The aerospace industry falls into civilian and military manufacturers. Never the less, both use RFID in similar ways and they need RFID security for a number applications. Most prominent among these is parts maintenance and management. Consider a civilian aircraft manufacturer which sells planes to airline customers around the world. When a part breaks down, the affected airline may not be able to supply the required replacement in a timely fashion. Thus, airlines exchange parts with one another to alleviate the need for extensive inventories at each airport. An American Airlines plane that is grounded at London Heathrow will receive help in the form of spare parts from British Airways and a Lufthansa plane that needs repair in Moscow will very likely leave with an Aeroflot part installed. In this manner many airlines help one another.
 
One of the complications in the parts management process is that each part is only suitable for a specific type and model of plane. Airlines thus need to keep track of the specific information on every part they hold in stock e.g. when was it made, whether it is flight ready, has it been properly stored and handled, also whether it is certified for the type of aircraft that now needs it, etc. All of this information is kept on paper today.
 
By leveraging high-memory passive RFID tags on parts, the manufacturer can simplify information processing for customers and also introduce higher levels of efficiency in its own aftermarket parts supply chain. The business case for such a parts management solution quickly becomes very attractive when we consider that it can take up to 21 man-days to create an aircraft readiness log alone, which contains a mandated list of all key parts that go onto the airplane. Today the manufacturer manually records every single part, serial number and other relevant information for between 1,750 and 2,500 parts per plane, which is why this process takes very long. One civilian aerospace manufacturer estimates that this process can be reduced to two man-days through the application of RFID thus saving over 90% of the required manpower.
 
In order to use the parts tracking RFID system in all corners of the world, it is pivotal that the information about a specific part is stored on the part. We cannot assume that every airport and airline has access to a central parts management system. In addition, such a central system would also pose a security vulnerability in its own right e.g. it would make it convenient for attackers to break into the central database and change critical information there. Lastly, airlines are historically reluctant to accept central databases and usually want to maintain their own systems instead. In consequence, manufacturers are forced to store a lot of information on a high-memory RFID tag for each part.

 

However, this creates a challenge as well in that the information on RFID tags can be changed, or worse, deleted. In this manner a broken or potentially unsuited part could become a good one. Granted, the airline tests every part that is put on a plane and can easily detect a broken or heavily damaged part. With knowledge of the system and airplane components, it might well become possible to circumvent the current safety checks. More importantly, what would happen when an entire warehouse of spare parts loses the information stored on RFID tags. Such a scenario requires that each and every serial number is individually read and recorded. It could take months before the airline could resume its maintenance and repair operation. At the same time, criminal organizations can easily make money through extortion or simply by betting against the stock of the target airline while buying shares of its closest competitor.

 

To secure RFID applications in aerospace, it is pivotal to encrypt data on tags, provide secure IDs and to authenticate each reader that accesses an RFID tag. This latter point is particularly important in that an RFID tag that does not respond to a foreign or rogue reader preempts any potential damage that could possibly be done by malicious third-parties.