SEAS: A Secure and Efficient Anonymity Scheme for Low-Cost RFID Tags

Abstract

In this paper, we propose SEAS, a novel privacy preserving, anonymous authentication scheme for RFID tags, which allows the tags to use pseudonyms instead of their true identity for authentication. Using SEAS, a tag generates random numbers and uses them to create a pseudonym as its identity for authentication. The pseudonym does not reveal the identity of the tag and the pseudonyms of multiple authentications appear random and uncorrelated to the adversary. A pseudonym can only be deciphered by the back-end authentication authority to identify the tag. No other entity in the network can link the pseudonym to the identity of the tag. Our scheme is efficient, with a tag needing to perform only simple operations such as XOR, bits shifting, bits concatenation, and random number generation. We perform security analysis of our scheme to show its effectiveness against different forms of attacks. We also perform comparison of our scheme with existing schemes in terms of efficiency in the use of resources. Our scheme performs effectively, while at the same time being better than the other popular schemes in the literature in terms of cost and computation efficiency.

SAMA: Serverless Anonymous Mutual Authentication for Low-Cost RFID Tags

“…The proposed mutual authentication schemes (server-based or serverless) generally fall into three classes, namely those using hash functions [20], [23], [28], encryption [8], [9], [10], and logical operations [15], [17]. For the first two classes, instead of comparing with all proposed schemes, we compare with the underlying techniques (hash or encryption), noting that the gates/clock cycles requirements of the schemes will be at least that required by their underlying techniques.…”

“…In [17], Misra et al proposed an efficient and anonymous scheme for passive tags that provides security against several possible attacks. However, this scheme relied on the server to authenticate the tag, thus requiring a persistent connection between the reader and the server.…”

“…While some protocols require the server during the authentication process [17], [18], [20] other are serverless, with the readers equipped with the necessary information for mutual authentication [24]. Serverless authentication is more desirable as it precludes the need for a persistent connection between the server and the readers, thus improving the scalability of the system.…”

“…Several authentication protocols have been proposed for RFID systems [14], [17], [18], [20], [24]. While some protocols require the server during the authentication process [17], [18], [20] other are serverless, with the readers equipped with the necessary information for mutual authentication [24].…”

“…RELATED WORK The proposed solutions for authentication in RFID systems, range from the use of cryptographic primitives such as hash functions [21], [27], block/stream ciphers [8], pseudo random number generators (PRNGs) [25], to those that rely on logical and bit operations [17], [20]. In [21] and [27], the proposed authentication protocols required a tag to perform hashing using hash functions, such as MD5, SHA-1, and SHA-256 to authenticate itself to the reader.…”