Bidirectional security authentication method and system for RFID (Radio Frequency Identification Device) tag

Abstract

The invention relates to the technical field of RFID (Radio Frequency Identification) security authentication, in particular to an RFID tag bidirectional security authentication method and system. The method comprises the following steps: a reader sends an authentication request containing a first random number to a label for starting a bidirectional authentication process and introducing initial randomness; and the tag generates a first response by adopting a lightweight hash algorithm based on a tag lightweight key stored in the tag and the first random number, generates a second random number at the same time, and sends the first response and the second random number to the reader for proving tag identity legality to the reader and introducing tag side randomness. According to the RFID tag bidirectional security authentication method and system provided by the invention, through introduction of the lightweight key, the lightweight hash algorithm and the tag pseudo-random number, the contradiction between tag resource constraint and security strength in the prior art is effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of radio frequency identification security authentication, in particular to a two-way security authentication method and system for RFID tags. BACKGROUND

[0002] Radio frequency identification (RFID) is an important bridge connecting the physical world and the digital world due to its non-contact, high speed and large capacity. However, the wireless communication link between RFID tags and readers is vulnerable to illegal interception, forgery or replay attacks. Therefore, two-way security authentication is a mechanism to ensure the credibility of the RFID system, which not only ensures that the reader can verify the legitimacy of the tag to prevent illegal tags from impersonating, but also ensures that the tag can verify the legitimacy of the reader to prevent illegal readers from stealing information.

[0003] Most existing RFID two-way authentication schemes are based on the traditional framework in which the reader sends a random number, the tag generates a response using a fixed key, and the reader verifies the response. However, this framework is difficult to balance the contradiction between tag resource constraints and security strength. To improve security levels, traditional schemes often use complex encryption algorithms or long keys. However, RFID tags are constrained by low power consumption and small size hardware constraints, and complex calculations can cause the power consumption of the tag to increase dramatically and shorten its service life. If the algorithm is simplified or a pseudo-random number generator is used to generate random numbers, the unpredictability of the random number and the unforgeability of the response will be reduced. That is, an attacker can obtain the tag key through reverse engineering or predict the pseudo-random number generation rule to forge the tag response to deceive the reader. At the same time, the tag cannot effectively verify the identity of the reader, resulting in a double risk of identity forgery and information leakage. Therefore, how to balance the computational efficiency and security strength of the two-way security authentication method under the premise of meeting the low power consumption and small size hardware constraints of the RFID tag, which ensures that the tag can efficiently generate a secure response and ensures the sufficient randomness and unforgeability of the two-way identity verification between the reader and the tag, is a technical problem faced by current RFID tag security authentication. SUMMARY

[0004] The present disclosure proposes a two-way security authentication method and system for RFID tags, which aims to overcome at least one of the deficiencies in the prior art.

[0005] To achieve the above-mentioned purpose, the technical solutions of the present application are as follows: According to one aspect of the present disclosure, a two-way security authentication method for RFID tags is provided, comprising the steps of: The reader sends an authentication request containing a first random number to the tag to start the two-way authentication process and introduce initial randomness. The tag generates a first response by using a lightweight hash algorithm based on the stored tag lightweight key and the first random number, generates a second random number at the same time, and sends the first response and the second random number to the reader to prove the legitimacy of the tag identity and introduce tag-side randomness; The reader verifies the first response based on the tag lightweight key and the first random number, and after verification, generates a second response based on the tag lightweight key and the second random number, and sends it to the tag to confirm the legitimacy of the tag and start the reader identity authentication. The tag verifies the second response based on the tag lightweight key and the second random number, and after verification, completes the mutual authentication to confirm the legitimacy of the reader identity.

[0006] Further, the second random number is generated by a physically unclonable function (PUF) built in the tag to enhance the unpredictability of the random number, and the expression of the PUF is: wherein R tag represents the second random number generated by the tag to respond to the authentication request of the reader; S sel represents a selection signal generated internally by the tag to select a pair of oscillators to be compared from multiple ring oscillators built in the tag; C phy represents the physical fingerprint of the tag to determine the oscillation frequency of the ring oscillator; and RO-PUF represents the PUF of the lightweight oscillator.

[0007] Further, the generation step of the first response is specifically that the tag concatenates the stored lightweight key with the first random number, and obtains the first response by using the lightweight hash algorithm to prevent direct exposure of the key.

[0008] Further, the step of verifying the first response by the reader is specifically that the reader concatenates the pre-stored tag lightweight key with the first random number, and obtains the result by using the same lightweight hash algorithm as the tag, and the verification is passed if the comparison result is consistent. The step of verifying the second response by the tag is specifically that the tag concatenates the stored lightweight key with the second random number, and obtains the result by using the lightweight hash algorithm, and the verification is passed if the comparison result is consistent.

[0009] Further, after completing the mutual authentication, the reader and the tag update the stored lightweight key based on the first random number and the second random number for use in the next authentication to improve the dynamic security of the key.

[0010] Further, the updating step of the lightweight key is specifically: the reader and the tag splice the first random number and the second random number, and obtain a new lightweight key by using the lightweight hash algorithm, which is used to replace the original key, and the lightweight hash algorithm is a lightweight optimized SM3 algorithm, which is used to adapt to the low-power computing capability of the tag.

[0011] Further, the authentication request further contains a unique identifier of the reader, which is used for the tag to identify the identity of the reader initiating the authentication.

[0012] Further, the first random number is generated by a true random number generator built in the reader, which is used to enhance the initial randomness.

[0013] According to another aspect of the present disclosure, there is provided an RFID tag bidirectional secure authentication system for implementing the RFID tag bidirectional secure authentication method as described above, comprising: An authentication request sending module is arranged in the reader, and is used to send an authentication request containing a first random number to the tag, start a bidirectional authentication process and introduce initial randomness; A tag response generating module is arranged in the tag, and is used to generate a first response by using a lightweight hash algorithm based on a lightweight key stored in the tag and the first random number, generate a second random number at the same time, and send the first response and the second random number to the reader, so as to prove the legitimacy of the tag identity to the reader and introduce randomness on the tag side; A reader response verifying module is arranged in the reader, and is used to verify the first response based on a pre-stored lightweight key of the tag and the first random number, and after the verification is passed, generate a second response based on the lightweight key of the tag and the second random number, and send the second response to the tag, so as to confirm the legitimacy of the tag and start the authentication of the reader identity; A tag response verifying module is arranged in the tag, and is used to verify the second response based on the lightweight key stored in the tag and the second random number, and after the verification is passed, complete the bidirectional authentication and confirm the legitimacy of the reader identity.

