Cryptanalysis and improvement of a group RFID authentication protocol

Radio frequency identification (RFID) is a relatively new technology widely deployed in many applications. Due to several advantages of the technology including decreased costs and increased speed, different organizations and industries show interest in it, and its application range is gradually developing. Some of the main problems of RFID are security and privacy. The implementation of authentication protocols is a flexible and effective way to solve these problems. Several authentication protocols of RFID are based on hash functions or symmetric cryptography. According to the small size of the key, efficient computations, and high security in the elliptic curve cryptography (ECC), its use has increased. Recently some certain ECC-based authentication protocols have been represented. In this paper, a RFID authentication protocol is presented using ECC for mutual authentication to overcome weaknesses of the existing authentication protocols. It has been shown that the proposed protocol satisfies security requirements of RFID authentication protocol and prevents different attacks on RFID systems. Also, the proposed authentication protocol has been analyzed in terms of computational costs, communication costs, and storage requirements. The results revealed that the proposed authentication protocol is an appropriate model for RFID tags with limited resources.

Radio frequency identification (RFID) is the fastest growing technology in the world today. Thus, wireless communication between tags and readers became an integral part of retail products, library books, personal identifications, and healthcare. The RFID system can provide security features to the data transferred along the network to maintain data privacy, integrity, and confidentiality. Elliptic curve cryptography (ECC) is widely used in RFID authentication protocols to improve communication security. Zhao proposed an RFID authentication protocol using ECC where a unique access list for tags is generated with the reader identifier to elevate the security level. Although Zhao's protocol can withstand most of the RFID security attacks, it has a very high computation cost. The authors improve Zhao protocol and propose a new RFID authentication protocol by reducing the computation cost almost to the half of that in Zhao. The proposed protocol shows a significant improvement in the computation cost.

There are many protocols proposed for protecting Radio Frequency Identification (RFID) system privacy and security. A number of these protocols are designed for protecting long-term security of RFID system using symmetric key or public key cryptosystem. Others are designed for protecting user anonymity and privacy. In practice, the use of RFID technology often has a short lifespan, such as commodity check out, supply chain management and so on. Furthermore, we know that designing a long-term security architecture to protect the security and privacy of RFID tags information requires a thorough consideration from many different aspects. However, any security enhancement on RFID technology will jack up its cost which may be detrimental to its widespread deployment. Due to the severe constraints of RFID tag resources (e.g., power source, computing power, communication bandwidth) and open air communication nature of RFID usage, it is a great challenge to secure a typical RFID system. For example, computational heavy public key and symmetric key cryptography algorithms (e.g., RSA and AES) may not be suitable or over-killed to protect RFID security or privacy. These factors motivate us to research an efficient and cost effective solution for RFID security and privacy protection. In this paper, we propose a new effective generic binary tree based key agreement protocol (called BKAP) and its variations, and show how it can be applied to secure the low cost and resource constraint RFID system. This BKAP is not a general purpose key agreement protocol rather it is a special purpose protocol to protect privacy, un-traceability and anonymity in a single RFID closed system domain.

Radio Frequency Identification (RFID) systems represent a key technology for ubiquitous computing and for the deployment of the Internet of Things (IoT). In RFID technology, authentication protocols are often necessary in order to confirm the identity of the parties involved (i.e. RFID readers, RFID tags and/or database servers). In this article, we analyze the security of a mutual authentication protocol proposed by Wang and Ma. Our security analysis clearly shows major security pitfalls in this protocol. Firstly, we show two approaches that an adversary may use to mislead an honest reader into thinking that it is communicating with a legitimate database. Secondly, we show how an adversary that has compromised some tags can impersonate an RFID reader to a legitimate database. Furthermore, we present a new adversary model, which pays heed on cases missed by previous proposals. In contrast to previous models where the communication between an RFID reader and a back-end server is through a secure channel, our model facilitates the security analysis of more general schemes where this communication channel (RFID reader-to-server) is insecure. This model determines whether the compromise of RFID tags has any impact on the security of the reader-to-server communication or vice versa. In a secure protocol, the possible compromise of RFID tags should not affect the RFID reader-server communication. In this paper, we show that compromising of RFID tags in Wang and Ma protocol has a direct impact on the reader-server security. Finally, we propose a new authentication protocol that offers an adequate security level and is resistant against the mentioned security risks. The security proofs of the proposed protocol are supported with Gong-Needham-Yahalom (GNY) logic and Scyther tool, which are formal methods to evaluate the security of a cryptographic protocol.

