Bidirectional authentication method for RFID system and RFID system

Abstract

The present application belongs to the technical field of Internet of Things, and in particular, relates to a two-way authentication method and RFID system of an RFID system, including: a reader sends a security authentication request to a tag; the tag sends a tag pseudo-random identity to the reader; the reader generates a reader verification request message based on the Hamming weight of the identity and a preset shared key through an ultra-lightweight transformation function and sends it to the tag; the tag generates an electronic tag verification request message based on the Hamming weight of the identity and a preset shared key through an ultra-lightweight transformation function and sends it to the reader; the reader and the tag update the shared key and the electronic tag pseudo-random identity through an ultra-lightweight transformation function based on the Hamming weight of the identity, the preset shared key, and the verification request message of the reader and the tag. The method improves the security of the Internet of Things RFID system and can resist desynchronization attacks.

Description

Technical Field

[0001] The present application belongs to the technical field of Internet of Things, and in particular, relates to a two-way authentication method of an RFID system and an RFID system. Background Art

[0002] The Radio Frequency Identification (RFID) system uses radio wave reflection communication to automatically identify and track the electronic tags attached to the target object through the reader in a non-contact manner, thereby obtaining detailed information about the target object. Due to its advantages such as small size, easy to carry, low cost, and long life, RFID technology is widely used in various fields such as production, logistics, national defense, and transportation. However, due to the limited resources of RFID tags and the fact that they operate in an open wireless environment, RFID system communications are vulnerable to various security threats such as eavesdropping attacks and spoofing attacks.

[0003] Due to the limited resources of RFID tags, traditional high-intensity encryption or signature algorithms are difficult to integrate into tags. There are currently several ultra-lightweight security protocols for resource-constrained low-cost passive RFID tags. These protocols are all based on transformation functions designed for linear operations to ensure the diffusion of secret information, resulting in corresponding security vulnerabilities in the authentication protocol, including: using T functions and their linear combinations to achieve the diffusion of secret information, while T functions have low security; using operations with biased outputs, such as AND and OR operations in Boolean functions, and circular shift operations will introduce additional security vulnerabilities.

[0004] In summary, how to achieve secure identification and privacy protection of resource-constrained RFID tags has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a two-way authentication method of an RFID system and an RFID system.

[0007] (II) Technical solution

[0008] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0009] In a first aspect, an embodiment of the present invention provides a two-way authentication method for an RFID system, wherein the preset parameters of a reader / writer and an electronic tag of the RFID system both include a pseudo-random identity identifier and a shared key of the electronic tag to be authenticated, and the method comprises:

[0010] The reader / writer sends a security authentication request to the electronic tag;

[0011] The electronic tag sends the pseudo-random identity of the electronic tag to the reader / writer in response to the security authentication request;

[0012] The reader verifies the received pseudo-random identity of the electronic tag, and after the verification is passed, generates a reader verification request message through an ultra-lightweight transformation function based on the Hamming weight of the pseudo-random identity of the electronic tag and a preset shared key, and sends the message to the tag;

[0013] The electronic tag verifies the legitimacy of the reader verification request message based on the Hamming weight of the preset electronic tag pseudo-random identity and the shared key, and after the verification is passed, generates an electronic tag verification request message through an ultra-lightweight transformation function and sends it to the reader;

[0014] The reader / writer performs a legitimacy verification on the electronic tag verification request message;

[0015] After the verification is passed, the reader and the electronic tag respectively update the shared key and the electronic tag pseudo-random identity through the ultra-lightweight transformation function based on the Hamming weight of the preset electronic tag pseudo-random identity, the preset shared key, and the verification request message of the reader and the electronic tag.

[0016] Optionally, the ultra-lightweight transformation function is defined as:

[0017] For two strings P and Q of the same length of n bits, the strings P and Q are grouped based on the Hamming weights of the strings P and Q and a preset grouping size threshold;

[0018] The grouping of the two strings P and Q is exchanged, and the subgroups of the two strings after the exchange of grouping are circularly shifted left based on the Hamming weight to obtain the rearranged strings P' and Q';

[0019] The following operations are performed on the two rearranged strings P' and Q': the number of even bits in the string P' is taken from low to high, and they are written into the odd bits of the output string in a high to low manner; the number of odd bits in the string Q' is taken from high to low, and they are written into the even bits of the output string in a low to high manner to obtain the first combined string; the remaining bits of the strings P' and Q' are combined in sequence to form the second combined string Z, which is expressed as follows:

[0020] Z=z n z n-1 …z2z1=P'1Q'2P'3Q'4…P' 2r-1 Q2' r ,z i ∈{0,1},i=1,2,…,n

[0021] An XOR operation is performed on the first combined character string and the second combined character string Z, and the obtained character string is used as the output of the ultra-lightweight transformation function.

