I. E-Passport Proposal Following the 9/11 terrorist attacks, the Bush Administration launched the Machine Readable Passport (MRP) program to increase border security. In 2005, the US government issued its first E-passports (see Fig 1) to select government officials and went public with issuance in late 2006, albeit amid numerous privacy concerns. The new passports contain traditional passport information (such as name, date of birth, gender, place of birth, date of issuance and expiration, and passport number) as well as personal biometric information for facial and fingerprint recognition purposes on a 64 kilobyte chip. Figure 2 shows the configuration of data in the E-passport (Yong & Bertino, 2007). The US Department of State and Western Hemisphere Travel Initiative determined electronic passports were necessary in order to facilitate faster immigration inspections and increase border protection and security. E-passports are scanned prior to inspections, providing border patrol agents additional assurances regarding authenticity, originality, and validity of the relationship between the holder and travel documentation. They also permit officials to scan passport information against watch lists and national no-travel databases to more accurately define prospective terrorists and other threats to the nation (US DOS, 2009).
II. Contactless Technology: Radio Frequency Identification (RFID) International standards for passports have been set by the International Civil Aviation Organization (ICAO) for the past 50 years. The ICAO accepted the RFID technology as a leading global standard due to its “global interoperability, reliability, durability, and practicality” (King, Meingast, & Mulligan, 2007). While some countries use other smart-card technology for their versions of E-passports, the 27 countries in the US Visa Waiver Program are required to use the RFID technology. All 189 ICAO member states have agreed to issue E-passports by 2010 (Witteman, 2007). A contactless integrated circuit (IC) is the core of the E-passport. A small inlay is inserted in the rear cover of the electronic passports that uses a secure version of RFID. An antenna coil surrounds the IC that is stimulated by a radio frequency field to activate and communicate with a reader (Wright, 2005). The IC meets the transmission criteria for proximity based identification cards provided by the ISO 14443 standard (US DOS, 2009). Three types of RFID ICs are available: active, semi-active, and passive (RFID, 2004). The E-passport uses a passive RFID, meaning the IC must be activated by a radio frequency field within a certain range determined by the ICAO as standard (903-927 MHz). As the passport enters the appropriate radio frequency, the IC is activated. The initial signal is sent to the IC from the reader (Wright, 2005). This signal is sent to prove authenticity of the passport data, known as passive authentication (PA) using Public Key Infrastructure (PKI) technology (Liersch, 2009) PKI uses a “cryptographic computation to validate the authenticity using the public key of the passport issuing country” evaluated against a separate certificate authority from the reader. If the key is accepted, the reader requests the travel document and biometric data from the IC (Witteman, 2007). Once the reader obtains the data, the traveler’s information can be checked against multiple Homeland Security no-travel databases to minimize terrorist risks.
IV. Security and Privacy Concerns addressed by the US Department of State Initial issuance of E-passports to the public was expected by the end of 2006, but privacy concerns created demand for increased security measures before widespread adoption. In response to public outcry, the US Department of State added personal privacy security measures to the E-passport. Additions included an anti-skimming shield built into the cover of the passport, as well as Basic Access Control (BAC), which encrypts the transmission between the passport and reader. BAC also creates a unique “unlock code from a scan of the machine-readable portion of the passport” (King, Meingast, & Mulligan, 2007). BAC and passive authentication (PA) are mandatory for ICAO member countries. The main security and privacy risks addressed by the Department of State include: Skimming. Skimming is the process of obtaining data from an individual that has not granted permission to access such information. The E-passport includes a metal insert in the cover (a Faraday cage) that blocks RF transmission. When closed, the passport chip will remain passive, even in a matching radio frequency field (King, Meingast, & Mulligan, 2007). Skimming and eavesdropping were the two main privacy concerns among privacy advocates (US DOS, 2009). Eavesdropping. Eavesdropping is the interception of information as it is transferred from the IC to the reader. Preventative measures to reduce eavesdropping primarily involve BAC. The target of BAC is confidentiality, focusing on providing authentication and creating a secure channel of communication. A reader must first optically scan the Machine Readable Zone (MRZ) located at the bottom of the passport, and derive the access key from the scanned information. When a communication channel is developed, the reader authenticates the passport based on an encrypted key embedded in the MRZ. If authentication is successful, the chip releases the encrypted data to the reader, which is decrypted securely on the reader. BAC provides security against both skimming and eavesdropping as it limits access to readers by using access keys (King, Meingast, & Mulligan, 2007). Cloning. Cloning is the process of creating a duplicate passport by adding data on a passport to a fake chip (King, Meingast, & Mulligan, 2007). If a hacker gained access to a blank passport, he/she could potentially duplicate an unassuming traveler’s passport without them knowing. In this circumstance, the traveler would not report the passport lost or stolen because they still physically have it. This issue has been the most difficult to address (Witteman, 2007). Currently, the Department of State is relying on PA and BAC to thwart potential clones (US DOS, 2009). As described later, active authentication (only used in a few countries due to high costs) and RFID fingerprinting are potential security mechanisms to minimize cloning risks. Tracking. Tracking is the process of obtaining information related to the movement of a person or object (King, Meingast, & Mulligan, 2007). When the reader initially communicates with the chip, the unique ID (UID) of the chip is transferred in order to begin passive authentication. If the ID were to remain static, a hacker would need to intercept the communication channel only once to track a passport holder. To deal with this, each chip has a built in random number generator that changes the UID before each session to prevent the use of the UID for tracking purposes (Bundesamt fur Sicherheit, 2009).
