Low-cost RFID Tags Research Articles

Securing cyberspace

Cyberspace, the ubiquitous space that exists in relation to the Internet, is usually referred to as a dynamic broad domain ranging from Internet and its infrastructures to social networks. More research work in security has been extended from securing computers to securing Cyberspace, which includes the physical-level security, the network-level security, and the application-level security and addresses improvements in Cyberspace management. As a result, recent years have witnessed increasing research attention on securing Cyberspace, and many interesting methods have been proposed to locate suspicious IP, detect gossip content, prevent illegal information publication and distribution, manage social software and applications, and profile user behavior and opinion. This trend has provided the motivation to launch this special issue. Based on an open call in this area and invited best papers from The Fifth International Conference on Applications and Techniques for Information Security (ATIS 2014) and The first International Workshop on Curbing Cyber-Crimes (C3 2014), five submissions have been accepted to best illustrate the main development and perspectives. The papers in this issue report a variety of methods used to tackle the security issues in cyberspace. They aim at improving security in applications ranging from RFID systems, location based service, discovery of software vulnerability to private medical records, and outsourcing in Multi-Cloud. The problems discussed in these papers are also related to disciplines including data mining, network security, digital forensics, and behavioral and psychological sciences. Here, we provide an integrative perspective of this special issue by summarizing each contribution contained therein. In 1, to address security and privacy issue in RFID systems, a new off-line reading order-independent grouping-proof protocol is proposed to generate a proof that a group of tags have been scanned simultaneously in the range of a reader. The proposed protocol defines an ideal grouping-proof functionality aiming at capturing the secure grouping-proof generation for a group of RFID tags in the UC framework. The new protocol maintains its security properties when composed concurrently with an unbounded number of instances of arbitrary protocol. In addition, the protocol conforms to the computational constraints of EPC Class-Gen-2 passive RFID tags. It is suitable for low-cost passive RFID tags, which are widely used in practical applications. In 2, the authors proposed an algorithm to address the problem of preserving privacy for individual users in location-aware applications. They define a novel distance measurement that combines the semantic and Euclidean distance to address the privacy-preserving issue. They conduct performance experiments on the proposed algorithm and distance metric, and results suggest that they can successfully retain the utility of the location services. In 3, to discover software vulnerability, an effective and efficient mechanism is proposed. The method also helps programmers to write secure code to avoid the existence of vulnerability at the early stage of software development. The proposed mechanism uses code clone verification to discover vulnerability in software programs and reduces the false positive of detection by combining the advantages of static and dynamic analysis. In addition, it also mitigates the path explosion problem in the testing process when verifying the existence of vulnerability. As a result, the proposed approach effectively improves the security of software systems, applications, and utilities in various areas of Cyberspace. In particular, it helps to create a reliable environment for the communications of all the social media participants. In 4, the authors analyze the security of Fair Remote Retrieval (FRR) model that is used to ensure the integrity of remote medical records. They show that FRR model fails to achieve its security goals, therefore present an improved protocol, called IFR2̂, to fix the security minor faults while preserving all the properties of FRR. The paper analyzes the correctness and security of IFR2̂ and experimentally verifies the efficiency in terms of computational and communication cost of the model. In 5, the authors propose an identity based storage management and integrity verification protocol for secure outsourcing in Multi-Cloud. The paper aims to fill the gap on guaranteeing fair results on two-party storage checking protocols without third party audit in multi-cloud computing. Specifically, the authors prove the security and efficiency of their protocol by theoretical analysis and simulation experiments without using any trusted organizer. Furthermore, the protocol enjoys many security attributes including prevention of various attacks, user anonymity, and local password verification. Preparation of this issue would have been impossible without the hard work of anonymous reviewers and the authors. Special thanks go to Prof. Geoffrey Fox, editor-in-chief of the journal, for his great support.

