Method for extending RFID authentication protocol to generate contextual information verification credentials

Abstract

The present invention provides a method for extending the RFID authentication protocol to generate context information verification credentials, comprising the following steps: Step 1, selecting an existing RFID two-way authentication system RS based on a symmetric key; Step 2, setting an additional electronic tag shared key K' Tm , assign electronic label T m and the key pair of the reader R; step 3, expand the original two-way authentication protocol of the electronic tag and the reader to generate a verification certificate; step 4, save the context information, the verification certificate and the key; step 5, verify whether the context information has been modified through the verification certificate. While completing the two-way authentication, the present invention can generate a certificate related to the context information, and can verify whether the context information has been modified through the certificate, so as to ensure the integrity and authenticity of the context information mutually authenticated by the electronic tag and the reader.

Description

Technical Field

[0001] The invention relates to a method for extending an RFID authentication protocol to generate a context information verification credential, and belongs to the research field of wireless radio frequency identification (RFID). Background Art

[0002] Radio-frequency identification (RFID) is a technology that uses radio waves to identify objects. The RFID system consists of electronic tags, readers and back-end databases. Electronic tags are chips with storage functions that store the ID of objects. Readers and writers read the tag IDs by interacting with electronic tags. The back-end database stores the specific information of objects, and the tag IDs obtained by the reader and writer generate corresponding RFID events. Usually, each time a reader and writer reads an electronic tag, an RFID event is generated. For example, the access control system generates and saves an access record after an employee swipes his card to enter the door.

[0003] When electronic tags send their IDs directly to readers, it will cause security risks and privacy leakage. Attackers can track electronic tags by monitoring the wireless communication between readers and tags, or they can forge tags by monitoring the IDs. Researchers have proposed a large number of privacy-protected RFID mutual authentication protocols based on symmetric keys. In these protocols, the reader and each electronic tag share an independent key. The protocol usually includes three rounds: (1) the reader sends a challenge c (usually a random number) to the electronic tag; (2) the electronic tag uses the shared key k and challenge c to calculate a response r and returns it to the reader; (3) the reader authenticates the electronic tag by verifying r. Only by knowing the key k can the correct response r be calculated. If r is correct, the reader uses the shared key k, challenge c, and the tag's response r to calculate a value F and returns it to the electronic tag. The electronic tag authenticates the reader by verifying F.

[0004] Existing RFID two-way authentication protocols based on symmetric keys with privacy protection cannot guarantee the authenticity of RFID events. In RFID systems, two-way authentication and event generation are usually independent modules, and dishonest administrators or hackers can directly modify RFID events or insert fabricated events. Summary of the invention

[0005] The present invention provides a method for extending an RFID authentication protocol to generate a context information verification credential, which can verify whether the context information is modified through the verification credential.

[0006] In order to solve the above technical problems, the present invention provides a method for extending the RFID authentication protocol to generate context information verification credentials, comprising the following steps: Step 1, selecting an existing RFID two-way authentication system RS based on a symmetric key: RS includes a reader / writer R, L electronic tags T m And a two-way authentication protocol π R,Tm ; Where 1≤m≤L, the two-way authentication protocol π R,Tm It is a 2γ+1 round RFID mutual authentication protocol based on symmetric key with privacy protection, γ is a positive integer, and each electronic tag T m A shared key K is assigned to the reader R. Tm , the security parameter of RS is κ, κ is a positive integer, and κ represents the ability of RS to resist attacks; Step 2, set an additional electronic tag shared key K' Tm , assign electronic label T m and a key pair of the reader / writer R: The key pair includes a public key and a private key. m Add one l k Additional electronic tag shared key K' Tm , each electronic tag T m Each is assigned a key pair (PK Tm ,sk Tm ), the reader R assigns a key pair (PK R ,sk R ),in l k is the bit length of the polynomial function output determined by the security parameter κ of RS; Step 3, expand the original two-way authentication protocol of the electronic tag and the reader to enable it to generate a verification certificate: based on the two-way authentication protocol π R,Tm , introduce electronic tag T m Contextual information info Tm and context information of the reader R info R As input, execute the electronic tag T m Two-way authentication with reader R, and output of derived key K S and info Tm and info R The verification credential cred is used to construct a 2γ+3-round RFID two-way authentication protocol π * R,Tm , info Tm and info R The bit length does not exceedl k bit, in the RFID two-way authentication protocol π * R,Tm In the execution process of , a pseudo-random string generation function G, a digital signature function S, a cryptographic hash function H, and a signature verification function V are introduced, where G is a pseudo-random string generation function with two input parameters to generate a pseudo-random string; S is a digital signature function in which the private key owner signs a message with his private key to output the digital signature of the private key owner on the message; H is a function that maps an input of any bit length to a bit length of l k The cryptographic hash function of the hash value of the public key is used to verify the signature of a digital signature. V is a signature verification function that verifies a digital signature using a public key and a message. If the digital signature is the digital signature of the public key on the message, it outputs true, otherwise it outputs false. Step 4: Save the context information, verification credentials and key: Save the electronic tag T m Contextual information info Tm , context information of reader R info R , verification credential, electronic tag T m The public key PK Tm , the public key PK of the reader R R and the derived key K S ; Step 5: Verify whether the context information has been modified by verifying the credentials: Verify the context information of the electronic tag in the acquired information info * Tm and context information of the reader / writer info * R Whether it is the context information of the electronic tag generated by steps 1 to 3 and saved by step 4 info Tm and context information of the reader / writer info R .

