Non-linearity cannot help RFID resist full-disclosure attacks and terrorist fraud attacks

Transcription

1 SECURITY AND COMMUNICATION NETWORKS Seuy Comm. Newoks 203; 6: Publshed onlne 27 July 202 n Wley Onlne Lby (wleyonlnelby.om)..40 SPECIAL ISSUE PAPER Non-lney nno help RFID ess full-dslosue ks nd eos fud ks Hung-Yu Chen *, Chu-Sng Yng 2 nd Hung-Pn Hou 3 Depmen of Infomon Mngemen, Nonl Ch Nn Unvesy, Pul, Twn 2 Depmen of Elel Engneeng, Nonl Cheng Kung Unvesy, Tnn Cy, Twn 3 Pul Chsn Hospl, Pul, Twn ASTRACT As he onep of do-fequeny denfon (RFID) ely k hs been suessfully mplemened nd demonsed, he eseh of RFID dsne-boundng poools o dee RFID ely ks hs dwn muh enon fom boh he ndusy nd dem. Convenonlly, esehes doped lne omposon of sees o ess eos fud ks. Reenly, Pes-Lopez e l. suded he weknesses of pevous RFID dsne-boundng poools nd poposed h non-lne omposon of sees nd nluson of moe ndom none ould help RFID ess key dslosue k nd eos fud k. In hs ppe, we wll show h non-lne omposon of sees nno help enhne he seuy ully. Copygh 202 John Wley & Sons, Ld. KEYWORDS RFID; uhenon; mf k; eos k; dsne-boundng poool *Coespondene Hung-Yu Chen, Depmen of Infomon Mngemen, Nonl Ch Nn Unvesy, Pul, Twn. E-ml: hyhen@nnu.edu.w. INTRODUCTION In mny do-fequeny denfon (RFID)-bsed pplons suh s ess onol nd nvenoy mngemen, ede would deem h he gs uhenes e n s pomy when uhenes hese gs, beuse RFID ommunons e usully sho. The seuy of hese pplons depends on he seuy of uhenon poools (suh s hose n [ 7]) h hey use nd he ssumpon of g pomy. Fo emple, ess onol sysems of buldngs would llow ess only when he uhened g s n he pomy. Unfounely, hee e wo knds of well-known ely ks [8 0] h mgh umven he lmed nge of do hnnel nd he vefe no belevng he pomy of n uhened g (bu he g s f fom he vefe). The onvenonl RFID uhenon poools opeed n uppe newok lyes nno defe he ely ks, whee n dvesy sng beween legl g nd s vefe ( ede) elys messges beween hem o umven he ssumed ommunon nge... Rely ks The ely k nmed he mf fud k, nodued by Desmed [0], s h n ke ses up ogue pove (sy ^A) nd ogue vefe (sy ^) sng beween he el vefe (sy ) nd he el pove (sy A), nd ^A nd ^ oopevely ely he messges beween A nd so h he vefe wongly beleves h he pove A s n s pomy (bu s no). Anohe ely k lled he eos fud k [0] s h he pove onspes wh ogue ede o he he vefe, whou dslosng s pemnen sees o he onspes. Fgue () nd Fgue (b) espevely show he mf fud k nd he eos fud k, whee he dffeene s h he pove onspes wh he ouge ede nd he ouge g n he eos fud k bu he pove does no o-opee wh he ouge ede nd he ouge g n he mf fud k. Convenonl RFID uhenon poools suh s hose n [ 7] nno dee nd ess suh knds of ks..2. Dsne-boundng poool The onvenonl RFID uhenon poools h usully opee he uppe lye of he poool sk nd do modee ompuons nno obn hgh-esoluon mng of he vls of ndvdul ommunon bs nd, heefoe, nno dee whehe he messges e elyed o eend s ssumed ommunon nge. On ony, dsne-boundng poool suh s hose n [9 8] eeued 490 Copygh 202 John Wley & Sons, Ld.

