CN106209768A - A kind of extendible RFID mutual authentication method - Google Patents

Abstract

The invention discloses a kind of extendible RFID mutual authentication method, reader produces the random number r of length L, calculates A in conjunction with identifier UID, and A and request Query is sent to label；Label calculates random number r by A, with r and self storage (K, ID) calculate two authenticity verification values B, C passes to reader, reader sends jointly to background data base together with r after receiving B, C, and background data base first calculates odd bits B of BⁿMating with the value in the even bit storehouse of shared key, quick-searching is to corresponding (K, ID), and calculates B`, C`, the authenticating tag true and false.As label is legal, background data base current key K and random number r calculates authenticity verification value D, and D is sent to reader, simultaneously more new key K.Reader is sent to label after receiving D, label upon receipt, calculates the true and false of D` certification reader.If reader is legal, then tag update key K.

Description

A kind of extendible RFID mutual authentication method

Technical field

The present invention relates to radio frequency identification (RFID) research field, be specifically related in rfid system a kind of extendible RFID mutual authentication method.

Background technology

Radio frequency identification (radio frequency identification, RFID) is a crucial skill of Internet of Things Art, is generally made up of background data base, reader and label 3 part.Reader is sent by sky alignment label and receives letter Number, automatically identify destination object and obtain relevant information data, information data transmission is further processed to background data base. RFID provides the function of identification contactless, instant for object and object.Collect quickly and accurately as one and process information New and high technology, and there is the advantages such as noncontact, wearability, low cost, little, the life-span length of volume, be widely used in supply In the every field such as chain management, stock's monitoring, transportation, E-Passport, payment system and medical control.

In rfid system, reader and background data base are to be transmitted by the wire message way of safety, it is considered that it Channel between is safe lane.Read write line is referred to as forward channel to the channel of label, and the channel of label to read write line is referred to as Backward channel, both channels are all transmitted by wireless signal, are insecure channels, are easily subject to tracking, eavesdropping, vacation Emit, retransmit and refuse service etc. to attack；Simultaneously as low cost label has, storage is little, running space is limited, computing capability is low Etc. feature so that complicated AES is very difficult to apply in rfid system.These factors have become and have seriously restricted RFID technique The key issue of solution is needed in development badly further.

For overcoming the problems referred to above, between 10 years of past, emerge in large numbers substantial amounts of RFID personal secrets protection scheme, as physics is pacified The proposition in succession of full mechanism and software safety mechanism based on cryptographic technique etc..The former is to use non-cryptography mode such as Kill life Make, the mechanism protection RFID tag data privacy such as faraday cup, active interference and label jams.Due to the thing employed in RFID There is many disadvantages in reason security mechanism, then there has been proposed many security mechanisms based on cryptographic technique.It mainly by The cryptography scheme of various relative maturity and mechanism design and realize meeting the cipher protocol of RFID demand.According to label cost and The difference of security requirement, can be divided into two classes by RFID security authentication protocol: public key encryp scheme PKC (public Key crypto) and non-public key encryption system scheme NPKC (non-public key crypto).Based on public key encryp side What most of safety certifying method of case used is ECC (elliptic curve crypto) algorithm, has the highest safety strong Degree, but calculate spend bigger so that the cost of label be difficult to reduce, as Godor et al. propose certificate scheme (GODOR, NORBERT G.Elliptic curve cryptography based mutual authentication protocol for low computation RFID systems performance analysis by imulations[A] .2010IEEE International Conference on[C].2010.25-27).Based on non-public key encryption system scheme What safety authentication protocol mainly used is the hash function computing with certain security intensity, because it is relatively small to calculate cost, Safety is the highest, uses ratio wide at present, but major part scheme does not all account for the expansible of RFID Verification System Property.In order to ensure anonymity, labeling requirement sends after being encrypted by the identity information of oneself.Reader must first confirm label simultaneously Identity just can utilize the private information of label to verify the legitimacy of message, this need background data base attempt all labels Key information be decrypted, say, that confirm that the cost of label and number of tags are linear, when number of tags is too much Time determine that label cost is excessive.Scheme (Sarma S E, Weis S A, the Engels D W.RFID that Sarma S E et al. proposes systems and security and privacy implications[G]//LNCS 2523:Proc of the 4th Int Workshop on Cryptographic Hardware and Embedded Systems(CHES2002).Berlin: Springer, 2003:454-469) do not use dynamic refresh mechanism due to ID, metalID keeps constant, label easily by with Track positions, and (key, ID) sends with plaintext version, and easy stolen hearer obtains；The scheme that Ohkubo M et al. proposes (Ohkubo M,Suzuki K,Kinoshita S.Hash-chain based forward-secure privacy protection scheme for low-cost RFID[C]//Proc of the Symp on Cryptography and Informantion Security.Los Alamitors, CA:IEEE Computer Society, 2004:719-724) only It is one-way authentication protocol, and this agreement is highly susceptible to retransmit and impersonation attack；Scheme (the LEE S that Lee S M et al. proposes M,HWANG Y J,LEE D H,et al.Efficient authentication for low-cost RFID systems [A].Proceedings of International Conference on Com-putational Science and Its Applications [C] .2005.619-627) owing to solicited message being processed every time, it is impossible to prevent Denial of Service attack； Wang Shaohui et al. propose scheme (Wang Shaohui, Liu Sujuan, Chen Danwei. meet the expansible RFID two-way authentication side of backward privacy Case [J]. Journal of Computer Research and Development, 2013,06:1276-1284.) in label and reader the random number r1, r2 that produce be all Plaintext transmission, and hash function algorithm is all disclosed, assailant can be by exhaustive method breaking cryptographic keys Key value；Jin Yong Bright et al. propose scheme (gold Yongming, Wu's chess is crystal-clear, Shi Zhiqiang, Lu Xiang, Sun Limin. RFI D light-weight authentication based on PRF is assisted View research [J]. Journal of Computer Research and Development, 2014,07:1506-1514) safety is higher, but in the program, label produces Having given birth to random number and improve the cost of label, additionally this agreement needs traversal confirmation tag identity to make background data base amount of calculation Relatively big, extensibility is the strongest；Scheme (Alomair B, the Cuellar J, Poovendran that Alomair B et al. proposes R..Scalable RFID systems:A privacy-preserving protocol with constant time identification[J].IEEE Trans on Parallel and Distributed Systems,2012,23(8): 1-10) scheme (Godor G, the Imre S.Hash-based mutual authentication proposed with Godor G et al. protocol for low-cost RFID systems[C]//Proc of the 18th EUNICE Conf on Information and Communications Technologies.Berlin:Springer, 2012:76-87.) although The mode using assumed name solves expansible problem, but the scheme that Alomair B et al. proposes is not provided that backward personal secrets Property, and Godor G et al. propose scheme can not resisting asynchronous attack, assailant by reset, forge message so that label and In reader, the key data of storage is inconsistent, thus destroys the follow-up certification of label and reader.On this basis, Wo Menshe Counting an expansible safety certifying method based on Rabin algorithm, the method is avoided the defect of such scheme, is made the cost of label It is substantially reduced, and the query cost of background data base is greatly reduced, there is important Research Significance and use value..

Summary of the invention

The present invention is directed to existing many RFID security certificate schemes Shortcomings and scheme on cost and safety The aspects such as extensibility is bad, the one of design has good confidentiality, integrity, availability, high efficiency and low cost can The RFID mutual authentication method of extension.

The purpose of the present invention is realized by following technical scheme: a kind of distensible RFID mutual authentication method, including Step:

1) reader generates the random number r of an a length of L, is then obtained with shared identifier UID computing by random number r A, finally that calculated A is sent along to label together with request certification Query order；

2), after label receives request certification Query order and A, first take out the UID self stored, then calculate and extract r, Finally utilize (K, ID) that label self stores and calculated r to be encrypted calculating, generate two authenticity verification values B, C, And result of calculation is sent to reader；

3), after reader receives B and C, the data base on backstage is sent in the lump to together with the random number r self produced；

4) background data base is after receiving the information that reader is sent, and first calculates Bⁿ, BⁿFor the odd bits of B, then with Element Rapid matching in shared key even bit storehouse, obtains corresponding (K, ID), calculates and generates B`, C`, and whether checking B`, C` Equal with B, C, if equal, background data base calculates reader authenticity verification value D, and the value of D is sent to reader, simultaneously More new key K；

5), after reader receives information D that background data base transmission comes, forward that information to label, tag computation at once Going out D`, D` is the most equal with D in checking, if equal, the most more new key is K, certification success；Otherwise explanation reader is to forge, Authentification failure.

Preferably, step 1) in the identifier UID that shares of this random number r and all labels and reader carry out XOR Obtain

Preferably, step 4) the process that realizes be: background data base, after receiving the information that reader is sent, first calculates Bⁿ(odd bits of B), then in the even bit storehouse of epicycle shared keyIn look for whether exist and BⁿConsistent value, if existing, Then find out withCorresponding (K_new, ID), calculate B`=Cro (r, K<sub>new</sub>) and B`, C` are the most equal with B, C in checking, if equal, then carry out step 5, otherwise termination protocol；If not existing, then last round of The even bit storehouse of shared keyIn look for whether exist and B<sup>n</sup>Consistent value, if not existing, then termination protocol；No person finds out WithCorresponding (K<sub>old</sub>, ID), calculate B`=Cro (r, K_old) andChecking B `, C` are the most equal with B, C, if equal, background data base calculates reader authenticity verification value D, and is sent to read by the value of D Read device, simultaneously more new key K, otherwise termination protocol.

Preferably, step 4) in more new key carry out by following rule:

(1) if. BⁿWithValue in storehouse is consistent, then background data base more new key is as follows:

K_old=K_new；K_new=[K_new ²mod N]_L；

(2) if. BⁿWithValue in storehouse is consistent, then back-end data library key need not update.

Preferably, step 5) the process that realizes be: reader receives after background data base sends information D come, and will at once This information is transmitted to label, and tag computation goes out D`=Cro (r, [K<sup>2</sup>mod N]<sub>L</sub>), D` is the most equal with D in checking, if equal, the most more New key is K=[K²mod N]_L, certification success；Otherwise explanation reader is to forge, authentification failure.

The present invention compared with prior art, has the advantage that and beneficial effect:

On the basis of this method is the research work in terms of using for reference recent domestic RFID security certificate scheme, design A kind of based on Rabin algorithm expansible mutual authentication method.The random number of the method is produced by reader rather than label, The cost of label is greatly reduced；The all of information that in the method, between label and read write line, mutual authentication process is transmitted All transmit again after encryption, safer compared with traditional transmission means, simultaneously the information in of transmitting procedure all The most plural variable is unknown for assailant, thus thoroughly avoids assailant and use the method for exhaustion to crack The potential safety hazard of key；Introduce and intersect bit arithmetic algorithm, assumed name key K and random number r is carried out intersecting bit arithmetic, and general's calculating Result, as response message, is greatly reduced the query cost of background data base, has ensured certification the most to a certain extent simultaneously The confidentiality of communication；Introducing the Rabin AES after optimizing replaces the one-way hash function of major part agreement use to encrypt, In hgher efficiency with in communication capacity calculating.

Accompanying drawing explanation

Fig. 1 is the distensible RFID mutual authentication process flow chart of the present invention.

Fig. 2 is each parameter transmittance process schematic diagram in mutual authentication process of the present invention.

Fig. 3 is that in mutual authentication method of the present invention, intersection bit arithmetic calculates process flow diagram flow chart.

Detailed description of the invention

The present invention is described in further detail below in conjunction with the accompanying drawings, but embodiments of the present invention are not limited to this.

First the implication of each symbol related in method described in the present embodiment is given:

R: reader；

T: label；

DB: background data base；

The identifier that UID: all labels and reader are shared；

ID: tags unique identifier accords with；

K_new: the shared key of epicycle；

The even bit of epicycle shared key；

K_old: last round of shared key；

The even bit of last round of shared key；

The length of L: key；

The Mersenne number of N: selection, N=2^L-1；

The random number that r: reader produces；

XOR；

[]_L: take the front L position of operation result

Cro (X, Y): intersection bit arithmetic, specifically, if X, Y are the binary system arrays (s is even number) of two s positions, X= x₁x₂x₃…x_s, Y=y₁y₂y₃…y_s。x_i, y_i∈ 0.1}, i=1,2 ... s, the bit arithmetic Cro (X, Y) that intersects is by the odd bits of X The new array in s position intersected with the even bit of Y and formed, i.e. Cro (X, Y)=y₂x₁y₄x₃y₆x₅…y_sx_s-1.Cro's (X, Y) Calculating process in detail is as it is shown on figure 3, take length s=16 here, if X=1010011100101100, Y= 01100101100111, then Cro (X, Y)=1101101100111110.

