CN102594550A - RFID internal mutual authentication safety protocol based on secret key array - Google Patents

Abstract

The invention relates to an RFID system and discloses an RFID internal mutual authentication safety protocol based on a secret key array. The method is used in the RFID system possessing a plurality of servers. The each RFID system comprises a plurality of tags, a reader and a database. The method comprises the following steps: distributing one identification code for each server in advance; simultaneously, establishing only one authentication key for the server and the tag; storing the identification codes and the secret keys of all the servers in the tag; distributing only one pair of the shared secret key for one pair of the tag and the reader; when the reader reads the tag, carrying out authentication operation; firstly inspecting whether a memory of the tag comprises the server identification code corresponding to the reader by the tag; if identification code matching succeeds, carry out tag reading. Compared to the prior art, the protocol of the invention is suitable for the RFID field with a high safety requirement.

Description

The card security protocol is recognized each other in RFID inside based on the key array

Technical field

The present invention relates to the information security technology of rfid system, be applicable to that particularly radio frequency identification (is called for short, RFID) the safeguard protection agreement of the mutual authentication of internal system participant (company and consumer).

Background technology

In the prior art, early stage RFID technology is not considered safety problem, because early stage application only limits in logistics, industry or the enclosed environment, a typical example is exactly the intelligent repository shelf management system.Though the assailant possibly make workflow fall into chaos to the invasion of this type systematic, the assailant can't obtain any interests.Follow the development of technology and demand; The RFID technology worldwide is used widely; Especially when key areas such as RFID technology entering commerce, finance and national security; After E-Passport (E-passport), noncontact credit card (Contactless Credit Cards) and supply-chain management system, the safety problem of rfid system more and more receives publicity and payes attention to.

For example,, rfid system sets up the automatic identification and management systems of enterprise of participating in when being applied to supply chain or Internet of Things more, and as shown in Figure 1.Rfid system in this system has a plurality of servers, and intrasystem same label can be under the jurisdiction of the reader of different server and read.For example in bank transaction system, a user possibly have account in how tame bank, and these accounts are stored on the card.This card can be read through radiofrequency signal in the terminal of all banks.But need to give rfid card with the identifier allocation of each bank in advance, promptly need have the key between it and each bank on the rfid card.So, could guarantee under the normal operating position of rfid card, avoid the bank of no authorization identifying in these banks can not pretend to be other banks to steal economic interests.This shows that in above-mentioned multiserver rfid system, exist and internal attack risk, promptly some legal server can pretend to be other servers to read the data message that it is maintained secrecy in the system.This also is a letter of the present invention safety problem to be solved.

Summary of the invention

Problem based on above-mentioned prior art existence; The present invention proposes a kind of RFID inside and recognize each other the card security protocol based on the key array; Make electronic tag at first discern reader through corresponding authentication protocol, find corresponding key, reader could get into next cognitive phase then; With respect to the agreement of other same levels, this agreement more is applicable to the rfid system application that safety requirements is high.

The present invention proposes a kind of RFID inside and recognize each other the anti-view of card safety based on the key array; This method is used to have the rfid system of multiserver; Wherein each rfid system comprises a plurality of electronic tags, reader and database, it is characterized in that, this method may further comprise the steps:

Be identification code of each server-assignment in advance, set up unique authenticate key for server and label simultaneously;

The identification code and the key of storage Servers-all in label; Each distributes a pair of unique shared key to label and reader; When the reader label reading, carry out authentication operation: label at first checks whether comprise this reader corresponding server identification code in its internal memory; If mating, identification code successfully can carry out the label reading;

Said authentication operation may further comprise the steps:

Reader R _iProduce random number R, encrypt IDR with all readers and label cipher key shared k _iPR is then with key E _k(IDR _iPR) send to label T _j

