Xiuqing Chen 1 *, Tianjie Cao 1 *, Jingxuan Zhai 1, Yu Guo 2 1 School of Computer, China University of Mining and Technology, Xuzhou,

Transcription

1 [Type text] [Type text] [Type text] ISSN : Volume 0 Issue 9 BoTechnology 04 An Indan Journal FULL PAPE BTAIJ, 0(9, 04 [ ] Securty lghtweght FID protocol for U- healthcare system Xuqng Chen *, Tanje Cao *, Jngxuan Zha, Yu Guo School of Computer, Chna Unversty of Mnng and Technology, Xuzhou, (CHINA School of Materals Scence and Engneerng, Chna Unversty of Mnng and Technology, Xuzhou, (CHINA E-mal : xuqngchen@6.com ABSTACT ado Frequency Identfcaton systems have been extensvely deployed n the ubqutous healthcare doman. However, healthcare records of patents n database and moble devces can be revealed by a malcous attacker, there are many prvacy threats. In order to meet the practcal requrements of hosptal envronment, ths paper crtcally analyzes all the possble attacks on orgnal protocol and proposes an mproved low-cost lghtweght FID protocol conformng to EPC Class Generaton standards n hosptal scenaros. Therefore, the enhanced protocol s more secure and hgher performance n terms of performance and securty propertes compared wth other schemes. KEYWODS ado frequency dentfcaton; Ubqutous healthcare; Low-cost lghtweght FID protocol; Provably securty; Prvacy property. Trade Scence Inc.

2 BTAIJ, 0(9 04 Tanje Cao et al INTODUCTION ado Frequency Identfcaton (FID systems have been extensvely deployed n the ubqutous health care (U-healthcare doman []. U-healthcare s an evolutonary servce of healthcare appled by wreless networks, FID moble devces, wreless medcal sensors and body area networks (BANs. To mplement U-healthcare servce, developng U-healthcare system n the healthcare ndustry s a sgnfcant tendency va tradtonal wred, moble health (M-health and ubqutous sensor network (USN technologes []. Adopton of the Health Informaton System (HIS based on the wreless network nfrastructure gves a lot of benefts. As a part of the U-healthcare system, many moble devces have been employed n hosptals due to ther outstandng moblty. Immedate access to the Electronc Medcal ecord (EM database (DB offered wth the moble devce can reduce the processng tme to access and update EM [3-5]. Healthcare nformaton of moble devces can be exposed, then there are many securty problems occurred. In order to montor and track patents, automatc solutons based on FID technology have been provded for the nursng staff [6] n U-healthcare envronment. On the one hand, USN s employed as a key factor to rapdly transmt medcal nformaton (bomedcal sgnals to the remote hosptals n prevous health envronments. On the other hand, patent montorng medcal nformaton n real tme can be analyzed by consultants. But there are many securty ssues and lmtatons for the patents' safety. In a passve scenaro and an actve scenaro, the adversary montors and traces the messages n nsecurty channels, such as the channel between a genune tag and a moble reader (a reader and DB. There are U-healthcare scenaros where the adversary can ntate fake transactons between a tag (h by a patent and a moble reader (h by a nurse. The adversary can have an objectve to reconstruct the genune tag key and dsturb the regular arrangement of the nurse. The safety performance and low-cost s the task of desgnng a lghtweght FID scheme n U- healthcare. Ths s why U-healthcare should be as economc and wdely avalable as possble. The doctor should obtan accurately the bologcal nformaton of the patent from wreless medcal sensors BANs (WMSBANs and dagnose promptly the patent s condton. The effcent U-healthcare system applcatons beneft from FID technology, such as the patent traceablty, ownershp transfer procedures, medcaton admnstraton and cost savngs. Ths paper s focused on acute dseases that are ncreasngly threatenng the sustanablty of health care systems due to rapdly-ncreasng ncdence. The mproved scheme requrements for better utlzaton of health care resources, and FID technology can provde effectve medcal checkup n U- healthcare. In order to manage effectvely the related clncal processes, we develop a securty lghtweght FID protocol for the mult-tags and mult-owners. Snce t s common for FID-tagged patents beng owned by mult-owners, a patent s commonly managed by some nurses and doctors. The proposed protocol addresses the dynamc assocated n the u-healthcare scenaros. CYPTANALYSIS OF MOHAMMADALI ET AL S POTOCOL For smplcty, we use the notatons of the orgnal paper. These notatons have been explaned n TABLE. Notatons TABLE : The notatons and descrptons. Descrptons EPC s ;DATA Electronc Product Code; The tag s record. K (P key (access key stored n the tag. C ; ID The -th tag s ndex n DB; reader s dentfer.

3 390 Securty lghtweght FID protocol for U-healthcare system BTAIJ, 0(9 04 ID The reader dentcaton number. H(; h K ( Hash functon; Keyed hash functon. We analyze the securty of Mohammadal et al's scheme n Fgure. to fnd out varous attacks. Then, we propose several types of attacks aganst ths protocol, such as tag, reader, DB mpersonaton attack and tracng attack. [ TID, K, P, C, K, P, C,] 6. M, DC,, EV,, N 7. for each s ID n DB H( ID N M? VDB If C s verfed PNG( EPCs N PNG( D K K? M x= else: = M K PNG( D K? PNG( EPCs N x= endf If C = 0 = M K PNGD ( K M K PNG( D K = or? PNG( EPCs N x= or x= endf verfes PNG( C K X D KX PX? E f ID = ID:consders ID else: ID endf then computes values below: M = PNG( EPCs NT PX Info = DATA ID hid ( N MAC = H ( DATA N If x= K K PNG( K P P PNG( P C C PNG( NT N else C PNG( NT N endf If ID = ID ID ID H ( ID else do not update the reader's key endf. Generate N. N 4. M, DC,, E 5. V= H( ID N M 8. Info, MAC, M 9. Info ID hid( N = DATA HDATA ( N = MAC ID = H( ID [ K, P, C, TID] 3.Generate NT M = PNGEPC ( s N PNG ( NT K D= NT K If flag = 0, consders C ' else: generates NT ' C = C NT E = NT PNG ( C K P flag = 0. M. verfes M? PNG( EPCs NT P K+ = PNG( K P+ = PNG( P C+ = PNG( NT N flag = 0 Fgure : Mohammadal et al s protocol. ( Impersonaton DB Attack Phase (Learnng: The attacker Adv plays as a blocker and eavesdrops one successful run of protocol and blocks the Step, then stores the exchanged messages {M, D, C, E}, where: Step. The generates a nonce N and sends t to the T.

4 BTAIJ, 0(9 04 Tanje Cao et al. 39 Step. The T generates N T and computes M, D, C, E, then sends them to the. a. M = PNG(EPC s N PNG(N T K b. D =N T K c. C = C (flag=0 d. E= N T PNG(C K P Step 3. The attacker Adv blocks and stores the nformaton, then stops the sesson. Phase (Impersonaton DB: To mpersonate the DB, Adv ntates a sesson of protocol, where: Step. Adv replays the montored nonce N to the T. Step. The T produces N T and computes M, D, C, E, then sends them to the. Ther equatons are calculated as follows. a. M = PNG(EPC s N PNG(N T K b. D =N T K c. C = C N T (flag= d. E = N T PNG(C K P Step 3. Adv blocks the messages {M, D, C, E } and modfes the transferred messages as follows: a. M Adv =PNG(EPC s N PNG(N T K b. D Adv = D =N T K c. C Adv = C d. E Adv = E D D =N T PNG(C K P Subsequently, Adv forwards the messages {M Adv, D Adv, C Adv, E Adv } to the reader. Step 4. ( -DB The reader computes V=H(N ID M and sends {M Adv, D Adv,C Adv, E Adv, V, N } to the DB. Step 5. (DB verfcaton DB pcks up each stored ID sequentally to compute H(ID N M Adv wth the same N, and compares the computed V DB wth the receved V. If V DB = V, the DB verfes the legtmate reader. On the other hand, the values {M Adv, D Adv,C Adv, E Adv, V, N } are verfed by the DB. The followng equatons are gven to prove the computatonal process. a. V DB = H(ID N M Adv =V= H(ID N M From the above compared result, the DB can authentcate the. b. The DB compares transferred message M Adv wth the calculated M DB usng the stored keys {EPC s, K } and the receved messages {N, D Adv }. Therefore, the DB verfes M DB = M Adv usng the followng equaton. M DB =PNG(EPC s N PNG(N T K = M Adv c. The DB compares transferred message E Adv wth the calculated E DB usng the followng equaton. E DB =D Adv K PNG(C Adv K P =N T PNG(C K P =E Adv d. After the DB verfes successfully, t computes the messages {M, MAC, nfo} as follows: M = PNG(EPC s N T P Info= DATA ID h ID (N MAC=H(DATA N e. The DB res the related secrets as follows: C + = PNG(N N T The DB forwards the messages {M, MAC, nfo} to the reader.