In the scheme that this method proposes, parameters in the concrete verification process of label, reader and background data base Transmission sees Fig. 2, wherein A, B, Bⁿ, the explanation of C, D:

$A=r\&CirclePlus;\mathrm{UID};$

B=Cro (r, K)；

Bⁿ: the odd bits of B；

$C={\left[{(r\&CirclePlus;K\&CirclePlus;\mathrm{ID})}^2\mathrm{mod}\mathrm{}N\right]}_L;$

K_new=[K²mod N]_L；

D=Cro (r, K_new)；

Below in conjunction with Fig. 1, the verification process of the present embodiment is described as follows:

1, first reader generates random number r, the identifier then shared by this random number r with all labels and reader UID carries out XOR and obtainsFinally calculated A is together sent out together with request certification Query order Give label.

2, after label receives request certification Query order and A, first calculate extractionAnd calculate B, C, Result of calculation is sent to reader.

3, after reader receives B and C, send the data base on backstage in the lump to together with the random number r self produced.

4, background data base, after receiving the information that reader is sent, first calculates Bⁿ(odd bits of B), then at this The even bit storehouse of wheel shared keyIn look for whether exist and BⁿConsistent value, if exist, then find out withCorresponding (K_new, ID), calculate B`=Cro (r, K<sub>new</sub>) and Checking B`, C` whether with B, C phase Deng, if equal, then carry out step 5, otherwise termination protocol.If not existing, then in the even bit storehouse of last round of shared key In look for whether exist and B<sup>n</sup>Consistent value, if not existing, then termination protocol；No person find out withCorresponding (K<sub>old</sub>, ID), Calculate B`=Cro (r, K_old) andB`, C` are the most equal with B, C in checking, if Equal, then carry out step 5, otherwise termination protocol.

5, background data base calculates reader authentication information D=Cro (r, [K²mod N]_L) value, and the value of D is sent to Reader, and the most more new key:

(1) if. BⁿWithValue in storehouse is consistent, then background data base more new key is as follows:

K_old=K_new；K_new=[K_new ²mod N]_L。

(2) if. BⁿWithValue in storehouse is consistent, then back-end data library key need not update.

6, after reader receives information D that background data base transmission comes, forward that information to label at once.Tag computation Go out D`=Cro (r, [K<sup>2</sup>mod N]<sub>L</sub>), D` is the most equal with D in checking, if equal, the most more new key is K=[K²mod N]_L, recognize Demonstrate,prove successfully；Otherwise explanation reader is to forge, authentification failure.

The BAN logical form fractional analysis of authentication protocol is given below, and BAN logic is by Burrows, Abadi and Needham In nineteen ninety propose the logic of modality based on conviction, mainly include three kinds process objects: main body, key, formula.This method is adopted By BAN logical form fractional analysis method, scheme is carried out Security Proof.It is below the part rule of inference of BAN logic:

(1) message implication rule:It is meant that if P believes that K is the shared key between P and Q, and P receives the message { X} with K encryption X_K, then P believes that Q is transmitted across message X；

(2) message freshness rule:It is meant that if a part for a formula is fresh, then this formula Be entirely the freshest；

(3) nonce proof rule:It is meant that if message X is fresh, and P believes that Q once sent Cross X, then P believes that Q believes X；

(4) administration rule:It is meant that if P believes that message X is had jurisdiction by Q, and P believes that Q believes X, then P believes X；

First the idealized model of scheme is given:

Message 1. R → T:{Query, A}, A are the ciphertexts comprising random number r encryption；

Message 2. T → R:B, C；

Message 3. R → T:D；

The original hypothesis of scheme:

P₁:(R believes R and T shared key value K).

P₂:(T-phase letter R and T shared key value K).

P₃:(R believes that R and T shares identifier ID).

P₄:(T-phase letter R and T shares identifier ID).

P₅:(R believes the identifier UID that R and T shares).

P₆:(the identifier UID that T-phase letter R and T shares).

P₇: T | ≡ # (r) (freshness of T-phase letter random number r).

P₈: R | ≡ # (r) freshness of random number r (R believe).

