# An Improved Security Authentication Protocol for Lightweight RFID Based on ECC

Authors: Guo-heng Wei; Yan-lin Qin; Wei Fu
Journal: Journal of Sensors
 (2022)

---

## Abstract

The security, privacy, and operation efficiency of radio frequency identification (RFID) must be fully measured in practical use. A few RFID authentication schemes based on elliptic curve cryptography (ECC) have been proposed, but most of them cannot resist the existing attacks. The scheme presented by Qian et al. could not resist impersonation attack according to our security analysis. Then, we propose a novel lightweight RFID authentication scheme, which is proved that it can resist server spoofing attack, tag masquerade attack, and provide other security properties of a RFID authentication scheme. Comparisons of computation and communication cost demonstrate that the proposed scheme is more suitable for the resource-constrained RFID authentication.


---

## Body

## 1. Introduction

Radio frequency identification (RFID) is a noncontact automatic identification technology, and the basic principle is to use the transmission characteristics of the RF signal space coupling (inductive or electromagnetic coupling) or reflection to achieve automatic identification of the object. An RFID system usually consists of tags, readers, and a back-end server [1]. In recent years, radio frequency identification technology has developed rapidly and been widely used in various fields. However, due to the openness of the channel between the tag and the reader, the security and privacy problems it faces have become increasingly prominent. In particular, the processing capacity, storage space, and energy supply of tag chips are very limited, and many mature security schemes cannot be applied to RFID. Hence, higher security level, lightweight, and efficient RFID authentication scheme has become the new research goal.At present, several lightweight RFID authentication schemes using cryptography have been successively proposed. These schemes can be roughly divided into the following categories: the schemes using simple bitwise logic operation, the schemes based on hash function, the schemes based on symmetric cryptosystem (AES and others), and the schemes based on public key cryptosystem. Among them, lightweight authentication scheme using simple bitwise logic operations satisfies the properties of low calculation amount, low power consumption, and small chip area, but the security cannot be well guaranteed. At the same time, the authentication scheme using only the hash function and the symmetric cryptographic algorithms has also been proved to be unable to fully meet the security requirements of RFID authentication [2]. Therefore, scholars have carried out research on lightweight authentication schemes based on public key cryptography. In this paper, we propose an improved RFID authentication scheme based on the security analysis of the scheme proposed by Qian et al. [3], analyze the security of the improved scheme, and compare its performance with the existing similar schemes. The security and efficiency comparison results show that the proposed scheme is more secure and has superior computing performance.


## 2. Related Work

In recent years, the public key cryptosystem has been introduced into the RFID authentication schemes. Chen et al. [4] proposed the RFID authentication scheme based on the quadratic residues for the first time, but Cao et al. [5]found that it could not resist tag impersonation and desynchronization attacks [5]. Yeh et al. [6] further proved that the scheme in [4] could not provide location privacy and resistance to replay attacks and proposed an improved scheme.Compared with public key cryptosystem based on quadratic residues [7] and other public key cryptosystems (such as RSA and ElGamal), elliptic curve public key cryptography (ECC) requires a much shorter key length while providing the same security strength, so it is especially suitable for environments with limited computing resources and storage space. Lee et al. [8] proposed an ECC-based RFID authentication scheme—EC-RAC—which proved to be unable to resist impersonation attacks and location tracking attacks [9]. Aiming at the security problems in the EC-RAC scheme [10], Zhang et al. [11] proposed a randomized key RFID authentication scheme based on the elliptic curve discrete logarithm problem and proposed an improved scheme for the classic Schnorr authentication scheme at the same time. Babaheidarian et al. [12] pointed out that both of the two improved schemes proposed in [11] have security problems: the improved scheme for EC-RAC has the risk of tag impersonation attack and cannot provide mutual authentication between the server and the tag; the improved scheme for the classic Schnorr authentication scheme is difficult to resist location tracking attack and desynchronization attack. Liao and Hsiao [13] proposed an ECC-based RFID authentication scheme, which does not need to update the data in the server and tag memory and has high computational efficiency. However, Peeters and Hermans [14] proved that there is a server counterfeiting attack, and the attacker can obtain the identity authentication factor of the tag by insertion attack, so it is also difficult to resist the tag impersonation attack. He et al. [15] improved the authentication scheme in [13], but Wei et al. [16] found that the improved scheme [15]could not resist the server impersonation attack. This paper focuses on the analysis to another ECC-based authentication scheme proposed by Qian et al. [3] recently. Through analysis, we found that the scheme still has loopholes for attacks such as server impersonation and tag impersonation.


