Chinese Journal of Electronics Vol.25, No.5, Sept. 2016

Untraceability Analysis of Two RFID Authentication Protocols∗ CHEN Xiuqing1,2 , CAO Tianjie1 and ZHAI Jingxuan1 (1. School of Computer Science and Technology, China University of Mining and Technology, Xuzhou 221116, China) (2. School of Medicine Information, Xuzhou Medical University, Xuzhou 221000, China) Abstract — With the development of Radio frequency identification (RFID) technologies, theoretical study on the protocol’s design promotes the increasing reality applications of this product. The protocol designers attach significance to untraceability analysis on key-update RFID authentication protocols. This paper analyzes two RFID authentication protocols in terms of forward untraceability and backward untraceability, which are two necessary conditions for key-update RFID protocols and ownership transfer protocols. This paper introduces impersonation attacks as well as desynchronization attacks to two protocols. This paper presents two enhanced protocols, which can achieve forward untraceability and backward untraceability privacy. This paper shows the outstanding efficiency and security properties of two improved schemes through detailed analysis and comparisons. Key words — Radio frequency identification (RFID), Forward untraceability, Backward untraceability, Impersonation attacks, Desynchronization attacks.

I. Introduction In order to achieve automatic information processing in the modern society, the definition of Internet of Things (IoT) is that networked devices can efficiently communicate with each other, which is one of key technologies to construct IoT systems. The design of a secured RFID authentication protocol is quite crucial in various application fields, such as supply chain managements[1], mass transportation and book management systems, etc. However, the security and privacy of the protocols is also a critical issue in various application conditions and environments. In the view of the protocol’s designer, security proof based on a cryptographic security model can meet security and privacy requirements and is the best way to resist various attacks. On the one hand, almost all the other available schemes provide security and privacy only with heuristic

analysis[2−5]. On the other hand, existing canonical RFID authentication protocols[6−8] present security and privacy proof process based on the security models[9] . They briefly describe security and privacy requirements for RFID authentication and only provide intuition of the security proof. However, the key-update (state) RFID protocols[10] are liable to forward traceability attacks[11,12]. In addition, Chien et al.[13] proved that RFID protocol could not resist full-disclosure attacks by adding more random numbers to encrypt transmitted information. Safkhani et al.[4] have stated that Anti-counting security protocols (ACSP)[3] are vulnerable to these attacks, such as tag impersonation attacks, DoS attacks and traceability attacks. Afterwards, they presented the improved protocols ACSP+ which was resistant against counting attack and the other known privacy issues. Alagheband and Aref et al.[6] pointed out weaknesses of Networked RFID systems (NRS) protocol[2] in backward and forward traceability analysis. Then, they presented the improved protocol named NRS+ protocol which solved privacy issues in the simulation-based privacy model. However, this paper holds that the key-update protocol can achieve forward and backward untraceability by adding two different entities’ nonce to key-update mechanisms. Therefore, it is necessary to design a provably untraceable RFID authentication protocol in a security and privacy model. This paper analyzes two RFID protocols[4,6] and illustrates several concrete attacks to their protocols. In order to overcome weaknesses of problematical protocols, this paper improves RFID protocols based on the existing construction and describes a concrete security proof in a new security model. In addition, this paper demonstrates that the proposed protocols meet additional security require-

∗ Manuscript Received July 7, 2014; Accepted Oct. 10, 2014. This work is supported by the Fundamental Research Funds for the Central Universities (No.2015XKMS086). c 2016 Chinese Institute of Electronics. DOI:10.1049/cje.2016.08.013 

Untraceability Analysis of Two RFID Authentication Protocols

ments, such as forward and backward untraceability, etc. Moreover, the presented protocols are resistant to general attacks besides traceability attacks.

II. Security Model for RFID Protocols This paper adopts Vaudenay’s privacy model and practically defines RFID construction, including forward and backward untraceability[6] . These definitions are used to prove security properties of the key-update (state) RFID protocol via different oracles. The revised Vaudenay’s model has a strong realistic application background, because messages between the tag (Ti ) and the reader (Ri ) are monitored by a narrowstrong attacker (A+ ) or a weak attacker (A− ). Therefore, the following eight queries and adversary classes are listed in Table 1 and Table 2 respectively. An adversary is a polynomial time algorithm and is divided into 2 × 4 categories ((Wide, Narrow) ∪ (Weak, Forward, Destructive, Strong)) according to Result or Corrupt oracles: The relation between the first two types and the other four types is orthogonal in Table 2. The privacy game contains learning and attack phases under the narrow-strong attacker. As long as the game’s outcome is true with negligible probability, RFID protocols will achieve untraceable privacy and the narrow-strong adversary’s attacks will be trivial. Table 1. Functional explanations of adversary oracles Adversary oracles Functional explanations CreateTagx (TID) Generates free tag with sole TID with SetupTag(TID i ) (1 ≤ i ≤ n). When x = 1 (x = 0), Ti is legitimate (illegality). DrawTag() Sends Ti from free tags to drawn tags as vtag. It outputs the bit x to indicate whether drawn tag is legitimate or not. Free(vtag) Returns vtag to the set of free tags. Launch() → π R to start a new run of protocol π. SendReaderThe tag transmits the message mR and reTag(mR , π) → mR sponds with mR . SendTag(m, vtag) The tag transmits the message m and re→ m sponds with m . Result(π) Returns 1 when protocol instance π is successfully completed or 0 otherwise. Corrupt(vtag) → The attacker returns the tag’s key vtag. TID Table 2. The classes of adversary’s ability Type Functional specification Narrow Does not use Result oracle. Wide Uses Result oracle. Strong Uses eight oracles. Destructive Destroys corrupted tag. Forward Uses Corrupt only once as the last oracle. Weak Does not use Corrupt oracle.

