A method for whole of system analysis of RFID security

Existing methods for analysis of security in Radio Frequency Identification (RFID) systems take a relatively localized view of security. Rotter (2008) proposed a privacy and security risk assessment framework which was used to assess domain risks using three criteria. Mitrokotsa et al. (2008; 2009) structured threats into system layers, enumerating the threats as well as offering potential defenses for each layer. Since then there has been limited focus on a reference model based approach to RFID security. Therefore, work reported here addresses the existing gap in the RFID security analysis field by introducing a ‘whole of system’ approach to analysis, made possible by way of a reference model, consisting of the three horizontal layers suggested by previous authors: real world, RFID and strategic. But at the same time, adds vertical security partitions for such things as the problem context. This provides a structure that allows existing methods to be applied systematically and across the ‘whole system’.