Practical Access Control Management for Outsourced EPC-related Data in RFID-enabled Supply Chain

To reduce deployment and maintenance costs companies often decide to outsource parts of RFID infrastructure to an external application service provider. In scenarios where outsourced data can be accessed by several parties, the managing of discretionary access control to it becomes a very important issue. In this paper we present an approach that uses selective encryption for managing discretionary read/write access to the data that describe tagged objects and are submitted by a number of parties to a central datastore. Our approach does not reveal relationships between the parties and allows efficient dynamic assignment of read permissions. We proceed with presenting experimental performance results and based on them discuss the applicability of our approach to practical scenarios.