ACTION: Breaking the Privacy Barrier for RFID Systems

Transcription

1 ACTION: Breaking the Privacy Barrier for RFID Sytem Li Lu, Jinong Han, Renyi Xiao, and Yunhao Liu Deartment of Comuter Science & Engineering, Hong Kong Univerity of Science & Technoogy, Hong Kong, China Abtract In order to rotect rivacy, Radio Frequency Identification (RFID) ytem emoy Privacy-Preerving Authentication (PPA) to aow vaid reader to exicity authenticate their dominated tag without eaking rivate information. Tyicay, an RF tag end an encryted meage to the reader, then the reader earche for the key that can decryt the ciher to identify the tag. Due to the arge-cae deoyment of today RFID ytem, the key earch cheme for any PPA require a hort reone time. Previou deign contruct baance-tree baed key management tructure to acceerate the earch eed to O(ogN), where N i the number of tag. Being efficient, uch aroache are vunerabe to comromiing attack. By caturing a ma number of tag, comromiing attacker are abe to identify other tag that have not been corruted. To addre thi iue, we rooe an Anti- Comromiing authentication rotoco, ACTION, which emoy a nove are tree architecture, uch that the key of every tag i indeendent from one another. The advantage of thi deign incude: 1) reiience to the comromiing attack, ) reduction of key torage for tag from O(ogN) to O(1), which i ignificant for reource critica tag device, and 3) high earch efficiency, which i O(ogN), a good a the bet in the reviou deign. Keyword-RFID; rivacy; authentication; comromiing I. INTRODUCTION Due to the ow cot and eay deoyment, Radio- Frequency Identification (RFID) ha been an imortant enabing technoogy for everyday aication, uch a retaiing, medica-atient management, acce contro [1], ogitic and uy chain management [, 3]. In RFID ytem, RF tag emit their unique eria number to RF reader. Without rivacy rotection, however, any reader can identify a tag ID via the emitted eria number. Indeed, a maiciou reader can eaiy erform bogu authentication with detected tag to retrieve enitive information within it canning range. Currenty, many comanie embed RF tag into item. A thee tag contain unique information about the item, a cutomer carrying the tag i ubject to ient tracking from unauthorized reader. Senitive erona information might be ao eaked: detai about an ine inferred by the urchae of certain harmaceutica roduct; the ma he ho at; the tye of item he refer to buy, and o on. Ceary, a ecure RFID ytem mut meet two requirement. Firt, vaid reader mut be abe to identify vaid tag. Second, mibehaving reader houd not be abe to retrieve rivate information from vaid tag. In order to rotect rivacy, Privacy-Preerving Authentication (PPA) i introduced into the interactive rocedure between RFID reader and tag [4]. To achieve PPA, an RFID tag erform a crytograhy enabed chaengingreone rocedure with a reader [5]. For exame, we can et each tag hare a key with the reader. During authentication, the reader firt robe a tag via a query meage with a nonce. Intead of anwering the query in aintext, the tag reie to the reader with the encryted nonce. The reader earche a the key that it hod in the back-end databae. If the tag i vaid, the reader can find a roer key to recover the authentication meage, and thereby identify the tag. (For imicity, we ue the term reader to denote the reader device a we a the back-end databae in the foowing). Uing PPA, any invaid tag wi not be acceted ince it cannot rovide a roer ciher reated to a key owned by the reader. Meanwhie, the vaid tag doe not exoe it identity to any third arty in PPA ince ony vaid reader know the key ued for encryting meage. A maiciou reader cannot identify a uer via robing the vaid tag. Athough it i ime and ecure, uch a PPA baed deign uffer oor caabiity. Uon receiving a nonce ciher, the reader need a romt ooku to ocate a key in the databae. Ceary, the earch comexity i O(N), where N i the number of a the oibe tag, even ony a ma ortion of them are in the reader range. In today arge-cae RFID ytem, N i often a arge a hundred of miion, and thouand of tag may reond to a reader imutaneouy, demanding a fat keyearch method a we a a carefuy deigned key-torage tructure. Hence, baance-tree baed cheme [6-9] emoy key-haring infratructure to acceerate the authentication rocedure, in which the ooku comexity i O(ogN). The baance-tree baed aroache are efficient, neverthee, not ecure due to the key-haring infratructure. A the infratructure ued by thoe aroache i tatic, each tag, more or e, hare ome common key with other tag (in thi aer, we ue norma tag to denote tag that are not tamered with). Conequenty, comromiing one tag might revea information of other tag [6, 9]. L. Lu, et a evauate the damage caued by the comromiing attack to baance-tree baed aroache [9]. By comromiing ony twenty tag, an adverary can achieve a neary 100% robabiity of uccefuy track norma tag in a baance-tree baed RFID ytem containing 0 tag [10]. L. Lu, et a rooe a dynamic key-udating cheme [9], SPA, for baance-tree bae aroache to mitigate the imact of comromiing attack. SPA reduce the number of key hared among comromied and norma tag, and aeviate