A Lightweight Authentication Protocol Based on Partial Identifier for EPCglobal Class-1 Gen-2 Tags

RFID is a key technology that can be used to create the pervasive society. The tag is an important part of the RFID system and most popular tags are some low-cost passive tags. These tags have limited computing and storing resources, and no more attentions are paid to their security and privacy. So the application of these tags is not secure. Lightweight authentication protocols are considered as an effective method to solve the security and privacy of low-cost RFID tags. We propose a novel lightweight authentication protocol by means of some functions provided by EPCglobal Class-1 Gen-2 tags. The protocol enhances the difficulty to reveal the tag’s secrecy by using the tag’s partial identifier to generate the session messages between the tag and the reader. The tag’s partial identifier is generated randomly for each authentication. Otherwise, the tag’s identifier is randomly divided into two separate parts so as to avoid colliding from the 16-bit cyclic redundancy coding function. Some random numbers, which are generated by the tag and the reader respectively, randomize the session messages between the tag and the reader so as to resist against tracing attack and replay attack. Our proposed protocol can assure forward security and it can resist against de-synchronized attack. This protocol only uses some lightweight functions and it is very suitable to low-cost RFID tags

Security Analysis and Strengthening of an RFID Lightweight Authentication Protocol Suitable for VANETs

Due to the storage capacity and computational power restrictions of low-cost RFID tags based on the EPC-C1G2 standard, most of the existing authentication protocols seem too complicated to be appro...

CrowdSensing: A crowd-sourcing based indoor navigation using RFID-based delay tolerant network

As a supporting technology for most pervasive applications, indoor localization and navigation has attracted extensive attention in recent years. Conventional solutions mainly leverage techniques like WiFi and cellular network to effectively locate the user for indoor localization and navigation. In this paper, we investigate the problem of indoor navigation by using the RFID-based delay tolerant network. Different from the previous work, we aim to efficiently locate and navigate to a specified mobile user who is continuously moving within the indoor environment. As the low-cost RFID tags are widely deployed inside the indoor environment and acting as landmarks, the mobile users can actively interrogate the surrounding tags with devices like smart phones and leave messages or traces to the tags. These messages or traces can be carried and forwarded to more tags by other mobile users. In this way, the RFID-based infrastructure forms a delay tolerant network. By using the crowd-sourcing technology in RFID-based delay tolerant network, we respectively propose a framework, namely CrowdSensing, to schedule the tasks and manage the resources in the network. We further propose a navigation algorithm to locate and navigate to the moving target. We verify the performance of proposed framework and navigation algorithm on mobility model built on real-world human traceset. Experiment results show that our solution can efficiently reduce the average searching time for indoor navigation.

A new security approach for public transport application against tag cloning with neural network-based pattern recognition

RFID tags are widely used in situations where their counterfeiting or cloning can bring financial rewards. Cloning is a particular problem because it gets round the sophisticated security measures. This paper describes a neural network-based technique for identifying cloned tickets for a public transport system. It is based on modeling passenger behavior. Cardholders' behavioral characteristics in using public transport are modeled with seven neural network model equations, one for each day of the week, and stored in an RFID card. At the time of use, these model equations or characteristics are employed to predict whether the user is the real owner of the card. Therefore, even if the RFID card is cloned, the cloned card cannot be used because a passenger's behavioral characteristics when using public transport are individual and unique, such as the passenger's signature or style of speech. Therefore, the proposed approach provides high security, especially for low-cost RFID tags.

저비용 RFID 인증을 위한 PUF 기반 암호화 프로세서와 상호 인증 프로토콜 설계

The attacker can access the RFID systems illegally because authentication operation on the RFID systems are performed in wireless communication. Authentication methods based on the PUF were presented to defend attacks. Because of Hash and AES, the cost is expensive for the low-cost RFID tag. In this paper, the PUF-based encryption processor and the mutual authentication protocol are proposed for low-cost RFID authentication. The challenge-response pairs (PUF`s input and output) are utilized as the authentication key and encrypted by the PUF`s characteristics. The encryption method is changed each session and XOR operation with random number is utilized. Therefore, it is difficult for the attacker to analyze challenge-response pairs and attack the systems. In addition, the proposed method with PUF is strong against physical attacks. And the method protects the tag cloning attack by physical attacks because there is no authentication data in the tag. Proposed processor is implemented at low cost with small footprint and low power.