2 H.-Y. Chen, C.-S. Yng nd H.-P. Hou Non-lney nno help RFID ess ks Tg Rogue Rede Rogue g Rede be fooled () mf fud k Tg Rogue Rede onspe Rogue g onspe Rede be fooled (b) eos fud k Fgue. Vous ely ks on do-fequeny denfon. by pove A nd vefe, whh s ghly neged no he physl lye, s one poenl mehnsm o defe ely ks. I onsss of wo phses slow phse nd fs phse. A pove nd vefe ehnge he hllenges nd ompue sesson sees n he slow phse, nd hen, he vefe hllenges s pove o, usng sesson sees, espond oely b-by-b n he fs phse. I depends on he posulon h no nfomon n popge hough spe me fse hn lgh. If he pove n nswe he vefe s hllenges oely, hen he pove A n onvne he vefe of A s deny nd A s physl pomy o. To effevely mplemen he RFID dsne-boundng poools, eques low-leny ommunon nd mng mehnsm. The sudes suh s [,4] hd poposed poenl mplemenons of low-leny ommunon nd mng mehnsms on low-os gs. Hnke nd Kuhn [] poposed o use ul-wde bnd (UW), whees Red e l. [4] poposed o use sde hnnel lekge s low-leny ommunon mehnsm. In hs ppe, we fous on he desgn of dsne-boundng poools, nd neesed edes e efeed o [,4] fo he dels of mng mehnsms. Whle he pevous dsne-boundng poools (suh s h n [9] h doped publ key opeons) e oo osly fo low-os RFID gs nd he muul uhenon wh dsne-boundng (MAD) poool e desgned fo d ho newoks [6], he een shemes suh s hose n [ 5] e desgned fo RFID pplons. Unfounely, vulnebles of mjo o mno elevne hve been denfed n hem. Cpkun e l. [6] hd desgned he MAD poool o enble wo nodes o deemne he muul dsne he me of he enoune, bu hey dd no ke eos fud k no oun. Km Avone s Swss-knfe RFID dsne-boundng poool [7] med o beng he bes n ems of seuy, pvy, g ompuonl ovehed nd ful olene, bu Pes-Lopez e l. [8] epoed he poool beng vulneble o full-dslosue ks f low-os gs n only suppo modee b-lengh ndom numbes (e.g., 32 bs). They epoed h, fe evesdoppng modee numbe of eeuon sessons of g, s fesble o deve ll he see keys of he g. The mn onl s h, fe evesdoppng on modee numbe of sessons, s hghly possble h some hllenge numbe wll epe nd he ke n, heefoe, dedue he see keys. Pes-Lopez e l. obseved h non-lne omposon of sees nd nluson of moe none ould enhne he seuy nd, heefoe, poposed he Hom RFID dsne-boundng poool. Howeve, we fnd h he Hom sheme s sll vulneble o ou full-dslosue k whee n ke ould dedue ll he see keys of g fe evesdoppng on esonble numbe of RFID sessons, nd he sheme s vulneble o ou eos fud k. We gue h non-lne omposon of sees nno help enhne he seuy. On ony, we popose h onvenonl ppoh of lne omposon of sees s bee. The es of hs ppe s ognzed s follows. Seon 2 evews he Hom sheme [8], nd Seon 3 shows s vulnebly o he full-dslosue k nd he eos fud k. Fnlly, he onluson s gven n Seon THE HITOMI PROTOCOL AND PERIS-LOPE AND COLLEAGUES ATTACKS The Hom poool med o seue he full-dslosue k, he mf fud k, nd he eos fud k h boheng he pevous RFID dsne-boundng shemes. In hs seon, we fs evew he Swss-knfe RFID dsne-boundng poool by Km e l., desbe he full-dslosue k of Pes-Lopez e l., nd hen evew he Hom poool. 