Definition 1 (Privacy) A narrow-strong adversary A+ is able to call all oracles.

913 +

A succeeds)| Then, if |P r(ExpA S succeeds) − P r(ExpS + + is negligible, A is called trivial A depending on the related adversary class. The different untraceability definitions depend on success probability of narrow-strong adversary A+ . Definition 2 (Forward untraceability)[6] It should be impossible for the narrow-strong adversary A+ to trace the tag at the round i that i ≥ i + 2, even though A+ corrupts the ith round keys of the target tag. At last, the orward (k) succeeds as long as the advanexperiment ExpF S,A+ + tage of A is negligible. Definition 3 (Backward untraceability)[6] Even if the narrow-strong adversary A+ corrupts the ith round keys of the target tag, s/he can not trace target tag’s transactions that occur at the past round i (i < i − 1). (k) succeeds as long Finally, the experiment ExpBackward S,A+ as A+ returns true.

III. Cryptanalysis of NRS+ Protocol and the Presented NRS++ Protocol 1. Weaknesses of NRS+ protocol The descriptions of NRS+ protocol are in Fig.1. However, this paper demonstrates that NRS+ protocol suffers from replay attacks, desynchronization attacks and DoS attacks. The notions of all the protocols are shown in Table 3. Table 3. The notions of all protocols Symbols Notions ⊕/|| Exclusive-or/Concatenation operation. H(K1 , K2 ) One way hash function with two keys. ID/EPC The tag identifier/tag trademark. K1 /K2 The shared keys of tag and DB. Ci The number of runs for the attacker. iM The message M in the ith session. k Security parameter (i.e. the bit length of the keys shared between the tag and the reader). SIDcur /SIDnew Current/New session identifier. TIDcur /TIDnew Current/New unique identifier. SELECT /QUERY

Select/Query command.

IDENT /AUTHENE Identification/Authentication message. UPDSID/UPDACK SID update/Update acknowledge message.

The lack of tag’s nonce in its authentication messages can lead to serious security weaknesses, such as loss of message integrity, which results in reader impersonation attacks and DoS attacks under the weak attacker (A− ). 1) Impersonation attacks and desynchronous attacks Phase 1 (Learning) A− plays as a blocker and eavesdrops one successful run for NRS+ protocol. A− stores exchanged messages (M1 , M2 , M3 , M4 , M5 ) between the reader Ri and the legitimate tag Ti , blocks the authentication information from Ri to Ti , where: Step 1: Ri generates a nonce r, computes M1 = H(EP C ⊕ K1 ), M2 = r ⊕ K1 , and then sends them to Ti .

914

2016

Chinese Journal of Electronics

Step 2: Ti receives (M1 , M2 ) and computes C1 . If C1 is equal to the received M1 , Ti computes M3 and sends it to Ri . a) if α = 0, M3 = H(EPC ⊕ K2 ⊕ r) b) if α = 0, M3 = H(H(EPC) ⊕ K2 ⊕ r) Step 3: Ri receives M3 and computes C2 using (α, r, EPC, K2 ). If C2 is equal to the received M3 , Ri computes M4 = K1 ⊕ r2 and M5 = H(EP C ⊕ r2 ), then sends M4 ||M5 to Ti . The DB renews related secrets as following: a) ID new = ID ⊕ [(r2lef t ||K1right ) ⊕ (K2lef t ||r2right )] b) K1new = H[(K1right ||K2lef t ) ⊕ r2 ] c) K2new = H[(K2right ||K1lef t ) ⊕ r2 ] Phase 2 (Reader impersonation) Step 1: To impersonate Ri , the attacker A− blocks authentication messages from Ri to Ti and transmits the information 0||M1 instead of M4 ||M5 in Step 6 of Fig.1. Step 2: Ti computes C3 using the received message 0||M1 , and then compares with the received M1 . a) r2 = 0 ⊕ K1 = K1 b) C3 = H(EPC ⊕ r2 ) = H(EPC ⊕ M4 ⊕ K1 ) = H(EPC ⊕ 0 ⊕ K1 ) = H(EPC ⊕ K1 ) = M1 When C3 is equal to M1 , forged messages are verified by the tag. The keys of tag which are calculated as follows:

