Lightweight Radio Frequency Identification Research Articles

Toward designing a lightweight RFID authentication protocol for constrained environments

AbstractIn present times, Radio‐Frequency Identification (RFID) systems have seen a significant rise in their usage. There has been an increasing interest in developing even lighter RFID protocols suitable for resource‐constrained environments. Ensuring security and privacy remain critical challenges in RFID‐based systems. Recently proposed lightweight authentication schemes, namely LRSAS+ and LRARP+, are ideally suited for constrained devices. However, this article investigates these schemes and reveals certain vulnerabilities: LRSAS+ is susceptible to tag impersonation, desynchronization, and traceability attacks, while LRARP+ can fall prey to traceability and secret disclosure attacks. An enhanced version of these authentication systems is proposed that tackles their inherent weaknesses by leveraging the function. To verify the security of the proposed scheme, a formal analysis is conducted using Gong–Needham–Yahalom logic (GNY logic) and an automated security protocol verification tool, ProVerif. The improved scheme's effectiveness is also compared with multiple contemporary lightweight systems. The results indicate that the enhanced scheme not only meets the security requirements for lightweight authentication schemes but also achieves this with minimal computational overhead.

ENHANCING SECURITY OF RFID-ENABLED IOT SUPPLY CHAIN

In addition to its benefits, the popular Internet of Things (IoT) technology has also opened the way to novel security and privacy issues. The basis of IoT security and privacy starts with trust in the IoT hardware and its supply chain. Counterfeiting, cloning, tampering of hardware, theft, and lost issues in the IoT supply chain have to be addressed, in order to ensure reliable IoT industry growth. In four previous works, radio-frequency identification (RFID)-enabled solutions have been proposed by the same authors, aimed to bring security to the entire IoT supply chain. The works propose a new RFID-traceable hardware architecture, device authentication, and supply chain tracing procedure. In each of these works, a variant of the same is proposed. However, the same variant of lightweight RFID authentication protocol coupled with the offline supply chain proposed in these works has such security vulnerabilities that make the whole supply chain unsafe. In our present work, an online supply chain hop-tracking procedure supported by a novel RFID mutual authentication protocol, based on the strong matching of the RFID readers-their operators-central database present at the transfer hops is proposed. Our proposed Strong RFID Authentication Protocol (STRAP) has been verified by two well-accepted formal protocol analyzers Scyther and AVISPA. The verification results demonstrate that STRAP overcomes the previous works’ vulnerabilities. Furthermore, our proposed novel online supply chain tracing procedure supporting STRAP removes the previous offline supply chain tracing procedure weaknesses.

Survey: An Overview of Lightweight RFID Authentication Protocols Suitable for the Maritime Internet of Things

The maritime sector employs the Internet of Things (IoT) to exploit many of its benefits to maintain a competitive advantage and keep up with the growing demands of the global economy. The maritime IoT (MIoT) not only inherits similar security threats as the general IoT, it also faces cyber threats that do not exist in the traditional IoT due to factors such as the support for long-distance communication and low-bandwidth connectivity. Therefore, the MIoT presents a significant concern for the sustainability and security of the maritime industry, as a successful cyber attack can be detrimental to national security and have a flow-on effect on the global economy. A common component of maritime IoT systems is Radio Frequency Identification (RFID) technology. It has been revealed in previous studies that current RFID authentication protocols are insecure against a number of attacks. This paper provides an overview of vulnerabilities relating to maritime RFID systems and systematically reviews lightweight RFID authentication protocols and their impacts if they were to be used in the maritime sector. Specifically, this paper investigates the capabilities of lightweight RFID authentication protocols that could be used in a maritime environment by evaluating those authentication protocols in terms of the encryption system, authentication method, and resistance to various wireless attacks.

Enhancing Security and Privacy in Healthcare Systems Using a Lightweight RFID Protocol

Exploiting Radio Frequency Identification (RFID) technology in healthcare systems has become a common practice, as it ensures better patient care and safety. However, these systems are prone to security vulnerabilities that can jeopardize patient privacy and the secure management of patient credentials. This paper aims to advance state-of-the-art approaches by developing more secure and private RFID-based healthcare systems. More specifically, we propose a lightweight RFID protocol that safeguards patients’ privacy in the Internet of Healthcare Things (IoHT) domain by utilizing pseudonyms instead of real IDs, thereby ensuring secure communication between tags and readers. The proposed protocol has undergone rigorous testing and has been proven to be secure against various security attacks. This article provides a comprehensive overview of how RFID technology is used in healthcare systems and benchmarks the challenges faced by these systems. Then, it reviews the existing RFID authentication protocols proposed for IoT-based healthcare systems in terms of their strengths, challenges, and limitations. To overcome the limitations of existing approaches, we proposed a protocol that addresses the anonymity and traceability issues in existing schemes. Furthermore, we demonstrated that our proposed protocol had a lower computational cost than existing protocols and ensured better security. Finally, our proposed lightweight RFID protocol ensured strong security against known attacks and protected patient privacy using pseudonyms instead of real IDs.

