Radio Frequency Identification Authentication Protocol Research Articles

An ultralightweight RFID authentication protocol with CRC and permutation

Radio Frequency Identification (RFID) technology will become one of the most popular technologies to identify objects in the near future. However, the major barrier that the RFID system is facing presently is the security and privacy issue. Recently, an ultralightweight RFID authentication protocol with permutation has been proposed to provide security and prevent all possible attacks. However, it is discovered that a type of desynchronization attack can successfully break the proposed scheme. To overcome the vulnerability under the desynchronization attacks, we propose an approximate ultralightweight RFID authentication protocol which integrates the operation of the XOR operator, build-in CRC-16 function, the permutation and secret key backup technology to improve the security functions without increasing any security cost. We formally verify the security functionality of the proposed scheme by using Simple Promela Interpreter (SPIN). Analysis shows that our proposal has a strong ability to prevent existing possible attacks.

Two RFID Standard-based Security Protocols for Healthcare Environments

Radio Frequency Identification (RFID) systems are widely used in access control, transportation, real-time inventory and asset management, automated payment systems, etc. Nevertheless, the use of this technology is almost unexplored in healthcare environments, where potential applications include patient monitoring, asset traceability and drug administration systems, to mention just a few. RFID technology can offer more intelligent systems and applications, but privacy and security issues have to be addressed before its adoption. This is even more dramatical in healthcare applications where very sensitive information is at stake and patient safety is paramount. In Wu et al. (J. Med. Syst. 37:19, 43) recently proposed a new RFID authentication protocol for healthcare environments. In this paper we show that this protocol puts location privacy of tag holders at risk, which is a matter of gravest concern and ruins the security of this proposal. To facilitate the implementation of secure RFID-based solutions in the medical sector, we suggest two new applications (authentication and secure messaging) and propose solutions that, in contrast to previous proposals in this field, are fully based on ISO Standards and NIST Security Recommendations.

RFID Authentication and Communication Protocol Based on the Dynamic Active Tag ID and Key

The reliability of Radio Frequency Identification (RFID) mechanism is disturbed by illegal tracking and information intercepted.The paper proposed a new active RFID authentication protocol based on the dynamic tag ID and encryption key,which transforms the tag ID using chaotic transformation during authentication and communication between the reader and tags,and realizes mutual authentication of the reader and tags.Through the analysis of security, the protocol not only can ensure the integrity, fresh and confidentiality of data, but also can effectively prevent illegal tracking labels and replay attack.

CRFID: An RFID system with a cloud database as a back-end server

Radio-frequency identification (RFID) systems can benefit from cloud databases since information on thousands of tags is queried at the same time. If all RFID readers in a system query a cloud database, data consistency can easily be maintained by cloud computing. Privacy-preserving authentication (PPA) has been proposed to protect RFID security. The time complexity for searching a cloud database in an RFID system is O(N), which is obviously inefficient. Fortunately, PPA uses tree structures to manage tags, which can reduce the complexity from a linear search to a logarithmic search. Hence, tree-based PPA provides RFID scalability. However, in tree-based mechanisms, compromise of a tag may cause other tags in the system to be vulnerable to tracking attacks. Here we propose a secure and efficient privacy-preserving RFID authentication protocol that uses a cloud database as an RFID server. The proposed protocol not only withstands desynchronizing and tracking attacks, but also provides scalability with O(logN) search complexity.

RFID authentication protocol based on secret-sharing scheme

The authentication efficiency of tags is always an important factor that restricts the extensive application of Radio Frequency IDentification(RFID).But there is not a good method to solve the problem till now.On the basis of tree-based RFID protocol,this article shared the secret of each path with many portions using the secret-sharing scheme.A new secret tree was created and a secret-sharing-based protocol was proposed while still keeping the searching efficiency.After being analyzed,the protocol is proved to be secure and efficient,and it also solves the key-updating problem which has slowed the study of RFID system for a long time.