5 39 Securty lghtweght FID protocol for U-healthcare system BTAIJ, 0(9 04 Step 6. The reader receves the messages {M, MAC, nfo} and compares the computed value MAC =H(DATA N wth the receved MAC by extractng DATA from nfo. If the receved messages are authentcated by the reader, M s sent to the tag T. Step 7. The tag vertfes M tag usng ts current keys {EPC s, P } and the nonce N T. The prvate keys of the tag are updated as follows: C + = PNG(N N T ( eader Impersonaton Attack Snce the channel between the moble reader and the DB s unsafety, and the adversary has manpulated the reader s outputs, the DB and the tag can authentcate the modfed messages from the spoofed reader. Phase (Learnng: The reader transmts a nonce N to the tag, whle the tag calculates as follows: a. M = PNG(EPC s N PNG(N T K b. D =N T K c. C = C N T d. E= N T PNG(C K P Phase (Impersonaton eader: To mpersonate the reader, the spoofed attacker modfes the blocked messages, where: Step. The spoofed attacker modfes the blocked messages from tag to reader, where: M =PNG(EPC s N PNG(N T K N Step. The reader computes V= H(ID N M N = H(ID M Step 3. The spoofed attacker modfes the blocked messages from the reader to the DB, where: a. N =0 b. M = M c. V = H(ID M = V Step 4. The DB computes and compares the computed V DB wth the receved V. V DB = H(ID N M =H(ID 0 M = H(ID M = V Therefore, the counterfeted reader s verfed by the DB, the attack succeeds. (3 Impersonaton Tag Attack Phase (Learnng: Adv eavesdropps the frst successful run of protocol and blocks the Step, then stores the exchanged messages {M, D, C, E}, where: Step. The generates a nonce N and sends t to the T. Step. The T generates N T and computes M, D, C, E, then sends them to the a. M =PNG(EPC s N PNG( N T K b. D =N T K c. C = C (flag=0 d. E= N T PNG(C K P Step 3. The computes V= H(ID M N and sends V to the DB. Step 4. After the DB verfes successfully, t computes the messages {M, MAC, nfo} as follows: M = PNG(EPC s N T P Info= DATA ID h ID (N MAC=H(DATA N The DB res the related secrets as C + = PNG(N N T. The attacker Adv blocks and stores these nformaton M, then stops the sesson. Phase (Impersonaton Tag: To mpersonate the tag T, untl the reader ntates a second sesson of protocol, where: Step. the reader ntates a second run of protocol and replays the montored nonce N =0 to the T.

6 BTAIJ, 0(9 04 Tanje Cao et al. 393 Step. The T produces N T and computes {M, D, C, E }, then sends them to the. The equatons are calculated as follows. a. M = PNG(EPC s N N T K b. D =N T K c. C = C N T (flag= d. E = N T PNG(C K P Step 3. Adv blocks the messages {M N, D, C, E } from T to. Step 4. The computes V = H(ID M N N = H(ID M and sends V to Adv. Step 5. Adv modfes the transferred messages as follows: a. M Adv =M N =PNG(EPC s N N T K b. D Adv = D =N T K c. C Adv = C d. E Adv = E D D =N T PNG(C K P e. V Adv =V = H(ID M f. N =0 Subsequently, Adv forwards the messages {M Adv, D Adv, C Adv, E Adv, V Adv, N } to the. Step 6. (DB authentcates the reader and tag From the followng compared result, the DB can authentcate the. If V DB = V Adv, DB compares transferred message {M Adv, E Adv } wth the calculated {M DB, E DB } as followng. V DB = H(ID N M Adv = V Adv = H(ID M From the above compared result, the DB can authentcate the counterfeted. b. If C Adv s not verfed, the DB computes the calculated I. I =M Adv PNG(D Adv K K =PNG(EPC s N =PNG(EPC s X= = Therefore, the DB verfes that the state of the tag's keys s. c. E DB =D Adv K PNG(C Adv K P = D K PNG(C K P =N T PNG(C K P =E Adv After DB verfes E DB =E Adv successfully, t computes the messages {M, MAC, nfo } as follows: d. M = PNG(EPC s N T P Info = DATA ID h ID (N MAC =H(DATA N e. The DB res the related secrets as follows: C + = PNG(N N T The tag mpersonaton attack succeeds. (4 The Tag Tracng Attack The attacker can calculate the xored value DE=PNG(C K P usng the montored messages {D,E}. Therefore, Adv traces the target tag accordng to the fxed value PNG(C K P. THE ENHANCED MOHAMMADALI ET AL. S POTOCOL There s a wde varety of applcatons n a hosptal where secure and effcent authentcaton mechansms are demanded. For nstance, FID technology ensures the safety of transfuson patents, and creates the accurate and effectve medcal servce for treatment. In order to avod transfusonhandlng errors, ths process conssts of two phases. Frst the denttes of the patents and lqud

7 394 Securty lghtweght FID protocol for U-healthcare system BTAIJ, 0(9 04 medcne bags are confrmed (authentcaton protocol and then the matchng between both enttes s checked (verfcaton step. The process s sketched n Fgure. and an authentcaton protocol s at the core of ths applcaton. Our authentcaton protocol are shown n Fgure. and descrbed below: Step : T: N. When the physcan arrves at the bed, the reader s her sends a query sgnal and a nonce N to the tag. Step :T : {M,E,F}. The tag generates a nonce N T and computes the encrypted messages contaned patent dentfer, concrete dsease and medcaton lsts. The most common servce n a hosptal envronment have patent data and medcaton lsts, whch call automatcally at the dsplay of moble reader. [ TID, K, P, C, K, P, C, ID, ID ] 6. M, EFVG,,,. Generate N. N 4. M, EF, 5. G= ID N V = H( ID N M [ K, P, C, TID] 3.Generate NT M = PNG ( EPC s N TN PNG ( K D= NT K E= PNG ( C N TK P F= C N D 7. for each s ID n DB N = ID G HID ( N M? V DB extract C and Dfrom F If C =0 For each tuple( EPC, K, K = M PNG( K = M PNG( K or? PNG( EPC N D K X= or s s X else: C or C? C X= or endf PNG ( EPC D K N PNG( K? M verfes PNG( C D K K P? E f ID = ID :consders ID else: ID endf then computes values below : s X X X X M = PNG( EPC N P MAC = H( DATA N If x= K K PNG( K N P P PNG( P N C C PNG( N N else C PNG( N N endf If ID = ID s T Info = DATA ID N T T ID ID H( ID else do not update the reader's key endf 8. Info, MAC, M 9. Info ID N = DATA HDATA ( N = MAC ID = H( ID N. verfes M PNG( EPC N P 0. M K = PNG( K N + P = PNG( P N + s T C = PNG( N N + T Fgure : The mproved protocol. Step 3: DB : {M, E, F, V, G}. Upon recevng the messages, the reader computes V =H(ID N M and forwards (N, M, F, V, E to the DB. The nurse or the doctor forwards the messages such as patent dentfer, concrete dsease and medcaton lsts, to the DB.

8 BTAIJ, 0(9 04 Tanje Cao et al. 395 Step 4: DB verfcaton and computaton After recevng {M, E, F, V, G}, the DB performs the followng operatons: a. The DB searches ts look-up table for a value ID that satsfes N =ID G and V=H(ID N M. If the above equaton s set up, the DB authentcates the reader of the her s legal. Some patents need more care and regular checks. For example, f a patent needs a regular check three tmes a day, the FID system should remnd the responsble personnel. Therefore an automatc checklst can be created. b. If C = 0, t stands for the frst access. For each tuple (K,P,C,K,P,C,EPC s, the DB computes values I =M PNG(K and I =M PNG(K n ts DB, and checks whether I (I matches PNG(EPC s D EPC s N. The process s teratvely repeated for each entry untl t fnds authentcaton key (K or K. c. When C 0, the DB consders C as an ndex to fnd the related keys n the database. If C =C, the DB sets X =, otherwse (C =C X=. Then the DB nvestgates whether M s equal to the computed value PNG(EPC s D K X N K X. d. The DB uses K X and D to obtan N T, then checks whether the receved E matches PNG(C X D K X K X P X computed by the DB. If the two values match, the back-end server verfes the tag, otherwse termnates the sesson. e. The DB computes M =PNG(EPC s N T P X. When the next shft nurse knows whch tasks have been done and whch have not, another problem n hosptals s that change of shft report whch ncludes the tasks that have been done. The checklst can be created automatcally by ths way. If ID = ID, the DB uses ID to compute nfo and MAC; otherwse, ID =ID. If X=, nfo= DATA ID N and MAC=H(DATA N, then DB sends t to the reader. If X=, the DB updates just C + = PNG(N T N. Otherwse, t updates the record by replacng K wth K,P wth P and C =C. New values K, P and C are reset as PNG(K N T, PNG(P N T and C =PNG(N T N. f. The reader updates secret values ID =ID, ID =H(ID N, when the receved messages are verfed successfully. Otherwse, the back-end server does not update the keys of the reader. Step 5:DB :{M, MAC, nfo} The DB forwards the messages {M, MAC, nfo} to the reader. Step 6: T:{M } The reader obtans DATA, then checks whether the receved MAC s equal to H(DATA N. If the message MAC s verfed, the reader sends M to the tag and updates secret value ID=H(ID N. After recevng M, the tag computes PNG(EPC s N T P based on the saved value (N T, P, EPC s, then compares the receved value M wth the computed value. If the equatons h, the tag authentcates the reader and updates the ts keys as K + =PNG(K N, P + =PNG(P N and C + =PNG(N T N. Data acquston equpments of FID system and patent data measurng equpments of the clncal manfestaton would perform data synchronous updatng mechansm accordng to relevant applcaton requrements. Moreover, the update mechansm that have mportant meanng towards control condton developng and reducng ts harm n tme. THE SECUITY AND PEFOMANCE POPETIES ANALYSIS ( Tag Impersonaton esstance In order to mpersonate a tag, an adversary should have the forged messages {M, E,F}. In order to compute M, the Adv needs EPC s,k and N T that are unknown for Adv. On the other hand, the current value of E s ndependent of the value D. Adv can not fnd the relatons from the messages {M,E,F}. Therefore, Adv can not mpersonate the tag. ( DB Impersonaton esstance The enhanced protocol s DB mpersonaton resstance. It s mpossble for Adv to obtan nfo and MAC. Even f the DB receves the replayed N n the DB'S verfcaton process,the computatons of