## 3. Security Analysis of the RFID Authentication Scheme Proposed by Qian et al.

### 3.1. The Authentication Scheme Proposed by Qian et al.

Qian et al. proposed an ECC-based RFID authentication scheme in [3]. The detailed steps of this scheme are shown in Figure 1.Figure 1
ECC-based RFID authentication scheme proposed by Qian et al.


### 3.2. Attacks against the Scheme

(i)
Server impersonation attackAssuming that the attacker can obtain the tag’s internal ID information, he can impersonate database and reader to interact with the tag and can pass the tag’s authentication.The specific attack steps are as follows:(a)
Attacker→tag: The attacker generates a random numberR′ and sends M1′=R′,Query to the tag(b)
Tag→fake reader: Upon receiving query andR′, the tag computes M2′=MID+tPs+R′,Pt+R′ and sends it to the fake reader(c)
Fake reader→fake database: The fake reader sendsM2′,R′ to the fake database(d)
Fake database→tag: The fake database generates a random numberk′, calculates K′=k′G and M4′=HID⨁Kx′,Kx′+R′⨁HID, and sends M4′ to the tag(e)
Tag: Upon receivingM4′, the tag checks that M4′1⨁HID+Rx′⨁M4′2=HID holdsTherefore, the tag believes that the attacker is a legitimate database, and the successful attack proves that the scheme is unable to resist server impersonation attacks.(ii)
Tag impersonation attackSupposing that after the attacker intercepting messageM2 that the tag sent to the reader, he can calculate MID+tPs=M0−R and then can impersonate the tag to interact with the reader and database and pass the reader’s authentication.The specific steps are as follows:(1)
Attacker→reader: When the attacker receives query and random numberR′, he calculates M2′=M0−R+R′,Pt+R′=M0′,Pt+R′ and sends M2′ to the reader(2)
Reader→server: The reader sendsM3′=M2′,R′ to the server(3)
Server: The server computesMID=M0′−R′−nPt=M0−R−nPt=MID+tPs−nPt and compares MID with MID′ stored locally and finds that it is consistent, so it verifies the fake tag.Therefore, the database is made to consider the attacker to be a legitimate tag, and the attack is successful, which proves that the scheme is unable to resist the tag impersonation attack.At the same time, since the authentication scheme of Qian et al. is difficult to resist server and tag impersonation attacks, it is easy to prove that it cannot resist location tracking attacks nor does it satisfy anonymity and forward security.


## 3.1. The Authentication Scheme Proposed by Qian et al.

Qian et al. proposed an ECC-based RFID authentication scheme in [3]. The detailed steps of this scheme are shown in Figure 1.Figure 1
ECC-based RFID authentication scheme proposed by Qian et al.


## 3.2. Attacks against the Scheme

(i)
Server impersonation attackAssuming that the attacker can obtain the tag’s internal ID information, he can impersonate database and reader to interact with the tag and can pass the tag’s authentication.The specific attack steps are as follows:(a)
Attacker→tag: The attacker generates a random numberR′ and sends M1′=R′,Query to the tag(b)
Tag→fake reader: Upon receiving query andR′, the tag computes M2′=MID+tPs+R′,Pt+R′ and sends it to the fake reader(c)
Fake reader→fake database: The fake reader sendsM2′,R′ to the fake database(d)
Fake database→tag: The fake database generates a random numberk′, calculates K′=k′G and M4′=HID⨁Kx′,Kx′+R′⨁HID, and sends M4′ to the tag(e)
Tag: Upon receivingM4′, the tag checks that M4′1⨁HID+Rx′⨁M4′2=HID holdsTherefore, the tag believes that the attacker is a legitimate database, and the successful attack proves that the scheme is unable to resist server impersonation attacks.(ii)
Tag impersonation attackSupposing that after the attacker intercepting messageM2 that the tag sent to the reader, he can calculate MID+tPs=M0−R and then can impersonate the tag to interact with the reader and database and pass the reader’s authentication.The specific steps are as follows:(1)
Attacker→reader: When the attacker receives query and random numberR′, he calculates M2′=M0−R+R′,Pt+R′=M0′,Pt+R′ and sends M2′ to the reader(2)
Reader→server: The reader sendsM3′=M2′,R′ to the server(3)
Server: The server computesMID=M0′−R′−nPt=M0−R−nPt=MID+tPs−nPt and compares MID with MID′ stored locally and finds that it is consistent, so it verifies the fake tag.Therefore, the database is made to consider the attacker to be a legitimate tag, and the attack is successful, which proves that the scheme is unable to resist the tag impersonation attack.At the same time, since the authentication scheme of Qian et al. is difficult to resist server and tag impersonation attacks, it is easy to prove that it cannot resist location tracking attacks nor does it satisfy anonymity and forward security.