Security analysis of a RFID authentication protocol based on physically unclonable function

The Radio Frequency IDentification(RFID) authentication protocols based on Physically Unclonale Function(PUF) is a hot research field recent years.In 2011,Bassil et al.proposed a new RFID authentication protocol based on PUF in international conference on Internet technology and secured transactions(BASSIL R,EL-BEAINO W,KAYSSI A,et al.A PUF-based ultra-lightweight mutual-authentication RFID protocol [C]// 2011 International Conference on Internet Technology and Secured Transactions.Piscataway: IEEE,2011: 495-499).The paper analyzed the security of this protocol by an imaginative adversary and found that it cannot resist secret disclosure attack,traceability attack,reader impersonation attack and desynchronization attack.The paper described the details of these attacks and computed their success probabilities and computation complexities.

Enhanced secure RFID authentication protocol for EPC Gen2

Many current Radio Frequency IDentification(RFID) authentication protocols cannot conform with the EPC Class 1 Gen 2(EPC Gen2) standards or cannot meet the requirements of low-cost tags for the RFID authentication protocol.A new RFID authentication protocol based on the EPC Class 1 Gen 2(EPC Gen2) standards was proposed and the security proof was given with BAN logic.After analyzing the security,the proposed protocol can meet the RFID security demands: information confidentiality,data integrity and identity authentication.

Low-cost RFID authentication protocol based on PUF

The available security mechanisms for the low-cost Radio Frequency IDentification(RFID) systems are either defective or high-cost.Therefore,this paper proposed an efficient security authentication protocol for low-cost RFID system based on Physical Unclonable Function(PUF) and Linear Feedback Shift Register(LFSR).The protocol provides strong security and can resist physical attack and tag clone with strong privacy.

A Privacy-preserving RFID Authenticate Protocols against Man-in-themiddle Attacks

Radio Frequency Identification (RFID) is a technology designed to automatically identify a myriad of everyday objects and people. Due to widely spread of the RFID applications, some useful message can be attacked by adversaries. Thus, to eliminate the security problem, the security requirements for privacy-preserving RFID authentication protocols are evident. In this paper, we discuss unique manin-the-middle attacks on extending RFID authentication protocols. In particular, we show that the revised protocols which rely on the use of elliptic curve cryptography (ECC), grouping proof and RFID localization algorithms. Furthermore, we demonstrate that the proposed protocols can resist unique man-in-the-middle attacks and replay attacks.

Security analysis of two lightweight RFID authentication protocols

One of the key problems in radio frequency identification (RFID) is security and privacy. Many RFID authentication protocols have been proposed to preserve security and privacy of the system. Nevertheless, most of these protocols are analyzed and it is shown that they cannot provide security against some RFID attacks. Strong authentication and strong integrity (SASI) is the first ultra-lightweight authentication protocol introduced rotation shift operation and RFID authentication protocol with permutation (RAPP) is a new ultra-lightweight authentication protocol with permutation. In this paper, we give the security analysis on these two protocols. An active attack is presented on RAPP, and using the property of the left rotation and permutation operations, we can deduce the relationship of bits of random number or secret keys at different positions, thus obtain all the secrets shared by the reader and the tag. A passive full-disclosure attack is proposed on SASI. Using SASI’s construction weakness, our attack can reveal all the secrets shared by the reader and tag by eavesdropping about 48 rounds of the authentication messages.

A Lightweight RFID Authentication Protocol based on Elliptic Curve Cryptography

The security and privacy of the tag carrier has become the bottle neck of Radio Frequency Identification (RFID) system development further. In this paper, we propose a robust authentication protocol based on Elliptic Curve Cryptography (ECC), which meets the requirement of resource-limited RFID systems. Our protocol achieves mutual authentication and possesses lightweight feature by reducing the computation cost over the tag end. Moreover, the proposed protocol possesses remarkable security properties in RFID system and the immunity against the possible malicious attacks as well as an excellent performance through the detailed security analysis. Performance evaluation and function comparison demonstrate that our protocol makes a balance between cost and security in RFID authentication protocol. Compared to the previous relevant RFID authentication protocols, our protocol improves efficiency, enhances robustness, which is well suitable for RFID tags with the scarceness of resources.