SummaryIn the fifth generation mobile networks (in short, 5G), radio frequency identification (RFID) tags are embedded in a growing number of personal items, especially in smartphones. The RFID authentication protocols in 5G should be anti‐scanning and privacy‐enhancing, because RFID tags in smartphones often suffer from leaking private trace of mobile users. However, majorities of existing RFID protocols are vulnerable to location‐tracking threats, and to distributed denial of service (DDoS) attacks on back‐end servers. To eliminate these threats, we propose a hash‐based mutual authentication protocol for smartphones in 5G. This protocol protects individuals' location privacy against malicious hidden scanning in public places. By the authentication of RFID readers via hash values, the proposed protocol is robust against the aforementioned threats. Additionally, our authentication efficiency on the tag side is 2H (two hash calculations), which outperforms most of previously reported solutions based on hash, and the tag stores only two vectors (one is k‐bit and the other j‐bit). Copyright © 2015 John Wiley & Sons, Ltd.

RFID (radio frequency identification) is an Internet of Things (IoT) enabling technology. All physical devices can be connected to the Internet of Things thanks to RFID. When RFID is extensively utilized and fast increasing, security and privacy concerns are unavoidable. Interception, manipulation, and replay of the wireless broadcast channel between the tag and the reader are all possible security threats. Unverified tags or readers provide untrustworthy messages. IoT requires a safe and consistent RFID authentication system. PUFs are also physical one-way functions made up of the unique nanoscopic structure of physical things and their reactivity to random occurrences. PUF includes an unclonable feature that takes advantage of physical characteristics to boost security and resistance to physical attacks. We analyze the security of the RSEAP2 authentication protocol that has been recently proposed by Safkhani et al., a hash-based protocol, and elliptic curve cryptosystem-based protocol. Our security analysis clearly shows important security pitfalls in RSEAP2 such as mutual authentication, session key agreement, and denial-of-service attack. In our proposed work, we improved their scheme and enhanced their version using physically unclonable function (PUF), which are used by the proposed protocol in tags. This research proposes a cloud-based RFID authentication technique that is both efficient and trustworthy. To decrease the RFID tag’s overhead, the suggested authentication approach not only resists the aforementioned typical assaults and preserves the tag’s privacy, but also incorporates the cloud server into the RFID system. According to simulation results, our approach is efficient. Moreover, according to our security study, our protocol can withstand a variety of attacks, including tracking, replay, and desynchronization assaults. Our scheme withstands all the 18 security features and further consumes the computation cost as 14.7088 ms which is comparable with the other schemes. Similarly, our scheme consumes the communication cost as 672 bits during the sending mode and 512 bits during the receiving mode. Overall, the performance of our proposed method is equivalent to that of related schemes and provides additional security features than existing protocols. Mutual authentication, session key generation, and ephemeral session security are all achieved. Using the real-or-random concept, we formalize the security of the proposed protocol.

Remote technologies are changing our way of life. The radio frequency identification (RFID) system is a new technology which uses the open air to transmit information. This information transmission needs to be protected to provide user safety and privacy. Business will look for a system that has fraud resilience to prevent the misuse of information to take dishonest advantage. The business and the user need to be assured that the transmitted information has no content which is capable of undertaking malicious activities. Public awareness of RFID security will help users and organizations to understand the need for security protection. Publishing a security guideline from the regulating body and monitoring implementation of that guideline in RFID systems will ensure that businesses and users are protected. This chapter explains the importance of security in a RFID system and will outline the protective measures. It also points out the research direction of RFID systems.