A Strong Lightweight Authentication Protocol for Low-cost RFID Systems

RFID is an important technology that can be used to create the ubiquitous society. But an RFID system uses open radio frequency signal to transfer information and this leads to pose many serious threats to its privacy and security. In general, the computing and storage resources in an RFID tag are very limited and this makes it difficult to solve its secure and private problems, especially for low-cost RFID tags. In order to ensure the security and privacy of low-cost RFID systems we propose a lightweight authentication protocol based on Hash function. This protocol can ensure forward security and prevent information leakage, location tracing, eavesdropping, replay attack and spoofing. This protocol completes the strong authentication of the reader to the tag by twice authenticating and it only transfers part information of the encrypted tag’s identifier for each session so it is difficult for an adversary to intercept the whole identifier of a tag. This protocol is simple and it takes less computing and storage resources, it is very suitable to some low-cost RFID systems.

Secure ownership transfer for multi-tag multi-owner passive RFID environment with individual-owner-privacy

In this paper we propose a secure ownership transfer protocol for a multi-tag multi-owner RFID environment that provides individual-owner-privacy. To our knowledge, the existing schemes do not provide individual-owner-privacy and most of the existing schemes do not comply with the EPC Global Class-1 Gen-2 (C1G2) standard since the protocols use expensive hash operations or sophisticated encryption schemes that cannot be implemented on low-cost passive tags that are highly resource constrained. Our work aims to fill these gaps by proposing a protocol that provides individual-owner-privacy, based on simple XOR and 128-bit pseudo-random number generators (PRNG), operations that are easily implemented on low-cost RFID tags while meeting the necessary security requirements thus making it a viable option for large scale implementations. Our protocol also provides additional protection by hiding the pseudo-random numbers during all transmissions using a blind-factor to prevent tracking attacks.

An Improved Watermarking-Based Algorithm of Tamper Detection for Low-Cost EPC C1G2 RFID Tags

Data tampering as one of the primary security issues in RFID-enabled applications has been presented in recent years and proposals based on watermarking have been put forward to address different aspects of tampering in RFID tags. However, most of current researches are focused on the way of generating the watermark from the data to be protected and embedding it into the tag field (usually the field of serial number or SN) used as the cover medium, thus the innate structural coding relationship as a new clue to guess out the hidden watermark might be ignored. In this paper, this flaw has been fully considered, and a novel tamper detection method using CFB based encryption to hide the location clues is presented. Although it cant resist the attack from statistical analysis either, theoretical analysis has demonstrated that our scheme outperforms its previous counterparts in data security.

A lightweight authenticated encryption algorithm for RFID systems

Security of RFID systems is a very important issue with the increasing of their applications. To achieve secure communications between a reader and a tag in RFID systems, encryption of the communication data is usually performed. However, in case of low-cost RFID tags, it is difficult for them to adopt the well-known encryption algorithms because the tags have very limited resources to implement the encryption algorithms. Therefore, in this paper, we propose a new lightweight authenticated symmetric key encryption algorithm for RFID systems which use low-cost tags. To achieve a secure message authentication in the proposed algorithm, redundant bits are contained in a ciphertext. Even though the proposed algorithm uses very lightweight operations for the encryption/decryption, it provides confidentiality, authentication, and integrity.

A secure RFID authentication protocol adopting error correction code.

RFID technology has become popular in many applications; however, most of the RFID products lack security related functionality due to the hardware limitation of the low-cost RFID tags. In this paper, we propose a lightweight mutual authentication protocol adopting error correction code for RFID. Besides, we also propose an advanced version of our protocol to provide key updating. Based on the secrecy of shared keys, the reader and the tag can establish a mutual authenticity relationship. Further analysis of the protocol showed that it also satisfies integrity, forward secrecy, anonymity, and untraceability. Compared with other lightweight protocols, the proposed protocol provides stronger resistance to tracing attacks, compromising attacks and replay attacks. We also compare our protocol with previous works in terms of performance.