2 the damage caued by comromiing attack. SPA, however, doe not eiminate the imact of comromiing attack. For intance, uing SPA in an RFID ytem with 0 tag, the robabiity of tracking norma tag i coe to 60% after an adverary comromie twenty tag [9]. Another drawback for baance-tree baed PPA i the arge ace needed for toring key in each tag. Baance-tree baed aroache require each tag to hod O(og δ N) key, and the reader to tore δ N key, where δ i a branch factor of the key tree. Due to the imited memory caacity of RF tag, exiting PPA are difficut to ay in current RFID ytem. In order to addre the above iue, we rooe an Anti- Comromiing authentication rotoco, caed ACTION. By emoying a are tree to organize key, ACTION generate cometey indeendent key for tag, o that comromied tag have no key that correate with the norma one. A a reut, ACTION can effectivey defend againt comromiing attack. We how that if an attacker can track a norma tag with a robabiity arger than α, it mut tamer with more than N 1/α tag, whie in reviou baance-tree baed aroache, by comromiing O(ogN) tag, an attacker can track a norma tag with a robabiity coe to 100% [10]. Another aient feature of thi deign i the ow torage requirement for tag. ACTION ony aow each tag to tore two key and the reader to tore O(N) key, achieving high torage efficiency for both reader and tag, making thi deign ractica for today RF tag. We ao how that ACTION retain high earch efficiency in the ene that the ooku comexity i ti O(ogN), a good a the bet of reviou deign. The ret of thi aer i organized a foow. We dicu the reated work in Section II. We reent the ACTION rotoco in Section III. In Section IV, we dicu the torage and earch efficiency of ACTION. We reent the ecurity anayi in Section V, and concude the work in Section VI. II. RELATED WORK The fundamenta rincie of PPA i baed on HahLock [5], in which every tag hare a unique key with the reader. A tag and the reader ue a chaenging-reone cheme to conduct authentication. Recent tudie [13] how that HahLock i a ecure PPA. The main drawback of HahLock i that the key earch i inear to the number of tag in the ytem, which imit the uage of HahLock in arge-cae RFID ytem. Subequent aroache in the iterature are moty aimed at imroving the efficiency of key earch. Jue [14] caifie thoe aroache into three categorie. Synchronization aroache: Such aroache [15-18] ue an incrementa counter to record the tate of authentication. When an authentication i uccefuy erformed, the tag increae the counter by one. The reader comare the vaue of a tag counter with the record in the databae. If the difference of the two counter vaue i in a roer window, the tag i viewed a vaid and the reader ynchronize the counter record of the tag. Synchronization cheme are ubject to the deynchronization attack [14], in which a maiciou reader interrogate a tag many time uch that the counter of the tag exceed the range of the window and the reader fai to recognize a vaid tag. Time-ace tradeoff aroache: OSK [15] and AO [19] emoy Heman tabe [0] to imrove the key-efficiency. Heman tudie the robem of breaking ymmetric key and how that an adverary can re-comute a Heman tabe of torage ize O(N /3 ), in which the adverary can earch a key with the comexity of O(N /3 ). That mean the key-earching efficiency of OSK or AO i ao O(N /3 ). Thoe aroache are not ufficienty efficient for uorting arge-cae RFID ytem. Baance-tree baed aroache: Baance-tree baed aroache [6-9] imrove the key earch efficiency from inear comexity to ogarithmic comexity. They emoy a baancetree to organize and tore key for tag. In a baance-tree, each node tore a unique key. Key in the ath from the root to a eaf node are ditributed to a tag. Each tag ue thee mutie key to encryt the identification meage. Uon receiving an encryted meage, the reader erform a Deth-Firt Search on the key tree with a ogarithmic comexity of the ytem ize. The baance-tree baed aroache, however, are ubject to the comromiing attack [6, 9]. In a baance-tree, tag away hare key with other. Hence, hacking one tag may revea evera key ued by other tag. For exame, in a binary baance-tree baed RFID ytem containing 0 tag, an adverary can identify any tag with the robabiity of about 90% by tamering with ony twenty tag [9, 10]. To addre a comromiing attack, L. Lu, et a rooe a dynamic keyudating cheme, SPA [9], for enhancing baance-tree baed aroache. In SPA, the reader dynamicay and recurivey udate key in the key tree and coordinate the key with the tag after a uccefu identification. The key-udating cheme reduce the robabiity of ocating a tag via comromiing attack. However, the threat from comromiing attack ha not been cometey reieved. For intance, in a SPA ytem containing 0 tag, an adverary can ti recognize any norma tag with a high robabiity (about 60%) after it tamer with twenty tag [9]. III. ACTION DESIGN In thi ection, we firt dicu the motivation of thi work, and then reent the detai of the ACTION rotoco. A. Motivation In reviou baance-tree baed aroache, initiay, a reader organize a hierarchica baance-tree with a deth of og δ N (δ i branching factor), in which each node i aigned a unique key. The reader then monogamouy ma N eaf node to N tag. Figure 1 ot a baance-tree for eight tag. For each tag, there i a unique hortet ath from the root to the correonding eaf node. For exame, in Fig. 1, the tag T 3 obtain k 1, 1, k,, and k 3, 3. During authentication, uon receiving a requet with a nonce r from the reader, T 3 encryt r in the way {k 1, 1 {r}, k, {r}, k 3, 3 {r}} and end the ciher to the reader. Uon receiving the reone from T 3, the reader earche roer key in the key tree to recover r. Thi i equa to exoring a ath from the root to the eaf node of T 3 in the tree. At the end of identification, if uch a ath exit, R