Label T _jReceive E _k(ID _iPR) after, it is deciphered obtain reader R _iIdentifier ID R _i, utilize IDR _iFind current label T _jWith reader R _iBetween shared key k _Ij: if do not find the corresponding shared key, then communication process finishes; If find the corresponding shared key, label T _jProduce random number r; Calculate ${\mathrm{<figure-callout\; id="1"\; label="M"\; filenames="HDA0000140646950000012.png"\; state="\{\{state\}\}">M</figure-callout>}}_1={\mathrm{IDT}}_j\&CirclePlus;r,$ ${\mathrm{<figure-callout\; id="2"\; label="M"\; filenames="HDA0000140646950000012.png"\; state="\{\{state\}\}">M</figure-callout>}}_2=h\left({\mathrm{IDT}}_j\right)\mathrm{Pr}\&CirclePlus;R,$ $M_3=h\left({\mathrm{IDT}}_j\mathrm{PR}\right)\&CirclePlus;k_{\mathrm{Ij}};$ Simultaneously with M ₁, M ₂, M ₃Send to reader R _i

Reader R _iAfter receiving the response of label, with this response and IDR _i, R sends to server together;

After receiving the message of reader, server is sought in internal memory and is satisfied IDT _j, and then find corresponding current label T _jWith reader R _iBetween shared key k _IjWith reader Ri and label T _jThe key of previous stage of communication

Then, server calculates And check k ' _IjWhether with the k of server stores _IjOr Equate.If unequal, show that the information of sending is unreliable, communication process finishes.If have one to equate, judge which value k _IjOr With k _IjEquate that server calculates $M_4=h\left({\mathrm{IDR}}_i\right)\&CirclePlus;h\left({\mathrm{IDT}}_j\mathrm{Pr}\right)\&CirclePlus;k_{\mathrm{Ij}}$ Or $M_4=h\left({\mathrm{IDR}}_i\right)\&CirclePlus;h\left({\mathrm{IDT}}_j\mathrm{Pr}\right)\&CirclePlus;k_{\mathrm{Ij}}^{\mathrm{Old}};$ Simultaneously, server is with key value

Be updated to k _Ij, with k _IjBe updated to PRNG (k _Ij); Then, server sends to T with authentication information M4 through reader _j

The M that label is relatively received ₄Whether with

Equate,, confirm reader R if equate _iBe legal, label is with key k _IjBe updated to PRNG (k _Ij).

Compared with prior art, the present invention proposes corresponding authentication security agreement, label is at first discerned reader, finds corresponding key, and reader could get into next cognitive phase then.With respect to the agreement of other same levels, this agreement more is applicable to the field that safety requirements is high.

Description of drawings

Fig. 1 is the rfid system fundamental diagram of background technology;

Fig. 2 is the automatic identification and management system sketch map of enterprise of participating in of the present invention more;

Fig. 3 recognizes each other the schematic flow sheet of card security protocol for the RFID inside based on the key array of the present invention;

Fig. 4 is a key authentication schematic flow sheet of the present invention.

Embodiment

Rfid system of the present invention refers to radio-frequency recognition system (RFID), and is as shown in Figure 1, mainly is made up of electronic tag (Tag), reader (Reader) and three parts of database (Database).Electronic tag is the real data medium of rfid system.Generally speaking, electronic tag is made up of label antenna and label special chip.Each label has unique electronic code (EPC), during use attached on the object.Reader is responsible for reading or writing label information, and basic function just provides the approach that carries out transfer of data with electronic tag.Simultaneously, functions such as signal condition control, parity check can also be provided.When label receives the signal that reader is launched, promptly waken up, corresponding action is accomplished in the instruction of sending according to reader then, and response message is launched back reader again.Data management system is mainly accomplished data information memory, the management of rfid system, can be database or supply chain system.

The multiserver rfid system is internaled attack easily.To this problem, this patent has proposed corresponding authentication protocol.Label is at first discerned reader, finds corresponding key, and reader could get into cognitive phase then.With respect to the agreement of other same levels, this agreement more is applicable to the field that safety requirements is high.The agreement that this patent proposed is applicable to multi-server system.As shown in Figure 2, be the system block diagram of multi-server system.Comprise a plurality of servers, each server belongs to a participant (company), and each server has a plurality of readers.Its workflow is after label gets into the sphere of action of reader antenna, and that can receive reader sends inquiry order and RF energy.The RF energy that obtains makes electronic tag be activated, and electronic tag begins to respond reader inquiry order.At first, reader and label are accomplished mutual authentication, and electronic tag sends data to reader then, and reader sends data to back-end data base and accomplishes tag recognition.

