Security of RFID systems

V. Belsky, E. Griboedova, K. Tsaregorodtsev, A. Chichaeva

Abstract


Radio-frequency tags (RFID tags) are widely used throughout the world to identify and authenticate objects. Due to the architectural features and in order to minimize implementation cost RFID tags are often subject to considerable restrictions (memory resources, computing power, chip area, etc), which, in turn, has a significant impact on the used cryptographic mechanisms and protocols. Existing cryptographic standards from other fields are not suitable for RFID systems, that is why the development of new RFIDspecific algorithms is necessary. In this article, we give a classification of RFID systems and describe typical scenarios for their use. We focus on the comparative analysis of the existing cryptographic mechanisms, considering the particularities of radio-frequency identification systems. We list important operational and cryptographic features that must be taken into account during RFID system development. We conclude with an overview of currently known security models that are used to analyze cryptographic protocols for RFID systems.

Full Text:

PDF (Russian)

References


Das Raghu. RFID Forecasts, Players and Opportunities 2019-2029. The complete analysis of the global RFID industry. — URL: https://www.idtechex.com/en/research-report/ rfid-forecasts-players-and-opportunities-2019-2029/700. access date: 22.06.2021.

Grigor’eva Anastasiya. RFID v 2015 i v 2020 godu // Komponenty i tekhnologii. — 2021. — Vol. 3. — In Russian.

Scharfeld Tom Ahlkvist. An analysis of the fundamental constraints on low cost passive radio-frequency identification system design : Ph. D. thesis / Tom Ahlkvist Scharfeld ; Massachusetts Institute of Technology. — 2001.

ISO/IEC 18000-2 Information technology - Radio frequency identification for item management - Part 2: Parameters for air interface communications below 135 kHz. — 2009.

ISO/IEC 18000-3 Information technology — Radio frequency identification for item management — Part 3: Parameters for air interface communications at 13,56 MHz. — 2010.

ISO/IEC 18000-7 Information technology — Radio frequency identification for item management — Part 7: Parameters for active air

interface communications at 433 MHz. — 2014.

ISO/IEC 18000-6 Information technology — Radio frequency identification for item management — Part 6: Parameters for air interface communications at 860 MHz to 960 MHz General. — 2013.

ISO/IEC 18000-4 Information technology — Radio frequency identification for item management — Part 4: Parameters for air interface

communications at 2,45 GHz. — 2018.

Xing Zijian. Near-Field Antenna of RFID System // Radio Frequency Identification. — 2017. — P. 5.

Nikitin Pavel V, Rao KVS, Lazar Steve. An overview of near field UHF RFID // 2007 IEEE international conference on RFID / IEEE. — 2007. — P. 167–174.

ISO/IEC 10536 Identification cards — Contactless integrated circuit(s) cards — Close-coupled cards.

ISO/IEC 14443 Cards and security devices for personal identification — Contactless proximity objects.

ISO/IEC 15693 Cards and security devices for personal identification — Contactless vicinity objects.

STMicroelectronics. — ST25TA512B, ST25TA02KB ST25TA02KB‑D, ST25TA02KB‑P Datasheet. NFC Forum Type 4 Tag IC with up to 2-Kbit EEPROM, 2018.

NXP Semiconductors. — NTAG213/215/216 NFC Forum Type 2 Tag compliant IC with 144/504/888 bytes user memory, 2015.

STMicroelectronics. — AN5085 Application note. Cycling endurance and data retention of EEPROMs in ST25DVxxx products based on CMOS F8H process, 2018.

Mezhgosudarstvennyj standart GOST 34.13-2018 Informacionnaya tekhnologiya (IT). Kriptograficheskaya zashchita informacii. Rezhimy

raboty blochnyh shifrov. — In Russian.

Shanghai Fudan Microelectronics Group Company Limited. — FM13HF02N HF RFID IC based on ISO/IEC 15693 Datasheet, 2014.

NXP Semiconductors. — MF1P(H)x2 MIFARE Plus EV2 Product short data sheet, 2020.

Fan Junfeng. Cryptographic hardware: how to make it cool, fast and secure // CHES. — 2012.

RFID security: cryptography and physics perspectives / Jorge Guajardo, Pim Tuyls, Neil Bird et al. // RFID Security. — Springer, 2008. — P. 103–130.

ISO/IEC 29167-10 Information technology — Automatic identification and data capture techniques — Part 10: Crypto suite AES- 128 security services for air interface communications. — 2017.

Towards the five-cent tag : Rep. / Technical Report MIT-AUTOIDWH-006, MIT Auto ID Center, 2001. Available from ; Executor: Sanjay E Sarma et al. : 2001.

Weis Stephen August. Security and privacy in radio-frequency identification devices : Ph. D. thesis / Stephen August Weis ; Massachusetts Institute of Technology. — 2003.

