# A Novel Security Authentication Protocol Based on Physical Unclonable Function for RFID Healthcare Systems

Authors: He Xu; Xin Chen; Feng Zhu; Peng Li
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

The Radio Frequency Identification (RFID) technology has been integrated into healthcare systems for the purpose of improving healthcare management. However, people have concerns about the security and privacy of this kind of RFID systems. In order to solve the security problems faced by RFID-based healthcare systems, a novel security authentication protocol based on Physical Unclonable Function (PUF) and Advanced Encryption Standard (AES) encryption algorithm is designed. The protocol uses PUF technology to output unique and random responses to different excitation inputs, encrypts the authentication information sent by the tag, and uses the AES encryption algorithm to encrypt the authentication information between the cloud database and the reader. At the same time, in the authentication process, once the communicating entity completes the identity authentication of the other two entities, it immediately starts to update the key. The security analysis and formal analysis of BAN (proposed by Burrows et al.) logic prove the security and correctness of the protocol. Analysis results show that the computation cost and security performance of the proposed protocol are better than the compared protocols. Our findings will contribute to further enhancing the security for RFID healthcare systems.


---

## Body

## 1. Introduction

Radio Frequency Identification (RFID) technology is one of the important technologies in the realization of Internet of Things (IoT). In RFID systems, radio frequency signal is used to achieve contactless authentication and identification. Because of its advantages of rapid identification and reuse rate, it has been widely used in many areas. As one of the key technologies of IoT, RFID technology has been applied to offer services like patient monitoring, drug administration, and medical asset tracking. However, people have concerns about the security and privacy of RFID-based healthcare systems. And RFID is widely used in healthcare monitoring system for patient safety and traceability [1–5]. With the feature of noncontact automatic identification, in recent years, RFID technology has been applied in healthcare systems for providing intelligent services such as patient monitoring, drug administration, and medical asset tracking. The improvement of drug management can help to reduce the number of medication errors. By integrating with RFID technology, hospitals can track medical assets in order to mitigate theft loss, improve resource utilization, and save costs. Thus, patients and medical staff can benefit a lot from these services.However, the security risks brought by RFID healthcare systems have also attracted the attention of scholars and engineers, so many authentication schemes are proposed for RFID healthcare systems [6, 7]. Although an RFID-based healthcare system has lots of advantages over a traditional one, it suffers from new security and privacy risks. For example, if an adversary can track a tag embedded in the smart wristband of a patient, the location of the patient is known by the adversary. Furthermore, an adversary may impersonate as a legitimate reader to collect a patient’s medical data from the patient’s smart wristband, leading to medical privacy leakage. Hence, a suitable solution to secure RFID-based healthcare systems is urgently needed.Over the last several years, researchers have proposed a variety of authentication schemes, aiming to secure RFID-based healthcare systems. In 2014, Zhao [8] proposed an RFID authentication protocol based on elliptic curve cryptosystem (ECC) to secure communications in healthcare environments. Zhang and Qi [9] proposed an ECC-based RFID authentication protocol for medical systems to enhance patient safety. However, Farash et al. [10] analyzed the protocols in [8, 9] and pointed out that these two protocols cannot ensure forward secrecy. Farash et al. also suggested an improved protocol based on ECC to enhance the security of healthcare environments in [10]. Later, researchers proposed more ECC-based RFID authentication protocols [11–16] for healthcare applications. Because of the high hardware requirement of ECC, these ECC-based protocols are not well compatible with the EPC C1G2 standard.In this paper, we use cloud database and active tag to get high security for RFID healthcare systems, which is compatible with the EPC C1G2 standard. In traditional RFID systems, the wireless channel between tag and reader is vulnerable to be attacked, and the channel between cloud database and reader is also vulnerable to network attack. In order to solve the previous problem, this paper combines Physical Unclonable Function (PUF) with one-way hash function and Advanced Encryption Standard (AES) encryption algorithm to realize a cloud-based RFID authentication protocol using active tag. The key contributions of this paper are as follows:(1)
Active tag and AES encryption are used to ensure the RFID systems’ security to resist the typical wireless attacks, and we present a novel security authentication protocol based on Physical Unclonable Function is proposed for RFID healthcare systems(2)
In order to deduce the security goal and prove the security of the proposed protocol, we use BAN (proposed by Burrows et al. in reference [17]) logic, which is a security analysis model and is used for RFID application systems, to perform security analysis for our proposed protocol(3)
The proposed protocol updates the key at real time with the PUF and Cloud technology, which is more effective for privacy protection in RFID healthcare systemsThe rest of this paper is organized as follows. Section II describes the security problems of RFID systems and physical unclonable technology. Section III describes related works. Section IV presents the proposed RFID security authentication protocol based on PUF and AES. The security analysis, proof of the proposed protocol, and computing overhead and space analysis are given in Section V. Section VI concludes the paper works.


## 2. An Overview of RFID System Security

### 2.1. Common Security Issues in RFID Healthcare Systems

RFID systems’ devices communicate with each other in a common channel using radio frequency signals, which means that the signals between devices are basically exposed. In addition, because some RFID systems lack of security protection mechanism, attackers can attack RFID healthcare systems and illegally obtain the data using wireless signal analysis equipment which brings serious network security threats to enterprises and consumers. The following will make a specific description of common security attack means to RFID systems [18].(1)
Counterfeiting Attack. Some RFID security authentication protocols only require the reader to authenticate the tag, but not authenticate the reader. In this case, attackers can use forged readers or tags to impersonate trusted devices for authentication [19].(2)
Replay Attack. The attacker repeats the authentication message eavesdropped before to the reader or tag, trying to cheat the reader or tag to trigger it response.(3)
Replication Attack. The attacker completely copies the legal tag’s information, and the cloned tag has the true ID and key information stored in the legal tag. When the reader sends the radio frequency signal to the covering area, the clone tag sends a response signal to the reader, which is consistent with the response signal generated by the legal tag.(4)
Desynchronization Attack. The attacker intercepts the information sent by the communication entity, so that the other party’s communication device does not update the information [20]. In the next round of authentication, if the key information stored among the communication parties is inconsistent, the two parties will not be able to authenticate each other.(5)
Tag-Tracking Attack. The attacker intercepts the authentication information of reader and tag and infers information about the tag’s or reader’s identity.(6)
Forward Privacy Attack. After the attacker cracked an RFID tag, the information used in previous authentication can be inferred from the information in the authentication process.


### 2.2. Security Mechanism for RFID Systems

Aiming at various security problems encountered in RFID systems, security mechanisms can be divided into two categories: physical security mechanism and security authentication protocol.The existing physical security mechanisms [21] mainly include Faraday cover, tag “kill” mechanism, and tag blocking. Although these physical security mechanisms protect the security of the RFID systems in a certain extent, but because these methods require additional hardware equipment, and once it is attacked while opening the defense mechanism which will affect the subsequent use of tags, so it is not practical in large RFID systems.At present, the research on RFID security protocols based on logic method and encryption technology can be divided into the following three directions according to the complexity of encryption algorithm [22]: ultralightweight authentication protocol based on simple XOR logic operation, lightweight authentication protocol based on simple one-way function such as hash operation, and heavy-weight authentication protocol based on symmetric encryption or asymmetric encryption algorithm. Among them, the first two authentication protocols have limitations by the simplicity of the algorithm, so they are only suitable for occasions with low-security requirements. Compared with the first two authentication protocols, the encryption algorithm used in the heavy-weight authentication protocol is more complex, which is suitable for the occasions with high-security requirements.


### 2.3. Physical Unclonable Technology

For the problem of replication attack, some scholars put forward Physical Unclonable Function (PUF) technology. PUF technology is a group of micro delay circuits [23], which generates numerous unique and unpredictable “keys” by extracting the differences in the chip manufacturing process. The input is called challenge, and the output is called response. A group of input and output of PUF is called challenge-response pair (CRP). The relationship between CRP is only determined by some physical differences of devices. Because of the differences in the chip manufacturing process, it has the characteristics of nonduplication. Therefore, PUF technology makes the chip to have anticounterfeiting function.The ideal PUF module has three characteristics [24]: uniqueness, unidirectionality, and invulnerability. These characteristics of ideal PUF are described as follows:(1)
Uniqueness. For the same excitation, the response generated by the same PUF module is the same, and the response generated by different PUF modules is different.(2)
Unidirectionality. The response generated by PUF module is unpredictable, and the excitation generating this response cannot be found through the response and specific PUF module.(3)
Invulnerability. Any physical attack on the device containing PUF module will result in the destruction of the physical characteristics of its PUF module [25]. Therefore, in any probability polynomial time, the success rate of physical attack on the device can be ignored.