[0014] Further, a key updating module is arranged in the reader and the tag respectively, and is used to update the lightweight key stored in each of the reader and the tag based on the first random number and the second random number after the bidirectional authentication is completed, so as to improve the dynamic security of the key.

[0015] The present application has the following advantages: The RFID tag two-way security authentication method and system provided by this invention effectively solves the contradiction between tag resource constraints and security strength in existing technologies by introducing lightweight keys, lightweight hash algorithms, and tag pseudo-random numbers. On the one hand, the tag uses a lightweight key and a lightweight hash algorithm to generate the first response, which significantly reduces the tag's computational load. The hardware implementation area of ​​the lightweight hash algorithm is only about 1 / 3 of that of the traditional AES algorithm, and the power consumption is only about 1 / 4 of that of the traditional algorithm, meeting the low power consumption requirements of RFID tags. On the other hand, while generating the first response, the tag generates a second random number through a Physically Unclonable Function (PUF), such as a ring oscillator (PUF). This utilizes the tag's inherent physical characteristics to generate a unique and unpredictable random number, integrating the tag's physical uniqueness into the authentication process. This prevents attackers from forging responses by copying the tag hardware or predicting the random number generation pattern. The random number generated by the PUF is determined by the inherent deviations in the tag manufacturing process, and each tag's random number is unique and cannot be copied, thus solving the security risk of the predictability of pseudo-random numbers.

[0016] Furthermore, the two-way authentication process of this invention achieves mutual identity verification through reader verification of tag response and tag verification of reader response: the reader verifies the tag response using the tag key and a first random number to ensure the tag's legitimacy; the tag verifies the reader response using the tag key and a second random number to ensure the reader's legitimacy. This design, without increasing the tag's computational burden, deeply integrates the unpredictability of random numbers, the unforgeability of responses, and two-way identity verification, significantly improving the security of the RFID system. Even if an attacker intercepts the authentication request or response in the communication link, they cannot forge a legitimate tag response or reader response because the tag's second random number is generated by the PUF and is unpredictable, while the reader's second response is generated by the tag key and the second random number and requires tag verification.

[0017] Furthermore, the technical solution of the present invention, while meeting the constraints of low power consumption and small size of RFID tags, enhances the randomness and non-forgeability of two-way authentication through lightweight technical means, achieving a balance between low power consumption and high security, and providing a solid guarantee for the reliability of RFID tags.

[0018] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, the following describes the preferred embodiments of the present invention in detail with reference to the accompanying drawings. Attached Figure Description

[0019] Figure 1 This is one embodiment of the present invention; Figure 2 This is a schematic diagram of RFID communication electromagnetic waves in one embodiment of the present invention; Figure 3 This is a schematic diagram of the PUF architecture in one embodiment of the present invention; Figure 4 This is a diagram of a lightweight hash algorithm architecture in one embodiment of the present invention; Figure 5 This is a schematic diagram of a key update mechanism in one embodiment of the present invention; Figure 6 This is a schematic diagram illustrating security attack defense in one embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In embodiments of the present invention, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in embodiments of the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Rather, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0022] The present invention provides the following preferred embodiments: Example 1: To address the difficulty in balancing tag resource constraints and security strength in existing RFID two-way authentication schemes, this example provides a two-way security authentication method for RFID tags. By combining lightweight computation with bidirectional randomization, it achieves mutual identity verification under low power consumption. Figure 1 As shown, the process is as follows: S100: The reader sends an authentication request containing a first random number to the tag to initiate the two-way authentication process and introduce initial randomness.

[0023] S200: The tag generates a first response using a lightweight hash algorithm based on its stored tag lightweight key and a first random number, and simultaneously generates a second random number. The first response and the second random number are sent to the reader to prove the legitimacy of the tag's identity and to introduce tag-side randomness.

[0024] S300: The reader verifies the first response based on the tag's lightweight key and the first random number. After successful verification, the reader generates a second response based on the tag's lightweight key and the second random number, and sends it to the tag to confirm the tag's legitimacy and initiate reader authentication.

[0025] S400: The tag verifies the second response based on the tag's lightweight key and a second random number. Once the verification is successful, two-way authentication is completed to confirm the legitimacy of the reader's identity.

[0026] Specifically, the reader, acting as the authentication initiator, first sends an authentication request containing a first random number to the tag. This request is transmitted via the RFID wireless communication link, and its electromagnetic wave signal transmission model is as follows: Figure 2 As shown, the introduction of the first random number provides initial randomness for the subsequent authentication process, avoiding the risk of replay attacks from fixed keys or predictable random sources, and ensuring that the authentication process is resistant to attacks from the start. At this point, the reader's role is to initiate two-way authentication and inject randomness into the process through the first random number, laying the foundation for subsequent verification steps.

[0027] Furthermore, after receiving the authentication request, the tag, based on its stored lightweight key, fuses the key with a first random number and generates a first response using a lightweight hash algorithm. The architecture of this lightweight hash algorithm is as follows: Figure 4 As shown, it employs a simplified round function design and hardware parallelization optimization, achieving efficient data diffusion and obfuscation without increasing tag power consumption. This ensures the unforgeability of the first response; even if an attacker intercepts the first response, they cannot obtain the tag key or predict subsequent responses through reverse engineering. Simultaneously, the tag generates a second random number, which serves as an independent randomness input on the tag side and is sent to the reader along with the first response via the RFID link. The first response proves the legitimacy of the tag's identity to the reader, while the introduction of the second random number further enriches the randomness dimension of the authentication process, avoiding the security risks associated with a single random source, such as the first random number provided by the reader. This ensures that attackers cannot predict subsequent authentication steps by intercepting a single random number.

[0028] Furthermore, after receiving the first response and the second random number, the reader first performs tag authentication. Specifically, based on the pre-stored tag lightweight key, the reader merges this key with the first random number in a way that is identical to the tag's, calls the same lightweight hash algorithm for calculation, and compares the result with the received first response. If they match, it means the tag holds a valid lightweight key and its identity is legitimate; if they do not match, the authentication process terminates to prevent impersonation by unauthorized tags. After successful tag authentication, the reader initiates its own authentication process: based on the tag's lightweight key and the second random number, it again calls the lightweight hash algorithm to generate a second response and sends this response to the tag. The generation process of the second response forms a symmetrical structure with the first response, ensuring equality between the reader and the tag in the authentication process. The reader must prove its identity to the tag through the second response, rather than the tag only verifying the reader unilaterally.

[0029] Furthermore, upon receiving the second response, the tag performs reader authentication. Based on its stored lightweight key, the tag fuses this key with a second random number, performs a lightweight hash algorithm, and compares the result with the received second response. If they match, it indicates that the reader possesses a valid tag lightweight key and its identity is legitimate; if they do not match, the authentication process terminates to prevent unauthorized readers from stealing information. Once the reader's authentication is successful, the two-way authentication process is complete, and both the reader and the tag have confirmed each other's legitimacy, allowing for normal data interaction thereafter.

[0030] This embodiment reduces the computational load on the tag by combining a lightweight key with a lightweight hash algorithm, meeting the hardware constraints of low power consumption and small size for RFID tags. Simultaneously, the bidirectional introduction of a first random number (reader side) and a second random number (tag side) ensures sufficient randomness in the authentication process, preventing replay attacks or forgery attacks. The design of the bidirectional verification mechanism (reader verifies tag, tag verifies reader) achieves mutual identity confirmation, ensuring that both communicating parties in the RFID system are legitimate entities, thus enhancing the overall security of the system.

[0031] Example 2: To address the issue that random numbers generated by fixed digital circuits in existing RFID tag random number generation mechanisms are easily predicted or forged by attackers due to their modelability, this example further optimizes the generation method of the second random number on the tag side. The second random number is generated through the Physically Unclonable Function (PUF) built into the tag, which enhances the unpredictability of the random number by utilizing physical characteristics, making it more suitable for the hardware constraints of low power consumption and small size of RFID tags.

[0032] In this embodiment, the second random number R generated by the tag tag It is generated by the built-in lightweight oscillator physically unclonable function (RO-PUF), and its generation process follows the expression. , where R tag S represents the second random number generated by the tag, used in the tag's response to the reader's authentication request. sel This indicates a selection signal generated internally by the tag, used to select the oscillator pair to be compared from multiple ring oscillators built into the tag; C phy The physical fingerprint of the tag is determined by unavoidable random differences in the semiconductor manufacturing process, such as fluctuations in wafer doping concentration, changes in metal linewidth, and differences in oxide layer thickness. These are inherent and unchangeable characteristics of the tag. RO-PUF is a lightweight PUF architecture based on a ring oscillator array, which is responsible for converting the combination of Ssel and Cphy into binary random number output.

[0033] like Figure 3As shown, the RO-PUF architecture used in this embodiment comprises three parts: a ring oscillator array, a selection logic circuit, and a frequency comparison module. The ring oscillator array consists of multiple sets of ring oscillators with identical structures but slightly different physical characteristics. Each set of oscillators is composed of an odd number of inverters, and its oscillation frequency is determined by physical parameters such as the threshold voltage and parasitic capacitance of the inverters. These parameters are further determined by C... phy The unique determination, that is, the C of different labels phy Even with identical circuit structures, ring oscillators can exhibit significantly different oscillation frequencies. Choosing a logic circuit as the bridge connecting the oscillator array and the frequency comparison module, based on S... sel The signal selects a specific pair of oscillators from the array, for example, when S sel When the signal is a 4-bit binary signal, any two oscillators can be selected from 16 oscillators to form a pair. The selection process is dynamically controlled by the tag's internal logic. Each round of authentication uses S... sel The signals may all be different. The frequency comparison module is the core functional unit of the RO-PUF. It converts the frequency difference of the selected oscillator pair into a binary digital signal through a differential amplifier circuit: when the frequency of oscillator A is higher than that of oscillator B, it outputs "1"; otherwise, it outputs "0". Since C phy The existence of this means that even when the same oscillator pair is selected, the frequency difference between different tags will be different; while S sel The dynamic changes ensure that the oscillator pair selected for the same label is different in different certification rounds, thus making the R generated in each round... tag Each one is unique and cannot be repeated.

[0034] It's important to understand that the design of using RO-PUF to generate the second random number in this embodiment essentially shifts the random number generation process from "digital logic calculation" to "physical characteristic extraction." Unlike traditional digital random number generators such as linear feedback shift registers (LFSRs) that rely on software algorithms or fixed hardware circuits, the output of RO-PUF directly depends on the tag's physical characteristics. These characteristics are impossible for attackers to replicate or model. Even if an attacker obtains the tag's circuit design drawings, they cannot manufacture a tag with the same C... phy The tag; even if a certain round of authentication is intercepted by S sel With R tag It is also impossible to derive C through reverse engineering. phy Furthermore, it is impossible to predict the next round of R certification. tag Output. This physical non-cloning property makes the second random number highly unpredictable, effectively solving the security risks of predictability in traditional random number generation mechanisms.

[0035] Furthermore, the RO-PUF architecture in this embodiment adopts a lightweight design to adapt to the resource constraints of RFID tags. The circuit structure of the ring oscillator is simple, consisting only of inverters, and its chip area is much smaller than other types of PUFs, such as SRAM-PUF or butterfly PUF. The selection logic circuit and frequency comparison module are both implemented using digital circuits, with few logic gates and extremely low power consumption. Tests show that the overall power consumption of the RO-PUF in this embodiment is only 25% of that of a traditional LFSR random number generator, and the chip area is reduced by 40%, fully meeting the hardware requirements of low power consumption and small size for RFID tags.

[0036] In the two-way authentication process, the second random number R tag Its function is to serve as an independent randomness input on the tag side, sent to the reader along with the first response, for the reader to generate the second response. This embodiment generates the R using RO-PUF. tag This gives this random input the dual attributes of being both "physically inherent" and "dynamically changing": on the one hand, C phy The uniqueness ensures that each tag's R tag Each has a unique physical characteristic, making it impossible for attackers to forge R. tag Misrepresenting legitimate labels; on the other hand, S sel Dynamic selection and C phy The combination of unpredictability makes each round of certification R tag They are all different, even if the attacker intercepts the R of a certain round of authentication. tag It is also impossible to predict the next round of R tag This output effectively prevents replay attacks.

[0037] The advantage of this embodiment lies in the deep integration of the tag's physical characteristics with the random number generation process by employing RO-PUF to generate a second random number. This imbues the second random number with both physical unclonability and dynamic randomness, significantly enhancing the unpredictability of the tag's response. Simultaneously, the lightweight RO-PUF architecture ensures the tag's low power consumption and small size, allowing it to adapt to the hardware constraints of RFID tags. This design addresses the security vulnerabilities of traditional random number generation mechanisms while meeting the tag's resource requirements, providing a more reliable randomness guarantee for the security strength of the two-way authentication process.

[0038] Example 3: To address the issue that tag responses in existing RFID two-way authentication are prone to key exposure due to directly including the key or using simple encryption methods, this example further refines the generation logic of the first response. By concatenating and hashing a lightweight key with a first random number, indirect key verification is achieved, while also adapting to the hardware constraints of low power consumption and small size of the tag.

[0039] In this embodiment, the generation process of the first response is completed by the tag's internal logic circuitry: when the tag receives the authentication request sent by the reader, as follows... Figure 2 As shown, the authentication request includes a first random number generated by the reader. First, a pre-stored lightweight key is retrieved from the built-in non-volatile memory. Then, the key and the first random number are concatenated in a fixed order, such as key data first, followed by the first random number, forming a concatenated data string. Finally, this data string is input into a lightweight hash algorithm for calculation, and the output result is the first response. The entire process is coordinated and controlled by the tag's microcontroller unit (MCU). After the calculation is completed, the first response is returned to the reader via the radio frequency module in the form of an electromagnetic wave signal. Figure 2 The annotation of the authentication response.

[0040] like Figure 4 As shown, the lightweight hash algorithm architecture used in this embodiment consists of a compression function, an iteration control module, and an output truncation module. The compression function is the core processing unit of the algorithm, based on a permutation-substitution network design: first, the concatenated data string is divided into fixed-length byte blocks, the byte order is shuffled through byte permutation, and then obfuscated by XOR operation with a fixed round key generated from the concatenated data string, achieving data diffusion and obfuscation; the iteration control module dynamically adjusts the number of iterations according to the length of the concatenated data string. For example, for 16-byte concatenated data, with an 8-byte key + 8-byte first random number, only 3 iterations are needed to achieve sufficient obfuscation, avoiding the power consumption overhead caused by excessive iterations in traditional hash algorithms; the output truncation module truncates the compressed 32-byte intermediate result to 16 bytes as the final output of the first response, ensuring that the output length meets the authentication requirements while further reducing the amount of data transmission.

[0041] It's important to understand that the purpose of the concatenation operation is to bind the key to the first random number, ensuring that the first response of each authentication round is strongly correlated with the first random number of that round. Even if an attacker intercepts the first response of a certain round of authentication, they cannot use it to forge responses in other rounds because the first random number for the next round of authentication will change, the concatenated data string will change accordingly, and the hash result will also be different. Furthermore, the irreversibility of hash operations fundamentally eliminates the possibility of an attacker recovering the key from the first response: the output of the hash function cannot be used to deduce the input; even if the first response is completely intercepted, the key remains inside the tag and is not exposed in the communication link.

[0042] Furthermore, the design and storage of the lightweight key fully consider the hardware limitations of the tag: the key length is set to 8 bytes, ensuring sufficient security entropy to resist brute-force attacks while avoiding excessive memory usage due to excessively long keys; key storage uses EEPROM, an electrically erasable programmable read-only memory, which has low power consumption for reading and writing, meets the tag's lifecycle requirements for erase and write cycles, and ensures data persistence and stability even after power failure. The fixed concatenation order is fundamental to achieving reader-tag consistency verification. The reader must concatenate its stored key and the first random number in the same order as the tag (key first, first random number last), and then use the same lightweight hash algorithm to obtain a first response consistent with the tag, thus completing the verification of the tag's legitimacy.

[0043] The advantage of this embodiment is that it achieves indirect key verification by concatenating a lightweight key with a first random number through hash processing, avoiding direct transmission of the key in the communication link; the use of a lightweight hash algorithm makes the generation process of the first response highly compatible with the hardware constraints of the tag, without increasing additional power consumption or size burden; and the irreversibility of hash operation and the dynamic nature of concatenated data together ensure the security of the key, so that even if the communication link is intercepted, attackers cannot obtain the key or forge a legitimate response.

[0044] Example 4: To address the issue of authentication failure due to inconsistent response verification logic between the reader and tag in RFID two-way authentication, or the possibility of forged responses passing due to simple verification methods, this example further refines the verification process of the reader for the first response and the verification process of the tag for the second response. Through consistent concatenation logic and a lightweight hash algorithm, the accuracy and security of two-way authentication are achieved.

[0045] In this embodiment, the reader's verification process for the first response is as follows: When the reader receives the first response returned by the tag through the radio frequency module, as follows: Figure 2 As shown, this response is the tag's reply to the authentication request. First, the pre-stored lightweight key corresponding to the tag is retrieved from the local secure storage unit. Then, the key is concatenated with the first random number previously sent to the tag in a fixed order. This concatenation order is exactly the same as the order in which the tag generated the first response, i.e., the key data first, followed by the first random number, forming a fixed-length concatenated data string. For example... Figure 4As shown, the reader uses the same lightweight hash algorithm as the tag to process the concatenated data string: the compression function spreads and obfuscates the concatenated data blocks through a permutation-replacement network; the iteration control module dynamically adjusts the number of iterations based on the length of the concatenated data (e.g., 3 rounds for 16 bytes of data); and the output truncation module truncates the compressed result to a fixed length, such as 16 bytes. After the operation is complete, the reader compares the hash result with the received first response byte by byte. If the results are completely identical, the tag's legitimacy is confirmed, allowing subsequent authentication steps to continue.

[0046] Furthermore, the tag's verification process for the second response is consistent with the reader's verification logic: when the tag receives the second random number and the second response sent by the reader, as follows... Figure 2 As shown, this signal is the reader's response after completing the first response verification. It retrieves its stored lightweight key from its built-in non-volatile memory and concatenates the key and a second random number in the same order as when the first response was generated, with the key first and the second random number last, forming a new concatenated data string. Subsequently, the tag uses its integrated lightweight hash algorithm to process this concatenated data string, obtaining the hash result on the tag side. This hash result is completely consistent with the algorithm architecture used by the reader and itself when generating the first response. Figure 4 As shown. Finally, the tag compares the result with the received second response. If they match, the legitimacy of the reader is confirmed, and the two-way authentication process is completed.

[0047] It's important to understand that the reader and tag use completely consistent concatenation order and hash algorithms during the verification process; this is the core logic ensuring successful verification. If an attacker attempts to forge the first response, even if they obtain the first random number and key, if the concatenation order differs from the tag's or a different hash algorithm is used, the generated response will fail the reader's verification. Similarly, when forging the second response, if the concatenation order or algorithm differs from the reader's, it will also fail the tag's verification. This consistent verification logic ensures the accuracy of two-way authentication while preventing attacks that forge responses. Furthermore, the use of a lightweight hash algorithm ensures that the verification process is highly compatible with the hardware constraints of the tag and reader, without adding extra power consumption or computational burden. The permutation-replacement network design of the compression function and the dynamic adjustment of the number of iterations are all optimized to meet low-power requirements, ensuring that the verification process is completed efficiently with the tag's limited computational resources.

[0048] The advantage of this embodiment is that it achieves accurate verification of bidirectional responses by using consistent splicing logic and a lightweight hash algorithm between the reader and the tag, avoiding authentication failures caused by inconsistent logic. At the same time, the consistent algorithm and splicing method prevent forged responses from passing verification, thus improving the security of bidirectional authentication. Furthermore, the use of a lightweight hash algorithm adapts to the hardware constraints of the tag and the reader without increasing additional power consumption or computational burden.

[0049] Example 5: To address the risk of key leakage caused by the long-term fixation of static keys in traditional RFID authentication, this example further optimizes the key update mechanism after two-way authentication. The lightweight keys stored in the reader and tag are dynamically updated by the first and second random numbers generated during the authentication process, achieving one-time key encryption.

[0050] Once mutual authentication is complete, such as Figure 2 As shown, the authentication response returned by the tag is verified by the reader, and the tag verifies the reader's second response. The reader first retrieves the lightweight key corresponding to the tag from its local secure storage unit. Then, it concatenates the key with the first random number sent and the second random number received during this authentication in a fixed order: key data first, first random number in the middle, and second random number last, forming a concatenated data string of fixed length. Next, the reader calls the same lightweight hash algorithm used in the authentication process to operate on the concatenated data string, such as... Figure 4 As shown, the algorithm consists of a compression function, an iteration control module, and an output truncation module. The compression function uses a permutation-replacement network to spread and obfuscate the concatenated data blocks. The iteration control module dynamically adjusts the number of iterations based on the length of the concatenated data. The output truncation module truncates the compressed result to a fixed length. After the operation is complete, the reader uses the resulting hash result as a new lightweight key and writes it to the local secure storage unit through atomic operations, replacing the original key. This atomic operation ensures that even in the event of power outages or other anomalies during the update process, the key data will not be corrupted or incomplete.

[0051] Furthermore, the tag's key update process is completely synchronized with the reader's logic: after two-way authentication is completed, the tag retrieves the currently stored lightweight key from its built-in non-volatile memory and concatenates the key, the first random number, and the second random number in the same order as the reader, forming a concatenated data string with the same structure. Subsequently, the tag uses its integrated lightweight hash algorithm to process the concatenated data string, which is completely consistent with the algorithm architecture used by the reader and in the authentication process, such as... Figure 4 As shown, the same hash result as the reader is obtained. Finally, the tag uses atomic operations to write the new key into the built-in non-volatile memory, replacing the original key. That is, atomic operations ensure that the tag will not have key errors due to radio frequency energy fluctuations during the update process, ensuring the correctness of the key for the next authentication.

[0052] It's important to understand that both the first and second random numbers used during the key update process originate from the data exchanged during this authentication process: the first random number is generated by the reader and sent to the tag, such as... Figure 2 In the authentication request phase shown, the second random number is generated by the tag and sent to the reader, such as... Figure 2In the authentication response phase shown, both the reader and the tag use one-time random numbers, which are not stored on external media, thus avoiding additional communication overhead and storage risks. The concatenation order, hash algorithm, and atomic operations of the reader and the tag are completely identical, ensuring that the new keys used for the next authentication are exactly the same. If there are differences in the concatenation order or algorithm, the keys will be inconsistent during the next authentication, resulting in authentication failure. Therefore, consistency is the core requirement of the update mechanism.

[0053] The advantages of this embodiment are that the lightweight key is dynamically updated by the random number generated during the two-way authentication process, so that the key changes with each authentication, avoiding the risk of key leakage caused by the long-term fixation of static keys; the update process is seamlessly connected with the authentication process, without the need for additional communication steps, maintaining the low power consumption characteristics of the RFID system; the synchronous update logic of the reader and the tag ensures the consistency of the key, providing a secure key foundation for the next authentication.

[0054] Example 6: To resolve the contradiction between the algorithm complexity and the low power consumption of RFID tags in the traditional key update process, this example further optimizes the specific implementation process of key update and uses the lightweight optimized SM3 algorithm to complete the dynamic generation of keys.

[0055] After two-way authentication is completed, the reader first retrieves the lightweight key currently associated with the tag from its local secure storage unit. Then, it concatenates these three elements in a fixed order: "key data + first random number + second random number," where the first random number is a random value generated and sent by the reader during this authentication process. Figure 2 In the authentication request phase shown, the second random number is a random value returned in the tag response, such as... Figure 2 The authentication response phase is shown. After concatenation, the reader calls a lightweight hash algorithm to process the concatenated data string: this algorithm is optimized based on the SM3 architecture, such as... Figure 4 As shown, it consists of a compression function, an iteration control module, and an output truncation module. The compression function achieves data diffusion through a simplified permutation-replacement network. The iteration control module dynamically adjusts the number of iterations based on the length of the concatenated data to reduce computation. The output truncation module truncates the result to a fixed length consistent with the original key. The hash value obtained is the new lightweight key, which the reader writes to a secure storage unit through atomic operations, ensuring data integrity and consistency during the update process.

[0056] Furthermore, the tag's key update logic is completely synchronized with the reader: the tag retrieves the current key from its built-in non-volatile memory, concatenates the key, the first random number, and the second random number in the same order, and performs calculations using its integrated lightweight hash algorithm, consistent with the reader's algorithm architecture, such as... Figure 4As shown, a new key identical to that of the reader is obtained. Subsequently, the tag writes the new key to memory through atomic operations, replacing the original key. It is important to understand that the lightweight SM3 algorithm's optimized design, such as reducing the number of shifts and parallelizing the round functions to adapt its computational power consumption and storage overhead to the tag's low-power requirements, avoids additional energy consumption.

[0057] The advantage of this embodiment is that by concatenating random numbers and keys in a fixed order and using lightweight optimization algorithms and atomic operations, dynamic updating and synchronization of the key are achieved, ensuring that the key used by the reader and the tag is completely consistent during the next authentication, while also adapting to the low power consumption characteristics of the tag.

[0058] Example 7: To address the risk of spoofing attacks caused by the inability to verify the identity of the reader in traditional RFID authentication, this example adds a unique identifier of the reader to the authentication request, which is used by the tag to identify the identity of the reader initiating the authentication.

[0059] The reader's unique identifier is an unalterable hardware ID pre-programmed by the manufacturer during the production process. This ID includes the manufacturer code, device model, and production serial number, and is globally unique. During the authentication initiation phase, the reader writes this unique identifier into a fixed field in the authentication request data packet. The field's position is predefined by the communication protocol to ensure accurate tag extraction. The authentication request structure is: start bit + reader unique identifier + first random number + check bit, where the check bit is used to verify the integrity of the transmitted identifier data.

[0060] Furthermore, upon receiving an authentication request, the tag first extracts the reader's unique identifier. Then, it retrieves a pre-stored reader whitelist from its built-in non-volatile memory. This whitelist contains unique identifiers of readers the tag is permitted to communicate with, and is written to the tag by the tag owner through a secure channel. The tag compares the extracted identifier with each entry in the whitelist: if a match is found, the reader's identity is confirmed as legitimate, and the subsequent authentication process continues, generating a second random number and calculating the authentication response; if no match is found, authentication is directly rejected, and an error response is returned. It's important to understand that the immutability of the reader's unique identifier is guaranteed by hardware circuitry, ensuring the reliability of authentication and preventing unauthorized readers from initiating authentication by forging identifiers.

[0061] Furthermore, the tag's whitelist supports dynamic updates: when the tag owner needs to add or remove allowed readers, they can send an update command to the tag via a secure communication channel such as encrypted RFID communication. After verifying the command's validity, the tag modifies the built-in whitelist. This dynamic update mechanism adapts to the changing needs of the number of readers in practical applications.

[0062] The advantage of this embodiment is that by adding a unique reader identifier to the authentication request, it provides an initial basis for verifying the reader's identity for the tag, preventing unauthorized readers from impersonating legitimate devices to initiate authentication, and enhancing the security of the authentication process.

[0063] Example 8: To address the problem of insufficient initial randomness caused by the predictability of algorithms in traditional pseudo-random number generators, in this example, the first random number is generated by the true random number generator built into the reader to enhance the initial randomness.

[0064] The reader's true random number generator is designed based on a hardware noise source, specifically using the thermal noise of a diode as the random source—the thermal noise of the PN junction of a diode in reverse bias is unpredictable and unbiased. The true random number generator's structure consists of: a noise source + amplifier circuit + sampling circuit + analog-to-digital converter circuit + post-processing module. The analog noise signal generated by the noise source is amplified by the amplifier circuit and then sampled at a fixed frequency by the sampling circuit. The analog-to-digital converter circuit converts the analog signal into a digital signal. The post-processing module removes bias and correlation from the digital signal through XOR operations and entropy estimation, ultimately generating true random numbers that meet cryptographic requirements.

[0065] like Figure 2 As shown, during the authentication initiation phase, the reader generates a first random number using a true random number generator and then writes it into the authentication request data packet. The length of the random number is defined by security requirements, such as 128 bits, to ensure sufficient randomness. The transmission of the first random number is synchronized with other fields of the authentication request, such as the reader's unique identifier, and the correct transmission order is guaranteed by the communication protocol.

[0066] It's important to understand that the hardware implementation of a true random number generator ensures the unpredictability of the initial random number: unlike pseudo-random number generators that generate numbers through algorithms, true random numbers rely on physical noise and cannot be predicted or copied by algorithms. This unpredictability enhances the security of the initial random number, preventing attackers from cracking subsequent authentication processes by predicting the random number.

[0067] Furthermore, the reader's true random number generator supports real-time entropy detection: if the entropy value of the detected noise source is lower than the threshold, such as due to hardware aging, random number generation will stop and an alarm will be triggered to ensure that the generated random numbers always meet cryptographic requirements.

[0068] The advantage of this embodiment is that by generating the first random number through a built-in true random number generator, the unpredictability of the initial random number is enhanced, providing a basic guarantee for the security of subsequent authentication processes.

[0069] Example 9: To address the problem of insufficient process coordination caused by the fuzzy functional boundaries of modules in traditional two-way authentication systems, this example provides an RFID tag two-way security authentication system. It further refines the module division of the two-way security authentication system and the functional implementation of each module, and clarifies the logical link between the introduction of randomness and identity verification.