[0007] In a specific implementation, step 3 specifically includes the following steps: 3.1. Reader / writer R and electronic tag T m According to the two-way authentication protocol π R,Tm After completing 2γ rounds of information exchange, the reader R calculates the last round of message C γ+1 , but not sent; 3.2, the reader R will C γ+1 Message and encrypted reader / writer R's context information E R Combine to get C * γ+1 =(C γ+1 , E R), the reader R will C * γ+1 Send to electronic tag T m , K S and E R Calculated by the following formula: , ,in, c 1 || α 1 ||…|| c γ+1 To run π R,Tm The concatenation of the generated 2γ+1 rounds of messages; K S The pseudo-random string is generated by the function G with the key K' Tm Time based on c 1 || α 1 ||…|| c γ+1 The pseudo-random string generated is K S As a derived key; G Ks ('r') is to use a derived key K S The character 'r' is a pseudo-random string generated by a pseudo-random string generation function G, || represents the concatenation of the previous and next strings, and ⊕ represents an XOR operation; 3.3. Electronic tag T m Receive C * γ+1 =(C γ+1 , E R ) After that, the electronic tag T m According to the two-way authentication protocol π R,Tm Algorithm verification C γ+1 Is it correct? If C γ+1 If incorrect, the reader is deemed to be illegal and returns O. * Tm =0,O * Tm Electronic tag T m The return result of executing the protocol; if C γ+1 If it is correct, the protocol will continue to execute, and the electronic tag T m Perform the following calculations:

[0008] ,

[0009] , ,

[0010] and , electronic tag T m Generate message α * γ+1 = (E Tm , σ' Tm ), and sends it to the reader R, returning the execution result O * Tm =1; where G Ks ('I'||T m ) is to use a derived key K S and 'I'||T m The pseudo-random string generated by the pseudo-random string generation function G, E Tm To pass G Ks ('I'||T m )right info Tm The encrypted electronic tag T m The context information, σ Tm Electronic tag T m right info Tm , info R , E R , E Tm The digital signature of the hash value, where the subscript sk of the digital signature function S Tm Electronic tag T m The private key of G Ks ('T'||T m ) is to use a derived key K S and 'T'||T m The pseudo-random string generated by the pseudo-random string generation function G, σ' Tm To pass G Ks ('T'||T m ) for σ Tm 3.4. The reader R generates the verification credential cred, as follows: The reader R receives α * γ+1 = (E Tm , σ' Tm ), calculate ,if , generate a digital signature ,calculate , generate credentials , and returns O * R =1, authentication successful;

[0011] if , then return O * R =0, authentication failed;

[0012] in, It is through the electronic tag T m The public key PK Tm Verification Tm Is it an electronic tag? m right The result of the digital signature, σ R For the reader R info Tm , info R , E R , E Tm The digital signature of the hash value, where the subscript sk of the digital signature function S R is the private key of the reader R, G Ks ('r'||T m ) is to use a derived key K S and 'r'||T m The pseudo-random string generated by the pseudo-random string generation function G, σ' R To pass G Ks ('r'||T m ) for σ R The ciphertext generated after encryption is O * R The result returned by the reader R after executing the protocol.