3 k,1 k1,1 k 1, k k,, 3 k,4 k3,1 k3, k3, 3 k3, 4 k3, 5 k3, 6 k3, 7 k 3, 8 Figure 1. An exame of key organization in baance-tree baed PPA. regard T 3 a a vaid tag. Ceary, the earch comexity i O(ogN). The fundamenta nature of baance-tree baed PPA i that a tag hare ome non-eaf node, more or e, with other tag in the key tree. Thi i a fata faw when baance-tree baed PPA are under the comromiing attack. For exame, in Fig. 1, we can ee that a common key, k 1, 1, i hared by tag T 1, T, T 3, and T 4, and k, i hared by T 3 and T 4. If an adverary comromie T 3 and revea the key tored in T 3, the key k 1, 1 and k, are ao exoed. A a reut, even though T 4 i not cracked, the attacker can eaiy ditinguih T 4 via k 1, 1 and k,. Even wore, the adverary can actuay ditinguih each norma tag by ony comromiing a ma fraction of a tag. Recenty, L. Lu, et a rooe a dynamic key-udating method, SPA [9], which mitigate the imact of the comromiing attack. SPA udate a tag key from the eaf node to the root in the key tree. Each non-eaf node ue a number of tate bit to record the key-udating tatu of it chidren. The od key that are ued by other tag wi be tored into temorary cache. The non-eaf node automaticay udate it own key if a it chidren have udated their key. Comared to non-key-udating aroache, SPA i more ecure becaue it revea fewer key hared between a comromied tag and norma tag to adverarie. Uing SPA, however, the robabiity that comromiing attack ucceed [9] i ti arge, more than 50% in genera cae. That i, for an RFID ytem containing 0 tag, an adverary ony need to comromie 0 tag before it i abe to ditinguih any tag from other with a robabiity arger than 50%. The main reaon i that the deendence among the key of different tag i remaining. SPA reduce the number of key correating to norma tag, but the tag away hare key in baanced tree tructure. Hence, tag are ti threatened by comromiing attack. Baed on the above anayi, it i cear that the ony oution to comromiing attack i to eiminate the correation among the key of different tag. Therefore, in thi deign, we intend to remove a correation among the key. The difficuty i that we cannot acrifice the earch efficiency a we a the torage efficiency. B. Overview ACTION ha four comonent: ytem initiaization, tag identification, key-udating, and ytem maintenance. In the firt comonent, intead of uing a baance-tree, we emoy a are tree to organize key for tag. We generate two random key (18 bit) for each tag, denoted a eaf key k, and ath key k, reectivey. The k i correonding to a ath in the Figure. A key tree with four tag (N = 4). are tree according to it vaue. Each tag i aociated with a eaf node in the tree after the key initiaization. The eaf node thereby hod the key k aigned to the tag, and the ath from the root to the eaf node indicate the key k. Since the two key are randomy generated, key among different tag are indeendent. In the econd comonent, the reader erform a ogarithmic earch to identify a tag. In the third comonent, ACTION erform a key-udating rocedure, in which ACTION emoy a crytograhic hah function, uch a MD5, SHA-1, to udate the od key in a tag. Note that the new key i ti random and indeendent of the key ued by other tag. ACTION ao reduce the maintenance overhead in highy dynamic ytem where tag join or eave frequenty by uing the fourth comonent. C. Sytem Initiaization We aume that there are N tag T i, 1 i N, and a reader R in the RFID ytem. We denote the are tree ued in ACTION a S. Let δ denote the branching factor of the key tree and d denote the deth of the tree. Each tag i aociated with a eaf node in S. The ecret key hared by tag T i and reader R are denoted a k i and k i. Let n be the ength of k i and k i, i.e. k i = k i = n. We it k i into d art a k i [0] k i [1] k i [d-1] ( denote concatenation), and the ength of each k i [m] i n/d, 0 m d 1. We et the branching factor, δ, of each non-eaf node in S a n/d, namey d ogδ = n. For exame, if we et the key ength a 18 bit and d = 3, the branching factor of the S i δ = 18/3 = 4 = 16. In other word, each non-eaf node i abe to accommodate 16 chid oition in S. If the c-th chid node exit in a chid oition of a non-eaf node j, we et c a the index number of thi chid and record c in j. Note that a non-eaf node ony tore the index number for exiting chidren. For imicity, we denote the et of j index number a IS j, and the eement number of IS j a IN j, that i, IN j = IS j. We how an exame in Fig., in which the branching factor δ i 4. Each non-eaf node ha ixteen chid oition. For a noneaf node a, a hown in Fig., the reader maintain it index number et a IS a = {5, 7}, and the IN a =. Initiay, the tree i emty. Reader R generate two key k i and k i uniformy at random for every tag T i. Meanwhie, the reader divide each k i into d art, k i [0] k i [1] k i [d-1], where d i the deth of key tree S. The reader ditribute k i and k i to tag T i and organize k i into S a foow. From the root, the reader generate a non-eaf node at each eve m

4 Reader R Requet, r 1 according to the correonding k i [m]. Secificay, after generating a node a at the eve m-1 according to the k i [m-1], the reader wi generate the k i [m]-th chid of node a, and et an index number of a a k i [m]. For the exame hown in Fig., the branching factor δ of S i 16, and there are four tag in the ytem, denoted a T 1, T, T 3, and T 4. Aume that the ength of ath key i tweve bit. Each ath key i divided into three art, and the ength of each art i four bit (becaue δ = 16, the ength of each art of a key houd be og 16 = 4 bit). The reader generate four ath key a 57, 77, 468, and 354 for tag T 1 -T 4, reectivey. The reader ao generate four eaf key a k 1, k, k 3, and k 4 for T 1 -T 4, reectivey. For T 1, k 1 = 57 ( ), thu, k 1 [0] =, k 1 [1] = 5, and k 1 [] = 7. The reader firt generate a chid at the root, and et an index number a (k 1 [0] = ). Here the index number mean the root ha a chid marked a node a in it econd oition, a iutrated in Fig.. Then the reader generate a chid b of node a, and et an index number of a a 5 (k 1 [1] = 5). Finay, the reader generate a chid c of node b, which i a eaf node c, and et an index number of b a 7 (k 1 [] = 7). Indeed, the key organization i anaogou to generating a ath in tree S. In the above exame, the ath of T 1 i root a b c. After the