基于伪随机函数的RFID系统双向认证协议

移动RFID系统中,读写器与后台数据库之间不再通过有线方式通信,而采用无线方式通信,但也存在一定的安全隐患问题。为确保通信数据的安全,提出一种基于伪随机函数的移动RFID双向认证协议。协议确保标签、读写器、后台数据库三方均进行认证,从而保障通信的安全性;采用字合成等位运算,在一定程度上能够减少总的计算量;三方认证,使得移动RFID系统具备更为广泛的运用价值。安全性及性能分析表明,所提协议具有较高的安全性及较低的成本。     

基于相互认证的移动RFID安全协议

移动RFID系统是指利用植入RFID读写芯片的智能移动终端,获取标签中的信息,并通过移动网络,访问后台数据库,获取相关信息。然而,由于移动RFID系统的无线通信环境和无可视性读写,带来了很多安全隐患,已经成为制约移动RFID发展的重要因素,针对此问题,在分析了移动RFID网络构成及其安全隐患后,提出了一种基于相互认证的安全协议,该协议引入了一个第3方服务器来为移动读写器和后台数据库提供签名密钥,并且利用椭圆曲线加密体制(ECC)对信息进行签名验证,最后分析表明该协议可以为移动读写器与后台数据库提供安全的通信环境,以应对各种攻击。     

基于单向伪随机函数的移动RFID系统认证协议

针对移动RFID系统认证中可能出现的成本、效率、安全问题,设计了一种基于单向伪随机函数的移动RFID认证协议.协议在满足Gen-2标准的前提下,综合采用位替换运算、异或运算和单向伪随机函数加密通信信息;协议充分利用标签、读写器、后端数据库三方共享密钥和三方通信信息,对信息进行加密传输和加密认证,降低系统成本;通过实现完整三方认证与密钥更新工作,避免协议遭受假冒、去同步化等攻击行为.最后,给出协议GNY理论逻辑证明以及安全、性能分析,表明新协议的可行性与安全性.     

基于对数谱射频指纹识别的RFID系统信息监控方法

针对常规RFID系统对信息控制的不足,提出了一种基于辐射源识别的无源RFID系统的信息监控方法。采集无源RFID标签的辐射射频信号,变换为新的对数谱射频指纹,并进行特征提取与识别,获得标签身份真伪结果;把射频指纹等集成到读写器应用层协议,实现标签与读写器之间信息的控制。建模、仿真与实验表明,对数谱射频指纹仅由标签的频偏与冲击响应决定,具有稳健性等;给出了融合提出指纹的RFID系统挑战——应答认证协议实例。提出方法不仅能增强标签与读写器的认证安全强度,而且能实现通信中标签的身份监控,对于解决密钥泄漏检测公开问题也有一定贡献。     

基于Hash链的RFID双向认证协议的设计与分析

系统中信息的安全性是制约射频识别技术(RFID)广泛应用的一个重要因素.基于Hash函数的RFID认证协议是受到广泛关注的解决方案.本文针对RFID系统存在的用户安全及隐私等问题,在讨论了现有协议的优缺点的基础上,提出了一种基于Hash链的双向认证方案.分析表明,该协议具有不可分辨性、前向安全性、抗重放攻击、哄骗攻击等特点.     

物联网中基于动态密钥轻量级RFID认证协议

针对物联网中感知层RFID系统信息及用户隐私易被泄露等问题,提出一种基于动态密钥轻量级RFID安全认证协议。该协议利用标签及读写器自身产生的随机数、CRC编码函数及一定算法生成动态密钥,并利用该密钥及加密算法来加密认证过程中的重要参数,确保数据传输过程中的机密性。运用BAN逻辑形式化分析方法对该协议安全性进行证明。通过对该协议的安全性、复杂性分析表明,该协议安全、可靠,运行效率较高,适合低成本RFID系统对应用安全的需要。     

一种具有阅读器匿名功能的射频识别认证协议

在射频识别(RFID)的应用中,安全问题特别是用户隐私问题正日益凸显。因此,(用户)标签信息的隐私保护的需求越来越迫切。在RFID系统中,标签的隐私保护不仅是对外部攻击者,也应该包括阅读器。而现有许多文献提出的认证协议的安全仅针对外部攻击者,甚至在外部攻击者的不同攻击方法下也并不能完全保证安全。该文提出两个标签对阅读器匿名的认证协议:列表式RFID认证协议和密钥更新式RFID认证协议。这两个协议保证了阅读器对标签认证时,标签的信息不仅对外部攻击者是安全的而且对阅读器也保持匿名和不可追踪。相较于Armknecht等人提出的对阅读器匿名和不可追踪的认证协议,该文所提的协议不再需要增加第三方帮助来完成认证。并且密钥更新式RFID匿名认证协议还保证了撤销后的标签对阅读器也是匿名性和不可追踪的。     