[0013] In a specific implementation, step 5 specifically includes the following steps: 5.1. Obtaining information, which includes context information of the electronic tag. info * Tm , context information of the reader info * R , the public key PK of the electronic tag Tm * 、Reader's public key PK R * , derive the key K * S , Verify the credential cred * , for cred * Analyze and get h and E' R , E' Tm , σ 1 R , σ1 Tm , where h is the value from cred * The hash value obtained by parsing, E' R For cred * The encrypted reader / writer context information obtained by parsing, E' Tm For cred * The context information of the encrypted electronic tag obtained by parsing, σ 1 R For cred * Parse the ciphertext 1, σ 1 Tm For cred * Parse and get ciphertext 2; 5.2, verify H (K * S ) is equal to h. If not, the verification fails. If they are equal, execute step 5.3. * S ) is the derived key K * S Hash value; 5.3, perform calculations, , ,if info * R == info ' R , info * Tm == info ' Tm , execute step 5.4, otherwise it returns verification failed; info ' R To pass the authentication cred * The context information of the reader / writer is obtained. info ' Tm To pass the authentication cred * The electronic tag context information obtained, where G K * s ('r') is the derived key K * S and 'r' is a pseudo-random string generated by a pseudo-random string generation function G, G K * s ('I'||T m ) is to use the derived key K * S and 'I'||T m The pseudo-random string generated by the pseudo-random string generation function G; 5.4, perform calculations, , ,if

[0014] ,

[0015] , then the verification is passed, otherwise the verification fails and the verification ends. K * s ('r'||T m ) is to use the derived key K * S and 'r'||T m The pseudo-random string generated by the pseudo-random string generation function G, G K * s ('T'||T m ) is to use the derived key K * S and 'T'||T m The pseudo-random string generated by the pseudo-random string generation function G, To use the public key PK Tm * verify Is it an electronic tag pair? The digital signature of To use the public key PK R * verify Is it a reader / writer pair? Digital signature; during the execution of steps 5.2 to 5.4, if the verification fails, the context information of the electronic tag in the information is obtained info * Tm and context information of the reader / writer info * R Context information of electronic tags that are not generated in steps 1 to 3 and saved in step 4 info Tm and context information of the reader / writer info R ; Execute to step 5.4. If the verification is successful, the context information of the electronic tag in the information is obtained. info * Tm and context information of the reader / writer info * R The context information of the electronic tag generated by steps 1 to 3 and saved by step 4 info Tm and context information of the reader / writer info R, that is, the context information of the electronic tag and the context information of the reader / writer in the acquired information are not modified.

[0016] In a specific embodiment, the value of κ is 80, 128 or 256.

[0017] Compared with the prior art, the present invention has the following beneficial effects: Based on the RFID two-way authentication system, the present invention constructs a 2γ+3-round RFID two-way authentication protocol π that introduces context information as input * R,Tm , so that it can generate a verification credential related to the context information while completing the two-way authentication. The verification credential can be used to verify whether the context information has been modified to ensure the integrity and authenticity of the context information. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of a method for extending an RFID authentication protocol to generate a context information verification credential provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The present invention will be described in detail below in conjunction with the embodiments and drawings. It should be noted that the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0020] refer to Figure 1 A method for extending an RFID authentication protocol to generate a context information verification credential comprises the following steps: Step 1: Select an existing RFID bidirectional authentication system RS based on a symmetric key: RS comprises a reader / writer R, L electronic tags T m And a two-way authentication protocol π R,Tm ; Where 1≤m≤L, the two-way authentication protocol π R,Tm It is a 2γ+1 round RFID mutual authentication protocol based on symmetric key with privacy protection, γ is a positive integer, and each electronic tag T m A shared key K is assigned to the reader R. Tm , the security parameter of RS is κ, κ is a positive integer, and κ represents the ability of RS to resist attacks; preferably, the value of κ is 80, 128 or 256, the larger the κ is, the more computing resources RS needs, and the stronger the ability of RS to resist attacks is.

[0021] Step 2: Set up additional electronic tag shared key K' Tm , assign electronic label T m and a key pair of the reader / writer R: The key pair includes a public key and a private key. m Add one l kAdditional electronic tag shared key K' Tm , each electronic tag T m Each is assigned a key pair (PK Tm ,sk Tm ), the reader R assigns a key pair (PK R ,sk R ),in l k It is the bit length of the polynomial function output determined by the security parameter κ of RS.