ame rocedure on tag T, T 3, and T 4, we obtain a are tree a iutrated in Fig.. The rocedure i decribed in Agorithm 1 TagJoin. Agorithm 1: TagJoin (Tag T, Key Tree S) 1: k, k KeyGeneration(T); : (k [0],, k [d-1]) KeyDiviion(k ); 3: Node GetRoot(S); 4: for i = 0 to d 1 5: Add k [i]into Node Index Set IS; 6: if the k [i]-th chid doe not exit 7: Create the k [i]-th chid; 8: Node the k [i]-th chid; 9: ee Node the k [i]-th chid; U σ Tag Ti Figure 3. The authentication rocedure of ACTION. D. Tag Identification ACTION emoy crytograhic hah function to generate authentication meage and udate key. Let h denote a crytograhic hah function: h:{0,1} * {0,1} n, where n denote the ength of the hah vaue. Let N be the number of a tag in the ytem. The baic authentication rocedure between the reader and a tag T i ( 1 i N ) incude three hae, a iutrated in Fig. 3. In the firt hae, the reader R end a Requet with a random number r 1 (a nonce) to tag T i. In the econd hae, uon receiving Requet, tag T i generate a random number r (a nonce) and cacuate a erie Agorithm : Identification (U, node X) 1: SUCCEED fae; : m DethOfNode(X); 3: IS GetIndexSet(X); 4: IN IS ; 5: if m d 6: for i = 1 to IN 7: if v m = h(r 1, r, i) i IS 8: Y GetChid(X,i); 9: Identification (U, Y); 10: ee if m = d h(r 1,r, k ) = v d 11: SUCCEED true; 1: if (SUCCEED = fae) 13: Fai and outut 0; 14: Accet and outut 1; of hah vaue, h(r 1, r, k i [0]), h(r 1, r, k i [1]),..., h(r 1, r, k i [d- 1]), h(r 1, r, k i ), where h(r 1, r, k) denote the outut of the hah function on three inut: a key k and two random number r 1 and r. T i reie R with a meage U = (r, h(r 1, r, k i [0]), h(r 1, r, k i [1]),..., h(r 1, r, k i [d-1]), h(r 1, r, k i )). For imicity, we denote the eement in U a u, v 0, v 1,, v d-1,v d where u = r and v j = h(r 1, r, k j i ), j = 0...d-1, v d = h(r 1, r, k i ). In the third hae, R identifie T i uing the key tree S and the received U. Reader R invoke a recurive agorithm to robe a ath from the root to a eaf in S to identify T i a hown in Agorithm. Aume R reache a non-eaf node a at eve m-1. For a index number tored in a, R comute the hah vaue with inut r 1, r, and the index number. R then comare the hah vaue with the eement v m in the received U. If there i a match, the ath of T i houd be extended to the chid reated to the index number. Note that here the chid node i on the ath aigned to T i. Reeating uch a rocedure unti arriving at a eaf node, R recognize the tag T i. For the exame hown in Fig., uon receiving a Requet meage with a random r 1, T 1 generate a random number r, and comute a erie of hah vaue h(r 1, r, ), h(r 1, r, 5), h(r 1, r, 7), and h(r 1, r, k 1 ), then reie R with the meage U = (u, v 0, v 1, v ) = (r, h(r 1, r, ), h(r 1, r, 5), h(r 1, r, 7), h(r 1, r, k 1 )). After receiving U, R comute a h(r 1, r, x) to comare with v 1. Here x =, 5, and 7, which are a the index number tored in the root. Ceary, R ocate a a match number and thereby move to node a. Then R ocate 5 and 7 in the node b and node c, reectivey. R terminate it ath robing when it reache the eaf node c, and hence identifying T 1. E. Key-Udating After uccefuy identifying T i, R and T i automaticay udate the key tored in T i and coordinate the change to the tree S a foow. R make ue of a crytograhic hah function h to generate new key. Let k i and k i be the current ath key and eaf key ued by T i. R comute a new ath key ki from the od ath key k i and eaf key k i by comuting k i = h(r 1, r, k i, k i ). Simiary, R cacuate the new eaf key a k i = h(r 1, r, k i ).

5 The chaenging iue here i that we need to carefuy modify the index number of non-eaf node according to the new key k i. Otherwie, ome tag identification can be interruted, ince the index number tored in non-eaf node might be hared among mutie tag. To addre the chaenge, we deign two agorithm for key-udating: TagJoin hown in Agorithm 1 and TagLeave hown in Agorithm 3. The baic idea i that we firt ue the TagLeave to remove the ath correonding to od ath key k i of tag T i, and then generate a new ath correonding to key k i in S. It i oibe that a non-eaf node in the ath ha mutie branche o that ome key are ued by other tag, for exame, node a in Fig.. In thi cae, the TagLeave agorithm terminate. Agorithm 3: TagLeave (Tag T, Key Tree S) 1: k, k GetKey(T); : (k [0],, k [d-1]) KeyDiviion(k ); 3: Node GetLeaf(T);\\ Get the correonding eaf node of T 4: for i = d 1 to 0 5: if Node doen t have brother 6: TemNode Node; 7: Node FindParent(TemNode); 8: Deete the k i from the Index Set IS of Node; 9: Deete TemNode; 10: ee Node FindParent(Node); After deeting the od key, R re-generate a new ath for tag T i according to the new key ki uing the TagJoin agorithm. A otentia robem of new ath generation i that the ath ha exited in S, which mean the key ki ha been generated in the ytem. The robabiity of thi ituation haening i quite ma. Firt, the are tree i a virtua tree according to the initiaization agorithm. Prior to the tag deoyment, the tree i emty. When a ath key i generated by a hah function, a ath from a certain eaf to the root emerge accordingy in the are tree. Therefore, a ath in the are tree correond to a hah vaue. Thi correondence ead to two fact: 1) the caabiity of a are tree i a arge a the ize of the hah vaue ace. In our work, a ath key i a hah vaue with a ength of 18 bit, which indicate the are tree can hod 18 ath at it maximum, that i, the are tree can hod 18 tag correondingy. In any ractica RFID ytem, however, the number of tag i much e than 18. The robabiity that the tree become dene i negigibe. ) A ath in the are tree correond to a hah vaue. Therefore, if two tag have the ame ath in the are tree, a hah coiion aear. According to the coiion-reitance roerty of hah