# An Elliptic Curve Cryptography-Based RFID Authentication Securing E-Health System

Authors: Chin-I Lee; Hung-Yu Chien
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

Mobile healthcare (M-health) systems can monitor the patients’ conditions remotely and provide the patients and doctors with access to electronic medical records, and Radio Frequency Identification (RFID) technology plays an important role in M-health services. It is important to securely access RFID data in M-health systems: here, authentication, privacy, anonymity, and tracking resistance are desirable security properties. In 2014, He et al. proposed an elliptic curve cryptography- (ECC-) based RFID authentication protocol which is quite attractive to M-health applications, owing to its claimed performance of security, scalability, and efficiency. Unfortunately, we find their scheme fails to achieve the privacy protection if an adversary launches active tracking attacks. In this paper, we demonstrate our active attack on He et al.’s scheme and propose a new scheme to improve the security. Performance evaluation shows the improved scheme could meet the challenges of M-health applications.


---

## Body

## 1. Introduction

Mobile healthcare (M-health) systems can monitor the patients’ conditions remotely and provide the patients and doctors with access to electronic medical records. Such a system improves both convenience and efficiency, because the patients and doctors are no longer required to be present at the same place; therefore, patients can contact their doctor at home and obtain the instant diagnosis and prescription. In the development of M-health systems, Radio Frequency Identification (RFID) technology plays an important role for identifying and accessing patients and objects. Therefore, securely accessing these RFID tags and systems is critical to the success of M-health systems [1, 2].In a RFID system, there are three types of roles: RFID tags, RFID readers, and a back-end server. Each tag has a unique number which is used to identify a RFID-tagged product. To obtain data from a tag, a reader first issues a query to the tag and then forwards the received information provided by the tag to a back-end server. The back-end server maintains a database of the information of tags and their labelled products. However, since a tag automatically responds to any readers’ queries via radio signal, the owner of the tagged product is even unaware of this action. If the tag transmits a fixed value in response to readers’ queries, it raises potential privacy threats to the labelled objects and the owner’s location.Privacy protection in a RFID system is investigated in two respects. One is anonymity; the other is tracking attack resistance. The former is to provide confidentiality of tag’s identity such that an unauthorized observer cannot learn the identity of the tag. The latter is to provide unlinkability of any two RFID transmission sessions; that is, given any two RFID transactions, an attacker cannot tell whether the two transactions came from the same tag or not. Tracking attack could be classified into two categories: passive tracking attack and active tracking attack. The passive tracking attack is that an adversary tries to distinguish whether two RFID transactions came from the same tag by eavesdropping only, while the active tracking attack is that an adversary can actively participate in the transactions (like eavesdropping, interrupt, replay, and modification) to get the data to tell whether two transactions came from the same tag. Both types of tracking might be used to infer users’ location information or even their personal profiles.Due to the advances of hardware development, many RFID schemes based on the public key techniques have been proposed and implemented [3]. Compared with the other cryptography mechanisms, the elliptic curve cryptography (ECC) [4, 5] is more competitive since it could provide the same security level with much smaller key size. Lee et al. [6] proposed an ECC-based RFID authentication scheme. Bringer et al. [7] and Deursen and Radomirovic [8] found that Lee et al.’s scheme is vulnerable to the tracking attack and the replay attack. Liao and Hsiao [9] proposed an ECC-based RFID authentication scheme integrated with an ID verifier transfer protocol; nevertheless, Peeters and Hermans [10] showed Liao and Hsiao’s scheme cannot resist the server impersonation attack. Tan [11] proposed ECC-based RFID three-factor authentication. Arshad and Nikooghadam [12] found that Tan’s scheme is not resistant to the replay attack and the denial-of-service attack.In 2014, He et al. [13] proposed an elliptic curve cryptography- (ECC-) based RFID authentication protocol which aimed at protecting tag’s anonymity and unlinkability and improving the computational complexity. Compared with the previous authentication schemes, He et al.’s scheme has better performance in terms of security, computational cost, and storage requirement. Unfortunately, we find that their scheme fails to achieve the privacy protection if an adversary launches active tracking attacks. We will show the weaknesses and propose an improved scheme. The rest of this paper is organized as follows. Section 2 gives the preliminary sketch of the elliptic curve cryptography and bilinear pairing. Section 3 reviews He et al.’s scheme and shows its security weakness. In Section 4, we propose our new scheme, which is followed by security analysis and performance evaluation in Section 5. Finally, conclusions are given in Section 6.


## 2. Preliminaries

We briefly introduce the elliptic curve cryptography and the bilinear pairing.


### 2.1. Elliptic Curve Cryptography

Koblitz [4] and Miller [5] introduced elliptic curves for cryptographic applications. Since then, elliptic curve cryptography (ECC) has played an important role in many cryptosystems. An elliptic curve E is defined over the equation y2=x3+ax+b over F(q), where q is a large prime and F(q) is a finite field of order q. The main attraction of ECC is that ECC with 160-bit key can reach a security level the same as that of 1024-bit RSA and thereby significantly reduce the key size.The security of He et al.’s protocol is based on the complexity of the elliptic curve discrete logarithm problem (ECDLP) [14].Elliptic Curve Discrete Logarithm Problem (ECDLP). Given an elliptic curve E over F(q) and two points P and Q on E, the elliptic curve discrete logarithm problem is to find an integer x∈Zq∗ such that xP=Q.


### 2.2. The Bilinear Pairing

The bilinear pairing was initially considered as a negative property on the design of elliptic curve cryptosystems, because it reduces the discrete logarithm problem on some elliptic curves (especially for supersingular curves) to the discrete logarithm problem in a finite field [15]. Such property diminishes the strength of supersingular curves in practice [16]. However, followed by the tripartite key agreement protocol proposed by Joux [17] and the identity-based encryption scheme proposed by Boneh and Franklin [18], pairing becomes beneficial and favorable to the design of cryptographic protocols or cryptosystems [19].LetG1 be an additive cyclic group (which is the elliptic curve group E(Fq) here) and let G2 be a multiplicative cyclic group with the same prime order n; that is, G1=G2=n. Bilinear pairing is defined by e^:G1×G1→G2 which satisfies the following properties:(1)
Bilinear: for allP,Q∈G1 and all u,v∈Zn∗, we have e^(uP,vQ)=e^(uvP,Q)=e^(P,uvQ)=e^(P,Q)uv.(2)
Nondegenerate:e^(P,P)≠1 for some P∈G1.(3)
Computable: givenP,Q∈G1, there is an efficient algorithm to compute e^(P,Q).We find that He et al.’s protocol is vulnerable to active tracking attack. We will utilize the bilinear pairing to facilitate our active attacks in Section4.


## 2.1. Elliptic Curve Cryptography

Koblitz [4] and Miller [5] introduced elliptic curves for cryptographic applications. Since then, elliptic curve cryptography (ECC) has played an important role in many cryptosystems. An elliptic curve E is defined over the equation y2=x3+ax+b over F(q), where q is a large prime and F(q) is a finite field of order q. The main attraction of ECC is that ECC with 160-bit key can reach a security level the same as that of 1024-bit RSA and thereby significantly reduce the key size.The security of He et al.’s protocol is based on the complexity of the elliptic curve discrete logarithm problem (ECDLP) [14].Elliptic Curve Discrete Logarithm Problem (ECDLP). Given an elliptic curve E over F(q) and two points P and Q on E, the elliptic curve discrete logarithm problem is to find an integer x∈Zq∗ such that xP=Q.


## 2.2. The Bilinear Pairing

The bilinear pairing was initially considered as a negative property on the design of elliptic curve cryptosystems, because it reduces the discrete logarithm problem on some elliptic curves (especially for supersingular curves) to the discrete logarithm problem in a finite field [15]. Such property diminishes the strength of supersingular curves in practice [16]. However, followed by the tripartite key agreement protocol proposed by Joux [17] and the identity-based encryption scheme proposed by Boneh and Franklin [18], pairing becomes beneficial and favorable to the design of cryptographic protocols or cryptosystems [19].LetG1 be an additive cyclic group (which is the elliptic curve group E(Fq) here) and let G2 be a multiplicative cyclic group with the same prime order n; that is, G1=G2=n. Bilinear pairing is defined by e^:G1×G1→G2 which satisfies the following properties:(1)
Bilinear: for allP,Q∈G1 and all u,v∈Zn∗, we have e^(uP,vQ)=e^(uvP,Q)=e^(P,uvQ)=e^(P,Q)uv.(2)
Nondegenerate:e^(P,P)≠1 for some P∈G1.(3)
Computable: givenP,Q∈G1, there is an efficient algorithm to compute e^(P,Q).We find that He et al.’s protocol is vulnerable to active tracking attack. We will utilize the bilinear pairing to facilitate our active attacks in Section4.