## 4. The Improved Scheme

To resist the above server and tag impersonation attacks, the authentication scheme proposed by Qian et al. has been modified. The detailed process is as follows:


### 4.1. System Parameter Setting

(1)
Generate a large prime numberq, and Fq is a finite field, where q represents the number of elements in the finite field.(2)
Choose a safe elliptic curvey2=x3+ax+b, where a,b∈Fq. Select the points on the elliptic curve to form an additive cyclic group P,+ with order t, and G is a generator of P. The reader, database, and each tag store the elliptic curve parameters q,a,b,G,t locally.(3)
The server selectsn∈Zt∗ as its private key and computes Ps=nG as its public key and selects a random value ID as the identity information of each tag and encodes it as a point on the elliptic curve, denoted as MID. The server saves MID and stores its public key Ps together with MID in the memory of the tag.(4)
Select a secure hash function:H:P,+⟶0,1∗


### 4.2. The Authentication Process

(1)
Reader→tag: The reader generates a random numberr1, computes R1=r1G, and sends M1=R1,Query to the tag(2)
Tag→reader: Upon receivingM1, the tag generates a random number r2, computes R2=r2G and M2=HMID+r2Ps⨁Hr2R1, and sends M2,R2 to the reader(3)
Reader→database: Upon receivingM2,R2, the reader sends M3=M2,R2,r1 to the database(4)
Database→reader: Upon receivingM3, the database uses stored tag identity information ID′ to vertify whether HMID′+nR2⨁M2=Hr1R2 holds. If so, it will compute M4=nR2 and send M4 to the reader(5)
Reader→tag: The reader forwardsM4 to the tag(6)
Tag: Upon receivingM4, the tag checks whether M4=r2Ps holds, and if so, the reader and database are authenticated.


## 4.1. System Parameter Setting

(1)
Generate a large prime numberq, and Fq is a finite field, where q represents the number of elements in the finite field.(2)
Choose a safe elliptic curvey2=x3+ax+b, where a,b∈Fq. Select the points on the elliptic curve to form an additive cyclic group P,+ with order t, and G is a generator of P. The reader, database, and each tag store the elliptic curve parameters q,a,b,G,t locally.(3)
The server selectsn∈Zt∗ as its private key and computes Ps=nG as its public key and selects a random value ID as the identity information of each tag and encodes it as a point on the elliptic curve, denoted as MID. The server saves MID and stores its public key Ps together with MID in the memory of the tag.(4)
Select a secure hash function:H:P,+⟶0,1∗


## 4.2. The Authentication Process

(1)
Reader→tag: The reader generates a random numberr1, computes R1=r1G, and sends M1=R1,Query to the tag(2)
Tag→reader: Upon receivingM1, the tag generates a random number r2, computes R2=r2G and M2=HMID+r2Ps⨁Hr2R1, and sends M2,R2 to the reader(3)
Reader→database: Upon receivingM2,R2, the reader sends M3=M2,R2,r1 to the database(4)
Database→reader: Upon receivingM3, the database uses stored tag identity information ID′ to vertify whether HMID′+nR2⨁M2=Hr1R2 holds. If so, it will compute M4=nR2 and send M4 to the reader(5)
Reader→tag: The reader forwardsM4 to the tag(6)
Tag: Upon receivingM4, the tag checks whether M4=r2Ps holds, and if so, the reader and database are authenticated.


