Keyless Security in Wireless Networks

Security and privacy issues in RFID technology gain tremendous popularity recently. However, existing work on RFID authentication problems always make assumptions such as (1) hash function can be fully employed in designing RFID protocols; (2) channels between readers and server are always secure. The first assumption is not suitable for EPC Class-1 Gen-2 tags, which has been challenged in many research work, while the second one cannot be directly adopted in mobile RFID applications where wireless channels between readers and server are always insecure. To solve these problems, in this paper, we propose a novel ultralightweight and privacy-preserving authentication protocol for mobile RFID systems. We only use bitwise XOR, and several special constructed pseudo-random number generators to achieve our aims in the insecure mobile RFID environment. We use GNY logic to prove the security correctness of our proposed protocol. The security and privacy analysis show that our protocol can provide several privacy properties and avoid suffering from a number of attacks, including tag anonymity, tag location privacy, reader privacy, forward secrecy, and mutual authentication, replay attack, desynchronization attack etc. We implement our protocol and compare several parameters with existing work, the evaluation results indicate us that our protocol significantly improves the system performance.     

A practical quadratic residues based scheme for authentication and privacy in mobile RFID systems

In this paper we propose a novel approach to authentication and privacy in mobile RFID systems based on quadratic residues and in conformance to EPC Class-1 Gen-2 specifications. Recently, Chen et al. (2008) [10] and Yeh et al. (2011) [11] have both proposed authentication schemes for RFID systems based on quadratic residues. However, these schemes are not suitable for implementation on low-cost passive RFID tags as they require the implementation of hash functions on the tags. Consequently, both of these current methods do not conform to the EPC Class-1 Gen-2 standard for passive RFID tags which from a security perspective requires tags to only implement cyclic redundancy checks (CRC) and pseudo-random number generators (PRNG) leaving about 2.5k–5k gates available for any other security operations. Further, due to secure channel assumptions both schemes are not suited for mobile/wireless reader applications. We present the collaborative authentication scheme suitable for mobile/wireless reader RFID systems where the security of the server–reader channel cannot be guaranteed. Our schemes achieves authentication of the tag, reader and back-end server in the RFID system and protects the privacy of the communication without the need for tags to implement expensive hash functions. Our scheme is the first quadratic residues based scheme to achieve compliance to EPC Class-1 Gen-2 specifications. Through detailed security analysis we show that the collaborative authentication scheme achieves the required security properties of tag anonymity, reader anonymity, reader privacy, tag untraceability and forward secrecy. In addition, it is resistant to replay, impersonation and desynchronisation attacks. We also show through strand space analysis that the proposed approach achieves the required properties of agreement, originality and secrecy between the tag and the server.     

基于口令认证的RFID系统安全协议及其BAN逻辑分析

本文提出一种新的基于口令认证的RFID系统安全协议.该方法充分利用RFID低等级标签提供的有限资源:访问口令(PW)、标签的标识码(ID)和伪随机函数等建立RFID系统读写器和标签双向认证的安全协议,对该协议抵抗各种攻击的安全性进行理论分析并对该协议的认证功能进行BAN逻辑的形式化分析.结果表明该协议能够有效抵御在线和离线字典攻击、伪装攻击、重放攻击以及流量分析和跟踪攻击,因而解决了RFID系统的安全问题.     

Study of Magnetic Field Coupling Technologies in Activating RFID-SIM Card Mobile Payments

In this paper, we propose a RFID (Radio-frequency Identification)-SIM card mobile payment scheme and study the magnetic field coupling technologies in activating the payments for the second generation readers. Simulation results show that the mobile payment scheme based on a low-frequency magnetic-coupling activation strategy is reasonable, secured, robust, low-cost, and easy to promote. The performance of various mobile phones integrated with the RFID-SIM cards is very similar under the proposed activation strategy. The activation distances between various mobiles and the readers are very consistent. When high-frequency magnetic coupling is used, however, the performance of different mobile phones shows great difference because of the small attenuation factor.     

