Skip to main content

Advertisement

Log in

A Secure and Privacy Friendly ECC Based RFID Authentication Protocol for Practical Applications

  • Published:
Wireless Personal Communications Aims and scope Submit manuscript

Abstract

Radio frequency identification (RFID) is a promising and widespread wireless communication technology for entity identification or authentication. By the emerging Internet of Things phenomenon, the use of RFID is densely augmenting in various daily life applications. However, RFID systems suffer from security and privacy issues. Recently, many researchers propose RFID authentication protocols based on elliptic curve cryptography (ECC) to efficiently mitigate the aforementioned concerns. In this work, we extensively examine the state-of-the-art RFID authentication protocols based on ECC in terms of security and performance. Some of these works claim that their protocols provide all general security and privacy properties. We revisit Vaudenay’s formal privacy model and show that they do not provide forward and/or backward privacy under this model contrary to their claim. Then, we propose a secure, privacy-preserving and efficient ECC based RFID authentication protocol. We also present a security and performance analysis of our proposed protocol and compare it to the existing relevant schemes in detail. Furthermore, we implement our proposal in a real RFID system to demonstrate its practicability. To the best of our knowledge, our proposed scheme is the most efficient ECC based RFID authentication protocol realized in a real-world environment that satisfies all common security and privacy features including backward and forward privacy.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7

Similar content being viewed by others

Availability of Data and Material

Not applicable.

References

  1. Bello, O., Zeadally, S., & Badra, M.. (2017). Network layer inter-operation of device-to-device communication technologies in internet of things (IoT). Ad Hoc Networks, 57, 52–62. Special Issue on Internet of Things and Smart Cities security, privacy and new technologies.

  2. Eteng, A. A., Rahim, S. K. A., & Leow, C. Y. (2018). RFID in the internet of things (pp. 135–152). London: Wiley (chapter 5).

    Google Scholar 

  3. Priyanka, D. D., Jayaprabha, T., Florance, D. D., Jayanthi, A., & Ajitha, E. (2016). A survey on applications of RFID technology. Indian Journal of Science and Technology, 9(2), 1–5.

    Google Scholar 

  4. Finkenzeller, K. (2003). RFID handbook: Fundamentals and applications in contactless smart cards and identification (2nd ed.). New York: Wiley Publishing.

    Book  Google Scholar 

  5. Zhang, D., Huang, H., & Jo, M. (2015). Future RFID technology and applications: Visions and challenges. Telecommunication Systems, 58(3), 193–194.

    Article  Google Scholar 

  6. Kardas, S., Celik, S., Bingöl, M. A., & Levi, A. (2013). A new security and privacy framework for RFID in cloud computing. In IEEE 5th international conference on cloud computing technology and science, CloudCom 2013, Bristol, United Kingdom, December 2–5, 2013, Volume 1 (pp. 171–176).

  7. Bingöl, M. A., Birinci, F., Kardaş, S., & Kiraz, M. S. (2012). Anonymous RFID authentication for cloud services. International Journal of Information Security Science, 1(2), 32–42.

    Google Scholar 

  8. Roberti, M. (2017). When RFID becomes obsolete. RFID Journal Blog. Accessed on 17 March, 2018.

  9. Avoine, G., Bingöl, M. A., Carpent, X., & Kardaş, S. (2013). Deploying OSK on low-resource mobile devices (pp. 3–18). Berlin, Heidelberg: Springer.

    Google Scholar 

  10. Avoine, G. (2018). RFID lounge. http://www.avoine.net/rfid/. Accessed on 26 February 2018.

  11. Arslan, A., Kardaş, S., Çolak, S. A., & Ertürk, S. (2018). Are RNGs Achilles’ heel of RFID security and privacy protocols? Wireless Personal Communications, 100(4), 1355–1375.

    Article  Google Scholar 

  12. Avoine, G., Bingöl, M. A., Carpent, X., & Yalcin, S. B. O. (2013). Privacy-friendly authentication in RFID systems: On sublinear protocols based on symmetric-key cryptography. IEEE Transactions on Mobile Computing, 12(10), 2037–2049.