## 2.1. Common Security Issues in RFID Healthcare Systems

RFID systems’ devices communicate with each other in a common channel using radio frequency signals, which means that the signals between devices are basically exposed. In addition, because some RFID systems lack of security protection mechanism, attackers can attack RFID healthcare systems and illegally obtain the data using wireless signal analysis equipment which brings serious network security threats to enterprises and consumers. The following will make a specific description of common security attack means to RFID systems [18].(1)
Counterfeiting Attack. Some RFID security authentication protocols only require the reader to authenticate the tag, but not authenticate the reader. In this case, attackers can use forged readers or tags to impersonate trusted devices for authentication [19].(2)
Replay Attack. The attacker repeats the authentication message eavesdropped before to the reader or tag, trying to cheat the reader or tag to trigger it response.(3)
Replication Attack. The attacker completely copies the legal tag’s information, and the cloned tag has the true ID and key information stored in the legal tag. When the reader sends the radio frequency signal to the covering area, the clone tag sends a response signal to the reader, which is consistent with the response signal generated by the legal tag.(4)
Desynchronization Attack. The attacker intercepts the information sent by the communication entity, so that the other party’s communication device does not update the information [20]. In the next round of authentication, if the key information stored among the communication parties is inconsistent, the two parties will not be able to authenticate each other.(5)
Tag-Tracking Attack. The attacker intercepts the authentication information of reader and tag and infers information about the tag’s or reader’s identity.(6)
Forward Privacy Attack. After the attacker cracked an RFID tag, the information used in previous authentication can be inferred from the information in the authentication process.


## 2.2. Security Mechanism for RFID Systems

Aiming at various security problems encountered in RFID systems, security mechanisms can be divided into two categories: physical security mechanism and security authentication protocol.The existing physical security mechanisms [21] mainly include Faraday cover, tag “kill” mechanism, and tag blocking. Although these physical security mechanisms protect the security of the RFID systems in a certain extent, but because these methods require additional hardware equipment, and once it is attacked while opening the defense mechanism which will affect the subsequent use of tags, so it is not practical in large RFID systems.At present, the research on RFID security protocols based on logic method and encryption technology can be divided into the following three directions according to the complexity of encryption algorithm [22]: ultralightweight authentication protocol based on simple XOR logic operation, lightweight authentication protocol based on simple one-way function such as hash operation, and heavy-weight authentication protocol based on symmetric encryption or asymmetric encryption algorithm. Among them, the first two authentication protocols have limitations by the simplicity of the algorithm, so they are only suitable for occasions with low-security requirements. Compared with the first two authentication protocols, the encryption algorithm used in the heavy-weight authentication protocol is more complex, which is suitable for the occasions with high-security requirements.


## 2.3. Physical Unclonable Technology

For the problem of replication attack, some scholars put forward Physical Unclonable Function (PUF) technology. PUF technology is a group of micro delay circuits [23], which generates numerous unique and unpredictable “keys” by extracting the differences in the chip manufacturing process. The input is called challenge, and the output is called response. A group of input and output of PUF is called challenge-response pair (CRP). The relationship between CRP is only determined by some physical differences of devices. Because of the differences in the chip manufacturing process, it has the characteristics of nonduplication. Therefore, PUF technology makes the chip to have anticounterfeiting function.The ideal PUF module has three characteristics [24]: uniqueness, unidirectionality, and invulnerability. These characteristics of ideal PUF are described as follows:(1)
Uniqueness. For the same excitation, the response generated by the same PUF module is the same, and the response generated by different PUF modules is different.(2)
Unidirectionality. The response generated by PUF module is unpredictable, and the excitation generating this response cannot be found through the response and specific PUF module.(3)
Invulnerability. Any physical attack on the device containing PUF module will result in the destruction of the physical characteristics of its PUF module [25]. Therefore, in any probability polynomial time, the success rate of physical attack on the device can be ignored.


## 3. Related Works

Chou et al. proposed a mutual authentication protocol based on the combination of elliptic curve cryptography (ECC) and hash function in reference [26]. The protocol authentication process does not involve inversion operation, which reduces the amount of calculation. In 2013, Liao and Hsiao analyzed the security problem in [27], proposed an RFID mutual authentication protocol based on ECC, and proved the security of the protocol. However, reference [8] points out that the Liao’s protocol is easy to deduce the private key of the tag, and thus, a new RFID security authentication protocol based on ECC is proposed.Liao and Hsiao proposed an RFID security authentication protocol based on ECC in reference [28] and claimed that the protocol can resist various attacks. However, He pointed out in reference [29] that the protocol could not resist tag-tracking attacks and counterfeiting attacks and did not meet the requirements of anonymity. Thus, an improved RFID security authentication protocol based on ECC was proposed. Zhang and Qi proposed a new RFID authentication protocol based on elliptic curve in reference [9] and proved that the protocol can well resist various attacks. However, in 2016, Farash et al. pointed out that the protocol in [10] does not have the ability to protect the forward privacy security of tags and proposed an improved protocol combining ECC and hash functions. Moosavi et al. also proposed an RFID mutual authentication protocol based on ECC and hash in reference [30], but Khatwani and Roy proved that the protocol could not resist DoS (denial of service) attack in reference [31].Xie et al. proposed an RFID security authentication protocol in cloud environment in reference [32] and used virtual private network proxy to establish a secure back-end channel to provide users with anonymous access to the cloud. The structure of cloud database is an encrypted hash table. However, the session initiator of the protocol is the tag. If the attacker forges the tag and continues to send authentication request, it will cause denial of service (DoS) attack on cloud database.In addition, with the development of RFID-based IoT technology, a blockchain-enabled distributed security framework using edge cloud and software-defined networking (SDN) is presented in the literature [33], where the SDN server is a kind of cloud server used in our proposed architecture. In literature [34], mobile edge computing is used in real-time industrial informatics which inspires us to present our protocol based on the cloud computing to enforce the RFID healthcare systems’ security. In addition, the authors in literature [35] propose an energy-aware green adversary model for its use in smart industrial environment through achieving confidentiality, which gives us a motivation that our presented protocol should ensure the information confidentiality for RFID-based healthcare systems.


## 4. Proposed RFID Security Authentication Protocol Based on PUF and AES

Figure1 shows the RFID and cloud-based healthcare system’s architecture. Our proposed protocol runs on this architecture. This paper combines PUF technology and AES encryption algorithm to design a cloud-based RFID authentication protocol using active tag (C-RAPA) for RFID systems. In C-RAPA protocol, cloud database needs to perform AES encryption and one-way hash encryption capabilities, reader needs to perform AES decryption and one-way hash encryption capabilities, tag needs to have PUF module and perform one-way hash encryption. The symbols used in C-RAPA protocol are shown in Table 1.Figure 1
RFID and cloud-based healthcare system’s architecture.Table 1
Symbols used in the C-RAPA protocol.
SymbolsRepresentationsRIDnThe camouflage identifier of the reader in then-th authentication process, with the length of LTIDnThe camouflage identifier of the tag in then-th authentication process, with the length of LrrRandom number generated by the reader in the authentication process, with the length ofLrtRandom number generated by the tag in the authentication process, with the length ofLrcRandom number generated by the cloud-based database in the authentication process, with the length ofLKnIn then-th session, the shared key used between the tag and the cloud-based database, with the length of LKrIn then-th session, the shared key used between the reader and the cloud-based database, with the length of L⊕XOR operation by bitHXOne-way hash encryption operation ofXPFi=PUFXiGet the response from PUF module when inputXiY=EKXAES encryption of dataX with the key KX=DKYAES decryption of dataY with the key K


### 4.1. Initialization Phase

The initialization phase of C-RAPA protocol needs to be carried out in a secure environment. In the secure initialization process, the initial key information among the cloud database, reader, and tag is established and shared. It can also be regarded as “identity registration” of tag, reader, and background database. At this time, the tag is new produced and has not communicated with the cloud database or reader. To facilitate the analysis, we select a reader that has never been authenticated with the cloud database to describe the following authentication process. In the initialization phase, the reader is also needed to register.In this stage, the reader first sends initialization request information to the cloud database. After receiving the information, the cloud database generates a random numberrc with the length of L. The random number is sent to the reader. The reader received a random number rc, and an initialization request information and a random number rc are sent to tag. After the tag receives the initialization request information sent by the reader, as shown in equation (1), the random number rc is regarded as the input to get the response PF0 from the PUF module of the tag. At the same time, a random number rt is generated. The true ID of the tag and the response PF0 and random number rt were recorded and sent to the reader.(1)PF0=PUFrc.After the reader receives the true ID of the tag, responsePF0, and random number rt, a random number rr with length of L is generated. The random numbers rt and rr, response PF0, the ID of the reader, and the ID of the tag are sent to the cloud database. After receiving the information, the cloud database uses the random numberrc (generated by the cloud database and tag), the tag’s ID, and response PF0 to generate the camouflage mark TID0C of tag, and the shared key K0C of tag, the random number generated by the cloud database and the reader, and the ID of the reader are used to generate the reader’s camouflage identity RID0C and the shared key K0CR with reader. Finally, the cloud database sends TID0C, K0C, and RID0C, K0CR to the reader; the reader stores the camouflage identity RID0C and the shared key K0CR, which is, respectively, regarded as RID0 and K0cr. Then, the reader sends TID0C and K0C to the tag. The tag holds the camouflage identity TID0C and the shared key K0C which is, respectively, regarded as TID0andK0; then, the initialization process ends. The information stored in cloud database, reader, and tag is shown in Table 2.Table 2
Storage information table in initialization phase.
EntityStorage informationTagTID0, K0ReaderRID0, K0crCloud databaseTID0C, K0C, RID0C,K0CR, TID−1C,K−1C, RID−1C,K−1CRIn the authentication process, aiming at cloud database, readers, and tags, key information need to be saved, respectively: (1) the camouflage identification and shared key used in the previous round of authentication and (20) the camouflage identity and shared key used in this round of authentication. In the initialization stage, it is necessary to save the two groups of key information for subsequent authentication. Since the cloud database, tag, and reader have not been authenticated, the camouflage identification and key information used in the last round of authentication are the following:TID−1C, K−1C, RID−1C,K−1CR, and the camouflage identity and the shared key used in this round of authentication are the following: TID0C, K0C, RID0C,K0CR. For tag, TID0C=TID−1C=TID0, and K0C=K−1C=K0; For readers, RID0C=RID−1C=RID0, and K0CR=K−1CR=K0cr. The sequence diagram of initialization phase is shown in Figure 2.Figure 2
Sequence diagram of initialization phase.


