Ahmed Qasim Abd Alhasan*
| Mohd Foad Rohani | Oras N. Hamad
© 2024 The authors. This article is published by IIETA and is licensed under the CC BY 4.0 license (http://creativecommons.org/licenses/by/4.0/).
OPEN ACCESS
This paper reviews ultra-lightweight mutual authentication protocols (UMAPs) tailored for passive radio frequency identification (RFID) tags, which face limitations in computational power and storage capacity, rendering traditional cryptographic methods inadequate. We identify critical security vulnerabilities in existing UMAPs, including replay, desynchronization, full disclosure, and denial of service attacks. In response, we propose an innovative UMAP that enhances session key management and updates session data to maintain high authenticity while minimizing execution time and memory usage. Our methodology employs T-functions and bitwise operations (AND, OR, XOR, and rotation) to develop a UMAP suitable for RFID applications. Comprehensive security analyses conducted using formal verification tools (Scyther and AVISPA) confirm that the proposed protocol effectively mitigates identified security threats. Performance evaluations reveal that our protocol achieves a total execution time of 0.033 milliseconds, significantly lower than that of existing protocols while demonstrating reduced overhead. Furthermore, we provide a comparative analysis with recent protocols, highlighting that our proposed protocol requires less storage space and exhibits ultra-lightweight cryptographic demands.
radio frequency identification, ultra-lightweight mutual authentication protocols, security attack, cryptanalysis
Using wireless methods, radio frequency identification (RFID) is an identifying technology that allows for object tracking and identification. RFID technology is now widely employed in a variety of fields, including security and healthcare. Governmental organizations and businesses were encouraged to use this technology into their applications due to its affordability and versatility.
An RFID system is made up of three primary parts: an RFID tags, an RFID reader, and a back-end server. An antenna is used to communicate between the RFID tags and readers, and integrated circuits (IC) is used for storage and computing. The RF module, control unit, and antenna are all part of the RFID reader. The reader or transceiver's job is to give the tag the energy it needs to function as well as the communication signals it needs to carry out particular tasks. The back-end server can handle hundreds of RFID tag queries since it has fast processing power and ample storage [1].
There are three categories for RFID tags: semi-active, active, and inactive. The semi-active tags have their own battery, but it is only used for the computing function; the active tags have their own battery, which is used for both transmission and computation. The passive tags, also known as low-cost RFID tags, do not have their own battery [2].
Due to their limited computational power and storage capacity, low-cost RFID tags are unable to carry out traditional security cryptography tasks. The computational capabilities of low-cost RFID tags are surpassed by the exorbitant power and memory needs of classic encryption algorithms and primitives. In order to improve the security of the RFID system with these obstacles, most researchers are tackling these issues by introducing UMAPs that simply employ basic bitwise operations.
1.1 RFID challenges
Among all automated identification systems (AIDs), RFID is the most widely used technology and maybe the most ubiquitous in history. Similar to other kinds of systems, RFID systems provide a number of dangers that make this technology very vulnerable to security breaches. A few elements of security threats are as follows:
Since each of those difficulties raises a different kind of security risk, safe RFID authentication procedures must be implemented utilizing cryptography. In the past ten years, more than a thousand RFID authentication protocols have been presented [6].
1.2 Classification of UMAPs
The procedure of authentication involves an RFID tag demonstrating, through some indicator such as tag ID and secret keys, that it is an alleged identity for the RFID reader and back-end server. Physical solutions cannot facilitate this procedure; only RFID protocols may be used. There are two stages to the authentication process for RFID systems. In order to ensure that they are communicating with a valid partner, the RFID tags and RFID readers must first authenticate themselves before starting any connection. In order to verify the authenticity of the data received, the RFID tags and RFID readers exchange data during the second phase [7].
Two parties can verify each other's identities using mutual authentication. When the RFID reader and the RFID tag are both verifying each other, this happens. Before sharing any data or keys, the RFID tag and the RFID reader should conduct mutual authentication.
Cryptographic techniques must be used by RFID systems in order to establish safe RFID authentication protocols. RFID tags are not able to perform classical security cryptography operations like stream ciphers, AES, and hash functions due to their low processing capability and storage capacity [8].
Luo et al. [9] categorized RFID authentication protocols into four types according on the tags' capabilities:
In spite of the limitations of passive RFID tags (low-cost tags), the hash functions have been used by most of the proposed protocols [14-16], therefore, engineers are confronted by non-trivial problem when trying to implement cryptographic hash functions with only 250-4K gates [17, 18].
Because of their extremely limited capabilities and the extensive use that is anticipated of them, ultra-lightweight protocols provide a challenging security problem. Because using an RFID tag that uses a protocol based on basic bitwise operations to safeguard sensitive data, such as credit card numbers, health information, or e-passport information, may be difficult. This problem has drawn attention from researchers, and as a result, numerous novel ultra-lightweight techniques are put forth annually. The current Ultra-Lightweight protocol is insufficiently secured, despite the fact that numerous additional protocols are being developed [19].
1.3 Problem statement
The widespread of radio frequency identification (RFID) systems is significantly hindered by serious security and privacy vulnerabilities, especially in low-cost RFID tags. Traditional security mechanisms often unsuitable for low-cost RFID tags due to limited processing power and memory capacity. As attackers exploit these weaknesses, there is an urgent need for effective ultra-lightweight mutual authentication protocols that can operate within such limitations. Current ultra-lightweight mutual authentication protocols, specifically designed for resource-constrained environments, demonstrate considerable shortcomings. These include vulnerabilities to desynchronization, full-disclosure attacks, and inadequate defenses against tracking and impersonation. These flaws stem from reliance on weak cryptography functions, inefficient use of random nonces, and lack of robust alternative methods and consequently, these protocols many of them fail to provide effective mutual trust or provide excessive demands on RFID tags, compromising their feasibility in real-world applications.