Fig. 1. The NRS+ protocol

a) ID new = ID ⊕ [(K1lef t ||K1right ) ⊕ (K2lef t ||K1right )] b) K1new = H [(K1right ||K2lef t ) ⊕ K1 ] c) K2new = H [(K2right ||K1lef t ) ⊕ K1 ] Therefore, the reader authenticates the modified message as the legitimate information and updates the tag’s

identifier TID. The success probability of the above attacks is “1” and the complexity is only three successive runs of the protocol. Phase 3 (Desynchronous attacks) After A− executes Phase 1 and Phase 2 in the protocol, the Database (DB) does not have new keys of the tag. Then, asynchronous attacks will happen in the next run. 2) Traceability attacks under the weak attacker The lack of the tag’s random number in M3 can lead to traceability attacks. A− monitors the 0th session, replays M1 and M2 in the 1st run and sets α = 0 in the tag. In order to prevent the target tag from updating its keys, A− intercepts M4 and M5 from Ri to Ti . The attacker verifies whether a random tag Tx is the target tag Ti or not, according to the following decisions (b ∈ (0, 1)): if Tx = Ti , b = 1 else Tx = Ti , b = 0 The weak adversary’s success in winning the traceability game is equivalent to the success of breaking the untraceability property offered by the protocol. So the advantage of A− in distinguishing Ti is defined as below where Pr (succeed) = Pr (b’ is correct):    1  UN T  AdvA (k, ci ) = P r(succeed) −  2 The traceability attacks are described as below: Phase 1 (Learning) A− chooses a target tag Ti and eavesdrops on all runs, blocks the third flow from Ri to Ti and prevents the key update operation on tag. Step 1: Ri generates a nonce r and computes M1 = H(EPC ⊕ K1 ), M2 = r ⊕ K1 , then sends them to Ti . Step 2: A− replays M1 ||M2 with M1 ||0 and sends 2 of Fig.1. Ti receives M1 ||0 and computes M1 ||0 to tag in  C1 . If C1 is equal to the received M1 , the tag executes the following cases: a) If 0 α = 0, then 1 M3 = H(EPC ⊕ K2 ⊕ K1 ) and 1 α = K1 ; b) If 0 α = 0, then 1 M3 = H(H(EPC) ⊕ K2 ⊕ K1 ) and 1 α = K1 Ti computes 1 M3 and sends it to Ri in 1st run. Step 3: In order to set 1 α = K1 = 0, A− blocks 1 M3 , sends the message M1 ||0 to Ti in the second run. The tag calculates 2 M3 = H(H(EPC) ⊕ K2 ⊕ K1 ) after 2 α = K1 . Phase 2 (Challenging) Step 1: Then, in order to set 1 α = K1x , the message M1 ||0 is sent to Tx by A− in the first run. The tag calculates 1 M3 where 1 α = K1x = 0 and send it to the Ri . 6 of Fig.1 from Ti to Ri . Step 2: A− blocks 

Untraceability Analysis of Two RFID Authentication Protocols

Step 3: A− sends the message M1 ||0 to Tx in the second run again. Ti computes 2 M3x = H(H(EPC) ⊕ K2x ⊕ K1x ). Step 4: A− eavesdrops 2 M3x and executes the guessing phase attacks. Phase 3 (Guessing) A− compares the message 2 M3 with 2 M3x . It is not difficult to know that Tx is exactly the same as the target tag, when 2 M3x =2 M3 with the probability 1. Therefore, A− can trace the target tag. If Tx = Ti , A− makes sure that 2 M3x =2 M3 with a negligible probability, which is less than 2−L , the success probability Pr (b is correct) = 1 − 2−L . Therefore, the attacker’s advantage in succeeding the game is as bellow:       1   1 UN T −L −L   AdvA (L, 1) = 1 − 2 −  =  − 2  2 2 The attacker runs four rounds of the NRS+ scheme. Therefore, the total complexity of the traceability attacks includes two runs in the Learning phase and two runs in the Challenging phase. 2. The proposed NRS++ protocol In order to resist the impersonation attacks and the desynchronization attacks, this paper presents the enhanced protocol NRS++ . As an alleviation, both Ri and Ti create their own random numbers. However, Ti adopts the Pseudo random number generator (PRNG) function to prevent against replay attacks. Nevertheless, the enhanced way provides message integrity through the encrypted message M3 using the tag’s random number r1 and reader’s r2 . Even if the transmitted messages are modified by the narrow-strong attacker, the message integrity mechanism ensures that modified messages cannot be verified by the tag. Therefore, the target tag is untraceable. The authentication steps of NRS++ protocol in Fig. 2. are as follows: Step 1: The reader creates r, calculates M1 = H(EPC ⊕ K1 ||r) and M2 = r ⊕ K1 , and sends M1 ||M2 to the tag. Step 2: Ti receives M1 ||M2 , computes C1 using M2 and its keys, and then compares the calculated C1 with M1 . If the equation holds, it generates its nonce r1 , encrypts r1 as N = r1 ⊕ K1 and computes M3 = H(EPC ⊕ K1 ||r||r1 ). Then, Ti sends (M3 , N ) to Ri . Step 3: The reader computes r1 = N ⊕ K1 and C2 = H(EPC ⊕ K1 ||r||N ⊕ K1 ), and verifies that C2 is equal to M3 . If the equation holds, after computing M4 = r2 ⊕ K1 and M5 = H(EPC ⊕ K1 ||r1 ||r2 ), sends M4 ||M5 to the tag. Then, the reader updates tag’s keys in the DB, such as IDnew = ID ⊕ (r2right ||K1lef t ) and K1new = H[(K1right ||r1lef t ) ⊕ r2 ]. If the verification fails, it terminates the protocol.