[0022] Optionally, before S10, the method further includes:

[0023] The reader / writer reads the electronic tag unique identifier of the electronic tag and sends it to the backend server;

[0024] The backend server generates a pseudo-random identity of the electronic tag based on the unique identifier of the electronic tag, and randomly generates a shared key between the electronic tag and the reader;

[0025] The backend server stores and sends the shared key and the pseudo-random identity of the electronic tag to the reader / writer;

[0026] The reader receives and stores the shared key and the pseudo-random identity of the electronic tag, and sends the shared key and the pseudo-random identity of the electronic tag to the electronic tag;

[0027] The electronic tag receives and stores the shared key and the electronic tag pseudo-random identity.

[0028] Optionally, based on the Hamming weight of the pseudo-random identity of the electronic tag and a preset shared key, generating the reader / writer verification request message through an ultra-lightweight transformation function includes:

[0029] S231, the reader generates a second random number, and generates a first character string and a second character string based on the Hamming weight of the pseudo-random identity of the electronic tag and the shared key, including the following steps:

[0030] When the Hamming weight is an odd number, the first half of the shared key K L As the first string K LorR , the second half of the shared key K R As the second string K' LorR ;

[0031] When the Hamming weight is an even number, the second half of the shared key K R As the first string K LorR , the first half of the shared key K L As the second string K' LorR ;

[0032] S232: Based on the first character string and the second character string, generate the reader / writer verification request message through the ultra-lightweight transformation function.

[0033] Optionally, step S232 includes:

[0034] The first verification request message A and the second verification request message B of the reader / writer are generated according to the first character string, the second character string and the second random number by the following formula:

[0035]

[0036]

[0037] Among them, LTH(*,*) is an ultra-lightweight transformation function. is an XOR operation, Rot(*,*) represents a circular left shift based on the Hamming weight, R2 is the second random number, K LorR is the first string, K' LorR For the second string;

[0038] The reader-writer verification request message A||B is generated based on the first verification request message, the second verification request message and the Hamming weight of the second verification request message LorR ,in:

[0039] When the Hamming weight of B is odd, A||B LorR =A||B L , B L It is the first half of B;

[0040] When the Hamming weight of B is even, A||B LorR =A||B R , B R It is the second half of B.

[0041] Optionally, the reader updates the shared key and the electronic tag pseudo-random identity through the ultra-lightweight transformation function based on the preset Hamming weight of the electronic tag pseudo-random identity, the preset shared key, and the verification request message of the reader and the electronic tag, including:

[0042] Based on the first character string, the second character string and the second random number, the shared key is updated by the ultra-lightweight transformation function, and the formula is as follows:

[0043]

[0044]

[0045]

[0046] Among them, K new Updated shared key;

[0047] Based on the verification request message of the reader / writer and the electronic tag and the second random number, the pseudo-random identity of the electronic tag is updated by the ultra-lightweight transformation function;

[0048]

[0049] Among them, PID new Represents the pseudo-random identity of the updated electronic tag, B' LorR Indicates the other half of the reader verification request message that the reader has not sent out, C' LorR Indicates the other half of the electronic tag verification request message that has not been sent out.

[0050] Optionally, the electronic tag generates an electronic tag verification request message through an ultra-lightweight transformation function based on the Hamming weight of the preset electronic tag pseudo-random identity and a shared key and sends the message to the reader / writer, including:

[0051] C is calculated by the following formula:

[0052]

[0053] When the Hamming weight of C is an odd number, C LorR =C L , C L It is the first half of C;

[0054] When the Hamming weight of C is even, C LorR =C R , C R It is the second half of C.

[0055] Optionally, the electronic tag updates the pseudo-random identity of the electronic tag through the ultra-lightweight transformation function based on the preset Hamming weight of the pseudo-random identity of the electronic tag, the preset shared key, and the verification request message of the reader and the electronic tag, including:

[0056] The electronic tag calculates the key update verification message D based on the updated shared key through an ultra-lightweight transformation function * :

[0057]

[0058] Compare D* with the received key update message D to see if they are equal. If D*=D, then update the pseudo-random identity of the tag based on the reader verification request message and the electronic tag verification request message:

[0059]

[0060] Among them, PID newPseudo-random identity of the electronic tag after update, B' LorR Indicates the other half of the reader verification request message that the reader has not sent out, C' LorR Indicates the other half of the electronic tag verification request message that has not been sent out.