function, the robabiity of a hah coiion haening i ao negigibe. For exame, an RFID ytem contain 0 tag, and the ength of a ath key i 18 bit. The ratio of occuied ath in the are tree i -88 ( 0 / 18 ), and the ath key i generated uniformy at random. Thu, the robabiity of generating an exiting ath i -88. It i afe to caim that the robabiity of two tag having a imiar ath i negigibe baed on the above anayi. If uch a coiion doe haen, in thi deign, R firt generate a new key k i = h( r1, r, ki, ki ), and then execute the TagJoin agorithm again to create a new ath in S. R reeat uch a rocedure unti a new ath i uccefuy generated. R count the number that TagJoin run, denoted a (due to the negigibe robabiity of coiion, uuay equa to 1), and end a ynchronization meage σ = (, h(r 1, r, k i ), h(r 1, r, k i )) to tag T i, a hown in Fig. 3. Here k i i comuted from iterative equation by: 1 ki = ki 1 (1) ki = h( r1, r, ki, ki ) Having σ, T i can coordinate it key with the one generated by the reader. T i firt comute k i uing k i and with equation (1), then comute k i = h(r 1, r, k i ). Thu, T i get σ = (, h(r 1, r, k i ), h(r 1, r, k i )). After comuting σ and σ, T i verifie whether σ i identica to σ. If ye, T i udate it key a ki and k i to finih the ynchronization. Otherwie, T i return an error to the uer. F. Sytem Maintenance Thi comonent i mainy for tag joining and eaving. If a new tag T i join the ytem, R need to find a new ath in the key tree by invoking the TagJoin agorithm. In detai, R generate a new ath key k i and eaf key k i indeendent to other key, then it k i into d art, k i [0], k i [1],, k i [d-1]. Starting from the root, R contruct the ath downward. If R arrive at a non-eaf node j at eve m, R add k i [m] into j index number et IS j, and wak to the k i [m]-th chid of j (if thi chid doe not exit, R create it). When a eaf node i reached, R aociate T i to the eaf node, and et the key of the eaf node a k i. A new ath i generated for T i. To withdraw a tag T i, R houd erae the ath from the root to T i aociated eaf node by uing the TagLeave agorithm. Starting from the aociated eaf node of T i, R remove the ath uward. At the beginning, R deete the eaf key k i of T i. If R reache a node e at eve m, R firt find e arent f, and then deete k i [m] from the index et IS f. After arriving at node f, R deete e. R reeat thi rocedure unti a non-eaf node in the ath ha mutie branche, for exame, node a in Fig.. Thu, R withdraw T i. IV. EFFICIENCY We firt invetigate the torage efficiency of ACTION, and then anayze the identification efficiency by etimating the neceary number of hah comutation. We ao dicu the ower and uer bound of ACTION identification efficiency.

6 δ root δ δ { N A. Storage An RFID tag normay ha a very tiny memory for toring uer information a we a the key. Hence, torage efficiency mut be taken into account in deigning ecure PPA rotoco. Without o of generaity, we aume that key ued by PPA rotoco have an identica ength, for exame 64 bit, for ecurity conideration. In baance-tree baed aroache, each tag i aocated mutie key, which incur a reativey arge torage overhead. ACTION i more efficient in the key torage on both the tag and reader ide. On the tag ide, ACTION aocate each tag ony two key, a ath key and a eaf key. On the reader ide, each ath key i divided into evera fraction and tored in the non-eaf node index et. Thu, R ony tore N key. In contrat, baance-tree baed aroache ditribute O(og δ N) key to each tag, and maintain δ N key on the reader ide, where δ i the branching factor of the baance key tree. Therefore, ACTION i more ractica for current RFID ytem. B. Identification Efficiency The baic oeration in a PPA authentication are hah comutation and comarion. The number of thee two oeration are equa, becaue each hah comutation i foowed by a comarion of hah vaue. Hence, we ue the number of hah comutation to etimate the time comexity. We reent the bet and wort cae in ACTION authentication rocedure, which are the comutationa ower bound and uer bound, reectivey. In the bet cae, the reader away meet a non-eaf node with ony one index number at each eve in the key tree. After d te robing, the reader uccefuy identifie a tag. With the ame branching factor etting δ, the deth of are tree i arger than the baance-tree, that i, d > og δ N. Therefore, the comutationa ower bound of ACTION identification i og δ N. A we aume the branching factor of the key tree i δ, each non-eaf node ha at mot δ chidren. In the wort cae, at the root, the reader wi comute δ hah vaue, and narrow the earch coe to N/δ tag; at a chid node of the root, the reader erform δ hah comutation again. Then the reader narrow the earch coe to N/δ tag. At each eve, the reader d Figure 4. The wort cae of ACTION. a b Efficiency uer bound Branching factor δ Figure 5. Efficiency uer bound v. branching factor. (Aume N = 0, n = 18) conduct δ hah comutation. The reader reeat the ame roce at each eve. At a given eve, the reader narrow the earch coe to N/δ tag, and erform δ hah comutation. We aume at eve, the reader find N/δ = 1, or = og δ N. Since d > og δ N, the reader doe not reach eaf node at eve. We aume that the reader reache a non-eaf node a at eve. The node a mut have ony one chid (if a ha two chidren, the number of tag in the ytem mut be N+1, not N). Simiar to a, each node of a offring ha ony one chid. Thu, the reader wi erform d hah comutation beow the eve. We iutrate the wort cae in Fig. 4. We cacuate hah comutation in the wort cae, f(δ) = δ + d. Since = og δ N, and d = n/ogδ (ee Section III. C). We get n f ( δ ) = δ ogδ N + ( ogδ N ) ogδ () n = ( δ 1) ogδ N + ogδ In equation (), n i the bit ength of key in the ytem; in ACTION, n = 18. Let E ACTION denote the efficiency of identification. We