## 5. Security Analysis of the Improved Scheme

(i)
Resistance to server impersonationAssume that the attacker can obtain the tag’s internal informationMID and uses reader and database impersonation attacks.
(a)
Attacker→tag: The attack impersonates the reader to generate a random numberr1′, calculates R1′=r1′G, and sends R1′ to the tag(b)
Tag→fake reader (attacker): Upon receivingR1′, the tag generates a random number r2′, computes M2′=HMID+r2′Ps⨁Hr2′R1′, and sends M2′,R2′ to the fake reader (the attacker)(c)
Fake reader→fake database (attacker): The fake reader sendsM3′=M2′,R2′,r1′ to the fake database (the attacker)(d)
Fake database: The fake database must forgeM4′=nR2′ to pass the authentication of the tag. Because of the unidirectionality of the hash function, the attacker cannot recover out M4′=nR2′=r2′Ps even though he obtains the MID and uses M2′,R2′,r1′ to calculate HMID+r2′Ps=M2′⨁Hr2′R1′. Meanwhile, the attacker cannot obtain the database’s private key n or the random number r2′ generated by the tag, so it is unable for him to forge M4′(ii)
Resistance to tag impersonation(a)
The attacker impersonates the tag to attack: Upon receiving the messageM1′=R1′,Query of the reader, the fake tag selects a random number r2′ and calculates R2′=r2′G. However, it is unable to recover the tag’s legal MID, so the attack fails because he cannot generate legal authentication information M2′=HMID+r2′Ps⨁Hr2′R1′(b)
Assuming that the attacker takes an active attack: The attacker selects a random numberr1′, calculates R1′=r1′G, and sends R1′ to the tag. Upon receiving R1′, the tag generates a random number r2′, computes R2′=r2′G and M2′=HMID+r2′Ps⨁Hr2′R1′, and sends M2′,R2′ to the reader. After the attacker intercepts M2′,R2′, he can calculate Hr1′R2′⨁M2′=HMID+r2′Ps, but cannot obtain tag’s MID because of the unidirectionality of the hash function
(iii)
Resistance to replay attackIn replay attack, the attacker can intercept the reader’s past authentication informationM4=nR2=r2Ps sent to the tag and resend it to the tag. Upon receiving the replay information, the tag can compute M4′=r2′Ps using its current one-time random number r2′. M4≠M4′, and it can be determined that M4 is a replay information. The attacker can also intercept the tag’s past authentication information M2,R2 sent to reader and send it to the reader. Upon receiving M2,R2, the reader combines it with the random number r1′ (it currently generates to get M3′=M2,R2,r1′) and forward M3′ to the database. Upon receiving M3′, the database checks that HMID′+nR2⨁M2≠Hr1′R2 to identify replay attack.
(iv)
Forward securityForward security ensures that attacker cannot associate the past interaction information with tag’s identity. Assume that the attacker can obtain tag’s identity informationMID and intercept the past interaction information M1=R1,Query, M2,R2, and M4, among them R1=r1G, R2=r2G, and M2=HMID+r2Ps⨁Hr2R1. Without obtaining one-time random numbers r1 and r2 and database’s private key n, the attacker cannot confirm the intercept information M1, M2,R2, and M4 is related to the tag’s identity MID that he knows.
(v)
Mutual authenticationThe attacker can eavesdrop on the information passed between the reader and tag to get the messageM2=HMID+r2Ps⨁Hr2R1. Due to the unidirectionality of hash function, he cannot get MID, so he cannot generate the legitimate information that can pass authentication. At the same time, the database can use stored ID′ to check whether HMID′+nR2⨁M2=Hr1R2 holds to authenticate the tag. In addition, in the authentication process of the tag to reader, the tag authenticates reader by verifying whether M4=r2Ps is true. If the attacker does not have private key n of the legitimate database or the one-time random number r2, it is difficult to calculate M4 and unable to pass the authentication of the tag.
(vi)
Confidentiality of the identity informationMIDIn the improved scheme in this paper, theMID information of the tag is only contained in M2. Due to the unidirectionality of hash function, the attacker cannot intercept the previous interaction information between the reader and tag to obtain the tag’s legitimate MID. Similar to the antitag impersonation attack analysis mentioned above, the attacker is also difficult to obtain the tag’s MID through active attack.
(vii)
Resistance to location tracking attackWe assume that the attacker has mastered the tag’sMID and intercepted the interaction information M1,M2,R2. Since the attacker cannot obtain the database’s private key n, the reader’s random number r1, and the tag’s random number r2, so it is impossible to use HMID+nR2⨁M2=Hr1R2 to associate the intercepted interaction information with a specific tag. Therefore, the improved scheme can resist location tracking attack.
(viii)
AnonymityAnonymity of the scheme requires that the attacker cannot associate the interaction information with tag’s identity. According to the previous analysis, it is difficult for an attacker to recover the tag’sMID from the interaction information between the reader and tag, and each interaction uses different random numbers r1 and r2, so the attacker cannot associate the interaction information with tag’s specific identity, which ensures the anonymity.
(ix)
Resistance to denial-of-service (DOS) attackFrom the above analysis of the confidentiality of the tag’sMID, it can be seen that the tag’s MID can be well protected, and it is difficult for an attacker to obtain the tag’s MID from the interaction information between the reader and the tag. Therefore, the authentication scheme in this paper does not need to update tag’s MID, which can effectively resist DOS attack.


