RFID鑑別協定之計數器不同步問題之研究

A Study of Counter Inconsistency Problems in RFID Authentication Protocols

白如珮(Ju-Pei Pai)

指導教授 ： 曹世昌 ； 林詠章

亞洲大學/資訊學院/資訊科學與應用學系碩士班/碩士(2009年)

摘要

無線射頻辨識系統 (RFID) 現今已被廣泛的應用在許多的領域，但因其非接觸式的特性，不合法的使用者可能藉由讀取器與標籤無線通訊時，在遠端竊取或竊聽資料，造成使用者的隱私及系統的安全遭受威脅。因此，許多學者針對RFID安全與隱私上的議題紛紛提出不同的解決方法，以確保RFID系統中合法的讀取器與標籤可以安全的做驗證及通訊。然而在這些驗證的方法中，若在傳輸的過程中遺失了驗證的訊息封包，將致使資料庫與標籤間所共享的資訊無法同步更新。然而在資訊不同步的情況下，將導致資料庫和標籤間的驗證失敗且此標籤將無法在這個系統中繼續使用。
在這篇論文中，我們分析一些學者所提出的RFID驗證方法，發現某些方法中存在著計數器不同步的問題。因此，我們分別提出了兩個方法，以預防不同步的問題。在第一個方法中不只可抵擋不同步的問題，亦可提升標籤向資料庫請求認證時，資料庫搜尋標籤身分的時間。在第二個方法中，我們提出一個輕量級的認證方法，在這個方法中，使用不複雜的密碼技術(如雜湊函數，XOR)以完成RFID的身分鑑別，此方法可預防計數器不同步的缺點並且能抵擋中間人攻擊。

關鍵字

RFID、驗證機制、計數器不同步、中間人攻擊、安全、隱私、所有權轉移、對稱式加密

並列摘要

Radio Frequency Identification (RFID) has been widely used in several applications and its security has become a critical issue in this field. So far, several secure schemes have been proposed to authenticate the legitimate reader and tag. However, in these schemes, if the transmitted parameters are lost, the shared counter can become inconsistent. In this condition, the authentication between the reader and the tag will fail and the tag cannot be used in this system anymore. In this thesis, we point out the problem of
counter inconsistency in several RFID authentication schemes. Furthermore, we have proposed two schemes to avoid these problems respectively. The first scheme can not only overcome the counter inconsistency problem, but also can improve the search time
to find the tag’s identification in the database. In the second scheme, we will propose a lightweight authentication scheme to overcome the asynchronous flaw and withstand the man-in-the-middle attack.

並列關鍵字

RFID, authentication protocol, counter inconsistency, man-in-the-middle attack, security, privacy, ownership transfer, symmetric encryption

參考文獻

[1] A. Juels, “RFID security and privacy: A research survey,” IEEE Journal on Selected Areas in Communications, vol. 24, pp. 381–394, Feb. 2006.

[3] M. B. Jansen and W. Eradus, “Future developments on devices for animal radiofrequency identification,” Computers and Electronics in Agriculture, vol. 24, pp. 109–117, Nov. 1999.

[5] S. Gao, “RFID applications toward mobile business,” in Proceedings of 2007 IEEE International Conference on the Management of Mobile Business, (Washington, DC, USA), pp. 65–66, IEEE Computer Society, July 2007.

[7] S. M. Lee, Y. J. Hwang, D. H. Lee, and J. I. Lim, “Efficient authentication for lowcost RFID systems,” Lecture Notes in Computer Science - Computational Science and Its Applications (ICCSA 2005), vol. 3480, pp. 619–627, May 2005.

[8] J. Munilla and A. Peinado, “HB-MP: A further step in the HB-family of lightweight authentication protocols,” Computer Networks, vol. 51, no. 9, pp. 2262–2267, 2007.