[0061] In a second aspect, an embodiment of the present application provides an RFID system, including: a server, a reader / writer, and an electronic tag;

[0062] The reader / writer and the electronic tag are used to execute the two-way authentication method as described in any one of the first aspects above.

[0063] (III) Beneficial effects

[0064] The beneficial effects of the present invention are as follows: the present application proposes a two-way authentication method and an RFID system for an RFID system, wherein the method comprises: a reader sends a security authentication request to a tag; the tag sends a tag pseudo-random identity to the reader; the reader generates a reader verification request message based on the Hamming weight of the identity and a preset shared key through an ultra-lightweight transformation function and sends it to the tag; the tag generates an electronic tag verification request message based on the Hamming weight of the identity and a preset shared key through an ultra-lightweight transformation function and sends it to the reader; the reader and the tag update the shared key and the electronic tag pseudo-random identity through an ultra-lightweight transformation function based on the Hamming weight of the identity, the preset shared key, and the verification request message of the reader and the tag. The method improves the security of the Internet of Things RFID system and can resist desynchronization attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 A schematic diagram of an application scenario of a two-way authentication method for an RFID system is shown;

[0067] Figure 2 A schematic diagram of a two-way authentication method for an RFID system provided in an embodiment of the present application is shown;

[0068] Figure 3 A schematic diagram of a two-way authentication process between a tag and a reader in another embodiment of the present application is shown;

[0069] Figure 4A structural block diagram of an RFID system provided by yet another embodiment of the present application is shown. DETAILED DESCRIPTION

[0070] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below through specific implementation modes in conjunction with the accompanying drawings.

[0071] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0072] Figure 1 The bidirectional authentication method of the RFID system is shown in the following application scenario diagram. The bidirectional authentication method of the RFID system provided in this application can be applied to Figure 1 In the passive RFID system shown in FIG. Figure 1 As shown, the passive RFID system includes an electronic tag (Tag), a reader (Reader) and a background server (Server). The electronic tag exchanges data with the reader through radio waves. The reader can transmit the read and write commands of the background server to the electronic tag, and then transmit the data returned by the electronic tag to the server. The data exchange and management system in the server is responsible for completing the storage, management and control of the electronic tag data information. Among them, the electronic tag is a passive electronic tag, which receives the microwave signal transmitted by the reader and obtains energy through the electromagnetic induction coil to temporarily power itself, thereby completing this information exchange. Because the power supply system is omitted, the volume of the passive RFID product can reach the centimeter level or even smaller, and the structure itself is simple, the cost is low, the failure rate is low, and the service life is long. In this application, it is assumed that the channel between the reader and the background server is a secure channel, and the channel between the tag and the reader is an unsecure channel. Therefore, this application proposes a two-way authentication method for an RFID system for the exchange of security authentication information between the reader and the electronic tag.

[0073] Embodiment 1

[0074] This embodiment provides a two-way authentication method for an RFID system, which is applied to the RFID system. The preset parameters of the reader and the electronic tag of the RFID system include the pseudo-random identity identifier and the shared key of the electronic tag to be authenticated. Figure 2 , Figure 2 A schematic diagram of a two-way authentication method for an RFID system provided in an embodiment of the present application is shown. Figure 2 As shown, the two-way authentication method includes:

[0075] S10, the reader sends a security authentication request to the electronic tag;

[0076] S20, the electronic tag responds to the security authentication request and sends the electronic tag pseudo-random identity to the reader;

[0077] S30, the reader verifies the received pseudo-random identity of the electronic tag, and after the verification passes, generates a reader verification request message through an ultra-lightweight transformation function based on the Hamming weight of the pseudo-random identity of the electronic tag and a preset shared key, and sends the message to the tag;

[0078] S40, the electronic tag verifies the legitimacy of the reader verification request message based on the Hamming weight of the preset electronic tag pseudo-random identity and the shared key, and after the verification is passed, generates an electronic tag verification request message through an ultra-lightweight transformation function and sends it to the reader;

[0079] S50, the reader / writer performs a legitimacy verification on the electronic tag verification request message;

[0080] S60: After the verification is passed, the reader and the electronic tag respectively update the shared key and the electronic tag pseudo-random identity through an ultra-lightweight transformation function based on the Hamming weight of the preset electronic tag pseudo-random identity, the preset shared key, and the verification request message of the reader and the electronic tag.

