Vulnerability Assessment of IoT Airport Luggage Management Systems

The airport's luggage management process has traditionally been supported by airline employees who receive and check luggage at the counter, placing paper-based barcodes to identify passengers' bags. Using conveyor belts and multiple barcode readers along the belt path, these bags are guided through the system to the loading section, where airport staff collect batches of luggage for transport by vehicles to the airplane cargo loading belts. However, in this multi-step process, bags commonly get lost or delayed due to various issues, including barcodes being covered or damaged and thus unreadable by scanners, bags becoming physically stuck or falling off at belt intersections, and faulty readers. To mitigate or reduce some of these problems, airports and airlines have gradually been working to implement RFID-based luggage identification for more reliable tracking. However, the cost of installing RFID technology throughout every airport luggage tunnel may be too high for immediate deployment. RFID technology, using active and passive tags for communication, is widely used in tracking, inventory, access control, and NFC applications. However, vulnerabilities like tag cloning and data overwriting raise security concerns, especially for luggage management systems. This paper presents a testbed design that facilitates the implementation of cybersecurity attack scenarios on an RFID IoT airport luggage management system, along with the corresponding vulnerability assessment.