Thursday, February 22, 2007

Handheld RFID Readers - Wireless Security Issue

The standards for cryptography of data over wi-fi network are:
  1. WEP (Wired Equivalent Privacy): WEP is part of the IEEE 802.11 standard released in September 1999. Several serious weaknesses were identified by cryptanalysts. And, it is a fact that any WEP key can be cracked with software readily available over internet in few minutes.
  2. WPA (Wi-Fi Protected Access) WEP was superseded by Wi-Fi Protected Access (WPA) in 2003, and then by the full IEEE 802.11i standard (also known as WPA2) in 2004.
  3. LEAP (Cisco Wireless EAP) Meanwhile, Cisco developed LEAP (Lightweight Extensible Authentication Protocol) based on EAP type specified by IEEE 802.1X to provide Wi-Fi security. LEAP is a proprietary system that doesn't fit on a network open to a variety of devices, from standard PC laptops to Macs and handheld devices.

Enterprise wireless network implements WPA or EAP based security solution. Handheld RFID reader uses WLAN to connect to the Access Point and routes the tag-events. The data can be sent over tcp/ip or http. To connect to a wirless Access Point, the handheld RFID reader must support the implemented wireless security protocol.

Based on my research last week, it seems there is no handheld RFID reader currently available in the market which supports LEAP protocol. The industry leaders, such as Symbol, are working on to provide support to the LEAP and WPA protocols. This is a serious limitation in deploying RFID solution using handheld readers in a secured wireless network.

No comments: