A Formal Analysis Method for Verifying the Untraceability of RFID Security Protocols

Abstract

The present application relates to a formal analysis method for verifying the untraceability of RFID security protocols. The method comprises: using process calculus to formally describe messages in RFID security protocols, abstracting the communication behavior in the protocol into an operational mathematical model, and then constructing an attacker's capability model based on an item rewriting system; using a constraint system to symbolically represent the execution trace of the RFID security protocol based on the attacker's capability model, and using the execution trace to define an untraceability standard to evaluate whether the attacker can infer the identity or behavior of a specific tag or user from the execution trace; according to the untraceability standard, converting the problem of verifying untraceability into the problem of determining whether two constraint systems have the same solution, solving the constraint system, and realizing the untraceability analysis of the system based on the solution result. The method can realize fast computer automated verification.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security technology, and in particular to a formal analysis method for verifying the untraceability of RFID security protocols. Background Art

[0002] RFID (Radio Frequency Identification) technology has been widely used in the Internet of Things (IoT) environment, where the popularity and wireless communication capabilities of RFID tags make them easy to track in space and time. However, from the perspective of information security, this traceability has great security risks, which may cause user privacy leakage, data tampering or tracking attacks. For example, in a retail environment, RFID tags may be used to track consumers' shopping habits, and then used for precision marketing or worse surveillance. In order to protect the privacy and security of objects and prevent unauthorized tracking and monitoring, the untraceability of security protocols used in RFID communication scenarios is very important. Therefore, how to verify the untraceability of RFID security protocols has become a key issue. At present, the most systematic and comprehensive technology is formal analysis technology. Formal analysis technology creates a rigorous theoretical model and conducts rigorous mathematical and logical deduction and argumentation on security protocols to prove the security properties of the protocol. Formal analysis technology consists of two parts: formal language and its reasoning system. The formal language uses mathematical methods to accurately describe the behavior of the protocol, and the reasoning system uses rigorous logical or mathematical methods on the basis of the formal language to derive and verify the security properties of the protocol. Process calculus is a formal language description tool used to build a model of a system or protocol to describe its behavior in detail. As a reasoning system, the constraint system can describe in detail the numerous protocol execution paths (execution traces) that may be generated when the security protocol is executed, and convert the security properties of the security protocol into constraints that can be understood and processed by computers. Subsequently, the constraint solving technology is used to check whether the execution path abstracted from the derived constraint system satisfies the specific untraceability constraint conditions, thereby achieving effective verification of the security properties. This process not only avoids the tediousness and error-proneness of manual verification, but also can accurately determine whether the protocol execution path meets specific safety requirements. Therefore, the constraint system has the characteristics of automatic verification and can efficiently and accurately complete the verification of security properties.

[0003] On the one hand, existing technologies mainly focus on verifying the confidentiality and authentication security attributes of RFID security protocols. On the other hand, most of them complete the verification of untraceability through manual derivation, and fail to achieve fast computer automated verification. Summary of the invention

[0004] Based on this, it is necessary to provide a formal analysis method for verifying the untraceability of RFID security protocols that can achieve fast computer automated verification to address the above technical issues.

[0005] A formal analysis method for verifying the untraceability of an RFID security protocol, the method comprising:

[0006] The process calculus is used to formally describe the messages in the RFID security protocol. The communication behavior in the protocol is abstracted into an operational mathematical model, and then the attacker's capability model is constructed according to the item rewriting system. The capability model is used to describe the possible operations of the attacker.

[0007] Based on the attacker's capability model, the constraint system is used to symbolically represent the execution trace of the RFID security protocol, including all possible execution paths of the protocol in normal and attack scenarios;

[0008] Define untraceability criteria using execution traces to assess whether an attacker can infer the identity or behavior of a specific tag or user from the execution traces;

[0009] According to the untraceability standard, the problem of verifying untraceability is transformed into the problem of judging whether two constraint systems have the same solution. The constraint systems are constrained and solved. If there is an intersection in the solution spaces of the two constraint systems, it means that there is at least one solution that satisfies the constraints of both systems at the same time, and the untraceability is verified. If there is no intersection, it means that the two execution traces are distinguishable from the attacker's perspective, that is, the untraceability of the system fails.

[0010] The above-mentioned formal analysis method for verifying the untraceability of RFID security protocols, this application uses process calculus to formally describe protocol messages, uses constraint systems to abstract protocol execution traces, expresses the untraceability attributes of the security protocol as derivable constraints, and verifies whether the security attributes are satisfied through constraint solving. This application has a complete representation of the attacker's knowledge, can verify the untraceability of RFID security protocols containing basic cryptographic primitives, is equally effective when processing the untraceability security attributes of other security protocols, and can use computers to achieve efficient and accurate automatic verification work. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram of a process of a formal analysis method for verifying the untraceability of an RFID security protocol in one embodiment;

[0012] Figure 2 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0014] In one embodiment, Figure 1 As shown, a formal analysis method for verifying the untraceability of RFID security protocols is provided, including the following steps:

[0015] Step 102, using process calculus to formally describe the messages in the RFID security protocol, abstracting the communication behavior in the protocol into an operational mathematical model, and then constructing an attacker's capability model based on the item rewriting system; the capability model is used to describe the operations that the attacker may perform.

[0016] Defining variables: In RFID security protocols, messages may contain various types of data, such as keys, random numbers, identifiers, etc. Variables in process calculus can naturally represent these arbitrary messages or values ​​without specifying their specific types in advance.

[0017] In RFID security protocols, some messages may be predefined or fixed, such as specific key values ​​or protocol identifiers. Names in process calculus are used to represent specific messages or values.

[0018] In RFID security protocols, messages may contain encrypted data, signed data, or other processed data. In order to describe complex message structures, process calculus provides the concept of function. By defining functions, new messages or values ​​can be constructed from known messages or values, thereby conveniently representing these complex message structures.

[0019] In addition to describing the message itself, process calculus can also be used to abstract the communication behavior in the RFID security protocol. By defining the process of sending and receiving messages, the communication behavior in the protocol can be modeled as an operational mathematical model. In this way, each operation of the protocol is converted into an operational mathematical model, which is convenient for subsequent derivation and verification, avoiding the complexity and uncertainty in traditional manual derivation.

[0020] Define item rewriting rules: The rewriting rules of the item rewriting system define how to derive new message items from known message items. When building an attacker capability model, it is necessary to define corresponding rewriting rules based on the attacker's knowledge (such as known keys, messages, etc.) and attack methods (such as decryption, signature forgery, etc.). Simulate the attack process: Use the item rewriting system to simulate how the attacker uses his knowledge and capabilities to construct new message items. By applying the defined rewriting rules, the attacker can derive new message items.

[0021] At the same time, the attacker's capability model is constructed through the item rewriting system, which can describe in detail the possible operations that the attacker may perform in the protocol (such as interception, tampering, forging messages, etc.). The item rewriting system forms a set of inference rules for the attacker's behavior by defining the possible modification behaviors of the attacker on the protocol messages. In this model, the attacker's knowledge is complete, that is, the attacker understands all the communication content and potential operation steps of the protocol. This completeness ensures the breadth and accuracy of the verification, and can simulate any actions that the attacker may take during the attack process.

[0022] Step 104 , based on the attacker's capability model, a constraint system is used to symbolically represent the execution trace of the RFID security protocol, including all possible execution paths of the protocol in normal and attack scenarios.

[0023] In the constraint system, the messages that the attacker may construct at a certain stage of the protocol execution are symbolized as variables. These variables represent various messages that may appear during the protocol execution. At the same time, derivation constraints are defined to represent the relationship between these variables, which may come from the logical structure of the protocol, the message format, or the attacker's capabilities.

[0024] Based on the variables and constraints defined above, a constraint system is constructed to represent the execution trace of the RFID security protocol. This constraint system not only includes all possible paths of the protocol during normal execution, but also considers various attack methods that attackers may take.

[0025] Since the RFID security protocol may have infinite execution traces, the characteristics of the constraint system are used to abstract it into a finite set of derivation constraints. These derivation constraints can cover the behavior of the protocol on all possible execution paths, thus avoiding the direct processing of infinite execution traces, which not only simplifies the analysis process but also improves the efficiency and accuracy of the analysis. By comparing whether two constraint systems satisfy the same derivation constraints, it can be determined whether they are equivalent, thereby further evaluating the security of the protocol.

[0026] Step 106 , using the execution trace to define an untraceability standard to evaluate whether an attacker can infer the identity or behavior of a specific tag or user from the execution trace.

[0027] Define the untraceability standard: First, clarify the concept of untraceability, that is, for all possible execution traces, if the attacker cannot distinguish whether two specific messages come from the same subject, then the system is untraceable. Evaluate untraceability: If there is an execution trace in the system that allows the attacker to accurately determine that two specific messages come from the same subject, then the untraceability of the system is considered invalid, that is, the system is at risk of being attacked.

[0028] Step 108, according to the untraceability standard, the problem of verifying untraceability is transformed into the problem of determining whether two constraint systems have the same solution, and the constraint systems are constrained and solved. If there is an intersection in the solution spaces of the two constraint systems, it indicates that there is at least one solution that satisfies the constraint conditions of both systems at the same time, and the untraceability is verified. If there is no intersection, it indicates that the two execution traces are distinguishable from the attacker's perspective, that is, the untraceability of the system fails.

[0029] Construct constraint system: Construct corresponding constraint systems for each execution trace in the RFID security protocol. These constraint systems consist of a series of variables and derived constraints, which can fully reflect the key information in the protocol execution process. According to the definition of the untraceability standard, the problem of verifying untraceability is transformed into the problem of determining whether two constraint systems C and C' have the same solution. Constraint system C represents a certain execution trace observed by the attacker, while constraint system C' represents a possible alternative execution trace in which two specific messages come from two different subjects. If C and C' have the same solution, that is, there is the same message sequence that satisfies the constraints of the two systems, it means that the attacker cannot distinguish the two execution traces, thus meeting the requirements of untraceability. In the constraint solving process, pay attention to whether the solution spaces of the two constraint systems C and C' have an intersection. If there is an intersection, it means that there is at least one solution that satisfies the constraints of the two systems at the same time, thus verifying the untraceability. If there is no intersection, it means that the two execution traces are distinguishable from the attacker's perspective, that is, the untraceability of the system fails.

[0030] By defining the untraceability criterion, this method evaluates whether an attacker can infer the identity of a tag or user from the execution path of the protocol. The untraceability criterion essentially determines whether the execution path of the protocol allows an attacker to distinguish between different users or tags. The problem of untraceability verification is transformed into a problem of determining whether two constraint systems have the same solution. If the solution spaces of the two constraint systems have an intersection, it means that the protocol cannot distinguish between users or tags from the attacker's perspective, indicating that the protocol satisfies untraceability; if there is no intersection, it means that the attacker can distinguish between users or tags through the execution path of the protocol, and the untraceability of the protocol fails. Through the constraint solving algorithm, the computer can efficiently process complex constraint systems and automatically determine whether the constraints are met. Since the constraint system and the solving algorithm can model and solve the execution path of the protocol in detail, the computer can verify whether the protocol meets the untraceability criterion in a very short time, with a very high degree of automation. This means that users do not need to manually analyze and deduce each execution path of the protocol, and can rely on the computer system to quickly obtain verification results. At the same time, due to the use of formal analysis methods and constraint systems, the entire verification process, from protocol behavior modeling, attacker capability simulation, execution path representation to untraceability verification, is carried out through mathematical models and logical reasoning. This method can eliminate errors in manual analysis and ensure the accuracy of verification. The computer can quickly traverse all possible execution paths and determine whether they meet the untraceability standards, thereby greatly improving verification efficiency. Computer solutions can also further accelerate the verification process through parallel processing and optimization algorithms, especially in complex protocols and large-scale scenarios.

[0031] In the above-mentioned formal analysis method for verifying the untraceability of RFID security protocols, the present application uses process calculus to formally describe protocol messages, uses constraint systems to abstract protocol execution traces, expresses the untraceability property of the security protocol as derivable constraints, and verifies whether the security property is satisfied by constraint solving. The present application has a complete representation of the attacker's knowledge, can verify the untraceability of RFID security protocols containing basic cryptographic primitives, is equally effective when processing the untraceability security properties of other security protocols, and can use computers to achieve efficient and accurate automatic verification work.

[0032] In one embodiment, process calculus is used to formally describe the messages in the RFID security protocol, and the communication behavior in the protocol is abstracted into an operational mathematical model, including:

[0033] The names in the process calculus represent characteristic messages or values ​​and define functions to construct new messages or values ​​from known messages or values ​​to express the message structure; messages include encrypted data, signed data or other processed data; values ​​include specific key values ​​or protocol identifiers; for example, variables are used to represent values ​​of any type, names are used to represent atomic values ​​(keys, random numbers), and functions are used to represent general cryptographic primitives (encryption, decryption, signature);

[0034] By defining the process of sending and receiving messages, the communication behavior in the protocol is modeled as an operational mathematical model.

[0035] In one embodiment, a message structure is expressed by defining a function to construct a new message or value from a known message or value, including:

[0036] Define an infinite set of names N ={ a , b …},in a, b etc. denotes a name, an infinite set of first-order variables X 1 ={ x , y , …},in x , y etc. represent variables, a set of function symbols F , function symbol set F is a set of combinatorial functions F c and decomposition function set F d The union of , the expressions are as follows:

[0037] ;

[0038] in, senc , sdec , aenc , adec , pair , h , project 1 , project 2 They represent symmetric encryption function, symmetric decryption function, asymmetric encryption function, asymmetric decryption function, pairing function, hash function, mapping 1 function, and mapping 2 function respectively. pub Represents a public key;

[0039] The message combination item is recorded as T ( F c , N , X 1), the combination without variables is called the base combination, denoted by T ( F c , N ), the base combination item is used to represent the protocol message.

[0040] In a specific embodiment, a simple process expression of the process calculation is as follows

[0041] ;

[0042] in, Indicates "defined as", the empty process does not do anything, parallel composite process P | Q express P and Q The process operation is performed simultaneously; the name constraint process new n . P Indicates the creation of a new private name n , then execute P Process operation, name n Only in process P Visible in; conditional process if M = N then P else Q First determine the conditions M = N Is it true? If true, execute P process, otherwise execute Q Process. Here M = N Indicates semantic equivalence of terms, rather than simple syntactic equality. The message input process in( x , y ). P Indicates that a message is ready to be input ( x , y ), then execute P Process operation, variables ( x , y ) Only in process P As can be seen in the message output process out( M , N ). P Indicates that the output message is ready ( M , N ), then execute P Process operation.

[0043] The extended process expression of process calculus is as follows

[0044] ;

[0045] Among them, the variable constraint process new x . P Indicates the creation of a new variable x , then execute P Process operation, name x Only in process P Visible in; Active replacement process { M / x} indicates the use of items M Replace free variables x .

[0046] In one embodiment, the attacker model is represented by an item rewriting system, which is another way to describe the reasoning system and represents the attacker's ability to construct new message items from known message items. The attacker's ability model is constructed based on the item rewriting system:

[0047] ;

[0048] The first property simulates the fact that when symmetric decryption is performed with the correct key, the corresponding plaintext x The second property simulates the fact that when verified with the correct public key, the associated signature will be returned. x , the third property simulates the fact that mapping pairing parameter 1 returns x , the fourth property simulates the fact that the mapping pair parameter 2 returns y Based on the above rewrite system, any item t can be rewritten as a standard form, denoted as .

[0049] In one embodiment, a constraint system is used to symbolically represent the execution trace of the RFID security protocol based on the attacker's capability model, including:

[0050] In the constraint system, the messages that the attacker may construct at a certain stage of the protocol execution are symbolized as variables. At the same time, derivation constraints are defined to express the relationship between variables. The relationship comes from the logical structure of the protocol, the message format or the attacker's ability.

[0051] Based on the defined variables and derived constraints, a constraint system is constructed to represent the execution trace of the RFID security protocol; the constraint system not only includes all possible paths of the protocol during normal execution, but also considers various attack methods that the attacker may take.

[0052] In one embodiment, in a constraint system, a message that an attacker may construct at a certain stage of protocol execution is symbolized as a variable, and at the same time, a derivation constraint is defined to represent the relationship between the variables, including:

[0053] The constraint system is a symbolic representation of the protocol trace. The messages that the attacker may construct at a certain stage of the protocol execution are symbolized as variables, represented by derivation constraints, and the infinite protocol trace is abstracted into a set of derivation constraints. In order to represent the attacker's reasoning process, a special term different from the message term is defined as the spectrum, denoted as g , the spectrum without variables is the base spectrum, which is defined in the function set F And a special parameter AX ={ axe 1 , axe 2 , ... , axe n , ...}, this special parameter indicates the set of message items known to the attacker, referred to as parameter;

[0054] The spectrum is defined in the function set F , parameter set AX and the second-order variables V 2 Above, among which V 2 ={ X 1 , X 2 , ...} is a second-order variable, also known as a spectral variable. g The parameters in are recorded as par ( g );

[0055] Defining a Constraint System C , or empty, recorded as , or a four-tuple consisting of the following elements:

[0056] (1) Framework (1≤ j ≤ n ),in g j For different spectra, u j For different combinations; the frame size is m ;

[0057] (2) Collection (1≤ j ≤ n ),in X j For different spectral variables, u j For different combinations; for each 0≤ k ≤ m , ;

[0058] The set of equalities or inequalities for (3) is E ;

[0059] (4) The set of spectral equations or inequalities is E' ;

[0060] Among them, the framework Records the collection of message items output by the protocol role to the public environment. Indicates that the spectrum g j Constructing Composite Items u j , the frame is called closed when g j For the base spectrum, u j The size of the frame refers to the domain of the frame. The number of elements in house ( )={ g 1 , ... , g n}∩ AX , is a single constraint that expresses whether the attacker can X j Derivation of Combination Term u j ,var( x )express x Variables, conditions It indicates that the variables appearing in the framework must appear in the previous reasoning constraints. It shows an objective fact that the information known by the attacker must be the information that the attacker can infer. E and E ' respectively represent the equality and inequality relations of terms and spectra, which may appear in the process of transforming constraints.

[0061] In one embodiment, the restraint system C =( , D , E , E The solution of ') consists of a permutation s and a permutation i ,in s Replace all first-order variables with basis combinations, i Replace all spectrum variables with the base spectrum as follows:

[0062] For all , and ;

[0063] For all , and ;

[0064] all E The equation in (inequality ) in replacement s The following is consistent;

[0065] all E' Medium (inequality ) in replacement i The following is consistent;

[0066] Restraint system C All solutions of Sol ( C ), Sol ( C )= ; Two closed frames of the same size and is statically equivalent, denoted by , if and only if:

[0067] For any base spectrum g , ,have is a combination term if and only if is a combination item;

[0068] For any base spectrum g and g' , , and For the combination item, there are If and only if .

[0069] On the basis of static equivalence, assuming C , C' are two constraint systems, and their respective frames are and , C The symbol is equivalent to C' , denoted as , if and only if:

[0070] For all ,exist in , so that and ;

[0071] For all ,exist in , so that and ;

[0072] The infinite execution trace of the protocol is abstracted into a constraint system, that is, the equivalence problem of any trace is transformed into the equivalence problem of the constraint system for solution.

[0073] In one embodiment, an untraceability standard is defined based on the execution trace to evaluate whether an attacker can infer the identity or behavior of a specific tag or user from the execution trace, including:

[0074] The untraceability standard is defined based on the execution trace: for all possible execution traces, if the attacker cannot distinguish whether two specific messages come from the same subject, then the system is untraceable;

[0075] If there is an execution trace in the system that allows an attacker to accurately determine that two specific messages come from the same subject, the system's untraceability is considered to be invalid, that is, the system is at risk of being attacked.

[0076] In a specific embodiment, in an RFID system, when an attacker observes a system and determines that two specific messages may come from two different sessions being performed by the same subject, the system is untraceable if for all such cases there is another trace that appears to the attacker to be the same, and in this trace, the two messages come from two different subjects. The failure of untraceability directly means being attacked.

