Impersonation Attack on RFID Authentication Protocol and its Countermeasures

Abstract:

Due to the well-developed technology and its variety of applications, the Radio Frequency Identifications (RFIDs) are widespread in a broad range of markets. In many applications, the RFID systems need security service such as authentication mechanism to identify tag and resist possible attacks. In 2008, Song et al. proposed a RFID authentication protocol for low-cost tags. Their protocol has the merits of privacy and security properties, and it can stand tag impersonation attack, replay attack, and backward/forward traceability. In this article, we show that their protocol cannot resist server impersonation attack as they declared. An adversary can successfully impersonate as a server to send fake message for verification. We also present countermeasures to fix the flaw. The performance of the improved mechanisms is the same as that of Song et al.’s protocol while the server impersonation attack is avoided.

• Periodical: Key Engineering Materials (Volumes 467-469)
• Pages: 1787-1792
• DOI: https://doi.org/10.4028/www.scientific.net/KEM.467-469.1787
• Online since: February 2011
• Authors: Yung Cheng Lee
• Keywords: Authentication, Impersonation Attack, Radio Frequency Identification (RFID)

References

[1] G. Avoine: The Sixth International Conference on Smart Card Research and Advanced Applications-CARDIS (2004), p.33.

[2] G. Avoine, E. Dysli, and P. Oechslin: Lecture Notes in Computer Science, Vol. 3897, Springer-Verlag (2005), p.291.

[3] H. Y. Chien: IEEE Transactions on Dependable and Secure Computing, Vol. 4, No. 4 (2007), p.337.

[4] H. Y. Chien and C. H. Chen: Computer Standards & Interfaces, Vol. 29, No. 2 (2007), p.254.

[5] T. Dimitriou: IEEE International Conference on Security and Privacy for Emerging Areas in Communication Networks, SECURECOMM 2005, p.59.

[6] S. L. Garfinkel, A. Juels, R. Pappu: IEEE Security & Privacy, Vol. 3, No. 3 (2005), p.34.

[7] A. Henrici and P. M¨ulle: IEEE International Workshop on Pervasive Computing and Communication Security, PerSec'04, (2004), p.149.

[8] A. Juels: The IEEE Journal on the Selected Areas in Communications, Vol. 24, Is. 2 (2006), p.381.

[9] M. Langheinrich: Proceedings of the Security, Privacy, and Trust in Modern Data Management, Springer (2007), p.433.

[10] M. Ohkubo, K. Suzki, and S. Kinoshita: RFID Privacy Workshop (2003). http: /www. avoine. net/rfid/download/papers/OhkuboSK-2003-mit-paper. pdf.

[11] P. Peris-Lopez, J. C. Hernandez-Castro, J. M. Estevez-Tapiador, and A. Ribagorda: Proceedings of the Second Workshop RFID Security, RFID'06 (2006).

DOI: 10.1201/9781420068405.ch2

[12] R. D. Pietro and R. Molva: ESORICS 2007, Lecture Notes in Computer Science, Springer- Verlag, Vol. 4734 (2007), p.187.

[13] D. C. Ranasinghe, D. W. Engels, and P. H. Cole: Auto-ID Labs White Paper Journal, WP- SWNET- 013, Vol. 1 (2005), p.1.

[14] B. Song, C.J. Mitchell: Proceedings of the first ACM Conference on Wireless Network Security (2008), p.140.

[15] S. Weis, S. Sarma, R. Rivest, and D. Engels: International Conference on Security in Pervasive Computing, SPC2003, Lecture Notes in Computer Science, Vol. 2802 (2003), p.454.