RFID technology, also known as radio frequency identification technology, is a kind of information transmission, identification and operation without human intervention and direct contact between communication parties. As one of the important technologies in the field of the Internet of things, with the rapid rise of the Internet of things technology, RFID technology is also getting more and more attention, from the ID card of residents, supermarket management, to finance, national defense and other fields. However, with the rapid rise of RFID technology, some problems existing in RFID technology have become increasingly prominent, of which the most concern is the security and privacy protection of RFID technology, because RFID technology has penetrated into people’s daily work, study and life, and the security and privacy problem can not be underestimated.
Considering the inherent limited internal resources, limited energy and fast reading requirements of RFID tags, the encryption algorithm used in the design of security protocol based on encryption scheme is not only simple and convenient, but also can not occupy more system storage resources, so the traditional encryption algorithm is not suitable for RFID tags, It is necessary to find a simple and secure encryption algorithm.
Chaos is a kind of behavior controlled by nonlinear dynamics law, which is shown as sensitivity to initial value and system parameters, statistical characteristics of white noise and ergodic characteristics of chaotic sequence. The dimension of its attractor has a very complex fractal structure and unpredictability. It can be used to calculate random key. The characteristics of chaotic signal, such as concealment, unpredictability, high complexity and easy implementation, are especially suitable for secure communication. Therefore, chaotic encryption can be applied to RFID Security mechanism.
This paper mainly studies the security and privacy protection of chaotic encryption technology in RFID system
(1) This paper studies the existing RFID Security Authentication Protocols at home and abroad, and proposes two RFID Security Authentication Protocols with high security based on chaotic encryption algorithm. The main feature is that the security technology and privacy protection technology based on chaotic hash are applied, and the RFID dynamic key protocol with chaotic characteristics is proposed. The results show that the improved authentication protocol meets the security goal.
(2) In order to enhance the security of RFID authentication protocol based on chaos, a large number of experiments are carried out to study the periodicity of chaotic sequences. This paper summarizes the experimental data and puts forward the relevant theoretical model, which provides a solid theoretical basis for the practical application of RFID authentication protocol in the future.
(3) In order to strengthen the practical application of RFID Security Authentication Protocol, a double chaotic experimental model is proposed, which provides a more specific method to promote the application of RFID Security Authentication Protocol Based on chaotic encryption technology. The experimental analysis of the double chaotic performance and security is carried out, and the results show that the encryption algorithm has large periodicity, good randomness, good security High security features.
(4) This paper analyzes the hidden danger of privacy security in the existing RFID identity authentication, introduces the zero knowledge proof protocol, proposes a dynamic identity authentication mechanism based on zero knowledge, and carries out data verification and security analysis. The results show that the chaotic encryption algorithm can be applied to the zero knowledge identity authentication protocol, and has good security.
2. Research status at home and abroad
RFID technology was first applied abroad. Harry stockman can be called the founder of the development of RFID technology. His “communication using reflected power” provided theoretical support for the development of RFID technology. Since then, more and more scientists began to invest in the research of RFID technology.
Before the 1980s, due to the low development level of RFID technology and the high cost of R & D, its application scope was limited, and most of them were used in the military field. With the development of science and technology, RFID technology has also been developed rapidly, and its application is more and more extensive. As far as the United States is concerned, the U.S. government has always regarded the development and application of RFID technology as the top priority. The US Department of defense stipulates that all domestic military materials should be labeled with radio frequency tags after 2005. The U.S. FDA also recommends the use of radio frequency tags on drugs from 2006 to prevent the circulation of counterfeit drugs. Under the strong promotion of the government, it has formed a set of RFID system with unique characteristics, established RFID standards, and is in the forefront of the industry in terms of hardware and software research and development. Most European countries have studied RFID application earlier, such as Nokia, Philips, sap, etc. they have developed products with their own characteristics on the electronic tag chip. The research on RFID technology in China started late, mainly after the 1980s, and the most typical application is the use of RFID technology in the aspect of identity authentication of the second generation ID card. At present, RFID technology is mainly used in logistics management system, parking management system, highway toll system, supermarket goods tracking system and other fields.
The popularity of RFID technology application also makes people pay more and more attention to the problem of system security and privacy protection. So far, a considerable number of security policies have been proposed. Some experts have proposed to protect them at the physical level, such as the “kill” tag mechanism designed by auto ID organization. If the goods with embedded RFID tags are sold, the command will be started, In this way, we can prevent illegal users from tracking the goods maliciously, but once the command is started, the tag can not be used again, which wastes resources; By using the principle of electrostatic shielding, the label is placed in a closed metal container to block the entry of external signals, but it also blocks the legal reader from reading and writing, so the practicability is not strong. Considering the hidden defects of physical methods, experts and scholars have proposed communication protocols based on cryptographic encryption mechanism, such as hash lock protocol proposed by Sarma and Engels, randomized hash lock protocol proposed by Weis, hash ID change protocol proposed by henrici, RFID anti tracking security mechanism designed by Xue Jiamei, etc, Other authentication schemes about encryption mechanism can be found in the literature. There are a large number of these security protocols, but there are a variety of security defects, which can not meet the security and practical requirements of RFID system.
Analysis of existing RFID Security Authentication Protocols
Sarma et al. Designed and proposed hash lock authentication mechanism based on hash function in 2003. In the initial state, a random number key is generated for each tag to get the meta id = hash (key). The tag stores its own ID and the corresponding meta ID, and uses the meta ID to replace the tag ID for communication to prevent the identification information from being illegally stolen. The corresponding meta ID, key and ID are stored in the background database. The specific process of the protocol is shown in Figure 1.
The working steps of the agreement are as follows:
(1) Tag reader sends query request to tag.
(2) After receiving the request, tag sends its own metaid to reader.