Pushing the limits: A very compact and a threshold implementation of AES / Amir Moradi, Axel Poschmann, San Ling et al. // Annual International Conference on the Theory and Applications of Cryptographic

Techniques / Springer. — 2011. — P. 69–88.

Ob odnom podhode k formalizacii zadach kriptograficheskogo analiza / E.K. Alekseev, L.R. Ahmetzyanova, A.M. Zubkov et al. // Matematicheskie Voprosy Kriptografii (Mathematical Aspects of Cryptography). — 2020. — In Russian.

Yashchenko V.V. Vvedenie v kriptografiyu.-izdanie 4 dopolnennoemcnmo: Moskva, 2012 g. — 2012. — In Russian.

RFID systems: A survey on security threats and proposed solutions / Pedro Peris-Lopez, Julio Cesar Hernandez-Castro, Juan M EstevezTapiador, Arturo Ribagorda // IFIP international conference on personal wireless communications / Springer. — 2006. — P. 159–170.

Mitrokotsa Aikaterini, Beye Michael, Peris-Lopez Pedro. Classification of RFID Threats based on Security Principles // Security Lab, Faculty of Electrical Engineering, Mathematics and Computer Science, Delft University of Technology. — 2011.

Li Yingjiu, Deng Robert H, Bertino Elisa. RFID security and privacy //

Synthesis Lectures on Information Security, Privacy, & Trust. — 2013. — Vol. 4, no. 3. — P. 1–157.

RFID security: a lightweight paradigm / Ahmed Khattab, Zahra Jeddi, Esmaeil Amini, Magdy Bayoumi. — Springer, 2016.

Zhao Kai, Ge Lina. A survey on the internet of things security //

Ninth international conference on computational intelligence and security / IEEE. — 2013. — P. 663–667.

Ali Inayat, Sabir Sonia, Ullah Zahid. Internet of things security,

device authentication and access control: a review // arXiv preprint

arXiv:1901.07309. — 2019.

Dolev Danny, Yao Andrew. On the security of public key protocols // IEEE Transactions on information theory. — 1983. — Vol. 29, no. 2. — P. 198–208.

Mao Wenbo. Modern cryptography: theory and practice. — Pearson

Education India, 2003.

Rfc 8645 re-keying mechanisms for symmetric keys. — 2019.

Damgård Ivan, Pedersen Michael Østergaard. RFID security: Tradeoffs between security and efficiency // Cryptographers’ Track at the RSA Conference / Springer. — 2008. — P. 318–332.

van Deursen Ton. 50 ways to break RFID privacy // IFIP PrimeLife

International Summer School on Privacy and Identity Management for

Life / Springer. — 2010. — P. 192–205.

Goldreich Oded. Foundations of cryptography: volume 1, basic

tools. — Cambridge university press, 2007.

Savage John E. Models of computation // Early Years. — 2014. — Vol. 4, no. 1.1. — P. 2.

Message authentication, revisited / Yevgeniy Dodis, Eike Kiltz,

Krzysztof Pietrzak, Daniel Wichs // Annual International Conference on the Theory and Applications of Cryptographic Techniques / Springer. — 2012. — P. 355–374.

Mol Petros, Tessaro Stefano. Secret-Key Authentication Beyond the

Challenge-Response Paradigm: Definitional Issues and New Protocols // Manuscript, December. — 2012.

Park Namje, Kim Marie, Bang Hyo-Chan. Symmetric key-based authentication and the session key agreement scheme in IoT environment // Computer Science and its Applications. — Springer, 2015. — P. 379–384.

ISO/IEC 29167-11 Information technology — Automatic identification and data capture techniques — Part 11: Crypto suite PRESENT-80 security services for air interface communications. — 2014.

ISO/IEC 29167-21 Information technology — Automatic identification and data capture techniques — Part 21: Crypto suite SIMON

security services for air interface communications. — 2018.

ISO/IEC 29167-22 Information technology — Automatic identification and data capture techniques — Part 22: Crypto suite SPECK

security services for air interface communications. — 2018.

Security and privacy aspects of low-cost radio frequency identification systems / Stephen A Weis, Sanjay E Sarma, Ronald L Rivest, Daniel W Engels // Security in pervasive computing. — Springer, 2004. — P. 201–212.

Cryptographic approach to “privacy-friendly” tags / Miyako Ohkubo, Koutarou Suzuki, Shingo Kinoshita et al. // RFID privacy workshop /Cambridge, USA. — Vol. 82. — 2003.

PRESENT: An ultra-lightweight block cipher / Andrey Bogdanov, Lars R Knudsen, Gregor Leander et al. // International workshop on cryptographic hardware and embedded systems / Springer. — 2007. — P. 450–466.

