An Efficient Ownership Transfer Protocol for RFID Conforming to EPC Class 1 Generation 2 Standards

Transcription

1 Journal of Computers Vol. 27, No. 3, 2016, pp do: / An Effcent Ownershp Transfer Protocol for RFID Conformng to EPC Class 1 Generaton 2 Standards Fan-Shuo Lu 1 Ha-Bng Mu 1 1 School of Electronc and Informaton Engneerng, Bejng Jaotong Unversty, Bejng, Chna @bjtu.edu.cn, hbmu@bjtu.edu.cn Receved 1 July 2015; Revsed 27 July 2015; Accepted 10 August 2015 Abstract. Rado Frequency Identfcaton (RFID) s a new recognton technology used to dentfy each tem n commodty. Durng tradng, tags whch are attached to goods wll be read by the readers and ther ownershp need transferrng to complement the transacton process and servce. Tags and readers are apt to be attacked durng the communcaton between them due to the wreless channel and the weak resource of the RFID tag. Tags n tradng also need forward and backward securty besdes the ordnary securty requrements n other crcumstances. There are many prevously proposed protocols whle most may suffer from spendng problem because they use hash or keyed encrypton functon. In ths paper we propose a secure ownershp transfer protocol that conforms to the EPCglobal Class 1 Generaton 2 (C1G2) standards. Our work ams to propose a low-cost protocol, based on smple XOR, Cyclc Redundancy Check (CRC) and 16- bt pseudo-random number generators (PRNG). We also put a trust model n whch we make some assumpton whch s useful to ntroduce our protocol. Furthermore, we add a sgn bt to mark the tag's state to ntroduce a release-transfer-resumpton mode. The analyss shows that the proposed scheme can resst common attacks and ensure a securty communcaton. Keywords: EPC, Ownershp transfer, RFID, Securty 1 Introducton RFID technology has become a general technology. It makes the dentfcaton of object wthout touchng come true. A typcal RFID system conssts of tags, reader and database. Tags that carry the pvotal nformaton are attached to object. Ths technology has been wdely used n supply chan management, logstcs, healthcare, defense and many other felds. However, RFID tags and readers just provde lmted calculaton resource, whch makes t dffcult to deal wth the securty rsks n wreless communcaton. The secure ownershp transfer of objects from one owner to another has become an mportant feature of RFID system. For example, the manufacturer transports products to the dstrbuton center, and then to warehouse, to retaler, the ownershp of the products always changes frequently n the supply chan [1]. In our knowledge, the process of ownershp transfer has two securty needs: (1) only the new owner could dentfy and communcate wth the tag, the old owner would not dentfy and trace the tag (2) the new owner has no way to know the communcaton process between the old owner and the tag. And we also use the two condtons to judge ownershp havng been transferred from the old owner to the new owner. Formal defntons are put for secure ownershp and ownershp transfer provded by van Deursen, Mauw, Radomrovc and Vullers [2]. Now, we defne a classfcaton method of ownershp transfer protocol and put a trust model. The secure ownershp transfer protocols can be broadly classfed nto double databases and sngle database. In the former, both the old owner and the new owner use prvate database, durng the process of ownershp transfer, the data should be transmt by secure channel (or rely on a trusted ntermedary). In the trust model, that tag meets the needs of low-cost means t just save ID and only use low-cost calculaton, whch makes the tag always readable but only the current owner could dentfy and get useful nformaton. The rest of the paper s organzed as follows. Secton 2 covers the related work n ths area. The trust 41