[0022] Step 3: Expand the original two-way authentication protocol of the electronic tag and the reader to generate a verification certificate: Based on the two-way authentication protocol π R,Tm , introduce electronic tag T m Contextual information info Tm and context information of the reader R info R As input, execute the electronic tag T m Two-way authentication with reader R, and output of derived key K S and info Tm and info R The verification credential cred is used to construct a 2γ+3-round RFID two-way authentication protocol π * R,Tm , info Tm and info R The bit length does not exceed l k bit, in the RFID two-way authentication protocol π * R,Tm In the execution process of , a pseudo-random string generation function G, a digital signature function S, a cryptographic hash function H, and a signature verification function V are introduced, where G is a pseudo-random string generation function with two input parameters to generate a pseudo-random string; S is a digital signature function in which the private key owner signs a message with his private key to output the digital signature of the private key owner on the message; H is a function that maps an input of any bit length to a bit length of l k The cryptographic hash function of the hash value of ; V is a signature verification function that verifies a digital signature using a public key and a message. If the digital signature is the digital signature of the public key on the message, it outputs true, otherwise, it outputs false. Electronic tag T m It can perform calculations of pseudo-random string generation function G, digital signature function S, and cryptographic hash function H.

[0023] Step 4: Save context information, verification credentials, and keys: Save the electronic tag T m Contextual information info Tm , context information of reader R info R , verification credential, electronic tag T m The public key PK Tm , the public key PK of the reader R R and the derived key K S .

[0024] Step 5: Verify whether the context information has been modified by verifying the credentials: Verify the context information of the electronic tag in the acquired information info * Tm and context information of the reader / writer info * R Whether it is the context information of the electronic tag generated by steps 1 to 3 and saved by step 4 info Tm and context information of the reader / writer info R .

[0025] Preferably, step 3 specifically includes the following steps: 3.1. Reader / writer R and electronic tag T m According to the two-way authentication protocol π R,Tm After completing 2γ rounds of information exchange, the reader R calculates the last round of message C γ+1 , but not sent.

[0026] 3.2、Reader R will C γ+1 Message and encrypted reader / writer R's context information E R Combine to get C * γ+1 =(C γ+1 , E R ), the reader R will C * γ+1 Send to electronic tag T m , K S and E R Calculated by the following formula:

[0027] , ,in, c 1 || α 1 ||…|| c γ+1 To run πR,Tm The concatenation of the generated 2γ+1 rounds of messages; K S The pseudo-random string is generated by the function G with the key K' Tm Time based on c 1 || α 1 ||…|| c γ+1 The pseudo-random string generated is K S As a derived key; G Ks ('r') is to use a derived key K S The character 'r' is a pseudo-random string generated by a pseudo-random string generation function G. || represents the concatenation of the previous and next strings, and ⊕ represents an exclusive-OR operation.

[0028] 3.3 Electronic Tag T m Receive C * γ+1 =(C γ+1 , E R ) After that, the electronic tag T m According to the two-way authentication protocol π R,Tm Algorithm verification C γ+1 Is it correct? If C γ+1 If incorrect, the reader is deemed to be illegal and returns O. * Tm =0,O * Tm Electronic tag T m The return result of executing the protocol; if C γ+1 If it is correct, the protocol will continue to execute, and the electronic tag T m Perform the following calculations: , ,

[0029] , and , electronic tag T m Generate message α * γ+1 = (E Tm , σ' Tm ), and sends it to the reader R, returning the execution result O * Tm =1; where G Ks ('I'||T m ) is to use a derived key K S and 'I'||T m The pseudo-random string generated by the pseudo-random string generation function G,E Tm To pass G Ks ('I'||T m )right info Tm The encrypted electronic tag T m The context information, σ Tm Electronic tag T m right info Tm , info R , E R , E Tm The digital signature of the hash value, where the subscript sk of the digital signature function S Tm Electronic tag T m The private key of G Ks ('T'||T m ) is to use a derived key K S and 'T'||T m The pseudo-random string generated by the pseudo-random string generation function G, σ' Tm To pass G Ks ('T'||T m ) for σ Tm The encrypted ciphertext.