## 6. Efficiency and Security Performance Comparisons

We compared the computing efficiency, communication overhead, and security of the improved authentication scheme with similar schemes. For the convenience of comparison, the scalar dot product operation on the elliptic curve is denoted as SM and the point addition operation as TA. At the same time, assume that all schemes use the elliptic curve with a key length of 160 bits, and the data length of a point on the elliptic curve is 320 bits. Table1 shows the comparison of computational overhead between the schemes in References [3, 8, 11, 15, 16] and the schemes in this paper, among which scheme I in [11] refers to the improvement of EC-RAC scheme, and scheme II in [11] refers to the improved scheme of Schnorr authentication scheme.Table 1
Comparison of computational overhead of the scheme in this paper and the existing schemes.
Qian et al.’s scheme [3]Lee et al.’s scheme [8]Zhang et al.’s scheme I [11]Zhang et al.’s scheme II [11]He et al.’s scheme [15]Wei et al.’s scheme [16]Our schemeServer3SM+2TA4SM+2TA5SM+3TA3SM+2TA3SM+4TA4SM+1TA4SM+1TATag1SM+3TA2SM2SM1SM3SM+4TA5SM+1TA4SM+1TAThe communication overhead refers to the length of the authentication information transmitted by the server and the tag during the execution of the authentication scheme. Table2 gives the comparison of communication overhead between the schemes in [3, 8, 11, 15, 16] and the improved schemes. Only the length of communication data between the server (or reader) and the tag is considered here, and data interactions between the server and reader are ignored.Table 2
Comparison of communication overhead of the scheme in this paper and the existing schemes.
Qian et al.’s scheme [3]Lee et al.’s scheme [8]Zhang et al.’s scheme I [11]Zhang et al.’s scheme II [11]He et al.’s scheme [15]Wei et al.’s scheme [16]Our schemeServer640 bits160 bits160 bits160 bits640 bits640 bits640 bitsTag640 bits800 bits960 bits640 bits640 bits960 bits640 bitsIt can be seen from Table2 that the length of data transmitted by the tag and server in the scheme in this paper is basically equal to that in the schemes in [3, 15]. Table 3 shows the comparison of security performance between the proposed scheme and the existing schemes.Table 3
Comparison of security performance of the scheme in this paper and the existing schemes.
Qian et al.’s scheme [3]Lee et al.’s scheme [8]Zhang et al.’s scheme I [11]Zhang et al.’s scheme II [11]He et al.’s scheme [15]Wei et al.’s scheme [16]Our schemeMutual authentication×××××√√Confidentiality of authentication factor√√√×√√√Anonymity××√×√√√Practicability√√××√√√Perfect forward security×√√√√√√Scalability√√××√√√Resistance to replay attack√√√√√√√Resistance to tag impersonation attack×××√√√√Resistance to server impersonation attack×××××√√Resistance to DoS attack√√××√√√Resistance to location tracking attack××√×√√√√ means providing; × means not providing.Through the above analysis, the scheme proposed in this paper is basically the same as the original scheme in terms of computational and communication overhead, which can satisfy the practical application of low-cost tags, but compared with other typical schemes with similar structure, this scheme has a superior security advantage, which can fully meet various security requirements such as mutual authentication and privacy protection in the RFID authentication process.


## 7. Conclusion

This paper analyzes the security performance of the improved scheme proposed by Qian et al. and proves that it is difficult to resist server and tag impersonation and thus cannot realize the mutual authentication between the server and the tag. On this basis, we improved the scheme proposed by Qian et al. Security analysis and efficiency comparison show that compared with similar schemes, the proposed scheme has higher security while ensuring high computing performance and can fully meet the security requirements of mutual authentication and privacy protection in the RFID authentication process.



---

*Source: 7516010-2022-02-08.xml*