1.4 Contributions
This article’s main contributions are as follows:
The rest of the paper is structured as follows: In Section 1, we explain the most important challenges that is faced by this technology and summarization of the classification of authentication protocols based on the ability of tags is provided. In Section 2, the security analysis of several RFID UMAPs is presented. Section 3 describes the design of a new ultralight-weight mutual authentication protocol. The assumptions that we assumed, the new protocol’s features, the notation used, and the description of the proposed protocol are explained. Section 4 describes the security analysis for the proposed protocol in terms of formal and informal analysis to prove the authenticity, privacy, and secrecy between the RFID tags and the back-end server by using official tools Scythe and AVISPA. Performance analysis of the proposed protocol depending on the storage cost, communication messages, and resistance to de- synchronization attacks is presented in Section 5. Section 6 describes the conclusion of this paper.
In the past ten years, numerous RFID UMAPs have been presented [6]. Regretfully, the majority of the suggested protocols are open to multiple attacks [20]. We examine the RFID ultra-lightweight mutual authentication methods in depth in the following manner:
It was Lopez that designed the UMAPs basics in 2006. Three types of UMAPs were postulated by Peris-Lopez et al. [21-23], specifically M2AP [21], EMAP [22], and LMAP [23]. The three protocols that were designed made use of the triangular functions (AND, XOR, and OR). Each of these protocols has a computational cost of less than 300 gates. In 2007, the Lopez protocols underwent cryptanalysis. The researchers used the T-function's vulnerability to carry out a variety of attacks, including replay, full disclosure, and desynchronization assaults. The inability of the Lopez measures to stop these kinds of attacks was demonstrated by studies [24, 25].
Chien [8] proposed the SASI protocol in 2007. Rot(x, y), a left rotation function, was the non-T-function that Chien employed. As reported by Chien [8], the rotation function is described along with the prerequisites needed to put it into practice. The SASI protocol's cryptanalysis was first presented by Hernandez-Castro et al. [26] in 2008, and it was later provided by some researchers [27-29]. The rotation function employed by the SASI protocol has a flaw that the researchers intended to exploit in order to present attacks related to traceability, complete disclosure, and desynchronization.
A new UMAP (LMAP+) was proposed by Li in 2008 [30]. Li [30] achieved safe mutual authentication between the RFID tag and RFID reader by using only bitwise operations (T-function). Li [30] demonstrated how the suggested procedure prevents forgeries and is resistant to Man in the Middle attacks. Based on computational complexity, storage, and communication, the author compared the suggested protocol with the LMAP protocol, as indicated in Table 1. Safkhani et al. [31] suggested the first attack on the LMAP+ protocol. Safkhani demonstrates that LMAP+ fails to meet the security requirement of traceability and that the protocol is unable to thwart a desynchronization attack.
Subsequently, protocols were presented by Peris-Lopez et al. [32] and David and Prasad [33] that involved the development of a single non-T-function in order to enhance the earlier protocols. These protocols' susceptibilities to several types of assaults were revealed via cryptanalysis [34, 35].
Yeh et al. [34] presented a redesigned UMAP in 2010. This protocol was proposed by implemented a T-function, Rot function, and random number. The authors demonstrated that every passive assault can be resisted by this technique. These protocols' security study revealed that they are vulnerable to a number of different types of attacks.
Engels et al. [36] proposed the Hummingbird-1 protocol in 2011, using an extremely lightweight cryptography method to introduce a new UMAP. Further details on Hummingbird-1 are presented in the reference [36]. Subsequently, Saarinen [37] demonstrated that for some cryptographic applications, the Hummingbird-1 protocol might not provide sufficient security. This protocol, which was an improved version of Hummingbird-1, was suggested as Hummingbird-2. The Hummingbird-2 cryptographic algorithm was utilized in the protocol's construction, and its designers have demonstrated that it can withstand prevalent attacks aimed at jeopardizing the security and privacy of RFID systems. Zhang et al. [38] identified a few hummingbird-2 protocol flaws. The results of the cryptanalysis indicate that the Hummingbird-2 encryption is vulnerable to related key attacks.
The UMAPs were enhanced by employing several non-T-functions after 2011. One of the RFID UMAPs that was created by utilizing the permutation function is RAPP [39]. This protocol allows for mutual authentication between RFID readers and RFID tags by using rotation Rot(x, y) and permutation Per(x, y). However, this also increases the protocol execution time and memory requirements. The RAPP has been the target of full disclosure and desynchronization attacks by some researchers [40, 41] who took advantage of the permutation function's flaws.
For a concise and lightweight authentication protocol (SLAP), Luo et al. [9] developed a new ultra-lightweight primitive in 2016. They called it the conversion function Conv(x, y). Safkhani and Bagheri [42] presented a security study [9] and showed that a desynchronization attack could be carried out in just five authentication sessions between the RFID tags and the RFID readers.