[0077] Take an RFID unilateral authentication protocol as an example. The protocol uses a random number generator and a hash function h The state of each tag is represented by a randomly generated key s Initialize, this key is known to the background and serves as the tag's identity data and is never updated. The tag also generates a new random number at each run. r , and calculate the hash value of its key and the random number h ( s , r ). Finally, it outputs the pair of values ​​< r , h ( s , r )>. The background performs the same calculation for all known tags and compares them with the given value to identify the corresponding tag. This protocol is modeled in process calculus as follows:

[0078] ;

[0079] Consider the case of two sessions. A possible trace is:

[0080] ;

[0081] Another possible trace is:

[0082] ;

[0083] Among them, A 2 Message in and From the same subject, A 4 Message in and from two different entities, and Therefore, it can be concluded that this RFID unilateral authentication protocol satisfies the untraceability requirement.

[0084] According to the statement of untraceability, during the interaction between the attacker and the RFID system protocol entity, a protocol trace containing basic cryptographic primitives is:

[0085] ;

[0086] Corresponding restraint system C for:

[0087] ;

[0088] Another protocol trace is:

[0089] ;

[0090] Corresponding restraint system C' for:

[0091] ;

[0092] The problem of verifying untraceability is ultimately transformed into a judgment constraint system C and C' The question of whether they have the same solution.

[0093] Although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0094] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 2 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a formal analysis method for verifying the untraceability of the RFID security protocol is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0095] Those skilled in the art will understand that Figure 2 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0096] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0097] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0098] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A formal analysis method for verifying the untraceability of RFID security protocols, characterized in that: The method comprises: The messages in the RFID security protocol are formally described using process calculus, and the communication behavior in the protocol is abstracted into an operational mathematical model. Then, the attacker's capability model is constructed according to the item rewriting system; the capability model is used to describe the possible operations of the attacker. Based on the attacker's capability model, a constraint system is used to symbolically represent the execution trace of the RFID security protocol, including all possible execution paths of the protocol in normal and attack scenarios; Using the execution trace to define an untraceability standard to evaluate whether an attacker can infer the identity or behavior of a specific tag or user from the execution trace; According to the untraceability standard, the problem of verifying untraceability is transformed into the problem of determining whether two constraint systems have the same solution. The constraint systems are constrained and solved. If there is an intersection in the solution spaces of the two constraint systems, it indicates that there is at least one solution that satisfies the constraint conditions of the two systems at the same time, and the untraceability is verified. If there is no intersection, it indicates that the two execution traces are distinguishable from the attacker's perspective, that is, the untraceability of the system fails.

2. The method according to claim 1, characterized in that: The process calculus is used to formally describe the messages in the RFID security protocol and abstract the communication behavior in the protocol into an operational mathematical model, including: The name in the process calculus represents a characteristic message or value and expresses the message structure by constructing a new message or value from a known message or value by defining a function; the message includes encrypted data, signed data or other processed data; the value includes a specific key value or a protocol identifier; By defining the process of sending and receiving messages, the communication behavior in the protocol is modeled as an operational mathematical model.

3. The method according to claim 1, characterized in that: Message structures are expressed by defining functions to construct new messages or values ​​from known messages or values, including: Define an infinite set of names N ={ a , b , …},in a, b etc. denotes a name, an infinite set of first-order variables X 1 ={ x , y , …},in x, y etc. represent variables, a set of function symbols F , function symbol set F is a set of combinatorial functions F c and decomposition function set F d The union of , the expressions are as follows: in, senc , sdec , aenc , adec , pair , h , proj 1, proj 2 represents symmetric encryption function, symmetric decryption function, asymmetric encryption function, asymmetric decryption function, pairing function, hash function, mapping 1 function, mapping 2 function, respectively. pub Represents a public key; The message combination item is recorded as T ( F c , N , X 1 ), the combination without variables is called the base combination, denoted by T ( F c , N ), the base combination item is used to represent the protocol message.