## 3. Weaknesses of He et al.’s Protocol

### 3.1. Review of He et al.’s Protocol

This section reviews He et al.’s protocol [13]. The system consists of three kinds of entities: readers, a back-end server, and a set of tags; but the RFID reader is omitted from the protocol description since it acts as an intermediate party that relays messages exchanged between a tag and the server. It is assumed that the communication between the reader and back-end server is secure. The proposed protocol comprises two phases:setup andauthentication. Notations used in the protocol are defined as follows:(i)
n,q: two large primes.(ii)
F(q): a finite field of order q.(iii)
E: an elliptic curve defined by the equation y2=x3+ax+b over F(q).(iv)
P: a generator point for a group of order n over E.(v)
xs: the private key of the server.(vi)
Ps: the public key of the server Ps=xsP.(vii)
XT: the ID verifier of the tag.Setup Phase. To set up the system, the back-end server performs the following tasks:(i)
Defineparams=q,a,b,P,n as the elliptic curve domain parameters.(ii)
Choose a random numberxs∈Zn∗ as the server’s private key, and compute Ps=xsP as the server’s public key.(iii)
Choose a random pointXT on E denoted as a tag’s ID verifier.(iv)
(params, Ps, XT) is stored at both the tag and the server’s database.(v)
The server also keepsxs secret.Authentication Phase. To achieve mutual authentication, the server (S) and the tag (TagXT) do the following steps. The authentication phase is illustrated in Figure 1.Figure 1
The authentication phase of He et al.’s protocol.Step 1 (S→TagXT:m1=R1).
S randomly chooses r1∈Zn∗, computes R1=r1P, and sends m1=R1 as a challenge to the tag.Step 2 (TagXT→S:m2=R2,AuthT).
T
a
g
X
T randomly chooses r2∈Zn∗ and computes R2=r2P, TKT1=r2Ps, TKT2=r2R1, and AuthT=(XT+TKT1)⊕TKT2. Then, TagXT sends back m2=R2,AuthT to S.Step 3 (S→TagXT:m3=Auths).
S computes TKs1=xsR2, TKs2=r1R2, and XT=(AuthT⊕TKs2)-TKs1 and then searches the server’s database for XT. If it is not found, the server S rejects the tag; otherwise, the tag TagXT is authenticated and thereafter S computes Auths=(XT+2TKs1)⊕(2TKs2) and sends back m3=Auths to TagXT.Step 4.
Upon receiving the server’s response,TagXT checks if (XT+2TKT1)⊕(2TKT2)=Auths. If it succeeds, the server S is authenticated; otherwise, the tag stops the procedure.


### 3.2. The Weaknesses

We find that He et al.’s protocol is vulnerable to active tracking attack. We utilize the bilinear pairing to check whether the two transactions came from the same tag or not. We demonstrate our active attack as follows, where Adv denotes the notion that the adversary impersonates the server to get the responses for tracking. First of all, Adv randomly choosesr1∈Zn∗, computes R1=r1P, and sends message m1=R1 to probe the tags it encounters. In the following, we assume Adv encounters the same tag TagXT.Upon receiving the query,TagXT randomly chooses r2∈Zn∗ and computes R2=r2P, TKT1=r2Ps, TKT2=r2R1, and AuthT=(XT+TKT1)⊕TKT2. Then, TagXT sends back m2=R2,AuthT to S. Adv can compute TKs2=r1R2, which equals TKT2. So Adv obtains (XT+TKT1)⊕TKT2⊕TKs2=(XT+TKT1).WhenTagXT is probed again, it randomly chooses r2¯∈Zn∗ and computes R2¯=r2¯P, TKT1¯=r2¯Ps, TKT2¯=r2¯R1, and AuthT¯=(XT+TKT1¯)⊕TKT2¯. Then, TagXT responds with m2=R2¯,AuthT¯. Adv computes TKs2=r1R2-, which equals TKT2¯. Then, it obtains (XT+TKT1¯)⊕TKT2¯⊕TKs2¯=(XT+TKT1¯). Now Adv performs the following steps to verify whether the two transactions came from the same tag:(1)
It computes(XT+TKT1)-(XT+TKT1¯)=TKT1-TKT1¯=(r2-r2¯)Ps and R2-R2¯=r2P-r2¯P=(r2-r2¯)P.(2)
It checks whether the equatione^R2-R-2,PS=?e^((XT+TKT1)-(XT+TKT1¯),P) holds.If the transactions came from the same tag, the above verification equation should hold, becausee^(XT+TKT1)-(XT+TKT1¯),P)=e^((r2-r-2)PS,P)=e^((r2-r-2)P,P)xs=e^((r2-r-2)P,xsP)=e^((R2-R-2),PS). That is, He et al.’s protocol cannot resist the active tracking attack.