    Article  Google Scholar 

  13. He, D., & Zeadally, S. (2015). An analysis of RFID authentication schemes for internet of things in healthcare environment using elliptic curve cryptography. IEEE Internet of Things Journal, 2(1), 72–83.

    Article  Google Scholar 

  14. Ibrahim, A., & Dalkılıç, G. (2019). Review of different classes of RFID authentication protocols. Wireless Networks, 25(3), 961–974.

    Article  Google Scholar 

  15. Avoine, G., Bingöl, M. A., Kardaş, S., Lauradoux, C., & Martin, B. (2011). A framework for analyzing rfid distance bounding protocols. Journal of Computer Security, 19(2), 289–317.

    Article  Google Scholar 

  16. Kardaş, S., Çelik, S., Arslan, A., & Levi, A. (2013). An efficient and private RFID. In G. Avoine & O. Kara (Eds.), Lightweight cryptography for security and privacy (pp. 130–141). Berlin, Heidelberg: Springer.

    Chapter  MATH  Google Scholar 

  17. Vaudenay, S. (2007). On privacy models for RFID. In Kurosawa, K. (Ed.), Advances in cryptology ASIACRYPT 2007, volume 4833 of Lecture notes in computer science (pp. 68–87). Berlin, Heidelberg: Springer.

  18. Kardaş, S., Çelik, S., Bingöl, M. A., Kiraz, M. S., Demirci, H., & Levic., A. (2014). \(k\)-Strong privacy for radio frequency identification authentication protocols based on physically unclonable functions. Wireless Communications and Mobile Computing, 15(18), 2150–2166.

  19. Avoine, G., Coisel, I., & Martin, T. (2010). Time measurement threatens privacy-friendly RFID authentication protocols. In SB Ors Yalcin (Eds.), Workshop on RFID security—RFIDSec’10, volume 6370 of lecture notes in computer science (pp. 138–157). Istanbul: Springer.

  20. Hermans, J., Peeters, R., & Preneel, B. (2014). Proper RFID privacy: Model and protocols. IEEE Transactions on Mobile Computing, 13(12), 2888–2902.

    Article  Google Scholar 

  21. Hein, D., Wolkerstorfer, J., & Felber, N. (2009). ECC is ready for RFID–A proof in silicon. In M. A. Roberto, K. Liam, & F. Sica (Eds.), Selected areas in cryptography (pp. 401–413). Berlin, Heidelberg: Springer.

    Chapter  Google Scholar 

  22. Hutter, M., Feldhofer, M., & Plos, Thomas. (2010). An ECDSA processor for RFID authentication. In S. Berna & O. Yalcin (Eds.), Radio frequency identification: Security and privacy issues (pp. 189–202). Berlin, Heidelberg: Springer.

    Chapter  Google Scholar 

  23. Lee, Y. K., Sakiyama, K., Batina, L., & Verbauwhede, I. (2008). Elliptic-curve-based security processor for RFID. IEEE Transactions on Computers, 57(11), 1514–1527.

    Article  MathSciNet  MATH  Google Scholar 

  24. Batina, L., Guajardo, J., Kerins, T., Mentens, N., Tuyls, P., & Verbauwhede, I. (2007). Public-key cryptography for RFID-tags. In International workshop on pervasive computing and communication security—PerSec 2007 (pp. 217–222). New York City: IEEE, IEEE Computer Society.

  25. Bringer, J., Chabanne, H., & Icart, T. (2008). Cryptanalysis of EC-RAC, a RFID identification protocol. In Franklin, M. K, Chi, L., Hui, K., & Wong, D. S. (Eds.), 7th International conference on cryptology and network security—CANS’08, volume 5339 of lecture notes in computer science (pp. 149–161). Hong Kong: Springer.

  26. Altop, D. K., Bingöl, M. A., Levi, A., & Savaş, E. (2017). DKEM: Secure and efficient distributed key establishment protocol for wireless mesh networks. Ad Hoc Networks, 54(C), 53–68.