Secure and Efficient LCMQ Entity Authentication Protocol

The simple, computationally efficient HB-like entity authentication protocols based on the learning parity with noise (LPN) problem have attracted a great deal of attention in the past few years due to the broad application prospect in low-cost RFID tags. However, all previous protocols are vulnerable to a man-in-the-middle attack discovered by Ouafi, Overbeck, and Vaudenay. In this paper, we propose a lightweight authentication protocol named LCMQ and prove it secure in a general man-in-the-middle model. The technical core in our proposal is a special type of circulant matrix, for which we prove the linear independence of matrix vectors, present efficient algorithms on matrix operations, and describe a secure encryption against ciphertext-only attack. By combining all of those with LPN and related to the multivariate quadratic problem, the LCMQ protocol not only is provably secure against all probabilistic polynomial-time adversaries, but also transcends HB-like protocols in terms of tag's computation overhead, storage expense, and communication cost.

Secure RFID Tag Ownership Transfer Based on Quadratic Residues

In this paper, we propose a novel approach to secure ownership transfer in RFID systems based on the quadratic residue property. We present two secure ownership transfer schemes—the closed loop and open loop schemes. An important property of our schemes is that ownership transfer is guaranteed to be atomic. Further, both our schemes are suited to the computational constraints of EPC Class-1 Gen-2 passive RFID tags as they only use operations that such passive RFID tags are capable of. We provide a detailed security analysis to show that our schemes achieve strong privacy and satisfy the required security properties of tag anonymity, tag location privacy, forward secrecy, and forward untraceability. We also show that the schemes are resistant to replay (both passive and algebraic), desynchronization, and server impersonation attacks. Performance comparisons demonstrate that our schemes are practical and can be implemented on low-cost passive RFID tags.

A new ultra-lightweight RFID authentication protocol using merge and separation operations

Since Low-cost RFID tags have very limited hardware resources, it is difficult to implement an authentication protocol which uses heavy operations such as modern ciphers or hash functions. It has been presented some ultra-lightweight RFID authentication protocols for low-cost RFID tags by using very light operations. Recently, Jeon and Yoon proposed a new ultra-lightweight RFID authentication protocol. They defined and used the merge and separation operations. The merge operation can merge the bits from two bit strings and the separation operation is an inverse operation of the merge operation. However, we found that the protocol cannot serve correctly when the collision of tag pseudonyms is occurred. In this paper, we propose an improved authentication protocol that solves the problem. We show that the proposed protocol can resist various security attacks and is efficient enough to implement low-cost RFID tags.

An Effective Ultralightweight RFID Secure Protocol with Mutual Authentication

Due to the radio transmission nature of RFID, the challenge of security and privacy has seriously hindered the large-scale development of RFID technology. However, low-cost RFID tags have the characteristic of extremely limited resources, traditional security primitives cannot be better applied in RFID system. Hence, Designing an effective ultralightweight security protocol applying to low-cost tag is crucial for the various applications of RFID system. In this paper, we propose an ultralightweight secure protocol with mutual authentication. Without adopting classical cryptographic primitives, the protocol proposed only employs simple bit-wise operations such as xor and module addition. Meanwhile, the protocol can resist various attacks and has features of low computation cost and communication traffic.

순열을 사용한 새로운 초경량 RFID 인증 프로토콜에 대한 보안 분석 및 개선

저가의 RFID 태그는 많은 응용에 이용되지만 매우 한정된 계산 및 저장 능력을 가지고 있기 때문에 다양한 보안공격에 견딜 수 있는 RFID 상호인증 프로토콜을 만들기가 쉽지 않다. 아주 최근에 Tian 등은 계산비용이 적은 XOR 연산, 회전연산, 그리고 순열 연산을 사용하여 다양한 보안 공격에 견딜 수 있는 저가의 RFID 태그를 위한 인증 프로토콜(RAPP)을 제안하였다. 본 연구에서는 RAPP가 비동기화 공격에 취약함을 보이고 아울러 그 취약점을 극복하여 개선된 RAPP를 제시한다. Low-cost RFID tags are used in many applications. However, since it has very limited power of computation and storage, it's not easy to make a RFID mutual authentication protocol which can resist from the various security attacks. Quite recently, Tian et al. proposed a new ultralightweight authentication protocol (RAPP) for low-cost RFID tags using the low computation cost operations; XOR, rotation, and permutation operations, which is able to resist from the various security attacks. In this paper, we show that RAPP is vulnerable to the de-synchronization attack and present an improved RAPP which overcomes the vulnerability of RAPP.

