# 5G-Compliant Authentication Protocol for RFID
## 3 Proposed Protocol  
This section describes a 5G-compliant protocol for RFID systems. Although several authors have proposed changes to the 5G-AKA protocol [6; 11; 13], mainly focused on improving its privacy, our protocol follows the current version of 5G-AKA (Release 16), as described earlier. It is out of the  
Figure 2: 5G-authentication and key agreement (AKA).  
scope of this paper to analyze these proposals, and the security claims and assumptions of the standard are adopted here.  
In the 5G-compliant RFID protocol, the RFID tags are the 5G subscribers, while the readers and the back-end servers physically connect the tags to 5G. For simplicity, the readers and back-end servers are identified as a single entity from a security point of view (called just the reader). These high-level entities could be implemented in practice on the same device but, even if this is not the case, they are able to perform complex cryptographic operations, such as asymmetric encryption/decryption and digital signatures/verification, so that the channel between them can be considered secure. Although inductive RFID tags that operate in ranges of centimeters (near field communication--NFC), can be used in secure applications implementing complex cryptographic algorithms; most of the RFID tags currently used are UHF passive tags. These tags have no power of their own and use backscatter coupling, as they operate in the far field [14]. As a result, they work at much higher distances, of up to ten meters, but the delivered power is low. This, along with the fact that low cost is also a common requirement, means that lightweight or not too complex cryptographic tools must be used [15]. Our proposal focuses on such tags and it shall assume that these are able to perform one-way symmetric cryptographic operations, select pseudo-random numbers, and use functions that integrate strong security services based on the MILENAGE algorithms (Section 2.2, Assumption D). The case of NFC tags, by contrast, where tags work very close to the reader and therefore attacks in the air channel become less relevant, and are able to compute asymmetric cryptographic primitives, may be better analyzed as a particular case of SIM card implementation.  
The main design principle of the protocol is to move the most complex (asymmetric encryption) and computationally intensive operations (ciphered and integrity verification of the communication) from the tag to the reader. For this purpose, the protocol leverages the task division between the USIM and the ME within the UE, associating these with the tag and the reader, respectively, and assuming a similar degree of trust between them (see Figure 3). This trust is temporal as in 5G: that is, as the subscribers can use their USIM in another ME without the risk of being impersonated, the tags likewise can be assigned to another reader without the previous reader being able to impersonate them. The protocol uses six additional cryptographic functions \(h1,\ldots,h6\), with the first four used for privacy protection, while the last two are used for integrity protection. These are keyed PRFs that can use, likewise to the functions in 5G-AKA, the same kernel based on AES-128, with different circular shifts \(r_{1}^{\prime},\ldots,r_{6}^{\prime}\) and/or constants \(c_{1}^{\prime},\ldots,c_{6}^{\prime}\), for strong one-wayness and pairwise independence (Section 2.2). There are several AES-128 implementations designed for RFID applications and optimized for low resource requirements [16; 17], and the cost of implementing right circular shifts and xor's is almost negligible.