Table 1. LMAP and LMAP+ comparison
|
Protocols |
Computational Overhead (Tag: Reader) |
Storage Overhead (Tag: Reader) |
Communication Overhead (Bits) |
|
LMAP [23] |
$+, \bigvee, \bigwedge, \bigoplus$ |
480: 6NL |
384 |
|
385: 5NL |
288 |
||
|
LMAP+[30] |
$+, \bigoplus$ |
|
|
Several cryptanalysis studies, including those found in references [12, 43-45], have been proposed in 2017 to demonstrate or present a number of security breaches against the earlier UMAPs. Zhuang et al. [20] introduced de-synchronization and replay attacks aimed at ultra-lightweight mutual authentication protocols. His findings demonstrated that the de-synchronization attack put out in this research is insurmountable for all UMAPs based on T-functions.
Based on the review, we can infer that several UMAPs have been developed in the last decade; nevertheless, cryptanalysis studies have demonstrated that all of these procedures are susceptible to various types of attacks, as shown in Table 2 which summarizes the advances in the proposed UMAPs and detected attacks.
Table 2. Current research on UMAPs
|
Year |
Protocols |
Year |
Attacks |
|
2006 |
M2AP [21], EMAP [22] and LMAP [23] |
2007 |
[24, 25] |
|
2007 |
(SASI) protocol [8] |
2008 |
[26] |
|
2009 |
[27] |
||
|
2010 |
[29] |
||
|
2011 |
[28] |
||
|
2008 |
Gossamer protocol [32] |
2010 |
[35] |
|
LMAP+ protocol [30] |
2011 |
[31] |
|
|
2010 |
Yeh et al. [34] |
2010 |
[35] |
|
2011 |
Hummingbird-1 [36] |
2011 |
[37] |
|
2012 |
RAPP protocol [39] |
2013 |
[46] |
|
2013 |
RAPLT protocol [46] |
2015 |
[47] |
|
2016 |
SLAP [9] |
2016 |
[42] |
|
2018 |
Zhuang et al. [20] showed that all mentioned ultralight-weight RFID protocols that used redundancy mechanism by store old keys on both side and one side will not be prevent of the proposed replay attacks and desynchronization attack. |
||
Based on the operators employed in ultra-lightweight RFID authentication protocols, we categorize these protocols into three classes, highlighting their respective limitations and vulnerabilities as follows:
(1) T-function
(2) Non-T-function
(3) Multiple Non-T-functions
The new ultralight-weight mutual authentication protocol (UMAP) designed and developed by implementing the rotation operator, the mechanism of the secret keys, and T-function. In this section, we explain the proposed protocol in detail.
3.1 Assumptions
Based on the following assumptions, we present an ultralight-weight RFID mutual authentication protocol:
3.2 Protocol design
There are several features that our proposed protocol possesses as following:
Before starting any tag readings, the back-end server designates the initial values in the database, and in the RFID, tag as summarized below:
3.3 Protocol description
The proposed protocol consists of three phases: the Identification Phase, the Server Authentication and Update Phase, and the Tag Authentication and Update Phase. An overview of the protocol is illustrated in Figure 1, and it is executed according to the steps depicted in Figure 1.
Figure 1. The proposed Ultralight-weight RFID mutual authentication protocol
Identification phase
$M 1=(S D \oplus n 1)$ (1)
$T_{S 1}^{\prime}=\left(n 1 \oplus T_{S 1}\right) \wedge(n 1 \oplus S I D)$ (2)
$M 2=\left(S I D \oplus T_{S 1}^{\prime}\right)$ (3)
$M 3=\left(I D S_{\text {new }} \oplus T_{S 1}^{\prime}\right)$ (4)
$M 4={Rot}\left(K 1_{\text {new }} \oplus T_{S 1}^{\prime}, K 2_{\text {new }}\right)$ (5)
And sends M2, M3, and M4 to the RFID reader.
Server authentication and update phase
- If IDS=IDSnew then st=new, (IDSnew, K1new, K2new) and re-computes M4′=Rot (K1new $\oplus$ TS1, K2new) in order authenticate the RFID tag.
- If IDS=IDSold then st=old, (IDSold, K1old, K2old) and re-computes M4′=Rot(K1old $\oplus$ TS1, K2old) in order authenticate the RFID tag.
- Else if the server doesn’t find any match with IDS in the database or M4′, M4, then the server sends an ending notification to the reader in order to terminate this session.
$K 1^{\prime}={Rot}\left(K 1_{s t} \oplus n 1, I D S_{s t}\right)$ (6)
$K 2^{\prime}={Rot}\left(K 2_{s t} \oplus T_{s 1}, I D S_{s t}\right)$ (7)
$M 5={Rot}\left(K 1_{s t} \oplus K 2^{\prime}\right) \wedge\left(K 1^{\prime} \oplus K 2_{s t}\right)$ (8)
- If st=new
$I D S_{\text {old }}=I D S_{\text {new }}$ (9)
$I D S_{\text {new }}=(I D S \oplus I D) \vee\left(n 1 \oplus T_{s 1}\right)$ (10)
$K 1_{ {OLD }}=K 1_{ {new }}, K 1_{ {new }}=K 1^{\prime}$ (11)
$K 2_{{OLD }}=K 2_{ {new }}, K 2_{ {new }}=K 2^{\prime}$ (12)
- Else if st=old where the IDS is found in $IDS_{old}$: No update
Tag authentication and update phase
$K 1^{\prime}={Rot}\left(K 1_{\text {new }} \oplus n 1, I D S_{n e w}\right)$ (13)
$K 2^{\prime}={Rot}\left(K 2_{\text {new }} \oplus T_{s 1}, I D S_{\text {new }}\right)$ (14)
$M 5^{\prime}=\left(K 1_{\text {new }} \oplus K 2^{\prime}\right) \wedge\left(K 1^{\prime} \oplus K 2_{\text {new }}\right)$ (15)
$I D S_{\text {new }}=(I D S \oplus I D) \vee\left(n 1 \oplus T_{s 1}\right)$ (16)
$K 1_{\text {new }}=K 1^{\prime}, K 2_{\text {new }}=K 2^{\prime}, T_{S 1}=T_{S 1}^{\prime}$ (17)
Else if M5 is not received, or the computed M5′ is not equal to the received M5, the RFID tag neglects all previous steps and keeps all current values unchanged.