一种具有阅读器匿名功能的射频识别认证协议

在射频识别(RFID)的应用中,安全问题特别是用户隐私问题正日益凸显。因此,(用户)标签信息的隐私保护的需求越来越迫切。在RFID系统中,标签的隐私保护不仅是对外部攻击者,也应该包括阅读器。而现有许多文献提出的认证协议的安全仅针对外部攻击者,甚至在外部攻击者的不同攻击方法下也并不能完全保证安全。该文提出两个标签对阅读器匿名的认证协议:列表式RFID认证协议和密钥更新式RFID认证协议。这两个协议保证了阅读器对标签认证时,标签的信息不仅对外部攻击者是安全的而且对阅读器也保持匿名和不可追踪。相较于Armknecht等人提出的对阅读器匿名和不可追踪的认证协议,该文所提的协议不再需要增加第三方帮助来完成认证。并且密钥更新式RFID匿名认证协议还保证了撤销后的标签对阅读器也是匿名性和不可追踪的。     

An Efficient Reader Anticollision Algorithm in Dense RFID Networks With Mobile RFID Readers

In parallel with the proliferation of radio-frequency identification (RFID) systems, many RFID readers have been increasingly employed. In such an environment, collision among readers becomes a serious problem. Existing anticollision algorithms, depending on the information of neighboring readers, may require constant effort in order to grasp such information. Although it may be given by a server or a coordinator, they may not be suitable in dense and dynamic RFID networks with mobile readers. In this paper, we propose an efficient reader anticollision algorithm using a polling server in dense and dynamic RFID networks with mobile readers. Owing to the assistance of the server, the readers can rapidly decide whether they can work or not without interfering neighbors and can be easily synchronized. Our proposed algorithm is simple and makes readers aware of neighbors to minimize reader collisions. Performance evaluation shows how many readers can operate in a network and indicates that our proposed algorithm is more efficient than distributed color selection, colorwave, and hierarchical Q-learning algorithm, particularly in dense and mobile environments.      

RFID技术在手机支付领域中的应用

随着无线通信技术的快速发展,手机支付作为第三方电子支付手段的市场空间正在迅速扩大。RFID技术作为手机支付的核心,本文简述了移动手机支付的基本概念,RFID的工作原理,功能及技术应用的基本原理,分析了RFID技术在手机支付领域的应用前景和制约因素,并针对RFID技术在手机支付发展领域的广阔前景,从加强信息产业与传统产业相结合,完善手机支付的安全性,健全手机支付信用体系及协调手机支付产业链等方面提出相关方法建议来促进手机支付的快速发展。     

物联网移动RFID系统匿名访问控制认证密钥交换协议

针对物联网移动RFID系统标签隐私信息的访问控制以及用户身份隐私保护问题,本文采用身份加密和属性加密相结合的方法,建立了IB-AB-eCK安全模型,设计了基于身份及属性的认证密钥交换协议IB-AB-AKE。基于IB-AB-AKE协议,提出了移动RFID手机与信息服务器之间认证密钥交换协议,实现了在保护移动RFID手机用户身份隐私的同时,根据标签所有者定制的访问控制策略进行标签信息的访问控制认证和会话密钥交换,防止了隐私信息被非法访问。分析表明,IB-AB-AKE协议在IB-AB-eCK模型下是安全的,且在通信次数、通信量及计算量方面具有优势。      

基于相互认证的移动RFID安全协议

移动RFID系统是指利用植入RFID读写芯片的智能移动终端,获取标签中的信息,并通过移动网络,访问后台数据库,获取相关信息。然而,由于移动RFID系统的无线通信环境和无可视性读写,带来了很多安全隐患,已经成为制约移动RFID发展的重要因素,针对此问题,在分析了移动RFID网络构成及其安全隐患后,提出了一种基于相互认证的安全协议,该协议引入了一个第3方服务器来为移动读写器和后台数据库提供签名密钥,并且利用椭圆曲线加密体制(ECC)对信息进行签名验证,最后分析表明该协议可以为移动读写器与后台数据库提供安全的通信环境,以应对各种攻击。     

RF-IPD directional coupler for mobile RFID handset applications

To offer RFID services on mobile phones, the RFID reader must be embedded on the handset as a chip. However, the directional coupler, a ceramic passive component used in conventional RFID readers with identical Tx/Rx carrier frequency, has been too large for cellular handset applications. A miniaturised directional coupler design for UHF RFID mobile readers using an IPD (integrated passive device) process is presented. Parallel-coupled line theory has been used for formulation of a T-type and a -type coupler. Couplers with dimensions of 1.74 1.6 mm and 1.32 1.4 mm were assembled using the IPD process.     