2 An effcent ownershp transfer protocol for RFID conformng to EPC Class 1 Generaton 2 standards model s ntroduced n Secton 3 n detal. Our proposed protocol s descrbed n Secton 4, followed by the detaled securty analyss n Secton 5. Secton 6 concludes the paper. 2 Related work One of the earlest schemes for ownershp transfer was proposed by Osaka, Takag, Yamazak and Takahash [3] whch s based on hash and keyed encrypton functons. Protocol contans wrtng stage and ownershp transfer stage. In the wrtng stage, symmetrc secret key between tag and server should be updated to k' for ownershp transfer phase. In the transfer of ownershp stage, k' and other pvotal nformaton would be transferred, and then the k' s updated to k'' to complete the transfer of ownershp. The cost does not apply to EPC C1G2. Japnnen and Hamalanen [4] proposed a protocol to mprove the orgnal scheme [3]. However, the mprovement brought desynchronzaton problems that had been verfed [5]. For the nose njecton problem, Chen, Lee, Zhao and Chen [6] used a hash functon to protect the key beng transferred. Ths scheme stll suffers from desynchronzaton ssues. Molnar, Soppera and Wagner [7] proposed a protocol based on key-tree, and referred to the problem of ownershp transfer at the end of the artcle. There are two ways to acheve ownershp transfer of the tag: (1) soft falure, the new owner B communcates wth a trusted center TC (Trusted Center) and learns the number k whch was authorzed to the orgnal owner A. B readng the tag k + 1 tmes that makes A can t read the tag. (2) ncreased tag count, c s the tag s count, B sends a new count value c' and c' > c after B and tags establshed a secure channel, whch makes the tag pass all pseudonym authorzed for A and A can t read the tag. The protocol s not completely transferred ownershp, but pseudo shft. Chen, Huang and Jang [8] proposed an ownershp transfer protocol apples for retal and follows the EPC standards. In the purchase phase, the whole authentcaton conssts of sx steps. If A wants to buy the product, A enters hs personal password PW on the reader n the seventh step, the reader uses PW to make a hash functon and sends the value of H(PW) to the server, then the server wrtes H (PW) n the matched lst. In ownershp transfer phase, A sales the object to B, both A and B need to enter the personal password (PW and PW new ), the reader sends H (PW) and H (PW new ) to the server, the server authentcates H(PW) and makes the update operaton. After that, the server sends the acknowledgment Y and C 2 to the reader, the reader uses SN to update the tag after affrms the rght of Y and C 2. Ths protocol just uses CRC to protect the communcaton whch cannot prevent the tag beng forged. The moble phone s used as a reader n [9]. Frst, the moble reader needs to regster on the server. Durng the ownershp transfer process, a sends pvotanformaton to B, B acheves the ownershp transfer by a thrd party AA (Authorzed Agent). L, Hu, He and Pang [10] use a sgn F d to transfer ownershp after two server authentcate each other. 3 The trust model and assumptons 3.1 Trust mode In the supply chan, tag s attached to goods for dentfcaton. For the manufacturer and retaler, they are cooperaton partners n the economy. They need to share much nformaton for common beneft, though there are some key nformaton must to be protected. Based on ths relaton, we make an assumpton that the old owner shouldn t do any attack acton durng the ownershp transfer process. So the attack s source may be the old or new owner after the ownershp transfer process or an ndvdual attacker durng the process. In the trust mode, we use a flag f whch s set to 1 for no-transferrng and 0 for transferrng to present tag s state and dvde the ownershp transfer nto three steps: (1) ownershp release; (2) nformaton transfer; (3) ownershp resumpton. In the frst step, the old owner change the f s value to turn the tag s state nto transferrng; n the second step, the old owner gves some mport nformaton to the new owner; n the last step, the new owner changes the value of f to turn the tag s state nto no-transferrng and gets the ownershp. 42

