基于Hash函数的RFID安全认证协议研究

近年来,射频识别(RFID)技术发展非常迅速,未来应用将无处不在.针对RFID应用中存在的安全隐患,分析了了目前有代表性的几个基于Hash函数的RFID安全认证协议的优缺点,比较了各自的安全性,提出了一个基于Hash函数的RFID安全认证协议.该协议引入标签ID动态更新机制,并设计了自同步解决方案,该协议具有防跟踪、不可分辨性、抗重放攻击、哄骗攻击、去同步攻击和拒绝服务攻击,较好地解决了RFID的安全隐患问题,特别适合于低成本、低计算量、大规模的RFID系统.     

一种基于动态密钥的低成本射频识别标签安全方案

随着射频识别(RFID)技术的广泛应用,隐私安全问题引起了人们的极大关注。首先从安全性和实用性方面讨论了现有的RFID安全协议存在的不足,然后对一种基于动态密钥的低成本RFID标签安全方案进行了分析,较好地解决了在认证协议中容易出现的数据不同步和重传攻击问题。     

物联网系统安全协议的分析与设计

随着网络技术的飞速发展,物联网技术越来越受到人们的重视,而电子标签（RFID）系统在物联网技术中占有举足轻重的地位。但是由于它的异构性和低成本性,使得其非常容易遭到恶意攻击。面对日益复杂的网络环境,本文对RFID系统的实际使用需求有针对性的对物联网安全协议进行分析和设计。以期能够保护物联网的信息安全与隐私。     

RFID安全认证协议HSAP的分析及改进

随着RFID系统应用的不断扩大,RFID的安全问题也越来越受到人们的关注,基于Hash Lock的RFID安全协议以其低成本的优势得到了广泛的应用,但其安全性能尚不完善。在分析已有的Hash Lock安全协议的基础上,提出了一种基于HSAP的改进协议,通过对其分析可知,改进的协议IHSAP能够保证内容隐私、防止位置跟踪攻击、防止会话劫持攻击、抵抗重放攻击、防止假冒攻击,是一种性能较好的协议,在实际的环境中有一定的实用价值。     

RFID系统安全与隐私问题研究

介绍了RFID系统组成和工作原理,对当前RFID系统中存在的安全隐私问题从标签安全、网络安全、数据安全等方面进行简要介绍,然后从RFID系统的物理安全机制和安全协议两个方面对现有的安全与隐私问题解决方案进行讨论,最后提出了一种基于攻击树(Attack Tree)的RFID系统安全攻击模型。     

基于ISO18000-6C标准的RFID认证协议

RFID技术应用越来越广,给人们带来便利的同时安全和隐私问题也相随而生,如何提高RFID系统的安全防范能力已成为该领域的重点研究方向。许多研究者提出了基于RFID空中接口通信的认证协议,但复杂的算法难以适用于符合ISO18000-6C标准的电子标签。论文根据ISO18000-6C标准提出了一种新的适合低成本标签的认证协议,为RFID安全提供了一套解决方案。     

最优分组索引的RFID安全协议

由于RFID系统及设备的特殊性和局限性,以及使用开放的无线通信链路,从而带来许多安全问题,目前还缺乏安全、高效、实用的低成本RFID安全协议。本文对现有几种典型的安全协议进行了分析,并指出其存在的安全缺陷和漏洞。针对基于分组索引的RFID安全协议所存在的问题,本文提出了最优分组方案,使其索引的时间复杂度降为最低,同时采用随机数、Hash函数、标签与后端数据库共享密钥机制等,解决了RFID中的隐私保护、跟踪、欺骗攻击、前向安全、后向安全、妥协攻击等安全性问题。     

