Tamper-Resistant RFID Usage Metering via Hash Chain Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for tracking device usage, particularly in power-constrained embedded wireless devices, are vulnerable to tampering, leading to 'lifecycle-extension attacks' where usage data is falsified, posing safety hazards, especially in medical devices, without adequate protection against counter manipulation.
Innovation Solution
A cryptographically secured monotonic counter system using hash chains is implemented in RFID tags, allowing secure incrementing and verification of usage data without special-purpose hardware, ensuring tamper-resistance and integrity protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If standard NFC/RFID tags are used for lifecycle tracking, then power consumption and hardware requirements are reduced, but the device becomes vulnerable to tampering and lifecycle-extension attacks
Solution Approach 1:
The system divides the tracking function into two parts: a simple counter stored in the low-power RFID tag and a verification mechanism using hash chains stored externally. The tag only needs to store and transmit the counter value and hash chain, while the verification is performed by external readers, thus maintaining low power consumption while ensuring data integrity through cryptographic verification.
Solution Approach 2:
The patent introduces hash chains as an intermediary mechanism between the counter and the verification system. The hash chain acts as a cryptographic mediator that links counter values across time, allowing external readers to verify the integrity of usage data without requiring the RFID tag to have complex security hardware or consume additional power.
2Reliability
If hardware-enforced monotonic counters (e.g., TPM) are used, then protection against lifecycle-extension attacks is improved, but device cost and complexity increase
Solution Approach 1:
The patent extracts the complex verification functionality from the RFID tag and places it in external readers. The tag itself remains simple, storing only the counter and hash chain values, while the computationally intensive hash verification is performed externally, thus achieving strong security without adding complexity to the constrained tag device.
Solution Approach 2:
Instead of implementing complex security hardware in the tag, the system uses cryptographic copies (hash values) of the counter state stored in the tag. These hash chain values serve as verifiable copies of the usage state that can be authenticated by external readers without requiring the tag to contain sophisticated security mechanisms.
3Reliability
If password protection or access controls are implemented in RFID tags, then some protection against manipulation is achieved, but determined attackers can still abuse access rights to manipulate lifecycle data
Solution Approach 1:
The system performs preliminary cryptographic preparation by establishing hash chains before usage begins. The hash chain is pre-computed and stored in the tag, creating a predetermined sequence of verifiable states. This preliminary action ensures that any subsequent manipulation can be detected during verification, preventing lifecycle-extension attacks even if access controls are compromised.
Solution Approach 2:
The patent converts the limitation of simple RFID tags (lack of security hardware) into a benefit by using their simplicity as a security feature. The unidirectional hash function's one-way property is used to create a verification mechanism where the tag's inability to perform complex operations actually prevents certain types of attacks, as the security relies on mathematical properties rather than hardware enforcement.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Systems and methods are described for providing a secure counter that is resistant to rollback attacks. In an exemplary embodiment, a tag memory, such as an RFID or NFC tag, is provided with a counter value, a verification value, and a digitally signed hash chain head value. The tag is initialized with a counter value of zero and a random initial verification value. The hash chain head value is initialized by applying a cryptographic hash function to the initial verification value a predetermined number of times. The counter is updated by incrementing the counter value and applying the hash function to the verification value. The counter is verified by determining the number of times the hash function must be applied to the verification value to reach the hash chain head value. Embodiments using a plurality of sub-counters are also described.