### 4.2. Cloud Database Authentication Phase

At the end of the initialization phase, tags and readers begin to start the authentication phase which is shown in Figure3, including cloud database authentication phase, reader authentication phase, and tag authentication phase.Figure 3
Sequence diagram of authentication phase.While entering the stage of cloud database authentication, it indicates that the cloud database, reader, and tag have been successfully initialized. In the following descriptions, we assume it is then-th authentication process among the cloud database, reader, and tag. In the n-th authentication process, the cloud database needs to store two groups of key information and the camouflage identity shared with the tag: TIDn−1C, Kn−1C and TIDnC, KnC, where TIDn−1C, Kn−1C represents the key information used in the (n−1)-th authentication process and TIDnC, KnC represents the updated key information after the (n−1)-th authentication process, that is, the key information to be used for the n-th authentication which is stored by the tag. Similarly, the cloud database also stores two sets of the shared keys with the reader and the reader’s camouflage identity: RIDn−1C, Kn−1CR and RIDnC, KnCR, where RIDn−1C, Kn−1CR represents the key information used in the (n−1)-th authentication process and RIDnC, KnCR represents the updated key information after the (n−1)-th authentication process, that is, the key information to be used for the n-th authentication which is stored by the reader. In addition, in order to resist the desynchronization attack, the key information of reader and tag is saved, respectively, in cloud database. Which group of key information is stored by the tag and reader needs to be judged according to the information sent to the cloud database by the tag and reader in the authentication process. Next, the n-th authentication process will be described in detail.In the stage of the cloud database authenticating the tag, firstly, the reader sends a request authentication information to the cloud database. After receiving the request authentication information, the cloud database generates a random numberrc and sends it to the reader. When the reader received the random number rc, a random number rr is generated, and after then, the random numbers rr and rc and the request authentication information are sent to the tag. After the tag receives the random numbers rr, and rc and request authentication information, as shown in formula (2), the random number rc is selected as the input to the PUF module to produce the response PFn. Then, it will generate a random rt, as is shown in formula (3), and rr, rt, rc, and Kn are used to perform one-way hash encryption to get the result A. At last, the tag sends the following value of A, TIDn, rt, and PFn to the reader.(2)PFn=PUFrc,(3)A=Hrr⨁Kn⨁rt⨁rc.After the reader receives the result of tag’sA, camouflage identityTIDn, random number rt, and response result PFn, the result A is saved. Next, as shown in equation (4), the reader performs one-way hash encryption using its RIDn, random numbers rr and rc, and the shared key Kncr with the cloud database to get result B. At last, the reader sends the following value of PFn, TIDn, RIDn, rr, rt, A, and B to the cloud database.(4)B=Hrr⨁Kncr⨁rc⨁RIDn.After the cloud database receives response resultPFn, camouflage identity TIDn, RIDn, random numbers rr and rt, and the results A and B sent by reader, it first verifies the result B produced by the reader. The cloud database first searches the reader’s RIDn in the database; there exist three kinds of situations:(1)
RIDn does not exist in the cloud databaseIfRIDn does not exist in the cloud database, it indicates that the reader is not an illegal one. At this time, the cloud database will refuse communication.(2)
RIDn=RIDn−1CIfRIDn=RIDn−1C, it shows that in the n−1 round of authentication process, after the cloud database completes authentication phase, the authentication information sent to the reader may be intercepted, or due to network problems, the reader does not receive the authentication information sent by the cloud database, so there is no update information for the key and camouflage identity. At this condition, the cloud database will use RIDn−1C and Kn−1CR to make authentication with the reader.(3)
RIDn=RIDnCIfRIDn=RIDnC, it shows that in the n−1 round of authentication process, after the cloud database sends the authentication information, the reader verifies the authentication information, passes the authentication process for cloud database, and updates the camouflage identity and shared key. At this condition, the cloud database will use RIDnC and KnCR to make authentication with the reader.Take the third case as an example to explain the protocol process in detail. As shown in equation (5), after searching the RIDn, the cloud database will perform hash encryption using the reader’s RIDnC, random numbers rr and rc, and the key KnCR to get the result B′.(5)B′=Hrr⨁KnCR⨁rc⨁RIDnC.Next, the cloud database needs to judge whetherB is equal to B′. If B≠B′, then the cloud database will refuse to communicate; otherwise, the cloud database will pass the reader authentication and continue to authenticate tag.After completing the reader authentication, the cloud database starts to authenticate the tags. Cloud database first searches the tag’s camouflage identityTIDn. The following are the three kinds of situations:(1)
TIDn does not exist in the cloud databaseIfTIDn cannot match any camouflage identity, it indicates that the tag is not a trusted one. At this time, the cloud database will refuse communication and terminate the entire protocol authentication process.(2)
TIDn=TIDn−1CIfTIDn=TIDn−1C, the shared key used by the tag is Kn=Kn−1C, that is, the tag did not update the shared key in this round of session due to some reasons (such as network problems or network attacks). So, the cloud database will use TIDn−1C and Kn−1C for this round of session, and the protocol will continue.(3)
TIDn=TIDnCIfTIDn=TIDnC, the shared key used by the tag isKn=KnC, that is, the shared key used by the cloud database and the tag in this round of session is equal, which indicates that the cloud database, reader, and tag are normal and secure in the protocol authentication process. So, the cloud database will use TIDnC and KnC to communication with reader and tag at this round of session, and the protocol will continue.Take the third case as an example to explain the protocol process in detail. In the following, we will descript theTIDnC and KnC are used by the cloud database to make authentication with readers and tags.As shown in equation (6), according to the random numbers rr, rt, and rc and the key KnC, the cloud database will perform hash encryption to get the result A′; then, we compare whether A is equal to A′. If A≠A′, then the cloud database will refuse to communication. Otherwise, the cloud database will pass the authentication for readers and tags.(6)A′=Hrr⨁KnC⨁rt⨁rc.When the cloud database has completed the authentication of reader and tag, it needs to prepare for the next stage of reader authentication and tag authentication. At the same time, after the cloud database has verifiedA=A′, the key will be updated.First of all, as shown in equation (7), the cloud database uses the random numbers rc and rt and key KnC to perform one-way hash encryption to get the result C. Next, the cloud database uses the shared key KnCR with the reader to perform AES encryption of the shared key KnC between the cloud database and the tag to obtain the result EKnCRrr⨁KnC. Finally, the cloud database sends the result C and EKnCRrr⨁KnC to the reader. At the same time, as shown in equations (8) and (9), the cloud database updates the key and the camouflage identity of the tag using the response PFn and random numbers rc and rt. As shown in equations (10) and (11), the reader’s key and camouflage identity are updated with the random numbers rc and rr, and then, the protocol will enter the next phase.(7)C=Hrc⨁KnC⨁rt,(8)Kn+1C=Hrc⨁PFn⨁rt,(9)TIDn+1C=HKn+1C⨁rc⨁PFn⨁rt,(10)Kn+1CR=Hrc⨁rr,(11)RIDn+1C=HKn+1CR⨁rc⨁rt.


### 4.3. Reader Authentication Phase

The purpose of this phase is to allow the reader to authenticate the identity of the tag and the cloud database. In previous section, we have discussed the cloud database authentication of readers and tags. If either of the reader or tag is illegal, the protocol process will be terminated. Therefore, in this section, assume that both the reader and the tag are trusted users. For convenience, the cloud database and tag useTIDnC, KnC, and cloud database and reader use RIDnC and KnCR to perform authentication. The following illustrates the detailed protocol process.After the reader receives the resultC and EKnCRrr⨁KnC sent by the cloud database, firstly, the shared key Kncr with cloud database is used to perform AES decrypt EKnCRrr⨁KnC; then, random number rr with XOR operation is used to get the result KnC′. As shown in equation (12), the random numbers rr, rt, and rc and the key KnC′ are combined to perform one-way hash encryption to get the result A′′. At this time, the reader needs to compare the calculated result A′′ with the saved value of A: if A′′≠A, the reader will refuse communication; if A′′=A, in the process of calculating the result A′′, the reader first needs to use the key Kncr shared with the cloud database to decrypt and get the result KnC′, and after then, KnC′ and the random numbers generated by tag and cloud database are used by one-way hash encryption to get the result A′′. Therefore, both the tag and the cloud database will be authenticated by the reader, as shown in equation (13), which uses random number rr and decrypted key KnC′ to perform XOR operation, and one-way hash encryption is used to get the result D, and after then, the reader sends the result D and C⨁D to the tag. Finally, as shown in equations (14) and (15), the reader updates the key and camouflage identification, and the reader authentication phase ends.(12)A′′=Hrr⨁KnC′⨁rt⨁rc,(13)D=HKnC′⨁rr⨁rt,(14)Kn+1cr=Hrc⨁rr,(15)RIDn+1=HKn+1cr⨁rc⨁rt.