Attacks and improvements on the RFID authentication protocols based on matrix

Most of the Radio Frequency IDentification (RFID) authentication protocols, proposed to preserve security and privacy, are analysed to show that they can not provide security against some passive or active attacks. In this paper, the security of two matrix-based protocols, proposed by Karthikeyan and Nesterenko (KN protocol) and Ramachandra et al. (RRS protocol) that conform to Electronic Product Code Class-1 Generation-2 (EPC Class-1 Gen-2) standard, are investigated. Using the linear relationship of multiplication of matrix and vector, we point out that both protocols can not provide scalability, and they are vulnerable to passive impersonation attack. In addition, both protocols are totally insecure if the adversary can compromise one tag to extract the secrets. A modified lightweight matrix-based authentication protocol is presented, which can resist mainly common attacks on an RFID authentication system including eavesdropping, relay attack, desynchronization attack, impersonation attack and tag tracking attack. The new protocol also has the desirable scalability property and can keep secure under compromising attack.

Unified privacy analysis of new‐found RFID authentication protocols

ABSTRACTUbiquitousness of Radio Frequency Identification (RFID) systems with inherent weaknesses has been a cause of concern about their privacy and security. Therefore, secure protocols are essentially necessary for the RFID tags to guarantee privacy and authentication among them and the reader. This paper inspects privacy in the RFID systems. First, we survey four new‐found RFID authentication protocols, and then, their weaknesses in formal privacy model are analyzed. Although the authors of the schemes claimed that their protocols completely resist privacy attacks, we formally prove that all of them suffer from the family of traceability attacks. Furthermore, not only are the four improved protocols proposed to prevent the aforementioned attacks, but also we provide formal analysis to guarantee the security and privacy of the proposed enhancements. Copyright © 2012 John Wiley & Sons, Ltd.

Efficient Implementation of RFID Mutual Authentication Protocol

Researchers have shown that the Electronic Product Code (EPC) Class-1 Generation-2 (C1G2) specification has serious security problems. To overcome these weaknesses, some authors have proposed a specially designed pad generation (PadGen) function to improve security. The PadGen function is used to produce a cover-coding pad to mask the tag's access password before the data are transmitted. In this paper, we study the radio-frequency identification (RFID) tag-reader mutual authentication (TRMA) scheme. Two improved authentication protocols for generating the PadGen function are described. A hardware design of these RFID authentication protocols conforming to the International Standards Organization 18000-6 Type-C protocol, also known as EPC C1G2 RFID protocol, is proposed. Since tags have an extremely limited computing power and storage capacity, the PadGen function based on exclusive-or operation for low-cost hardware implementation is reported in this study. The proposed RFID TRMA protocol was simulated using Modelsim XE II and synthesized using Altera's Quartus II software. The functionality of these strengthening protocols was successfully verified in hardware using an Altera DE2 board that included an Altera Cyclone II field-programmable gate array.

Efficient Passive Full-disclosure Attack on RFID Light-weight Authentication Protocols LMAP++ and SUAP

Radio Frequency Identification (RFID) is a technology that has been widely used in daily life, such as in access control, in electronic passports, in payment and ticketing. However, since the RFID information may be easily unveiled over the air, security and the privacy issues always exist. Many RFID authentication protocols have been proposed to preserve security and privacy of the system. Nevertheless, most of these protocols are analyzed and it is shown that they can not provide security against some RFID attacks. LMAP++ and SUAP are two typical and recently proposed RFID lightweight authentication protocols, which were presented to resist passive attack. In this work, utilizing the particular structures of these two protocols and the property of bitwise operations, we present a new and efficient passive full-disclosure attack on LMAP++, SUAP-1 and SUAP-3 protocol. We point out the construction weakness of these two protocols and our passive attack can be used to reveal all the secrets shared by the Reader and Tag by eavesdropping about 20 rounds of the authentication messages. DOI: http://dx.doi.org/10.11591/telkomnika.v10i6.1398 Full Text: PDF