915

Step 4: The tag verifies C3 = M5 and terminates the protocol if it fails. Otherwise, the secrets of the tag are renewed as IDnew = ID ⊕ (r2right ||K1lef t ) and K1new = H[(K1right ||K1lef t ) ⊕ r2 ].

Fig. 2. The NRS++ protocol

IV. Untraceability Analysis of ACSP+ Protocols and the Proposed ACSP++ Protocols 1. Weaknesses of ACSP+ protocols Two phases of ACSP+ protocols are explained in Figs.3 and 4. However, this paper shows that ACSP+ protocols suffer from tag impersonation attacks and forward traceability attacks. To resist these attacks, this paper proposes ACSP++ protocols in order to meet security and privacy requirements.

Fig. 3. The ACSP+ ’s SID update phase

1) DoS attacks under the narrow-strong attacker The assumptions are that the narrow-strong attacker + A corrupts the current tag key TIDcur and knows the encrypted structure of the hash function. Phase 1 (Learning) A+ eavesdrops the first suc7 in Fig.4, then stores cessful run of protocol and blocks  the exchanged messages between the reader and the legitimate tag Ti where: Step 1: Ri generates two nonces R3 and R4 and sends the following information to Ti .

916

Chinese Journal of Electronics

Fig. 4. The ACSP+ ’s tag identification phase

a) SELECT , TID ⊕ SID ⊕ R3 , H(SELECT , R3 , SID) b) QUERY , TID ⊕ R4 , H(QUERY , R4 , SID) Step 2: Ti generates R5 , computes the related messages, and then sends (IDENT , TID ⊕ R5 , H(IDENT , R4 , R5 )) to Ri . Step 3: If Ri verifies that the calculative formula H  (IDENT , R4 , R5 ) is equal to the received value H(IDENT , R4 , R5 ), then it computes and sends the messages (AUTHEN, H(AUTHEN, R4 , R5 , TID)) to the tag. Ri renews the related secret TID as TIDnew = H(TID). Step 4: The attacker A+ blocks and stores these transmitted messages, then stops the session. In the end, the tag’s key is TIDcur . Phase 2 (Asynchronous operation) If the attacker has an asynchronous operation for the old tag Told , the reader will initiate a second session of Fig.4, where: Step 1: The reader initiates the second run protocol and creates the nonces (R3 , R4 ) and calculates the messages using the old tag’s keys as following:   a) SELECT , TID ⊕ SID ⊕ R3 , H(SELECT , R3 , SID)  b) QUERY , TID ⊕ R4 , H(QUERY  , R4 , SID) Step 2: Ti computes H(IDENT  , R4 , R5 ) by using R5 , and then sends them to Ri . Step 3: A+ blocks the messages (IDENT  , R5 ⊕ TID, H(IDENT  , R4 , R5 )) from Ti to Ri , transmits R5 ⊕ H(TID) instead of R5 ⊕ TID and sends the transferred messages (IDENT  , R5 ⊕ H(TID), H(IDENT  , R4 , R5 )) to Ri . Step 4: Ri extracts R5 from R5 ⊕ H(TID) using H(TID), calculates H  (IDENT  , R4 , R5 ) and compares with the received value of H(IDENT  , R4 , R5 ). If H  (IDENT  , R4 , R5 ) = H(IDENT  , R4 , R5 ), then Ri updates the key TIDnew = H(H(TID)) and TIDold = H(TID). Therefore, the reader has no record of the tag’s key TID, which leads to DoS attacks. Remark 1 It must be noted that the original ASCP+ scheme in Fig.4 has shown that the tag’s outputs are (IDENT , R5 ⊕ TID, H(IDENT , R4 , R5 , TID)). This allows the attacker to counterfeit Ri by replacing the message (AUTHEN , H(AUTHEN, R4 , R5 , TID)) with 7 of Fig.4. (IDENT , H(IDENT , R4 , R5 , TID)) in  2) Forward untraceability attacks

