A novel mutual authentication scheme based on quadratic residues for RFID systems

Abstract

In 2004, Ari Juels proposed a Yoking-Proofs protocol for RFID systems. Their aim is to permit a pair of tags to generate a proof which is verifiable off-line by a trusted entity even when the readers are potentially untrusted. However, we found that their protocol does not possess the anonymity property but also suffers from both known-plaintext attack and replay attack. Wong et al. [Kirk H.M. Wong, Patrick C.L. Hui, Allan C.K. Chan, Cryptography and authentication on RFID passive tags for apparel products, Computer in Industry 57 (2005) 342–349] proposed an authentication scheme for RFID passive tags, attempting to be a standard for apparel products. Yet, to our review, their protocol suffers from guessing parameter attack and replay attack. Moreover, both of the schemes have the common weakness: the backend server must use brute search for each tag’s authentication. In this paper, we first describe the weaknesses in the two above-mentioned protocols. Then, we propose a novel efficient scheme which not only achieve the mutual authentication between the server and the tag but also can satisfy all the security requirements needed in an RFID system.

Introduction

An RFID (radio frequency identification device) system has become one of the most important applications today. It consists of radio frequency (RF) tags, tag readers and a backend server. In the system, when the server wants to identify a tag, the reader will broadcast an RF signal. The tag in the range of the signal will then be triggered and respond with its resident data. After receiving the responded data, the reader, usually cooperating with the backend server, identifies whether the tag is legal or not. For an earlier application, an RF tag is used for replacing the barcode, the universal product code (UPC) printed on merchandise, with an advantage that 100–200 tags can be read per second in a range of several meters [6]. Moreover, an RF tag as a “smart label” has its own memory and computing unit. These equipments can further support access control or cryptographic functions and thus can make an RF tag applicable in various significant areas such as, supply chain management, inventory control, counterfeiting prevention, etc. However, this promising technology may suffer from some security threats. For example, 1. Secrecy: a fake reader may defraud an honest tag of its resident secrecy, 2. Location privacy: a malicious person may expose a person’s location through tracing a particular tag embedded in a product. 3. Forward secrecy: due to the impracticality of equipping a low-cost tag with tamper-proof device, an attacker may compromise a tag’s resident data and then expose the bearer’s previous locations by tracing the past transactions the tag had been involved in, 4. Replay attack and DOS attack: a poor designed tag identification protocol may suffer from replay attack or deny-of-service (DOS) attack.

To prevent the above-mentioned security threats, many researchers have proposed solutions. Weis et al. [4], [5] proposed “hash locking” and “randomized hash-locking” schemes by using hash function and pseudo-random number generation (PRNG) function. In their scheme, when a tag is locked, it does not respond to any reader’s triggering. Only a legitimate reader possessing the right key can unlock the tag to obtain its resident data. However, in their scheme, after a reader unlocking a tag, the tag ID (TID) is transmitted between the tag and the reader in clear. This makes personal information or individual location of the bearer traceable. It violates the anonymity property of TID. In the same year, Ohkubo et al. [11] proposed a “privacy-friendly” tag scheme by using hash-chain. In the scheme, the tag sends a_i = G(s_i) to the reader/server for being authenticated and renews s_i+1 = H(s_i) in the ith authentication. After receiving a_i, the server which maintains a list of (TID, s₁) checks if a_i is equal to G(Hⁱ(s₁)) to identify the tag valid or not. Although their scheme has the anonymity property of TID, it obviously suffers from the replay attack. When an attacker replays any old message a_j = G(s_j) where j ⩽ i, the server will undoubtedly identify the tag as valid. Henrici et al. [8] proposed another “hash lock”-like scheme. They claimed that their scheme possesses the properties of TID anonymity, location privacy, and can resist replay and DOS attacks. However, in 2005, Yang et al. [13], [14] pointed out that their scheme suffers from man-in-the-middle attack because an attacker may do some malicious actions between a tag and a reader to obtain information and be authenticated by the reader before the next transaction. Moreover, we found that Henrici et al.’s scheme does not provide forward secrecy. Because when a tag is compromised, the attacker can use the current tag ID (changed to ID ⊕ RND after each authentication, where RND is a random number generated by the backend server) and the last authentication flows (which contains the information of h(ID), RND, etc.) to trace the tag’s previous transaction by computing the tag’s previous ID. Hence, Yang et al. proposed a new mutual authentication protocol for low-cost RFID also based on hash function [13], [14]. They claimed that their scheme can guarantee TID anonymity and location privacy of the tag bearers, and can prevent active attacks such as, man-in-the-middle attack, replay attack, forgery and so on. However, [21] pointed out that their scheme lacks the forward secrecy. Moreover, another weakness of this study is that the backend server always uses brute search for finding TID in each authentication. This needs O(n²) time complexity for n tags’ authentication. It is very time consuming and limits the number of tags to be authenticated by the reader/server each time.

In 2004, Molnar et al. [10] proposed a pseudo-random-function(PRF)-based scheme for library RFID. They claimed that their scheme can protect a patron’s privacy and can be extended to a tree-based protocol needing only O(log n) rounds for n tags’ simultaneous identification. However, Rhee etal. [12] pointed out that Molnar et al.’s scheme does not achieve forward secrecy. Hence, Rhee et al. proposed an improvement based on Molnar et al.’s scheme. Unfortunately, Rhee et al.’s is still unable to provide forward secrecy mentioned in [2]. In addition, we found that the common drawback of server’s brute search exists in Molnar et al.’s scheme. This is time-consuming and thus compromises the advantage of round efficiency they emphasized.

Beside the above hash-based and PRF-based (cryptography-based) approaches for RFID systems, some lightweight schemes (non-cryptography-based) [7], [9], [2] have been proposed. Both Duc et al.’s [7] and Chien et al.’s schemes [2] adopt CRC function (instead of costly hash function) and PRNG function. Karikeyan et al’s scheme [9] is based on matrix operations. However, Chien et al. [2] pointed out that Duc et al.’s scheme [7] does not provide forward secrecy and suffers from DOS attack, and Karikeyan et al.’s scheme [9] does not provide TID anonymity and suffers from DOS attack as well. Hence, Chien et al. [2] proposed a scheme intended to satisfy all of the security and privacy requirements of an RFID system. However, we found the common drawback still exist in their scheme, the backend server searching TID in a brute way. This significantly impacts on the scalability of the RFID system’s deployment. Moreover, such lightweight schemes are intuitively less secure than the cryptography-based ones.

This paper is organized as follows. In Section 2, we review Juels’ and Wong et al.’s schemes and discuss their weaknesses. In Section 3, we present our protocol. The security analysis and performance evaluation of our scheme is discussed in Section 4. Finally, a conclusion is given in Section 5.