Personal RFID tags store valuable information private to their users that can easily be subject to eavesdropping, unauthorized reading, owner tracking, and cloning. RFID tags are also susceptible to relay attacks and likely to get lost and stolen. In this paper, we introduce the problem of user authentication to RFID tags. This allows users to control when and where their RFID tags can be accessed. We present a novel approach for user authentication to multiple RFID tags called “Vibrate-to-Unlock” (VtU). This technique uses a mobile phone as an authentication token, forming an unidirectional tactile communication channel between users and their RFID tags. Authenticating to an RFID tag involves touching a vibrating phone to the tag or an object carrying the tag, such as a wallet. We discuss the design and implementation of this new method on Intel's WISP tags. We also report on a preliminary usability evaluation of our VtU prototype.

No abstract available.

The operation of achieving authenticated key agreement between two human-operated devices over a short-range wireless communication channel (such as Bluetooth or WiFi) is referred to as "Pairing". The devices in such a scenario are ad hoc in nature, i.e., they can neither be assumed to have a prior context (such as pre-shared secrets) with each other nor do they share a common trusted on- or off-line authority. However, the devices can generally be connected using auxiliary physical channel(s) (such as audio, visual, etc.) that can be authenticated by the device user(s) and thus form a basis for pairing.