V. Additional security mechanisms not implemented in current E-passports Active authentication (AA). The cloning concern can be addressed with active authentication. While passive authentication addresses the authenticity of passport data, active authentication addresses the authenticity of the passport chip. AA uses an IC-individual key pair to induce a challenge-response protocol that compares a public key stored in the reader with a private key in the chip. The chip can prove the key pair before allowing a reader to access data. The private key is stored in secure memory that cannot be read out, making it unique to the chip and secure (Bundesamt fur Sicherheit, 2009 & Liersch, 2009). The use of this technology is limited in RFID due to the size requirements for computations, although several European countries that use other forms of smart-card technology have already implemented AA (Liersch, 2009). Extended access control (EAC). EAC allows the E-passport to authenticate the reader attempting to gain access in order to limit access to personal information. The system is based on “certificate validation, issued by the E-passport issuing country” (Liersch, 2009). The IC uses PKI based on individual asymmetric key pairs. The use of the asymmetric key pairs provides a strong, secure communication channel (Witteman, 2007). The US only includes facial image biometric information in E-passports. The new passports do not include biometric information beyond a facial image such as fingerprints, so sensitive data that should only be accessed by authorized readers was not fully protected. As the E-passport technology develops and biometric information is used for processes such as automated inspections, the use of EAC will be necessary to secure more sensitive data (Bundesamt fur Sicherheit, 2009). See Figure 3 for all security mechanisms recommended, although not mandated, by the ICAO (Liersch, 2009). RFID fingerprinting. As recent as mid-November 2009, Thompson and Di, researchers from the University of Arkansas, have discovered unique ‘electronic fingerprints’ derived from several physical characteristics in each RFID chip. The passive RFID tag modulates a signal after being charged which is unique to each individual chip. Radio frequencies range from 903 to 927 megahertz and increased by increments of 2.4 megahertz. These measurements revealed that each tag had a unique minimum power response at multiple radio frequencies. Same-model tags also varied significantly in power responses (Thompson, D & McGowan, 2009). An added feature of this ‘fingerprinting’ is that the unique characteristics are separate from the computation capabilities of RFID ICs. Thus, minimal costs would be associated with implementing this added security that would limit the possibility for cloning (Thompson, D & McGowan, 2009).
VI. Conclusion E-passports provide a means for increased border security, although the contactless nature of the RFID technology creates significant privacy concerns. The Department of State has taken measures to reduce the threat of some of these concerns, such as skimming and eavesdropping, though there are still several opportunities for hackers to gain access to an individuals travel documents. While there are proven concepts to increase the authenticity, validity, and originality of E-passports, policies and procedures need to be implemented in order to use them. Understanding that RFID technology is limited to a cost-benefit relationship, additional research will be necessary to reduce the investment necessary in precautionary measures such as EAC and AA. The current measures addressing privacy concerns offer limited privacy protection at the cost of complex technology and procedures.

References
Bundesamt fur Sicherheit (2009). Advanced security mechanisms for machine readable travel documents. Retrieved November 25, 2009 from https://www.bsi.bund.de/cae/servlet/contentblob/532066/publicationFile/44792/TR-03110_v202_pdf
King, J., Meingast, M. & Mulligan, D. (2007). Embedded RFID and everyday things. IEEE International Conference on RFID. March 26-28. Grapevine, TX.
Liersch, I. (2009). Electronic passports – from secure specifications to secure implementations. Information Security Technical Report. 14, 96-100. Retrieved from Elsevier ScienceDirect.
O’Connor M.C. (2007 Aug 16). One year later, US E-passports architect says system is a success. RFID Journal. Retrieved November 23, 2009 from http://www.rfidjournal.com/article/articleview/3567/1/1/
Swedberg, C. (2004 Nov 2). US tests E-passports. RFID Journal. Retrieved November 23, 2009 from http://www.rfidjournal.com/article/articleview/1218/1/1/
Thompson, D. & McGowan M. (2009 Nov 19). Fingerprinting RFID tags: Researchers develop anti-counterfeiting technology. University of Arkansas. Retrieved November 23, 2009 from http://dailyheadlines.uark.edu/16260.htm
Witteman, M. (2007 Dec 3). On the security of E-passports. Help Net Security. Retrieved November 23, 2009 from http://www.net-security.org/article.php?id=1100&p=7.
Wright, M. (2005 July 5). Contactless traveling. Electronics Design, Strategy, & News, 50(14), 42. Retrieved from Academic Search Premier.
US Department of State (2009). The US electronic passport. Bureau of Consular Affairs. Retrieved from http://travel.state.gov/passport/eppt/eppt_2498.html
Yong, J. & Bertino, E. (2007 October). Replacing lost or stolen E-passports. Computer, 40(10). Retrieved from IEEE Xplore.