揭示Osaka等人RFID所有权转移安全方法的两大问题与改进方案

需积分: 3 149 浏览量更新于2024-10-26 收藏 200KB PDF 举报

本文主要探讨了2006年由大阪等人提出的一种基于哈希函数和对称密钥加密系统的RFID安全方法存在的两个关键问题。RFID（Radio Frequency Identification）是一种利用无线电频率实现自动识别和数据捕获的技术，对于物联网(IoT)和供应链管理等领域具有重要意义。大阪等人的方法声称能够满足一系列重要的安全需求，包括不可区分性（Indistinguishability）、前向安全性(Forward Security)、重放攻击防护(Replay Attack)、标签杀手攻击(Tag Killing)以及所有权转移(Ownership Transfer)。然而，作者指出，尽管这些特性在理论上有一定的吸引力，但在实践中，大阪等人提出的RFID安全方法存在两个重要的安全漏洞。首先，可能存在对密钥的破解或攻击，这将破坏其核心的加密机制，使得数据的机密性和完整性受到威胁。其次，文中提到的前向保密性(Forward secrecy)可能并未得到充分保障，这意味着一旦攻击者获取到某个会话密钥，他们可能会利用这个密钥来解密过去的所有通信，违反了安全预期。为了弥补这些问题，本文提出了一个改进的RFID安全方案。这个改进旨在增强系统的健壮性，确保即使在遭受攻击时，也能保证数据的安全性和隐私性。改进措施可能涉及采用更先进的加密算法、引入定期更换密钥策略、或者采用一次性密码(One-Time Password，OTP)来增强身份验证环节。此外，还可能考虑抵御分布式拒绝服务(DoS)攻击，防止恶意用户通过大量请求淹没系统，从而影响正常的服务提供。本文通过对大阪等人RFID安全方法的深入分析，揭示了存在的安全缺陷，并提出了针对性的改进措施，这对于确保RFID技术在实际应用中的安全性具有重要价值。关键词包括RFID、身份验证、密码分析、前向保密性和DoS攻击，突显了研究的核心关注点。

Two Security Problems of RFID Security Method with Ownership Transfer

Eun-Jun Yoon

School of Electrical Engineering and Computer Science

Kyungpook National University

Daegu 702-701, Republic of Korea

ejyoon@tpic.ac.kr

Kee-Young Yoo

∗

Department of Computer Engineering

Kyungpook National University

Daegu 702-701, Republic of Korea

yook@knu.ac.kr

Abstract

Radio Frequency Identiﬁcation (RFID) is a technology

that allows automatic identiﬁcation and data capture by us-

ing radio frequencies. In 2006, Osaka et al. proposed a

RFID security method based on a hash function and a sym-

metric key cryptosystem. Osaka et al. claimed that their

proposed RFID security method achieves the following se-

curity requirements such as (1) Indistinguishability, (2) For-

ward Security, (3) Replay Attack, (4) Tag Killing, and (5)

Ownership Transfer. Unlike their claims, the current pa-

per points out two security problems of Osaka et al.’s RFID

security method. To mitigate these security breaches, we

propose an improved RFID security method.

Keyword: RFID, Authentication, Cryptanalysis, For-

ward secrecy, DoS attack

1 Introduction

The Radio Frequency Identiﬁcation (RFID) technology

[1, 2, 3, 4] has come under the spotlight as technology sup-

porting ubiquitous society. For example, RFID has been

widely used by manufacturing management, custody con-

trol, management of humans and farm animals, arrange-

ment of books at some libraries, etc. From now, intended

purpose of RFID will be diversiﬁed, and will be used in ev-

ery nook and cranny. However, the current RFID systems

have several security problems and challenges [3, 4, 5, 6, 7].

In general, RFID security system consists of the three

components as Database, Reader, and Tag. Database holds

the unique identities IDs of each Tag and administrates

the information Info(ID) related to the ID (e.g. time

and location, manufacturer name, ownership, etc.). During

the protocol, the IDs are secretly held by only Database.

Database is securely connected only to Reader, tries to

∗

Corresponding author: Kee-Young Yoo (yook@knu.ac.kr) Tel.: +82-

53-950-5553; Fax: +82-53-957-4846

ﬁnd the ID from Reader, and then gives Info(ID) to

Reader. Reader reads and writes the data on Tag via inse-

cure radio-frequency transmission channel. Reader broad-

casts response request Query and the random number r,

which is necessary to transmit data securely, to Tag. Reader

also requests Info(ID) to Database. Tag holds crypto-

graphically converted ID. Tag computes and transmits the

request information to Reader. Tags are memory-constraint

and low-energy devices, so that data transmission between

Tag and Reader is not encrypted, and Tags do not provide

tamper resistant.

Therefor, it must be to deal with new security problems

and challenges in RFID system, which have not been con-

sidered in the conventional security systems. The s ecurity

problems in RFID system are as follows:

• Data transmission between Tag and Reader is unen-

crypted.

• Because Tags are inexpensive micromini devices, Tags

do not provide tamper resistant.

Recently, there are many papers reported that current

RFID systems must achieve the following security require-

ments [3, 4, 5, 6, 7]:

• Indistinguishability: The security that the attacker can

not distinguish output of Tag.

• Forward Security: The security that past data are se-

cure even if present data on Tag leaked out to the at-

tacker.

• Replay Attack: The security against the attack that the

attacker spoofs as legitimate Tag .

• Tag Killing: The security against the DoS attack that

broadcasts large amount of Query to Tag, then stops

its working.

• Ownership Transfer: Ownership is transferable with-

out invasion of owner’s privacy.

2008 IFIP International Conference on Network and Parallel Computing

DOI 10.1109/NPC.2008.64

2008 IFIP International Conference on Network and Parallel Computing

DOI 10.1109/NPC.2008.64

Authorized licensed use limited to: BEIHANG UNIVERSITY. Downloaded on June 10,2010 at 09:00:33 UTC from IEEE Xplore. Restrictions apply.

下载后可阅读完整内容，剩余5页未读，立即下载

LukeChen_1985

粉丝: 2
资源: 47

揭示Osaka等人RFID所有权转移安全方法的两大问题与改进方案

A Novel RFID Authentication Protocol with Ownership Transfer.doc

An Efficient and Secure RFID Security Method

汽车TCO计算-Total Cost of Ownership

Take ownership

TakeOwnership

Take Ownership

Ownership structure and performance of the largest German companies.pdf

Cost or Value - Beyond Cost of Ownership Whitepaper.pdf

Development of Private Vehicle Ownership among Provinces in China: A Panel Data Analysis

Achieving proof of shared ownership for the shared file in collaborative cloud applications

最新资源