2.. Revew of Km Avone s Swss-knfe dsne-boundng poool The noon s nodued s follows. T, pove (g); R, vefe (ede): Inlly, T nd R she see key. ID T, ID R : ID T denoes he deny of he g, nd ID R denoes he deny of he ede. ID, D: ID whou subsp denoes he deny of he g nvolved, nd D denoes he dbse n he seve s sde. f(): keyed hsh funon. N A, N : ndom numbes. C, W, W : sysem-wde onsns. Δ m : he llowed mmum hllenge esponse dely. n: he lengh of oupu sng (lso he numbe of ounds equed). Seuy Comm. Newoks 203; 6: John Wley & Sons, Ld. 49

3 Non-lney nno help RFID ess ks H.-Y. Chen, C.-S. Yng nd H.-P. Hou Km Avone s sheme onsss of hee phses pepon phse, pd b ehnge, nd he fnl phse. Tg nd ede ehnge he ndom numbes nd ompue he ommmens n he pepon phse. In he pd b ehnge phse, he vefe pobes he pove, usng ndvdul hllenge b, nd he pove should espond s nswe b n esonble me. Fnlly, he vefe, wh he pove s esponses, sehes he oespondng g n s dbse (D) nd vefes he vldy of he g. The sheme deped n Fgue 2 s desbed s follows Pepon phse The ede sends ndom numbe N A o he g, nd he g hooses ndom numbe N nd ompues = f (C, N ), 0 =, nd = Rpd b ehnge The phse s epeed n mes, nd he hllenge esponse dely fo eh eeuon s mesued. Eh nsne of pd b ehnge s denoed by subsp. The ede ss by hoosng ndom b, ss me, nd sends o he g. The b eeved by he g s denoed s (he hnnel nose o ks mgh hnge he b ). Upon eevng, he g esponds wh =. Upon eevng he esponse, he ede sops he me nd eods he eeved b s ndhedelymesδ Fnl phse The g ompues = f (,..., n, ID, N A, N ) nd sends o he ede, whh pefoms n ehusve seh ove s dbse o fnd n eny (ID, ), ssfyng. Usng hs eny, he ede ompues 0 nd nd uses hem o vefy eh eeved esponse b. e denoes he numbe of esponse bs h nno mee he mmum dely bound. e denoes he numbe of esponse bs h e no oe, nd e denoes he numbe of hllenges bs dffeen fom hose hllenges eeved by he g. If he numbe of eos (e + e + e ) s less hn he pedefned heshold, hen he ede eps hs g; ohewse, ejes hs g. If ede uhenon s equed, hen he ede sends A o he g. Km nd Avone epoed h s seuy bound gns mf fud k s (/2) n nd h s seuy bound gns eos fud k s (/2) v, ssumng h 2n v bs of 0 nd e dslosed o he dvesy befoe he pd b ehnge Full-dslosue k of Pes-Lopez e l. Pes-Lopez nd ollegues ks [8] on Km Avone s sheme e bsed on he obsevon h low-os g usully ffods modee-lengh ndom numbe (e.g., 32 bs) bu no long-lengh ndom numbes (e.g., 64 o 80 bs). Unde suh umsnes, Pes-Lopez e l. showed one effeve k s follows. () The ke denfes eh uhenon sesson by denfyng he ndom numbe N befoe he pd b ehnge. He o she eods {, } =~n of eh sesson. Rede Tg Pepon Pk ndom N A Rpd b ehnge : ~n Pk R {0,} s me sop me eod, Fnl phse hek Compue Compue e : # { : e : # { : e : # { : If e e e hen REJECT A ID v f ( N ) D 0, } m } N A N,..., n, } A Pk ndom 0 f ( C, N ), N n A, N f (,...,, ID, N vefy A ) Fgue 2. Swss-knfe dsne-boundng poool. 492 Seuy Comm. Newoks 203; 6: John Wley & Sons, Ld.