基于共享秘密的伪随机散列函数RFID双向认证协议

针对资源受限的RFID标签,结合伪随机数和共享秘密机制,该文提出一种基于散列函数的轻量级双向认证协议,实现了后端数据库、阅读器和标签之间的双向认证。详细分析了双向认证协议的抗攻击性能和效率性能,并基于BAN逻辑分析方法对协议模型进行了形式化证明。理论分析表明,该文提出的认证协议能够实现预期安全目标,抗攻击性能好,认证执行效率高且标签开销小,适用于大数量的RFID应用。     

基于口令认证的RFID系统安全协议及其BAN逻辑分析

本文提出一种新的基于口令认证的RFID系统安全协议.该方法充分利用RFID低等级标签提供的有限资源:访问口令(PW)、标签的标识码(ID)和伪随机函数等建立RFID系统读写器和标签双向认证的安全协议,对该协议抵抗各种攻击的安全性进行理论分析并对该协议的认证功能进行BAN逻辑的形式化分析.结果表明该协议能够有效抵御在线和离线字典攻击、伪装攻击、重放攻击以及流量分析和跟踪攻击,因而解决了RFID系统的安全问题.     

一种读写器参与计算的RFID认证协议

伴随着物联网技术的兴起,射频识别（RFID）技术受到更为广泛的关注,其安全特性与面临的隐私问题制约了其应用。针对这些问题,学者提出诸多安全协议以应对,然而现有协议大都将RFID读写器作为传递数据的工具,而没有充分开发读写器在协议中的运算作用。本文设计了一个读写器参与识别计算的协议,标签和后端数据库存储不同的秘密,并通过读写器建立联系,这样不仅可以抵抗常见的攻击,而且可以抵抗因后端数据库所存储的识别表意外失窃所带来的对整个系统的危险。     

基于位替换运算的RFID双向认证协议

安全性是射频识别系统面临的重要隐患,针对该问题,设计了用于加密的位替换运算,并提出了一种新的基于位替换运算的RFID双向认证协议(SRMAP).安全与性能分析表明:SRMAP可抵抗多种潜在攻击,且能够使标签内计算操作、存储空间及通信量得以降低.最后,采用BAN逻辑方法形式化证明了该协议的正确性与安全性.     

用于多媒体加密的基于身份的密钥协商协议的安全性

最近Yi等(2002)提出了一个用于多媒体加密的基于身份的密钥协商协议。协议建立在Diffie-Hellman 密钥交换协议和RSA公钥密码体系之上。Yi等分析了协议的安全性,并认为该协议对于恶意攻击是鲁棒的。然而,本文证明该协议对于某些攻击如伪造秘密信息和篡改交换消息是脆弱的,并分析了该协议受到这些攻击的原因。本文指出由于该协议内在的缺陷,该协议可能难于改善。     

A Secure Ambulance Communication Protocol for VANET

Vehicular ad hoc networks (VANETs) have been a research focus in recent years. VANET’s main applications are enhancing road safety and reducing traffic accidents. Moreover, the VANET system can also reduce the time it takes for emergency vehicles to arrive at the accident location. The security of the transmission messages is of utmost importance, and to protect the transmission messages we propose a secure ambulance communication protocol for VANET to ensure that messages will not be revealed or stolen. The proposed scheme combines symmetric encryption, message authentication codes and digital signature mechanisms, and thereby achieves non-repudiation, availability, integrity, confidentiality, mutual authentication, session key security, known-key security and the ability to prevent known attacks. Finally, with NS2 simulation results that are based on realistic vehicle density statistics and the Taipei city road map, we argue that our secure ambulance communication protocol is effective in real VANET scenarios.     

Design of a lightweight and anonymous authenticated key agreement protocol for wireless body area networks

Wireless body area networks (WBANs) are a network designed to gather critical information about the physical conditions of patients and to exchange this information. WBANs are prone to attacks, more than other networks, because of their mobility and the public channel they use. Therefore, mutual authentication and privacy protection are critical for WBANs to prevent attackers from accessing confidential information of patients and executing undetectable physical attacks. In addition, in the authentication and key agreement process, messages should be transferred anonymously such that they are not linkable. In this paper, we first indicate that one of the most recently introduced authentication protocol is vulnerable to the wrong session key agreement attack and desynchronization attack. Second, we propose a lightweight authentication and key agreement protocol, which can withstand the well‐known attacks and provide the anonymity feature. Eventually, we analyze the security of our proposed protocol using both Automated Validation of Internet Security Protocols and Applications (AVISPA) and random oracle model and compare its performance with the related works. The results demonstrate the superiority of our proposed protocol in comparison with the other protocols.     

