ISO/IEC 29167-1:2014

Overview

ISO/IEC 29167-1:2014 is a fundamental international standard developed by ISO and IEC, defining the architecture for security services applied to RFID air interfaces as specified in the ISO/IEC 18000 series. Specifically targeting automatic identification and data capture (AIDC), this standard establishes a technical specification for optional security services in RFID systems, addressing key issues such as privacy, integrity, authentication, and confidentiality of data on RFID tags.

The overarching goal of ISO/IEC 29167-1:2014 is to improve the security of RFID devices, enabling organizations to safeguard sensitive information, prevent unauthorized access, and protect the identity of items and individuals interacting with RFID technology.

Key Topics

• Security Mechanisms

  • Untraceability: Provides options to hide or limit tag identification, reducing the risk of unauthorized tracking.
  • Authentication: Frameworks for verifying the authenticity of tags, interrogators, and exchanged data.
  • Secure Access and Encryption: Mechanisms for controlling and securing access to tag data and functions.
  • Cryptographic Suites: Modular cryptographic functions, with the flexibility for tags to support one or more suites.

• Privacy and Data Protection

  • Built-in privacy-by-design and security-by-design features to minimize unauthorized data collection and access.
  • Support for organizing tag data into files with tailored access rights.

• Discovery and File Management

  • Methods for interrogators to discover supported tag features, security mechanisms, and file management schemas.
  • Mechanisms for authorized identification of untraceable tags and dynamic management of tag memory and permissions.

• Crypto Suite Indicator (CSI) Assignment

  • Structured allocation of identifiers to different cryptographic suites for interoperability and scalability, supporting extension as new suites are developed.

Applications

ISO/IEC 29167-1:2014 provides significant practical value in a range of RFID applications where enhanced security is required:

• Supply Chain Management: Protecting items against counterfeit and ensuring data integrity during shipping and logistics.

• Asset and Inventory Tracking: Safeguarding asset identity and ensuring only authorized users can access sensitive inventory data.

• Access Control: Enabling secure entry systems, preventing cloning or unauthorized access via RFID-enabled credentials.

• Healthcare and Pharmaceuticals: Protecting patient privacy and securing the cross-movement of medical equipment and drugs.

• Retail and Customer Privacy: Minimizing in-store tracking of individuals and protecting the confidentiality of purchase data.

By incorporating ISO/IEC 29167-1:2014, organizations can align their RFID deployments with international best practices for security, reduce compliance risks, and strengthen trust among stakeholders.

Related Standards

This standard is part of a comprehensive framework for RFID security within the ISO/IEC ecosystem. Key related standards include:

• ISO/IEC 18000 series: Covers foundational air interface protocols for RFID.
• ISO/IEC 29167 (other parts): Defines specific cryptographic suites, such as AES-128, ECC-DH, and others, for implementing robust security at the air interface level.
• ISO/IEC 15962: Governs data encoding rules and logical memory functions for RFID.
• ISO/IEC 18031: Specifies techniques for secure random bit generation necessary for cryptographic operations.
• GDPR and other privacy frameworks: While not ISO standards, these regulatory documents influence privacy requirements and risk management strategies for RFID systems.

Adopting ISO/IEC 29167-1:2014 ensures that RFID solutions can scale and evolve to meet future security challenges, while maintaining compatibility and interoperability with established international standards.