## 3.1. Review of He et al.’s Protocol

This section reviews He et al.’s protocol [13]. The system consists of three kinds of entities: readers, a back-end server, and a set of tags; but the RFID reader is omitted from the protocol description since it acts as an intermediate party that relays messages exchanged between a tag and the server. It is assumed that the communication between the reader and back-end server is secure. The proposed protocol comprises two phases:setup andauthentication. Notations used in the protocol are defined as follows:(i)
n,q: two large primes.(ii)
F(q): a finite field of order q.(iii)
E: an elliptic curve defined by the equation y2=x3+ax+b over F(q).(iv)
P: a generator point for a group of order n over E.(v)
xs: the private key of the server.(vi)
Ps: the public key of the server Ps=xsP.(vii)
XT: the ID verifier of the tag.Setup Phase. To set up the system, the back-end server performs the following tasks:(i)
Defineparams=q,a,b,P,n as the elliptic curve domain parameters.(ii)
Choose a random numberxs∈Zn∗ as the server’s private key, and compute Ps=xsP as the server’s public key.(iii)
Choose a random pointXT on E denoted as a tag’s ID verifier.(iv)
(params, Ps, XT) is stored at both the tag and the server’s database.(v)
The server also keepsxs secret.Authentication Phase. To achieve mutual authentication, the server (S) and the tag (TagXT) do the following steps. The authentication phase is illustrated in Figure 1.Figure 1
The authentication phase of He et al.’s protocol.Step 1 (S→TagXT:m1=R1).
S randomly chooses r1∈Zn∗, computes R1=r1P, and sends m1=R1 as a challenge to the tag.Step 2 (TagXT→S:m2=R2,AuthT).
T
a
g
X
T randomly chooses r2∈Zn∗ and computes R2=r2P, TKT1=r2Ps, TKT2=r2R1, and AuthT=(XT+TKT1)⊕TKT2. Then, TagXT sends back m2=R2,AuthT to S.Step 3 (S→TagXT:m3=Auths).
S computes TKs1=xsR2, TKs2=r1R2, and XT=(AuthT⊕TKs2)-TKs1 and then searches the server’s database for XT. If it is not found, the server S rejects the tag; otherwise, the tag TagXT is authenticated and thereafter S computes Auths=(XT+2TKs1)⊕(2TKs2) and sends back m3=Auths to TagXT.Step 4.
Upon receiving the server’s response,TagXT checks if (XT+2TKT1)⊕(2TKT2)=Auths. If it succeeds, the server S is authenticated; otherwise, the tag stops the procedure.


## 3.2. The Weaknesses

We find that He et al.’s protocol is vulnerable to active tracking attack. We utilize the bilinear pairing to check whether the two transactions came from the same tag or not. We demonstrate our active attack as follows, where Adv denotes the notion that the adversary impersonates the server to get the responses for tracking. First of all, Adv randomly choosesr1∈Zn∗, computes R1=r1P, and sends message m1=R1 to probe the tags it encounters. In the following, we assume Adv encounters the same tag TagXT.Upon receiving the query,TagXT randomly chooses r2∈Zn∗ and computes R2=r2P, TKT1=r2Ps, TKT2=r2R1, and AuthT=(XT+TKT1)⊕TKT2. Then, TagXT sends back m2=R2,AuthT to S. Adv can compute TKs2=r1R2, which equals TKT2. So Adv obtains (XT+TKT1)⊕TKT2⊕TKs2=(XT+TKT1).WhenTagXT is probed again, it randomly chooses r2¯∈Zn∗ and computes R2¯=r2¯P, TKT1¯=r2¯Ps, TKT2¯=r2¯R1, and AuthT¯=(XT+TKT1¯)⊕TKT2¯. Then, TagXT responds with m2=R2¯,AuthT¯. Adv computes TKs2=r1R2-, which equals TKT2¯. Then, it obtains (XT+TKT1¯)⊕TKT2¯⊕TKs2¯=(XT+TKT1¯). Now Adv performs the following steps to verify whether the two transactions came from the same tag:(1)
It computes(XT+TKT1)-(XT+TKT1¯)=TKT1-TKT1¯=(r2-r2¯)Ps and R2-R2¯=r2P-r2¯P=(r2-r2¯)P.(2)
It checks whether the equatione^R2-R-2,PS=?e^((XT+TKT1)-(XT+TKT1¯),P) holds.If the transactions came from the same tag, the above verification equation should hold, becausee^(XT+TKT1)-(XT+TKT1¯),P)=e^((r2-r-2)PS,P)=e^((r2-r-2)P,P)xs=e^((r2-r-2)P,xsP)=e^((R2-R-2),PS). That is, He et al.’s protocol cannot resist the active tracking attack.