This section examines how our proposed UMAP aligns with the objectives of this study by conducting both formal and informal security analyses. Through these analyses, we aim to provide a comprehensive evaluation of the protocol's security features, demonstrating its resilience against various threats and vulnerabilities. By employing rigorous methodologies, we intend to substantiate our claims regarding the effectiveness of the proposed UMAP in ensuring secure and efficient communications in relevant applications. Integrating both formal verification and practical security assessments will enhance our understanding of the protocol's robustness and capacity to address the challenges identified in the literature.
4.1 Informal analysis
The robust security provided by our proposed protocol, particularly its resilience against various attacks, surpasses that of the other protocols illustrated in Table 3.
Table 3. Security threats in current UMAPs
|
Protocol |
Attacks |
||||
|
De-Synchronization |
Replay |
Full-Disclosure |
Traceability |
DoS |
|
|
[8] |
✗ |
✓ |
✗ |
✓ |
✗ |
|
[9] |
✗ |
✗ |
✗ |
✓ |
✓ |
|
[21] |
✗ |
✓ |
✗ |
✗ |
✓ |
|
[22] |
✗ |
✗ |
✓ |
✓ |
✗ |
|
[32] |
✗ |
✗ |
✗ |
✓ |
✓ |
|
[39] |
✗ |
✗ |
✓ |
✓ |
✗ |
|
[46] |
✗ |
✓ |
✓ |
✓ |
✗ |
|
[47] |
✗ |
✓ |
✓ |
✓ |
✗ |
|
[48] |
✗ |
✗ |
✓ |
✓ |
✗ |
|
Proposed protocol |
✓ |
✓ |
✓ |
✓ |
✓ |
4.2 Formal analysis
In this section, we formally analyze our proposed protocol and prove the authenticity and secrecy between the RFID tags and the back-end server are achieved, for this purpose the Scyther [49] and AVISPA [50] tools are used.
Figure 2. The Scyther analysis results
4.2.1 Scyther analysis
One of the most important formal security analysis tools to check the authenticity of the transmitted messages between the back-end server and tags in the protocols is Scyther. It employs a model-checking approach to analyze the correctness of protocols against specific security properties. Scyther allows users to specify security properties that need verification, such as secrecy (ensuring that certain information is not disclosed) and authenticity (ensuring that messages are genuinely from the claimed sender). The tool systematically searches for attacks against the specified security properties. It looks for scenarios where an attacker could intercept, modify, or inject messages to violate the protocol's security guarantees. We used Scyther to perform a formal security analysis of our proposed protocol based on the Dolev and Yao model [51], which is suitable for analyzing security protocols with an unbounded number of instances. We made the formal analysis of the proposed protocol depending on three goals secret, aliveness, and agreement. There are three roles defined, namely as Server (S), Reader (R), and Tag (Ti). N1 and N2 are random numbers defined as Nonce; and IDS (tag identifier), SID (server identifier) and K1, K2, K4, K4 (tag shares keys) are defined as Data. The XoR is defined as global functions.
The role Server and role Tag are sharing a secret goal through the six values of shares secret keys: IDS, SID, K1, K2, K3 and K4 as follows:
claim_S1(S, Secret, IDS);
claim_S2(S, Secret, SID);
claim_S3(S, Secret, K1);
claim_S4(S, Secret, K2);
claim_S5(S, Secret, K3);
claim_S6(S, Secret, K4);
claim_Ti1(Ti, Secret, SID);
claim_Ti2(Ti, Secret, IDS);
claim_Ti3(Ti, Secret, K1);
claim_Ti4(Ti, Secret, K2);
claim_Ti5(Ti, Secret, K3);
claim_Ti6(Ti, Secret, K4);
Also, both roles claim to be alive and share the agreement and synchronization goals as follows:
claim_S7(S, Niagree);
claim_S8(S, Alive);
claim_Ti7(Ti, Alive);
claim_Ti8(Ti, Niagree);
claim_Ti9(Ti, Nisynch);
The Scyther verified proposed protocol and shows there are no attacks within bounds as shown in Figure 2.
4.2.2 AVISPA analysis
The other formal security analysis tool is AVISPA. This tool is used for validation of the security protocols by using formal modelling [50]. To describe any protocol in AVISPA we must be using a language called High-Level Protocol Specification Language (HLPSL), this language validates the security protocol specifies. We made a formal analysis of the proposed protocol with consideration to required security properties such as authentication and secrecy in HLPSL.
We made a formal analysis of the proposed protocol with consideration to required security properties such as authentication and secrecy in HLPSL.
witness (Server, Tag, Protocolid, Information)
request (Tag, Server, Protocolid, Information)
When the RFID tag wants to authenticate the back-end server the witness predicate is used that is mean the back-end server is the witness for the Information. Whenever the RFID tag wants to requests to verify the Information the request predicate is used. The authentication_on id is the goal’s section of authentication property in the HLPSL script where the id is the label of type protocol_id. If any tools of the back-end will find a trace that produces by an agent except the Server and in this trace found the request event was preceded by a witness event. Therefor will be reported about this attack, Moreover, if there is no valid witness found for request then will be reported about an attack trace.
secret (secret-information, protocol_id, Tag, Server)
This declares the secret information(secret-information) as a secret shared between Tag and Server. The label protocol_id of type (protocolid) is used to HLPSL goal identity. The statement (secrecy_of ids) in HLPSL goal’s section must be presented in order to refer to it.