2016

Since the key update operation only has one key, the attacker can compute tag’s keys of the (i + 2)th session via the corrupted keys of tag in the ith session. Regarding this drawback, ACSP+ schemes suffer from forward traceability attacks. A+ queries Execute oracle to obtain the (i + 2)th runs messages. Later, A+ randomly sends DrawTag (TIDc ) between TID0 and TID1 (c ∈ (0, 1)) to launch the scheme. A+ chooses another time interval i = i + 2, monitors the transmitted messages and computes the updated keys of tagc , such as SIDi+1 = H(SIDic ), SIDi+2 = c c i+1 i+1 i = H(TIDi+1 H(SIDc ), TIDc = H(TIDc ), TIDi+2 c c ). i+2 i+2 Therefore, R4c and R5c can be extracted from i+2 i+2 ⊕ TIDi+2 and R5c ⊕ the eavesdropped values R4c c i+2 i+2 i+2 TIDc using the above tag’s keys (SIDc , TIDc ) in the tag identification phase. Given vtag c , A+ calculates i+2 i+2 and HCS using the computed valthe values HCT i+2 i+2 i+2 ues (R4c , R5c , TIDC , SIDi+2 C ) and monitors the values i+2 i+2 , R2x ,) as following: (IDENT , R1x i+2 i+2 i+2 i+2 HCT = HCT (IDENT , R4c , R5c ) i+2 i+2 i+2 i+2 HCS = HCS (UPDACK, R2c , R1c , SIDi+2 C ) i+2 The computational process of HCS in SID update phase is the same as the tag identification phase. At last, i+2 If the monitored message Hi+2 (IDENT , R4 , R5 ) = HCT i+2 i+2 and H (UPDACK, R2 , R1 , SIDx ) = HCS , then the given tag Tx is differentiated from the set (TID0 , TID1 ) using the tag’s responds. Theorem 1 ACSP+ protocols do not achieve forward untraceability. Proof 1 CreateTag(TID0 , SID 0 ), CreateTag(TID1 , SID 1 )  2 vtag c ← DrawTag (TID c , SID c ), where c ∈ (0, 1)  i i 3 SID C , TIDC ← Corrupt() in the ith run  4 Free(vtag c )  5 vtag x ← DrawTag (TID x ) between 2 tags  6 π i+2 ← Launch //A+ queries Execute oracle in SID  update phase as following: i+2 7 UPDSID  , R1i+2 , H i+2 (UPDSID, R1 , SIDx ) ← SendReader-tag (π i+2 , Init, SIDx ) i+2 8 UPDACK  , R2i+2 , H i+2 (UPDACK, R2 , R1 , SID x ) ← SendTag(vtag x ) //A+ queries Execute oracle in tag identification phase: i+2 9  SELECT , [TIDx ⊕ SID x ⊕ R3 ]i+2 , H i+2 (SELECT , R3 , SIDx ) ← SendReader-tag(π i+2 , Init, SIDx , TIDx ) i+2 10 QUERY  , [TID ⊕ R4 ]i+2 , H i+2 (QUERY , R4 , SIDx ) ← SendReader-tag(π i+2 , Init, SIDx , TIDx ) i+2 11 IDENT  , [TIDx ⊕ R5 ]i+2 , H i+2 (IDENT , R4 , R5 ) ← SendTag(vtag x ) //The queries is ended, receives τ (vtagx ) = TIDx . i+2 12 If H i+2 (IDENT , R4 , R5 )  = HCT and i+2 i+2 H (UPDACK, R2 , R1 , SIDx ) = HCS , then x = c, otherwise x = |1 − c|.

Untraceability Analysis of Two RFID Authentication Protocols

2. The proposed ACSP++ protocols The ACSP+ protocols do not meet the data integrity of transferred messages, as well as their forward and backward untraceability. Therefore, we present the enhanced versions named ACSP++ protocols. In ACSP++ , SID update and tag identification phases are described in Figs. 5 and 6, respectively. On the one hand, to resist the DoS attacks and randomly modify the TID, the identification message H(IDENT , R4 , R5 , TID) of the tag achieves data integrity by adding the TID. For example, in the tag identification stage, this paper uses the message H(IDENT , R4 , R5 , TID) instead of H(IDENT , R4 , R5 ) with a negligible probability to manipulate with the TIDcur , since TID ⊕ R5 can be modified by a narrow-strong adversary. However, this paper replaces H(AUTHEN, R4 , R5 , TID) with H(AUTHEN, R5 , TID) in 7 of Fig.6. On the other hand, to rule out the forward  and backward traceability attacks, each secret key in the key update mechanism is updated by using two different nonces. Firstly, the SID update phase proceeds as below: Step 1: Ri creates a nonce R1 and sends (UPDSID, SID ⊕ R1 , H(UPDSID, R1 , SIDcur )) to the tag. Step 2: Ti extracts R1 from R1 ⊕ SIDi , where SIDi can be either SIDold or SIDcur . Ti calculates the value H(UPDSID, R1 , SIDi ) using UPDSID, R1 and SIDi , and then compares with the received H(UPDSID, R1 , SIDcur ) in order to verify whether the command is valid or not. If the computed value is equal to the received message, Ti generates a nonce R2 , computes SIDnew = H(SIDcur ||R2 ||R1 ) and transmits (UPDACK, SID ⊕ R2 , H(UPDACK, R2 , R1 , SIDcur )) to Ri . Ti reserves the records as SID old = SIDcur and SIDcur = SIDnew .

917

valid, the reader updates the local SID as SID new = H(SIDcur ||R2 ||R1 ). Secondly, the tag identification phase accomplishes the following: Step 1: Ri creates two nonces R3 and R4 , transmits (SELECT , SID ⊕ R3 , H(SELECT , R3 , SID)) and (QUERY , SID ⊕ TID ⊕ R4 , H(QUERY , R4 , SID, TID)) to Ti . Step 2: The tag Tj extracts R3 from the received TID ⊕ SID ⊕ R3 and verifies H(SELECT , R3 , SID j ) = H(SELECT , R3 , SID). If the equation holds (Tj = Ti ), Ti gets ready to respond; otherwise, Ti stops until next run. Step 3: The target tag Ti extracts R4 from the received TID ⊕ R4 ⊕ SID and compares the calculated H(QUERY , R4 , SIDi , TIDi ) with the received H(QUERY , R4 , SID, TID). If the equation holds, the tag creates a nonce R5 and transmits with (IDENT , TID ⊕ R5 , H(IDENT , R4 , R5 , TID)) to Ri . Step 4: Ri verifies the messages as below: a) In order to authenticate Ti , it computes H(IDENT , R4 , R5 , TID) by extracting R5 from the received TID⊕R5 . Ri verifies H(IDENT , R4 , R5 , TID) = H(IDENT , R4 , R5 , TID). If the equation holds, it updates tag’s keys TIDnew = H(TID||R4 ||R5 ) and TIDold = TID. b) Else Ri transmits QUERY REP to stop this session. Step 5: Ti receives (AUTHEN , H(AUTHEN , R5 , TID)), calculates H(AUTHEN , R5 , TIDi ) and proceeds as following: a) If the received H(AUTHEN , R5 , TID) is valid, Ti updates its identifier as TIDnew = H(TID||R4 ||R5 ). b) Otherwise, it stops the protocol.