## 4. The Proposed Scheme

We propose a new ECC-based scheme, which owns excellent performance in terms of security, computational complexity, and communicational cost. Our scheme can resist all security threats including active tracking attack. Regarding computational complexity, we reduce the number of elliptic curve scalar multiplications, which is the most computationally expensive operation in ECC cryptography. For embedded systems like RFID and wireless sensor network, the communication operations consume the highest amount of energy of all the operations; therefore, reducing the message length is critical for saving the energy of these devices. The proposed scheme consists of two phases: setup and authentication. Since the setup phase is the same as that in He et al.’s protocol, it is omitted here. The authentication phase is described as follows.Authentication Phase. To achieve mutual authentication, the server (S) and the tag (TagXT) do the following steps. The authentication phase is illustrated in Figure 2.Figure 2
The authentication phase of the proposed protocol.Step 1 (S→TagXT:m1=R1).
S randomly chooses r1∈Zn∗, computes R1=r1P, and sends m1=R1 as a challenge to the tag.Step 2 (TagXT→S:m2=R2,AuthT).
T
a
g
X
T randomly chooses r2∈Zn∗ and computes R2=r2P, TKT1=r2Ps, TKT2=r2R1, and AuthT=(XT+TKT2)⊕H(R1+TKT1). Then, TagXT sends back m2=R2,AuthT to S.Step 3 (S→TagXT:m3=Auths).
S computes TKs1=xsR2, TKs2=r1R2, and XT=(AuthT⊕H(R1+TKs1))-TKs2 and then searches the server’s database for XT. If it is not found, the server S rejects the tag; otherwise, the tag TagXT is authenticated and thereafter S computes Auths=(XT+2TKs2)⊕2H(R1+TKs1) and sends back m3=Auths to TagXT.Step 4.
Upon receiving the server’s response,TagXT checks if (XT+2TKT2)⊕2H(R1+TKT1)=Auths. If it succeeds, the server S is authenticated; otherwise, the tag stops the procedure.


## 5. Security Analysis and Performance Evaluation

### 5.1. Security Analysis

We analyze the security of the proposed scheme as follows.Mutual Authentication. The authentication of the tag is dependent on tag’s ability to prove its knowledge of the secret XT. In our scheme, the server receives the message m2=R2,AuthT, where R2=r2P and AuthT=(XT+TKT2)⊕H(R1+TKT1). The server will use its private key xs to compute TKs1=xsR2 and TKs2=r1R2 and to extract XT=(AuthT⊕H(R1+TKs1))-TKs2. Then, the server checks whether XT is stored in the database. Only the genuine tag that owns the secret XT can generate valid AuthT.The authentication of the server is dependent on server’s ability to extractXT and generate valid Auths. Only the genuine server that owns the secret xs can correctly extract XT from AuthT and then compute valid Auths=(XT+2TKs2)⊕2H(R1+TKs1). Without knowledge of the server’s secret key xs, the adversary cannot obtain TKs1=xsR2. The tag checks the validity of Auths. If it is valid, then the server is authenticated.Anonymity. In our scheme, m1=R1, m2=R2,AuthT, and m3=Auths are transmitted, where the tag-identity-related messages are AuthT=(XT+TKT2)⊕H(R1+TKT1) and Auths=(XT+2TKs2)⊕2H(R1+TKs1) which are random due to two random and fresh numbers r1 and r2 in each session. Therefore, the adversary can learn nothing about the identity of the tag from the transmission. The randomness and freshness of the two random numbers ensure the anonymity of the proposed scheme.Tracking Attack Resistance. The essence of the active tracking resistance of the proposed scheme is that each calculation of AuthT=(XT+TKT2)⊕H(R1+TKT1) involves the confusion value H(R1+TKT1), where the computation of TKT1 needs either tag’s secret r2 or the server’s private key xs; therefore, an active tracker has no way to derive any verifiable data from the transmissions. We can verify this by launching the same active attack on our proposed protocol as follows, where Adv denotes the notion that the adversary impersonates the server to get the responses for tracking.First of all, Adv randomly choosesr1∈Zn∗, computes R1=r1P, and sends message m1=R1 to probe the tags it encounters. In the following, we assume Adv encounters the same tag TagXT.Upon receiving the query,TagXT randomly chooses r2∈Zn∗ and computes R2=r2P, TKT1=r2Ps, TKT2=r2R1, and AuthT=(XT+TKT2)⊕H(R1+TKT1). Then, TagXT sends back m2=R2,AuthT to S. Since Adv cannot compute TKT1=r2Ps, Adv obtains nothing except AuthT. When TagXT is probed again, it randomly chooses r2¯∈Zn∗ and computes R2¯=r2¯P, TKT1¯=r2¯Ps, TKT2¯=r2¯R1, and AuthT¯=(XT+TKT2¯)⊕H(R1+TKT1¯). Then, TagXT responds with m2=R2¯,AuthT¯. Adv cannot compute TKT1¯=r2¯Ps, and Adv obtains nothing except AuthT¯. Adv cannot verify whether the two transactions came from the same tag. That is, our proposed protocol can resist the active tracking attack.Tag Masquerade Attack Resistance. To impersonate a tag, the adversary must be able to generate a valid message m2=R2,AuthT, where AuthT=(XT+TKT2)⊕H(R1+TKT1). However, it is difficult to generate such a message without knowing the identity of the tag XT.Server Spoofing Attack Resistance. To impersonate the server, the adversary must be able to generate a valid message m3=Auths, where R1=r1P and Auths=(XT+2TKs2)⊕2H(R1+TKs1). It is easy for the adversary to generate R1, but it is difficult to generate Auths without knowledge of the server’s secret key xs and the tag’s identity XT.