3 Journal of Computers Vol. 27, No. 3, Notaton Table 1. Notatons SIGN M req N f PID key s CRC PRGN EPC DATA key c Explanaton Request nformaton. Random number. The sgn of tag status. Pseudo dentfcaton code. The key of common. Cyclc Redundancy Check. Pseudo-random number generators. EPC dentfcaton code. Product nformaton. The key of ownershp transfer. 4 An RFID Authentcaton Protocols 4.1 Common communcaton process The f s value of tag s 1, whch means the tag hold no-transferrng states, when the tag recevng the request nformaton from the reader t would use keys n calculaton; The f s value n database s 1, whch means the tag should not be transferred, when the server has recognzed the tag t uses keys n calculaton. Ths protocol s shown n Fg.1. Fg. 1. Common communcaton process Step1: The reader generates a nonce N 1, and then sends M req and N 1 to the tag. Step2: Upon recevng the request message, the tag checks f s value to choose the key; after that, t generates a fresh nonce N 2 and computes A, B: ( 1 2) A= PRNG EPC N N (1) 43

4 An effcent ownershp transfer protocol for RFID conformng to EPC Class 1 Generaton 2 standards ( s ) B = CRC key A (2) Then, t responds (B, N 2, PID ) to the reader. Step3: Reader receves the message from tag and forwards (B, N 2, N 1, PID ) to the server. Step4: After recevng the authentcaton request from the reader, the server checks ts database. The tag s llegal f there s no matched PID j, and the communcaton process would be termnated. If there s a PID j-old equals PID, whch means the tag sufferng denal of servce attacks durng the prevous authentcaton, the server checks the k s value and computes A' and B': A' = PRNG EPC N N (3) ( s old ') B ' = CRC key A (4) If B' equals B, the authentcaton of the tag s fnshed. Then, the server computes C and D: C = PRNG EPC N N (5) ( s old ) D = CRC C key (6) The server sends (D, DATA) to the reader wthout updatng operaton. If there s a PID j-new equallng PID, whch means the prevous authentcaton s prefect, the server checks the k s value and computes A', B': A' = PRNG EPC N N (7) ( s new ) B ' = CRC key A (8) If B' equals B, the authentcaton of tag s fnshed. Then, the server computes C and D: The server computes key s ' and PID j ' as follows: C = PRNG EPC N N (9) ( s new ) D = CRC C key (10) keys ' = PRNG keys new (11) PID j ' = PRNG PID j new (12) The server sends (D, DATA) to the reader and does update operaton that replaces key s-old wth key s-new, replaces key s-new wth key s ', replaces PID j-old wth PID j-new, replaces PID j-new wth PID j '. Step5: Reader receves the message from the server and sends D to the tag. Step6: After recevng the message from the reader, tag computes C' and D': ( 1 2) C ' = PRNG EPC N N (13) D' = CRC C' keys (14) If D' equals D, the authentcaton of reader and server s fnshed. Then, the tag computes PID ' and key s ': s key ' = PRNG key (15) s PID ' = PRNG PID (16) The tag does the update operaton that replaces key s wth key s ' and replaces PID wth PID '. 44

5 Journal of Computers Vol. 27, No. 3, Ownershp transfer The process of ownershp transfer can be dvded nto three phases: ownershp release, nformaton transfer and ownershp resumpton Ownershp release In ths phase, the old owner communcates wth the tag and uses key c to change tag s state nto transferrng. Ths protocol s shown n Fg.2. Fg. 2. Ownershp release Step1: The reader generates a nonce N 1, and sends M req and N 1 to the tag. Step2: Upon recevng the request message, the tag chooses the key accordng to the value of f; after that, t generates a fresh nonce N 2 and computes A, B: ( 1 2) A= PRNG EPC N N (17) ( s ) B = CRC key A (18) Then, t responds (B, N 2, PID ) to the reader. Step3: Reader receves the message from tag and forwards (B, N 2, N 1, PID ) to server. Step4: After recevng the authentcaton request from the reader, the server checks ts database. The tag s llegal f there s no matched PID j, and the communcaton process would be termnated. The f's value n database s 0 whch means the tag needs to be transferred. If there s a PID j-old equallng PID, whch means the tag sufferng denal of servce attack durng the prevous authentcaton, the server computes A', B': 45