get n ogδ N < E ACTION ( δ 1) ogδ N + ogδ Thu, E ACTION i O(og δ N). We ot the curve of the efficiency uer bound f(δ) in Fig. 5. To find the otima δ, we et f (δ) = 0. We get n og e nδ ogδ N = (3) ( δ (nδ 1) + 1) og δ By oving equation (3), we find that δ = 8 i the otima etu for identification efficiency. The uer bound i 7 n f ( 8) = og N +. According to the reation between δ and 3 3 d, if δ = 8, then d = 18/(og 8) = 18/3. By that etu, d i not an integer. Hence, in ACTION, we et a ub-otima δ = 16, uch that d = 3. The uer bound i 15 n f ( 16) = og N Combined with the eary dicuion, we can ee that the time comexity of ACTION authentication i O(ogN). V. SECURITY ANALYSIS The eentia goa of ACTION i to rotect the rivacy and defend againt both aive and active attack. Thee attack are away the mot imortant concern in wiree environment [4-6]. For RFID ytem, aive attack often

7 mean eavedroing on the communication between tag T and reader R, which are intenivey dicued in reviou deign [5-10, 13-19]. Active attacker can forge, reay, or dicard the meage exchanged between T and R, o the attack incude tracking, coning, and tag-comromiing [7]. Attacker are even abe to execute bogu authentication rocedure. A ACTION ha mot of the advantage of eary deign, it i inherenty abe to defend againt aive attack. Hence, in thi ection, we focu more on the ACTION reitance to the comromiing attack, which i the mot eriou threat to RFID ytem but not addreed by eary tudie. A. Comromiing Attack We reent an attack mode to formaize the caabiity of adverarie baed on Avoine [] mode. We create an interactive game G for two articiant: an adverary A (the attacker) and a chaenger C (the RFID ytem). Any attack to the RFID ytem can be rereented a A querying on one of C orace a foow: Query(T, m 1, m 3 ): A end a requet m 1 to T. Subequenty, A receive a reone from T. R then end the meage m 3 to T. Note that m 1 and m 3 rereent the meage ent from A in the firt and third round in an ACTION authentication rocedure, reectivey. Send(R, m ): A end a meage m to R and receive a reone. Note that m rereent the meage ent from A in the econd round in an ACTION authentication rocedure. Execution(T, R): A act a a man-in-the-midde and execute an intance of the authentication rotoco P with T and R, reectivey. A then modifie the reone meage and reay them to both ide accordingy. Revea(T): A comromie T, which mean A obtain T key. Note that A can ditinguih any given tag T from other tag if it can obtain T key. Baed on thee orace, the detaied rocedure of game G between A and C conit of the foowing te. 1. A interact with C by acceing the above four orace in oynomia time. In fact, adverary A erform a earning rocedure on the ytem.. A inform C that the game ha begun. C chooe two norma tag T 0 and T Let O T 0 and OT 1 denote the et of acceed orace of T 0 and T 1, reectivey. For T 0 and T 1, A accee their orace in O and O. T 0 T 1 4. C firt accee O T 0 and O T 1, and then eect a bit b {0,1} uniformy at random. C then rovide the orace of the correonding tag T b (if b=0, T b =T 0, otherwie T b =T 1 ) to A for acce. For imicity, we denote T b a T. A then accee T orace (excet the Revea orace). Let the et of acceed orace of T be O T. 5. Baed on the reut from O T 0, O T 1, and O T, A outut a bit b. If b =b, A uccefuy ditinguihe T 0 and T 1 ; otherwie, A oe. Note that A can acce the orace in O, OT 1 and O T in oynomia time. Since T 0 and T 1 are choen T 0 uniformy at random from a norma tag, if A can ditinguih T 0 from T 1 (or vice vera) uccefuy with a robabiity nonnegigiby arger than 1/, thi mean that A can track a tag in an RFID ytem. Otherwie, we ca that uch an RFID ytem i rivate under the comromiing attack. Definition 1. A rotoco P i rivate under the comromiing attack, if for any oynomia time adverary A, the robabiity of A gueing b uccefuy under the above attack mode atifie: Pr[ b' = b] 1 + 1/ oy( ). Where oy() are arbitrary oynomia, and i a ecurity arameter. Baed on Definition 1, for a given PPA baed rotoco P, we define the advantage of a comromiing adverary by AdvP ( A) = Pr[ b' = b] The advantage i a meaurement of how uccefu an adverary can ditinguih a tag from other. In our mode, we aume that ony two tag are norma and a other tag have been comromied. In thi cae, if the adverary can ditinguih a norma tag from another one with a robabiity arger than 1/, by uing the obtained key from comromied tag, we caim that the adverary ha the advantage, and the vaue i determined by the difference between the robabiity and 1/. B. Defending Againt Comromiing Attack Baed on the mode, we formay rove that ACTION rotoco i rivate under the comromiing attack, which mean an adverary ha a negigibe advantage when it conduct comromiing attack on the ACTION. Theorem 1. Let q Q, q S, and q E be the number of querie to the Query, Send and Execute orace, reectivey. ACTION i rivate under the comromiing attack, and the advantage of a comromiing adverary A i bounded by Adv ACTION (( d + 1)( q Q + q E ) + 4 ( q E + q S )) ( A ), n + 1 even if a other tag, excet T 0 and T 1, in the ytem have been comromied by A, where d i the number of the key art (or the deth of the key tree), and n i the bit number of a hah vaue a aforementioned in Section III. C. Proof: In thi roof, we ue the random orace (RO) mode [3], in which hah function are treated a arbitrary random function. Since a key in ACTION are generated indeendenty, the key of a tag are not reated to thoe in other tag. We denote the game between the chaenger C and the adverary A a G 0. We introduce another chaenger C, (who ay a imuated game G 1 with the adverary A), to imuate the rea chaenger C, and make them inditinguihabe to A. Thu, from the viewoint of A, the game G 1 between A and C imuate exacty the rea game G 0 between A and the rea chaenger C. On the other hand, we contruct C without the knowedge of T 0 and T 1 ecret key, k 0 and k 1. Thu, there i no information about k 0 and k 1 eaked to adverary A, o that A 1

