抗去同步化的轻量级RFID双向认证协议

Lightweight anti-desynchronization RFID mutual authentication protocol

针对低成本RFID应用中轻量级认证协议的安全性进行研究,提出一种组合型去同步化攻击方法,该类攻击不用篡改任何协议消息,仅通过拦截、窃听、重放等攻击手段的顺序组合就能导致后台数据库/标签的共享密钥失去同步;设计一种轻量级抗去同步化的RFID双向认证协议,并利用形式化工具CPN Tools模拟运行该协议,该协议可以达到预期状态空间;与同类RFID协议相比,该协议在满足一般隐私安全属性的同时,还能有效抵抗来自恶意阅读器的组合型去同步化攻击,同时能有效减少RFID系统的计算开销,弥补原始协议的不足,更适合低成本RFID系统应用的隐私安全需求。

In researching the Lightweight authentication protocol in low-cost RFID applications, a kind of combinational desynchronization attack was proposed which could make the shared keys desynchronize without message manipulation, and a lightweight anti-desynchronized mutual authentication protocol, of which the state teachability was proved by the formal simulation with CPN tools was proposed. The results show that in addition to meeting the conventional security and privacy requirements, the proposed protocol is able to resist the combinational desynchronization attack in comparison with similar protocols. Since it can effectively save the RFID system＇s computation overhead by decreasing the calculation times of the one-way Hash, the proposed protocol is more suitable for low-cost RFID applications than others.