4 H.-Y. Chen, C.-S. Yng nd H.-P. Hou Non-lney nno help RFID ess ks (2) The ke evesdops eh new sesson { N, ; ¼en }nd heks whehe N of he new sesson equls n esng one n s eods. If so, hen he o she goes o he ne sep; ohewse, he o she epes hs sep fo new sessons. (3) Fo =on, he ke heks whehe 6¼.If so, he o she ompues ¼, whh s he h b of. The ke sops when ll he bs of hve been deved; ohewse, he o she jumps o Sep 2 o evesdop on moe sessons. Obvously, he suess of he foemenoned k depends on he pobbly of fndng epeed ndom numbe N. V smulons, Pes-Lopez e l. found h kes 330 nd , espevely, fo n =20ndn =30n n del hnnel (no noses), nd he numbe of equed sessons s sll ffodble f he b eo e s low nd he numbe of ehnge bs s modee [8]. Aully, he epeed numbe of sessons fo epeed ndom numbe ould be esmed by usng he bhdy pdo fomul (), whee d denoes he spe of possble dws nd p denoes he pobbly of lsenng wo sessons wh he sme ndom none. sffffffffffffffffffffffffffffffffffffffffffffffffffffffff N ff 2d log p () 3. THE HITOMI SCHEME AND ITS WEAKNESSES Afe nlyzng he seuy weknesses of pevous shemes, whh ll doped lne omposon of sees, Pes-Lopez e l. gued h non-lne omposon of sees nd nluson of moe ndom none ould enhne he seuy. Wh he obsevons, hey poposed new RFID dsne-boundng poool lled he Hom poool. I ws lmed h he sheme n effevely ess ll known ks. The Hom sheme s he fs sheme n hs egoy o eploe non-lne omposon of sees. Unfounely, we fnd h non-lney no only nno help he seuy bu even deeoes he seuy. Hee, we fs evew he sheme n Seon 3. nd hen show he seuy weknesses of non-lney n Seon The Hom poool To se he level of seuy, he Hom poool uses hee ndom numbes N T, N T2, nd N T3 on he g s sde nd hnges he ompuons of 0 nd by usng he followng non-lne elon: = f (N R, N T, W), b = f (N T2, N T3, W ), 0 = nd = b nsed of he onvenonl lne fom = f (N R, N T, W), 0 =, nd =. The Hom sheme onsss of hee phses. The poool s deped n Fgue 3, nd he seps e desbed s follows. Rede Tg Pepon Pk ndom N R Rpd b ehnge : ~n Pk R {0,} s me sop me eod, Fnl phse hek ID v D 0 Compue, Compue e : #{ : e : #{ : e : #{ : If e hen REJECT A f ( N, b) e R e } m } } N N R T, NT 2, NT 3 m, A Pk ndom N b 0 f ( N, N f ( N, R T 2 T, N T, N, W ), T 3 b T 2, W ), N T 3 m {... n... n } f( m, ID, NR, NT, NT 2, NT 3) vefy A Fgue 3. The Hom poool. Seuy Comm. Newoks 203; 6: John Wley & Sons, Ld. 493

5 Non-lney nno help RFID ess ks H.-Y. Chen, C.-S. Yng nd H.-P. Hou 3... Pepon phse The ede sends ndom numbe N R o he g. Then he g hooses hee ndom numbes (N T, N T, N T3 ) nd ompues = f (N R, N T, W), b = f (N T2, N T3, W ), 0 =, nd = b. The g sends bk (N T, N T, N T3 ) Rpd b ehnge Ths phse s he sme s h of Km Avone s sheme Fnl phse The g les m ¼ j...jj n jj jj...jj n g, ompues = f (m, ID, N R, N T, N T2, N T3 ), nd sends hem bk o he ede, whh pefoms n ehusve seh ove s dbse o fnd n eny (ID, ), ssfyng. The es of he vefon seps e he sme s hose of Km Avone s sheme. If ede uhenon s equed, hen he ede sends A o he g. The uhos gued h he nluson of moe ndom numbes wll enhne he level of seuy nd h he non-lne ngemen of 0 nd n effevely dee eos fud ks. Howeve, we le show h he Hom poool s sll vulneble o eos fud k nd full-dslosue k n Seon Aks on he Hom poool The full-dslosue k Hee, we desbe he