VI. Properties Analysis and Comparisons 1. Efficiency analysis and comparisons The performance properties of NRS++ and ACSP++ are evaluated according to the computation overload of tag and storage space in Table 4.

Fig. 5. The tag SID update phase in ACSP++

Fig. 6. The tag identification phase in ACSP++

Step 3: Upon receipt of the message, the reader checks whether the command is valid or not. If it is

Table 4. The comparisons of the performance properties Protocol Computation/T Storage/T Storage/R NRS 3h + 10XOR 4L 7L NRS+ 6h + 10XOR 4L 7L NRS++ 4h + 8XOR 3L 5L ACSP 7h + 3XOR + 4CRC 2L 4L ACSP+ 8h + 4XOR 2L 4L ACSP++ 8h + 6XOR 2L 4L

XOR: exclusive bitwise; h: hash function; CRC: Cyclic Redundancy Code. In a word, performance properties of NRS++ protocol in Table 4 are compared with NRS and NRS+ protocols in terms of computation overload and storage. From Table 4, it can be found that the computation overload in NRS is 3h + 10XOR, but it suffers from all attacks. The storage space of NRS++ is 3L in the tag and 5L in the DB , which is less than other two protocols.

918

2016

Chinese Journal of Electronics

Therefore, comparisons of performances demonstrate that NRS++ has the least computation overhead and the most powerful security among them. The improved protocols ACSP++ do not increase the storage space and computation cost, but they are safer than ACSP and ACSP+ protocols in Table 5. 2. Security properties analysis and comparisons This paper proposes the detailed security analysis and comparisons of two enhanced protocols, which shows that both NRS++ and ACSP++ protocols are superior to other protocols in Table 5. 1) The security analysis of NRS++ protocols is described as bellow: a) Resistance against forward traceability attacks (S1) The proof of forward and backward traceability is quite similar to forward traceability in the NRS+[2] as well as NRS++ . Indeed, even though A+ arbitrarily modifies the values (M1 , M2 , M4 , M5 ), Ti can detect the vicious attacks in (i + 1)th session via K1 and synchronize the common key with Ti . b) Resistance against backward traceability attacks (S2) Even if the attacker corrupts the keys in the ith run, but s/he cannot calculate the (i − 1)th keys and the tag’s output. Due to the irreversibility of hash function, s/he is not able to compute K1i−1 from K1i = H i−1 [(K1right ||K1lef t ) ⊕ r2 ]. Similarly, s/he cannot compute ID i−1 by means of ID i = ID i−1 ⊕(r2right ||K1lef t )i−1 without K1i−1 . c) Resistance against replay attacks and DoS attacks (S3) The tag stores three keys ID, K1 and EPC in the scheme, where EPC is fixed and the values (ID, K1 ) are varied. Furthermore, the reader creates two nonces r, r1 and the tag generates r2 in each session. All these keys and random numbers are mixed to construct different messages. Take information i M3 for example, an attacker cannot replay this value. When the value is used in another j th run, the tag computes j C2 which contains the reader’s nonce j r. Then the reader can resist replay attacks by verifying the value j C2 which is equal to the message M3 . Consequently, the attacker is not able to perform replay attacks using tag’s outputs and inputs. d) Resistance against reader and tag impersonation attacks and DoS attacks (S4) The transmitted messages of all entities can be verified for each other in the presented schemes. Even if the transmitted messages can be maliciously modified by the attacker, the modified data are not through the entities’ validation. Therefore, it is impossible to implement reader and tag impersonation attacks which lead to deasynchronous attacks and DoS attacks. e) Resistance against tracking attacks (S5)

The messages of M3 and N are not able to be located with the target tag, because of the utilization of the new random numbers K1 , r and r1 in each session. This paper uses three values (K1 , r, r1 ) and the fixed EPC to generate M3 where M3 = H(EPC ⊕ K1 ||r||r1 ). Even if an attacker can transmit challenges to a target tag for several times, each tag’s outputs can still be updated every time. Then, there is no fixed relationship among different outputs, since the nonces r and r1 are created in each challenge while the other key K1 is updated in each run. 2) This paper gives security analysis of ACSP++ protocols as follows: a) Resistance against forward traceability attacks (S1) Theorem 2 The ACSP++ protocols are forward untraceability. Proof Moreover, in order to prevent forward traceability, the nonces R4 and R5 should be concatenated in the tags’ key update operation. This paper assumes that A+ corrupts TIDi and monitors the messages in the ith session, and misses the (i + 1)th session. For instance, A+ can extract R4i and R5i from the monitored messages R4i ⊕ TIDi and R5i ⊕ TIDi by using the corrupted value TIDi , to calculate TIDi+1 = H(TIDi ||R4i ||R5i ). However, A+ cannot obtain (i+1)th session and is ignorant of (R4i+1 , R5i+1 ). The (i + 2)th keys can be calculated by TIDi+2 = H(TIDi+1 ||R4i+1 ||R5i+1 )

