RF-Rhythm：安全可用的双因素RFID身份验证
RF-Rhythm: Secure and Usable Two-Factor RFID Authentication
摘要：
无源RFID技术广泛应用于用户认证和访问控制。我们提出了RF节奏，一个安全和可用的双因素RFID认证系统具有很强的弹性丢失/被盗/克隆的RFID卡。在RF-Rhythm中，每个合法用户都会根据自己选择的秘密旋律在他/她的RFID卡上执行一系列敲击。这种有节奏的敲击可以引起反向散射信号的相位变化，RFID读取器可以检测到该相位变化以恢复用户的敲击节奏。除了像往常一样验证RFID卡的识别信息外，后端服务器还将提取的敲击节奏与其在用户注册阶段获取的节奏进行比较。当且仅当两个验证都成功时，用户才通过身份验证检查。我们还提出了一种新的跳相协议，其中RFID阅读器发射连续波（CW）与随机相位提取用户的秘密敲击节奏。我们的协议可以防止一个有能力的对手从嗅探RFID信号提取，然后重放一个合法的敲击节奏。全面的用户实验证实了RF-Rhythm的高安全性和可用性，假阳性和假阴性率接近于零。
英文摘要：
Passive RFID technology is widely used in user authentication and access control. We propose RF-Rhythm, a secure and usable two-factor RFID authentication system with strong resilience to lost/stolen/cloned RFID cards. In RF-Rhythm, each legitimate user performs a sequence of taps on his/her RFID card according to a self-chosen secret melody. Such rhythmic taps can induce phase changes in the backscattered signals, which the RFID reader can detect to recover the user's tapping rhythm. In addition to verifying the RFID card's identification information as usual, the backend server compares the extracted tapping rhythm with what it acquires in the user enrollment phase. The user passes authentication checks if and only if both verifications succeed. We also propose a novel phase-hopping protocol in which the RFID reader emits Continuous Wave (CW) with random phases for extracting the user's secret tapping rhythm. Our protocol can prevent a capable adversary from extracting and then replaying a legitimate tapping rhythm from sniffed RFID signals. Comprehensive user experiments confirm the high security and usability of RF-Rhythm with false-positive and false-negative rates close to zero.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