4. The method according to claim 3, characterized in that: The attacker's capability model is constructed based on the item rewriting system: The first property simulates the fact that when symmetric decryption is performed with the correct key, the corresponding plaintext x The second property simulates the fact that when verified with the correct public key, the associated signature will be returned. x , the third property simulates the fact that the mapping pair parameter 1 returns x , the fourth property simulates the fact that the mapping pair parameter 2 returns y .

5. The method according to claim 1, characterized in that Based on the attacker's capability model, a constraint system is used to symbolically represent the execution trace of the RFID security protocol, including: In the constraint system, the messages that the attacker may construct at a certain stage of the protocol execution are symbolized as variables, and at the same time, inference constraints are defined to express the relationship between the variables, which is derived from the logical structure of the protocol, the message format or the attacker's ability; Based on the defined variables and derived constraints, a constraint system is constructed to represent the execution trace of the RFID security protocol; the constraint system not only includes all possible paths of the protocol during normal execution, but also considers various attack methods that may be taken by attackers.

6. The method according to claim 5, characterized in that In the constraint system, the messages that the attacker may construct at a certain stage of the protocol execution are symbolized as variables. At the same time, derivation constraints are defined to express the relationship between variables, including: Define a special item different from the message item as a spectrum, denoted by ζ , the spectrum without variables is the base spectrum, which is defined in the function set F And a special parameter AX ={ ax 1, ax 2, ... , ax n , ...}, this special parameter indicates the set of message items known to the attacker, referred to as parameter; The spectrum is defined in the function set F , parameter set AX and the second-order variables V 2 Above, among which V 2 ={ X 1, X 2, ...} is a second-order variable, also known as a spectral variable. ζ The parameters in are recorded as par ( ζ ); Defining a Constraint System C , or is empty, then it is recorded as , or a four-tuple consisting of the following elements: (1) Framework (1≤ j ≤ n ),in ζ j For different spectra, u j For different combinations; the frame size is m ; (2) Collection (1≤ j ≤ n ),in X j For different spectral variables, u j For different combinations; for each 0≤ k ≤ m , ; The set of equalities or inequalities for (3) is E ; (4) The set of spectral equations or inequalities is E' ; Among them, the framework Records the collection of message items output by the protocol role to the public environment. Indicates that the spectrum ζ j Constructing Composite Items u j , the frame is called closed when ζ j For the base spectrum, u j The size of the frame refers to the domain of the frame. The number of elements in dom ( )={ ζ 1, ... , ζ n }∩ AX , is a single constraint that expresses whether the attacker can X j Derivation of Combination Term u j ,var( x )express x Variables, conditions Indicates that the variables appearing in the frame must appear in the inference constraints before it.

7. The method according to claim 6, characterized in that The method further comprises: The restraint system C =( , D , E , E The solution of ') consists of a permutation σ and a permutation θ ,in σ Replace all first-order variables with basis combinations, θ Replace all spectrum variables with the base spectrum, as follows: For all , and ; For all , and ; all E The equation in or inequality In replacement σ The following is consistent; all E' Medium or inequality In replacement θ The following is consistent; Restraint system C All solutions of Sol ( C ), Sol ( C )= ; Two closed frames of the same size and The static equivalent is , if and only if: For any base spectrum ζ , ,have is a combination term if and only if is a combination item; For any base spectrum ζ and ζ' , , and For the combination item, there are If and only if ; On the basis of static equivalence, assuming C , C' are two constraint systems, and their respective frames are and , C The symbol is equivalent to C' , denoted as , if and only if: For all ,exist σ' , so that and ; For all ,exist σ' , so that and ; The infinite execution trace of the protocol is abstracted into a constraint system, that is, the equivalence problem of any trace is transformed into the equivalence problem of the constraint system for solution.

8. The method according to claim 1, characterized in that: The untraceability criteria defined in the execution trace are used to evaluate whether an attacker can infer the identity or behavior of a specific tag or user from the execution trace, including: The untraceability standard is defined according to the execution trace: for all possible execution traces, if the attacker cannot distinguish whether two specific messages come from the same subject, then the system is untraceable; If there is an execution trace in the system that allows an attacker to accurately determine that two specific messages come from the same subject, the system's untraceability is considered to be invalid, that is, the system is at risk of being attacked.

Images