### 4.4. Tag Authentication Phase

In this stage, the tag receives the resultD and C⨁D sent by the reader. The tag uses the random numbers rr and rt and the result D where XOR operation is used for them to obtain result C. Then, as shown in equation (16), the tag uses the random number rr and the shared key Kn to perform XOR operation and one-way hash encryption is used to get the result D′, and finally, we compare D′ and D. If D=D′, then the tag is authenticated to the reader. If D≠D′, then the tag will terminate the protocol process.(16)D′=HKn⨁rr⨁rt.Next, the tag will authenticate the cloud’s reader. First, the tag uses the receivedC⨁D and D′ calculated from equation (16) to obtain the XOR operation result C′. Then, as shown in equation (17), the tag uses the random numbers rc and rt and the shared key Kn to perform XOR operation and one-way hash encryption is used to get the result C′′, and finally, the tag compares C′ and C′′. If C′′=C′, then the tag is authenticated to the cloud’s reader. If C′′≠C′, then the tag will terminate the protocol process.(17)C′′=Hrc⨁Kn⨁rt.If the tag has passed the authentication of reader and cloud database, the tag will be shown in equations (18) and (19), combined with the response PFn and random numbers rc and rt to update the key and the tag’s camouflage identification, and then, the protocol process ends.(18)Kn+1=Hrc⨁PFn⨁rt,(19)TIDn+1=HKn+1C⨁rc⨁PFn⨁rt.At last, then-th authentication process ends.


## 4.1. Initialization Phase

The initialization phase of C-RAPA protocol needs to be carried out in a secure environment. In the secure initialization process, the initial key information among the cloud database, reader, and tag is established and shared. It can also be regarded as “identity registration” of tag, reader, and background database. At this time, the tag is new produced and has not communicated with the cloud database or reader. To facilitate the analysis, we select a reader that has never been authenticated with the cloud database to describe the following authentication process. In the initialization phase, the reader is also needed to register.In this stage, the reader first sends initialization request information to the cloud database. After receiving the information, the cloud database generates a random numberrc with the length of L. The random number is sent to the reader. The reader received a random number rc, and an initialization request information and a random number rc are sent to tag. After the tag receives the initialization request information sent by the reader, as shown in equation (1), the random number rc is regarded as the input to get the response PF0 from the PUF module of the tag. At the same time, a random number rt is generated. The true ID of the tag and the response PF0 and random number rt were recorded and sent to the reader.(1)PF0=PUFrc.After the reader receives the true ID of the tag, responsePF0, and random number rt, a random number rr with length of L is generated. The random numbers rt and rr, response PF0, the ID of the reader, and the ID of the tag are sent to the cloud database. After receiving the information, the cloud database uses the random numberrc (generated by the cloud database and tag), the tag’s ID, and response PF0 to generate the camouflage mark TID0C of tag, and the shared key K0C of tag, the random number generated by the cloud database and the reader, and the ID of the reader are used to generate the reader’s camouflage identity RID0C and the shared key K0CR with reader. Finally, the cloud database sends TID0C, K0C, and RID0C, K0CR to the reader; the reader stores the camouflage identity RID0C and the shared key K0CR, which is, respectively, regarded as RID0 and K0cr. Then, the reader sends TID0C and K0C to the tag. The tag holds the camouflage identity TID0C and the shared key K0C which is, respectively, regarded as TID0andK0; then, the initialization process ends. The information stored in cloud database, reader, and tag is shown in Table 2.Table 2
Storage information table in initialization phase.
EntityStorage informationTagTID0, K0ReaderRID0, K0crCloud databaseTID0C, K0C, RID0C,K0CR, TID−1C,K−1C, RID−1C,K−1CRIn the authentication process, aiming at cloud database, readers, and tags, key information need to be saved, respectively: (1) the camouflage identification and shared key used in the previous round of authentication and (20) the camouflage identity and shared key used in this round of authentication. In the initialization stage, it is necessary to save the two groups of key information for subsequent authentication. Since the cloud database, tag, and reader have not been authenticated, the camouflage identification and key information used in the last round of authentication are the following:TID−1C, K−1C, RID−1C,K−1CR, and the camouflage identity and the shared key used in this round of authentication are the following: TID0C, K0C, RID0C,K0CR. For tag, TID0C=TID−1C=TID0, and K0C=K−1C=K0; For readers, RID0C=RID−1C=RID0, and K0CR=K−1CR=K0cr. The sequence diagram of initialization phase is shown in Figure 2.Figure 2
Sequence diagram of initialization phase.


## 4.2. Cloud Database Authentication Phase

At the end of the initialization phase, tags and readers begin to start the authentication phase which is shown in Figure3, including cloud database authentication phase, reader authentication phase, and tag authentication phase.Figure 3
Sequence diagram of authentication phase.While entering the stage of cloud database authentication, it indicates that the cloud database, reader, and tag have been successfully initialized. In the following descriptions, we assume it is then-th authentication process among the cloud database, reader, and tag. In the n-th authentication process, the cloud database needs to store two groups of key information and the camouflage identity shared with the tag: TIDn−1C, Kn−1C and TIDnC, KnC, where TIDn−1C, Kn−1C represents the key information used in the (n−1)-th authentication process and TIDnC, KnC represents the updated key information after the (n−1)-th authentication process, that is, the key information to be used for the n-th authentication which is stored by the tag. Similarly, the cloud database also stores two sets of the shared keys with the reader and the reader’s camouflage identity: RIDn−1C, Kn−1CR and RIDnC, KnCR, where RIDn−1C, Kn−1CR represents the key information used in the (n−1)-th authentication process and RIDnC, KnCR represents the updated key information after the (n−1)-th authentication process, that is, the key information to be used for the n-th authentication which is stored by the reader. In addition, in order to resist the desynchronization attack, the key information of reader and tag is saved, respectively, in cloud database. Which group of key information is stored by the tag and reader needs to be judged according to the information sent to the cloud database by the tag and reader in the authentication process. Next, the n-th authentication process will be described in detail.In the stage of the cloud database authenticating the tag, firstly, the reader sends a request authentication information to the cloud database. After receiving the request authentication information, the cloud database generates a random numberrc and sends it to the reader. When the reader received the random number rc, a random number rr is generated, and after then, the random numbers rr and rc and the request authentication information are sent to the tag. After the tag receives the random numbers rr, and rc and request authentication information, as shown in formula (2), the random number rc is selected as the input to the PUF module to produce the response PFn. Then, it will generate a random rt, as is shown in formula (3), and rr, rt, rc, and Kn are used to perform one-way hash encryption to get the result A. At last, the tag sends the following value of A, TIDn, rt, and PFn to the reader.(2)PFn=PUFrc,(3)A=Hrr⨁Kn⨁rt⨁rc.After the reader receives the result of tag’sA, camouflage identityTIDn, random number rt, and response result PFn, the result A is saved. Next, as shown in equation (4), the reader performs one-way hash encryption using its RIDn, random numbers rr and rc, and the shared key Kncr with the cloud database to get result B. At last, the reader sends the following value of PFn, TIDn, RIDn, rr, rt, A, and B to the cloud database.(4)B=Hrr⨁Kncr⨁rc⨁RIDn.After the cloud database receives response resultPFn, camouflage identity TIDn, RIDn, random numbers rr and rt, and the results A and B sent by reader, it first verifies the result B produced by the reader. The cloud database first searches the reader’s RIDn in the database; there exist three kinds of situations:(1)
RIDn does not exist in the cloud databaseIfRIDn does not exist in the cloud database, it indicates that the reader is not an illegal one. At this time, the cloud database will refuse communication.(2)
RIDn=RIDn−1CIfRIDn=RIDn−1C, it shows that in the n−1 round of authentication process, after the cloud database completes authentication phase, the authentication information sent to the reader may be intercepted, or due to network problems, the reader does not receive the authentication information sent by the cloud database, so there is no update information for the key and camouflage identity. At this condition, the cloud database will use RIDn−1C and Kn−1CR to make authentication with the reader.(3)
RIDn=RIDnCIfRIDn=RIDnC, it shows that in the n−1 round of authentication process, after the cloud database sends the authentication information, the reader verifies the authentication information, passes the authentication process for cloud database, and updates the camouflage identity and shared key. At this condition, the cloud database will use RIDnC and KnCR to make authentication with the reader.Take the third case as an example to explain the protocol process in detail. As shown in equation (5), after searching the RIDn, the cloud database will perform hash encryption using the reader’s RIDnC, random numbers rr and rc, and the key KnCR to get the result B′.(5)B′=Hrr⨁KnCR⨁rc⨁RIDnC.Next, the cloud database needs to judge whetherB is equal to B′. If B≠B′, then the cloud database will refuse to communicate; otherwise, the cloud database will pass the reader authentication and continue to authenticate tag.After completing the reader authentication, the cloud database starts to authenticate the tags. Cloud database first searches the tag’s camouflage identityTIDn. The following are the three kinds of situations:(1)
TIDn does not exist in the cloud databaseIfTIDn cannot match any camouflage identity, it indicates that the tag is not a trusted one. At this time, the cloud database will refuse communication and terminate the entire protocol authentication process.(2)
TIDn=TIDn−1CIfTIDn=TIDn−1C, the shared key used by the tag is Kn=Kn−1C, that is, the tag did not update the shared key in this round of session due to some reasons (such as network problems or network attacks). So, the cloud database will use TIDn−1C and Kn−1C for this round of session, and the protocol will continue.(3)
TIDn=TIDnCIfTIDn=TIDnC, the shared key used by the tag isKn=KnC, that is, the shared key used by the cloud database and the tag in this round of session is equal, which indicates that the cloud database, reader, and tag are normal and secure in the protocol authentication process. So, the cloud database will use TIDnC and KnC to communication with reader and tag at this round of session, and the protocol will continue.Take the third case as an example to explain the protocol process in detail. In the following, we will descript theTIDnC and KnC are used by the cloud database to make authentication with readers and tags.As shown in equation (6), according to the random numbers rr, rt, and rc and the key KnC, the cloud database will perform hash encryption to get the result A′; then, we compare whether A is equal to A′. If A≠A′, then the cloud database will refuse to communication. Otherwise, the cloud database will pass the authentication for readers and tags.(6)A′=Hrr⨁KnC⨁rt⨁rc.When the cloud database has completed the authentication of reader and tag, it needs to prepare for the next stage of reader authentication and tag authentication. At the same time, after the cloud database has verifiedA=A′, the key will be updated.First of all, as shown in equation (7), the cloud database uses the random numbers rc and rt and key KnC to perform one-way hash encryption to get the result C. Next, the cloud database uses the shared key KnCR with the reader to perform AES encryption of the shared key KnC between the cloud database and the tag to obtain the result EKnCRrr⨁KnC. Finally, the cloud database sends the result C and EKnCRrr⨁KnC to the reader. At the same time, as shown in equations (8) and (9), the cloud database updates the key and the camouflage identity of the tag using the response PFn and random numbers rc and rt. As shown in equations (10) and (11), the reader’s key and camouflage identity are updated with the random numbers rc and rr, and then, the protocol will enter the next phase.(7)C=Hrc⨁KnC⨁rt,(8)Kn+1C=Hrc⨁PFn⨁rt,(9)TIDn+1C=HKn+1C⨁rc⨁PFn⨁rt,(10)Kn+1CR=Hrc⨁rr,(11)RIDn+1C=HKn+1CR⨁rc⨁rt.