8 mut randomy gue which tag T 0 or T 1 i, that i, gueing the bit b (ee the te 5 of the attack mode in Section V. A) at random. In thi cae, the robabiity of a correct gue i 1/. According to the definition of the comromiing attack (refer to Section V. A), A advantage in G 1 i 0. G 1 amot erfecty imuate the rea game G 0, o the activitie of the chaenger C woud ao erfecty imuate the rea chaenger C. However, without the knowedge of T 0 and T 1 ecret key, there are ome difference, caed Excetion, between the activitie of C and C in ome ituation. If we can etimate the robabiity of the Excetion haening, we can comute the uer bound of A advantage. In G 1, the chaenger C imuate the hah function h in ACTION a a RO h. The h i contructed a a hah vaue it, H_it, maintained by C. H_it i initiaized a emty. The format of each item in H_it i (r 1, r, k, v), where v i the hah vaue of r 1, r, and k, i.e. v = h(r 1, r, k). For a query (r 1, r, k): If it exit in H_it, C return the correonding v = h(r 1, r, k); Otherwie C ick u a v uniformy at random, return the v a the anwer of h(r 1, r, k), and add (r 1, r, k, v) into the H_it. In the rea game G 0, each meage i comuted with the hah function; the outut of orace Query, Send, and Execute are ao comuted with the hah function. Thu, we ue the h given above to contruct the Query, Send, and Execute orace in the G 1. According to the ACTION rotoco, the inut of the Query orace are Requet and a nonce r 1, and the outut are the authentication meage U = (r, h(r 1, r, k i [0]), h(r 1, r, k i [1]),, h(r 1, r, k i [d-1])). In G 1, the chaenger C imuate the Query orace a foow: Uon receiving the Requet and r 1, the chaenger C firt generate a nonce r and two n-bit ong key k and k uniformy at random reectivey, and then divide k into d art, k [0], k [1],, k [d-1]. Next, C accee the random orace h for d time to get the hah vaue equence h(r 1, r, k [0]), h(r 1, r, k [1]),, h(r 1, r, k [d-1]). Later on, C comute the hah vaue h(r 1, r, k ) by accee h. Finay, C return U = (r, h(r 1, r, k [0]), h(r 1, r, k [1]),, h(r 1, r, k [d- 1]), h(r 1, r, k )). Simiary, C imuate the Send orace in G 1 a foow: Uon U = (r, h(r 1, r, k i [0]), h(r 1, r, k i [1]),, h(r 1, r, k i [d-1]), h(r 1, r, k i )): Generate a nonce r 1, a ath key k, and a eaf key k uniformy at random; Accee the random orace h to get the hah vaue h(r 1, r, k, k ) and h(r 1, r, k ); Accee the random orace h to get the hah vaue h(r 1, r, h(r 1, r, k )) and h(r 1, r, h(r 1, r, k )). Return σ = (1, h(r 1, r, h(r 1, r, k)), h(r 1, r, h(r 1, r, k ))) (where 1 i the vaue of, the number of TagJoin agorithm running; ee Section III. E). Baed on the Query and Send orace, C contruct the Execute orace. Note that according to the definition of the Execute orace, adverary A act a a man-in-midde attacker between reader R and tag T. Therefore, in the rocedure of erforming Execute orace, there are two tage: A communicate with T, which can be abtracted a Query orace, and A communicate with R, which can be abtracted a Send orace. Hence, the Execute orace can be conidered a Figure 6. Comarion on defending againt the comromiing attack (Aume N = 0 ). the combination of Query and Send orace. An acce to Execute can ao be regarded a an acce to Query orace u an acce to Send orace. We thereby treat q E Execute querie a q E Query and q E Send orace accee, reectivey. G 1 i ame a G 0, excet the contruction of the Query, Send and Execute orace. In G 1, from the viewoint of A, C imuate C erfecty excet one event haen: a hah coiion occur in the outut of the hah function. When the RO h receive (r 1, r, k) and (r, r 1, k) a inut, the two outut houd be identica in G 0. In G 1, however, the outut of h woud not be identica. Thu, C cannot anwer A query correcty. We define uch a ituation a an Excetion. The robabiity of an Excetion haening i bounded by the birthday aradox: (( d + 1)( q E + qq ) + 4( q S + q E )) Pr[ Excetion ] (4) n Note that the (d+1)(q E +q Q ) denote the number of accee to h. Thoe accee to h are generated by q E +q Q Query orace accee, and each Query orace acce incude d+1 accee to h. Since in each Send orace acce, there are four accee to h, the number of accee to h in acceing the Send orace i 4(q E +q S ), where n i the number of bit of a hah vaue, and d i the number of the divided art of each tag key. A dicued at the beginning of the roof, the advantage of A in G 1 i zero. Therefore, conidering the robabiity of Event haen, the advantage of the comromiing adverary i bounded by: Adv ACTION (( d + 1)( q Q + q E ) + 4 ( q E + q S )) ( A ) n + 1 Baed on the Definition 1, ACTION i rivate under the comromiing attack. Proved. Theorem 1 tate that, under the attack mode defined in Section V. A, the advantage of comromiing attacker i negigibe. Since q E, q Q, and q S are oynomia to n, the advantage of comromiing attacker aroximate 0. That i, in the extreme cae, even if a comromiing attacker ha catured N tag, the robabiity of ditinguihing a norma tag from another one i ti 1/. In genera, aume the attacker ha tamered with t tag. To ditinguih a norma tag,