    Article  Google Scholar 

  27. Benssalah, M., Djeddou, M., & Drouiche, K. (2017). A provably secure RFID authentication protocol based on elliptic curve signature with message recovery suitable for m-health environments. Transactions on Emerging Telecommunications Technologies, 28(11), e3166.

    Article  Google Scholar 

  28. Ibrahim, A., & Dalkılıç, G. (2017). An advanced encryption standard powered mutual authentication protocol based on elliptic curve cryptography for RFID, proven on WISP. Journal of Sensors, 2017, 2367312.

    Article  Google Scholar 

  29. A White Paper from CoreRFID. (2017). The internet of things: Practical thoughts for bussiness. http://www.corerfid.com/wp-content/uploads/2017/12/The-IoT-White-Paper.pdf. Accessed on 19 November 2018.

  30. Gueulle, P. (2012). BasicCard goes contactless a discreet alternative. http://www.basiccard.com/elektor_zc75rfid.pdf. Accessed on 19 November, 2018.

  31. Wolkerstorfer, J. (2005). Is elliptic-curve cryptography suitable to secure RFID tags. In E-CRYPT workshop RFID and lightweight crypto (pp. 78191). Graz, Austria.

  32. Tuyls, P., & Batina, L. (2006). RFID-tags for anti-counterfeiting. In Pointcheval, D., (Eds.), Topics in cryptology—CT-RSA 2006 (pp. 115–131). Berlin, Heidelberg: Springer.

  33. Schnorr, C. P. (1990). Efficient identification and signatures for smart cards. In Brassard, G., (Ed.), Advances in cryptology—CRYPTO’ 89 proceedings (pp. 239–252). New York, NY: Springer.

  34. Lee, Y. K., Batina, L., & Verbauwhede, I. (2008). EC-RAC (ECDLP based randomized access control): Provably secure RFID authentication protocol. In 2008 IEEE international conference on RFID (pp. 97–104).

  35. Okamoto, T. (1993). Provably secure and practical identification schemes and corresponding signature schemes. In Brickell, E. F. (Ed.), Advances in cryptology—CRYPTO’ 92 (pp. 31–53). Berlin, Heidelberg: Springer.

  36. Chou, J.-S. (2014). An efficient mutual authentication RFID scheme based on elliptic curve cryptography. The Journal of Supercomputing, 70(1), 75–94.

    Article  Google Scholar 

  37. van Deursen, T., & Radomirović, S. (2009). Algebraic attacks on RFID protocols. In Markowitch, O., Bilas, A., Hoepman, J.-H., Mitchell, C. J., & Quisquater, J.-.J. (Eds.), Workshop on information security theory and practice—WISTP’09, volume 5746 of lecture notes in computer science (pp. 38–51), Brussels, Belgium: Springer.

  38. van Deursen, T., & Radomirović, S. (2010). EC-RAC: Enriching a capacious RFID attack collection. In Ors Yalcin, S. B. (Eds.), Workshop on RFID security—RFIDSec’10, volume 6370 of lecture notes in computer science (pp. 75–90). Istanbul: Springer.

  39. Lee, Y. K., Batina, L., Singelee, D., Preneel, B., & Verbauwhede, I. (2010). Anti-counterfeiting, untraceability and other security challenges for RFID Systems: Public-key-based protocols and hardware (pp. 237–257). Berlin, Heidelberg: Springer.

    Google Scholar 

  40. Lv, C., Li, H., Ma, J., & Zhang, Y. (2012). Vulnerability analysis of elliptic curve cryptography-based RFID authentication protocols. Transactions on Emerging Telecommunications Technologies, 23(7), 618–624.

    Article  Google Scholar 

  41. Lee, Y. K., Batina, L., & Verbauwhede, I. (2009). Untraceable RFID authentication protocols: Revision of EC-RAC. In 2009 IEEE international conference on RFID (pp. 178–185).

  42. Zhang, X., Li, L., Wu, Y., & Zhang, Q. (2011). An ECDLP-based randomized key RFID authentication protocol. In 2011 International conference on network computing and information security, (Vol. 2, pp. 146–149).

  43. Chien, H.-Y. (2017). Elliptic curve cryptography-based RFID authentication resisting active tracking. Wireless Personal Communications, 94(4), 2925–2936.

