極低成本RFID認證協定設計及Gen2標籤應用實作

Design of Very Low-Cost RFID Authentication Protocol and Implementation of Gen2 Application

黃貞維(Chen-Wei Huang)

指導教授 ： 簡宏宇

國立暨南國際大學/管理學院/資訊管理學系/碩士(2008年)

https://doi.org/10.6837/NCNU.2008.00023

摘要

近年來RFID已經被應用在許多領域之中，RFID標籤被貼附於產品、動物或人身上，以達到辨識身份的目的；然而RFID的無線特性，使得惡意的攻擊者能夠進行各種攻擊，例如：竊聽(eavesdropping)、流量分析(traffic analysis)、欺騙(spoofing)、中斷服務(disabling the service)，或者導致標籤內的敏感資訊外洩，衍生出許多侵犯個人隱私和安全的議題。
為了提高RFID標籤的市場普及率，使用低成本的RFID標籤(如：EPC Class1 Gen2)將是較可行的方法，但低成本RFID標籤運算能力有限、記憶體容量小、通訊能力和邏輯閘數目有限，不足以支援傳統的密碼學演算法(如：AES、RSA)來保護個人隱私和安全。
目前已有許多學者提出適用於低成本RFID標籤的安全協定，但仍存在資料洩漏、阻斷服務攻擊(DoS attack)、不滿足向前安全(Forward secrecy)、讀取器和標籤資料不同步而無法進行下一次通訊等問題。本論文將這些協定分成三類：極低成本(ultra-lightweight)、低成本(lightweight)和使用雜湊函數的安全協定來做探討，說明這些協定安全上的弱點。我們並且提出一個能解決上述問題並將資料庫搜尋次數從O(n)降至O(1)的低成本RFID安全協定。除此之外，我們運用Gen2實作一系統，幫助大賣場管理保存期限短、易腐壞的生鮮食品，並假設當賣場進貨時，商品上的標籤記憶體就已經被鎖住，防止高價商品被仿冒成低廉商品出售；另外，我們也將Gen2運用於智慧住宅老人照護上，並且試圖讓惡意的攻擊者無法取得標籤內的個人私密資料，但因Gen2標籤未能提供防止讀取的功能，所以我們建議未來可將個人私密資料加密後再儲存至標籤或者直接儲存於資料庫中。

關鍵字

低成本RFID ； 認證協定 ； 阻斷服務攻擊 ； 向前安全 ； EPC Class1 Gen2

並列摘要

Recently, the wide deployment of RFID systems in a variety of applications has raised many concerns about the privacy and the security. An RFID tag can be attached to a product, an animal, or a person for the purpose of identification using radio waves. For any possible reasons, an adversary may perform various attacks such as eavesdropping, traffic analysis, spoofing, disabling the service, or disclosing sensitive information of tags, and hence infringes people’s privacy and security.
To attain great market penetration, RFID tags should be low-cost, such as EPC Class1 Gen2, which limit the computation power, the storage space, the communication capacity and the gates count. However, low-cost RFID tags aren’t equipped with conventional cryptographic primitives such as AES and RSA to protect people’s privacy and security.
Currently, there have been many works devoted to design security mechanisms for low-cost RFIDs. Unfortunately, we find that these works have several security weaknesses like information of tags compromised, DOS attack, not satisfied Forward secrecy, the information of a tag and a reader are out of synchronization, etc. In this thesis, our study focuses on ultra-lightweight, lightweight and using hash fuction security schemes. We analyze the security vulnerabilities of these works and then propose our scheme to improve the security and to reduce the database searching time from O(n) to O(1). In addition, we implemet two Gen2 RFID-based applications: one is to effectively manage and market fresh foods (like eggs, fishes, meat and milk), and to prevent an adversary from imitating a lower-price food as a higher-price food. The other aims to help the elders in their daliy activities, and to attempt preventing an adversary from obtaining personal privacy information of tags. Unfortunately, Gen2 tags are always read by anyone, so we sugguest that privacy information would be stored in the database or be crypted to tags.

並列關鍵字

low-cost RFID ； authentication protocol ； DOS attack ； Forward secrecy ； EPC Class1 Gen2

參考文獻

1. A. Juels and S. A. Weis (2005), Authenticating pervasive devices with human protocols, Advances in Cryptology – Crypto’05, Vol. 3126, pp.293-308, 2005.

2. D. Henrici and P. Müller (2004), Hash-based Enhancement of Location Privacy for Radio-Frequency Identification Devices using Varying Identifiers, PerSec04 at IEEE PerCom, 2004.

3. E. Y. Choi, S. M. Lee, and D. H. Lee (2005), Efficient RFID Authentication protocol for Ubiquitous Computing Environment, International Workshop on Security in Ubiquitous Computing Systems, Vol. 3823, pp.945-954, December 2005.

4. EPCglobal (2007), UHF Class 1 Gen 2 Standard v. 1.1.0, http://www.epcglobalinc.org/standards/uhfc1g2/, 2007.

5. EPCglobal Taiwan (2007), EPCglobal Taiwan, http://www.epcglobal.org.tw, 2007.