[0081] The two-way authentication method of this embodiment ensures information security and confidentiality by adopting an ultra-lightweight transformation function, and uses new and old pseudo-random identity identifiers and shared keys to resist desynchronization attacks. It is suitable for resource-constrained IoT RFID systems and ensures the secure acquisition, transmission and access of data in the IoT system.

[0082] In order to better understand the present invention, the ultra-lightweight transformation function in this embodiment is described below.

[0083] The definition of the ultra-lightweight transformation function in this embodiment is as follows:

[0084] For two strings P and Q of the same length n bits:

[0085] P=p n p n-1 …p2p1∈{0,1},i=1,2,…,n (1)

[0086] Q=q n q n-1 …q2q1∈{0,1},i=1,2,…,n (2)

[0087] Step 1: Grouping. Based on the randomness of the Hamming weight and the preset grouping size threshold, the strings P and Q are grouped. Taking string P as an example, if the Hamming weight of P is wt(P) = m, and the grouping size threshold is T, then two subgroups P2 = p are generated after the first grouping. n p n-1 …p m+2 p m+1 and P1 = p m p m-1 …p2p1. Then, the length of each sub-group is compared with T. If the length of the sub-group is greater than T, the sub-groups are grouped according to their Hamming weights until the threshold condition is met, and the grouping is completed.

[0088] Step 2: Rearrange. Exchange the grouping of the two strings P and Q, and perform a circular left shift based on the Hamming weight on the subgroups of the two strings after the exchange of grouping. Assume that the strings P and Q have been decomposed into l and k subgroups, that is, P l ,l=1,2,3,…,;l<n and Q k ,k=1,2,3,…,;k<n. Then after switching groups, they are P k and Q l , and then cyclically shift each subgroup of the two strings to the left based on the Hamming weight to obtain the rearranged strings P' and Q'.

[0089] Step 3: Combination. Perform the following operation on the two rearranged strings P' and Q'. Take the number of even bits in string P' from low to high, and write them into the odd bits of the output string in order from high to low. Then, take the number of odd bits in string Q' from high to low, and write them into the even bits of the output string in order from low to high. After that, combine the remaining bits of strings P' and Q' into a new string Z, as shown in the following formula:

[0090] Z=z n z n-1 …z2z1=P'1Q'2P'3Q'4…P' 2r-1 Q' 2r ,z i ∈{0,1},i=1,2,…,n (3)

[0091] Finally, perform an XOR operation with the previously arranged string, and use the output string as the output of the final transformation, as shown in the following formula:

[0092]

[0093] The ultra-lightweight transformation function LTH(*,*) has the following characteristics:

[0094] Irreversibility: The two inputs P and Q of the LTH(*,*) transformation are confused with each other, and the confusion factor depends not only on the Hamming weight of the two input strings, but also on the position and Boolean value of each input bit of the other party in the string. Therefore, it is possible to truly achieve the effect of knowing only one of the inputs and the corresponding output, and being unable to recover the other input.

[0095] Sensitivity: As long as the value of any bit in the two inputs changes, the output of the corresponding transformation will change completely. In other words, the output of the transformation operation is very sensitive to the input, and each bit of the two inputs will have a critical impact on the output.

[0096] Complete obfuscation: Each input string is completely obfuscated by another input, and there are no fixed points or points that can be predicted in advance. Therefore, an attacker cannot obtain the actual value of any bit of any input from the output of LTH(*,*).

[0097] Low complexity: Only Hamming weight-based circular shift and XOR operations are used in this transform, so it can be easily used in low-cost passive RFID tags.

[0098] Embodiment 2

[0099] The embodiment provides a two-way authentication method for an RFID system, the method comprising:

[0100] S1. Electronic tag initialization

[0101] The specific process of the electronic tag initialization phase is as follows:

[0102] S11, the reader reads the unique identifier UID (Unique Identity) of the electronic tag and transmits it to the backend server, and the backend server generates a pseudo-random identity identifier PID of the electronic tag according to the UID:

[0103] PID=h(UID||R1)

[0104] Among them, h() represents a one-way hash function, R1 represents the first random number, and || represents a join operation.

[0105] S12, the backend server randomly generates a shared key K between the electronic tag and the reader;

[0106] S13, the backend server stores the PID and K of the electronic tag and sends a copy to the reader;

[0107] S14, after receiving the PID and K sent by the background server, the reader stores them in the memory and sends a copy to the electronic tag;

[0108] S15. The electronic tag stores the received PID and K in a memory.