The card security protocol is recognized each other in RFID inside based on the key array of the present invention; The processing that this agreement is carried out may further comprise the steps: for the identification code of each server-assignment in the application system, set up unique authenticate key for server and label simultaneously in advance; The identification code and the key of storage Servers-all in label, each has unique shared key to label and reader, but when a reader label reading, label at first checks whether comprise this reader corresponding server identification code in its internal memory; If mating, identification code successfully can carry out the label reading.This flow chart is as shown in Figure 3.

Below in conjunction with accompanying drawing and preferred embodiment,, specify as follows according to embodiment provided by the invention, structure, characteristic and effect thereof.

As shown in Figure 4, the identifying procedure of security protocol of the present invention may further comprise the steps:

(1) reader R _i(1≤i≤m, m are the reader number that system comprises) produces random number R, encrypts IDR with all readers and label cipher key shared k _iPR is then with key E _k(IDR _iPR) send to label T _j(1≤j≤n, n are the label number that system comprises);

(2) label T _jReceive E _k(IDR _iPR) after, it is deciphered obtain reader R _iIdentifier ID R _i, utilize IDR _iFind current label T _jWith reader R _iBetween shared key k _Ij: if do not find the corresponding shared key, communication process finishes; If find the corresponding shared key, label T _jProduce random number r; Calculate ${\mathrm{<figure-callout\; id="1"\; label="M"\; filenames="HDA0000140646950000012.png"\; state="\{\{state\}\}">M</figure-callout>}}_1={\mathrm{IDT}}_j\&CirclePlus;r,$ ${\mathrm{<figure-callout\; id="2"\; label="M"\; filenames="HDA0000140646950000012.png"\; state="\{\{state\}\}">M</figure-callout>}}_2=h\left({\mathrm{IDT}}_j\right)\mathrm{Pr}\&CirclePlus;R,$ $M_3=h\left({\mathrm{IDT}}_j\mathrm{PR}\right)\&CirclePlus;k_{\mathrm{Ij}}$ (M ₁, M ₂, M ₃Three variablees are respectively the ciphertext symbols after label information is encrypted); Simultaneously with M ₁, M ₂, M ₃Send to reader R _i

(3) reader R _iThe response of receiving label (is M ₁, M ₂, M ₃) after, with this response and IDR _i, R sends to server together, and (specifically sending content is M ₁, M ₂, M ₃And IDR _i, R);

(4) receive the message of reader after, server is sought in internal memory and is satisfied

IDT _j, and then find corresponding current label T _jWith reader R _iBetween shared key k _IjWith reader Ri and label T _jThe key of previous stage of communication

(initial value is null).Then, server calculates

And check k ' _IjWhether with the k of server stores _IjOr

Equate.If unequal, show that the information of sending is unreliable, communication process finishes.If have one to equate, according to which value

With k _IjEquate that server calculates $M_4=h\left({\mathrm{IDR}}_i\right)\&CirclePlus;h\left({\mathrm{IDT}}_j\mathrm{Pr}\right)\&CirclePlus;k_{\mathrm{Ij}}$ Or $M_4=h\left({\mathrm{IDR}}_i\right)\&CirclePlus;h\left({\mathrm{IDT}}_j\mathrm{Pr}\right)\&CirclePlus;k_{\mathrm{Ij}}^{\mathrm{Old}}.$ Simultaneously, server is with key value

Be updated to k _Ij, with k _IjBe updated to PRNG (k _Ij).Then, server sends to T with authentication information M4 through reader _j

(5) M that relatively receives of label ₄Whether with

Equate.If equate, confirm reader R _iBe legal.Label is with key k _IjBe updated to PRNG (k _Ij).

Computing in the above flow process and function are represented the implication explanation as follows:

Ek () representative utilizes public keys k to carry out cryptographic calculation;

Dk () representative utilizes public keys k to carry out decrypt operation;

H () represents unidirectional hash function;

← representative substitutes computing;

represents XOR;

The P representative links computing.

Server initial allocation (IDT _i, k, (IDR _i, k _Ij)) to label T _jEach reader stores has its respective identifier R _iWith key k.Server comprises information

The communication protocol that security protocol of the present invention can satisfy rfid system should have following characteristic, thereby guarantees safety and privacy:

One, confidentiality

In order to reduce the risk that eavesdropping and traffic analysis are attacked as much as possible, valuable information should be transmitted [5] with the form of encrypting like tag identifier and key.Undelegated reader also might obtain the private information [6] of label in server through the personation label.