## 4.3. Reader Authentication Phase

The purpose of this phase is to allow the reader to authenticate the identity of the tag and the cloud database. In previous section, we have discussed the cloud database authentication of readers and tags. If either of the reader or tag is illegal, the protocol process will be terminated. Therefore, in this section, assume that both the reader and the tag are trusted users. For convenience, the cloud database and tag useTIDnC, KnC, and cloud database and reader use RIDnC and KnCR to perform authentication. The following illustrates the detailed protocol process.After the reader receives the resultC and EKnCRrr⨁KnC sent by the cloud database, firstly, the shared key Kncr with cloud database is used to perform AES decrypt EKnCRrr⨁KnC; then, random number rr with XOR operation is used to get the result KnC′. As shown in equation (12), the random numbers rr, rt, and rc and the key KnC′ are combined to perform one-way hash encryption to get the result A′′. At this time, the reader needs to compare the calculated result A′′ with the saved value of A: if A′′≠A, the reader will refuse communication; if A′′=A, in the process of calculating the result A′′, the reader first needs to use the key Kncr shared with the cloud database to decrypt and get the result KnC′, and after then, KnC′ and the random numbers generated by tag and cloud database are used by one-way hash encryption to get the result A′′. Therefore, both the tag and the cloud database will be authenticated by the reader, as shown in equation (13), which uses random number rr and decrypted key KnC′ to perform XOR operation, and one-way hash encryption is used to get the result D, and after then, the reader sends the result D and C⨁D to the tag. Finally, as shown in equations (14) and (15), the reader updates the key and camouflage identification, and the reader authentication phase ends.(12)A′′=Hrr⨁KnC′⨁rt⨁rc,(13)D=HKnC′⨁rr⨁rt,(14)Kn+1cr=Hrc⨁rr,(15)RIDn+1=HKn+1cr⨁rc⨁rt.


## 4.4. Tag Authentication Phase

In this stage, the tag receives the resultD and C⨁D sent by the reader. The tag uses the random numbers rr and rt and the result D where XOR operation is used for them to obtain result C. Then, as shown in equation (16), the tag uses the random number rr and the shared key Kn to perform XOR operation and one-way hash encryption is used to get the result D′, and finally, we compare D′ and D. If D=D′, then the tag is authenticated to the reader. If D≠D′, then the tag will terminate the protocol process.(16)D′=HKn⨁rr⨁rt.Next, the tag will authenticate the cloud’s reader. First, the tag uses the receivedC⨁D and D′ calculated from equation (16) to obtain the XOR operation result C′. Then, as shown in equation (17), the tag uses the random numbers rc and rt and the shared key Kn to perform XOR operation and one-way hash encryption is used to get the result C′′, and finally, the tag compares C′ and C′′. If C′′=C′, then the tag is authenticated to the cloud’s reader. If C′′≠C′, then the tag will terminate the protocol process.(17)C′′=Hrc⨁Kn⨁rt.If the tag has passed the authentication of reader and cloud database, the tag will be shown in equations (18) and (19), combined with the response PFn and random numbers rc and rt to update the key and the tag’s camouflage identification, and then, the protocol process ends.(18)Kn+1=Hrc⨁PFn⨁rt,(19)TIDn+1=HKn+1C⨁rc⨁PFn⨁rt.At last, then-th authentication process ends.


## 5. Security Analysis and Proof of Protocol

### 5.1. Security Analysis

In this section, we will mainly analyze C-RAPA protocol from two aspects: security analysis and BAN logic proof. C-RAPA protocol is a security authentication protocol for RFID systems, which uses cloud database and active tags. The protocol uses AES encryption algorithm and PUF technology to ensure the reliability and security. AES encryption algorithm is used to encrypt the authentication information between cloud database and reader, and one-way hash function and PUF technology are used to encrypt the authentication information among the tag, the reader, and the cloud database. After the cloud database and tag pass the authentication between each other, the key update is started immediately and not waiting for the protocol process to complete.The following contents show that the security of the protocol is verified by analyzing common attack methods.(1)
Counterfeiting attackAttackers use fake readers or fake tags to attack the RFID systems.In the cloud database authentication phase, the tag uses the random numbersrr, rt, and rc and the shared key Kn to calculate the result A which will be sent to the reader, and after then, it will be forwarded to the cloud database. Cloud database searches the identification TIDn to obtain the shared key and calculate A′ and determines the identity of the tag by verifying A=A′. In each round of authentication, the random number is randomly generated by the cloud database, reader, and tag in each round of session. After each round of authentication, the shared key will be updated by combining the random number and response by using one-way hash encryption. As a result, the attacker cannot calculate the value of the shared key and thus a counterfeit tag cannot calculate the result A. Similarly, the reader uses the random number and key to calculate and get the result A′′ and determines the identification of the tag by verifying A=A′′. The attacker cannot calculate the value of the key to get the result A′′ to counterfeit the tag.In the same way, attackers cannot use fake readers.(2)
Replay attackThe attacker eavesdropped then-th authentication process and captured the authentication information: 1rt, TIDn, PFn, A; (2) TIDn, RIDn, PFn, rr, rt, A, B; (3) C, EKnCRKnC; and (4) D, C⨁D. The attacker replays the information to the communicating entity, but the results A, B, C, and D depend on the random number generated in each round of authentication, and uses the updated key and the one-way hash to generate encryption value. Therefore, if the information replayed by the attacker is not equal to the result calculated by both sides of the communication, the replay attack fails.(3)
Replication attackThe proposed C-RAPA protocol is a security authentication protocol based on Physical Unclonable Function and AES encryption algorithm. Cloud database and tags update the key by using the response generated by Physical Unclonable Function for subsequent authentication. Because of the nonreplicability of PUF technology, the attacker cannot copy the same PUF module to produce the same response and pass the authentication. Therefore, the attacker’s replication attack will fail.(4)
Forward privacy attackSuppose that the attacker eavesdrops then-th authentication process and cracks the authentication information to obtain the shared key. Since each round of key is encrypted and updated by one-way hash function, the attacker cannot calculate the key information used in the previous n−1 authentication from the key information of this round.(5)
Desynchronization attackSuppose that the attacker eavesdrop some parts of then-th authentication session and captures the authentication information: (1) rt, TIDn, PFn, A; (2) TIDn, RIDn, PFn, rr, rt, A, B; (3) C, EKnCRKnC; and (4) D, C⨁D. The attacker blocks the authentication information 3 to prevent the reader and tag from updating the key. In the (n+1)-th authentication, the attacker’s desynchronization attack fails because the cloud database stores two groups of key information of tag and reader, respectively.(6)
Tag-tracking attackIn C-RAPA protocol, tag ID is only used in the initialization phase. At the same time, the tag needs to send authentication informationrt, TIDn, PFn, A to the reader, and the reader will forward it to the cloud database, and after then, the cloud database and reader will authenticate the tag. The randomness of random number, the unidirectionality of response, and hash function make it impossible for attackers to infer the ID and other information of tags even if they eavesdrop on multiple sessions.To sum up, the security comparison of the protocols mentioned above in C-RAPA protocol is shown in Table3.Table 3
Comparisons of different protocols’ security.
Attack methodsC-RAPA protocolChou protocol [26]Liao protocol [27]Xie protocol [32]Counterfeiting attack✓××✓Replay attack✓✓✓✓Replication attack✓✓✓✓Forward privacy attack✓×✓✓Desynchronization attack✓✓✓✓Tag-tracking attack✓✓××It can be seen from Table3 that the Chou protocol [26] cannot resist counterfeiting attacks and forward privacy attacks. If the attacker breaks the n-th authentication, the n−1 communication between the tag and the reader will be cracked by the attacker. Liao protocol [27] cannot resist counterfeiting attacks and tag-tracking attacks. Attackers can obtain the real information of tags by tracing the authentication of specific tags. Similarly, Xie protocol [32] cannot resist tag-tracking attacks. Therefore, the C-RAPA protocol proposed in this paper has greater advantages in resisting common security attacks.