Linear complementary pair of codes based lightweight RFID protocol

Data security and privacy is an essential topic in today’s life. It is necessary to prevent secret data from leakage. There are many services where data transfer is done without any physical contact and at a low-cost. Radio frequency identification (RFID) is one of the basic technical knowledge that solves the problem of data privacy. Many RFID protocols have been designed to ensure data security and privacy. But, a large portion of these protocols suffers from common security attacks and high computational costs. We present a lightweight RFID protocol based on linear complementary pair of codes to overcome these issues. This protocol ensures formal security using a random oracle model and BAN logic. For security verification of our protocol, we use the Scyther simulation tool. In addition, we compare the performance of our protocol in terms of storage costs, communication costs and computational costs with related existing protocols. We determine that our protocol gives preferable security and effectiveness over related competing protocols and is applicable for RFID systems.

VASERP: An Adaptive, Lightweight, Secure, and Efficient RFID-Based Authentication Scheme for IoV.

With the rapid growth in wireless communication and IoT technologies, Radio Frequency Identification (RFID) is applied to the Internet of Vehicles (IoV) to ensure the security of private data and the accuracy of identification and tracking. However, in traffic congestion scenarios, frequent mutual authentication increases the overall computing and communication overhead of the network. For this reason, in this work, we propose a lightweight RFID security fast authentication protocol for traffic congestion scenarios, designing an ownership transfer protocol to transfer access rights to vehicle tags in non-congestion scenarios. The edge server is used for authentication, and the elliptic curve cryptography (ECC) algorithm and the hash function are combined to ensure the security of vehicles' private data. The Scyther tool is used for the formal analysis of the proposed scheme, and this analysis shows that the proposed scheme can resist typical attacks in mobile communication of the IoV. Experimental results show that, compared to other RFID authentication protocols, the calculation and communication overheads of the tags proposed in this work are reduced by 66.35% in congested scenarios and 66.67% in non-congested scenarios, while the lowest are reduced by 32.71% and 50%, respectively. The results of this study demonstrate a significant reduction in the computational and communication overhead of tags while ensuring security.

Novel lightweight RFID authentication protocols for inexpensive tags

Radio-frequency identification (RFID) systems represent a support technology employed for the internet of things (IoT). Since RFID systems are now used extensively, it would be a mistake to disregard security problems and user privacy protection. However, constraints on computing power and storage resources in inexpensive tags of RFID have made the execution of security issues difficult. In other words, a persistent formidable challenge to RFID security is to design ultra-lightweight authentication protocols for RFID systems in acceptable compatibility with EPC Class-1 Generation-2 standards. Xiao et al. has recently proposed an appropriate lightweight authentication protocol for inexpensive tags by benefiting from the lightweight block cipher algorithm. They have claimed that their proposed protocol is resistant to all of the known attacks which may occur in RFID systems. In this paper, we show that the LRSAS protocol is vulnerable to replay, reader impersonation, tag tracking, and desynchronization attacks. We demonstrate that the use of fixed messages in the communication between the tag and the reader is led to these attacks. To improve the LRSAS protocol, We propose three lightweight protocols LRSAS+, LRARP, and LRARP+. We analyze the security level of the proposed protocols and prove the security of the proposed design using Gong–Needham–Yahalom logic (GNY logic). We also formally confirmed the security of the proposal using the Scyther simulation tool. According to security analysis, we can observe that these protocols have a high level of security. Furthermore, the performance of the proposed protocols is analyzed. A comparison of the performance of these three protocols with similar protocols shows that these protocols are at a better level than similar protocols in terms of computational costs, storage costs, and communication costs.

An Improved Security Authentication Protocol for Lightweight RFID Based on ECC

The security, privacy, and operation efficiency of radio frequency identification (RFID) must be fully measured in practical use. A few RFID authentication schemes based on elliptic curve cryptography (ECC) have been proposed, but most of them cannot resist the existing attacks. The scheme presented by Qian et al. could not resist impersonation attack according to our security analysis. Then, we propose a novel lightweight RFID authentication scheme, which is proved that it can resist server spoofing attack, tag masquerade attack, and provide other security properties of a RFID authentication scheme. Comparisons of computation and communication cost demonstrate that the proposed scheme is more suitable for the resource-constrained RFID authentication.