Tag and server defined as basic roles in our script, each one of them shares key (K) and text (IDS). N1 and N2 defined as random numbers and we used new function to freshly generated them. Channel(dy) also has been declared. The intruder is identified in the environment role section and we assumed that agents (Tag and Server) are known by the intruder.
OFMC and CL-AtSe back-ends are support XOR properties, when the others back-ends (SATMC and TA4SP) did not. By OFMC and CL-AtSe back-ends our protocol results have come secure as shown in Figures 3 and 4, which means that the protocol successfully meets the specified goal. Therefore, we can say that our protocol satisfies mutual authentication and confidentiality of sensitive data, compared to a passive intruder, as specified in the role of the environment.
Figure 3. OFMC analysis results
Figure 4. CL-at analysis results
This section presents a comparative analysis of the performance parameters related to ultra-lightweight mutual authentication protocols, evaluating our proposed protocol's effectiveness in meeting the objectives of this study.
Table 4 illustrates the efficiency of our proposed protocol in relation to existing alternatives. Notably, our protocol necessitates less storage (6L) compared to the other protocols, all of which require 7L. Additionally, it achieves a competitive total communication message count for authentication (4L). Furthermore, the protocol minimizes the tag's communication messages to 2L, which aligns with our objective of enhancing efficiency without compromising security. These metrics emphasize the advantages of our approach, demonstrating its potential for practical implementation in RFID systems.
The total execution time for the solution proposed by Mujahid et al. [19] is calculated based on the number of operations required. Specifically, the solution necessitates nine XOR operations (Txor), fifteen hash function operations (Th), and ten rotation function operations (Trot). Consequently, the overall execution time is expressed as 9Txor+15Th+10Trot=3.824 milliseconds. The protocol proposed described by Sun et al. [14] used twelve XOR operations (Txor) and four hash function operations (Th), Therefore, the total execution time is 12Txor+4Th=1.024 milliseconds. The protocol proposed described by Wei et al. [13] used seven hash functions Therefore, the total execution time is 7Th=1.771 milliseconds. Our proposed protocol needs eighteen XOR operation Txor, five of AND and OR operations, and five of rotation function operations (Trot) therefore, the total execution time is 18Txor+5T(and, or)+5Trot=0.033 milliseconds, as shown in Table 6.
Table 4. Comparison of communication and storage metrics for UMAPs and our proposed protocol
|
Metric |
Ref. [19] |
Ref. [9] |
Ref. [43] |
Ref. [44] |
Our Protocol |
|
Storage |
7L |
7L |
7L |
7L |
6L |
|
Total communication messages for authentication |
6L |
4L |
4L |
17L |
4L |
|
Tag's communication messages |
2L |
2L |
3L |
5L |
2L |
Table 5. Execution times of operations
|
Symbols |
Descriptions |
Execution Time (Millisecond) |
|
Txor |
Execution time for the XOR operation |
0.001 |
|
Tor |
Execution time for the OR operation |
0.001 |
|
Tand |
Execution time for the AND operation |
0.001 |
|
Tadd |
Execution time for the Addition operation |
0.001 |
|
Trot |
Execution time for the Rot operation |
0.002 |
|
Th |
Execution time for the hash function |
0.253 |
Table 6. Comparison of protocols' computational overhead and execution time
|
Protocols |
Total Computational Overhead |
Total Execution Time (ms) |
|
Ref. [19] |
9Txor+15Th+10Trot |
3.824 |
|
Ref. [14] |
12Txor+4Th |
1.024 |
|
Ref. [13] |
7Th |
1.771 |
|
Proposed protocol |
18Txor+5T(and, or)+5Trot |
0.033 |
Since the communications between the RFID tags and the RFID readers are carried out through an unprotected wireless channel, RFID systems, like other wireless technologies, face a new set of difficulties. As a result, there are various kinds of attacks that can target RFID systems. Furthermore, it was noted that every Mutual Authentication Protocol that had previously been suggested was open to several replay and desynchronization attacks. The subsection 1.2 noted that the RFID tags have limited processing power and storage capacity, which prevents them from carrying out the traditional security cryptography functions.
The computational capabilities of low-cost RFID tags are surpassed by the exorbitant power and memory needs of classic encryption algorithms and primitives. Because of this, the majority of academics are tackling these problems by creating a protocol that strengthens the security of the RFID system while overcoming these obstacles.
In this paper, we claim that there are two constraints in terms of RFID tag security present in most proposed protocols. First off, since RFID tags are limited in their ability to serve certain functions, the authors did not indicate which class of tags the suggested protocol is meant for. Secondly, numerous writers failed to indicate which class their suggested protocols fall into. Low-cost RFID tags are inappropriate for implementing UMAPs since they are based on hash functions, which are the most frequent type of protocol.
Because using an RFID tag that uses a protocol based on basic bitwise operations to safeguard sensitive data, such as credit card numbers, health information, or e-passport information, may be difficult. This problem has drawn attention from researchers, and as a result, numerous novel Ultra-Lightweight techniques are put forth annually. The current UMAP is insufficiently protected, despite the fact that numerous additional protocols are being devised.