### 5.2. BAN Logic Proof

In this section, firstly, we will explain the BAN logic expression and derivation rules and then prove the correctness of the proposed C-RAPA protocol using BAN logic. BAN logic was proposed by Burrows et al. in 1989 [17]. In short, BAN logic is a kind of method based on reasoning structural, using logic system to infer whether the protocol meets its security specification by starting from messages sent and received by users through a series of axioms and rules. The steps of BAN logic proof include protocol description, protocol initialization, and the presentation and proof of the security objectives.The BAN logic expression is as follows:(1)
Expression 5-1:X∣≡Y. In the whole protocol process, subject X assumes that Y is trusted.(2)
Expression 5-2:X∣~Y. Subject X has sent a message containing Y.(3)
Expression 5-3:X⊲Y. Subject X receives a message containing Y.(4)
Expression 5-4:X∣⇒Y. Subject X is used for the arbitration right of Y.(5)
Expression 5-5: #(X). Subject X appears for the first time in the protocol process.(6)
Expression 5-6:X↔KY. Subject X and subject Y have a shared key (K), and only X and Y know it and use the shared key (K).(7)
Expression 5-7:XK. The ciphertext is obtained by encrypting X with the key (K).BAN logic reasoning rules are as follows:(1)
The message meaning rule is shown in equation (20). If X believes the shared key K between X and Y, and X has received the ciphertext encrypted by the shared key K to Z, then X believes Y has sent Z. Note that this rule requires that X never sends Z(20)X∣≡Y↔KX,X⊲ZKX≡Y~Z.(2)
The arbitration rule is shown in equation (21). If X believes that Y has sent Z, and X believes that Y believes Z, then X believes Z. This rule is used to get trust relationship between the two sides through a middleman(21)X≡Y⇒Z,X≡Y≡ZX≡Z.(3)
The trust rule is shown in equation (22). Only if X trusts Y and X trusts Z, then X trusts a set of messages sent by Y and Z(22)X≡Y,X≡ZX∣≡Y,Z.(4)
The message splitting rule is shown in equation (23), which can be recognized as the inverse proposition of belief rule. If X trusts a group of messages composed of Y, Z, and Q, then X trusts every clause in the group of messages(23)X∣≡Y,Z,QX≡Y,X≡Z,X≡Q.(5)
The freshness value verification rule (also called random number verification rule) is shown in equation (24), and the information with the participation of fresh random number can be trusted(24)X∣≡#Y,X∣≡Z∣~YX≡Z≡Y.(6)
SupposeY appears for the first time in the protocol, and the sender X trusts Y; thus, the freshness value verification rule can be shown as equation (25).(25)X∣≡#YX∣≡#Y,Z.(7)
The rules for receiving messages are shown in equation (26) and equation (27), which indicates that X receives information containing Y and Z, which means that X receives information containing Y. Equation (27) shows that X trusts the shared key K between Y and X, and X receives the information sent by Y containing the ciphertext encrypted by Z using the shared key K; then, X can decrypt Z by using the shared key K, that is, X receives the information containing Z(26)X⊲Y,ZX⊲Y,(27)X∣≡Y↔KX,X⊲ZKX⊲Z.(8)
The transmission rule is shown in equation (28). If X believes that Y has sent information containing Z and Q, then X also believes that Y has sent information containing Z(28)X≡Y~Z,QX≡Y~Z.In C-RAPA protocol, there are three entities: cloud database (C), reader (R), and tag (T). The following will analyze and prove the n-th certification process.The C-RAPA protocol is described as follows:(1)
R→C: request(2)
C→R: rc(3)
R→T: rr, rc, request(4)
T→R: rt, TIDn, PFn, Hrr⨁Kn⨁rt⨁rc(5)
R→C: TIDn, RIDn, PFn, rr, rt, Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn(6)
C→R: Hrc⨁KnC⨁rt, EKnCRKnC(7)
R→T: HKnC′⨁rr⨁rt, Hrc⨁KnC⨁rt⨁HKnC′⨁rr⨁rtThe initialization of C-RAPA protocol is as follows:(1)
T∣≡C↔TIDn,KnT(2)
C∣≡T↔TIDnC,KnCC(3)
R∣≡C↔KncrR(4)
C∣≡R↔KnCRC(5)
T∣≡#rt(6)
R∣≡#rr(7)
C∣≡#rc(8)
C⊲TIDn, RIDn, PFn, rr, rt, Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn(9)
R⊲Hrc⨁KnC⨁rt, EKnCRrr⨁KnC(10)
T⊲HKnC′⨁rr⨁rt, Hrc⨁KnC⨁rt⨁HKnC′⨁rr⨁rtNext, we propose the three security goals for C-RAPA protocol and prove their correctness using BAN logic.Security Objective 1. The cloud database believes that the reader has sent information Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn, that is,(29)C≡R≡Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.Prove.(1)
According toC∣≡R↔KnCRC and C⊲TIDn, RIDn, PFn, rr, rt, Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn and the rules of message meaning X∣≡Y↔KX,X⊲ZK/X∣≡Y∣~Z, the following can be deduced(30)C∣≡R∣~Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.(2)
According toC∣≡#rc and the freshness validation rules X∣≡#Y/X∣≡#Y,Z, the following can be deduced(31)C∣≡#Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.(3)
According to the above two steps’ results and freshness validation rulesX∣≡#Y,X∣≡Z∣~Y/X≡Z≡Y, the following can be deduced(32)C≡R≡Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.Thus, security objective 1 is proved.Security Objective 2. The reader believes that the cloud database has sent the information Hrc⨁KnC⨁rt, EKnCRrr⨁KnC, that is,(33)R≡C≡Hrc⨁KnC⨁rt,EKnCRrr⨁KnC.Prove.(1)
According toR∣≡C↔KncrR, R⊲Hrc⨁KnC⨁rt, EKnCRrr⨁KnC and the rules of message meaning X∣≡Y↔KX,X⊲ZK/X∣≡Y∣~Z, the following can be deduced(34)R≡C~HPFn⊕rt.(2)
According toR∣≡#rr and the freshness validation rules X∣≡#Y/X∣≡#Y,Z, the following can be deduced(35)R∣≡#Hrc⨁KnC⨁rt,EKnCRrr⨁KnC.(3)
According to the above two steps’ results and freshness validation rulesX∣≡#Y,X∣≡Z∣~Y/X≡Z≡Y, the following can be deduced(36)R≡C≡Hrc⨁KnC⨁rt,EKnCRrr⨁KnC.Thus, security objective 2 is proved.Security Objective 3. The tag believes that the cloud database has sent the information HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt, that is,(37)T≡C≡HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.Prove.(1)
According toT∣≡C↔TIDn,KnT and T⊲HKnC′⨁rr⨁rt, Hrc⨁KnC⨁rt⨁HKnC′⨁rr⨁rt and the rules of message meaning X∣≡Y↔KX,X⊲ZK/X∣≡Y∣~Z, the following can be deduced(38)T≡C~HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.(2)
According toT∣≡#rt and the freshness validation rules X∣≡#Y/X∣≡#Y,Z, the following can be deduced(39)T∣≡#HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.(3)
According to the above two steps’ results and freshness validation rulesX∣≡#Y,X∣≡Z∣~Y/X≡Z≡Y, the following can be deduced(40)T≡C≡HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.Thus, security objective 3 is proved.


### 5.3. Computing Overhead Analysis

In this section, we will analysis the computing overhead of C-RAPA protocol inn times authentication process, which includes the following: cloud-based database authentication phase, reader authentication phase, and tag authentication phase. The PUF module will generate a corresponding operation for a random excitation which is referred to the PUF response time that is recorded as TPUF. The time of one AES encryption and decryption is recorded as TAES. The time of one-way hash encryption function is THash. Generating a random number operation time is recorded as TR. In the elliptic curve encryption algorithm, the time of one time point-addition is TEA, and the time of multiplication of a point is TEM.In C-RAPA protocol, for cloud database, the time required is3THash+TAES+TR which includes the generating random number operation, three times of one-way hash encryption, and one AES encryption operation. For the reader, the time required is 3THash+TAES+TR which includes the generating random number operation, three times of one-way hash encryption, and one AES decryption operation. For tags, it takes 3THash+TPUF+TR to perform one random number generation operation, three times of one-way hash encryption, and one PUF response operation. Therefore, the whole RFID systems need a total time of 9THash+2TAES+TPUF+3TR in the authentication process.Chou protocol [26] needs two multiplication operations, three point-addition operations, and two times of hash operations in the authentication process, namely, 2THash+2TEA+3TEM. In the authentication process of Liao protocol [27], there are two times of multiplication operations and five point-addition operations, namely, 2TEA+5TEM. Therefore, the computation time of C-RAPA protocol is less than that of Chou protocol [26] and Liao protocol [27]. In the process of communication, Xie protocol [32] needs to perform two times of random number generation operations, seven hash encryption operations, one AES encryption operation, and one AES decryption operation, namely, 7THash+2TAES+2TR. Although the computation cost of Xie protocol [32] is less than that of C-RAPA protocol in two times of hash encryption, one time of PUF operation, and one time of generating random number operation, it can be seen from Table 3 that Xie protocol [32] does not have tag’s anonymity, and PUF operation generated in C-RAPA protocol can resist replication attack. Considering the computation cost and security analysis, C-RAPA protocol is better than the compared three protocols.