    Article  Google Scholar 

  44. An, R., Feng, H., Liu, Q., & Li, L. (2017). Three elliptic curve cryptography-based RFID authentication protocols for internet of things. In L. Barolli, F. Xhafa, & K. Yim (Eds.), Advances on broad-band wireless computing, communication and applications (pp. 857–878). Cham: Springer.

    Chapter  Google Scholar 

  45. Liao, Y.-P., & Hsiao, C.-M. (2014). A secure ECC-based RFID authentication scheme integrated with ID-verifier transfer protocol. Ad Hoc Networks, 18, 133–146.

    Article  Google Scholar 

  46. Moosavi, S. R., Nigussie, E., Virtanen, S., & Isoaho, J. (2014). An elliptic curve-based mutual authentication scheme for RFID implant systems. Procedia Computer Science, 32, 198–206. The 5th international conference on ambient systems, networks and technologies (ANT-2014), the 4th international conference on sustainable energy information technology (SEIT-2014).

  47. He, D., Kumar, N., Chilamkurti, N., & Lee, J.-H. (2014). Lightweight ECC based RFID authentication integrated with an ID verifier transfer protocol. Journal of Medical Systems, 38(10), 116.

    Article  Google Scholar 

  48. Farash, M. S., Nawaz, O., Mahmood, K., Chaudhry, S. A., & Khan, M. K. (2016). A provably secure RFID authentication protocol based on elliptic curve for healthcare environments. Journal of Medical Systems, 40(7), 165.

    Article  Google Scholar 

  49. Zhao, Z. (2014). A secure RFID authentication protocol for healthcare environments using elliptic curve cryptosystem. Journal of Medical Systems, 38(5), 46.

    Article  Google Scholar 

  50. Peeters, R., & Hermans, J. (2013). Attack on Liao and Hsiao’s secure ECC-based RFID authentication scheme integrated with ID-verifier transfer protocol. Cryptology. Report 2013/399. https://eprint.iacr.org/2013/399.

  51. Alexander, P., Baashirah, R., & Abuzneid, A. (2018). Comparison and feasibility of various RFID authentication methods using ECC. Sensors, 18(9), 2902.

    Article  Google Scholar 

  52. Farash, M. S. (2014). Cryptanalysis and improvement of an efficient mutual authentication RFID scheme based on elliptic curve cryptography. The Journal of Supercomputing, 70(2), 987–1001.

    Article  MathSciNet  Google Scholar 

  53. Zhang, Z., & Qi, Q. (2014). An efficient RFID authentication protocol to enhance patient medication safety using elliptic curve cryptography. Journal of Medical Systems, 38(5), 47.

    Article  Google Scholar 

  54. Jin, C., Chunxiang, X., Zhang, X., & Zhao, J. (2015). A secure RFID mutual authentication protocol for healthcare environments using elliptic curve cryptography. Journal of Medical Systems, 39(3), 24.

    Article  Google Scholar 

  55. Jin, C., Chunxiang, X., Zhang, X., & Li, F. (2016). A secure ECC-based RFID mutual authentication protocol to enhance patient medication safety. Journal of Medical Systems, 40(1), 1–6.

    Article  Google Scholar 

  56. Dinarvand, N., & Barati, H. (2019). An efficient and secure RFID authentication protocol using elliptic curve cryptography. Wireless Networks, 25(1), 415–428.

    Article  Google Scholar 

  57. Liu, G., Zhang, H., Kong, F., & Zhang, L. (2018). A novel authentication management RFID protocol based on elliptic curve cryptography. Wireless Personal Communications, 101(3), 1445–1455.

    Article  Google Scholar 

  58. Alamr, A. A., Kausar, F., Kim, J., & Seo, C. (2018). A secure ECC-based RFID mutual authentication protocol for internet of things. The Journal of Supercomputing, 74(9), 4281–4294.

    Article  Google Scholar 

  59. Kumar, D., Grover, H. S., & Adarsh. (2019). A secure authentication protocol for wearable devices environment using ECC. Journal of Information Security and Applications, 47(8), 15.