In conclusion, the development of a new UMAP is critical for ensuring the security of RFID systems against prevalent attacks discussed in this paper. Our proposed UMAP is designed to meet the initial objectives outlined, with security analyses conducted using formal verification tools (Scyther and AVISPA) confirming its resilience to various attacks. Performance analysis reveals that our protocol requires only 6L of storage and achieves a competitive total communication message count for authentication of 4L, while reducing the tag's communication messages to 2L, thereby enhancing efficiency without compromising security. The total execution time of our proposed protocol is a mere 0.033 milliseconds, demonstrating its practicality for real-world applications. However, several limitations must be considered: the protocol's performance may be affected by environmental constraints, such as interference from external signals and signal collisions in densely populated areas; scalability issues may arise as the number of RFID tags increases, potentially creating bottlenecks in session key management; and while the protocol is designed to resist common attacks, it may not be robust against advanced threats like side-channel attacks or physical tampering. Moreover, effective key management is crucial; compromised keys could jeopardize overall security, and variations in hardware capabilities may limit applicability for extremely low-cost RFID tags. Future research should focus on enhancing robustness to environmental factors, investigating scalable architectures, strengthening defenses against advanced attacks, innovating key management practices, and conducting empirical studies across diverse RFID tag models. By addressing these limitations and pursuing the suggested areas for future research, the proposed UMAP can be further improved, ensuring its effectiveness and security across a broader range of scenarios.
|
ID |
The RFID tag’s unique identity |
|
IDS |
RFID tag’s pre-shares a pseudonym shared between tag and server |
|
SID |
Server pre-shares a pseudonym shared between server and RFID tag’s |
|
TS1 |
Secret Key for each RFID tag |
|
K1/K2 |
Secret Keys for each RFID tag with the back-end server |
|
IDSold |
The old value of IDS |
|
IDSnew |
The new value of key IDS |
|
K1old |
The old value of K1 |
|
K1new |
The new value of K1 |
|
K2old |
The old value of K2 |
|
K2new |
The new value of K2 |
|
n1 |
Random numbers generated by reader |
|
st |
Back-end server value is kept old or new to show if the tag uses new or old of values K1/K2 and IDS |
|
$\bigoplus$ |
Bitwise-XOR operation |
|
$\bigwedge$ |
Bitwise-AND operation |
|
$\bigvee$ |
Bitwise-OR operation |
|
Rot (a, b) |
Left rotate the value of a with b bits |
|
R →T: M |
R sends to T, message M |
[1] Younis, M.I., Abdulkareem, M.H. (2017). ITPMAP: An improved three-pass mutual authentication protocol for secure RFID systems. Wireless Personal Communications, 96: 65-101. https://doi.org/10.1007/s11277-017-4152-0
[2] Geng, L., Wei, X.Z., Zhang, J., Feng, X. (2023). A semi-numerical analysis of observations in passive tag-to-tag communications. Mathematical Modelling of Engineering Problems, 10(1): 31-38. https://doi.org/10.18280/mmep.100104
[3] Juels, A. (2006). RFID security and privacy: A research survey. IEEE Journal on Selected Areas in Communications, 24(2): 381-394. https://doi.org/10.1109/JSAC.2005.861395
[4] Jones, P., Clarke‐Hill, C., Hillier, D., Comfort, D. (2005). The benefits, challenges and impacts of radio frequency identification technology (RFID) for retailers in the UK. Marketing Intelligence & Planning, 23(4): 395-402. https://doi.org/10.1108/02634500510603492
[5] Cao, T., Bertino, E., Lei, H. (2008). Security analysis of the SASI protocol. IEEE Transactions on Dependable and Secure Computing, 6(1): 73-77. https://doi.org/10.1109/TDSC.2008.32
[6] Khalid, M., Mujahid, U., Najam-ul-Islam, M. (2018). Cryptanalysis of ultralightweight mutual authentication protocol for radio frequency identification enabled Internet of Things networks. International Journal of Distributed Sensor Networks, 14(8). https://doi.org/10.1177/1550147718795120
[7] Khattab, A., Jeddi, Z., Amini, E., Bayoumi, M. (2017). RFID security threats and basic solutions. In RFID Security: A Lightweight Paradigm, Springer, Cham, pp. 27-42. https://doi.org/10.1007/978-3-319-47545-5_2
[8] Chien, H.Y. (2007). SASI: A new ultralightweight RFID authentication protocol providing strong authentication and strong integrity. IEEE Transactions on Dependable and Secure Computing, 4(4): 337-340. https://doi.org/10.1109/TDSC.2007.70226
[9] Luo, H., Wen, G., Su, J., Huang, Z. (2018). SLAP: Succinct and lightweight authentication protocol for low-cost RFID system. Wireless Networks, 24: 69-78. https://doi.org/10.1007/s11276-016-1323-y
[10] Chou, J.S., Chen, Y., Wu, C.L., Lin, C.F. (2011). An efficient RFID mutual authentication scheme based on ECC. Cryptology ePrint Archive, pp. 1-20. https://ia.cr/2011/418.