The characteristics of radio frequency identification (RFID) systems introduce growing security and privacy concerns. RFID systems need security protocols to provide confidentiality, user privacy, mutual authentication and etc. Many security protocols for the RFID system have been presented. This paper analyze several of the newest RFID security protocols which proposed by Niu et al., Fu et al. and Habibi et al. respectively form the security viewpoint of data desynchronization attack. These lightweight protocols were expected to proposed security protections for the RFID system and safeguard against almost all major attacks. However, we found that these RFID security protocols were vulnerable to the attack of data desynchronization. Based on strand spaces model, data desynchronization attacks on these protocols were analyzed and described. Furthermore, improvements to overcome the security vulnerabilities of two protocols presented by Niu et al. and Fu et al. were given. DOI: http://dx.doi.org/10.11591/telkomnika.v11i2.1993

ABSTRACTThis paper addresses radio frequency identification (RFID) authentication and ownership transfer in offline scenarios. Four typical related works are reviewed in detail. A series of shortcomings and vulnerabilities of them are pointed out. A new RFID authentication protocol based on a novel tag‐owner‐assisting architecture is proposed, making a tag's owner an essential participant of the RFID authentication process. The proposed protocol is distinguished from existing works in providing ownership transfer, access control, and mutual authentication without any centralized database neither on a backend server nor in a reader. The security of the proposed protocol is verified by using automated validation of Internet security protocols and applications tool. The proposed protocol is server‐less, simple, scalable, untraceable, and device‐independent. These features are simultaneously achieved in a single RFID authentication protocol for the first time. Copyright © 2014 John Wiley & Sons, Ltd.

In recent years, numerous authentication protocols for radio frequency identification (RFID) systems have been proposed to protect privacy. Due to the hardware resource limitation on RFID tags, the majority of these protocols are based on symmetric-key ciphers. However, most of them lack scalability at the reader side as they require a linear or logarithmic search proportional to the number of tags in the system in order to authenticate a tag. Recently proposed scalable protocols require a constant-time search and utilize hash look-up tables. However, the storage requirement of the hash-table in these protocols is very large, therefore not practical. Moreover, previous proposals do not support dynamic resizing where the number of tags changes during the life time of the RFID system. In this paper, a new Re-Hash technique is presented to reduce the hash-table storage in constant-time authentication protocols. To the best of our knowledge, it offers the smallest storage cost in comparison to previous proposals. The Re-Hash technique is also further adapted to support the dynamic scalability for RFID systems.

The Internet of Things is an emerging paradigm, which is used to link physical objects with Internet. One of the most common ways of communicating and identifying objects on Internet of Things is using Radio Frequency IDentification (RFID) systems between different objects. Researchers have focused on developing improvements of RFID authentication protocols that stave off privacy threats and well‐known security problems. Recently, Khoret al.have proposed a new authentication protocol that conforms to the Electronic Product Code Class‐1 Generation‐2 standard (ISO/IEC 18000‐6C for RFID systems). In this paper, we show the vulnerabilities of this authentication protocol concerning to full disclosure, impersonation, traceability, de‐synchronization, and Denial‐of‐Service attacks. These attacks make the protocol unfeasible to introduce it with an adequate security and sufficient privacy protection level. Finally, we present a new protocol, calledFingerprint+protocol, which is based on ISO/IEC 9798‐2 and ISO/IEC 18000‐6C and whose security is formally verified using BAN logic. Copyright © 2014 John Wiley & Sons, Ltd.

In this paper, we focus on configuring a low cost RFID (Radio Frequency IDentification) system with less RFID readers and low density RFID tag textiles for stable and accurate self-localization for an omni-directional mobile robot. An RFID system using multiple RFID readers and high density RFID tags has already been applied to an indoor mobile robot self-localization. However, the system production cost is relatively high. To reduce the production cost of the system while maintaining the self-localization performance, we redesign two new RFID systems configured with 20 RFID readers and 5 RFID readers enlarging the size of an RFID reader antenna. Particularly, a new likelihood function of the tag detection with the redesigned large size RFID reader antenna is proposed for Monte Carlo Localization (MCL). Furthermore, we come up with a novel arrangement of RFID tags installed in a hexagon pattern. The new arrangement of ID tags enables both low cost ID tag installation and high performance of self-localization. We examine the performances of robot self-localization with less RFID readers and lower density RFID tags installed on the floor based on MCL(Monte Carlo localization). The simulation demonstrates the validity of our proposed configuration of the RFID based self-localization.