    Google Scholar 

  60. Naeem, M., Chaudhry, S. A., Mahmood, K., Karuppiah, M., & Kumari, S. (2020). A scalable and secure RFID mutual authentication protocol using ECC for internet of things. International Journal of Communication Systems, 33(13), e3906.

    Article  Google Scholar 

  61. Kumar, V., Ahmad, M., Mishra, D., Kumari, S., & Khan, M. K. (2020). RSEAP: RFID based secure and efficient authentication protocol for vehicular cloud computing. Vehicular Communications, 22, 100213.

    Article  Google Scholar 

  62. Safkhani, M., Camara, C., Peris-Lopez, P., & Bagheri, N. (2021). RSEAP2: An enhanced version of RSEAP, an RFID based authentication protocol for vehicular cloud computing. Vehicular Communications, 28, 100311.

    Article  Google Scholar 

  63. Izza, S., Benssalah, M., & Drouiche, K. (2021). An enhanced scalable and secure RFID authentication protocol for WBAN within an IoT environment. Journal of Information Security and Applications, 58, 102705.

    Article  Google Scholar 

  64. Agrahari, A. K., & Varma, S. (2021). A provably secure RFID authentication protocol based on ECQV for the medical internet of things. Peer-to-Peer Networking and Applications, 14, 1277–1289. https://doi.org/10.1007/s12083-020-01069-z.

    Article  Google Scholar 

  65. Kumari, A., Jangirala, S., Abbasi, M. Y., Kumar, V., & Alam, M. (2020). ESEAP: ECC based secure and efficient mutual authentication protocol using smart card. Journal of Information Security and Applications, 51, 102443.

    Article  Google Scholar 

  66. Kamil, I. A., & Ogundoyin, S. O. (2021). A lightweight mutual authentication and key agreement protocol for remote surgery application in tactile internet environment. Computer Communications, 170, 1–18.

    Article  Google Scholar 

  67. Braeken, A. (2021). Public key versus ssymmetric key cryptography in client—Server authentication protocols. International Journal of Information Security. https://doi.org/10.1007/s10207-021-00543-w.

    Article  Google Scholar 

  68. Vijayakumar, P., Obaidat, M. S., Azees, M., Islam, S. H., & Kumar, N. (2020). Efficient and secure anonymous authentication with location privacy for IoT-based WBANs. IEEE Transactions on Industrial Informatics, 16(4), 2603–2611.

    Article  Google Scholar 

  69. Koblitz, N. (1987). Elliptic curve cryptosystems. Mathematics of Computation, 48(177), 203–209.

    Article  MathSciNet  MATH  Google Scholar 

  70. Miller, V. S. (1986). Use of elliptic curves in cryptography. In Williams, H. C. (Eds.), Advances in cryptology—CRYPTO ’85 proceedings (pp. 417–426). Berlin, Heidelberg: Springer.

  71. Lauter, K. (2004). The advantages of elliptic curve cryptography for wireless security. IEEE Wireless Communications, 11, 62–67.

    Article  Google Scholar 

  72. Merkle, J., & Lochter, M. (2010). Elliptic curve cryptography (ECC) brainpool standard curves and curve generation. RFC 5639. https://rfc-editor.org/rfc/rfc5639.txt.

  73. Recommendation for Key Management, Special Publication 800-57 Part 1 Rev. 4. NIST, 01/2016.

  74. Harkanson, R., & Kim, Y. (2017). Applications of elliptic curve cryptography: A light introduction to elliptic curves and a survey of their applications. In Proceedings of the 12th annual conference on cyber and information security research, CISRC ’17 (pp. 6:1–6:7). New York: ACM.

  75. Ravikumar, K., & Udhayakumar, A. (2014). Secure multiparty electronic payments using ECC algorithm: A comparative study. In 2014 World congress on computing and communication technologies (pp. 132–136).

  76. Bingöl, M. A., Biçer, O., Kiraz, M. S., & Levi, A. (2018). An efficient 2-party private function evaluation protocol based on half gates. The Computer Journal (bxy136). https://doi.org/10.1093/comjnl/bxy136.