PUF-enhanced offline RFID security and privacy

RFID (Radio Frequency IDentification) based communication solutions have been widely used nowadays for mobile environments such as access control for secure system, ticketing systems for transportation, and sport events. These systems usually depend on readers that are not continuously connected to a secure backend system. Thus, the readers should be able to perform their duties even in offline mode, which generally requires the management by the readers of the susceptible data. The use of RFID may cause several security and privacy issues such as traceability of tag owner, malicious eavesdropping and cloning of tags. Besides, when a reader is compromised by an adversary, the solution to resolve these issues getting worse. In order to handle these issues, several RFID authentication protocols have been recently proposed; but almost none of them provide strong privacy for the tag owner. On the other hand, several frameworks have been proposed to analyze the security and privacy but none of them consider offline RFID system.Motivated by this need, in this paper, we first revisit Vaudenay's model, extend it by considering offline RFID system and introduce the notion of compromise reader attacks. Then, we propose an efficient RFID mutual authentication protocol. Our protocol is based on the use of physically unclonable functions (PUFs) which provide cost-efficient means to the fingerprint chips based on their physical properties. We prove that our protocol provides destructive privacy for tag owner even against reader attacks.

Security and Privacy Analysis of Song–Mitchell RFID Authentication Protocol

Many applications, such as e-passport, e-health, credit cards, and personal devices that utilize Radio frequency Identification (RFID) devices for authentication require strict security and privacy. However, RFID tags suffer from some inherent weaknesses due to restricted hardware capabilities and are vulnerable to eavesdropping, interception, or modification. The synchronization and untraceability characteristics are the major determinants of RFID authentication protocols. They are strongly related to privacy of tags and availability, respectively. In this paper, we analyze a new lightweight RFID authentication protocol, Song and Mitchell, in terms of privacy and security. We prove that not only is the scheme vulnerable to desynchronization attack, but it suffers from traceability and backward traceability as well. Finally, our improved scheme is proposed which can prevent aforementioned attacks.

An Authentication Protocol Based on Combined RFID-Biometric System

Radio Frequency Identification (RFID) and biometric technologies saw fast evolutions during the last years and which are used in several applications, such as access control. Among important characteristics in the RFID tags, we mention the limitation of resources (memory, energy, …). Our work focuses on the design of a RFID authentication protocol which uses biometric data and which confirms the secrecy, the authentication and the privacy. Our protocol requires a PRNG (Pseud-Random Number Generator), a robust hash function and Biometric hash function. The Biometric hash function is used to optimize and to protect biometric data. For Security analysis of protocol proposed, we will use AVISPA and SPAN tools to verify the authentication and the secrecy.

Practical attacks and improvements to an efficient radio frequency identification authentication protocol

SUMMARYIn 2008, a scalable radio frequency identification (RFID) authentication protocol was proposed by Yanfei Liu to provide security and privacy for RFID tags. This protocol only needs O(1) time complexity to find out the identifier of the RFID tag irrespective of the total number of the tags in the system. Based on our analysis, however, a security flaw, which has gone unnoticed in the design of the protocol, makes the scheme vulnerable to tracking attack, tag impersonation attack, and desynchronization attack, if the attacker has the possibility to tamper with only one RFID tag. Because low‐cost devices are not tamper‐resistant, such an attack could be feasible, and we can apply the resulting attacks on authentication, untraceability, and desynchronization resistance of the protocol. To counteract such flaws, we revise the scheme with a stateful variant and also show that the proposed model requires less tag and server‐side computation. Copyright © 2011 John Wiley & Sons, Ltd.

Improvement of the securing RFID systems conforming to EPC Class 1 Generation 2 standard

Radio frequency identification (RFID) technology is taking the place of barcodes to become electronic tags of the new generation. EPC Class 1 Generation 2 has served as the most popular standard for passive RFID tags. In 2010, Yeh et al. proposed a new RFID authentication protocol conforming to EPC Class 1 Generation 2 standard. However, this paper demonstrates that Yeh et al.’s protocol has two serious security problems such as DATA integrity problem and forward secrecy problem unlike their claims. An improved protocol is also proposed which can prevent the security problems and be applied in low-cost RFID environments requiring a high level of security.