Vajda and Buttyan (VB) proposed a set of five lightweight RFID authentication protocols. Defend, Fu, and Juels (DFJ) did cryptanalysis on two of them - XOR and SUBSET. To the XOR protocol, DFJ proposed repeated keys attack and nibble attack. In this paper, we identify the vulnerability existed in the original VB's successive session key permutation algorithm. We propose three enhancements to prevent DFJ's attacks and make XOR protocol stronger without introducing extra resource cost.
Radio Frequency Identification (RFID) is a key technology used in many applications. In the past decades, plenty of secure and privacy-preserving RFID tag/mutual authentication protocols as well as formal frameworks for evaluating them have been proposed. However, we notice that a property, namely proof of possession (PoP), has not been rigorously studied till now, despite it has significant value in many RFID applications. For example, in RFID-enabled supply chains, PoP helps prevent dis-honest parties from publishing information about products/tags that they actually have never processed. We…
Continuous advances of Information Technologies (ITs), and in particular of the RFID technologies that allow the connection between the physical world objects and the IT infrastructure, have guaranteed the improvement and efficiency of industrial technologies in the last decades. This paper includes the proposal of two new schemes for RFID. On the one hand, it describes the internals of a lightweight Pseudo-Random Number Generator (PRNG) suitable for low resource devices such as passive RFID complying with the EPC Gen2 specifications. On the other hand, a new secure mutual authentication proto…
Today, the Internet of Things (IoT) is one of the emerging technologies that enable the connection and transfer of information through communication networks. The main idea of the IoT is the widespread presence of objects such as mobile devices, sensors, and RFID. With the increase in traffic volume in urban areas, the existing intelligent urban traffic management system based on IoT can be vital. Therefore, this paper focused on security in urban traffic based on using RFID. In our scheme, RFID tags chose as the purpose of this article. We, in this paper, present a mutual authentication proto…
APRAP: Another Privacy Preserving RFID Authentication Protocol
隐私保护RFID（Radio Frequency Identification）认证是近年来的一个研究热点。前向安全性和后向安全性都需要保持标签的隐私，即，标签的秘密密钥的暴露不应暴露标签的过去或未来的秘密密钥。我们设想需要一个正式的模型，为RFID协议设计的后向安全共享密钥设置，因为RFID标签的资源过于有限，以支持公钥设置。然而，自从Serge Vaudenay在他的Asiacrypt 2007论文中指出，如果没有公钥设置，就不可能实现完美的后向安全性以来，对共享密钥环境的后向安全性的研究并不多。我们提出了一个用于共享密钥环境的隐私保护RFID认证协议APRAP，该协议使用绝缘密钥，最大限度地减少了秘密密钥暴露所造成的损害。即使标签的秘密密钥在认证会话期间暴露，在我们的假设下，标签的前向安全性和“受限”后向安全性也被保留。“受限”后向安全性的概念是对手错过了更新受损秘密密钥所需的协议副本。虽然我们的定义并没有捕捉到完美的后向安全性，但它仍然适合于有效的实现，因为标签在实践中是高度移动的。我们还提供了一个正式的安全模型的APRAP。从计算要求的角度来看，我们的方案比以前的建议更有效。
Practical Attacks on a RFID Authentication Protocol Conforming to EPC C-1 G-2 Standard
Yeh等人最近提出了一种基于EPC Class-1 Gen. 2标准[1]。他们声称，他们的协议是安全的，可以抵御对抗攻击，并提供前向保密。在本文中，我们将表明，建议的协议没有适当的安全功能。对该协议提出了一种强有力的实用攻击，从而破坏了协议的整体安全性。此外，Yeh等人的协议不保证不可追溯性和向后不可追溯性方面。也就是说，被泄露的标签的所有过去和下一个交易将被对手追踪。
This work considers identity attack on a radio-frequency identification (RFID)-based backscatter communication system. Specifically, we consider a single-reader, single-tag RFID system whereby the reader and the tag undergo two-way signaling which enables the reader to extract the tag ID in order to authenticate the legitimate tag (L-tag). We then consider a scenario whereby a malicious tag (M-tag)---having the same ID as the L-tag programmed in its memory by a wizard---attempts to deceive the reader by pretending to be the L-tag. To this end, we counter the identity attack by exploiting the n…
Physically unclonable functions (PUFs) can be employed for device identification, authentication, secret key storage, and other security tasks. However, PUFs are susceptible to modeling attacks if a number of PUFs' challenge-response pairs (CRPs) are exposed to the adversary. Furthermore, many of the embedded devices requiring authentication have stringent resource constraints and thus require a lightweight authentication mechanism. We propose PUF-RLA, a PUF-based lightweight, highly reliable authentication scheme employing binary string shuffling. The proposed scheme enhances the reliability …
Currently, special attention is being paid to scenarios where the interconnection of devices with heterogeneous computational and communication capabilities it is required. It is essential to integrate security services during the stages of design and deployment of these networks since many of these scenarios provide critical services such as medical health, payment systems, military affairs, access control, e-banking, etc. This work analyses several cryptographic primitives related to entity authentication providing robust solutions according to device capabilities.
Fingerprint authentication techniques have been employed in various Internet of Things (IoT) applications for access control to protect private data, but raw fingerprint template leakage in unprotected IoT applications may render the authentication system insecure. Cancelable fingerprint templates can effectively prevent privacy breaches and provide strong protection to the original templates. However, to suit resource-constrained IoT devices, oversimplified templates would compromise authentication performance significantly. In addition, the length of existing cancelable fingerprint templates…
The Internet of Things (IoT) is giving a boost to a plethora of new opportunities for the robust and sustainable deployment of cyber physical systems. The cornerstone of any IoT system is the sensing devices. These sensing devices have considerable resource constraints, including insufficient battery capacity, CPU capability, and physical security. Because of such resource constraints, designing lightweight cryptographic protocols is an opportunity. Remote User Authentication ensures that two parties establish a secure and durable session key. This study presents a lightweight and safe authent…
Internet of Things (IoT) networks are becoming a part of our daily lives, as the number of IoT devices around us are surging. The authentication of millions of connected things and the distribution and management of secret keys between these devices pose challenging research problems. Current one-to-one authentication schemes do not take the resource limitations of IoT devices into consideration. Nor do they address the scalability problem of massive machine type communication (mMTC) networks. Group authentication schemes (GAS), on the other hand, have emerged as novel approaches for many-to-m…
Continuous Authentication (CA) has been proposed as a potential solution to counter complex cybersecurity attacks that exploit conventional static authentication mechanisms that authenticate users only at an ingress point. However, widely researched human user characteristics-based CA mechanisms cannot be extended to continuously authenticate Internet of Things (IoT) devices. The challenges are exacerbated with increased adoption of device-to-device (d2d) communication in critical infrastructures. Existing d2d authentication protocols proposed in the literature are either prone to subversion o…
