Ownership Transfer Scheme Research Articles

A novel group ownership transfer protocol for RFID systems

Radio Frequency Identification (RFID) is a wireless communication technology nowadays widely used in almost every aspect of our lives including healthcare, logistics and supply chain management, inventory tracking, race timing, access control, toll collection, and a lot more. In RFID systems, a tag usually stores private or sensitive information, and so it needs an access control mechanism. When a tag's owner is changed, the read permission of the tag needs to be transferred from the old owner to the new owner, and this is when ownership transfer schemes come into play. In fact, not only do RFID ownership transfer schemes do ownership transfer, but they have to make sure that the ownership transfer procedure is executed under proper security protection. Besides, in some particular environments, the ownership transfer would be far more efficiently done if the tags could be treated as a group instead of individual tags. Therefore, in this paper, we propose a novel group ownership transfer protocol that satisfies all important security requirements including mutual authentication, data and location privacy, forward/backward secrecy, ownership privacy, and group ownership integrity. In addition, due to the use of cloud computing, our new protocol provides ubiquitous authentication. Based on homomorphic encryption and quadratic residues, our novel RFID group ownership transfer protocol can have encrypted data efficiently processed, and the communication cost is very low. The results of our BAN logic correctness check, security analysis, and performance evaluation confirm that the new protocol is logically correct and is capable of providing high level security/privacy protection on the basis of high cost-effective performance.

LACO: Lightweight Three-Factor Authentication, Access Control and Ownership Transfer Scheme for E-Health Systems in IoT

The use of the Internet of Things (IoT) in the electronic health (e-health) management systems brings with it many challenges, including secure communications through insecure radio channels, authentication and key agreement schemes between the entities involved, access control protocols and also schemes for transferring ownership of vital patient information. Besides, the resource-limited sensors in the IoT have real difficulties in achieving this goal. Motivated by these considerations, in this work we propose a new lightweight authentication and ownership transfer protocol for e-health systems in the context of IoT (LACO in short). The goal is to propose a secure and energy-efficient protocol that not only provides authentication and key agreement but also satisfies access control and preserves the privacy of doctors and patients. Moreover, this is the first time that the ownership transfer of users is considered. In the ownership transfer phase of the proposed scheme, the medical server can change the ownership of patient information. In addition, the LACO protocol overcomes the security flaws of recent authentication protocols that were proposed for e-health systems, but are unfortunately vulnerable to traceability, de-synchronization, denial of service (DoS), and insider attacks. To avoid past mistakes, we present formal (i.e., conducted on ProVerif language) and informal security analysis for the LACO protocol. All this ensures that our proposed scheme is secure against the most common attacks in IoT systems. Compared to the predecessor schemes, the LACO protocol is both more efficient and more secure to use in e-health systems.

A novel group ownership proof and transfer scheme for B2B, B2C and C2C transactions

In the field of supply chain management, radio frequency identification (RFID) tags have attracted widespread popularity. As raw materials or products are purchased, an inventory flow for products is completed once the ownership is transferred to the customer. On the basis of RFID tagged inventory, ownership transfer is a critical issue. The ownership of RFID tagged items should be seamlessly transferred. This paper proposes a novel RFID ownership transfer scheme suitable for products with multiple components attached with tags that need to be shipped together as a group. This is the first group ownership transfer scheme to emphasis the proof of ownership is crucial to purchase reliability. Buyers can confirm that the seller is the owner before the purchase. The ownership of the product can be verified and then be transferred successfully in business-to-business (B2B), business-to-customer (B2C) and customer-to-customer (C2C) transactions.

A Secure and Practical RFID Ownership Transfer Protocol Based on Chebyshev Polynomials

Radio frequency identification (RFID) has a wide range of applications, such as traffic management, access control, and supply chain management. Designing secure and efficient (i.e., practical) ownership transfer schemes remains a topic of ongoing challenge to supply chain vendors. In this paper, we propose the first RFID ownership transfer protocol based on Chebshev polynomials. The exchange properties of Chebyshev polynomials allow our proposed scheme to achieve data integrity, authentication, anonymity, and session freshness. We also demonstrate that our proposed scheme is more efficient than the existing schemes with the same security level, due to the reduced number of interactions.