### 5.2. Performance Evaluation

We compare the proposed scheme with He et al.’s protocol [13] and some related schemes [9, 12] in terms of computational cost, communicational cost, and storage cost. Let TEA denote the cost of point addition over an elliptic curve E, let TEM denote the cost of scalar multiplication over an elliptic curve E, let TM denote the cost of modular multiplication over the underlying field F(q), let TINV denote the cost of modular inverse over the underlying field F(q), let TH denote the cost of computing a hash value, let LECC denote the bit length of one elliptic curve point, let x denote the size of integer x, and let n denote the number of tags in the system. To evaluate the complexity, we adopt the practical figures from [20]. In [20], it lists the timing for computing kP and gkmod⁡p, where E is an elliptic curve defined over F(q), q≈2160, P is a point whose order is 160-bit prime over E, k is a random 160-bit integer, and p is a 1024-bit prime. Therefore, we can conclude that TM≈(41/5)TEA≈8TEA, TEM≈(29/0.12)TEA≈241TEA, and TINV≈(3∗8/41)TEA≈0.58TEA [20]. Note that the cost of executing an exclusive-or operation (XOR) is negligible when compared with other operations stated above. Since the parameters params=q,a,b,P,n are stored in both the server and the tag, the storage cost of params is omitted in the following comparison. The performance comparison is summarized in Table 1. Since He et al.’s protocol [13], Liao and Hsiao’s scheme [9], Arshad and Nikooghadam’s scheme [12], and our proposed scheme rely on the ECDLP, the elliptic curve scalar multiplication is the most time-consuming operation in the elliptic curve cryptosystem. Although our proposed scheme has the same communicational and storage costs as He et al.’s protocol, our proposed scheme owns better computational performance by eliminating one elliptic curve scalar multiplication operation. Our proposed scheme is more efficient than Liao and Hsiao’s scheme because our proposed scheme requires less cost in terms of computation, communication, and storage. Table 1 shows that Arshad and Nikooghadam’s scheme requires less computational cost than our proposed scheme. However, it has been studied that communication consumes more energy than computation in embedded wireless communication systems like RFID and wireless sensor network [21, 22]. Studies in the past have shown that 3000 instructions could be executed for the same energy usage as sending a bit 100 m by radio [23]; therefore, many studies in these fields devoted lots of efforts to reducing the communication complexity [24, 25]. It is important to optimize communication and minimize energy consumption. In our proposed scheme, the tag communication requires only 50% of that of Arshad and Nikooghadam’s scheme, while our scheme achieves the same security properties with slightly more computations.Table 1
Performance comparison.
Arshad and Nikooghadam [12]
Liao and Hsiao [9]
He et al. [13]
Ours
The server’s computational cost
2
T
E
M
+
T
M
+
T
I
N
V
+
8
T
H
=
490.58
T
E
A
+
8
T
H
5
T
E
M
+
3
T
E
A
=
1208
T
E
A
5
T
E
M
+
2
T
E
A
=
1207
T
E
A
4
T
E
M
+
4
T
E
A
+
2
T
H
=
968
T
E
A
+
2
T
H
The tag’s computational cost
2
T
E
M
+
T
M
+
7
T
H
=
490.58
T
E
A
+
7
T
H
5
T
E
M
+
3
T
E
A
=
1208
T
E
A
5
T
E
M
+
2
T
E
A
=
1207
T
E
A
4
T
E
M
+
4
T
E
A
+
2
T
H
=
968
T
E
A
+
2
T
H
Number of rounds/steps
3
3
3
3
Total length of transmitted message
8
x
+
2
L
E
C
C
4
L
E
C
C
4
L
E
C
C
4
L
E
C
C
The tag’s transmission length
4
x
+
L
E
C
C
2
L
E
C
C
2
L
E
C
C
2
L
E
C
C
The server’s storage cost
(
n
+
1
)
x
+
L
E
C
C
(
n
+
1
)
x
+
n
L
E
C
C
x
+
(
n
+
1
)
L
E
C
C
x
+
(
n
+
1
)
L
E
C
C
The tag’s storage cost
5
x
+
L
E
C
C
x
+
2
L
E
C
C
2
L
E
C
C
2
L
E
C
C
Security weaknesses
Server impersonation
Active tracking
No