seps of ou full-dslosue k, whh n effevely deve he see key of one g s follows. () The ke mpesones he ede nd nes eh uhenon nsne by sendng he sme N R o he g. Wh he esponse N T fom he g, he ke denfes eh uhenon nsne nd eods ll he ommunons of he uhenon nsne. Fo eh new N T eeved, sends ll s beng zeo o le he g lwys espond wh ¼ 0 ¼. He o she eods he ommunons {(N T, N T2, N T3 ){, } =~n }. If epeed N NT s eeved, hen he ke sends ; n ¼ ole he g espond wh ¼ ¼ b, eods he n ommunons N T ; NT2 ; o N T3 ; ¼en fo hs epeed N NT nsne, nd hen goes o sep 2; ohewse, he o she epes hs sep o ne new uhenon nsne. (2) Upon geng wo uhenon nsnes wh he sme N T one s {(N T, N T2, N T3 ) { n =0, } =~n } nd he ohe s? N T ; NT2 ; o N T3 ¼ ; he ke ¼en les = 2... n, ompues b¼f NT2 ;N T3 ;W, nd hen deves :¼ b j 2 jj...jjn Þ. The equon b j 2 jj...jjn Þ euns beuse ¼ ¼b. The dffeenes beween ou full-dslosue k nd Pes-Lopez nd ollegues ks nlude he followng: () The ke n Pes-Lopez nd ollegues k only evesdops on ommunons, bu ou ke mpesones he ede by sendng he sme N R ll he mes, nd les = 0 fo he sessons wh new N T nd les ¼ fo sesson wh epeed N T. Ou ks e ve, bu Pes-Lopez nd ollegues k seems o be pssve he fs glne. Howeve, we should noe h he ke n boh ks need o evesdop on mny sessons fom he sme g, nd, unde suh umsnes, he ke mus onol o even pues he g. Thus, he kes n boh ks e ully ve bu no pssve n pl sense. () The equed numbe of evesdopped sessons o deve he whole see key n ou k s muh less hn h n he sheme of Pes-Lopez e l. Ou k n olly deve he whole see key fo he fs ouene of epeed N T beuse we onol = 0 fo new N T nd ¼ fo epeed N T. u, he ke n Pes-Lopez nd ollegues k n only eove some bs of fo eh epeed N T. Theefoe, he numbe of evesdopped sessons n Pes- Lopez nd ollegues k s muh lge hn ou k Teos fud k In ode o se he seuy level gns full-dslosue k, he Hom poool poposes he non-lne ngemen of he fom = f (N R, N T, W), b = f (N T2, N T3, W ), 0 =, nd = b nsed of he onvenonl lne fom = f (N R, N T, W), 0 =, nd =. Howeve,wefnd h nus new wekness o eos fud k. A eos fud k onsdes he suon h pove (g) o-opees wh n ke (Adv) unde he onsn h he g would no dslose s long-em see key o Adv. Howeve, we n plo n effeve eos fud k on he Hom s follows. Assume n = 32 bs. Le g T dsloses ll he bs (n bs) of = b nd he fs hlf bs (sy ~ n/2 bs) of 0 = o Adv fe he pepon phse. In suh n ngemen, he long-em see key s no dslosed o Adv. Now, Adv dops hs segy s follows. Adv lwys nswes oely fo hllenges, n/2 beuse he o she hs ; n nd 0 ; n=2. Fo he es of hllenges, n/2 + n n he pd b ehnge, he o she jus ndomly hooses = 0 o. Thee e vegely n/4 hllenges wh = fo he es hllenges, n/2 + n. Fo hese n/4 = bs 2 [n/2 +, n], Adv knows he oe nswes =. So, Adv vegely only needs o guess = o 0 fo he es n/4 hllenges wh =0. On he vege, Adv guesses oely n/8 bs nd fls n/8 bs fo hese n/4 hllenges wh = 0. When n = 32, mples h he ke only guesses wongly fo 4 hllenge bs. So, f he heshold vlue of he numbe of eos (e + e + e ),, s 4, hen Adv n suessfully he he vefe. The hoe of should depend on he numbe of ehnge bs, n, nd he b eo e. In nose hnnel wh n = 32 bs, he heshold vlue s usully lge hn 4 [8]. Theefoe, ou eos fud k n suessfully defe he Hom poool. 494 Seuy Comm. Newoks 203; 6: John Wley & Sons, Ld.