Energy-Efficient Word-Serial Processor for Field Multiplication and Squaring Suitable for Lightweight Authentication Schemes in RFID-Based IoT Applications

Radio-Frequency Identification (RFID) technology is a crucial technology used in many IoT applications such as healthcare, asset tracking, logistics, supply chain management, assembly, manufacturing, and payment systems. Nonetheless, RFID-based IoT applications have many security and privacy issues restricting their use on a large scale. Many authors have proposed lightweight RFID authentication schemes based on Elliptic Curve Cryptography (ECC) with a low-cost implementation to solve these issues. Finite-field multiplication are at the heart of these schemes, and their implementation significantly affects the system’s overall performance. This article presents a formal methodology for developing a word-based serial-in/serial-out semisystolic processor that shares hardware resources for multiplication and squaring operations in GF(2n). The processor concurrently executes both operations and hence reduces the execution time. Furthermore, sharing the hardware resources provides savings in the area and consumed energy. The acquired implementation results for the field size n=409 indicate that the proposed structure achieves a significant reduction in the area–time product and consumed energy over the previously published designs by at least 32.3% and 70%, respectively. The achieved results make the proposed design more suitable to realize cryptographic primitives in resource-constrained RFID devices.

A novel vector-space-based lightweight privacy-preserving RFID authentication protocol for IoT environment

Internet of Things (IoT) is a novel paradigm that connects several physical devices and the cyber world over the Internet. IoT technology is growing rapidly and soon will have an enormous innovation in our daily lives. With the increasing number of connected IoT devices making our daily lives more convenient, it puts personal data at serious risk too. Radio frequency identification (RFID) contributes to IoT applications in the automatic identification of the connected devices. However, the primary concerns with the RFID tag connected devices are their security and privacy. The communication channel is deemed to be wireless or insecure between the tags and the readers, which makes RFID system vulnerable to the various known attacks. To deal with these security flaws, we have put forward a novel vector-space-based lightweight RFID authentication protocol for IoT environment named VLPRAP. The proposed protocol integrates vector space, linear mapping and basis mechanism that achieves secure authentication and improves security and privacy without increasing the computational cost. The correctness of the proposed VLPRAP protocol has been validated using BAN logic inference rules. The formal and informal security analysis demonstrates that our proposed protocol resists various malicious security threats, providing better security and higher efficiency. Furthermore, the performance analysis of our proposed protocol has been measured in terms of computation operations, storage requirement and communication overhead, which shows that better performance as compared to related existing protocols.

An ultra light weight and secure RFID batch authentication scheme for IoMT

As an application of IoT technology in the healthcare industry, IoMT has higher security requirements than IoT while improving medical efficiency and reducing medical costs. How to ensure the safety of IoMT is a challenging task. In the implementation of IoMT, Radio-Frequency Identification (RFID) is a key technology for establishing an identity authentication system, which can efficiently identify medical equipment and patients. Designing a safe and efficient RFID authentication protocol will help protect user privacy, enhance the security of the IoMT system and improve the efficiency of medical staff to detect and manage patients. Most of the existing RFID authentication protocols can only authenticate one tag in each authentication session, which is called a per-tag protocol. In medical scenarios that need to efficiently authenticate a mass of tags at short notice, the use of traditional per-tag protocols is inefficient and may delay the treatment of patients. To solve the problem that the per-tag protocols are not applicable in some medical scenarios, we designed a low-cost batch authentication protocol which can accurately identify each illegal tag and reduce the overhead of authentication data transmission. We use the solution of homogeneous linear equations as a key to encrypt the authentication data of the tag to further reduce the cost of the tag. The protocol proposed in this paper is capable of batch certification of tags, with strong security and low tag cost. After security analysis and performance analysis, our scheme can be well applied to IoMT.

A Novel Lightweight Authentication Scheme for RFID-Based Healthcare Systems.

The Internet of Things (IoT) has been integrated into legacy healthcare systems for the purpose of improving healthcare processes. As one of the key technologies of IoT, radio frequency identification (RFID) technology has been applied to offer services like patient monitoring, drug administration, and medical asset tracking. However, people have concerns about the security and privacy of RFID-based healthcare systems, which require a proper solution. To solve the problem, recently in 2019, Fan et al. proposed a lightweight RFID authentication scheme in the IEEE Network. They claimed that their scheme can resist various attacks in RFID systems with low implementation cost, and thus is suitable for RFID-based healthcare systems. In this article, our contributions mainly consist of two parts. First, we analyze the security of Fan et al.’s scheme and find out its security vulnerabilities. Second, we propose a novel lightweight authentication scheme to overcome these security weaknesses. The security analysis shows that our scheme can satisfy the necessary security requirements. Besides, the performance evaluation demonstrates that our scheme is of low cost. Thus, our scheme is well-suited for practical RFID-based healthcare systems.