(1)

H(SIDi+1 ||R1i+1 ||R2i+1 )

(2)

SID i+2 =

Therefore, the attackers’ computations for equations TIDi+2 and SIDi+2 are impractical because they have no access to R1i+1 , R2i+1 , R4i+1 and R5i+1 . 1 CreateTag(TID0 , SID 0 ), CreateTag(TID1 , SID 1 )  2 vtag c ← DrawTag (TID c , SID c ), where c ∈ (0, 1)  i 3 UPDSID , R1i ⊕ SID c , H i (UPDSID, R1 , SID c ) ←  SendReader-tag(π i , Init) i 4 UPDACK , R2i ⊕SID c , H i (UPDACK, R2 , R1 , SID c )  ← SendTag (vtag c ) 5 SID iC , TIDiC ← Corrupt(vtag c ) in the ith run  6 Free(vtag c )  7 vtag x ← DrawTag (TID x ) between two tags. //A+  misses the ith session and chooses another time interval i = [i + 2]. 8 π i+2 ← Launch //A+ queries Execute oracle in SID  update phase. i+2 9 UPDSID  , SID x ⊕ R1i+2 , H i+2 (UPDSID, R1 , SIDx ) ← SendReader-tag (π i+2 , Init, SIDx ) i+2

10 UPDACK  , SIDx ⊕ R2i+2 , H i+2 (UPDACK, R2 , R1 , SIDx ) ← SendTag(vtag x ) //A+ queries Execute oracle in tag identification phase. i+2 11 SELECT  , [SIDx ⊕ R3 ]i+2 , H i+2 (SELECT , R3 , SIDx ) ← SendReader-tag(π i+2 , Init, SIDx , TIDx )

Untraceability Analysis of Two RFID Authentication Protocols i+2

12 QUERY  , [TIDx ⊕ R4 ⊕ SIDx ] i+2 , H i+2 (QUERY , R4 , SIDx , TIDx ) ← SendReader-tag(π i+2 , Init, SIDx , TIDx ) i+2 13 IDENT  , [TIDx ⊕ R5 ]i+2 , H i+2 (IDENT , R4 , R5 , TIDx ) ← SendTag (vtag x ) //The queries is ended, receives τ (vtagx ) = (TIDx , SIDx ). i+2 14 If H i+2 (IDENT , R4 , R5 , TIDx ) = HCT  and H i+2 i+2 (UPDACK, R2 , R1 , SID x ) = HCS , then x = c, otherwise x = |1 − c|. A+ cannot distinguish between vtag c and vtag x in the (i +2)th run without values (R1i+1 , R2i+1 , R4i+1 , R5i+1 ). Since values (R4i+2 , R5i+2 ) are encrypted by the incom+ putable key TIDi+2 cannot compute H i+2 (IDENT , C , A R4 , R5 , TIDc ) without (R4i+2 , R5i+2 , TIDi+2 C ). The processes above prove that, A+ is not trivial and its advantage is as following. Forward−Untrace Untrace {AdvA (k), AdvA (k)} = 0 ε + +

Therefore, when A+ fails to distinguish the target tag from the game, ACSP++ protocols meet forward untraceability. b) Resistance against backward traceability attacks (S2) In order to implement backward traceability attacks, after tag’s corruption and obtaining tag’s internal states, the attacker can compute a sequence of past secret values and the tag’s previous outputs. For example, the attacker does not solve TIDi+1 = H(TIDi ||R4i ||R5i ) for TIDi , thanks to the good properties of hash functions. Therefore, ACSP++ protocols achieve backward untraceability. Evidenced by the same token, the attacker cannot deduce the old keys from the tag’s outputs. c) Resistance against replay attacks (S3) The proposed scheme addresses this issue by the following ways. On the one hand, the tag and the reader freshly create their own nonces in each session, on the other hand, different pairs of entities generate the different messages. While the former prevents an adversary from simply capturing and replaying captured messages to the same entity, the latter holds back copying messages from the tag and replaying appropriate modified messages to another tag in other runs. d) Resistance against reader and tag impersonation attacks and DoS attacks (S4) Data integrity mechanism of the protocol protects the safety of the transmitted messages against reader and tag impersonation attacks and DoS attacks. For example, after the reader receives the tag’s outputs (IDENT , TID ⊕ R5 , H(IDENT , R4 , R5 , TID)), it can check the data integrity of messages (IDENT , TID ⊕ R5 ) by the validation function H(IDENT , R4 , R5 , TID). e) Resistance against tracing attacks (S5) An attacker cannot deduce the fixed relationship from