9 the attacker ha to erform random gueing on N t norma tag, and the robabiity of correcty gueing, o the robabiity of a uccefu attack i 1/(N t). We comare the uccefu robabiitie of comromiing attack in baance-tree baed aroache, SPA, and ACTION. In thi comarion, we aume SPA and baance-tree baed aroache ue binary tree. The RFID ytem contain 0 tag. A hown in Fig. 6, in SPA and other baance-tree baed aroache, comromiing attacker have an overwheming robabiity of ditinguihing any norma tag after they tamer with 10 tag in the ytem, whie ACTION erfecty eiminate the imact of comromiing attack. We note that the ath key of a tag may uffer from the key extracting attack. In ACTION, we et the branching factor a 16 when the ength of a ath key i 18-bit ong. The ath key wi be divided into thirty-two 4-bit art with thi etting. In thi cae, for any identification meage h(r 1, r, k i [j]), an adverary can eaiy extract k i [j] by enumerating a 4-bit tring, ike a brute-force earch. Reeating the enumeration, the adverary can retrieve the entire ath key. To fix thi faw, we introduce a eaf key k i in the ath key udating rocedure. The ength of each eaf key i imiar to that of the ath key, that i, 18 bit in our rotoco. After identification, the ath key i udated by h(r 1, r, k i, k i ) and the key k i i ao udated accordingy in each key udating rocedure. Without knowing the eaf key, the adverary cannot redict the udated ath key by gueing or erforming a brute-force-ike earch on it ubart. Thu, ACTION can be reiient to an extracting attack. VI. CONCLUSIONS We rooe a PPA rotoco, ACTION, to uort ecure and efficient authentication in RFID aication. To the bet of our knowedge, thi i the firt work that i abe to defend againt a comromiing attack uing tree-baed aroache. The advantage of thi deign ao incude high efficiency in term of torage and identification. We beieve wide deoyment of thi deign wi make PPA more ractica and effective for arge-cae RFID ytem. ACKNOWLEDGEMENTS Thi work wa erformed at Hong Kong Univerity of Science and Technoogy whie Li Lu and Jinong Han were Pot-Doc Feow and Renyi Xiao wa a Viiting Schoar. Li Lu i now an aitant rofeor with Schoo of Comuter Science & Engineering, Univerity of Eectronic Science & Technoogy of China, and Renyi Xiao i with Nationa Natura Science Foundation of China. Thi work i uorted in art by the Hong Kong GRF grant HKUST6169/07E and Hong Kong ITF GHP/044/07LP. Yunhao Liu and Jinong Han are uorted in art by the NSFC/RGC Joint Reearch Scheme N_HKUST 60/08, NSFC grant No , Nationa High Technoogy Reearch and Deveoment Program of China (863 Program) under grant No. 007AA01Z180, and NSFC Key Project grant No and No REFERENCES [1] T. Kriean, E. Webourne, N. Khouainova, V. Ratogi, M. Baazinka, G. Borrieo, T. Kohno, and D. Suciu, "Phyica Acce Contro for Catured RFID Data," IEEE Pervaive Comuting, vo. 6, 007. [] B. Sheng, C. C. Tan, Q. Li, and W. Mao, "Finding Pouar Categorie for RFID Tag". in Proceeding of ACM Mobihoc, 008. [3] Y. Li and X. Ding, "Protecting RFID Communication in Suy Chain," in Proceeding of ASIACCS, 007. [4] P. Robinon and M. Beig, "Trut Context Sace: an Infratructure for Pervaive Security in Context-Aware Environment," in Proceeding of Internationa Conference on Security in Pervaive Comuting, 003. [5] S. Wei, S. Sarma, R. Rivet, and D. Enge, "Security and Privacy Aect of Low-Cot Radio Frequency Identification Sytem," in Proceeding of Internationa Conference on Security in Pervaive Comuting, 003. [6] T. Dimitriou, "A Secure and Efficient RFID Protoco that Coud make Big Brother (artiay) Oboete," in Proceeding of PerCom, 006. [7] D. Monar and D. Wagner, "Privacy and Security in Library RFID: Iue, Practice, and Architecture," in Proceeding of CCS, 004. [8] D. Monar, A. Soera, and D. Wagner, "A Scaabe, Deegatabe Peudonym Protoco Enabing Owner-hi Tranfer of RFID Tag," in Proceeding of Seected Area in Crytograhy - SAC, 005. [9] L. Lu, J. Han, L. Hu, Y. Liu, and L. M. Ni, "Dynamic Key-Udating: Privacy-Preerving Authentication for RFID Sytem," in Proceeding of PerCom, 007. [10] G. Avoine, E. Dyi, and P. Oechin, "Reducing Time Comexity in RFID Sytem," in Proceeding of Seected Area in Crytograhy - SAC, 005. [11] S. Bono, M. Green, A. Stubbefied, A. Jue, A. Rubin, and M. Szydo, "Security Anayi of a Crytograhicay-Enabed RFID Device," in Proceeding of USENIX Security, 005. [1] M. C. O'Connor, "Taking Advantage of Memory-Rich Tag", htt:// [13] A. Jue and S. Wei, "Defining Strong Privacy for RFID," in Proceeding of PerCom, Workho PerTec, 007. [14] A. Jue, "RFID Security and Privacy: a Reearch Survey," Journa of Seected Area in Communication, vo. 4, 006. [15] M. Ohkubo, K. Suzuki, and S. Kinohita, "Efficient Hah-Chain baed RFID Privacy Protection Scheme," in Proceeding of UbiCom, Workho Privacy, 004. [16] A. Jue, "Minimait Crytograhy for Low-Cot RFID Tag," in Proceeding of Internationa Conference on Security in Communication Network - SCN, 004. [17] T. Dimitriou, "A Lightweight RFID Protoco to Protect Againt Traceabiity and Coning Attack," in Proceeding of SecureComm, 005. [18] G. Tudik, "YA-TRAP: Yet Another Trivia RFID Authentication Protoco," in Proceeding of PerCom Workho, 006. [19] G. Avoine and P. Oechin, "A Scaabe and Provaby Secure Hah Baed RFID Protoco," in Proceeding of PerCom, Workho PerSec, 005. [0] M. E. Heman, "A Crytanaytic Time-Memory Trade-off," IEEE Tranaction on Information Theory, vo. 6, [1] "Exand Tag-it ISO/IEC RFID Product Line", New Reeae from Texa Intrument, htt:// [] G. Avoine, "Adveraria Mode for Radio Frequency Identification," Technica Reort 005/049. htt://erint.iacr.org/005/049, 005. [3] M. Beare and P. Rogaway, "Random Orace are Practica: A Paradigm for Deigning Efficient Protoco," in Proceeding of CCS, [4] M. Shao, Y. Yang, S. Zhu, and G. Cao, "Toward Statiticay Strong Source Anonymity for Senor Network," in Proceeding of Infocom, 008. [5] W. Gu, Z. Yang, C. Que, D. Xuan and W. Jia, "On Security Vunerabiitie of Nu Data Frame in IEEE baed WLAN, " in Proceeding of ICDCS, 008. [6] Z. Jiang, J. Wu, and D. Wang, "A New Faut-Information Mode for Adative & Minima Routing in 3-D Mehe," IEEE Tranaction on Reiabiity, vo. 57, 008.