A Privacy Model for RFID Tag Ownership Transfer

The ownership of RFID tag is often transferred from one owner to another in its life cycle. To address the privacy problem caused by tag ownership transfer, we propose a tag privacy model which captures the adversary’s abilities to get secret information inside readers, to corrupt tags, to authenticate tags, and to observe tag ownership transfer processes. This model gives formal definitions for tag forward privacy and backward privacy and can be used to measure the privacy property of tag ownership transfer scheme. We also present a tag ownership transfer scheme, which is privacy-preserving under the proposed model and satisfies the other common security requirements, in addition to achieving better performance.

RFID ownership transfer protocol based on cloud

RFID and Cloud computing are widely used in the IoT (Internet of Things). However, there are few research works which combine RFID ownership transfer schemes with Cloud computing. Subsequently, this paper points out the weaknesses in two protocols proposed by Xie et al. (2013) [3] and Doss et al. (2013) [9]. To solve the security issues of these protocols, we present a provably secure RFID ownership transfer protocol which achieves the security and privacy requirements for cloud-based applications. To be more specific, the communication channels among the tags, mobile readers and the cloud database are insecure. Besides, an encrypted hash table is used in the cloud database. Next, the presented protocol not only meets backward untraceability and the proposed strong forward untraceability, but also resists against replay attacks, tracing attacks, inner reader malicious impersonation attacks, tag impersonation attacks and desynchronization attacks. The comparisons of security and performance properties show that the proposed protocol has more security, higher efficiency and better scalability compared with other schemes.

Attacks on ownership transfer scheme for multi-tag multi-owner passive RFID environments

Sundaresan et al. proposed recently a novel ownership transfer protocol for multi-tag multi-owner RFID environments that complies with the EPC Class1 Generation2 standard. The authors claim that this provides individual-owner privacy and prevents tracking attacks. We show that this protocol falls short of its security objectives, and describe attacks that allow: (a) an eavesdropper to trace a tag, (b) the previous owner to obtain the private information that the tag shares with the new owner, and (c) an adversary that has access to the data stored on a tag to link this tag to previous interrogations (violating forward-secrecy). We analyze the security proof and show that while the first two cases can be addressed with a more careful design, strong privacy remains an open problem for lightweight RFID applications.

Secure RFID Tag Ownership Transfer Based on Quadratic Residues

In this paper, we propose a novel approach to secure ownership transfer in RFID systems based on the quadratic residue property. We present two secure ownership transfer schemes—the closed loop and open loop schemes. An important property of our schemes is that ownership transfer is guaranteed to be atomic. Further, both our schemes are suited to the computational constraints of EPC Class-1 Gen-2 passive RFID tags as they only use operations that such passive RFID tags are capable of. We provide a detailed security analysis to show that our schemes achieve strong privacy and satisfy the required security properties of tag anonymity, tag location privacy, forward secrecy, and forward untraceability. We also show that the schemes are resistant to replay (both passive and algebraic), desynchronization, and server impersonation attacks. Performance comparisons demonstrate that our schemes are practical and can be implemented on low-cost passive RFID tags.

Cryptanalaysis of an EPCC1G2 Standard Compliant Ownership Transfer Scheme

Recently, Chen and Chien have proposed a novel ownership transfer scheme with low implementation costs and conforming to the EPC Class-1 Generation-2 standard. The authors claimed that the proposed scheme is able to resist all attacks, and hence it has better security and performance than its predecessors. However, in this paper we show that the protocol fails short of its security objectives, and it is even less secure than the previously proposed schemes. In fact, we describe several attacks which allow to recover all the secret information stored in the tag. Obviously, once this information is known, tags can be easily traced and impersonated.

What Happened to the Company That Dix Made?

In the early twentieth century, progressive employers tried to turn recalcitrant workers into cooperative partners with a menu of corporate welfare programs. One of those employers, Henry A. Dix, took a leap that few contemplated. In 1922 he announced a plan to give his profitable $1 million business to his employees. Dix became famous as “the man who gave his business to his employees.” His ownership transfer scheme sought to make the welfare of the workforce the raison d'etre of a modern shareholder-owned corporation. It raised the possibility of building a capitalist society quite different from the one that emerged in the twentieth century. This paper connects the Dix plan to an understudied employer-based movement for industrial democracy and examines cultural, gender, and class dimensions of the Dix transfer from conception through the company's demise decades later.

What Happened to the Company That Dix Made?