[0070] Furthermore, the authentication request sending module is integrated into the reader's communication unit, and it follows... Figure 2 The authentication initiation phase flow shown involves sending a structured authentication request data packet to the tag. This module first obtains a first random number from the reader's built-in random number generation unit. The generation process of the first random number uses a hardware noise source to ensure initial randomness. Subsequently, the first random number is written into a fixed field of the authentication request. The field position is predefined by the communication protocol to ensure accurate tag retrieval. The authentication request structure includes a start bit, the first random number, and a check bit. The check bit is used to verify the integrity of data transmission and prevent the random number from being tampered with during transmission.

[0071] Furthermore, the tag response generation module is deployed within the tag's processing unit. When the tag receives an authentication request, this module first retrieves the pre-stored lightweight key from the tag's built-in non-volatile memory, and then calls... Figure 4 The lightweight hash algorithm shown, based on an SM3-optimized architecture, concatenates a lightweight key and a first random number in a fixed order as input. Data diffusion is achieved through a permutation-replacement network of a compression function. The iteration control module dynamically adjusts the number of iterations based on the input length to reduce computational load, ultimately outputting a first response truncated to a fixed length. Simultaneously, this module activates the tag-side random number generation unit to generate a second random number. This second random number is unpredictable and used for subsequent reader authentication. The generated first response and second random number are encapsulated into an authentication response data packet, according to... Figure 2 The authentication response phase shown in the diagram is sent to the reader to prove the legitimacy of the tag's identity and introduces randomness on the tag side to enhance process security.

[0072] Furthermore, the reader response verification module is located within the reader's secure processing unit. When the reader receives an authentication response, this module first retrieves the lightweight key associated with the tag from its local secure storage unit. Following the same algorithm and concatenation order as the tag response generation module, it recalculates the lightweight key with the first random number to obtain the verification value. The verification value is then compared with the first response sent by the tag; if they match, the tag's identity is confirmed as legitimate. After successful verification, the module, based on the second random number sent by the tag and the locally stored lightweight key, calls... Figure 4The lightweight hash algorithm shown generates a second response. During the generation process, the iteration control module adjusts the number of iterations to adapt to the reader's processing capabilities, and the output is a second response truncated to a fixed length. The generated second response is encapsulated into a verification data packet and sent to the tag to initiate the reader's authentication process.

[0073] Furthermore, the tag response verification module is integrated within the tag's security unit. When the tag receives the second response from the reader, this module retrieves the lightweight key from the tag's storage and recalculates it using the same algorithm and input order as the reader response verification module to obtain the tag's verification value. This verification value is compared with the second response sent by the reader; if they match, the reader's identity is confirmed as legitimate, completing the two-way authentication process. It is important to understand that the storage of the lightweight key complies with the system's security specifications, ensuring that the key cannot be illegally read or tampered with.

[0074] Furthermore, to visually demonstrate the system's defense capabilities against security attacks as described in this embodiment, such as... Figure 6 As shown in the figure, the security strength of one-way authentication, traditional two-way authentication, and the method of this patent is compared at different authentication stages through a time-series evolution diagram. The time-series curves in the figure show that the security strength in the initial authentication stage is higher than that of traditional two-way authentication. This is due to the first random number introduced by the authentication request sending module and the second random number introduced by the tag response generation module. The double randomness design makes it impossible for attackers to predict or copy key data in the authentication process, effectively defending against replay attacks and forgery attacks. In the subsequent key update stage, the security strength of this embodiment is further improved with the dynamic update of the key, which is significantly better than the traditional method. This is because the reader response verification module and the tag response verification module work together, combined with the diffusion characteristics of the lightweight hash algorithm, to ensure the unpredictability of the authentication process. Even if an attacker obtains authentication data in a certain instance, it cannot be used for subsequent attacks.

[0075] The advantage of this embodiment lies in that, by clearly dividing the process into four modules—authentication request sending, tag response generation, reader response verification, and tag response verification—it clarifies the logical relationship between randomness introduction, identity verification, and response generation in the two-way authentication process. Each module is based on... Figure 2 The authentication process shown works in tandem, combining Figure 4 The lightweight hash algorithm shown ensures both efficiency and security in response generation, enabling a modular and standardized design for the two-way authentication system, and improving system maintainability and process collaboration; simultaneously, Figure 6 The security attack defense analysis shown intuitively demonstrates the security strength advantages of the RFID tag two-way security authentication system in this embodiment at different authentication stages, and verifies the effectiveness of dual randomness, lightweight hashing and module collaborative design in defending against attacks such as replay and forgery.

[0076] Example 10: To address the security risks caused by long-term static storage of keys in traditional two-way authentication systems, this example adds a key update module to the RFID tag two-way security authentication system, enabling dynamic key updates and further enhancing the long-term security of the system.

[0077] The key update module is divided into two sub-modules: one on the reader side and one on the tag side. These are integrated into the secure storage unit of the reader and the non-volatile memory control unit of the tag, respectively. After two-way authentication is completed, the reader-side key update module first retrieves the first random number used in this authentication process and the second random number sent by the tag from its local storage. Then, it retrieves the lightweight key currently associated with the tag from the secure storage unit and updates it accordingly. Figure 5 The key update process shown concatenates the lightweight key, the first random number, and the second random number in a fixed order. This concatenation order is predefined by the system to ensure consistency between the reader's and the tag's concatenation logic. After concatenation, the module calls... Figure 4 The lightweight hash algorithm shown performs operations on the concatenated data. During the operation, the compression function uses a permutation-replacement network to diffuse the data. The iteration control module dynamically adjusts the number of iterations based on the length of the concatenated data to reduce the computational load. The output is a new lightweight key truncated to the same length as the original key. Subsequently, the reader-side key update module writes the new key to the secure storage unit through atomic operations, ensuring the integrity and consistency of the data during the update process and preventing the key from being tampered with.