(3) The reader receives the metaid and sends it to the background database.
(4) The background searches and compares the received metaid with the data in the database. If the data that is the same as the metaid is found, the matching (key, ID) of the data is sent to the reader; If not, authentication fails.
(5) The reader transfers the key data to the tag.
(6) Tag hashes the received key and compares whether H (key) and metaid are equal. If they are equal, the tag sends its own ID to the reader, and the reader compares it with the ID obtained in step 4. If they are the same, the authentication of both sides is completed; Otherwise, tag is illegal.
Due to the unidirectionality of hash function, the protocol plays a certain role in protecting data privacy, and the whole communication process only needs one hash operation, and the amount of calculation is also small. However, the protocol also has many security vulnerabilities. In step 2, tag always responds to reader with a fixed metaid, which makes it difficult to resist location tracking; In step 6, the ID is transmitted in plaintext in the wireless channel, which is easy to be stolen by illegal users, and is difficult to resist the attacks of counterfeiting and retransmission; The ID of tag is fixed and may be cloned by others. Therefore, the hash lock protocol can not meet the system security requirements.
RFID authentication scheme based on Chaotic Encryption
Through the analysis of the privacy problems faced by RFID technology and the introduction of the common attack means of attackers, we can see that the security threats of RFID technology can not be ignored, and the corresponding countermeasures are urgently needed to ensure the security of the system. Through the analysis and comparison of several existing RFID authentication protocols, we can see that these protocols have their own advantages and disadvantages. This paper uses their ideas for reference, and proposes an improved scheme based on Hash lock protocol.
Considering the inherent limited internal resources, limited energy and fast reading requirements of RFID tags, when designing the security protocol based on encryption scheme, the simpler the encryption algorithm is, the better. The algorithm with high complexity costs a lot of time and computation, so it is not suitable for low-cost electronic tags, so public key encryption algorithm is rarely used. Most of the existing authentication protocols are based on hash function encryption technology.
In general, we assume that the tag is passive tag, that is, passive tag. Its low cost makes its storage capacity very small. It can only store a small amount of data information, and its computing power is very low. Therefore, during initialization, tag only stores its own unique identifier ID and hash value H (ID) after operation. This scheme uses the hash value generated by the double chaotic encryption algorithm constructed in Chapter 3. The H (ID ‘) corresponding to the tag ID is stored in the background database system. The purpose of this is to prevent the tag ID from leaking after the background database is invaded by illegal intruders. The flow chart of the protocol is shown in Figure 2.
4.1 description of the agreement
The protocol authentication process is as follows:
(1) RFID reader generates a random number RR, and then sends RR to tag together with query request.
(2) The tag receives the RR sent by the reader, performs hash operation on the RR, and then XORs the encrypted result with H1 = H (ID)? H (RR), sent to the reader.
(3) After receiving the H1 data from the tag, the reader sends H1 and RR to the background system.
(4) After receiving H1 and RR, the background system calculates the data as shown in the figure. Then look in the database to see if it exists. If it exists, it is proved that the label is legal, otherwise it is illegal.
(5) The background database generates a random number Rd, and then h2 = H (ID ‘)? H (RD) and RD are sent to the reader together. After the reader receives the data, it is sent to the tag.
(6) After receiving the data H2 and RD, the tag first verifies whether there is an ID such that h (ID) = H2? H (RD), if it exists, it proves that the reader is legal; otherwise, it proves that the reader is not legal. So far, the certification of both parties is over.
4.2 security analysis of the protocol
(1) Privacy protection
In this scheme, the tag and the database store the 128 bit value after hash operation. In this way, the tag can complete the reader’s own legitimacy authentication without providing any information that can endanger itself. Moreover, even if the data information is leaked, the attacker only gets the hash value, and it is impossible to derive the ID from the unidirectionality of hash.
(2) Effective resistance position tracking
Every time the label is transferred to h (ID)? H (r r) changes dynamically, and the attacker can’t track the tag according to the fixed output.
(3) Data security
This scheme uses chaotic hash. General hash algorithms, such as MD5 and SHA-1, have been successfully cracked by Wang Xiaoyun and others. Their security is seriously threatened, and attackers can crack them. In chaotic hash, the hash value has a lot to do with the specific chaotic map, iteration times, parameters, initial value, etc., and its sequence trajectory is extremely complex, It is difficult to crack it.
(4) Hidden dangers
At present, the protocol still lacks ID dynamic refresh mechanism, which can’t resist the hidden danger of label replication.
To sum up, the authentication protocol based on Hash has some advantages over scheme 1 in terms of computation and storage space, but it does not have the mechanism to dynamically update the ID. in some application environments with high security requirements, such as military and financial fields, there is a risk that the tag will be copied, and the encrypted ciphertext is stored in the tag. Due to the unidirectionality of hash function, the authentication protocol based on Hash has the advantages of high security, In some applications that require data modification after authentication, such as one card system, the balance cannot be updated. Therefore, in some environments with low security requirements, such as some access control systems, we can adopt the authentication scheme based on hash. For applications with high security requirements, although it costs some in computing speed and storage capacity, the main advantage is its security, Because a good security authentication protocol not only depends on its advantages in computing and storage, but also can effectively resist all kinds of attacks. In this section, based on the research and improvement of the traditional hash lock authentication protocol, two unique RFID Security Authentication Protocols with high security are proposed. The main feature is that the security technology and data protection technology based on chaotic hash are applied, and the RFID dynamic key protocol with chaotic characteristics is proposed, and its performance is analyzed and compared. This paper briefly introduces the concept of BAN logic, expounds how to use BAN logic to prove the security of the protocol, and gives the process of proving the security of the improved protocol. The results show that the protocol meets the requirements of security objectives.
Editor in charge: CT