The SIMON and SPECK lightweight block ciphers / Ray Beaulieu, Douglas Shors, Jason Smith et al. // Proceedings of the 52nd Annual Design Automation Conference. — 2015. — P. 1–6.

Lee Jun-Ya, Lin Wei-Cheng, Huang Yu-Hung. A lightweight authentication protocol for internet of things // 2014 International Symposium on Next-Generation Electronics (ISNE) / IEEE. — 2014. — P. 1–2.

Li Ming, Dai Zhao Peng, Xi Fang. A new scheme on XOR Operation for Low-cost RFID // Applied Mechanics and Materials / Trans Tech Publ. — Vol. 303. — 2013. — P. 2207–2210.

Ren X., Xu X., Tang Hong-jun. A new mutual authentication scheme for low-cost RFID // 2007 IET Conference on Wireless, Mobile and

Sensor Networks (CCWMSN07). — 2007. — P. 170–173.

LMAP: A real lightweight mutual authentication protocol for lowcost RFID tags / Pedro Peris-Lopez, Julio Cesar Hernandez-Castro, Juan M Estévez-Tapiador, Arturo Ribagorda // Proc. of 2nd Workshop on RFID Security. — Vol. 6. — 2006.

M2AP: a minimalist mutual-authentication protocol for low-cost RFID tags / Pedro Peris-Lopez, Julio Cesar Hernandez-Castro, Juan M Estevez-Tapiador, Arturo Ribagorda // International conference on ubiquitous intelligence and computing / Springer. — 2006. — P. 912–923.

Li Ticyan, Wang Guilin. Security analysis of two ultra-lightweight RFID authentication protocols // IFIP international information security conference / Springer. — 2007. — P. 109–120.

Avoine Gildas, Carpent Xavier, Martin Benjamin. Strong authentication and strong integrity (SASI) is not that strong // International workshop on radio frequency identification: security and privacy issues / Springer. — 2010. — P. 50–64.

Schnorr Claus-Peter. Efficient identification and signatures for smart cards // Conference on the Theory and Application of Cryptology / Springer. — 1989. — P. 239–252.

Menezes Alfred J, Van Oorschot Paul C, Vanstone Scott A. Handbook of applied cryptography. — CRC press, 2018.

Kumar Sandeep, Paar Christof. Are standards compliant elliptic curve cryptosystems feasible on RFID // Workshop on RFID security / Citeseer. — 2006. — P. 12–14.

Elliptic-curve-based security processor for RFID / Yong Ki Lee, Kazuo Sakiyama, Lejla Batina, Ingrid Verbauwhede // IEEE Transactions on Computers. — 2008. — Vol. 57, no. 11. — P. 1514–1527.

A milestone towards RFID products offering asymmetric authentication based on elliptic curve cryptography / Holger Bock, Michael Braun, Markus Dichtl et al. // Invited talk at RFIDsec. — 2008.

ISO/IEC 29167-16 Information technology — Automatic identification and data capture techniques — Part 16: Crypto suite ECDSA”=ECDH security services for air interface communications. — 2015.

A low-cost PKC-based RFID authentication protocol and its implementation / Lili Wei, Zhaotong Luo, Qiang Qu et al. // 2014 Tenth International Conference on Computational Intelligence and Security / IEEE. — 2014. — P. 415–419.

Hopper Nicholas J, Blum Manuel. Secure human identification protocols // International conference on the theory and application of cryptology and information security / Springer. — 2001. — P. 52– 66.

Juels Ari, Weis Stephen A. Authenticating pervasive devices with human protocols // Annual international cryptology conference / Springer. — 2005. — P. 293–308.

Gilbert Henri, Robshaw Matthew JB, Seurin Yannick. hb# : Increasing the Security and Efficiency of HB+ // Annual International Conference on the Theory and Applications of Cryptographic Techniques / Springer. — 2008. — P. 361–378.

Bringer Julien, Chabanne Hervé, Dottax Emmanuelle. hb++: a Lightweight Authentication Protocol Secure against Some Attacks // Second international workshop on security, privacy and trust in pervasive and ubiquitous computing (SecPerU’06) / IEEE. — 2006. — P. 28–33.

Munilla Jorge, Peinado Alberto. HB-MP: A further step in the HB-family of lightweight authentication protocols // Computer Networks. — 2007. — Vol. 51, no. 9. — P. 2262–2267.

Efficient authentication from hard learning problems / Eike Kiltz, Krzysztof Pietrzak, Daniele Venturi et al. // Journal of Cryptology. — 2017. — Vol. 30, no. 4. — P. 1238–1275.

Ouafi Khaled, Overbeck Raphael, Vaudenay Serge. On the security of HB# against a man-in-the-middle attack // International Conference on the Theory and Application of Cryptology and Information Security / Springer. — 2008. — P. 108–124.

