Mirage: Mitigating Illicit Inventorying in a RFID Enabled Retail Environment

TL;DR

Mirage is a low-cost RFID security system that uses honeytokens to inject noise, effectively preventing corporate espionage by obscuring sales and restocking trends in retail environments.

Contribution

The paper introduces Mirage, a novel low-cost RFID security solution employing honeytokens and a history-based algorithm to mitigate illicit inventorying attacks.

Findings

Mirage successfully randomizes sales and restocking trends.

The system adds minimal cost to existing inventory control processes.

Evaluation in a real warehouse environment confirms effectiveness.

Abstract

Given its low dollar and maintenance cost, RFID is poised to become the enabling technology for inventory control and supply chain management. However, as an outcome of its low cost, RFID based inventory control is susceptible to pernicious security and privacy threats. A deleterious attack on such a system is corporate espionage, where attackers through illicit inventorying infer sales and restocking trends for products. In this paper, we first present plausible aftermaths of corporate espionage using real data from online sources. Second, to mitigate corporate espionage in a retail store environment, we present a simple lowcost system called Mirage. Mirage uses additional programmable low cost passive RFID tags called honeytokens to inject noise in retail store inven-torying. Using a simple history based algorithm that controls activation and de-activation of honeytokens, Mirage randomizes sales and restocking trends. We evaluate Mirage in a real warehouse environment using a commercial off-the-shelf Motorola MC9090 handheld RFID reader and over 450 Gen2 low cost RFID tags. We show that Mirage successfully flattens and randomizes sales and restocking trends while adding minimal cost to inventory control.