4.3 The Security Enhanced Protocol

Set-up Phase
In order to protect the secret function A(x,u) and B(x,u), we need to introduce several variables in the system, s_u,,,λ. The tag-specified secret variables s_u,, are established at the time when the RFID tag was manufactured, while λ were randomly chosen at each transmit session. In order to reduce the computational cost on the tag side, points parameter, including α_u,β_u,1,β_u,0, were pre-computed and pre-loaded in the code at tag-creation time. Therefore, it is necessary to have a data structure to maintain such list of points and provide efficient look-up.

Thus, each smart tag is preloaded with a secret identifier, u, and two polynomial functions:

Au′(x)	= su ⋅ A(x,u) -
	= su ⋅ Au,1 ⋅x + su ⋅ Au,0 -
Bu′(x)	= su ⋅ B(x,u) -
	= su ⋅ Bu,1 ⋅x + su ⋅ Bu,0 -
αu	= α × su
βu,1	= α ⋅λ⋅ ( ⋅ c1 + ⋅ d1)
βu,0	= α ⋅λ⋅ ( ⋅ c0 + ⋅ d0)

Communication Phase
The reader initiates the communication by sending a random session nonce, γ₀ to the tag. After receiving data from reader, the tag responses a random session nonce of its own, called γ₁, and hash the concatenations of these two random session. That is, γ₂ = H(γ₁|γ₀). Following by that, the user computes its secret function given γ₂. Last, the tag sends back a packet of data < γ₁,λ ⋅ A_u′(γ₂),λ ⋅ B_u′(γ₂),α_u ⋅ λ,β_u,1,β_u,0 > to reader side.

Authentication Phase
With the carefully selected coefficients, the authentication process could be achieved by checking the following equality, as shown in the next figure 2⁶:

	Ĉ(γ2) ×λ⋅ Au′(γ2) + (γ2) ×λ⋅ Bu′(γ2) + βu,1 ⋅γ2 + βu,0
=	α × C(γ2) ⋅λ⋅ (su ⋅ A(γ2,u) -)
+	α × D(γ2) ⋅λ⋅ (su ⋅ B(γ2,u) -)
+	α × su ⋅λ⋅ ( ⋅ c1 + ⋅ d1) ⋅γ2
+	α × su ⋅λ⋅ ( ⋅ c0 + ⋅ d0)
=	α × su ⋅λ⋅C(γ2) ⋅ A(γ2,u) + D(γ2) ⋅ B(γ2,u)
=	α × su ⋅λ⋅ E(γ2)			(Equation 6)

4.3.1 Security Analysis

Resistance against Tag Compromise Attack
In order to obfuscate the coefficients in the secret functions A(x,u) and B(x,u), we use three tag-based parameters, s_u,,. Similarly, the attack could retrieve 4 pieces of information for each tag. However, this scheme can successfully defend against k-tag compromise attack, and following equations will tell you why.

Tag 1
	…
Tag k

Session 1
…
Session k