In this paper the Authors has discussed various RFID privacy issues especially the RFID Tag tracking and provided a solution to this important issue.  In the proposed scheme the Tag ID changes at random driven by Tag’s internal circuitry during each Tag’s activation.  After some number of changes caused by Tag’s activation an external observer cannot link the original ID and the current one, so traceability is in practice quite limited: an adversary who looses an RFID Tag from his eyes for a moment would loose it forever. Also discussed few already mentioned techniques for privacy like killing the Tag, blocking, Hash lock scheme and re-encryption of Tag’s contents. 

Their aim is to make the RFID-Tags unlinkable for an external observer that can read the Tags, but the access is not continuous.  This thing is due to the fact that during each Tag activation its ID is transformed by a specially built in Tag circuit.  In this process if Tag ID is of l bits then l/2 bits get changed because of this transformation which inturn would be informed and updated in the reader data base, the update procedure requires no encryption.  Also incase of possible read outs carried by an adversary better to authenticate reader first than to send the updated ID.

Since the proposed protocol inserts l/2 random bits during each Tag activation so by an after T time frame the Tag will get a random ID and is indistinguishable to an external observer.

In this paper another important point is discussed which is related to Tag’s collision.  Since a Tag gets random value after each activation so it is possible that after some time the Tag gets an ID either similar or very close to another Tag’s ID.  In this case the protocol insures that the Tag is activated by a number of times so that a minimal hamming distance is maintained between the two Tag ID values.  Also the collisions may occur frequently only if the number of the Tags becomes of the same order as the address space, i.e. 2ⁿ.  Normally the time required to reach by two Tags the same value is quite large and therefore it should not cause any practical problem.

As mentioned earlier a minimum distance should be maintained this is important, since maintaining a minimal distance makes the system more immune against certain transmission and hardware faults. It is also important in a situation when a transition of an ID has occurred, but the changes have not been received by a reader.

Published in - International Conference on Information Technology (ITNG’07)

Link - http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=4151817

Importance to my Research – High

My Review–  

2.  Protection against tag spoofing or cloning:  The proxy enabled with the capability to relabel tags to protect user  privacy, helps to prevent cloning and ensures the privacy of subsequent owners.

3. Protection against impersonation attacks: The work provides protetction against such attacks which leads to the   removal of a user’s tagged items and tracking a user’s movement.

4. Policy enforcement and access control: Privacy is insured due to the use of proxy which act as a mediator.

5. Transferability and tag release: Provides the transferablity mechanism and the privacy of the new owner is guaranteed.

A. Threat model and assumptions
The tag shares a unique secret K with the back-end database. Threat model not only have a record of secret keys of every available tag but also has information of tags been released to new users With assumed little tag computational capability and the proxy to be capable of interacting with tags and perform several updating operations such as read or write.
   

Tag ownership:
The user’s proxy shares the secret key K with the tag and knows its unique identifier.  And this information is also available to the backend server as well. 

This paper discusses possible RFID privacy and security threats. Proposed authentication protocol seems efficient and resists tag information leakage, tag location tracking, replay attacks, denial of service attacks, backward traceability, forward, and server. Author identifies the following two major privacy issues.

1. Tag Information Privacy

2. Tag Location Privacy

Proposed authentication protocol seems efficient and resists tag information leakage and tag location tracking.

Author classifies security threats to RFID protocols into weak and strong attacks.

Weak attacks, feasible just by observing and manipulating communications between readers and tags, are

1. Tag Impersonation

2. Replay attack

3. Denial of Service attack

Strong attacks like Backward Traceability, Forward Traceability and Server Impersonation: Proposed authentication protocol seems efficient and resists replay attacks, denial of service attacks , backward traceability, forward, and server.

Performance Parameters: Following are the performance parameters used by author

1. Capacity minimisation: minimal data stored due to limited size of the Tag

2. Computation minimisation: Low-powered nature of Tags.

3. Communication compression: Limited bandwidth available for RFID tags

4. Scalability: The server should be able to handle growing amounts of work in a large tag population.

Proposed Authentication Protocol

The protocol involves three flows, and uses a challenge response approach. It uses random numbers to give anonymity for each tag response. The server database stores both the most recent and the current data for each tag to protect against desynchronisation between the server and tags, like the Henrici and Muller suggested a scheme relying on one way hash functions–HM, mutual authentication protocol confirming EPC Global class-1–CC and Lim and Kwon authentication scheme –LK protocols.  If the authentication procedure is successful, then the server and tag refresh their shared secrets probabilistically using exchanged random numbers, thereby providing untraceability, as in the LK protocol.

One of the main features of the protocol is that a random number generated by a tag serves as a temporary secret for the tag. Another feature is that a tag only needs to store an identifier, where this identifier is the cryptographic hash of a bit-string assigned to the tag. A server database stores tag bit-strings as well as tag identifiers. The bit-string is used for server validation. The scheme is designed to minimise the use of complex cryptographic functions, and instead wherever possible uses combinations of simple functions such as right and left shifts and bit-wise exclusive-or operations to combine data strings.