[0109] S2. Two-way authentication between tag and reader

[0110] Figure 3 FIG. 1 shows a schematic diagram of a two-way authentication process between a tag and a reader in another embodiment of the present application. Figure 3 As shown in the figure, the two-way authentication process includes:

[0111] S21, the reader sends a "Hello" message to the tag to initiate a security authentication request;

[0112] S22, after receiving the authentication request sent by the reader, the electronic tag sends the electronic tag pseudo-random identity identifier PID;

[0113] S23, the reader receives the PID returned by the electronic tag and verifies the PID; after the verification is passed, based on the Hamming weight of the PID and the shared key, an ultra-lightweight transformation function is used to generate a verification request message of the reader and send it to the electronic tag.

[0114] Specifically, after receiving the PID returned from the electronic tag, the reader uses the PID to search in the background database whether there is a corresponding record.

[0115] If PID=PID old , the reader reads the corresponding K old Perform the next authentication operation; if PID = PID new , the reader uses K new To complete the subsequent identification operation; if there is no record matching the PID in the background database, the authentication operation is terminated.

[0116] Once the reader / writer retrieves the corresponding storage record through PID, it extracts the corresponding K and generates a second random number R2.

[0117] After verification, the verification message is generated based on the Hamming weight of the PID and the shared key through an ultra-lightweight transformation function, including:

[0118] S231 . Generate a first character string and a second character string based on the Hamming weight of the PID and a shared key.

[0119] Specifically, if the Hamming weight of the PID is an odd number, the first half of the shared key K is selected L As the first string K LorR , select the second half of the shared key K R As the second string K' LorR ; If it is an even number, select the second half of the shared key K R As the first string KLorR , select the first half of the shared key K L As the second string K' LorR .

[0120] S232: Generate a verification request message based on the first character string and the second character string by using an ultra-lightweight transformation function.

[0121] Specifically, the first verification request message A of the reader is generated according to the first character string, the second character string and the second random number by the following formula:

[0122]

[0123] Among them, LTH(*,*) is an ultra-lightweight transformation function. It is an XOR operation.

[0124] The second verification request message B of the reader is generated by the following formula:

[0125]

[0126] Among them, Rot(*,*) represents a circular left shift based on the Hamming weight.

[0127] It should be noted that Rot(*,*) may also be a circular right shift based on the Hamming weight, which is not specifically limited in this embodiment.

[0128] Generate the verification request message A||B of the reader / writer based on the first verification request message, the second verification request message, and the Hamming weight of the second verification request message LorR ,in:

[0129] When the Hamming weight of B is odd, A||B LorR =A||B L , B L It is the first half of B;

[0130] When the Hamming weight of B is even, A||B LorR =A||B R , B R It is the second half of B.

[0131] S24, the electronic tag verifies the legitimacy of the verification request message of the reader based on the Hamming weight and shared key of the preset electronic tag pseudo-random identity identifier; after the verification is passed, based on the Hamming weight and shared key of the PID, the verification request message of the electronic tag is generated through an ultra-lightweight transformation function and sent to the reader.

[0132] Specifically, the electronic tag receives message A||B from the reader LorRAfter that, the second random number R2 to be verified is calculated based on the Hamming weight of PID * :

[0133]

[0134] It should be noted that K LorR ,K' LorR It is calculated by the electronic tag based on the Hamming weight of the PID and the shared key. The specific method is the same as that in S231 and will not be described in detail here.

[0135] Calculate the second verification message B using the extracted second random number to be verified * ,

[0136]

[0137] Then compare B * LorR With the received B LorR Are they equal? * LorR =B LorR , the tag verifies that the reader's identity is legitimate.

[0138] After the verification is passed, the verification request message C of the electronic tag is generated LorR :

[0139] C is calculated by the following formula:

[0140]

[0141] When the Hamming weight of C is an odd number, C LorR =C L , C L It is the first half of C;

[0142] When the Hamming weight of C is even, C LorR =C R , C R It is the second half of C.

[0143] Finally, the electronic tag sends a verification request message C LorR to the reader / writer.

[0144] S25. The reader / writer performs legitimacy verification on the verification request message of the electronic tag based on the first character string and the second character string. After the verification is passed, the shared key is updated through an ultra-lightweight transformation function based on the first character string, the second character string and the second random number, and the pseudo-random identity of the electronic tag is updated through an ultra-lightweight transformation function based on the verification request message of the reader / writer and the electronic tag and the second random number.

[0145] The reader receives the verification request message C sent by the electronic tag. LorR First, the verification message C of the electronic tag is calculated based on the Hamming weight of the PID and the second random number. * LorR :

[0146]

[0147] Comparison C * LorR With the received C LorR Are they equal?