[0030] 3.4. Reader R generates a verification credential, as follows: Reader R receives α * γ+1 = (E Tm , σ' Tm ), calculate ,if , generate a digital signature ,calculate , generate credentials , and returns O * R =1, authentication successful; if , then return O * R =0, authentication failed; where, It is through the electronic tag T m The public key PK Tm Verification Tm Is it an electronic tag? m right The result of the digital signature, σ R For the reader R info Tm , info R ,E R , E Tm The digital signature of the hash value, where the subscript sk of the digital signature function S R is the private key of the reader R, G Ks ('r'||T m ) is to use a derived key K S and 'r'||T m The pseudo-random string generated by the pseudo-random string generation function G, σ' R To pass G Ks ('r'||T m ) for σ R The ciphertext generated after encryption is O * R The result returned by the reader R after executing the protocol.

[0031] The hash function H() is deterministic, collision-resistant and unidirectional. Any polynomial-time attacker cannot distinguish the output of a pseudo-random function from the output of a true random function. In a digital signature, the signer uses his private key to generate a signature for a message, and others can verify the signature through the signer's public key. Digital signatures are used to ensure the authenticity, integrity and non-repudiation of the message.

[0032] Preferably, step 5 specifically includes the following steps: 5.1. Obtaining information, which includes context information of the electronic tag. info * Tm , context information of the reader info * R , the public key PK of the electronic tag Tm * 、Reader's public key PK R * , derive the key K * S , Verify the credential cred * , for cred * Analyze and get h and E' R , E' Tm , σ 1 R , σ 1 Tm , where h is the value from cred * The hash value obtained by parsing, E' R For cred * The encrypted reader / writer context information obtained by parsing, E' Tm For cred *The context information of the encrypted electronic tag obtained by parsing, σ 1 R For cred * Parse the ciphertext 1, σ 1 Tm For cred * Parse and get ciphertext 2.

[0033] 5.2. Verify H(K * S ) is equal to h. If not, the verification fails. If they are equal, execute step 5.3. * S ) is the derived key K * S The hash value of .

[0034] 5.3. Perform calculations.

[0035] , ,if info * R == info ' R , info * Tm == info ' Tm , execute step 5.4, otherwise it returns verification failed; info ' R To pass the authentication cred * The context information of the reader / writer is obtained. info ' Tm To pass the authentication cred * The electronic tag context information obtained, where G K * s ('r') is the derived key K * S and 'r' is a pseudo-random string generated by a pseudo-random string generation function G, G K * s ('I'||T m ) is to use the derived key K * S and 'I'||T m A pseudo-random string generated by a pseudo-random string generation function G.

[0036] 5.4. Perform calculations.

[0037] , ,if ,

[0038] , then the verification is passed, otherwise the verification fails and the verification ends. K * s ('r'||T m ) is to use the derived key K * S and 'r'||T m The pseudo-random string generated by the pseudo-random string generation function G, G K * s ('T'||T m ) is to use the derived key K * S and 'T'||T m The pseudo-random string generated by the pseudo-random string generation function G, To use the public key PK Tm * verify Is it an electronic tag pair? The digital signature of To use the public key PK R * verify Is it a reader / writer pair? Digital signature; during the execution of steps 5.2 to 5.4, if the verification fails, the context information of the electronic tag in the information is obtained info * Tm and context information of the reader / writer info * R Context information of electronic tags that are not generated in steps 1 to 3 and saved in step 4 info Tm and context information of the reader / writer info R ; Execute to step 5.4. If the verification is successful, the context information of the electronic tag in the information is obtained. info * Tm and context information of the reader / writer info * R The context information of the electronic tag generated by steps 1 to 3 and saved by step 4 info Tm and context information of the reader / writer info R , that is, the context information of the electronic tag and the context information of the reader / writer in the acquired information are not modified. Example

[0039] The time when Bob swipes the access card is "February 16, 2023 10:00", then the context information of the reader R is info R For "February 16, 2023 10:00", the electronic tag T m Contextual information info Tm is "Bob", and the verification cred generated after the protocol is executed is cred Bob The key required to verify the context information through the verification credential is the public key PK of the electronic tag. Bob 、Reader's public key PK R 0 , derive the key K S 0 .when info R When it is modified to "February 16, 2023 11:06", the value returned after executing step 5.4 must be false, and Bob's record modification will definitely be discovered. Due to the unforgeability of the verification credential, the attacker cannot generate another verification cred' Bob and derive the key K S ', (cred' Bob , K S ')≠(cred Bob , K S 0 ), so that the value returned after executing step 5.4 is true.