Every year researchers and engineers are finding new and useful applications for Radio Frequency Identification (RFID) systems (Finkenzeller, 2003). Because of the growing use of RFID systems, many different areas of research have also been developed to improve the performance of such systems. A few of these areas of research include novel antenna designs (Rao et at., 2005; Calabrese & Marrocco, 2008; Amin et al. 2009), analysis on the backscatter properties of RFID tags (Yen et al., 2007; Feng et al., 2006), mutual coupling between RFID tags (Li et al., 2008; Owen et al., 2009) and the deployment of RFID systems to complex and extreme environments (Qing & Chen, 2007; Sanford, 2008). There are many aspects to each area of research in RFID. A major topic in many of these areas involves research on the antenna design for RFID tags. This chapter will focus on the design of efficient space-filling antennas for passive UHF RFID tags. First, an introduction to RFID systems is presented. This is done by describing the major components in a RFID system and how they communicate. Then, the particular backscattering properties of a passive tag are described from a unique electric field integral equation standpoint and from an overall systems perspective (i.e., using the Friis transmission equation). This discussion will then be followed by a section describing a practical design process of various space-filling antennas for passive tags. Finally, a summary of future work and a conclusion about the chapter is presented.

최근 RFID (Radio Frequency Identification) 기술이 다양한 분야에서 관심을 받고 사용됨으로써 RFID 리더 제조회사들은 다양한 종류의 리더를 생산하고 있다. 현재 RFID 기술에서 RFID 태그 데이터 전송 형태는 EPCglobal에서 제공하는 표준 규약을 따르고 있지만 각 리더 별 리더 연결 및 통신 방법은 회사별로 다른 실정이다. RFID 리더를 사용하던 중 타 회사나 리더 인터페이스가 다른 RFID 리더로 변경하거나 새롭게 추가해야 하는 경우에는 사용자가 직접 RFID 미들웨어 개발단계로 돌아가 미들웨어의 내부 요소를 변경해야 하는 상황이 발생한다. 본 논문에서는 RFID 기술을 사용 시, 특히 여러 회사 또는 표준화되지 않은 인터페이스를 제공하는 RFID 리더를 사용하는 경우에 RFID 애플리케이션과 독립적으로 리더를 관리할 수 있는 리더 프레임워크를 개발하고자 한다. 본 리더 프레임워크는 RFID 애플리케이션과 RFID 리더 사이에 존재하여 RFID 리더 투명성을 제공한다. 본 리더 프레임워크는 현재 작동되고 있는 리더를 모니터링 할 수 있고, 리더의 속성을 확인할 수 있으며 RFID 태그 이벤트 정보, 시스템 로그 정보를 확인할 수 있다. 본 리더 프레임워크를 통해 수십 대의 이기종의 RFID 리더 상태를 용이하게 관리할 수 있게되며 애플리케이션 상의 코드 수정 없이 리더의 추가, 삭제가 가능하게 된다. More recently, variety RFID (Radio Frequency Identification) readers are produced by RFID equipment manufactures. Although a transmission standard instituted by EPCglobal is proposed for data transmission between the RFID readers and tags, other RFID reader protocols and the communication connection methods are be in use in other RFID companies. To replace or add the RFID readers of an RFID system, the developers should make changes to the core of the application and/or middleware. In this paper, we propose an RFID reader framework which can manage RFID readers without having to make changes the code of the application in environment with the growing number of heterogeneous RFID readers.This framework that sits on the layer between the RFID readers and the applications provides transparency to the RFID readers. Additionally, it can be used for monitoring the state and the property of all connected RFID, and for recording the RFID tag event logs and system logs. By using this framework, heterogeneous readers can be replaced and added without writing additional code in the applications. Consequently the readers can be easily managed and controlled by the RFID system administrator.

The design of secure authentication protocols for radio frequency identification (RFID) system is still a quite challenging problem. Many authentication protocols for RFID have been proposed, but most have weaknesses or flaws. We analyze the security of a serverless RFID authentication protocol which recently been presented by Hoque et al. The protocol was expected to safeguard both RFID tag and RFID reader against major attacks, and RFID server is not needed in the protocol. However, our security analysis shows that the authentication protocol is vulnerable to attack of data desynchronization. This attack destroys the availability of the protocol. Furthermore, improvement to overcome the security vulnerability of the protocol was presented.