RFID Security

Contributed by Joanne C. Kelleher

Louis Parks, SecureRF’s CEO, wrote an article for PharmaTech.com’s Equipment and Processing Report titled Pharmaceutical Packaging and ePedigree Requirements.

The article includes a list of questions the pharmaceutical industry must answer before it can select and implement an ePedigree solution. Due to space limitations parts of the article were edited out.  Because these are important issues I wanted to share the full list from the original submission.  You are invited to submit your comments about how these should be addressed. 

• As a drug product moves through the supply chain, where will the ePedigree information generated at each ownership transfer be stored; in a central database or in the RFID tag on the product itself?
• Who would own, manage, maintain, and protect the data in a centralized database of ePedigrees? How would participants in the supply chain access this information securely? What would happen if the database becomes inaccessible? The current consensus is that although a packager starts each record, an industry association or third party would most likely manage the database.
• If the ePedigree information is stored on the RFID tag, what security will be implemented to protect it from unauthorized readers? Authentication to ensure an authorized access, data encryption, digital signatures, tag anti-counterfeiting and physical security to prevent the tags from being moved should all be considered.
• Should anyone be allowed to access and use ePedigree information for purposes such as marketing? Should a manufacturer or packager be able to monitor how its drug is distributed? How is consumer privacy affected by ePedigree systems?
• What scanning equipment or network access will be required at each point in the supply chain, including pharmacies, hospitals, and clinics? How will this affect the shipping, receiving, and distribution processes?
• How will the costs to establish a system to record and read ePedigree data be shared among members of the pharmaceutical supply chain?

Although there has been lots of discussion about the use of bar codes vs. RFID tags within an e-Pedigree system, we haven’t seen anyone address these other major issues.

Read the rest of the article, originally published on May 20, 2009 at http://pharmtech.findpharma.com/pharmtech/article/articleDetail.jsp?id=598569