摘要
针对射频识别(RFID)三方认证协议存在的安全需求和资源开销难以折中的问题,提出一种基于PUF的高安全性轻量级RFID三方认证协议(PHL-RTAP)。PHL-RTAP协议利用物理不可克隆函数(PUF)实现对标签身份的安全认证,保护标签免受物理克隆攻击,同时降低了标签开销,满足资源受限的RFID系统的需求;采用二次剩余算法实现对阅读器身份的安全认证,保护阅读器的数据隐私;引入随机数抵抗重放攻击,同时保证了阅读器与标签的匿名性和不可追踪性。PHL-RTAP协议实现了服务器、阅读器和标签之间完整的三方认证,可以依据需求扩展RFID系统中阅读器和标签规模,使其适用于大规模标签的RFID系统。安全分析表明:PHL-RTAP协议能够有效抵抗追踪、重放、物理克隆和去同步化等多种恶意攻击,使用BAN逻辑分析法和AVISPA工具证明了协议的安全性。与近期协议的对比分析显示:PHL-RTAP协议弥补了同类RFID协议的安全缺陷,并且计算开销、通信开销和标签存储开销等资源开销都较低,在保证高安全性的同时实现了轻量级,适用于资源受限的RFID三方认证场景。
To solve the difficult tradeoff between security requirements and resource cost in radio frequency identification(RFID) triple authentication protocol, a PUF-based high-security lightweight RFID triple authentication protocol(PHL-RTAP) was proposed. Physical unclonable function(PUF) was utilized to authenticate the tag identity for protecting the tag from physical cloning attacks and reducing the tag cost, meeting the demand of resource-constrained RFID system. The quadratic residual algorithm was adopted to secure the reader data privacy. Random numbers were introduced to resist replay attacks and ensure the anonymity and untraceability of tags and readers. The PHL-RTAP could realize a complete triple authentication between server, reader and tag, and expand the scale of readers and tags in RFID systems according to different requirements, so that it was suitable for large-scale tag RFID system. Security analysis showed that PHL-RTAP could effectively resist various malicious attacks such as tracking attacks, replay attacks, physical cloning attacks and desynchronization attacks. BAN logic analysis and AVISPA tool were used to verify the security of the protocol. Compared with recent protocols, PHL-RTAP could make up for the security defects of similar RFID protocols, and has low resource costs such as computing cost, tag storage cost, and communication cost. PHL-RTAP could achieve both high security and lightweight, and was suitable for resource-constrained RFID triple authentication scenarios.
作者
范文兵
常正泰
艾璐琳
孔德涵
FAN Wenbing;CHANG Zhengtai;AI Lulin;KONG Dehan(School of Electrical and Information Engineering,Zhengzhou University,Zhengzhou 450001,China)
出处
《郑州大学学报（工学版）》
CAS
北大核心
2023年第2期46-52,共7页
Journal of Zhengzhou University（Engineering Science）
基金
河南省科技攻关项目(192102210086)。
关键词
射频识别
物理不可克隆函数
二次剩余
三方认证
形式化分析
radio frequency identification
physical unclonable function
quadratic residue
triple authentication
formal analysis