[0078] Furthermore, the tag-side key update module operates entirely in sync with the reader-side logic. After two-way authentication is complete, this module retrieves the current lightweight key from the tag's storage, obtains the first random number (from the reader's authentication request) and the second random number (generated by the tag itself), concatenates these three numbers in the same order as on the reader side, and then uses a lightweight hash algorithm consistent with the reader's architecture to calculate the new lightweight key, identical to the one on the reader side. Subsequently, the tag-side key update module atomically writes the new key into the tag's non-volatile storage, replacing the original key. It's important to understand that the use of atomic operations ensures the atomicity of the key update; either the update succeeds completely, or the original key remains unchanged, preventing authentication failures caused by a partially updated key.

[0079] Furthermore, the key update module is triggered only upon successful two-way authentication. This means the key update process is only initiated after the reader and tag have completed two-way authentication, preventing malicious modification of the key during unauthorized authentication. This triggering mechanism ensures the security of key updates; only legitimate authentication processes can trigger key updates, ensuring that the key changes after each successful authentication and enhancing its resistance to cracking.

[0080] The advantage of this embodiment lies in its ability to dynamically update the key by setting up key update modules in both the reader and the tag. The update process is based on a random number generated during the current authentication, ensuring that the key changes after each authentication and improving its resistance to cracking. Furthermore, the key update module seamlessly integrates with the two-way authentication process. Figure 5 The key update mechanism shown and Figure 4 Figure 5 The lightweight hash algorithm shown ensures the efficiency and security of key updates, is compatible with the low power consumption characteristics of RFID systems, and avoids additional energy consumption.

[0081] Although the present invention has been specifically described above with reference to preferred embodiments, it should be understood that the present invention is not limited to the embodiments described above. Various modifications and variations can be made by those skilled in the art without departing from the spirit of the present invention, and such modifications and variations should fall within the scope defined by the appended claims and their equivalents.

Claims

1. A two-way secure authentication method for RFID tags, characterized by the steps of The method comprises the steps of: The reader sends an authentication request containing a first random number to the tag, which is used to start a two-way authentication process and introduce initial randomness; The tag generates a first response based on the stored tag lightweight key and the first random number using a lightweight hash algorithm, and generates a second random number at the same time, and sends the first response and the second random number to the reader, which is used to prove the legitimacy of the tag identity to the reader and introduce randomness on the tag side; The reader verifies the first response based on the tag lightweight key and the first random number, and after verification, generates a second response based on the tag lightweight key and the second random number, and sends it to the tag, which is used to confirm the legitimacy of the tag and start the authentication of the reader identity; The tag verifies the second response based on the tag lightweight key and the second random number, and after verification, completes the two-way authentication, which is used to confirm the legitimacy of the reader identity.

2. The RFID tag bidirectional secure authentication method of claim 1, wherein, The second random number is generated by a physically unclonable function (PUF) built in the tag, which is used to enhance the unpredictability of the random number, and the expression of the PUF is: wherein R tag represents a second random number generated by the tag for authentication request of the tag to the reader; S sel represents a selection signal generated inside the tag for selecting an oscillator pair to be compared from a plurality of ring oscillators built in the tag; C phy represents a physical fingerprint of the tag for deciding an oscillation frequency of the ring oscillator; RO-PUF represents a lightweight oscillator physical unclonable function.

3. The RFID tag bidirectional secure authentication method of claim 1, wherein, The generation step of the first response is specifically that the tag splices the stored lightweight key and the first random number, and obtains the first response by using the lightweight hash algorithm, which is used to prevent direct exposure of the key.

4. The RFID tag bidirectional secure authentication method of claim 1, wherein, The step of verifying the first response by the reader is specifically that the reader splices the pre-stored tag lightweight key and the first random number, and compares the operation result with the first response by using the same lightweight hash algorithm as the tag, and the comparison result is consistent, then the verification is passed; The step of verifying the second response by the tag is specifically that the tag splices the stored lightweight key and the second random number, and compares the operation result with the second response by using the lightweight hash algorithm, and the comparison result is consistent, then the verification is passed.

5. The RFID tag bidirectional secure authentication method of claim 1, wherein, After completing the two-way authentication, the reader and the tag update the stored lightweight key based on the first random number and the second random number, which is used for next authentication, so as to improve the dynamic security of the key.

6. The RFID tag bidirectional secure authentication method of claim 5, wherein, The updating step of the lightweight key is specifically that the reader and the tag splice the first random number and the second random number, and obtain a new lightweight key by using the lightweight hash algorithm, which is used to replace the original key, and the lightweight hash algorithm is a lightweight optimized SM3 algorithm, which is used to adapt to the low-power computing capability of the tag.

7. The RFID tag bidirectional secure authentication method of claim 1, wherein, The authentication request also contains the unique identifier of the reader, which is used for the tag to identify the identity of the reader initiating the authentication.

8. The RFID tag bidirectional secure authentication method of claim 1, wherein, The first random number is generated by a true random number generator (TRNG) built in the reader, which is used to enhance the initial randomness.

9. An RFID tag bidirectional secure authentication system for implementing the RFID tag bidirectional secure authentication method according to any one of claims 1-8, characterized in that, The method comprises the steps of: An authentication request sending module is arranged in the reader, which is used to send an authentication request containing a first random number to the tag, start a two-way authentication process and introduce initial randomness; The tag response generation module, arranged in the tag, is configured to generate a first response based on a lightweight key stored in the tag and the first random number by using a lightweight hash algorithm, generate a second random number, and send the first response and the second random number to the reader to prove the legitimacy of the tag identity and introduce tag-side randomness. The reader response verification module, arranged in the reader, is configured to verify the first response based on a pre-stored tag lightweight key and the first random number, generate a second response based on the tag lightweight key and the second random number after the verification is passed, and send the second response to the tag to confirm the legitimacy of the tag and start the reader identity authentication. The tag response verification module, arranged in the tag, is configured to verify the second response based on a lightweight key stored in the tag and the second random number, and complete the mutual authentication after the verification is passed to confirm the legitimacy of the reader identity.

10. The RFID tag bidirectional secure authentication system of claim 9, wherein, The key update module is arranged in the reader and the tag, respectively, and is configured to update the stored lightweight key based on the first random number and the second random number after the mutual authentication is completed, so as to improve the dynamic security of the key.

Images