適用於Mobile RFID環境下之離線委任轉移協定

Delegation Transfer Protocol in Mobile RFID Networks

許博宇(Po-Yu Hsu)

中原大學/工學院/資訊工程研究所/碩士(2011年)

https://doi.org/10.6840/cycu201101023

摘要

在無線射頻識別(Radio Frequency Identification, RFID)技術的持續進步下，透過結合RFID技術與行動通訊技術產生出的行動讀取器(Mobile Reader)造就了Mobile RFID環境，並且使得RFID的服務範圍可不再受到讀取器地點的限制。然而，多數的RFID方法都需要讀取器將資訊藉由與後端資料庫連線，傳回至後端資料庫進行識別與認證，其應用依然會受限於無線網路存取的問題而有所侷限。
對於行動讀取器無法與後端資料庫連線的環境，相關學者提出了委任方法，讓行動讀取器透過事先經後端資料庫委任授權的方式，便讓行動讀取器可於離線的狀態下識別標籤。但是，行動讀取器被委任的權限一旦失效後，其仍然必須要存取無線網路與後端資料庫連線取得新的委任方可再次讀取標籤，因此為了解決在無法與後端資料庫連線的環境下，行動讀取器仍然必須取得讀取標籤委任權限的問題，我們提出適用於Mobile RFID環境下之離線委任轉移協定，讓無法連線到後端資料庫而委任權限用盡的行動讀取器可向另一同樣擁有該讀取標籤權限的行動讀取器要求委任的轉移，以解決無法獲得委任授權的問題。除此之外，我們所提出的協定還可防止惡意攻擊者進行重送攻擊、中間人攻擊、資料不同步阻斷服務攻擊、偽造標籤和猜測攻擊等攻擊的種種威脅，並且滿足向前安全性、向後安全性、資料隱私和位置隱私的安全性。

關鍵字

Mobile RFID ； 離線委任 ； 委任轉移 ； 中間人攻擊 ； 位置隱私

並列摘要

With the rapid development of Radio Frequency Identification (RFID), the combination of mobile devices and readers has seen wide application of mobile RFID. It is no longer confined by its locations. However, most RFID protocols still need to perform authentication and identification on back-end servers, which means all the date required is sent through the reader-server communications. Such methods inevitably cause some inconvenience to users because of the limitations of wireless communications.
Some studies have proposed new delegation approaches to deal with the wireless communications between mobile readers and back-end servers. The servers can delegate mobile readers in advance, so that the readers can identify tags in an off-line mode. The problem is once the delegation expires mobile readers still need to establish connection with back-end servers for new delegation. For this reason, we propose a new delegation protocol for mobile readers to perform delegation transfer. In our protocol, if a mobile reader’s delegation expires, it can ask for delegation transfer from another reader that has been authorized to access the same tag. Besides, our delegation protocol can also guarantee forward/backward secrecy and secure data privacy and location privacy. It can stand most RFID threats, such as replay attacks, Man-in-the-Middle attacks (MITM), pseudo tags, and denial of service (DoS) attacks.

並列關鍵字

Off-line Delegation ； Location Privacy ； Mobile RFID ； Man-in-the-Middle Attack ； Delegation Transfer

參考文獻

[20] 羅嘉寧、楊明豪、許博宇， “行動式無線射頻技術委任授權協定之分析及改良,” In Proceedings of Cryptology and Information Security Conference 2011, Yunlin, Taiwan, 2011.

[5] S. Fouladgar and H. Afifi, “A simple privacy protecting scheme enabling delegation and ownership transfer for RFID tags,” Published in Journal of Communications, Vol. 2, pp. 6–13, 2007.

[6] Li Gong, Roger Needham and Raphael Yahalom, “Reasoning about Belief in Cryptographic Protocols,” In Proceedings of 1990 IEEE Computer Society Symposium on Research in Security and Privacy, pp. 234–248, 1990.

[9] G. Kapoor and S. Piramuthu, “Vulnerabilities in Some Recently Proposed RFID Ownership Transfer Protocols,” Published in IEEE Journal of Communications Letters, Vol. 14, No. 3, pp. 260–262, 2010.

[11] N.Y. Lee and 李育賢, “Off-line authentication protocol for RFID tags,” In Proceedings of 2008第三屆數位教學暨資訊實務研討會EITS2008, 2008, pp. 34.