SecMAP: A Secure RFID Mutual Authentication Protocol for Healthcare Systems

In recent years, radio frequency identification (RFID) technology has been applied to construct better healthcare systems, offering various healthcare services that can benefit all medical staff and patients. However, because of the insecure communication channels in RFID systems, security is a main concern to be solved for RFID to be used in healthcare systems. To address this issue, recently in 2019, Safkhani et al. proposed a lightweight RFID authentication protocol in IEEE Access. The authors claimed that their protocol has a higher security level than existing protocols in this category. This article firstly analyzes the security of Safkhani et al.'s protocol, and shows that this protocol is lack of forward secrecy and scalability. Then, a new and secure mutual authentication protocol (SecMAP) is proposed to overcome these weaknesses. The security of the SecMAP protocol is confirmed with formal analyses using the Gong-Needham-Yahalom (GNY) logic and the Scyther tool. Besides, SecMAP is compatible with low-cost RFID tags. Thus, the proposed protocol can effectively provide security for RFID based healthcare systems.

SLEC: A Novel Serverless RFID Authentication Protocol Based on Elliptic Curve Cryptography

Internet of Things (IoT) is a new paradigm that has been evolving into the wireless sensor networks to expand the scope of networked devices (or things). This evolution drives communication engineers to design secure and reliable communication at a low cost for many network applications such as radio frequency identification (RFID). In the RFID system, servers, readers, and tags communicate wirelessly. Therefore, mutual authentication is necessary to ensure secure communication. Normally, a central server supports the authentication of readers and tags by distributing and managing the credentials. Recent lightweight RFID authentication protocols have been proposed to satisfy the security features of RFID networks. Using a serverless RFID system is an alternative solution to using a central server. In this model, both the reader and the tag perform mutual authentication without the need for the central server. However, many security challenges arise from implementing lightweight authentication protocols in serverless RFID systems. We propose a new secure serverless RFID authentication protocol based on the famous elliptic curve cryptography (ECC). The protocol also maintains the confidentiality and privacy of the messages, tag information, and location. Although most of the current serverless protocols assume secure channels in the setup phase, we assume an insecure environment during the setup phase between the servers, readers, and tags. We ensure that the credentials can be renewed by any checkpoint server in the mobile RFID network. Thus, we implement ECC in the setup phase (renewal phase), to transmit and store the communication credentials of the server to multiple readers so that the tags can perform the mutual authentication successfully while far from the server. The proposed protocol is compared with other serverless frameworks proposed in the literature in terms of computation cost and attacks resistance.

SecLAP: Secure and lightweight RFID authentication protocol for Medical IoT

The safety of medical data and equipment plays a vital role in today’s world of Medical Internet of Things (MIoT). These IoT devices have many constraints (e.g., memory size, processing capacity, and power consumption) that make it challenging to use cost-effective and energy-efficient security solutions. Recently, researchers have proposed a few Radio-Frequency Identification (RFID) based security solutions for MIoT. The use of RFID technology in securing IoT systems is rapidly increasing because it provides secure and lightweight safety mechanisms for these systems. More recently, authors have proposed a lightweight RFID mutual authentication (LRMI) protocol. The authors argue that LRMI meets the necessary security requirements for RFID systems, and the same applies to MIoT applications as well. In this paper, our contribution has two-folds, firstly we analyze the LRMI protocol’s security to demonstrate that it is vulnerable to various attacks such as secret disclosure, reader impersonation, and tag traceability. Also, it is not able to preserve the anonymity of the tag and the reader. Secondly, we propose a new secure and lightweight mutual RFID authentication (SecLAP) protocol, which provides secure communication and preserves privacy in MIoT systems. Our security analysis shows that the SecLAP protocol is robust against de-synchronization, replay, reader/tag impersonation, and traceability attacks, and it ensures forward and backward data communication security. We use Burrows–Abadi–Needham (BAN) logic to validate the security features of SecLAP. Moreover, we compare SecLAP with the state-of-the-art and validate its performance through a Field Programmable Gate Array (FPGA) implementation, which shows that it is lightweight, consumes fewer resources on tags concerning computation functions, and requires less number of flows.

A Lightweight RFID Mutual Authentication Protocol with PUF.