P₉:(R believes that T is to M₂Jurisdiction).

P₁₀:(R believes that T is to M₃Jurisdiction).

P₁₁:(T-phase letter R is to M₄Jurisdiction).

Security Target:

G₁: R | ≡ B, R believe B；G₂: R | ≡ C, R believe C；

G₃: T | ≡ D, T-phase letter D.

Analysis ratiocination:

2. obtained by message(R once received the B that disappears), and by original hypothesis P₁And message implication rule(R believes that T is transmitted across message M for | the ≡ T |～B that obtains R₂)。

By assuming P7 and message freshness ruleObtain R | ≡ # (B).

| ≡ T |～B, R by the R derived | ≡ # (B) and nonce proof ruleObtain R | ≡ T | ≡ B (R believes that T-phase believes B).

| ≡ T | ≡ B, initial state assumption P by R₉And administration ruleR can be obtained | ≡ B.Therefore, target G₁ Must demonstrate,prove.

Using above-mentioned condition and rule, proving by the same methods obtains G₂And G₃.Here is omitted.

Above-described embodiment is the present invention preferably embodiment, but embodiments of the present invention are not by above-described embodiment Limit, the change made under other any spirit without departing from the present invention and principle, modify, substitute, combine, simplify, All should be the substitute mode of equivalence, within being included in protection scope of the present invention.

Claims (5)

1. an extendible RFID mutual authentication method, it is characterised in that include step:

1) reader generates the random number r of an a length of L, then with shared identifier UID computing, random number r is obtained A, After by calculated A together with request certification Query order sent along to label；

2), after label receives request certification Query order and A, first take out the UID self stored, then calculate and extract r, finally Utilize (K, ID) that label self stores and calculated r to be encrypted calculating, generate two authenticity verification values B, C, and will Result of calculation is sent to reader；

3), after reader receives B and C, the data base on backstage is sent in the lump to together with the random number r self produced；

4) background data base is after receiving the information that reader is sent, and first calculates Bⁿ, BⁿFor the odd bits of B, then with share Element Rapid matching in key even bit storehouse, obtains corresponding (K, ID), calculates and generates B`, C`, checking B`, C` whether with B, C is equal, if equal, background data base calculates reader authenticity verification value D, and the value of D is sent to reader, updates simultaneously Key K；

5) after reader receives information D that background data base transmission comes, forwarding that information to label, tag computation goes out D at once `, D` is the most equal with D in checking, if equal, the most more new key is K, certification success；Otherwise explanation reader is to forge, certification Failure.

Method the most according to claim 1, it is characterised in that: step 1) in this random number r and all labels and reader The identifier UID shared carries out XOR and obtains

Method the most according to claim 1, it is characterised in that: step 4) the process that realizes be: background data base receive After the information that reader is sent, first calculate Bⁿ(odd bits of B), then in the even bit storehouse of epicycle shared keyIn Look for whether to exist and BⁿConsistent value, if exist, then find out withCorresponding (K_new, ID), calculating B`=Cro (r, K<sub>new</sub>) andB`, C` are the most equal with B, C in checking, if equal, then carry out step 5, no Then termination protocol；If not existing, then in the even bit storehouse of last round of shared keyIn look for whether exist and B<sup>n</sup>Consistent value, If not existing, then termination protocol；No person find out withCorresponding (K<sub>old</sub>, ID), calculate B`=Cro (r, K_old) and B`, C` are the most equal with B, C in checking, if equal, background data base calculates the reader true and false and tests Card value D, and the value of D is sent to reader, more new key K, otherwise termination protocol simultaneously.

Method the most according to claim 1, it is characterised in that: step 4) in more new key carry out by following rule:

(1) if. BⁿWithValue in storehouse is consistent, then background data base more new key is as follows:

K_old=K_new；

(2) if. BⁿWithValue in storehouse is consistent, then back-end data library key need not update.

Method the most according to claim 1, it is characterised in that: step 5) the process that realizes be: reader receives rear number of units After sending, according to storehouse, information D come, forwarding that information to label, tag computation goes out D`=Cro (r, [K at once<sup>2</sup> mod N]<sub>L</sub>), test D` is the most equal with D for card, if equal, the most more new key is K=[K² mod N]_L, certification success；Otherwise explanation reader is pseudo- Make, authentification failure.