### 5.4. Storage Space Analysis

In this section, the storage space of C-RAPA protocol is analyzed. Suppose the bit length of random number and shared key are bothL, and the bit length of the results obtained by AES encryption algorithm and one-way hash encryption is also L. Therefore, in the C-RAPA protocol, the information stored in the cloud database, reader, and tag during the authentication process is shown in Table 4.Table 4
Information stored in each stage of C-RAPA.
ProcessCloud databaseReaderTagInitializationTIDnnew, Knnew, TIDnold, Knold, KrcKrc, RIDTIDn, KnCloud-based database authenticationTIDnnew, Knnew, RID, Krc, A, B, PFnKrc, RID, ATIDn, KnReader authenticationTIDn+1new,Kn+1new,TIDn+1old, Kn+1old,KrcKrc, RID, ATIDn, KnTag authenticationTIDn+1new, Kn+1new, TIDn+1old, Kn+1old, KrcKrc, RIDTIDn+1, Kn+1, C, DFor cloud database, a total of 7L of space is required for specific tags, in the C-RAPA protocol process. For RFID tags, a total of 3L of storage space is needed in the C-RAPA protocol process. For RFID readers, a total of 4L of storage space is needed in the C-RAPA protocol process.


## 5.1. Security Analysis

In this section, we will mainly analyze C-RAPA protocol from two aspects: security analysis and BAN logic proof. C-RAPA protocol is a security authentication protocol for RFID systems, which uses cloud database and active tags. The protocol uses AES encryption algorithm and PUF technology to ensure the reliability and security. AES encryption algorithm is used to encrypt the authentication information between cloud database and reader, and one-way hash function and PUF technology are used to encrypt the authentication information among the tag, the reader, and the cloud database. After the cloud database and tag pass the authentication between each other, the key update is started immediately and not waiting for the protocol process to complete.The following contents show that the security of the protocol is verified by analyzing common attack methods.(1)
Counterfeiting attackAttackers use fake readers or fake tags to attack the RFID systems.In the cloud database authentication phase, the tag uses the random numbersrr, rt, and rc and the shared key Kn to calculate the result A which will be sent to the reader, and after then, it will be forwarded to the cloud database. Cloud database searches the identification TIDn to obtain the shared key and calculate A′ and determines the identity of the tag by verifying A=A′. In each round of authentication, the random number is randomly generated by the cloud database, reader, and tag in each round of session. After each round of authentication, the shared key will be updated by combining the random number and response by using one-way hash encryption. As a result, the attacker cannot calculate the value of the shared key and thus a counterfeit tag cannot calculate the result A. Similarly, the reader uses the random number and key to calculate and get the result A′′ and determines the identification of the tag by verifying A=A′′. The attacker cannot calculate the value of the key to get the result A′′ to counterfeit the tag.In the same way, attackers cannot use fake readers.(2)
Replay attackThe attacker eavesdropped then-th authentication process and captured the authentication information: 1rt, TIDn, PFn, A; (2) TIDn, RIDn, PFn, rr, rt, A, B; (3) C, EKnCRKnC; and (4) D, C⨁D. The attacker replays the information to the communicating entity, but the results A, B, C, and D depend on the random number generated in each round of authentication, and uses the updated key and the one-way hash to generate encryption value. Therefore, if the information replayed by the attacker is not equal to the result calculated by both sides of the communication, the replay attack fails.(3)
Replication attackThe proposed C-RAPA protocol is a security authentication protocol based on Physical Unclonable Function and AES encryption algorithm. Cloud database and tags update the key by using the response generated by Physical Unclonable Function for subsequent authentication. Because of the nonreplicability of PUF technology, the attacker cannot copy the same PUF module to produce the same response and pass the authentication. Therefore, the attacker’s replication attack will fail.(4)
Forward privacy attackSuppose that the attacker eavesdrops then-th authentication process and cracks the authentication information to obtain the shared key. Since each round of key is encrypted and updated by one-way hash function, the attacker cannot calculate the key information used in the previous n−1 authentication from the key information of this round.(5)
Desynchronization attackSuppose that the attacker eavesdrop some parts of then-th authentication session and captures the authentication information: (1) rt, TIDn, PFn, A; (2) TIDn, RIDn, PFn, rr, rt, A, B; (3) C, EKnCRKnC; and (4) D, C⨁D. The attacker blocks the authentication information 3 to prevent the reader and tag from updating the key. In the (n+1)-th authentication, the attacker’s desynchronization attack fails because the cloud database stores two groups of key information of tag and reader, respectively.(6)
Tag-tracking attackIn C-RAPA protocol, tag ID is only used in the initialization phase. At the same time, the tag needs to send authentication informationrt, TIDn, PFn, A to the reader, and the reader will forward it to the cloud database, and after then, the cloud database and reader will authenticate the tag. The randomness of random number, the unidirectionality of response, and hash function make it impossible for attackers to infer the ID and other information of tags even if they eavesdrop on multiple sessions.To sum up, the security comparison of the protocols mentioned above in C-RAPA protocol is shown in Table3.Table 3
Comparisons of different protocols’ security.
Attack methodsC-RAPA protocolChou protocol [26]Liao protocol [27]Xie protocol [32]Counterfeiting attack✓××✓Replay attack✓✓✓✓Replication attack✓✓✓✓Forward privacy attack✓×✓✓Desynchronization attack✓✓✓✓Tag-tracking attack✓✓××It can be seen from Table3 that the Chou protocol [26] cannot resist counterfeiting attacks and forward privacy attacks. If the attacker breaks the n-th authentication, the n−1 communication between the tag and the reader will be cracked by the attacker. Liao protocol [27] cannot resist counterfeiting attacks and tag-tracking attacks. Attackers can obtain the real information of tags by tracing the authentication of specific tags. Similarly, Xie protocol [32] cannot resist tag-tracking attacks. Therefore, the C-RAPA protocol proposed in this paper has greater advantages in resisting common security attacks.