基于有限状态机的DNS隐蔽通信模型

DNS(domain name system)作为互联网基础设施的重要组成部分,其数据一般不会被防火墙等网络安全防御设备拦截。以DNS协议为载体的隐蔽信道具有较强的穿透性和隐蔽性,已然成为攻击者惯用的命令控制和数据回传手段。现有研究中缺乏对真实APT(advanced persistent threat)攻击中DNS隐蔽信道的检测技术或方法,且提取的特征不够全面。为深入分析攻击流量和行为特征,基于有限状态机对真实APT攻击中DNS隐蔽通信建模,剖析了APT攻击场景下DNS隐蔽信道的构建机理,详细阐述了其数据交互过程,通过总结和分析DNS隐蔽通信机制,基于有限状态机建立通信模型,提出通信过程中存在关闭、连接、命令查询、命令传输等7种状态,控制消息和数据消息等不同类型消息的传输将触发状态迁移。利用泄露的Glimpse工具模拟真实APT攻击下DNS隐蔽通信,结合Helminth等恶意样本实验验证了模型的适用性和合理性,为人工提取特征提供了充分的依据。     

ITPMAP: An Improved Three-Pass Mutual Authentication Protocol for Secure RFID Systems

Radio frequency identification (RFID) is a wireless technology used in various applications to minimize the complexity of everyday life. However, it opens a large number of security and privacy issues that require to be addressed before its successful deployment. Many RFID authentication protocols are proposed in recent years to address security and privacy issues, and most of them are based on lightweight cryptographic techniques such as pseudo-random number generators (PRNGs), or bitwise logical operations. However, the existing RFID authentication protocols suffer from security weaknesses, and cannot solve most of the security and privacy problems. A new solution is necessary to address security and privacy issues. In this paper, an improved three-pass mutual authentication protocol (ITPMAP) for low-cost RFID tags is proposed to offer an adequate security level for RFID systems. The proposed ITPMAP protocol uses one PRNG on the tag side and heavy-weighted cryptographic techniques (i.e., digital signature and password-based encryption schemes) on the back-end server side instead of lightweight cryptographic techniques to address the security and privacy issues. The ITPMAP protocol is secure against various attacks such as cloning, spoofing, replay, and desynchronization attacks. Furthermore, as a proof of concept, the ITPMAP protocol is adopted to propose the design of three real-life RFID systems; namely: Signing and Verification of Graduation Certificate System, issuing and verification of e-ticketing system, and charging and discharging of prepaid card system. The Unified Modeling Language is used to demonstrate the design of the proposed ITPMAP protocol and systems. Java language is used for the implementation of the proposed systems. In addition, the “Mifare Classic” tags and readers are used as RFID apparatuses for the proposed systems.     

A Gen2-Based RFID Authentication Protocol for Security and Privacy

EPCglobal Class-1 Generation-2 specification (Gen2 in brief) has been approved as ISO18000-6C for global use, but the identity of tag (TID) is transmitted in plaintext which makes the tag traceable and clonable. Several solutions have been proposed based on traditional encryption methods, such as symmetric or asymmetric ciphers, but they are not suitable for low-cost RFID tags. Recently, some lightweight authentication protocols conforming to Gen2 have been proposed. However, the message flow of these protocols is different from Gen2. Existing readers may fail to read new tags. In this paper, we propose a novel authentication protocol based on Gen2, called Gen2^{+}, for low-cost RFID tags. Our protocol follows every message flow in Gen2 to provide backward compatibility. Gen2^{+} is a multiple round protocol using shared pseudonyms and Cyclic Redundancy Check (CRC) to achieve reader-to-tag authentication. Conversely, Gen2^{+} uses the memory read command defined in Gen2 to achieve tag-to-reader authentication. We show that Gen2^{+} is more secure under tracing and cloning attacks.     

多用户环境下无证书认证可搜索加密方案

可搜索加密技术的提出使用户能够将数据加密后存储在云端,而且可以直接对密文数据进行检索。但现有的大部分可搜索加密方案都是单用户对单用户的模式,部分多用户环境下的可搜索加密方案是基于传统公钥密码或基于身份公钥密码系统,因此这类方案存在证书管理和密钥托管问题,且容易遭受内部关键词猜测攻击。该文结合公钥认证加密和代理重加密技术,提出一个高效的多用户环境下无证书认证可搜索加密方案。方案使用代理重加密技术对部分密文进行重加密处理,使得授权用户可以利用关键字生成陷门查询对应密文。在随机预言模型下,证明方案具有抵抗无证书公钥密码环境下两类攻击者的内部关键词猜测攻击的能力,且该方案的计算和通信效率优于同类方案。