可证明安全的轻量级RFID所有权转移协议

设计安全的无线射频识别协议有助于实现智慧城市的规划和构建完善的智慧网络。安全的RFID所有权转移协议要求同时具备安全性和隐私性,标签的前向不可追踪性和后向不可追踪性是RFID系统实际应用中需要考量的两个重要的隐私性能。针对现有供应链系统中所有权转移协议存在的各种安全隐私问题,该文改进了原有前向不可追踪性定义的错过密钥更新过程的不合理的假设,提出了强前向不可追踪性的概念。提出了一个基于二次剩余定理的轻量级RFID所有权转移协议,并使用改进的模型和定义形式化证明了协议的安全性和隐私性。证明结果表明新方案既可以抵御内部读卡器恶意假冒攻击,追踪攻击,标签假冒攻击和异步攻击,又满足强前向不可追踪性和后向不可追踪性等隐私性能;新协议在实现低成本和高效率认证的基础上,比其他协议安全性和隐私性更好。     

基于口令认证的RFID系统安全协议及其BAN逻辑分析

本文提出一种新的基于口令认证的RFID系统安全协议.该方法充分利用RFID低等级标签提供的有限资源:访问口令(PW)、标签的标识码(ID)和伪随机函数等建立RFID系统读写器和标签双向认证的安全协议,对该协议抵抗各种攻击的安全性进行理论分析并对该协议的认证功能进行BAN逻辑的形式化分析.结果表明该协议能够有效抵御在线和离线字典攻击、伪装攻击、重放攻击以及流量分析和跟踪攻击,因而解决了RFID系统的安全问题.     

一个针对低成本RFID标签的双向认证协议

文中提出了一种为低成本RFID标签设计的双向认证协议。分析RFID系统可能存在的安全和隐私威胁,包括重放、冒充、后向和前向跟踪、异步攻击和标签位置跟踪。该协议能够有效地防护以上攻击并且与相关方案具备更优的计算性能。     

一种基于Hash函数的RFID安全认证方法

近年来,射频识别(RFID)技术得到越来越多的应用,随之而来的是各种RFID安全问题。对现有的基于Hash函数的RFID认证协议进行分析,针对现有技术存在的不足,提出了一种基于Hash函数的低成本的RFID双向安全认证方法,该方法只需要进行一次Hash函数计算,且加入了标签ID动态更新机制,通过在后台数据库中存储旧的标签ID解决同步问题,与现有技术相比具有一定的优越性。     

ECC-Based RFID Authentication Protocol

The radio frequency identification (RFID) technology has been widely used so far in industrial and commercial applications. To develop the RFID tags that support elliptic curve cryptography (ECC), we propose a scalable and mutual authentication protocol based on ECC. We also suggest a tag privacy model that provides adversaries exhibiting strong abilities to attack a tag’s privacy. We prove that the proposed protocol preserves privacy under the privacy model and that it meets general security requirements. Compared with other recent ECC-based RFID authentication protocols, our protocol provides tag privacy and performs the best under comprehensive evaluation of tag privacy, tag computation cost, and communications cost.     

Are RNGs Achilles’ Heel of RFID Security and Privacy Protocols?

Security and privacy concerns have been growing with the increased utilisation of RFID technology in our daily lives. To mitigate these issues, numerous privacy-friendly authentication protocols have been published in the last decade. Random number generators (RNGs) are necessarily used in RFID tags to provide security and privacy. However, low-end RNGs can be the weakest point in a protocol scheme and using them might undesirably cause severe security and privacy problems. On the other hand, having a secure RNG with large entropy might be a trade-off between security and cost for low-cost RFID tags. Furthermore, RNGs used in low-cost RFID tags might not work properly in time. Therefore, we claim that the vulnerability of using an RNG deeply influences the security and privacy level of the RFID system. To the best of our knowledge, this concern has not been considered in the RFID literature. Motivated by this need, in this study, we first revisit Vaudenay’s privacy model which combines the early models and presents a new mature privacy model with different adversary classes. Then, we extend the model by introducing RANDOMEYE privacy, which allows analyzing the security of RNGs in RFID protocols. We further apply our extended model to two existing RFID schemes.     

Lightweight Cryptographic Authentication in Passive RFID-Tagged Systems

The explosion in recent interest in radio-frequency identification (RFID) tags stems primarily from advances in information processing in supply chain management. Given their processing power and memory capabilities, RFID tags can be used in a wide range of applications including those where barcodes can and cannot be used. Although the potential exists, it is hampered by the relatively high unit cost of implementation and issues related to privacy and security. As with any technology, unit cost of RFID tags and their related systems is bound to come down. As for security and privacy issues, the main impediments are limited processing power, memory, and external power to operate these tags. In spite of these resource constraints, recent years have seen a plethora of new authentication protocols that promise to alleviate security and privacy concerns associated with the use of RFID tags. We evaluate a few protocols that have been suggested for use in passive RFID-tagged systems and identify vulnerabilities that may be present. When appropriate, we present modifications of existing protocols to prevent identified vulnerabilities.     