## 5.1. Security Analysis

We analyze the security of the proposed scheme as follows.Mutual Authentication. The authentication of the tag is dependent on tag’s ability to prove its knowledge of the secret XT. In our scheme, the server receives the message m2=R2,AuthT, where R2=r2P and AuthT=(XT+TKT2)⊕H(R1+TKT1). The server will use its private key xs to compute TKs1=xsR2 and TKs2=r1R2 and to extract XT=(AuthT⊕H(R1+TKs1))-TKs2. Then, the server checks whether XT is stored in the database. Only the genuine tag that owns the secret XT can generate valid AuthT.The authentication of the server is dependent on server’s ability to extractXT and generate valid Auths. Only the genuine server that owns the secret xs can correctly extract XT from AuthT and then compute valid Auths=(XT+2TKs2)⊕2H(R1+TKs1). Without knowledge of the server’s secret key xs, the adversary cannot obtain TKs1=xsR2. The tag checks the validity of Auths. If it is valid, then the server is authenticated.Anonymity. In our scheme, m1=R1, m2=R2,AuthT, and m3=Auths are transmitted, where the tag-identity-related messages are AuthT=(XT+TKT2)⊕H(R1+TKT1) and Auths=(XT+2TKs2)⊕2H(R1+TKs1) which are random due to two random and fresh numbers r1 and r2 in each session. Therefore, the adversary can learn nothing about the identity of the tag from the transmission. The randomness and freshness of the two random numbers ensure the anonymity of the proposed scheme.Tracking Attack Resistance. The essence of the active tracking resistance of the proposed scheme is that each calculation of AuthT=(XT+TKT2)⊕H(R1+TKT1) involves the confusion value H(R1+TKT1), where the computation of TKT1 needs either tag’s secret r2 or the server’s private key xs; therefore, an active tracker has no way to derive any verifiable data from the transmissions. We can verify this by launching the same active attack on our proposed protocol as follows, where Adv denotes the notion that the adversary impersonates the server to get the responses for tracking.First of all, Adv randomly choosesr1∈Zn∗, computes R1=r1P, and sends message m1=R1 to probe the tags it encounters. In the following, we assume Adv encounters the same tag TagXT.Upon receiving the query,TagXT randomly chooses r2∈Zn∗ and computes R2=r2P, TKT1=r2Ps, TKT2=r2R1, and AuthT=(XT+TKT2)⊕H(R1+TKT1). Then, TagXT sends back m2=R2,AuthT to S. Since Adv cannot compute TKT1=r2Ps, Adv obtains nothing except AuthT. When TagXT is probed again, it randomly chooses r2¯∈Zn∗ and computes R2¯=r2¯P, TKT1¯=r2¯Ps, TKT2¯=r2¯R1, and AuthT¯=(XT+TKT2¯)⊕H(R1+TKT1¯). Then, TagXT responds with m2=R2¯,AuthT¯. Adv cannot compute TKT1¯=r2¯Ps, and Adv obtains nothing except AuthT¯. Adv cannot verify whether the two transactions came from the same tag. That is, our proposed protocol can resist the active tracking attack.Tag Masquerade Attack Resistance. To impersonate a tag, the adversary must be able to generate a valid message m2=R2,AuthT, where AuthT=(XT+TKT2)⊕H(R1+TKT1). However, it is difficult to generate such a message without knowing the identity of the tag XT.Server Spoofing Attack Resistance. To impersonate the server, the adversary must be able to generate a valid message m3=Auths, where R1=r1P and Auths=(XT+2TKs2)⊕2H(R1+TKs1). It is easy for the adversary to generate R1, but it is difficult to generate Auths without knowledge of the server’s secret key xs and the tag’s identity XT.