Security analysis of an ultra‐lightweight RFID authentication protocol for m‐commerce

Nowadays, many people perform their commercial activities, such as electronic payment and electronic banking, through their mobile phones. Mobile commerce (m‐commerce) refers to manipulating electronic commerce (e‐commerce) by using mobile devices and wireless networks. Radio‐frequency identification (RFID) is a technology which can be employed to complete payment functions on m‐commerce. As an RFID subsystem is applied in m‐commerce and supply chains, the related security concerns are very important. Recently, Fan et al. have proposed an ultra‐lightweight RFID authentication scheme for m‐commerce (ULRAS) and claimed that their protocol is efficient enough and provides a high level of security. In this paper, we show that their protocol is vulnerable to secret disclosure and reader impersonation attacks. Finally, we improve it to a protocol that is resistant to the attacks presented in this paper and the other known attacks in the context of RFID authentication. We further analyze the security of the improved protocol through the Burrows–Abadi–Needham logic (BAN‐logic). Moreover, our proposed improvement does not impose any additional workload on the RFID tag.     

An efficient resource allocation scheme in a dense RFID network based on cellular learning automata

Radio‐frequency identification (RFID) is a wireless communication technology. Radio frequencies can cause interference in a dense RFID system, thus decreasing efficiency. In recent years, many protocols have been proposed to reduce reader collisions based on multiple‐access techniques. The main weakness of Time Division Multiple Access (TDMA)‐based schemes is the random selection of resources. Additionally, they do not consider the distance between the interfering readers. Therefore, the likelihood of interference in an RFID system will be increased. To address this problem, we propose a new scheme for allocating resources to readers using a learning technique. The proposed scheme takes into account the distance between interfering readers, and these readers acquire the necessary knowledge to select new resources based on the results of the previous selection of neighboring readers using cellular learning automata. This approach leads to reduced interference in an RFID system. The proposed scheme is fully distributed and operates without hardware redundancy. In this scheme, the readers select new resources without exchanging information with each other. The simulation results show that the percentage of kicked readers decreased by more than 20%, and the proposed scheme also provides higher throughput than do state‐of‐the‐art schemes for dense reader environments and leads to further recognition of tags.     

Mobile RFID的安全和隐私问题研究

射频识别技术被广泛应用于物体的自动识别,广泛地部署射频识别的标签会给用户的隐私带来新的安全威胁。目前,射频识别出现一种融合的趋势,阅读器被集成到移动电话中。移动射频识别主要应用于普通终端用户,用户的安全和隐私是最优考虑的问题。论文描述了移动RFID的应用场景和安全及隐私威胁,重点描述了移动环境下特殊的安全和隐私危险及解决移动RFID安全和隐私问题的安全体系构架方案。     

Using dummy data for RFID tag and reader authentication

Radio-Frequency IDentification (RFID) technology is an essential enabler of a multitude of intelligent applications. The robust authentication of RFID system components is critical in providing trustworthy data delivery from/to tags. In this paper, we propose an authentication protocol based on monitoring the transmissions between readers and tags in the system. The proposed authentication scheme is based on injecting decoys within the exchanged communications (between RFID readers and tags) and is used in the authentication process. Furthermore, the proposed authentication scheme is mathematically modeled and validated using extensive simulation. The simulations results show that the proposed scheme provides a 100% confidence level in the authentication of tags and detection of compromised readers.     