6 H.-Y. Chen, C.-S. Yng nd H.-P. Hou Non-lney nno help RFID ess ks 4. CONCLUSIONS In hs ppe, we hve nodued he Hom poool nd hve nlyzed o show h he poposed onle of non-lne omposon of sees nd nluson of moe hllenge nno enhne he seuy of RFID dsneboundng poool gns he possble ks. On ony, we gue h he ppoh of lne omposon of sees would be bee. The eson fo hs s h, unde non-lne omposon of sees, he dshones g n dslose moe see bs of he esponses o he dvesy fo eos ks, whou dmgng he pvy of s long-em see key. REFERENCES. Chen HY, Hung CW. Seuy of ul-lghwegh RFID uhenon poools nd s mpovemens. ACM Openg Sysem Revews 2007; 4(4): Chen HY. SASI: new ul-lghwegh RFID uhenon poool povdng song uhenon nd song negy. IEEE Tnsons on Dependble nd Seue Compung 2007; 4(4): Lee NY, Chun-Chng Pn. Odnl uhenon poools fo RFID gs. Po. of 2008 Inenonl Confeene on usness nd Infomon (AI2008). Ademy of Twn Infomon Sysems Reseh: Seoul, Koe, 2008; Pmuhu S. Poools fo RFID g/ede uhenon. Deson Suppo Sysems 2007; 43(3): Hwng MS, Lee CC, Chong SK, Lo JW. A key mngemen fo weless ommunons. Inenonl Jounl of Innovve Compung, Infomon nd Conol 2008; 4(8): Lo NW, Yeh KH, Yeun CY. New muul geemen poool o seue moble RFID-enbled deves. Infomon Seuy Tehnl Repo, pp. 5 57, Lee JS, Chng YF, Chng CC. Seue uhenon poools fo moble ommee nsons. Inenonl Jounl of Innovve Compung, Infomon nd Conol (IJICIC) 2008; 4(9): ussd L. Tus esblshmen poools fo ommunng deves. PhD hess, Insu Euéom, Téléom, Ps, nds S, Chum D. Dsne-boundng poools. In Advnes n Cypology EUROCRYPT 93, LNCS 765. Spnge-Velg: Lofhus, Nowy, 993; Desmed Y. Mjo seuy poblems wh he unfogeble (Fege)-F Shm poofs of deny nd how o oveome hem. Po. of SeuCom 88. SEDEP Ps: Fne, 988; Hnke G, Kuhn M. An RFID dsne boundng poool. Po. of he IEEE SeueComm 2005, Sepembe Medows R, Poovendn D, Pvlov L, Chng W, Syveson P. Dsne boundng poools: uhenon log nlyss nd olluson ks. Po. Of Seue Lolzon nd Tme Synhonzon fo Weless Senso nd Ad Ho Newoks. Spnge- Velg: 2007; Munll J, Pendo A. Dsne boundng poools fo RFID enhned by usng vod-hllenges nd nlyss n nosy hnnel. Weless Communons nd Moble Compung DOI: 0.002/wm Red J, Gonzlez JM, Tng T, Sendj. Deeng ely ks wh mng-bsed poools. Po. of he 2nd ACM symposum on Infomon ompue nd ommunons seuy ASIACCS 07 (2007). 5. Tu YJ, Pmuhu S. RFID dsne boundng poools. RFID Tehnology, Sepembe S. Čpkun, uyán L, Hubu J.-P. SECTOR: seue kng of node enounes n mul-hop weless newoks. Po. of ACM Wokshop on Seuy of Ad Ho nd Senso Newoks, pp. 2 3, Km CH, Avone G. RFID dsne boundng poool wh med hllenges o peven ely ks. Po. of 8h Inenonl Confeene on Cypology nd Newok Seuy CANS 09. Spnge: Ishkw, Jpn, Pes-Lopez P, Henndez-Cso JC, Dmkks C, Mokos A, Esevez-Tpdo JM. Sheddng lgh on RFID dsne boundng poools nd eos fud ks. CSF 0, June 200. hp://v.og/ bs/ , Conell Unvesy lby. Seuy Comm. Newoks 203; 6: John Wley & Sons, Ld. 495