## 5.2. Performance Evaluation

We compare the proposed scheme with He et al.’s protocol [13] and some related schemes [9, 12] in terms of computational cost, communicational cost, and storage cost. Let TEA denote the cost of point addition over an elliptic curve E, let TEM denote the cost of scalar multiplication over an elliptic curve E, let TM denote the cost of modular multiplication over the underlying field F(q), let TINV denote the cost of modular inverse over the underlying field F(q), let TH denote the cost of computing a hash value, let LECC denote the bit length of one elliptic curve point, let x denote the size of integer x, and let n denote the number of tags in the system. To evaluate the complexity, we adopt the practical figures from [20]. In [20], it lists the timing for computing kP and gkmod⁡p, where E is an elliptic curve defined over F(q), q≈2160, P is a point whose order is 160-bit prime over E, k is a random 160-bit integer, and p is a 1024-bit prime. Therefore, we can conclude that TM≈(41/5)TEA≈8TEA, TEM≈(29/0.12)TEA≈241TEA, and TINV≈(3∗8/41)TEA≈0.58TEA [20]. Note that the cost of executing an exclusive-or operation (XOR) is negligible when compared with other operations stated above. Since the parameters params=q,a,b,P,n are stored in both the server and the tag, the storage cost of params is omitted in the following comparison. The performance comparison is summarized in Table 1. Since He et al.’s protocol [13], Liao and Hsiao’s scheme [9], Arshad and Nikooghadam’s scheme [12], and our proposed scheme rely on the ECDLP, the elliptic curve scalar multiplication is the most time-consuming operation in the elliptic curve cryptosystem. Although our proposed scheme has the same communicational and storage costs as He et al.’s protocol, our proposed scheme owns better computational performance by eliminating one elliptic curve scalar multiplication operation. Our proposed scheme is more efficient than Liao and Hsiao’s scheme because our proposed scheme requires less cost in terms of computation, communication, and storage. Table 1 shows that Arshad and Nikooghadam’s scheme requires less computational cost than our proposed scheme. However, it has been studied that communication consumes more energy than computation in embedded wireless communication systems like RFID and wireless sensor network [21, 22]. Studies in the past have shown that 3000 instructions could be executed for the same energy usage as sending a bit 100 m by radio [23]; therefore, many studies in these fields devoted lots of efforts to reducing the communication complexity [24, 25]. It is important to optimize communication and minimize energy consumption. In our proposed scheme, the tag communication requires only 50% of that of Arshad and Nikooghadam’s scheme, while our scheme achieves the same security properties with slightly more computations.Table 1
Performance comparison.
Arshad and Nikooghadam [12]
Liao and Hsiao [9]
He et al. [13]
Ours
The server’s computational cost
2
T
E
M
+
T
M
+
T
I
N
V
+
8
T
H
=
490.58
T
E
A
+
8
T
H
5
T
E
M
+
3
T
E
A
=
1208
T
E
A
5
T
E
M
+
2
T
E
A
=
1207
T
E
A
4
T
E
M
+
4
T
E
A
+
2
T
H
=
968
T
E
A
+
2
T
H
The tag’s computational cost
2
T
E
M
+
T
M
+
7
T
H
=
490.58
T
E
A
+
7
T
H
5
T
E
M
+
3
T
E
A
=
1208
T
E
A
5
T
E
M
+
2
T
E
A
=
1207
T
E
A
4
T
E
M
+
4
T
E
A
+
2
T
H
=
968
T
E
A
+
2
T
H
Number of rounds/steps
3
3
3
3
Total length of transmitted message
8
x
+
2
L
E
C
C
4
L
E
C
C
4
L
E
C
C
4
L
E
C
C
The tag’s transmission length
4
x
+
L
E
C
C
2
L
E
C
C
2
L
E
C
C
2
L
E
C
C
The server’s storage cost
(
n
+
1
)
x
+
L
E
C
C
(
n
+
1
)
x
+
n
L
E
C
C
x
+
(
n
+
1
)
L
E
C
C
x
+
(
n
+
1
)
L
E
C
C
The tag’s storage cost
5
x
+
L
E
C
C
x
+
2
L
E
C
C
2
L
E
C
C
2
L
E
C
C
Security weaknesses
Server impersonation
Active tracking
No


## 6. Conclusions

Mobile healthcare systems are becoming more and more popular. Lack of protecting patient and data privacy may hinder the utility of mobile healthcare system. In this paper, we have shown the weakness of He et al.’s protocol. The protocol cannot meet privacy protection requirement since it is vulnerable to active tracking attack. We have proposed a new scheme which not only conquers the security weaknesses but also improves the computational performance.



---

*Source: 642425-2015-12-24.xml*