[11] Shen, J., Tan, H., Chang, S., Ren, Y., Liu, Q. (2015). A lightweight and practical RFID grouping authentication protocol in multiple-tag arrangements. In 2015 17th International Conference on Advanced Communication Technology (ICACT), PyeongChang, Korea (South), pp. 681-686. https://doi.org/10.1109/ICACT.2015.7224882
[12] Khalid, M., Mujahid, U. (2017). Security framework of ultralightweight mutual authentication protocols for low cost RFID tags. In 2017 International Conference on Communication, Computing and Digital Systems (C-CODE), Islamabad, Pakistan, pp. 26-31. https://doi.org/10.1109/C-CODE.2017.7918896
[13] Wei, C.H., Hwang, M.S., Chin, A.Y.H. (2017). A secure privacy and authentication protocol for passive RFID tags. International Journal of Mobile Communications, 15(3): 266-277. https://doi.org/10.1504/IJMC.2017.083462
[14] Sun, H., Li, P., Xu, H., Zhu, F. (2019). An improvement RFID security authentication protocol based on hash function. In Innovative Mobile and Internet Services in Ubiquitous Computing: Proceedings of the 12th International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS-2018), Springer, Cham, pp. 375-384. https://doi.org/10.1007/978-3-319-93554-6_35
[15] Al-Adhami, A., Ambroze, M., Stengel, I., Tomlinson, M. (2017). A 256 bit implementation of ECC-RFID based system using Shamir secret sharing scheme and Keccak hash function. In 2017 Ninth International Conference on Ubiquitous and Future Networks (ICUFN), Milan, Italy, pp. 165-171. https://doi.org/10.1109/ICUFN.2017.7993768
[16] Cho, Y., Kim, K.M., Iqbal, A., Lee, T.J. (2017). Efficient traffic control using hash function filter for massive IoT computational RFID communications. In Proceedings of the 2017 International Conference on Information Technology, pp. 297-301. https://doi.org/10.1145/3176653.3176725
[17] López, P.P., Castro, D.D.J.C.H., Garnacho, D.A.R. (2008). Lightweight cryptography in radio frequency identification (RFID) systems. Computer Science Department, Carlos III University of Madrid, p. 270.
[18] Ranasinghe, D.C., Engels, D.W., Cole, P.H. (2005). Low cost RFID systems: Confronting security and privacy. Paper Auto-ID Labs White Paper Journal, 1.
[19] Mujahid, U., Najam-ul-Islam, M., Jafri, A.R., Qurat-ul-Ain, Ali Shami, M. (2016). A new ultralightweight RFID mutual authentication protocol: Sasi using recursive hash. International Journal of Distributed Sensor Networks, 12(2): 9648971. https://doi.org/10.1155/2016/9648971
[20] Zhuang, X., Zhu, Y., Chang, C.C., Peng, Q. (2018). Security issues in ultralightweight RFID authentication protocols. Wireless Personal Communications, 98(1): 779-814. https://doi.org/10.1007/s11277-017-4895-7
[21] Peris-Lopez, P., Hernandez-Castro, J.C., Estevez-Tapiador, J.M., Ribagorda, A. (2006). M 2 AP: A minimalist mutual-authentication protocol for low-cost RFID tags. In Ubiquitous Intelligence and Computing: Third International Conference, UIC 2006, Wuhan, China, pp. 912-923. https://doi.org/10.1007/11833529_93
[22] Peris-Lopez, P., Hernandez-Castro, J.C., Estevez-Tapiador, J.M., Ribagorda, A. (2006). EMAP: An efficient mutual-authentication protocol for low-cost RFID tags. In on the Move to Meaningful Internet Systems 2006: OTM 2006 Workshops. OTM 2006, Berlin, Heidelberg. https://doi.org/10.1007/11915034_59
[23] Peris-Lopez, P., Hernandez-Castro, J.C., Estévez-Tapiador, J.M., Ribagorda, A. (2006). LMAP: A real lightweight mutual authentication protocol for low-cost RFID tags. In Proceedings of 2nd Workshop on RFID Security, vol. 6.
[24] Li, T., Deng, R. (2007). Vulnerability analysis of EMAP-an efficient RFID mutual authentication protocol. In the Second International Conference on Availability, Reliability and Security (ARES'07), Vienna, Austria, pp. 238-245. https://doi.org/10.1109/ARES.2007.159
[25] Li, T., Wang, G. (2007). Security analysis of two ultra-lightweight RFID authentication protocols. In IFIP International Information Security Conference, Boston, US, pp. 109-120. https://doi.org/10.1007/978-0-387-72367-9_10
[26] Hernandez-Castro, J.C., Tapiador, J.M., Peris-Lopez, P., Quisquater, J.J. (2008). Cryptanalysis of the SASI ultralightweight RFID authentication protocol with modular rotations. arXiv Preprint arXiv:0811.4257. https://doi.org/10.48550/arXiv.0811.4257
[27] Phan, R.C.W. (2008). Cryptanalysis of a new ultralightweight RFID authentication protocol-SASI. IEEE Transactions on Dependable and Secure Computing, 6(4): 316-320. https://doi.org/10.1109/TDSC.2008.33
[28] Sun, H.M., Ting, W.C., Wang, K.H. (2009). On the security of Chien's ultralightweight RFID authentication protocol. IEEE Transactions on Dependable and Secure Computing, 8(2): 315-317. https://doi.org/10.1109/TDSC.2009.26
[29] Avoine, G., Carpent, X., Martin, B. (2010). Strong authentication and strong integrity (SASI) is not that strong. In Radio Frequency Identification: Security and Privacy Issues. RFIDSec 2010, Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-16822-2_5
[30] Li, T. (2008). Employing lightweight primitives on low-cost RFID tags for authentication. In 2008 IEEE 68th Vehicular Technology Conference, Calgary, AB, Canada, pp. 1-5. https://doi.org/10.1109/VETECF.2008.290
[31] Safkhani, M., Bagheri, N., Naderi, M., Sanadhya, S.K. (2011). Security analysis of LMAP++, an RFID authentication protocol. In 2011 International Conference for Internet Technology and Secured Transactions, Abu, pp. 689-694.