[0148] If C * LorR =C LorR , the reader verifies the tag's identity is legal;

[0149] Otherwise, the reader verifies that the tag's identity is illegal.

[0150] Afterwards, the shared key is updated according to the following formula:

[0151]

[0152]

[0153]

[0154] Among them, K new The updated shared secret key.

[0155] Update the pseudo-random identity of the electronic tag according to the following formula:

[0156]

[0157] Among them, PID new Represents the pseudo-random identity of the updated electronic tag, B' LorR Indicates the verification request message of the other half of the reader / writer that was not sent out by the reader / writer in step S23, C' LorR Indicates the verification request message of the other half of the electronic tags that was not sent out by the electronic tags in step S24.

[0158] Based on the updated shared key, the pseudo-random identity of the electronic tag, and the second random number, a key update message is generated through an ultra-lightweight transformation function and sent to the electronic tag:

[0159]

[0160] Finally, assign the shared key and pseudo-random identity before the update to K respectively. old and PIDold , assign the updated shared key and pseudo-random identity to K new and PID new .

[0161] S26, the electronic tag receives the key update message D, updates the shared key in the same way as the reader, and calculates the key update verification message D based on the updated shared key through an ultra-lightweight transformation function * :

[0162]

[0163] Then compare D* with the received D to see if they are equal. If D*=D, then update the pseudo-random identity of the tag based on the verification request message of the reader and the verification request message of the electronic tag:

[0164]

[0165] Among them, PID new The pseudo-random identity of the electronic tag after it is updated.

[0166] Finally, the updated shared key and pseudo-random identity are assigned to K and PID respectively.

[0167] The bidirectional authentication method of the RFID system in this embodiment can be used as a bidirectional authentication method between an electronic tag and a reader in an ultra-lightweight authentication protocol for industrial Internet of Things RFID, meeting the functionality and security required by RFID. The specific effects are as follows:

[0168] (a) Two-way authentication security

[0169] In this embodiment, the label is compared with the locally calculated B' LorR And the verification message B sent by the reader LorR To verify the legitimacy of the reader. After the tag verifies the legitimacy of the reader, it also calculates the verification message C LorR And sent to the reader, the reader verifies C LorR The legitimacy of the tag identity is determined by the correctness of the message B. LorR , or the message C that proves the legal identity of the tag LorR , are calculated from the shared key K and the second random number R2 (extracted using the shared secret information and exchanged information) between the reader and the tag, so attackers cannot pass the identity authentication protocol without the shared key. In other words, only legitimate readers and tags can pass the mutual identity authentication, which improves the security of identity authentication.

[0170] (b) Confidentiality

[0171] First, during the identity authentication process between the reader and the tag, the verification information A and B transmitted in the insecure channel LorR and C LorR They are all calculated from shared secret information. Secondly, the random number R2 and the real ID of the tag are protected or hidden by the shared key, and attackers (or illegal third parties) cannot easily recover or obtain them. Thirdly, the shared key K used to calculate or protect the above information is protected by the security transformation LTH(*,*) designed above during use, and the LTH(*,*) transformation has many security features mentioned above. Therefore, during the two-way authentication process, the verification message transmitted in the insecure wireless channel will only be recognized by the legitimate tag or reader. The attacker cannot forge and identify the above messages without the key, and the secret information contained in these messages cannot be easily recovered and obtained.

[0172] (c) Integrity

[0173] In this embodiment, the verification request message B LorR and C LorR It not only provides a credential for the two-way authentication between the reader and the tag, but also ensures the integrity of the exchanged information. For example, when an attacker attempts to change the value of the random number R2 by modifying certain bits of message A, the changed random number R2 will inevitably cause the local B' calculated by the tag to be LorR With the received B LorR Different, which eventually leads to authentication failure.

[0174] (d) Forward security

[0175] Forward security means that if the master key used for a long time at a certain moment is leaked, it will not lead to the leakage of secret information before that moment (any time in the past). In this embodiment, after each round of successful identification, both communicating parties will use random numbers to update the pseudo-random identity PID and the shared key K, and the random numbers used in each round of the protocol are transmitted confidentially. Even if the tag is captured or its own key is exposed at a certain moment, the attacker still cannot obtain any secret information of the tag and the reader before. Therefore, this protocol can well guarantee the forward security of the tag and the reader.

