- 1 - Secure and Serverless RFID Authentication and Search Protocols Chiu C. Tan, Bo Sheng, and Qun Li IEEE Transactions on Wireless Communication APRIL 2008 Taesung Kim

- 2 - Contents Abstract Introduction Related Work RFID Privacy and Security RFID Authentication RFID Search

- 3 - Introduction What is Radio Frequency Identification? Tag Antenna Reader

- 4 - Introduction Solution for RFID Security and Privacy problem –Central database model –Three players in this model RFID reader, tag, database – 리더와 태그의 상호인증에 database 에 저장된 인증정보를 이용 –Database 와 연결이 없는 오프 사이트 위치에 있는 리더는 태그의 정보를 볼 수 없다. Simple alternative –Downloading database to reader –Mobile reader can be stolen. –An adversary will have access to information which include unique tag id and password. –The adversary can make fake tag based on this information.

- 5 - Introduction This paper suggest –Security protection as the central database model without persistent connection to the database. RFID searching problem –Single reader, multiple tag 상황에서 특정 tag 의 정보를 검색하 는 경우. –Authenticating each tag one at a time is a time consuming process. This paper suggest several solutions for RFID searching problem.

- 6 - Related Work Weis –randomized hash lock –Tag reply to reader query (r, ID ⊕ f k (r)) –where r is a random number generated by the tag, –k is the tag’s secret key –and f k is a pseudorandom function. A secure database searches the ID/secret key, then the real tag ID returned to reader. Molnar and Wagner –Randomized hash lock scheme does not defend against an eavesdropper. –Reader 가 secret key 를 알고 있다고 가정 –Reader 와 tag 가 각각 random number 를 만들고 교환한다.

- 7 - Related Work –Tag reply ID ⊕ f k (0, r1, r2) –Compromised reader problem. Dimitriou –Tag reply (h(ID i ), nt, h IDi (nt, nr)) –where ID i is the tag secret. –nt, nr are both random nubers generated by tag and reader Database return h IDi+1 (nt, nr) The tag update its screct ID i+1

- 8 - RFID Authentication Notations CA Trusted party, responsible for authenticating readers and deploying tags RiRi RFID reader i riri id for RFID reader R i LiLi access list for RFID reader R i n number of entries in L i TiTi RFID tag i id i id for RFID tag T i titi secret for RFID tag T i h(x) one-way hash function f(x,y) Concatenate x and y, then applying h(.), h(x||y) l number of bits of hash h(.) m CA defined number of bits, m < l

- 9 - RFID Authentication Set up –R obtains r and L from a certificate authority, CA. –Tag, T contains a unique value id, a unique secret t. –Access List L i

RFID Authentication Authentication Protocol

RFID Search 특정 태그를 찾고자 할 때 Reader issues a search request such that only authenticated tag can understand. The tag reply in such that only an authenticated reader can understand.

RFID Search Secure search protocol

RFID Search Search protocol improvement –Tag remember the last used random number.

RFID Search Search protocol improvement –A challenge and response method

RFID Search Search protocol improvement –A noise to mask the reply

Thank you!