Security and Privacy Analysis of Song–Mitchell RFID Authentication Protocol

Many applications, such as e-passport, e-health, credit cards, and personal devices that utilize Radio frequency Identification (RFID) devices for authentication require strict security and privacy. However, RFID tags suffer from some inherent weaknesses due to restricted hardware capabilities and are vulnerable to eavesdropping, interception, or modification. The synchronization and untraceability characteristics are the major determinants of RFID authentication protocols. They are strongly related to privacy of tags and availability, respectively. In this paper, we analyze a new lightweight RFID authentication protocol, Song and Mitchell, in terms of privacy and security. We prove that not only is the scheme vulnerable to desynchronization attack, but it suffers from traceability and backward traceability as well. Finally, our improved scheme is proposed which can prevent aforementioned attacks.     

一种基于动态ID刷新机制的低成本RFID标签双向认证协议(英文)

In order to solve the various privacy and security problems in RFID system, a new low-cost RFID mutual authentication protocol based on ID updating mechanics is proposed. In the proposed scheme, the backend server keeps both the current ID and potential next ID for each tag, thus to solve the possible problem of de-synchronization attack in the most ID updating-based schemes. In the security analysis section, comparing several protocols in property required and attacker resistances, the comparison results s...     

轻型的RFID安全认证协议LAP

RFID标签存在着处理能力弱、存储空间小和电源供给有限等局限性,传统的公钥算法或散列函数等复杂运算不能满足实际应用的需求。针对现有轻量级RFID认证协议的不足,设计了基于广义逆矩阵的RFID安全认证协议LAP。该协议采用了硬件复杂度较低的CRC校验及计算量较小的矩阵运算。通过安全隐私和性能分析,LAP协议适用于低成本、存储与计算受限的RFID标签。     

Radio frequency identification: technologies,applications, and research issues

A radio frequency identification (RFID) system is a special kind of sensor network to identify an object or a person using radio frequency transmission. A typical RFID system includes transponders (tags) and interrogators (readers): tags are attached to objects/persons, and readers communicate with the tags in their transmission ranges via radio signals. RFID systems have been gaining more and more popularity in areas such as supply chain management, automated identification systems, and any place requiring identifications of products or people. RFID technology is better than barcode in many ways, and may totally replace barcode in the future if certain technologies can be achieved such as low cost and protection of personal privacy. This paper provides a technology survey of RFID systems and various RFID applications. We also discuss five critical research issues: cost control, energy efficiency, privacy issue, multiple readers' interference, and security issue. Copyright © 2006 John Wiley & Sons, Ltd.     

标准模型下可证明安全的RFID双向认证协议

目前RFID(radio frequency identification)系统安全问题日益突出,为了实现RFID系统信息安全与隐私保护,在标准模型提出了一个基于HB协议的RFID双向安全认证协议。利用规约技术证明协议的安全性,将攻击者的困难规约到伪随机函数与真正随机函数的不可区分性上。协议仅使用轻量级的伪随机发生器以及向量点乘运算,具有较高的安全性和效率。通过从安全性及性能两方面与其他认证协议进行比较,表明协议适用于低成本及存储资源受限的RFID标签。     

Mobile RFID的安全和隐私问题研究

射频识别技术被广泛应用于物体的自动识别,广泛地部署射频识别的标签会给用户的隐私带来新的安全威胁。目前,射频识别出现一种融合的趋势,阅读器被集成到移动电话中。移动射频识别主要应用于普通终端用户,用户的安全和隐私是最优考虑的问题。论文描述了移动RFID的应用场景和安全及隐私威胁,重点描述了移动环境下特殊的安全和隐私危险及解决移动RFID安全和隐私问题的安全体系构架方案。