6 An effcent ownershp transfer protocol for RFID conformng to EPC Class 1 Generaton 2 standards A' = PRNG EPC N N (19-1) ( s old ') B ' = CRC key A (20-1) If B' equals B, the authentcaton of the tag s fnshed. Then, the server computes E and F: ( ( _ ( 1 2) j s old E = PRNG EPC key N N (21-1) F = CRC ( E key c ) (22-1) The server sends (F, DATA) to the reader wthout updatng operaton. If there s a PID j-new equallng PID, whch means the prevous authentcaton s prefect, the server computes A', B': A' = PRNG EPC N N (19-2) ( s new ) B ' = CRC key A (20-2) If B' equals B, the authentcaton of tag s fnshed. Then, the server computes E and F: The server computes key s ' and PID j ' as follows: ( ( _ ( 1 2) j s new E = PRNG EPC key N N (21-2) F = CRC ( E key c ) (22-2) keys ' = PRNG keys new (23) PID j ' = PRNG PID j new (24) The server sends (F, DATA) to the reader and does update operaton that replaces key s-old wth key s-new, replaces key s-new wth key s ', replaces PID j-old wth PID j-new, replaces PID j-new wth PID j '. Step5: Reader receves the message from the server and sends F to the tag. Step6: After recevng the message from the reader, tag computes C' and D': ( 1 2) C ' = PRNG EPC N N (25) If D' s not equal to F, the tag tres to compute E' and F': D' = CRC C' keys (26) ( ( ( 1 2) E = PRNG EPC key N N (27) ' s F ' = CRC E ' keyc (28) If F' equals F, the tag changes f's value nto 0 and computes PID ' and key s ': s key ' = PRNG key (29) s PID ' = PRNG PID (30) The tag does the update operaton that replaces key s wth key s ' and re places PID wth PID '. 46

7 Journal of Computers Vol. 27, No. 3, Informaton transfer The old owner gves the necessary data (k, EPC, PID j-new, key c-new, key s-new ) to the new owner by secure channel Ownershp resumpton The new owner recovers the tag from transferrng n to no-transferrng. Ths protocol s shown n Fg.3. Fg. 3. Ownershp resumpton Step1: The reader generates a nonce N 1, and then sends M req and N 1 to the tag. Step2: Upon recevng the request message, the tag checks f's value; after that, t generates a fresh nonce N 2 and responds (N 2, PID ) to the reader. Step3: Reader receves the message from tag and forwards (N 2, N 1, PID ) to theserver. Step4: After recevng the authentcaton request from the reader, the server checks ts database. The tag s llegal f there s no matched PID j, and the communcaton process would be termnated. The f s value n database s 0 whch means the tag n transfer state. If there s a PID j-new equalng PID, the server computes E and F: The server computes key s ' and PID j ' as follows: ( ( _ ( 1 2) j s new E = PRNG EPC key N N (31) F = CRC ( E key c ) (32) keys ' = PRNG keys new (33) PID j ' = PRNG PID j new (34) The server sends (F, DATA) to the reader and does update operaton that replaces key s-old wth key s-new, replaces key s-new wth key s ', replaces PID j-old wth PID j-new, replaces PID j-new wth PID j '. Step5: Reader receves the message from the server and sends F to the tag. Step6: After recevng the message from the reader, tag computes E' and F': ( ( ( 1 2) E = PRNG EPC key N N (35) ' s 47