  77. Bicer, O., Bingöl, M. A., Kiraz, M. S., & Levi, A. (2020). Highly efficient and re-executable private function evaluation with linear complexity. IEEE Transactions on Dependable and Secure Computing. https://doi.org/10.1109/TDSC.2020.3009496.

    Article  Google Scholar 

  78. Bingöl, M. Ali. (2019). Efficient and secure schemes for private function evaluation. Ph.d thesis, Sabanci University, Istanbul. http://research.sabanciuniv.edu/36861/.

  79. Schoenmakers, B. (2018). Lecture notes cryptographic protocols version 1.32. http://www.win.tue.nl/~berry/2DMI00/LectureNotes.pdf. Accessed on 14 November, 2018.

  80. Song, B., & Mitchell, C. J. (2008). RFID authentication protocol for low-cost tags. In Proceedings of the first ACM conference on wireless network security, WiSec ’08 (pp. 140–147). New York, NY: ACM.

  81. Lim, C. H., & Kwon, T.. (2006). Strong and robust RFID authentication enabling perfect ownership transfer. In Ning, P., Qing, S., Li, N., (Eds.), Information and communications security (pp. 1–20). Berlin, Heidelberg: Springer.

  82. Phan, R.C.-W., Wu, J., Ouafi, K., & Stinson, D. R. (2011). Privacy analysis of forward and backward untraceable RFID authentication schemes. Wireless Personal Communications, 61(1), 69–81.

    Article  Google Scholar 

  83. Stevens, M., Bursztein, E., Karpman, P., Albertini, A., & Markov, Y. (2017). The first collision for full SHA-1. In Katz, J., Shacham, H., (Eds.), Advances in cryptology—CRYPTO 2017 (pp. 570–596). Cham: Springer.

  84. Wang, X., Yin, Y. L., & Yu, H. (2005). Finding collisions in the full SHA-1. In Victor S, (Eds.), Advances in cryptology—CRYPTO 2005 (pp. 17–36). Berlin, Heidelberg: Springer.

  85. Koblitz, N., Menezes, A., & Vanstone, S. (2000). The state of elliptic curve cryptography. Designs Codes and Cryptography, 19(2–3), 173–193.

    Article  MathSciNet  MATH  Google Scholar 

  86. Shuhua, W., & Chen, K. (2012). An efficient key-management scheme for hierarchical access control in E-medicine system. Journal of Medical Systems, 36(4), 2325–2337.

    Article  Google Scholar 

  87. Gódor, G., Giczi, N., & Imre, S. (2010). Elliptic curve cryptography based mutual authentication protocol for low computational capacity RFID systems—Performance analysis by simulations. In 2010 IEEE international conference on wireless communications, networking and information security (pp. 650–657).

  88. Gódor, G., & Imre, G. (2011). Elliptic curve cryptography based authentication protocol for low-cost RFID tags. In 2011 IEEE international conference on RFID-technologies and applications (pp. 386–393).

  89. ZeitControl cardsystems GmbH. (2018). BasicCard Developer Manual V8.15. http://www.basiccard.com/index.html. Accessed on 15 November.

Download references

Funding

No funds received for this research.

Author information

Authors and Affiliations

Authors

Contributions

Conceptualization: AA, Methodology: AA, Formal analysis and investigation: AA, Writing—original draft preparation: AA, Review and editing: SE and SAÇ, Supervision: SE, Validation: SE and SAÇ.

Corresponding author

Correspondence to Atakan Arslan.

Ethics declarations

Confict of interest

The authors declare that they have no confict of interest.

Code Availability

Not applicable.

Ethics Approval

This article does not contain any studies with animals performed by any of the authors.

Consent to Participate

Not applicable.

Consent for Publication

Not applicable.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Arslan, A., Çolak, S.A. & Ertürk, S. A Secure and Privacy Friendly ECC Based RFID Authentication Protocol for Practical Applications. Wireless Pers Commun 120, 2653–2691 (2021). https://doi.org/10.1007/s11277-021-08552-7

Download citation

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11277-021-08552-7

Keywords