Radio frequency identification is one of the key techniques for Internet of Things, which has been widely adopted in many applications for identification. However, there exist various security and privacy issues in radio frequency identification (RFID) systems. Particularly, one of the most serious threats is to clone tags for the goal of counterfeiting goods, which causes great loss and danger to customers. To solve these issues, lots of authentication protocols are proposed based on physical unclonable functions that can ensure an anti-counterfeiting feature. However, most of the existing schemes require secret parameters to be stored in tags, which are vulnerable to physical attacks that can further lead to the breach of forward secrecy. Furthermore, as far as we know, none of the existing schemes are able to solve the security and privacy problems with good scalability. Since many existing schemes rely on exhaustive searches of the backend server to validate a tag and they are not scalable for applications with a large scale database. Hence, in this paper, we propose a lightweight RFID mutual authentication protocol with physically unclonable functions (PUFs). The performance analysis shows that our proposed scheme can ensure security and privacy efficiently in a scalable way.

Provably privacy analysis and improvements of the lightweight RFID authentication protocols

Radio Frequency Identification (RFID) systems authenticate products as well as people without any physical contact. Using RFID systems is an inevitable part of recent identifying and shopping affairs. However, RFID systems have huge hardware limitations in tags side because of their need to be as cheap as possible and in access for vast number of products. Moreover, The identity of the tag owners has to be anonymous and secure from the attackers actions. These critical necessities have made researchers to concentrate on designing lightweight secure authentication protocols. In this paper, four new designed lightweight RFID authentication protocols are analyzed. Security and privacy of each protocol is analyzed, and the weaknesses are proved, discussed and modified. We demonstrate that none of them provide even weak privacy level. Each protocol is improved through a solution to overcome the weaknesses and provide at least the weak privacy. All of the privacy and security analysis are done in the Vaudenay model. Also, we propose a new lightweight protocol which uses the pros of the considered protocols and provides weak privacy level. Moreover, some comprehensive methods are proposed to provide weak privacy in the lightweight authentication protocols.

Permutation Matrix Encryption Based Ultralightweight Secure RFID Scheme in Internet of Vehicles.

Radio frequency identification (RFID) is a kind of non-contact automatic identification technology. The Internet of Vehicles (IoV) is a derivative of the Internet of Things (IoT), and RFID technology has become one of the key technologies of IoV. Due to the open wireless communication environment in RFID system, the RFID system is easy to be exposed to various malicious attacks, which may result in privacy disclosure. The provision of privacy protection for users is a prerequisite for the wide acceptance of the IoV. In this paper, we discuss the privacy problem of the RFID system in the IoV and present a lightweight RFID authentication scheme based on permutation matrix encryption, which can resist some typical attacks and ensure the user’s personal privacy and location privacy. The fast certification speed of the scheme and the low cost of the tag is in line with the high-speed certification requirement in the Internet of vehicles. In this thesis, the specific application scenarios of the proposed RFID authentication scheme in the IoV is also discussed.

IoT Device Security: Challenging "A Lightweight RFID Mutual Authentication Protocol Based on Physical Unclonable Function".

With the exponential increase of Internet of things (IoT) connected devices, important security risks are raised as any device could be used as an attack channel. This preoccupation is particularly important with devices featuring limited processing power and memory capabilities for security purposes. In line with this idea, Xu et al. (2018) proposed a lightweight Radio Frequency Identification (RFID) mutual authentication protocol based on Physical Unclonable Function (PUF)—ensuring mutual tag-reader verification and preventing clone attacks. While Xu et al. claim that their security protocol is efficient to protect RFID systems, we found it still vulnerable to a desynchronization attack and to a secret disclosure attack. Hence, guidelines for the improvements to the protocol are also suggested, for instance by changing the structure of the messages to avoid trivial attacks. In addition, we provide an explicit protocol for which our formal and informal security analysis have found no weaknesses.

Breaking anonymity of some recent lightweight RFID authentication protocols

Due to their impressive advantages, Radio Frequency IDentification (RFID) systems are ubiquitously found in various novel applications. These applications are usually in need of quick and accurate authentication or identification. In many cases, it has been shown that if such systems are not properly designed, an adversary can cause security and privacy concerns for end-users. In order to deal with these concerns, impressive endeavors have been made which have resulted in various RFID authentications being proposed. In this study, we analyze three lightweight RFID authentication protocols proposed in Wireless Personal Communications (2014), Computers & Security (2015) and Wireless Networks (2016). We show that none of the studied protocols provides the desired security and privacy required by the end-users. We present various security and privacy attacks such as secret parameter reveal, impersonation, DoS, traceability, and forward traceability against the studied protocols. Our attacks are mounted in the Ouafi---Phan RFID formal privacy model which is a modified version of well-known Juels---Weis privacy model.