Dynamic Key-Updating : Privacy-Preserving Authentication for RFID Systems

1. Dynamic Key-Updating: Privacy-Preserving Authentication for RFID Systems Li Lu, Lei Hu State Key Laboratory of Information Security, Graduate School of Chinese Academy of Sciences Jinsong Han, Yunhao Liu, and Lionel M. Ni Dept. of Computer Science and Engineering, Hong Kong University of Science and Technology

2. Why Privacy in RFID? • RFID (Radio Frequency Identification) has been very popular Tag Reader • Most important usage • Identifying valid users or entities Bob’s car A tag is attached

3. (1)Request (2)ID Basic Identification Procedure Reader Tag

4. Bob’s car A tag is attached However… • Automatic response • Silent scanning I found Bob.

5. Motivation • Concerns regarding RFID privacy • An attacker can’t determine which tag he is accessing and can’t get any information about the tag’s owner. • In Short • Private authentication • Keeping private information (ID, Name,…) • Authenticating valid users

6. (1) {Request, P} (2) {ID , P}K Introducing Encryption into RFID K Reader Tag Key-Searching

7. k1 k2 .. kn (2) (3) searches the key space of all tags for a key Linear Key-Searching -- keyed one-way function P -- a random number -- key shared by reader and tag Key-searching is linear search, O (n). Thus it is not practical in large scale systems. Reader Tag (1)Request, P

8. Tree-based Key-searching A binary key tree with eight tags ,

9. Compute Compute Compute Authentication of Tree-based Protocols Tag Reader Identification: O(logn)

10. Drawbacks: • No forward security. • Vulnerable to compromising attack. Requires Key Updating

11. Requirement of Key-Updating • Challenging issues: • No interruption during authentication • Automatically updating keys • We use two techniques to keep the consistency of key-updating: temporary key and state bit.

12. Our Protocol: SPA Temporary keys are used to store old keys. • State bits are used to record the key-updating status of nodes in the sub-trees. For example: Temporary Key State bit

13. The ’s identification The ’s identification Using , and to identify Using , and to identify Using , and to identify The ’s second identification An Example of Key-Updating Authentication: • Basic tree-based identification • Key updating Authentication sequence: T1, T2, T1 0 0 1 0 0 1 1 0 0 0 1 0

14. New Tag Joining

15. Tag Leaving

16. Compromising Attack Resistance Which keys is used? Which key is used?

17. Security Analysis

18. Exposing Probability Comparison(Under Compromising Attack) Each non-leaf node has 2 keys (1 working key and 1 temporary keys).

19. Key-Updating Latency Each key updating needs less than 2 ms when the tag accessing frequency does not exceed 10 times per second.

20. Conclusion • By using dynamic key-updating scheme, SPA enhances the security of existing RFID private-authentication protocols. • SPA is lightweight. The authentication efficiency is logarithmic and the key-updating latency is acceptable. • SPA can effectively defend against both passive and active attacks including compromising attack.

21. Thank you！

22. Authentication • To protect reader from forged tags. • Only authorized reader can read valid tags. • Is the tag which I am reading valid? • Is the reader which scans tags authorized?

23. However… • Authorized reader may be cheated by forged tags. • A cloning tag may insert into a system while not be notified. • A malicious reader can read the content in a tag easily. • The goal of authentication: only authorized readers can get the content in valid tags, while private information would not be leaked if there exist dishonest entities.

24. Private Authentication • Tradeoff between privacy and authentication: • Privacy is to hide the identity of RFID tag. • Authentication needs to know the identity of tag before tag being authenticated. • Private authentication is to hide the identity of a tag in authentication procedure: • Reader identifies a tag at the end of authentication.

25. System Initialization • The reader assigns the N tags to N leaf nodes in a balanced binary tree S. Each non-leaf nodejin S is assigned with two keys, a working key and a temporary key . • Initially, each key is generated randomly and independently by the reader, and for all non-leaf nodes. • When a tag is introduced in the system, the reader distributes the keys from the root to a leaf node to this tag. • for a non-leaf node j at the path, if , tag is assigned .

26. Tag Reader Checking Identifying Computing Mutual Authentication Procedure Updating keys Updating keys

27. Tag Identification • The tag identification procedure is similar to the previous tree-based approaches. • The differences: • For each non-leaf node included in the identification, the reader uses not only the working key k, but also the temporary key tk. • If some of the keys stored in a tag are temporary keys, the reader will record the level information of these keys in the synchronization message to inform the tag updating these keys.

28. Key-updating Rules • Use hash function h to generating a new key. • Let be the old key for node j • A new key • To remain consistent, the non-leaf node j uses temporary key to store j’s old key. • Use state bits to note the key state of non-leaf node j’s children nodes. 1 for having been updated, otherwise 0. • If keys in all j’s children have been updated, j updates itself.

29. Three Key Parameters • the correlated-exposing probability is mainly determined by three key parameters: • t, the number of compromised tags; • , the branching factor of the key tree; • a, the number of keys belonging to each non-leaf node

30. A new tag joining

31. Tag leaving

32. k1 k2 .. kn (1) (2) (2) (1)Request, P (3) searches the key space of all tags for a key s.t. Linear Key-Searching -- keyed one-way function P -- a nonce -- key shared by reader and tag Key-searching is linear search, O (n). Thus it doesn’t fit large scale systems. Reader Tag

33. Prototype Implementation • We have implemented the our design on 40 Mantis™-series 303 MHz asset tags and a Mantis™ II reader manufactured by RF Code. • The back-end database is implemented on a desktop PC with the following configurations: Pentium M 3.2G dual core CPU, 1GBytes memory, and 40G hard disk. • We use the SHA-1 algorithm as the secure hash function • the system is able to maintain up to tags

34. Comparison of Static Protocols (under compromising attack) Each none-leaf node has 2 keys (1 working key and 1 temporary keys). Each none-leaf node has 5 keys (1 working key and 4 temporary keys).