[0040] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for extending an RFID authentication protocol to generate a context information verification credential, characterized in that: The following steps are involved: Step 1: Select an existing RFID two-way authentication system RS based on symmetric keys: RS includes a reader R, L electronic tags T m And a two-way authentication protocol π R,Tm ; Where 1≤m≤L, the two-way authentication protocol π R,Tm It is a 2γ+1 round RFID mutual authentication protocol based on symmetric key with privacy protection, γ is a positive integer, and each electronic tag T m A shared key K is assigned to the reader R. Tm , the security parameter of RS is κ, κ is a positive integer, and κ represents the ability of RS to resist attacks; Step 2: Set up additional electronic tag shared key K' Tm , assign electronic label T m and a key pair of the reader / writer R: The key pair includes a public key and a private key. m Add one l k Additional electronic tag shared key K' Tm , each electronic tag T m Each is assigned a key pair (PK Tm ,sk Tm ), the reader / writer R assigns a key pair (PK R ,sk R ),in l k is the bit length of the polynomial function output determined by the security parameter κ of RS; Step 3: Expand the original two-way authentication protocol of the electronic tag and the reader to generate a verification certificate: Based on the two-way authentication protocol π R,Tm , introduce electronic tag T m Contextual information info Tm and context information of the reader R info R As input, execute the electronic tag T m Two-way authentication with reader R, and output of derived key K S and info Tm and info R The verification credential cred is used to construct a 2γ+3-round RFID two-way authentication protocol π * R,Tm , info Tm and info R The bit length does not exceed l k bit, in the RFID two-way authentication protocol π * R,Tm In the execution process of , a pseudo-random string generation function G, a digital signature function S, a cryptographic hash function H, and a signature verification function V are introduced, where G is a pseudo-random string generation function with two input parameters to generate a pseudo-random string; S is a digital signature function in which the private key owner signs a message with his private key to output the digital signature of the private key owner on the message; H is a function that maps an input of any bit length to a bit length of l k The cryptographic hash function of the hash value of the public key is used to verify the signature of a digital signature. V is a signature verification function that verifies a digital signature using a public key and a message. If the digital signature is the digital signature of the public key on the message, it outputs true, otherwise, it outputs false. Step 4: Save context information, verification credentials, and keys: Save the electronic tag T m Contextual information info Tm , context information of reader R info R , verification credential, electronic tag T m The public key PK Tm , the public key PK of the reader R R and the derived key K S ; Step 5: Verify whether the context information has been modified by verifying the credentials: Verify the context information of the electronic tag in the acquired information info * Tm and context information of the reader / writer info * R Whether it is the context information of the electronic tag generated by steps 1 to 3 and saved by step 4 info Tm and context information of the reader / writer info R .

2. The method for extending the RFID authentication protocol to generate context information verification credentials as claimed in claim 1, characterized in that: Step 3 specifically includes the following steps: 3.

1. Reader / writer R and electronic tag T m According to the two-way authentication protocol π R,Tm After completing 2γ rounds of information exchange, the reader R calculates the last round of message C γ+1 , but not sent; 3.2、Reader R will C γ+1 Message and encrypted reader / writer R's context information E R Combine to get C * γ+1 =(C γ+1 , E R ), the reader R will C * γ+1 Send to electronic tag T m , K S and E R Calculated by the following formula: ， ， in, c 1 || α 1 ||…|| c γ+1 To run π R,Tm The concatenation of the generated 2γ+1 rounds of messages; K S The pseudo-random string is generated by the function G with the key K' Tm Time based on c 1 || α 1 ||…|| c γ+1 The pseudo-random string generated is K S As a derived key; G Ks ('r') is to use a derived key K S The character 'r' is a pseudo-random string generated by the pseudo-random string generation function G, || represents the concatenation of the previous and next strings, and ⊕ represents the XOR operation; 3.3 Electronic Tag T m Receive C * γ+1 =(C γ+1 , E R ) After that, the electronic tag T m According to the two-way authentication protocol π R,Tm Algorithm verification C γ+1 Is it correct? If C γ+1 If incorrect, the reader is deemed to be illegal and returns O. * Tm =0,O * Tm Electronic tag T m The return result of executing the protocol; if C γ+1 If it is correct, the protocol will continue to execute, and the electronic tag T m Perform the following calculations: ， ， ， and , Electronic label T m Generate message α * γ+1 = (E Tm , σ' Tm ), and sends it to the reader R, returning the execution result O * Tm =1; where G Ks ('I'||T m ) is to use a derived key K S and 'I'||T m The pseudo-random string generated by the pseudo-random string generation function G, E Tm To pass G Ks ('I'||T m )right info Tm The encrypted electronic tag T m The context information, σ Tm Electronic tag T m right info Tm , info R , E R , E Tm The digital signature of the hash value, where the subscript sk of the digital signature function S Tm Electronic tag T m The private key of G Ks ('T'||T m ) is to use a derived key K S and 'T'||T m The pseudo-random string generated by the pseudo-random string generation function G, σ' Tm To pass G Ks ('T'||T m ) for σ Tm The encrypted ciphertext is obtained; 3.