Radio frequency identification: technologies,applications, and research issues

A radio frequency identification (RFID) system is a special kind of sensor network to identify an object or a person using radio frequency transmission. A typical RFID system includes transponders (tags) and interrogators (readers): tags are attached to objects/persons, and readers communicate with the tags in their transmission ranges via radio signals. RFID systems have been gaining more and more popularity in areas such as supply chain management, automated identification systems, and any place requiring identifications of products or people. RFID technology is better than barcode in many ways, and may totally replace barcode in the future if certain technologies can be achieved such as low cost and protection of personal privacy. This paper provides a technology survey of RFID systems and various RFID applications. We also discuss five critical research issues: cost control, energy efficiency, privacy issue, multiple readers' interference, and security issue. Copyright © 2006 John Wiley & Sons, Ltd.     

Measurement of a Customer Satisfaction Index for Improvement of Mobile RFID Services in Korea

One of the ubiquitous technology fields that have received the most attention recently from technology communities worldwide is mobile radio frequency identification (RFID). Mobile handsets loaded with RFID readers enable the identification and retrieval of information on RFID tagged objects. In Korea, a variety of mobile RFID services are currently being piloted, and their commercial roll‐out looks imminent. The goal of this study is to propose, ahead of the commercial launch of mobile RFID services, a customer satisfaction index (CSI) model for this service category and to then measure the CSI to derive practical implications for their providers and pointers related to the improvement of service. A web survey was conducted on Korean mobile phone subscribers who had participated in a mobile RFID pilot program. Using the results of this survey, we tested the CSI model and its hypotheses by employing a partial least‐squares‐based structural equation model analysis and calculated the index. We further conducted an importance‐performance analysis in order to provide insights that may be useful for improving the quality of mobile RFID services.     

Model of dynamic clustering-based energy-efficient data filtering for mobile RFID networks

Data filtering is an essential task for improving the energy efficiency of radio-frequency identification (RFID) networks. Among various energy-efficient approaches, clustering-based data filtering is considered to be the most effective solution because data from cluster members can be filtered at cluster heads before being sent to base stations. However, this approach quickly depletes the energy of cluster heads. Furthermore, most previous studies have assumed that readers are fixed and interrogate mobile tags in a workspace. However, there are several applications in which readers are mobile and interrogate fixed tags in a specific area. This article proposes a model for dynamic clustering-based data filtering (DCDF) in mobile RFID networks, where mobile readers are re-clustered periodically and the cluster head role is rotated among the members of each cluster. Simulation results show that DCDF is effective in terms of balancing energy consumption among readers and prolonging the lifetime of the mobile RFID networks.     

基于Edwards曲线的移动RFID安全认证协议

针对传统的RFID认证协议通常难以适应移动RFID系统的问题,提出了基于Edwards曲线的适用于移动RFID系统的安全认证协议,协议采用Edwards曲线提高了其防侧信道攻击的能力,并应用椭圆曲线离散对数问题实现安全认证。进一步采用可证明安全方法给出了标签和阅读器不可跟踪隐私的安全性证明,通过安全性分析指出协议能更有效抵抗已有各种攻击。与现有的结构类似RFID认证协议相比,该协议扩展性更好,安全性和性能优于其他方案。     

Server‐less RFID authentication and searching protocol with enhanced security

This paper focuses on two interesting radio‐frequency identification (RFID) cryptographic protocols: the server‐less RFID authentication protocol that allows readers to authenticate tags without the help of any online backend servers, and the RFID searching protocol in which the verifier explicitly specifies the target tag to be searched and authenticated. These two kinds of RFID protocols play important roles in many RFID applications; however, the existing protocols either had security weaknesses or exhibited poor efficiency. This paper shows the weaknesses, and then proposes our server‐less RFID authentication protocol and RFID searching protocol. The proposed protocols greatly enhance the security using one more hashing. Copyright © 2011 John Wiley & Sons, Ltd.     

基于伪随机函数的RFID系统双向认证协议

移动RFID系统中,读写器与后台数据库之间不再通过有线方式通信,而采用无线方式通信,但也存在一定的安全隐患问题。为确保通信数据的安全,提出一种基于伪随机函数的移动RFID双向认证协议。协议确保标签、读写器、后台数据库三方均进行认证,从而保障通信的安全性;采用字合成等位运算,在一定程度上能够减少总的计算量;三方认证,使得移动RFID系统具备更为广泛的运用价值。安全性及性能分析表明,所提协议具有较高的安全性及较低的成本。