Universally Composable RFID Identification and Authentication Protocols

Abstract

As the number of RFID applications grows, concerns about their security and privacy become greatly amplified. At the same time, the acutely restricted and cost-sensitive nature of RFID tags rules out simple reuse of traditional security/privacy solutions and calls for a new generation of extremely lightweight identification and authentication protocols.This article describes a universally composable security framework designed especially for RFID applications. We adopt RFID-specific setup, communication, and concurrency assumptions in a model that guarantees strong security, privacy, and availability properties. In particular, the framework supports modular deployment, which is most appropriate for ubiquitous applications. We also describe a set of simple, efficient, secure, and anonymous (untraceable) RFID identification and authentication protocols that instantiate the proposed framework. These protocols involve minimal interaction between tags and readers and place only a small computational load on the tag, and a light computational burden on the back-end server. We show that our protocols are provably secure within the proposed framework.

Computational Independence in the Design of Cryptographic Protocols

“…EU-CMA security prevents successful prediction of signatures in instance 2 I from signatures in instance 1 I and as digital signatures are the only cryptographic mappings, instance 2 I is unpredictable from instance 1 I and vice versa. In spite of this (weak) unpredictability, the two instances are not computationally independent, which were the case if 1 I and 2 I would use (statistically) independent signature keys. Indeed, a distinguishing algorithm being aware of the public verification algorithm could easily distinguish the case of a common key from the one with independent keys.…”

“…Note EU-CMA security for a primitive f is an example for (weak) unpredictability: we require (weak) unpredictability for any pair of random variables 12 (m , m ) , where random variable 1 m is learned via accessing the corresponding oracle and 2 m is an output of f for a fresh input.…”

“…For example when the adversary wishes to fabricate a valid digital signature or authentication code without knowing the corresponding secret key, m 1 corresponds to signatures (MAC values) obtained from the oracle for messages sent in the requests, 2 m will be the signature (MAC value) for a new message m'.…”

“…Understandably, our examination is inherently related to Canetti's universal composition framework [4], [5]. This framework has strong theoretical foundation and the corresponding analysis and design techniques have had wide application in the last decade [1][2][3], [6][7], [9][10][11][12][13][14][15][16][17][18][19][20]. Notions UP, CI and SI are defined for random variables, while notion FI is inherently related to the notion of UCsecurity of protocols.…”

A Study of Security Vulnerabilities in Mobile environment

“… Universal Composability (UC) Protocols: O-FRAP Protocol [43], Optimistic Forward Secure RFID Authentication Protocol is the first full-fledged protocol, which is proven secure in a UC-based security framework [44]. The mutual authentication, privacy-preserving, a mechanism to prevent desynchronization of secret key attack, and forward security can be achieved by this protocol.…”