4. Reader R generates a verification credential, as follows: Reader R receives α * γ+1 = (E Tm , σ' Tm ), calculate , if , Generate a digital signature , calculate , Generate Credentials , and returns O * R =1, authentication successful; if , Return O * R =0, authentication failed; in, It is through the electronic tag T m The public key PK Tm Verification Tm Is it an electronic tag? m right The result of the digital signature, σ R For the reader R info Tm , info R , E R , E Tm The digital signature of the hash value, where the subscript sk of the digital signature function S R is the private key of the reader R, G Ks ('r'||T m ) is to use a derived key K S and 'r'||T m The pseudo-random string generated by the pseudo-random string generation function G, σ' R To pass G Ks ('r'||T m ) for σ R The ciphertext generated after encryption is O * R The result returned by the reader R after executing the protocol.

3. The method for extending the RFID authentication protocol to generate context information verification credentials as claimed in claim 2, characterized in that: Step 5 specifically includes the following steps: 5.

1. Obtain information, including the context information of the electronic tag info * Tm , context information of the reader info * R , the public key PK of the electronic tag Tm * , the reader's public key PK R * , derive the key K * S , Verify the credential cred * , for cred * Analyze and get h and E' R , E' Tm , σ 1 R , σ 1 Tm , where h is the value from cred * The hash value obtained by parsing, E' R From cred * The encrypted reader / writer context information obtained by parsing, E' Tm From cred * The context information of the encrypted electronic tag obtained by parsing, σ 1 R From cred * Parse the ciphertext 1, σ 1 Tm From cred * Parse and get ciphertext 2; 5.

2. Verify H(K * S ) is equal to h. If not, the verification fails. If they are equal, execute step 5.

3. * S ) is the derived key K * S The hash value of 5.

3. Perform calculations. , , if info * R == info ' R , info * Tm == info ' Tm , execute step 5.4, otherwise it returns verification failed; info ' R To pass the verification cred * The context information of the reader / writer is obtained. info ' Tm To pass the verification cred * The electronic tag context information obtained, where G K * s ('r') is the derived key K * S and 'r' is a pseudo-random string generated by a pseudo-random string generation function G, G K * s ('I'||T m ) is to use the derived key K * S and 'I'||T m A pseudo-random string generated by a pseudo-random string generation function G; 5.

4. Perform calculations. ， ， if , ， If the verification fails, the verification ends. Among them, G K * s ('r'||T m ) is to use the derived key K * S and 'r'||T m The pseudo-random string generated by the pseudo-random string generation function G, G K * s ('T'||T m ) is to use the derived key K * S and 'T'||T m The pseudo-random string generated by the pseudo-random string generation function G, To use the public key PK Tm * verify Is it an electronic tag pair? The digital signature of To use the public key PK R * verify Is it a reader / writer pair? Digital signature; During the execution of steps 5.2 to 5.4, if the verification fails, the context information of the electronic tag in the information is obtained. info * Tm and context information of the reader / writer info * R Context information of electronic tags that are not generated in steps 1 to 3 and saved in step 4 info Tm and context information of the reader / writer info R ; Execute to step 5.

4. If the verification is successful, the context information of the electronic tag in the information is obtained. info * Tm and context information of the reader / writer info * R The context information of the electronic tag generated by steps 1 to 3 and saved by step 4 info Tm and context information of the reader / writer info R , that is, the context information of the electronic tag and the context information of the reader / writer in the acquired information are not modified.

4. The method for extending the RFID authentication protocol to generate context information verification credentials as claimed in claim 3, characterized in that: The value of κ is 80, 128 or 256.

Images