[0176] (e) Anti-replay attack

[0177] In this embodiment, at the initial stage of each round of the authentication protocol, the reader will generate a new random number, which is shared confidentially and cannot be obtained by an attacker through eavesdropping. When an attacker pretends to be a legitimate tag to deceive the reader, since the fresh random number R2 used for this authentication cannot be obtained, all old replayed messages will become illegal messages; when an attacker pretends to be a legitimate reader to deceive the tag, the replayed old reader message will not affect the tag either, because the key in the replayed old message does not match the updated key of the tag, and therefore cannot pass the tag authentication, thereby effectively preventing the attacker from using past messages to pretend to be a legitimate tag or reader to pass the other party's authentication.

[0178] (f) Anti-desynchronization attack

[0179] The method of this embodiment can well ensure the data integrity of the verification message and the synchronization of the secret information of the communicating parties, and resist desynchronization attacks.

[0180] (g) Anti-traceability attack

[0181] In addition to security authentication, another important security indicator of the RFID system is privacy. Privacy issues include tag tracking and information leakage. The protection of RFID tags from illegal tracking is an important factor to be considered to ensure RFID security. In each security authentication process, the pseudo-random identity identifier PID and shared key K of the tag are dynamically updated after each authentication, and there is no biased output in the security operations used in the entire protocol, so it can effectively resist location tracking and tracing attacks.

[0182] (h) Anti-information leakage attack

[0183] The transformation operation LTH(*,*) adopted by the method of this embodiment greatly improves the cryptographic characteristics of the information passing through the operation with its sensitive and completely obfuscated characteristics. The irreversible characteristics make it difficult for an attacker to guess the other input even if he obtains the output of the LTH(*,*) transformation and one of the inputs. In addition, the transmitted messages are hidden in at least two or more secret information and combined with other security operations. Therefore, it is difficult for an attacker to obtain any secret information in the protocol through existing attack methods.

[0184] Embodiment 3

[0185] See also Figure 4 , Figure 4 FIG. 2 shows a structural block diagram of an RFID system provided by another embodiment of the present application. Figure 4As shown, the RFID system may include a server 100, a reader / writer 200, and an electronic tag 300, wherein the reader / writer 200 and the electronic tag 100 are used to perform a two-way authentication method according to any of the above embodiments for two-way authentication.

[0186] Understandably, Figure 4 The structure shown is for illustration only. The RFID system may also include Figure 4 More or fewer components as shown, or with Figure 4 Different configurations are shown. Figure 4 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0187] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method, and will not be elaborated here.

[0188] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0189] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0190] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0191] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0192] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0193] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A two-way authentication method for an RFID system, characterized in that: The preset parameters of the reader / writer and the electronic tag of the RFID system both include the pseudo-random identity of the electronic tag to be authenticated and a shared key. The method includes: The reader / writer sends a security authentication request to the electronic tag; The electronic tag sends the pseudo-random identity of the electronic tag to the reader / writer in response to the security authentication request; The reader verifies the received pseudo-random identity of the electronic tag, and after the verification is passed, generates a reader verification request message through an ultra-lightweight transformation function based on the Hamming weight of the pseudo-random identity of the electronic tag and a preset shared key, and sends the message to the tag; The electronic tag verifies the legitimacy of the reader verification request message based on the Hamming weight of the preset electronic tag pseudo-random identity and the shared key, and after the verification is passed, generates an electronic tag verification request message through an ultra-lightweight transformation function and sends it to the reader; The reader / writer performs a legitimacy verification on the electronic tag verification request message; After the verification is passed, the reader and the electronic tag respectively update the shared key and the electronic tag pseudo-random identity through the ultra-lightweight transformation function based on the Hamming weight of the preset electronic tag pseudo-random identity, the preset shared key, and the verification request message of the reader and the electronic tag; The ultra-lightweight transformation function is defined as: For two strings P and Q of the same length of n bits, the strings P and Q are grouped based on the Hamming weights of the strings P and Q and a preset grouping size threshold; The grouping of the two strings P and Q is exchanged, and the subgroups of the two strings after the exchange of grouping are circularly shifted left based on the Hamming weight to obtain the rearranged strings P' and Q'; The following operations are performed on the two rearranged strings P' and Q': the number of even bits in the string P' is taken from low to high, and they are written into the odd bits of the output string in a high to low manner; the number of odd bits in the string Q' is taken from high to low, and they are written into the even bits of the output string in a low to high manner to obtain the first combined string; the remaining bits of the strings P' and Q' are combined in sequence to form the second combined string Z, which is expressed as follows: Z=z n z n-1 …z2z1=P1’Q’2P’3Q’4…P’ 2r-1 Q’ 2r ,z i ∈{0,1},i=1,2,…,n An XOR operation is performed on the first combined character string and the second combined character string Z, and the obtained character string is used as the output of the ultra-lightweight transformation function.

