# A Novel RFID Authentication Protocol Based on Reconfigurable RRAM PUF
## 5 Experimental Results Analysis
### Protocol Characteristics Analysis
#### 5.2.2 Security Analysis  
We analyzed the ability of the protocol to defend against current main stream attacks, as follows:  
(1) Physical Attack  
Assuming that an attacker can destroy the tag and access the tag's non-tamper-proof memory to obtain information such as ID, K, M\({}_{0}\), etc. On the one hand, the key K only plays the role of encrypting the tag ID, and cannot determine the response information of the tag in authentication. On the other hand, although M0 is the seed of random number of tags, M\({}_{0}\) and random number M are not CRP. In addition, the subsequent X, Y, Z authentication information is encrypted based on R and RS. According to the physical unclonable characteristics of PUF, attackers cannot get R and RS from the existing information. Therefore, the information that attackers cannot get through physical attacks has any impact on authentication. (2) Replay attack  
Firstly, the tag is analyzed. From the fourth step, we can know that the tag will update the random number seed M\({}_{0}\) after each authentication, so the tag will produce different random number M for each authentication, and the R, H, X based on M will naturally be different. Even if an attacker obtains the previous authentication interaction information using a wiretapping attack, it cannot perform a replay attack on the tag. Meanwhile, in order to defend against the attacker's replay of the previous authentication message to achieve the purpose of spoofing the reader, the key is that the same challenge does \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **This Work** & **ISSCC’20** & **ISSCC’19** & **JSSC’18 [30]** & **TCAS-I’20** [31] \\ \hline Type & RRAM & CMOS & CMOS & CMOS & CMOS \\ \hline Bit Error Rate & \(3.8\times 10^{-6}\) & 0.089\% & 0.30\% & 3.2\% & 0.04\% \\ \hline Inter HD & 0.5001 & 0.4978 & 0.4998 & 0.4907 & 0.5032 \\ \hline Intra HD & 0 & - & - & 0.0049 & 0.097 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison of the RRAM PUF and the previous works. not occur every time the authentication is performed. In the third step, we pointed out that a TRNG or PUF module can be integrated on the reader side. Assuming that the reader has sufficient computing and storage capabilities, there are many ways to meet the requirements. Therefore, the replay attack against the reader is also invalid. (3) Tracking attack  
Tracking attack is a threat to most passive RFID tags at present. Attackers can track tags through the ID number of tags and other information, so as to obtain the location privacy information of tag holders. They can also eavesdrop on the authentication information of the specified tag for many times, and then seek the possibility of cracking the information. Currently, the ID numbers of tags in most protocols are sent in plaintext or simple encryption. That is to say, attackers can easily get these invariable ID numbers of tags and implement tracking attacks on tags. Although some RFID authentication protocols propose the method of updating tag ID number after each authentication, most of them have two problems, which lead to the inapplicability of the protocol: (a) The protocol is vulnerable to asynchronous attack, which makes the ID number of reader side and tag side asynchronous. (b) The protocol does not take into account the influence of intra-HD, which results in discrepancies between the updated information of reader and tag. The protocol proposed in this paper solves the problem by using the following methods: firstly, the ID number of the tag is encrypted with the shared key, and then the reader and tag end use R\({}^{\prime}\) and R to update the key respectively after each round of authentication, which prevents the tracking attack. Secondly, in the fourth step, the protocol uses error correction algorithm to ensure the consistency of R and R\({}^{\prime}\), avoiding the impact of error rate on key update. Finally, the reader sets an authentication completion identifier S for each tag, while retaining the key before the tag is updated.