Mobile RFID跨領域所有權轉移

Cross Authority Ownership Transfer on Mobile RFID Networks

蔡宗成(Tsung-Cheng Tsai)

指導教授 ： ARRAY(0xc75518c)

中原大學/工學院/資訊工程研究所/碩士(2009年)

https://doi.org/10.6840/CYCU.2009.00829

摘要

無線射頻識別(Radio Frequency Identification, RFID)廣泛應用在生產製造、設備資產管理、門禁管制、票據付款、智慧家電、醫療用藥等多個領域。而近年更發展出行動無線射頻識別(Mobile RFID)，結合行動通訊設備與RFID讀取功能，提供不受限於使用地點的RFID應用服務，使人們透過行動讀取器進行電子交易。然而隨著RFID技術快速發展，也陸續出現許多須克服的瓶頸，而其中一個重要的議題為所有權轉移(Ownership Transfer)。
所有權轉移可被應用在電子商務、設備資產管理之領域，透過所有權移協定，將貼有RFID標籤的物品之所有權轉移給他人。所有權轉移協定同時也是一種延長電子標籤生命週期與安全性的重要方法之一。目前的所有權轉移協定主要應用在只有單一後端伺服器狀況下進行，尚未有支援跨越多伺服器的所有權轉移協定。而為能夠透過所有權轉移協定，安全的將嵌入電子標籤物品的物權轉移給他人，並且可以應用在多伺服器的行動商務上，因此我們在本文中提出適用於Mobile RFID環境且支援跨越不同管轄領域伺服器的所有權轉移協定(Cross Authority Ownership Transfer)，並證明我們所提出的所有權轉移方法滿足向前安全和雙向認證，且可以防止重送攻擊、中間人攻擊、資料不同步之阻絕服務攻擊等安全威脅，並且在分析我們方法的效能與所需的儲存空間和其它現有的RFID所有權轉移方法比較，證明我們的方法於Mobile RFID運作的可行性。

關鍵字

重送攻擊 ； 跨領域 ； 所有權轉移 ； 中間人攻擊 ； 行動無線射頻識別

並列摘要

Radio Frequency Identification (RFID) is widely used in manufacturing, equipment asset management, entrance guard, bill payment, smart appliances, medical drug management and other fields. In recent years, Mobile Radio Frequency Identification (Mobile RFID), a combination of mobile communication equipment and RFID reading, has been developed to provide RFID services, and allow people to use readers in e-commerce. However, with the quick development of RFID, we also confront certain problems, one of which is Ownership Transfer.
Ownership Transfer can be used in e-commerce and equipment asset management, we can transfer the ownership of items with RFID tags through Ownership Transfer protocol. Ownership Transfer is also an important way to extend the life cycle of RFID electronic tags and the tag’s security. The current Ownership Transfer protocol is mainly used in the single back-end server, but is still unavailable for multiple servers ownership transfer. To securely transfer the item’s ownership, and apply the protocol in multi-server mobile commerce, we propose the ownership transfer protocol “Cross Authority Ownership Transfer on Mobile RFID Network”, and we try to prove that our proposed protocol meets forward security and mutual authentication, and avoids replay attack, man in the middle attack, desynchronized denial of service attack. Last we analyze the performance and required storage space of our protocol, and its feasibility.

並列關鍵字

Ownership Transfer ； Man in the middle attack ； Mobile RFID ； Cross domain ； Reply attack

參考文獻

[4] A. Juels, “RFID security and privacy: a research survey,” IEEE Journal on Selected Areas in Communications, 2006.

[5] A. Poschmann, G. Leander, K. Schramm, C. Paar, “New Light-Weight Crypto Algorithms for RFID,” Circuits and Systems, 2007, PP. 1843-1846.

[6] D. Johnson, C. Perkins, “Mobility Support in IPv6,” RFC 3775, June 2004.

[8] D. Molnar, A. Soppera, and D. Wagner, “A scalable, delegatable pseudonym protocol enabling ownership transfer of RFID tags,” Proc. Sel. Areas Cryptography, B. Preneel and S. Tavares, Ed. New York: Springer-Verlag, 2005, Lecture Notes in Computer Science.

[10] Eun-Jun Yoon, Kee-Young Yoo, “Two Security Problems of RFID Security Method with Ownership Transfer,” Network and Parallel Computing, 2008. NPC 2008. pp. 68-73.