2. The two-way authentication method of the RFID system according to claim 1, characterized in that: Before the reader sends a security authentication request to the electronic tag, the method further includes: The reader / writer reads the unique identifier of the electronic tag and sends it to the backend server; The backend server generates a pseudo-random identity of the electronic tag based on the unique identifier of the electronic tag, and randomly generates a shared key between the electronic tag and the reader; The backend server stores and sends the shared key and the pseudo-random identity of the electronic tag to the reader / writer; The reader receives and stores the shared key and the pseudo-random identity of the electronic tag, and sends the shared key and the pseudo-random identity of the electronic tag to the electronic tag; The electronic tag receives and stores the shared key and the electronic tag pseudo-random identity.

3. The two-way authentication method of the RFID system according to claim 1, characterized in that: Based on the Hamming weight of the pseudo-random identity of the electronic tag and the preset shared key, the reader verification request message is generated through an ultra-lightweight transformation function, including: S231, the reader generates a second random number, and generates a first character string and a second character string based on the Hamming weight of the pseudo-random identity of the electronic tag and the shared key, including the following steps: When the Hamming weight is an odd number, the first half of the shared key K L As the first string K LorR , the second half of the shared key K R As the second string K' LorR ; When the Hamming weight is an even number, the second half of the shared key K R As the first string K LorR , the first half of the shared key K L As the second string K' LorR ; S232: Based on the first character string and the second character string, generate the reader / writer verification request message through the ultra-lightweight transformation function.

4. The two-way authentication method of the RFID system according to claim 3, characterized in that: Step S232 includes: The first verification request message A and the second verification request message B of the reader / writer are generated according to the first character string, the second character string and the second random number by the following formula: Among them, LTH(*,*) is an ultra-lightweight transformation function. is an XOR operation, Rot(*,*) represents a circular left shift based on the Hamming weight, R2 is the second random number, K LorR is the first string, K' LorR For the second string; The reader-writer verification request message A||B is generated based on the first verification request message, the second verification request message and the Hamming weight of the second verification request message LorR ,in: When the Hamming weight of B is odd, A||B LorR =A||B L , B L It is the first half of B; When the Hamming weight of B is even, A||B LorR =A||B R , B R It is the second half of B.

5. The two-way authentication method of the RFID system according to claim 4, characterized in that: The reader / writer updates the shared key and the pseudo-random identity of the electronic tag through the ultra-lightweight transformation function based on the preset Hamming weight of the pseudo-random identity of the electronic tag, the preset shared key, and the verification request message of the reader / writer and the electronic tag, including: Based on the first character string, the second character string and the second random number, the shared key is updated by the ultra-lightweight transformation function, and the formula is as follows: Among them, K new Updated shared key; Based on the verification request message of the reader / writer and the electronic tag and the second random number, the pseudo-random identity of the electronic tag is updated by the ultra-lightweight transformation function; Among them, PID new represents the pseudo-random identity of the updated electronic tag, B' LorR Indicates the other half of the reader verification request message that the reader has not sent out, C' LorR Indicates the other half of the electronic tag verification request message that has not been sent out.

6. The two-way authentication method of the RFID system according to claim 1, characterized in that: The electronic tag generates an electronic tag verification request message based on the Hamming weight of the preset electronic tag pseudo-random identity and the shared key through an ultra-lightweight transformation function and sends it to the reader / writer, including: C is calculated by the following formula: When the Hamming weight of C is an odd number, C LorR =C L , C L It is the first half of C; When the Hamming weight of C is even, C LorR =C R , C R It is the second half of C.

7. The two-way authentication method of the RFID system according to claim 1, characterized in that: The electronic tag updates the pseudo-random identity of the electronic tag through the ultra-lightweight transformation function based on the preset Hamming weight of the pseudo-random identity of the electronic tag, the preset shared key, and the verification request message of the reader and the electronic tag, including: The electronic tag calculates the key update verification message D based on the updated shared key through an ultra-lightweight transformation function * : Compare D* with the received key update message D to see if they are equal. If D*=D, then update the pseudo-random identity of the tag based on the reader verification request message and the electronic tag verification request message: Among them, PID new Pseudo-random identity of the electronic tag after update, B' LorR Indicates the other half of the reader verification request message that the reader has not sent out, C' LorR Indicates the other half of the electronic tag verification request message that has not been sent out.

8. An RFID system, characterized in that: include: Server, reader / writer, electronic tag; The reader / writer and the electronic tag are used to execute the two-way authentication method described in any one of claims 1-7.

Images