Gilbert Henri, Robshaw Matthew JB, Seurin Yannick. Good variants of HB+ are hard to find // International Conference on Financial Cryptography and Data Security / Springer. — 2008. — P. 156–170.

O’Neill Maire et al. Low-cost SHA-1 hash function architecture for RFID tags // RFIDSec. — 2008. — Vol. 8. — P. 41–51.

Feldhofer Martin, Rechberger Christian. A case against currently used hash functions in RFID protocols // OTM Confederated International Conferences” On the Move to Meaningful Internet Systems” / Springer. — 2006. — P. 372–381.

Hash functions and RFID tags: Mind the gap / Andrey Bogdanov, Gregor Leander, Christof Paar et al. // International workshop on cryptographic hardware and embedded systems / Springer. — 2008. — P. 283–299.

ISO/IEC 29167-14 Information technology — Automatic identification and data capture techniques — Part 14: Crypto suite AES OFB security services for air interface communications. — 2015.

Bellare Mihir, Rogaway Phillip. Entity authentication and key distribution // Annual international cryptology conference / Springer. — 1993. — P. 232–249.

Bellare Mihir, Rogaway Phillip. Introduction to modern cryptography // UCSD CSE. — 2005. — Vol. 207. — P. 207.

Schneier Bruce. Applied cryptography: protocols, algorithms, and source code in C. — John Wiley & sons, 2007.

Stinson Douglas Robert, Paterson Maura. Cryptography: theory and practice. — CRC press, 2018.

Wetzels Jos. Broken keys to the kingdom: Security and privacy aspects of RFID-based car keys // arXiv preprint arXiv:1405.7424. — 2014.

Brands Stefan, Chaum David. Distance-bounding protocols // Workshop on the Theory and Application of of Cryptographic Techniques / Springer. — 1993. — P. 344–359.

A framework for analyzing RFID distance bounding protocols / Gildas Avoine, Muhammed Ali Bingöl, Süleyman Kardaş et al. // Journal of Computer Security. — 2011. — Vol. 19, no. 2. — P. 289– 317.

A formal approach to distance-bounding RFID protocols / Ulrich Dürholz, Marc Fischlin, Michael Kasper, Cristina Onete // International Conference on Information Security / Springer. — 2011. — P. 47–62.

Katz Jonathan, Lindell Yehuda. Introduction to modern cryptography. Chapman and Hall/CRC, 2014.

Rosulek Mike. The joy of cryptography // Oregon State University EOR. — 2018. — P. 1.

Bellare Mihir, Namprempre Chanathip. Authenticated encryption:

Relations among notions and analysis of the generic composition paradigm // International Conference on the Theory and Application of Cryptology and Information Security / Springer. — 2000. — P. 531– 545.

Shrimpton Tom. A characterization of authenticated-encryption as a form of chosen-ciphertext security. // IACR Cryptol. ePrint Arch. — 2004. — Vol. 2004. — P. 272.

3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3G Security; Security architecture (Release 16). — 2020.

Juels Ari, Weis Stephen A. Defining Strong Privacy for RFID // Proceedings of the Fifth IEEE International Conference on Pervasive Computing and Communications Workshops. — 2007. — P. 342–347.

Avoine Gildas. Adversarial Model for Radio Frequency Identification. // IACR Cryptol. ePrint Arch. — 2005. — Vol. 2005, no. 7. — P. 49–62.

On two RFID privacy notions and their relations / Yingjiu Li, Robert H Deng, Junzuo Lai, Changshe Ma // ACM Transactions on Information and System Security (TISSEC). — 2008. — Vol. 14, no. 4. — P. 1–23.

A new framework for RFID privacy / Robert H Deng, Yingjiu Li, Moti Yung, Yunlei Zhao // European Symposium on Research in Computer Security / Springer. — 2010. — P. 1–18.

A zero-knowledge based framework for RFID privacy / Robert H Deng, Yingjiu Li, Moti Yung, Yunlei Zhao // Journal of Computer Security. — 2011. — Vol. 19, no. 6. — P. 1109–1146.

Vaudenay Serge. On privacy models for RFID // International conference on the theory and application of cryptology and information security / Springer. — 2007. — P. 68–87.

Paise Radu-Ioan, Vaudenay Serge. Mutual authentication in RFID: security and privacy // Proceedings of the 2008 ACM symposium on Information, computer and communications security. — 2008. — P. 292–299.

Molnar David, Soppera Andrea, Wagner David. A scalable, delegatable pseudonym protocol enabling ownership transfer of RFID tags /International workshop on selected areas in cryptography / Springer. — 2005. — P. 276–290.


Refbacks

  • There are currently no refbacks.


Abava  Кибербезопасность IT Congress 2024

ISSN: 2307-8162