 hours. These “readiness pallets” are designed to support teams deployed in foreign battle zones and contain everything necessary to survive for five days without base support —weapons, ammunition, food, water, generators, fuel, radios, etc.

In 2003, the base deployed a batch bar code tracking system that fed inventory information into a stand-alone database application. This system did not allow staff to track routine maintenance and calibration schedules, didn’t provide real-time inventory visibility, and posed some security and accountability issues. “We were the only location using bar codes to track our gear and the deployment gear,” says Matthew Owen, resources advisor for security forces at Luke AFB. “Our headquarters at the Air Education and Training Command in San Antonio wanted to be able to see what each base has in real time, and we came up with an RFID tracking system to piggyback on what we’d already done with bar codes.”

In 2008, the SFS began investigating possible RFID solutions and teamed up with integrator American Barcode and RFID (AB&R) to find an appropriate system. After conducting a systems requirements study, AB&R recommended the CribMaster Accu-Port and Last-Point-Read Tracking Module, along with CribMaster inventory management software from WinWare.

Before the system went live, Owen organized a 12-person team to tag all 65,000 items in the warehouse with RFID labels containing an EPCglobal Gen 2-compliant Squiggle Tag from Alien Technology. Smaller items that couldn’t accommodate a label were placed inside tagged plastic bags for tracking.

Consumable items used on the base are primarily held inside a caged area in the warehouse. Staff access the storage area using a PIN. After picking up the items they need, they pass through a single Accu-Port RFID portal that matches the RFID tags to the PIN. The system generates an inventory list at the supply desk, which employees sign before leaving. By automatically matching supplies to personnel, the system provides full accountability and traceability of inventory and cuts down on the time needed to process and log inventory deductions. The system can also automatically trigger stock reorders. “That saves us time and also saves us money because we don’t overorder,” Owen says. “Eventually, the system will let us know how much material we’re actually consuming so we can adjust our inventory levels.”

Luke AFB utilizes a Motorola fixed-position RFID reader that tracks items too large for the caged supply area or items that have been moved outside for storage. The reader generates last-point-read information on those items so that staff can locate them more easily. Staff use Motorola MC9090 handheld RFID readers to scan goods that are loaded into the readiness pallets. The CribMaster application creates a location record that lists every item stored within each pallet. “The directions for loading the pallet are specific enough to tell you where each piece of equipment goes on the pallet,” Owens says. “We scan everything as it goes on to the container, and as soon as that pallet goes out the door it automatically deducts all of that equipment from our inventory.”

Because certain perishable items (like water and oil) are loaded onto the pallets just before shipment, the system also alerts staff if they’ve forgotten to load something. “If we tried to send a pallet out and we haven’t put those items in, the system lets us know,” Owens says. CribMaster also tracks routine maintenance schedules for items like generators or radios that have to be serviced periodically while in storage.

The system went live in January 2009, and Owen says the base is in the process of evaluating performance data to determine their cost savings. The Air Force expects the system to reduce purchasing costs and make building and issuing readiness pallets more efficient.

RFID has already cut down the time it takes to issue gear to base personnel. “Issuing equipment to a new arrival on the base used to take 45 minutes to an hour to do,” Owen says. “Now we can do it in 15 minutes and have them out the door and on their way.”

Helicopters and the risk of RFID hacks

Eurocopter and Telit recently signed a contract according to which, Telit RF Technology will develop a wireless communication system to monitor helicopters critical systems and to improve aircraft maintenance. According to the information that have been released so far, each critical system/part will be monitored using an Active RFID tag. The tag will be used to store the current status of the part, (most probably) the maintenance checks’ expiration dates, the date of the last check, and so on. The information will be transmitted to a Back End server where an application will correlate the data providing a means to monitor the status of the entire helicopter using the radiofrequency. Unfortunately, the news doesn’t provide any more detail dealing, for example, with the way the communication between tag and the reader will be secured and how the Back End system is going to be protected from hackers’ attacks. I’m a worrying for nothing? Probably. In my experience (I also wrote my graduation thesis on RFID security) security matters are underestimated when implementing RFID solutions. However the risk is extremely high for many reasons. First of all, because, being not as spread as other very well know technologies, RFID is hacked only by skilled people whose probability to cause significant damage is extremely high. Many tend to think that RFID is a safe technology just because only a few know exactly how a transaction between a reader and a tag works. Lack of “security awareness” aside, security countermeasures cost and make tags more expensive (thus render the solution less convenient). Security countermeasures like encryption or authentication require more power, more memory, more space on the tag to accomodate processors and memories able to perform crypto funcions and, consequently, more money. But the risk is extremely high. Just think to the following scenarios:
1) a DoS (Denial of Service) on the reader prevents the internal system from collecting information transmitted by the tag (leaving the Back End application “blind” and unable to perform the typical monitoring functions)
2) malware is injected by a rogue R/W tag to the reader to attack the Back End database or application, to gain unauthorized access to the internal network, to spread a virus, etc.
3) a cloned tag with wrong data (expiration dates, performed checks etc) can be used to provide a false information to the Back End system leading to an aviation safety risk (or disaster).

The Phidget RFID kit I used to test the radiofrequency identification vulnerabilities

The Phidget kit I used to test the RFID vulnerabilities

There are many more and the previous ones were interesting only to show the different risks embedded with Radio Frequency IDentification.
We currently don’t know the countermeasures that were thought to prevent the above theoretical risks from becoming real information or aviation incidents in the Telit – Eurocopter solution. However, just to provide an idea, of the technical measures required to secure an RFID solution and to improve the data security (and the aviation safety in this specific case), as an Information Security expert I will provide a list of the countermeasures aimed to prevent Integrity, Confidentiality and Availability of information (i.e. data) from being compromised (for more information on the attributes I suggest reading: About the hack into the F-35 Lightning II JSF (Joint Strike Fighter) project

  • Mutual Authentication between tags and readers (to be sure that the information are transmitted to valid readers or received by valid tags)
  • Frequency Hopping Spread Spectrum systems with multi-frequency tags (in order to switch on another frequency if the channel is saturated by jamming)
  • Redundant architecture without any SPF (Single Point of Failure): in order to ensure “business continuity”
  • Shielding of the components
  • Physical protection of the readers
  • PUF (Physically Unclonable Functions) as private keys for a challenge-response process
  • Roles segregation with Least Privilege access
  • Middleware code review
  • Input validation before connecting to the DB
  • Network separation by means of Application Gateway Firewalls
  • etc.