A practical quadratic residues based scheme for authentication and privacy in mobile RFID systems

In this paper we propose a novel approach to authentication and privacy in mobile RFID systems based on quadratic residues and in conformance to EPC Class-1 Gen-2 specifications. Recently, Chen et al. (2008) [10] and Yeh et al. (2011) [11] have both proposed authentication schemes for RFID systems based on quadratic residues. However, these schemes are not suitable for implementation on low-cost passive RFID tags as they require the implementation of hash functions on the tags. Consequently, both of these current methods do not conform to the EPC Class-1 Gen-2 standard for passive RFID tags which from a security perspective requires tags to only implement cyclic redundancy checks (CRC) and pseudo-random number generators (PRNG) leaving about 2.5k–5k gates available for any other security operations. Further, due to secure channel assumptions both schemes are not suited for mobile/wireless reader applications. We present the collaborative authentication scheme suitable for mobile/wireless reader RFID systems where the security of the server–reader channel cannot be guaranteed. Our schemes achieves authentication of the tag, reader and back-end server in the RFID system and protects the privacy of the communication without the need for tags to implement expensive hash functions. Our scheme is the first quadratic residues based scheme to achieve compliance to EPC Class-1 Gen-2 specifications. Through detailed security analysis we show that the collaborative authentication scheme achieves the required security properties of tag anonymity, reader anonymity, reader privacy, tag untraceability and forward secrecy. In addition, it is resistant to replay, impersonation and desynchronisation attacks. We also show through strand space analysis that the proposed approach achieves the required properties of agreement, originality and secrecy between the tag and the server.

Novel chipless RF identification technology for on-touch data transfer applications

This article presents the design and development of a simple low-cost chipless RFID system for secure near field data transfer.This system is ideal for use in credit cards, personal data keeping cards, and similar identification cards which are based on “data transfer by contact” which at present commonly uses the integrated circuits or magnetic strips in it. The proposed system consists of a compactable low-cost RFID tag and a reader using a rectangular waveguide. © 2012 Wiley Periodicals, Inc. Microwave Opt Technol Lett 54:2325–2327, 2012; View this article online at wileyonlinelibrary.com. DOI 10.1002/mop.27044

Passive Enumeration of Secret Information in LMAP andM2APRFID Authentication Protocols

AbstractAs RFID tags gain popularity for everyday use, issues related to privacy and security of RFID-tagged objects become important. However, the memory and processing power constraints in low-cost RFID tags make securing these tags difficult, if not impossible. Light-weight protocols have been proposed to address this issue. Li and Wang (2007) report security vulnerabilities in two recently proposed ultra-lightweight RFID mutual authentication protocols - LMAP and M2 AP. Fairly similar in structure, these two protocols use ⊕, ∧, ∨, and sum mod m operations. We use m = 2 in sum mod m operation which is realistic in low-cost tags and, using a passive observer adversary, enumerate the entire set of secret information in two consecutive rounds of authentication.

RFID Security Using Lightweight Mutual Authentication and Ownership Transfer Protocol

In recent years, radio frequency identification technology has moved into the mainstream applications that help to speed up handling of manufactured goods and materials. RFID tags are divided into two classes: active and passive. Active tag requires a power source that's why its cost is more than passive tags. However, the low-cost RFID tags are facing new challenges to security and privacy. Some solutions utilize expensive cryptographic primitives such as hash or encryption functions, and some lightweight approaches have been reported to be not secure. This paper describes a lightweight Mutual authentication and ownership transfer protocol utilizing minimalistic cryptography using Physically Unclonable Functions (PUF) and Linear Feedback Shift Registers (LFSR). PUFs and LFSRs are very efficient in hardware and particularly suitable for the low-cost RFID tags. To functioning security in low cost RFID tag minimum gate requirement is 2000 gates. To implement security protocols using PUF and LFSR functions need only approx 800 gates. In this paper it is explained how we can authenticate and transfer ownership of low cost RFID tag securely using LFSR and PUF as compared to existing solutions based on hash functions.