9 396 Securty lghtweght FID protocol for U-healthcare system BTAIJ, 0(9 04 {M,D,E, M } need check the ntegrty of N T whch s known for Adv. Therefore, t s mpossble for Adv to reveal the tag's nformaton. (3 eader Impersonaton esstance It s clear that the forged value V cannot be dentfed by the DB whch checks the ntegrty of N and M. Even f Adv compromses the current key ID cur, the next key of the reader s updated usng N whch s not known for Adv. (4 Tracng Attack esstance If Adv uses the montored messages {M, E,F} to analyze the tag's keys, we encrypt K and C usng N T and PNG (N T respectvely n the mproved protocol. Therefore, Adv can not obtan any other secret values and trace the tag. TABLE and TABLE 3 show the comparson of securty and performance propertes for the fve protocols. TABLE : The comparson of securty propertes Protocols S S S3 S4 Protocol [8] NO NO NO NO Protocol [9] NO NO NO NO Protocol [0] NO NO NO NO Protocol [7] NO NO NO YES ours YES YES YES YES S : Tag mpersonaton resstance; S : Server Impersonaton esstance; S3 : eader Impersonaton esstance; S4 : Tracng Attack esstance. The protocol [7] shows that protocols [8-0] has some weaknesses ncludng tracng attack, DB mpersonaton, tag mpersonaton and DATA forgery attack. Moreover, we also show that protocol [7] suffers from the reader mpersonaton, DB mpersonaton, tag mpersonaton attack and tracng attack. Snce our scheme s more secure than other schemes. TABLE 3. The comparson of performance propertes Protocols T T T3 T4 T5 Protocol [8] 0 6 hash 4 NO Protocol [9] hash 6PNG 4 YES Protocol [0] 0 6PNG 4 YES Protocol [7] hash 7PNG 4 YES ours hash 6PNG 3 YES T : Type and number of encrypton functons on reader; T : Type and number of encrypton functons on tag; T3 : Number of pseudo-random nonces on tag; T4 : Number of outputs on tag; T5: EPC CG complance. In our protocol, the tags need not mplement hash functons, so that the huge computatonal workloads can be reduced. Further, the tag computaton s restrcted to XO operatons and PNG. Thus, performance propertes of our scheme s superor to four protocols. Thus, we see that our scheme provdes the requred securty propertes whle at the same tme conformng to EPC Class- Gen- standards n the u-healthcare system. CONCLUSIONS In our scheme, the tag computaton s restrcted to btwse operatons, concatenaton calculatons and pseudo random number generaton. All the methods are wthn the capabltes of EPC Class- Gen

10 BTAIJ, 0(9 04 Tanje Cao et al. 397 tags. Further, snce the tags need not mplement hash functons, the huge computatonal workloads can be reduced. We have demonstrated that Mohammadal et al's protocol s vulnerable to varous attacks. Subsequently, we have proposed a FID authentcaton protocol for u-healthcare envronment. As an allevaton, we clam that these enhanced protocols are secure aganst DB mpersonaton attack, tag mpersonaton attack, reader mpersonaton attack, and afford untraceablty and forward secrecy based on the Vaudenay's formal prvacy model. Apart from guaranteeng some essental securty propertes, the mproved protocol clams to solve the trade-off between locaton prvacy and low-cost n u-healthcare envronment. EFEENCES [] S.D.Kaul, A.K.Awasth; FID Authentcaton Protocol to Enhance Patent Medcaton Safety. Journal of medcal systems, 37(6, -6 (03. [] J.T.Km; Enhanced Secure Authentcaton for Moble FID Healthcare System n Wreless Sensor Networks [M]. Computer Applcatons for Database, Educaton, and Ubqutous Computng. Sprnger (0. [3] J.T.Km; Prvacy and Securty Issues for FID Healthcare System n Wreless Sensor Networks [M]. Convergence and Hybrd Informaton Technology. Sprnger, (0. [4] P.Pcazo-Sanchez, N.Bagher et al.; Two FID Standard-based Securty Protocols for Healthcare Envronments. Journal of medcal systems, 37(5, - (03. [5] Y.en,.W.N.Pazz et al.; Montorng patents va a secure and moble healthcare system. Wreless Communcatons, IEEE, 7(, (00. [6] A.opponen, M.Lnnavuo et al.; A novel concept of a wearable nformaton applance usng context-based human computer nteracton. Personal and Ubqutous Computng, 7(, (03. [7] A.Mohammadal, Z.Ahmadan et al.; Analyss and Improvement of the securng FID systems conformng to EPC Class Generaton standard. IAC Cryptology eprnt Archve, (03. [8].H.E.Alakrut, A.Samsudn et al.; Provably Lghtweght FID Mutual Authentcaton Protocol. Internatonal Journal of Securty & Its Applcatons, 7(4, (03. [9] E.J.Yoon; Improvement of the securng rfd systems conformng to epc class generaton standard. Expert Syst.Appl., 39(, (0. [0] T.C.Yeh, Y.J.Wang, T.C.Kuo, S.S.Wang; Securng FID systems conformng to EPC Class Generaton standard, Expert Systems wth Applcatons, Avalable onlne, (00.