8 An effcent ownershp transfer protocol for RFID conformng to EPC Class 1 Generaton 2 standards F ' = CRC E ' keyc (36) If F' equals F, the tag changes f's value nto 1 and computes PID ', key s ': s key ' = PRNG key (37) s PID ' = PRNG PID (38) The tag does the update operaton that replaces key s wth key s ' and re places PID wth PID '. 5 Securty analyss and dscusson In ths part, we wll dscuss the protocol s securty. Frst, we need talk somethng about the attacker M. Our protocol conforms to the EPCglobal C1G2 standards, so M could montor the whole communcaton. Besdes, M could be a manufacturer who once owned the tag, he could know more detal about our protocol. To make an attack, M must montor an ntact communcaton. Some mportant nformaton learned by the legtmate communcaton s used to guess the authentcaton nformaton. 5.1 Resst tag mpersonaton attack For the dentfcaton by the server, after recevng the request message M needs to response B M, PID and N 2 ' to the reader. M may guess B M by XOR calculaton: K s s K B B = CRC key A CRC key A (39) B = B CRC key A CRC key A (40) K s s K K B = B CRC A A (41) ( ( 1 2) ( 1' 2' K K B = B CRC PRNG EPC N N PRNG EPC N N (42) In order to calculate B M, M need A s value, but A don t partcpate communcaton, so M can t get A by lstenng that M can t forge tag by guessng B M. 5.2 Resst server mpersonaton attack To Intate communcaton, M sends M req and N 1 ' to the tag. When recevng the request message from tag, M responses D M. M may guess D M by XOR calculaton: D D = CRC key C CRC key C (43) K s s K D = D CRC key C CRC key C (44) K s s K K D = D CRC C C (45) ( ( 1 2) ( 1' 2' K K D = D CRC PRNG EPC N N PRNG EPC N N (46) In order to calculate D M, M needs C's value, but C don t partcpate communcaton, so M can t get C by lstenng that M can t forge server by guessng D M. 5.3 Resst locaton trackng The attacker M needs to lsten to a legtmate communcaton process and record the traced target T. The process s as follow: 48

9 Journal of Computers Vol. 27, No. 3, 2016 (1) R T : M, N (47) req 1 For tracng the target, M lstens to another communcaton process: (2) T R: B, PID, N (48) 1 2 (1) R T : M, N ' (49) req (2) T R: B', PID ', N ' (50) Because the value of PID must be updated each communcaton, M can t judge f the two tags are the same one by PID. Ths protocol could resst trace attack. 5.4 Resst replay attack If M pretends to be a reader, frst, M sends M req,n 1 to the tag, then M receves B', PID ', N from tag, at last M sends D to tag. M can t use B, PID, N 2 to decode EPC and keys, so K can t use the lstened nformaton to make other attack; the tag calculates C' and D' after recevng D: ( 1 2' ) 2 C ' = PRNG EPC N N (51) D ' = CRC C ' key s ' (52) But D' not equals D, tag can t make the authentcaton about M, and tag doesn t update PID and keys yet, so the data between the tag and the database could keep synchronzaton. If M pretends to be a tag, when lstenng to a new communcaton, M sends B, PID, N 2 to the reader. The sever searches n the database to fnd a PID j-new equalng PID and computes A', B': ( j 1' 2) A' = PRNG EPC N N (53) ( s old ') B ' = CRC key A (54) But B' s not equal to B, the server can t make the authentcaton about M, and the communcaton must be nterrupt, the data between the tag and the database would never be changed. 5.5 Resst replay attack Durng the ffth step of the legtmate communcaton, M changes D nto D M. The tag receves D M and computes C', D': ( 1 2' ) C ' = PRNG EPC N N (55) D ' = CRC C ' key s ' (56) Because D' not equals D, tag can t make the authentcaton about server, and tag doesn t update PID and keys yet, but the server has updated the data after sendng nformaton,whch makes the data between the tag and the database not synchronzaton. The database keeps PID j-old, PID j-new, key s-old and key s-new, when the reader communcates wth an attacked tag, the server could fnd PID j-old equals PID, and uses key s-old to compute A', B': If B' equals B, the server computes C and D: A' = PRNG EPC N N (57) ( s old ') B ' = CRC key A (58) 49