919

the tag’s output. The reason is that the one-way hash function is used to encrypt information with different nonces in each session. Table 5. The comparisons of security properties Protocol S1 S2 S3 S4 S5 NRS NO NO NO NO NO NRS+ YES YES NO NO NO NRS++ YES YES YES YES YES ACSP NO NO NO NO NO ACSP+ NO YES NO NO YES ACSP++ YES YES YES YES YES

Both NRS and NRS+ protocols without tag’s nonce suffer from replay attacks and DoS attacks. Moreover, this paper verifies that two protocols are subjected to tracking attacks. At the same time, both ACSP and ACSP+ are subjected to impersonation attacks and DoS attacks. The obvious solutions to NRS++ and ACSP++ are that the transmitted random numbers generated by the reader and the tag should be sent in the cipher text form and contained in the key update mechanism. It can be seen from Table 5 that both NRS++ and ACSP++ can protect forward and backward untracebility privacy as well as resisting other attacks.

VII. Conclusion This paper has discovered several significant weaknesses of two RFID authentication protocols. The first weakness on NRS+ protocol is traceable and allows an adversary to implement replay attacks. The disadvantages in ACSP+ authentication protocols are that protocols lack message integrity and suffer from DoS attacks. Both NRS+ and ACSP+ protocols commonly lack the tag’s random numbers, in the tag keys update operations.. This disadvantage makes protocols fail to provide forward and backward untraceability under the narrow-strong attacker. Moreover, this paper presents two schemes named NRS++ and ACSP++ based on original protocols. Eventually, this paper has comprehensively proved that the two improved versions meet forward and backward untraceability and have the advantageous properties compared with other schemes in terms of the performance and security. A case study of hospital RFID systems will be presented in the near future. In this case study, it will be explained how the proposed schemes meet privacy and security requirements. References [1] O.K. Ha, et al., “Relation model describing the effects of introducing RFID in the supply chain: evidence from the food and beverage industry in South Korea”, Personal and Ubiquitous Computing, Vol.18, No.3, pp.553–561, 2014.

920

Chinese Journal of Electronics

[2] H. Fernando and J. Abawajy, “Mutual authentication protocol for networked RFID systems”, Proc. of the Trust, Security and Privacy in Computing and Communications (TrustCom), 2011 IEEE 10th International Conference, New York, USA, pp.417– 424, 2011. [3] Z. Qian, et al., “ACSP: A novel security protocol against counting attacks for UHF RFID systems”, Computers & Mathematics with Applications, Vol.63, No.2, pp.492–500, 2012. [4] M. Safkhani, et al., “On the security of RFID anti-counting security protocol (ACSP)”, Journal of Computational and Applied Mathematics, Vol.259, No.PartB, pp.512–521, 2014. [5] H. Ning, et al., “Ultralightweight RFID Authentication Protocol Based on Random Partitions of Pseudorandom Identifier and Pre-shared Secret Value”, Chinese Journal of Electronics, Vol.20, No.20, pp.228–232, 2011. [6] M.R. Alagheband and M.R. Aref., “Simulation-based traceability analysis of RFID authentication protocols”, Wireless Personal Communications, Vol.77, No.2, pp.1019–1038, 2014. [7] D. Moriyama, Lightweight Cryptography for Security and Privacy, Springer Berlin Heidelberg, Berlin, German, pp.114–129, 2013. [8] S. Karda¸s, et al., Lightweight Cryptography for Security and Privacy, Springer Berlin Heidelberg, Berlin, German, pp.130– 141, 2013. [9] S. Vaudenay, Advances in Cryptology–ASIACRYPT 2007. Springer Berlin Heidelberg, Berlin, German, pp.68–87, 2007. [10] L. Jian, et al., “ID updating-based RFID mutual authentication protocol for low-cost tags”, China Communications, Vol.8, No.7, pp.122–127, 2011. [11] K. Ouafi and R.C.W. Phan, Proc. of the Applied Cryptography and Network Security, Springer Berlin Heidelberg, Berlin, German, Vol.5037, No.7, pp.479–489, 2008. [12] C.H. Lim and T. Kwon, Information and Communications Security, Springer Berlin Heidelberg, Berlin, German, pp.1–20, 2006.

2016

[13] H.Y. Chien, et al., “Non-linearity cannot help RFID resist fulldisclosure attacks and terrorist fraud attacks”, Security and Communication Networks, Vol.6, No.12, pp.1490–1495, 2013. CHEN Xiuqing received the B.S. and M.S. degree from China University of Mining and Technology. She is now a doctoral candidate of computer software and theory from the China University of Mining and Technology. Her research interests include security protocols and network security. (Email: [email protected]) CAO Tianjie (corresponding author) received the B.S. and M.S. degree in mathematics from Nankai University, Tianjin, China and the Ph.D. degree in computer software and theory from State Key Laboratory of Information Security of Institute of Software, Chinese Academy of Sciences, Beijing, China. He is now a professor of computer science in the School of Computer Science and Technology, China University of Mining and Technology, Xuzhou, China. His research interests include security protocols and network security. (Email: [email protected]) ZHAI Jingxuan received the B.S. and M.S. degree from China University of Mining and Technology. He is now a doctoral candidate of computer software and theory from China University of Mining and Technology. He is the national technical experts of China. His research interests include network security and security protocols. (Email: [email protected])