## 5.2. BAN Logic Proof

In this section, firstly, we will explain the BAN logic expression and derivation rules and then prove the correctness of the proposed C-RAPA protocol using BAN logic. BAN logic was proposed by Burrows et al. in 1989 [17]. In short, BAN logic is a kind of method based on reasoning structural, using logic system to infer whether the protocol meets its security specification by starting from messages sent and received by users through a series of axioms and rules. The steps of BAN logic proof include protocol description, protocol initialization, and the presentation and proof of the security objectives.The BAN logic expression is as follows:(1)
Expression 5-1:X∣≡Y. In the whole protocol process, subject X assumes that Y is trusted.(2)
Expression 5-2:X∣~Y. Subject X has sent a message containing Y.(3)
Expression 5-3:X⊲Y. Subject X receives a message containing Y.(4)
Expression 5-4:X∣⇒Y. Subject X is used for the arbitration right of Y.(5)
Expression 5-5: #(X). Subject X appears for the first time in the protocol process.(6)
Expression 5-6:X↔KY. Subject X and subject Y have a shared key (K), and only X and Y know it and use the shared key (K).(7)
Expression 5-7:XK. The ciphertext is obtained by encrypting X with the key (K).BAN logic reasoning rules are as follows:(1)
The message meaning rule is shown in equation (20). If X believes the shared key K between X and Y, and X has received the ciphertext encrypted by the shared key K to Z, then X believes Y has sent Z. Note that this rule requires that X never sends Z(20)X∣≡Y↔KX,X⊲ZKX≡Y~Z.(2)
The arbitration rule is shown in equation (21). If X believes that Y has sent Z, and X believes that Y believes Z, then X believes Z. This rule is used to get trust relationship between the two sides through a middleman(21)X≡Y⇒Z,X≡Y≡ZX≡Z.(3)
The trust rule is shown in equation (22). Only if X trusts Y and X trusts Z, then X trusts a set of messages sent by Y and Z(22)X≡Y,X≡ZX∣≡Y,Z.(4)
The message splitting rule is shown in equation (23), which can be recognized as the inverse proposition of belief rule. If X trusts a group of messages composed of Y, Z, and Q, then X trusts every clause in the group of messages(23)X∣≡Y,Z,QX≡Y,X≡Z,X≡Q.(5)
The freshness value verification rule (also called random number verification rule) is shown in equation (24), and the information with the participation of fresh random number can be trusted(24)X∣≡#Y,X∣≡Z∣~YX≡Z≡Y.(6)
SupposeY appears for the first time in the protocol, and the sender X trusts Y; thus, the freshness value verification rule can be shown as equation (25).(25)X∣≡#YX∣≡#Y,Z.(7)
The rules for receiving messages are shown in equation (26) and equation (27), which indicates that X receives information containing Y and Z, which means that X receives information containing Y. Equation (27) shows that X trusts the shared key K between Y and X, and X receives the information sent by Y containing the ciphertext encrypted by Z using the shared key K; then, X can decrypt Z by using the shared key K, that is, X receives the information containing Z(26)X⊲Y,ZX⊲Y,(27)X∣≡Y↔KX,X⊲ZKX⊲Z.(8)
The transmission rule is shown in equation (28). If X believes that Y has sent information containing Z and Q, then X also believes that Y has sent information containing Z(28)X≡Y~Z,QX≡Y~Z.In C-RAPA protocol, there are three entities: cloud database (C), reader (R), and tag (T). The following will analyze and prove the n-th certification process.The C-RAPA protocol is described as follows:(1)
R→C: request(2)
C→R: rc(3)
R→T: rr, rc, request(4)
T→R: rt, TIDn, PFn, Hrr⨁Kn⨁rt⨁rc(5)
R→C: TIDn, RIDn, PFn, rr, rt, Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn(6)
C→R: Hrc⨁KnC⨁rt, EKnCRKnC(7)
R→T: HKnC′⨁rr⨁rt, Hrc⨁KnC⨁rt⨁HKnC′⨁rr⨁rtThe initialization of C-RAPA protocol is as follows:(1)
T∣≡C↔TIDn,KnT(2)
C∣≡T↔TIDnC,KnCC(3)
R∣≡C↔KncrR(4)
C∣≡R↔KnCRC(5)
T∣≡#rt(6)
R∣≡#rr(7)
C∣≡#rc(8)
C⊲TIDn, RIDn, PFn, rr, rt, Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn(9)
R⊲Hrc⨁KnC⨁rt, EKnCRrr⨁KnC(10)
T⊲HKnC′⨁rr⨁rt, Hrc⨁KnC⨁rt⨁HKnC′⨁rr⨁rtNext, we propose the three security goals for C-RAPA protocol and prove their correctness using BAN logic.Security Objective 1. The cloud database believes that the reader has sent information Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn, that is,(29)C≡R≡Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.Prove.(1)
According toC∣≡R↔KnCRC and C⊲TIDn, RIDn, PFn, rr, rt, Hrr⨁Kn⨁rt⨁rc, Hrr⨁Kncr⨁rc⨁RIDn and the rules of message meaning X∣≡Y↔KX,X⊲ZK/X∣≡Y∣~Z, the following can be deduced(30)C∣≡R∣~Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.(2)
According toC∣≡#rc and the freshness validation rules X∣≡#Y/X∣≡#Y,Z, the following can be deduced(31)C∣≡#Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.(3)
According to the above two steps’ results and freshness validation rulesX∣≡#Y,X∣≡Z∣~Y/X≡Z≡Y, the following can be deduced(32)C≡R≡Hrr⨁Kn⨁rt⨁rc,Hrr⨁Kncr⨁rc⨁RIDn.Thus, security objective 1 is proved.Security Objective 2. The reader believes that the cloud database has sent the information Hrc⨁KnC⨁rt, EKnCRrr⨁KnC, that is,(33)R≡C≡Hrc⨁KnC⨁rt,EKnCRrr⨁KnC.Prove.(1)
According toR∣≡C↔KncrR, R⊲Hrc⨁KnC⨁rt, EKnCRrr⨁KnC and the rules of message meaning X∣≡Y↔KX,X⊲ZK/X∣≡Y∣~Z, the following can be deduced(34)R≡C~HPFn⊕rt.(2)
According toR∣≡#rr and the freshness validation rules X∣≡#Y/X∣≡#Y,Z, the following can be deduced(35)R∣≡#Hrc⨁KnC⨁rt,EKnCRrr⨁KnC.(3)
According to the above two steps’ results and freshness validation rulesX∣≡#Y,X∣≡Z∣~Y/X≡Z≡Y, the following can be deduced(36)R≡C≡Hrc⨁KnC⨁rt,EKnCRrr⨁KnC.Thus, security objective 2 is proved.Security Objective 3. The tag believes that the cloud database has sent the information HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt, that is,(37)T≡C≡HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.Prove.(1)
According toT∣≡C↔TIDn,KnT and T⊲HKnC′⨁rr⨁rt, Hrc⨁KnC⨁rt⨁HKnC′⨁rr⨁rt and the rules of message meaning X∣≡Y↔KX,X⊲ZK/X∣≡Y∣~Z, the following can be deduced(38)T≡C~HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.(2)
According toT∣≡#rt and the freshness validation rules X∣≡#Y/X∣≡#Y,Z, the following can be deduced(39)T∣≡#HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.(3)
According to the above two steps’ results and freshness validation rulesX∣≡#Y,X∣≡Z∣~Y/X≡Z≡Y, the following can be deduced(40)T≡C≡HKnC′⨁rr⨁rt,Hrc⨁KnC⨁rt.Thus, security objective 3 is proved.


## 5.3. Computing Overhead Analysis

In this section, we will analysis the computing overhead of C-RAPA protocol inn times authentication process, which includes the following: cloud-based database authentication phase, reader authentication phase, and tag authentication phase. The PUF module will generate a corresponding operation for a random excitation which is referred to the PUF response time that is recorded as TPUF. The time of one AES encryption and decryption is recorded as TAES. The time of one-way hash encryption function is THash. Generating a random number operation time is recorded as TR. In the elliptic curve encryption algorithm, the time of one time point-addition is TEA, and the time of multiplication of a point is TEM.In C-RAPA protocol, for cloud database, the time required is3THash+TAES+TR which includes the generating random number operation, three times of one-way hash encryption, and one AES encryption operation. For the reader, the time required is 3THash+TAES+TR which includes the generating random number operation, three times of one-way hash encryption, and one AES decryption operation. For tags, it takes 3THash+TPUF+TR to perform one random number generation operation, three times of one-way hash encryption, and one PUF response operation. Therefore, the whole RFID systems need a total time of 9THash+2TAES+TPUF+3TR in the authentication process.Chou protocol [26] needs two multiplication operations, three point-addition operations, and two times of hash operations in the authentication process, namely, 2THash+2TEA+3TEM. In the authentication process of Liao protocol [27], there are two times of multiplication operations and five point-addition operations, namely, 2TEA+5TEM. Therefore, the computation time of C-RAPA protocol is less than that of Chou protocol [26] and Liao protocol [27]. In the process of communication, Xie protocol [32] needs to perform two times of random number generation operations, seven hash encryption operations, one AES encryption operation, and one AES decryption operation, namely, 7THash+2TAES+2TR. Although the computation cost of Xie protocol [32] is less than that of C-RAPA protocol in two times of hash encryption, one time of PUF operation, and one time of generating random number operation, it can be seen from Table 3 that Xie protocol [32] does not have tag’s anonymity, and PUF operation generated in C-RAPA protocol can resist replication attack. Considering the computation cost and security analysis, C-RAPA protocol is better than the compared three protocols.


## 5.4. Storage Space Analysis

In this section, the storage space of C-RAPA protocol is analyzed. Suppose the bit length of random number and shared key are bothL, and the bit length of the results obtained by AES encryption algorithm and one-way hash encryption is also L. Therefore, in the C-RAPA protocol, the information stored in the cloud database, reader, and tag during the authentication process is shown in Table 4.Table 4
Information stored in each stage of C-RAPA.
ProcessCloud databaseReaderTagInitializationTIDnnew, Knnew, TIDnold, Knold, KrcKrc, RIDTIDn, KnCloud-based database authenticationTIDnnew, Knnew, RID, Krc, A, B, PFnKrc, RID, ATIDn, KnReader authenticationTIDn+1new,Kn+1new,TIDn+1old, Kn+1old,KrcKrc, RID, ATIDn, KnTag authenticationTIDn+1new, Kn+1new, TIDn+1old, Kn+1old, KrcKrc, RIDTIDn+1, Kn+1, C, DFor cloud database, a total of 7L of space is required for specific tags, in the C-RAPA protocol process. For RFID tags, a total of 3L of storage space is needed in the C-RAPA protocol process. For RFID readers, a total of 4L of storage space is needed in the C-RAPA protocol process.


## 6. Summary

In this paper, aiming at the security requirements for RFID healthcare applications, combined with the characteristics of active tags and cloud database, we proposed an RFID security authentication protocol based on AES encryption algorithm and PUF technology. The presented protocol uses AES encryption algorithm to encrypt the authentication information between the cloud database and the reader, and PUF technology and one-way hash function are used to encrypt the authentication information among the tag, the reader, and the cloud database. Moreover, after the cloud database and tags pass the authentication between each other, they both immediately start to update the key, rather than wait until the end of the authentication process. Finally, the security and performance of protocol are analyzed, including the computing overhead and storage space.This paper makes the following three main academic contributions: (1) a novel security authentication protocol based on Physical Unclonable Function is proposed for RFID healthcare systems, which use active tag and AES encryption to ensure the RFID systems’ security to resist the typical wireless attacks. (2) BAN logic is used to deduce the security goal and prove the security of the proposed protocol, which gives a security analysis model for RFID application systems. (3) With the application of PUF and Cloud technology, the key in our protocol is updated at the real time while other protocols update the key at the end of the authentication process.We expect our findings will contribute to further enhancing the security for RFID healthcare systems. And accordingly, this research results have many practical applications, such as in RFID-based intelligent transportation in Internet of Vehicle environment and RFID-based high security door system. We proposed a protocol to more effectively ensure the privacy of RFID holders that will be prepared for future smart and intelligent applications based on RFID technology.



---

*Source: 8844178-2021-07-23.xml*