In the early twentieth century, progressive employers tried to turn recalcitrant workers into cooperative partners with a menu of corporate welfare programs. One of those employers, Henry A. Dix, took a leap that few contemplated. In 1922 he announced a plan to give his profitable $1 million business to his employees. Dix became famous as “the man who gave his business to his employees.” His ownership transfer scheme sought to make the welfare of the workforce the raison d'etre of a modern shareholder-owned corporation. It raised the possibility of building a capitalist society quite different from the one that emerged in the twentieth century. This paper connects the Dix plan to an understudied employer-based movement for industrial democracy and examines cultural, gender, and class dimensions of the Dix transfer from conception through the company's demise decades later.

Mobile RFID Mutual Authentication and Ownership Transfer

In this paper, we propose an ownership transfer scheme that applies in mobile RFID networks. The scheme includes a mutual authentication protocol and a role-based ownership transfer protocol. A tag will decide what actions are allowed for a reader according to the reader's role class, and the back-end server will send to the reader the requested information about the tag. Keyed-hash functions are used to secure the protocols. Last, we prove that our protocol can do against the threats of replay attacks, distributed denial of service (DDoS), Man-in-the-Middle (MITM) attacks that change users' data, interception of data and location privacy, and tracking of tags' ownership transfer. Keywords-RFID;authentication; ownership transfer

An Ownership Transfer Scheme Using Mobile RFIDs

RFID reader equipment is widely used in hand-held devices; thus, the security of the connection between mobile readers and RFID servers is an important issue. In this paper, we propose a novel scheme with low implementation costs and conforming to EPC C1G2 standards. The benefits include reducing the manpower required for market management, market members using the mobile readers to query product information, as well as ensuring secure and efficient cash transactions. The membership can also access after-sales service or make ownership transfers with other users. Moreover, in order to achieve mutual authentication, our proposed scheme integrates fingerprint biometrics, related cryptology and a hash function mechanism to ensure the security of the transmitted messages.

Across-authority lightweight ownership transfer protocol

With the combination of mobile devices and readers in recent years, mobile RFID systems have been widely deployed in mobile identification and its further applications. E-commerce has applied many mobile RFID services, including the transfer of a tagged item’s ownership. To secure such transfer in a mobile RFID environment, we propose a new ownership transfer protocol across different authorities. We prove that it is able to withstand most threats for RFID and prevent denial of service attacks that arise in the presence of asynchrony. It can also guarantee forward and backward secrecy, and circumvent the windowing problem. This scheme is designed for lightweight tags and has been proved to be viable for use in low-cost passive tags. It also offers better performance than any other known ownership transfer schemes.

Practical RFID ownership transfer scheme

When an RFID tag changes hand, it is not as simply as handing over the tag secret to the new owner. Privacy is a concern if there is no secure ownership transfer scheme to aid the transfer. After sales service and temporary tag delegation are also fe

Protocol for ownership transfer across authorities: with the ability to assign transfer target

AbstractRadio Frequency Identification (RFID) has been widely deployed for its high capabilities in simple computation, storage, long scan distance, and simultaneous reading. With the combination of mobile devices and readers in recent years, it has been transformed to mobile RFID providing wider services for its users and mobility for its readers. E‐commerce, for instance, has applied many of mobile RFID's deriving services, one of which is the transfer of a tagged item's ownership. To secure such transfer in a mobile RFID environment, we propose a new approach for ownership transfer across different authorities and prove it able to stand most threats for RFID and to prevent Denial of Service (DoS) attacks that derive from asynchrony. Another contribution in this paper is that we can assign transfer targets, which, except our scheme, can only be achieved by Yang et al.'s Cross Authority Ownership Transfer (CAOT) protocol. That scheme, however, involves heavy computation and is not suitable for lightweight tags, whereas this scheme is designed for lightweight tags and has been proved viable on low‐cost passive tags and has better performance than any known ownership transfer schemes. Copyright © 2011 John Wiley & Sons, Ltd.

Vulnerability analysis of RFID protocols for tag ownership transfer

In RFIDSec'08, Song proposed an ownership transfer scheme, which consists of an ownership transfer protocol and a secret update protocol [7]. The ownership transfer protocol is completely based on a mutual authentication protocol proposed in WiSec'08 [8]. In Rizomiliotis et al. (2009) [6], van Deursen and Radomirovic (2008), the first weaknesses to be identified (tag and server impersonation) were addressed and this paper completes the consideration of them all. We find that the mutual authentication protocol, and therefore the ownership transfer protocol, possesses certain weaknesses related to most of the security properties initially required in protocol design: tag information leakage, tag location tracking, and forward traceability. Moreover, the secret update protocol is not immune to de-synchronization attacks.