Risk adaptive hybrid RFID access control system

Abstract

Dynamic environments pose a challenge for traditional access control models where permissions are granted or revoked merely based on predefined and static access policies making them incapable of dynamically adapting to changing conditions. Risk adaptive access control models have been gaining more attention in the research community as an alternative approach to overcome the limitations of traditional access control models. Radio Frequency Identification (RFID) is an emerging technology widely utilized in both physical and logical access control systems because of its contactless nature, low cost, high read/write speed and long distance operation. Serverless RFID system architecture offers better availability assurance and lower implementation cost, while access rights management is easier in server‐based architecture. In this study, we continue to build on our previous research on the privacy and security of RFID access control systems without a backend database in order to overcome its limitations. We propose a hybrid design for a risk adaptive RFID access control system; that is, dynamically alternating between two access control modes, online (server‐based) and offline (serverless), to adapt to the level of risk depending on rule‐based risk scenarios and current risk value. The proposed design combines features of both serverless and risk adaptive access control systems. Copyright © 2015 John Wiley & Sons, Ltd.

Performance Analysis of SAP-NFC Protocol

“…Figure 1 illustrates the main parties to the NFC mobile payment application, as follows: (1) the credit card that is identified through the NFC mobile to deliver the payment service to the customer; (2) the point of sale (POS) that is integrated with the NFC technology; and (3) the authentication center (AuC) that serves as the trusted third party (TTP), which includes the security parameters of NFC mobiles and NFC POSs in the payment system. In general, payment is performed through the following operations [6,13,16,22,23,24]: (1) the customer tabs the NFC mobile in the range of the NFC POS to send the payment request message; (2) the NFC POS resends the payment request message to the AuC; (3) the AuC checks the security information of both POS NFC and NFC mobile devices; (4) the AuC transmits the response payment message to the NFC POS; (5) the latter authenticates the NFC mobile; (6) the NFC POS sends the response payment message to the NFC mobile; and (7) on receiving the response payment message, the NFC mobile verifies the NFC POS and completes the payment operation. Numerous authentication protocols have been proposed to overcome the security drawbacks in NFC mobile payment applications [25,26,27,28,29].…”

“…Moreover, to conceal the identities of the authentication parties, the SAP-NFC protocol renews the identities and the secret keys of the NFC devices in each successful authentication session. Consequently, this protocol can defeat existing attacks on NFC mobile payment applications [4,9,13]. NFC technology is used to establish the connection between the NFC mobile and the NFC POS [29].…”

RFID Applications and Security Review

“…However, in mobile objects, the implementation of security significantly degrades the system's performance or changes the data capture, affecting the storage of information, which has led to the development of models and policies for improving confidentiality protection and governance for object tracking data [177,178]. There are access control methods based on IPv6 [179], more simple approaches that work without a backend system [180], and hybrid systems that support online and offline modes, to adapt according to the rules [181]. These methods are used, for example, to control access for vehicles [182] and healthcare environments [182].…”

Fully Authentication Services Scheme for NFC Mobile Payment Systems

“…Numerous types of attacks have recently been found that could exploit existing weaknesses, such as desynchronization, impersonation, stolen verifier table, replay, tracking, insider, spoofing, man-in-themiddle, and password guessing attacks [28][29][30][31]. Therefore, mobile payment systems require significant improvement in order to support appropriate security services, while at the same time being reasonable for use.…”