 Assumptions

The said protocol works under the following assumptions.

• Each tag has a unique initiator, which creates and maintains security parameters for the tag.

• Each initiator maintains a secure database containing a set of values for each tag that it manages.

• Each tag has a rewritable memory which may be susceptible to compromise.

• Every tag reader has a PRBG.

• The tags can generate random numbers and perform a hash function and a keyed hash function.

• The channel between the server and the reader is secure.

• The reader and the tags communicate over an insecure channel and their communications are subject to eavesdropping or modification.  

Conclusions

1. Tag Information Privacy: A server and a reader communicate via a secure channel.  Only a legitimate server can extract a tag identifier only.  This protocol allows only an authorized server and reader to access the information associated with a tag.

 2. Tag Location Privacy:  The eavesdropper can neither link tag responses to previous responses from the same tag, nor distinguish one tag’s responses from another’s. It is thus difficult to track the location of a tag. 

3. Tag Impersonation attack:  For a weak attacker to impersonate Ti, it must be able to compute a valid response (M1, M2) to a reader query. However, it is hard to compute such a valid pair without knowledge of tag identity. Only a strong attacker is able to clone a tag. 

4. Replay attack:  The scheme is a challenge-response authentication protocol using random numbers to resist replay attacks. 

5. Denial of Service attack:  The shared secrets between server and tag needs synchronization and are helpful in the present scenario. 

6. Backward Traceability: A strong attacker cannot identify the past interactions of Ti, even if it knows Ti’s present internal state. 

7. Forward Traceability:  The present protocol also provides the forward untraceability. 

8. Server Impersonation attack:  The said protocol only resists such an attack on the assumption that an adversary does not have access to at least one of the mutual shared values during authentication session that is performed between an authorized server and a tag, for which the adversary knows the tag’s secret. 

9. Storage and computational requirements: The proposed protocol requires less tag-side storage and computation than other similarly structured RFID protocols.

Authors - Leonid Bolotnyy and Gabriel Robins

Year - 2007

Link -  http://ieeexplore.ieee.org/iel5/4144734/4144735/04144766.pdf

Published in - Proceedings of the Fifth Annual IEEE International

Conference on Pervasive Computing and Communications (PerCom’07)

Importance to my Research – High

My Review–     Radio Frequency Identification (RFID) gains its popularity for object identification. However tracking and authentication in RFID tags have raised many privacy and security concerns. Although numerous solutions exists which fairly addresses these issues but are too hardware expensive to incorporate into low-cost RFID tags. However Leonid Bolotnyy and Gabriel Robins proposed hardware based approach to RFID security that relies on physically unclonable functions (PUFs). These PUFs exploit the inherent variability of wire delays and parasitic gate delays in manufactured circuits, and may be implemented with fewer gate counts as compared with traditional cryptographic functions.

There are two important PUF parameters, first  ґ, represents the probability that the PUF output for a random input challenge is the same as the PUF output of another identical tag for the same challenge.  The probability ґ is computed as the ratio of such pairs to the total number of pairs. The second parameter, denoted μ, represents the probability that the output of a PUF for a given challenge is different from the PUF’s reference output.  We assume that the PUF is secure against side-channel attacks that try to recover the key. They propose a simple, single-use 1-step identification algorithm for preserving privacy against passive adversaries.  The tag identification algorithm is based on the classical cryptographic idea of using pseudonyms or one-time-pads to provide security.  Also described a PUF based MAC (message authentication code) protocol which is a three tuple (K, T, V) where K is the key generation algorithm, T is the tagging algorithm, and V is the verification algorithm. The algorithm K generates a key for use by algorithms T and V.  The tagging algorithm takes message m as the input, and outputs its signature ơ. The verification algorithm verifies that the Signature ơ for a message m is authentic.

The PUF-based MAC protocols they describe are different from standard cryptographic MAC algorithms. First, the keys that the verifier requires to validate a signature are large, whereas standard cryptographic MACs have short keys. Second, one of their MAC algorithms cannot verify a signature without the physical presence of the tag that signed the message, while other algorithms can not sign arbitrary messages.  Their proposed MAC protocols can be used in some applications of “yoking-proofs”, where confirmation is sought that a group of tags are read simultaneously.  The proposed protocols are designed to resist forgery even if the signature verifiers are off-line.

Possible Attacks on the MAC Protocols

The author also discussed possible attacks against the MAC protocols based on PUFs properties and are

1. Impersonation attacks

2. Modeling attacks

3. Side-channel attacks

4. Hardware tampering attacks

Comparison of PUF With Digital Hash Functions 

Algorithm        MD4    MD5    SHA-256    AES    YUKSEL    PUF