Recently, Wei & Chen proposed a secure three-party mutual authentication protocol for RFID based on elliptic curve cryptography (ECC). Their approach can allow insecure communication between the reader and the backend, so their approach must achieve mutual authentication between the tag, reader, and backend. In addition, their method also satisfies the essential characteristics of RFID systems, such as confidentiality, anonymity, resistance to tracking attacks, and spoofing attacks. However, this article finds that its method cannot meet the mutual authentication and denial of service attacks.
Recently, Wei & Chen proposed a secure three-party mutual authentication protocol for RFID based on elliptic curve cryptography (ECC). Their approach can allow insecure communication between the reader and the backend, so their approach must achieve mutual authentication between the tag, reader, and backend. In addition, their method also satisfies the essential characteristics of RFID systems, such as confidentiality, anonymity, resistance to tracking attacks, and spoofing attacks. However, this article finds that its method cannot meet the mutual authentication and denial of service attacks.
A low-cost, efficient and safe mutual authentication protocol for RFID based on elliptic curve cryptography (ECC) is proposed, specific to the security and privacy problem existed in the existing RFID authentication protocol, on the basis of deep analysis of the existing RFID protocol based on ECC.As to this proposal, mutual authentication between the tag and reader can be realized only through two sessions, under the condition of not destroying the security strength.So, the workload of calculation and system resource expense are reduced.The paper has described the protocol in detail and analyzed its security.The analysis result shows that, the protocol can resist tracking attack, replay attack, man-in-themiddle attack and other attacks, has good forward security and can realize mutual authentication between the server and the tag.Besides, it has definite practicability, due to low cost, security and scalability.
Radio Frequency Identification (RFID) systems represent a key technology for ubiquitous computing and for the deployment of the Internet of Things (IoT). In RFID technology, authentication protocols are often necessary in order to confirm the identity of the parties involved (i.e. RFID readers, RFID tags and/or database servers). In this article, we analyze the security of a mutual authentication protocol proposed by Wang and Ma. Our security analysis clearly shows major security pitfalls in this protocol. Firstly, we show two approaches that an adversary may use to mislead an honest reader into thinking that it is communicating with a legitimate database. Secondly, we show how an adversary that has compromised some tags can impersonate an RFID reader to a legitimate database. Furthermore, we present a new adversary model, which pays heed on cases missed by previous proposals. In contrast to previous models where the communication between an RFID reader and a back-end server is through a secure channel, our model facilitates the security analysis of more general schemes where this communication channel (RFID reader-to-server) is insecure. This model determines whether the compromise of RFID tags has any impact on the security of the reader-to-server communication or vice versa. In a secure protocol, the possible compromise of RFID tags should not affect the RFID reader-server communication. In this paper, we show that compromising of RFID tags in Wang and Ma protocol has a direct impact on the reader-server security. Finally, we propose a new authentication protocol that offers an adequate security level and is resistant against the mentioned security risks. The security proofs of the proposed protocol are supported with Gong-Needham-Yahalom (GNY) logic and Scyther tool, which are formal methods to evaluate the security of a cryptographic protocol.
In 2006, Lee and Ahn proposed a matrix-based RFID authentication protocol which eliminates the security problems in HB and RFID authentication protocols. Their proposed protocol provides the following three merits: (1) it reduces the computational costs of the RFID tag. (2) it reduces the communication overhead between the reader and the tag. (3) it protects the user privacy. However, this paper points out that Lee and Ahn's proposed protocol is insecure to various attacks because it does not provide mutual authentication which the RFID tag does not authenticate the legality of the RFID reader unlike their claims. In addition, this paper proposes an improved matrix-based RFID mutual authentication protocol that can provide the mutual authentication. As a result, the proposed protocol not only can provide strong security and but also guarantee high efficiency because it reduces the communication rounds compare with Lee-Ahn's protocol.
As for so many security vulnerabilities, such as readers' ID-disclosure attack, man-in-the-middle attack, spoofing attack in Yao's authentication protocol, we propose a Radio Frequency Identification mutual authentication protocol based on NTRU public key encryption system, and perform formal analysis with GNY logic. The protocol not only has character of once a secret, but also the session key exchanged when mutual authentication protocol completed.Main computing tasks is implemented on the readers, so the pressure of server can be reduced effectively, the position tracking and forward security issues exist in current protocols can be solved as well. Analytic result shows that the proposed mutual authentication protocol can resist replay attack, counterfeit attack, denial of service attacks and other malicious attacks,and has featuresof low computational complexity,little communication,high efficiency. It is suitable for apply this protocol in low-cost tags.
In order to content with the security requirements of RFID system,the study uses mathematic and cryptography methods to solve these problems.Considering the security,privacy and effectiveness of RFID protocol,the paper researches the authentication protocol of the RFID system and proposes a mutual authentication protocol of RFID.Its safety and performance analysis show that the proposed protocol is relatively good in these aspects.It can prevent many security including contents privacy,location tracing,replay attack,spoofing attack,and also has forward security ability.
In this paper, we analyse the security of two mutual authentication protocols that have been recently proposed by Gao et al. (IEEE Access, 7:8376-8384, 2019), a hash-based protocol and a Rabin public key based protocol. Our security analysis clearly shows important security pitfalls in these schemes. More precisely, in each protocol, we introduce efficient approaches to desynchronize the tag and the reader/server. The proposed attacks are almost deterministic and the complexity of each attack is a session for the hash-based and three sessions for Rabin public key based protocol. In addition, in the case of the hash-based protocol, we extend the proposed desynchronization attack to a traceability attack in which the adversary can trace any given tag based on the proposed attack with probability of almost one. In the case of Rabin public key based protocol, we extend the proposed desynchronization attack to a tag impersonation attack with the success probability of one. Besides, we propose an enhanced version of the Rabin public key based protocol to provide a secure authentication between the tag and the reader. We evaluate the security of the proposed protocol formally using the Scyther tool and also in Real-or-Random model.