HMAC-Based Authentication Protocol: Attacks and Improvements

Document Type : Research Article

Authors

1 M.Sc. Student, Information Systems and Security Laboratory (ISSL), Sharif University of Technology

2 Assistant Professor, Department of Electrical Engineering, Amirkabir University of Technology

Abstract

As a response to a growing interest in RFID systems such as Internet of Things technology along with satisfying the security of these networks, proposing secure authentication protocols are indispensable part of the system design. Hence, authentication protocols to increase security and privacy in RFID applications have gained much attention in the literature. In this study, security and privacy of the recent well-known HMAC-based RFID mutual authentication protocol, is analyzed. We prove that this protocol is not secure against various attacks and also does not provide untraceability. Also, in order to improve the performance of the mentioned protocol and enhance the security of RFID users, a more effective and secure authentication HMAC-based protocol is presented. Furthermore, security of our protocol is explored against different attacks such as; the replay attack, the tag’s ID exposure, the spoofing attack, DoS attack and traceability attack. It is shown that our proposed protocol is safe against the attacks. Finally, the security of the presented protocol is compared with some well-known related protocols.

Keywords

Main Subjects

References

[1] Wang, S. P.; Ma, Q. M.; Zhang, Y. L. and Li, Y. S.; “A HMAC-Based RFID Authentication Protocol,” in 2nd International Symposium on Information Engineering and Electronic Commerce (IEEC), pp. 1–4, 2010.
[2] Baghery, K.; Abdolmaleki, B. and Emadi, M. J.; “Game-Based Cryptanalysis of a Ligthwigth CRC-Based Authentication Protocol for EPC Tags,” Amirkabir International Journal of Electrical and Electronics Engineering (AIJ-EEE), Vol. 46, No. 1, pp. 27–36, 2014.
[3] Ren, X.; Xu, X. and Li, Y.; “An One-Way Hash Function Based Lightweight Mutual Authentication RFID Protocol,” Journal of Computers, Vol. 8, No. 9, pp. 2405–2412, 2013.
[4] Asadpour, M. and Dashti, M. T.; “A Privacy- Friendly RFID Protocol Using Reusable Anonymous Tickets,” in 10th International Conference on Trust, Security and Privacy in Computing and  Communications, Changsha, pp. 206–213, 2011.
[5] Jung, S. W. and Jung, S.; “HMAC-Based RFID Authentication Protocol with Minimal Retrieval at Server,” in The 5th International Conference on Evolving Internet, pp. 52–55, 2013.
[6] Tsudik, G.; YA-TRAP: Yet Another Trivial RFID Authentication Protocol,” in 4th Annual IEEE International Conference on Pervasive Computing and Communications Workshops, 2006.
[7] Zhang, X.; Cheng, L. and Zhu, Q.; “Improvement of Filtering Algorithm for RFID Middleware Using KDB-tree Query Index,” Journal of Software, Vol. 6, No. 12, pp. 2521–2527, 2011.
[8] Cho, J. S.; Yeo, S. S. and Kim, S. K.; “Securing Against Brute-Force Attack: A Hash-Based RFID Mutual Authentication Protocol Using a Secret Value,” Computer Communication, Vol. 34, No. 3, pp. 391–397, 2011.
[9] Cho, J.; Kim, S. C. and Kim, S. K.; “Hash- Based RFID Tag Mutual Authentication Scheme with Retrieval Efficiency,” in 9th IEEE Internation Symposium on Parallel and Distributed Processing with Applications, pp. 324–328, 2011.
[10] Van-Deursen, T. and Radomirovic, S.; “Attacks on RFID Protocol,” Cryptology ePrint Archive, 2008.
[11] Phan, R.; “Cryptanalysis of a New Ultralightweight RFID Authentication Protocol- SASI,” IEEE Transactionson Dependable and Secure Computing, Vol. 6, No. 4, pp. 316–320, 2009.
[12] Lim, C. H. and Kwon, T.; “Strong and Robust RFID Authentication Enabling Perfect Ownership Transfer,” in Proceedings of ICICS’06, LNCS 4307, pp. 1–20, 2006.
[13] Piramuthu, S.; “Lightweight Cryptographic Authentication in Passive RFID-Tagged Systems,” IEEE Transactions on Systems, Man and Cybernetics, Vol. 38, No. 3, pp. 360–376, 2008.
[14] Peris-Lopez, P.; Hernandez-Castro, J. C.; Estevez-Tapiador, J. M. and Ribagorda, A.; “Vulnerability Analysis of RFID Protocols for Tag Ownership Transfer,” Computer Networks, Vol. 54, pp. 1502–1508, 2010.
[15] Kulseng, L.; Yu, Z.; Wei, Y. and Guan, Y.; “Lightweight Mutual Authentication and Ownership Transfer for RFID Systems,” IEEE INFOCOM, pp. 251–255, 2010.
[16] Liu, H. and Ning, H.; “Zero-Knowledge Authentication Protocol Based on Alternative Mode in RFID Systems,” IEEE Sensors Journal, Vol. 11, No. 12, pp. 3235–3245, 2011.
[17] Lim, J.; Oh, H. and Kim, S.; “A New Hash-Based RFID Mutual Authentication Protocol Providing Enhanced User Privacy Protection,” in Information Security Practice and Experience, Springer Berlin Heidelberg, pp. 278–289, 2008.
[18] Lee, Y. C.; Hsieh, Y. C.; You, P. S. and Chen, T. C.; “An Improvement on RFID Authentication Protocol with Privacy Protection,” in 3rd International Conference on Convergence and Hybrid Information Technology, South Korea, Busan, 2008.
[19] Wang, S.; Ma, Q. M.; Zhang, Y. L. and Li, Y. S.; “A HMAC-Based RFID Authentication Protocol,” in 2nd International Symposium on Infromation Engineering and Electronic Commerce (IEEC), 2010.
AUT Journal of Electrical Engineering
Volume 48, Issue 2
November 2016
Pages 71-80

Files

Share

How to cite

Statistics