面向RFID物联网应用的商业标签逆向工程与安全评估
Reverse Engineering and Security Evaluation of Commercial Tags for RFID-Based IoT Applications
AI总结：
本文针对RFID物联网应用，综述常见安全缺陷，提出一种便于检测和缓解缺陷的新方法论，并通过Proxmark 3工具在多个场景中验证，证明其可用于审计安全及逆向工程RFID通信。
摘要：
物联网（IoT）是一个由物理对象组成的分布式系统，需要硬件（如传感器、执行器、电子设备）与网络通信的无缝集成，以收集和交换数据。物联网智能对象需要以某种方式被识别，以确定数据的来源并自动检测我们周围的元素。在实现识别功能方面，最具优势的技术之一是RFID（射频识别），近年来该技术在门禁控制、支付卡或物流等应用中获得了极大的普及。尽管RFID广受欢迎，但在众多应用中，其安全性并未得到妥善处理。为促进此类应用的安全性，本文包含三项主要贡献。首先，为奠定基础，对RFID物联网系统中发现的常见缺陷进行了详细综述，包括文献中描述的最新攻击。其次，提出了一种新颖的方法论，便于检测和缓解此类缺陷。第三，分析了最新的RFID安全工具，并通过其中之一（Proxmark 3）应用所提出的方法论进行验证。因此，该方法论在标签常用于识别的不同场景中进行了测试。在这些系统中，能够克隆应答器、提取信息，甚至模拟标签和读写器。由此表明，所提出的方法论对于审计物联网应用中RFID通信的安全性及进行逆向工程是有用的。必须指出，尽管本文旨在促进物联网应用中RFID通信的安全性，但该方法论可应用于任何RFID通信协议。
英文摘要：
The Internet of Things (IoT) is a distributed system of physical objects that requires the seamless integration of hardware (e.g., sensors, actuators, electronics) and network communications in order to collect and exchange data. IoT smart objects need to be somehow identified to determine the origin of the data and to automatically detect the elements around us. One of the best positioned technologies to perform identification is RFID (Radio Frequency Identification), which in the last years has gained a lot of popularity in applications like access control, payment cards or logistics. Despite its popularity, RFID security has not been properly handled in numerous applications. To foster security in such applications, this article includes three main contributions. First, in order to establish the basics, a detailed review of the most common flaws found in RFID-based IoT systems is provided, including the latest attacks described in the literature. Second, a novel methodology that eases the detection and mitigation of such flaws is presented. Third, the latest RFID security tools are analyzed and the methodology proposed is applied through one of them (Proxmark 3) to validate it. Thus, the methodology is tested in different scenarios where tags are commonly used for identification. In such systems it was possible to clone transponders, extract information, and even emulate both tags and readers. Therefore, it is shown that the methodology proposed is useful for auditing security and reverse engineering RFID communications in IoT applications. It must be noted that, although this paper is aimed at fostering RFID communications security in IoT applications, the methodology can be applied to any RFID communications protocol.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
