Security considerations in the design and peering of RFID Discovery Services

There is growing interest in discovery services for locating RFID and supply chain data between companies globally, to obtain product lifecycle information for individual objects. Discovery services are heralded as a means to find serial-level data from previously unknown parties, however more realistically they provide a means to reduce the communications load on the information services, the network and the requesting client application. Attempts to design a standardised discovery service will not succeed unless security is considered in every aspect of the design. In this paper we clearly show that security cannot be bolted-on in the form of access control, although this is also required. The basic communication model of the discovery service critically affects who shares what data with whom, and what level of trust is required between the interacting parties.