Two, authentication each other

Authentication (checking mutually) should be carried out before label and reader communicate each other,, Replay Attack, man-in-the-middle attack and cloning attack etc. can be prevented like this to guarantee to have only the legal label and the reader ability access system of mandate.

Three, indistinguishability

Indistinguishability means that the information that the assailant can not utilize label to send makes a distinction itself and other label.It is the effective way that prevents Position Tracking that the data of transmission possess indistinguishability.In most of prior protocols, all comprise random number in the information that label and reader send, when making each reader inquiry, the response of same label is all different, like this assailant's Replay Attack will lose efficacy [7,8].

Four, forward security Forward security

Even forward security is meant that a label is captured, the assailant still can not obtain the signal intelligence in this label past.That is to say, obtained the data message of label, can not recall the communication data in label past even forward security has guaranteed the assailant.The method that reaches forward security is to upgrade communication key [5,8] continually.

Five, validity Efficiency

The equipment price of most of rfid systems is cheap, and computing capability is limited.Therefore, RFID communication protocol must be followed the principle of low-power consumption.When the number of labels of handling when needs was big, extensibility also was an aspect of authentication protocol validity.For avoiding poor search, the method identification label of some agreements through tabling look-up only needs the amount of calculation of O (1).

Claims (1)

1. the card security protocol is recognized each other in the RFID inside based on the key array, and this method is used to have the rfid system of multiserver, and wherein each rfid system comprises a plurality of electronic tags, reader and database, it is characterized in that, this method may further comprise the steps:

Be identification code of each server-assignment in advance, set up unique authenticate key for server and label simultaneously;

The identification code and the key of storage Servers-all in label; Each distributes a pair of unique shared key to label and reader; When the reader label reading, carry out authentication operation: label at first checks whether comprise this reader corresponding server identification code in its internal memory; If mating, identification code successfully can carry out the label reading;

Said authentication operation may further comprise the steps:

Reader R _iProduce random number R, encrypt IDR with all readers and label cipher key shared k _iPR is then with key E _k(IDR _iPR) send to label T _j

Label T _jReceive E _k(ID _iPR) after, it is deciphered obtain reader R _iIdentifier ID R _i, utilize IDR _iFind current label T _jWith reader R _iBetween shared key k _Ij: if do not find the corresponding shared key, then communication process finishes; If find the corresponding shared key, label T _jProduce random number r; Calculate $M_1={\mathrm{IDT}}_j\&CirclePlus;r,$ $M_2=h\left({\mathrm{IDT}}_j\right)\mathrm{Pr}\&CirclePlus;R,$ $M_3=h\left({\mathrm{IDT}}_j\mathrm{PR}\right)\&CirclePlus;k_{\mathrm{Ij}},$ Simultaneously with M ₁, M ₂, M ₃Send to reader R _iM ₁, M ₂, M ₃Three variablees are respectively the ciphertext symbols after label information is encrypted;

Reader R _iReceive the response M of label ₁, M ₂, M ₃After, with this response and IDR _i, R sends to server together;

After receiving the message of reader, server is sought in internal memory and is satisfied

IDT _j, and then find corresponding current label T _jWith reader R _iBetween shared key k _IjWith reader Ri and label T _jThe key of previous stage of communication

Then, server calculates

And check k ' _IjWhether with the k of server stores _IjOr

Equate; If unequal, show that the information of sending is unreliable, communication process finishes; If have one to equate, judge which value k _IjOr

With k _IjEquate that server calculates $M_4=h\left({\mathrm{IDR}}_i\right)\&CirclePlus;h\left({\mathrm{IDT}}_j\mathrm{Pr}\right)\&CirclePlus;k_{\mathrm{Ij}}$ Or $M_4=h\left({\mathrm{IDR}}_i\right)\&CirclePlus;h\left({\mathrm{IDT}}_j\mathrm{Pr}\right)\&CirclePlus;k_{\mathrm{Ij}}^{\mathrm{Old}};$ Simultaneously, server is with key value

Be updated to k _Ij, with k _IjBe updated to PRNG (k _Ij); Then, server is with authentication information M ₄Send to T through reader _j

The M that label is relatively received ₄Whether with

Equate,, confirm reader R if equate _iBe legal, label is with key k _IjBe updated to PRNG (k _Ij).

Images