[32] Peris-Lopez, P., Hernandez-Castro, J.C., Tapiador, J.M., Ribagorda, A. (2009). Advances in ultralightweight cryptography for low-cost RFID tags: Gossamer protocol. In Information Security Applications: 9th International Workshop, WISA 2008, Jeju Island, Korea, pp. 56-68. https://doi.org/10.1007/978-3-642-00306-6_5
[33] David, M., Prasad, N.R. (2009). Providing strong security and high privacy in low-cost RFID networks. In Security and Privacy in Mobile Information and Communication Systems: First International ICST Conference, MobiSec 2009, Turin, Italy, pp. 172-179. https://doi.org/10.1007/978-3-642-04434-2_15
[34] Yeh, K.H., Lo, N.W., Winata, E. (2010). An efficient ultralightweight authentication protocol for RFID systems. In Radio Frequency Identification System Security, pp. 49-60. https://doi.org/10.3233/978-1-60750-485-6-49
[35] Tagra, D., Rahman, M., Sampalli, S. (2010). Technique for preventing DoS attacks on RFID systems. In SoftCOM 2010, 18th International Conference on Software, Telecommunications and Computer Networks, Split, Croatia, pp. 6-10.
[36] Engels, D., Fan, X., Gong, G., Hu, H., Smith, E.M. (2010). Hummingbird: Ultra-lightweight cryptography for resource-constrained devices. In International Conference on Financial Cryptography and Data Security, pp. 3-18. https://doi.org/10.1007/978-3-642-14992-4_2
[37] Saarinen, M.J.O. (2011). Cryptanalysis of hummingbird-1. In Fast Software Encryption: 18th International Workshop, FSE 2011, Lyngby, Denmark, pp. 328-341. https://doi.org/10.1007/978-3-642-21702-9_19
[38] Zhang, K., Ding, L., Guan, J. (2012). Cryptanalysis of hummingbird-2. IACR Cryptology ePrint Archive, Report, 2012.
[39] Tian, Y., Chen, G., Li, J. (2012). A new ultralightweight RFID authentication protocol with permutation. IEEE Communications Letters, 16(5): 702-705. https://doi.org/10.1109/LCOMM.2012.031212.120237
[40] Wang, S.H., Han, Z.J., Liu, S.J., Chen, D.W. (2012). Security analysis of RAPP an RFID authentication protocol based on permutation. IACR Cryptology ePrint Archive, 2012: 327.
[41] Ahmadian, Z., Salmasizadeh, M., Aref, M.R. (2013). Desynchronization attack on RAPP ultralightweight authentication protocol. Information Processing Letters, 113(7): 205-209. https://doi.org/10.1016/j.ipl.2013.01.003
[42] Safkhani, M., Bagheri, N. (2016). Generalized desynchronization attack on UMAP: Application to RCIA, KMAP, SLAP and SASI $^+$ protocols. Cryptology ePrint Archive, pp. 905-912.
[43] Tewari, A., Gupta, B.B. (2017). Cryptanalysis of a novel ultra-lightweight mutual authentication protocol for IoT devices using RFID tags. The Journal of Supercomputing, 73: 1085-1102. https://doi.org/10.1007/s11227-016-1849-x
[44] Aghili, S.F., Ashouri-Talouki, M., Mala, H. (2018). DoS, impersonation and de-synchronization attacks against an ultra-lightweight RFID mutual authentication protocol for IoT. The Journal of Supercomputing, 74: 509-525. https://doi.org/10.1007/s11227-017-2139-y
[45] Wang, K.H., Chen, C.M., Fang, W., Wu, T.Y. (2018). On the security of a new ultra-lightweight authentication protocol in IoT environment for RFID tags. The Journal of Supercomputing, 74: 65-70. https://doi.org/10.1007/s11227-017-2105-8
[46] Jeon, I.S., Yoon, E.J. (2013). A new ultra-lightweight RFID authentication protocol using merge and separation operations. International Journal of Mathematical Analysis, 7(52): 2583-2593.
[47] Wang, S., Liu, S., Chen, D. (2015). Security analysis and improvement on two RFID authentication protocols. Wireless Personal Communications, 82: 21-33. https://doi.org/10.1007/s11277-014-2189-x
[48] Rama, N., Suganya, R. (2010). SSL-map: A more secure gossamer-based mutual authentication protocol for passive RFID tags. International Journal on Computer Science and Engineering, 2: 363-367.
[49] Cremers, C.J. (2008). The Scyther tool: Verification, falsification, and analysis of security protocols: Tool paper. In International Conference on Computer Aided Verification, pp. 414-418. https://doi.org/10.1007/978-3-540-70545-1_38
[50] Armando, A., Basin, D., Boichut, Y., Chevalier, Y., Compagna, L., Cuéllar, J., Drielsma, P.H., Heám, P.C., Kouchnarenko, O., Mantovani, J., Mödersheim, S., von Oheimb, D., Rusinowitch, M., Santiago, J., Turuani, M., Viganò, L., Vigneron, L. (2005). The AVISPA tool for the automated validation of internet security protocols and applications. In Computer Aided Verification: 17th International Conference, CAV 2005, Edinburgh, Scotland, UK, pp. 281-285. https://doi.org/10.1007/11513988_27
[51] Dolev, D., Yao, A. (1983). On the security of public key protocols. IEEE Transactions on Information Theory, 29(2): 198-208. https://doi.org/10.1109/TIT.1983.1056650