10 An effcent ownershp transfer protocol for RFID conformng to EPC Class 1 Generaton 2 standards C = PRNG EPC N N (59) ( s old ) Tag receves D from the reader and computes C' and D': D = CRC C key (60) ( 1 2) C ' = PRNG EPC N N (61) D' = CRC C' keys (62) If D' equals D, tag computes PID ', keys', and does the update operaton, whch makes the tag and the database synchronzed n data agan. 5.6 The desynchronzaton of PRNG In our protocol, the PRNG s used to update the pvotal nformaton. The nformaton could keep synchronzaton f there was on attack. The attack behavor makes the tmes of PRNG dfferent that leads to the desynchronzaton ssue. Because the database uses more room to save the new and old nformaton, the server could detect the attack behavor. When the attack behavor has been found, the server nterrupts the current communcaton and sends a specal broadcast to let the tag reset the PRNG that solve the desynchronzaton ssue. 6 Concluson In ths paper, we bult a trust model for Double-database System. Then, we proposed a Secure Ownershp Transfer protocol based on the model. Ths protocol s ultra-lghtweght and meets the EPC C1G2 standard, n whch only CRC, XOR and 16 bt PRNG functons are employed. Securty analyss shows that the protocol can resst tag mpersonaton attack, server mpersonaton attack, locaton trackng, replay attack and man-n-the-mddle attack. In future work, our am s to mprove the protocol and propose a verson for sngle-database. Acknowledgement Ths work s supported by Natonal Natural Scence Foundaton of Chna under Grant References [1] Saravanan Sundaresan, Robn Doss, Wanle Zhou. (2015). Secure ownershp transfer for mult-tag mult-owner passve RFID envronment wth ndvdual-owner-prvacy. Computer Communcatons, 55(C), [2] van Deursen, T., Mauw, S., Radomrovc', S., & Vullers, P. (2009, September). Secure ownershp and ownershp transfer n RFID systems. Paper presented at the 14th European Symposum on Research n Computer Securty-ESORICS 2009, Sant- Malo, France. [3] Osaka, K., Takag, T., Yamazak, K., & Takahash, O. (2006, November). An effcent and secure RFID securty method wth ownershp transfer. Paper presented at the 2006 Internatonal Conference on Computatonal Intellgence and Securty, Guangzhou, Chna. [4] Japnnen, P., & Hamalanen, H. (2008, December). Enhanced RFID securty method wth ownershp transfer. Paper presented at Internatonal Conference on Computatonal Intellgence and Securty (CIS'08), Suzhou, Chna. [5] Kapoor, G., & Pramuthu, S. (2010). Vulnerabltes n some recently proposed RFID ownershp transfer protocols. IEEE 50

11 Journal of Computers Vol. 27, No. 3, 2016 Communcaton Letter, 14(3), [6] Chen, H., Lee, W., Zhao, Y., & Chen, Y. (2009, January). Enhancement of the RFID securty method wth ownershp transfer. Paper presented at the Proceedngs of the 3rd Internatonal Conference on Ubqutous Informaton Management and Communcaton (ICUIMC'09), Suwon, Korea. [7] Molnar, D., Soppera, A., & Wagner, D. (2005, August). A scalable, delegatable pseudonym protocol enablng ownershp transfer of RFID tags. Paper presented at Proceedngs ofthesac'05:proceedngs ofthe 2005 ACM Symposum on Appled Computng, New York, NY. [8] Chen, C.-L., Huang, Y.-C., & Jang, J.-R. (2013). A secure ownershp transfer protocol usng EPCglobal Gen-2 RFID. Telecommuncaton Systems, 53(4), [9] Chen, C.-L., & Chen, C.-F. (2013). An ownershp transfer scheme usng moble RFIDs. Wreless Personal Communcatons, 68(3), [10] L, H.-X., Hu, J.-H., He, L.-W., & Pang, L.-J. (2012, November). Mutual authentcaton and ownershp transfer scheme conformng to EPC-C1G2 standard. Paper presented at the 8th Internatonal Conference on Computatonal Intellgence and Securty IEEE Computer Socety, Guangzhou, Chna. 51

12 An effcent ownershp transfer protocol for RFID conformng to EPC Class 1 Generaton 2 standards 52