Privacy-Preserving Authentication Protocol (Current Design)

4.4 Privacy-Preserving Authentication Protocol (Current Design)

Set-up Phase
In order to protect data against eavesdropping attack, each smart tag is preloaded with another secret identifier, μ, generated distinctly at each session. In order to reduce the computational cost on the tag side, points parameter, including < α × u ⋅ λ,β_u,1,β_u,0 >, were pre-computed and hard-coded in the source code on tag side. Therefore, it is necessary to have a data structure to maintain such list of points and provide efficient look-up.

(x)	= A_u′(x) - μ
	= s_u ⋅ A(x,u) - - μ
(x)	= B_u′(x) - μ
	= s_u ⋅ B(x,u) - - μ
α_u	= α × s_u
β_u,1	= α ⋅λ⋅ (( ⋅ c₁ + ⋅ d₁) + (d₁ + c₁) ⋅ μ)
β_u,0	= α ⋅λ⋅ (( ⋅ c₀ + ⋅ d₀) + (d₀ + c₀) ⋅ μ)

Communication Phase
Each transmission starts, when the reader first sends a random session nonce, γ₀ to the tag. After receiving data from reader, the tag generate a random session nonce of its own, called γ₁, and hash the concatenations of these two random session. That is, γ₂ = H(γ₁|γ₀). Last, the tag sends back a packet of data < γ₁,λ ⋅ A¯u (γ₂),λ ⋅ B¯u (γ₂),α_u ⋅ λ,β_u,1,β_u,0 > to reader side.

Authentication Phase
With the carefully selected coefficients, the authentication process could be achieved by checking the following equality, as shown in the figure 3 below⁷:

	α × C(γ2) ⋅λ⋅(γ2) + α ××D(γ2) ⋅λ⋅(γ2) + β_u,1 ⋅γ2 + βu,0
=	α × C(γ2) ⋅λ⋅ (s_u ⋅ A(γ2,u) - -μ)
+	α × D(γ2) ⋅λ⋅ (s_u ⋅ B(γ2,u) - -μ)
+	α ×λ⋅ ⋅ c₁ + ⋅ d₁ + (c₁ + d₁) ⋅μ⋅γ2
+	α ×λ⋅ ⋅ c₀ + ⋅ d₀ + (c₀ + d₀) ⋅μ
=	α × s_u ⋅λ⋅C(γ2) ⋅ A(γ2,u) + D(γ2) ⋅ B(γ2,u)
=	α × s_u ⋅λ⋅ E(γ2)	(Equation 6)

Figure 3:

Privacy-Preserving Authentication Protocol

4.4.1 Security Analysis

Resistance against Tag Compromise Attack
This scheme inherit the resistance against tag compromise attack from the previous scheme. In order to disturb the coefficients in the secret functions A(x,u) and B(x,u), we have introduced four tag-based parameters, s_u, a¯u , b¯u ,μ. The following shows that this scheme can defend against k-tag compromise attack.

Tag 1:
…
Tag k:

There are also 4k equations, however, the unknown variable has turned into
{u ,...,u ,s ,...,s ,a ,...,a ,b ,...,b ,μ ...μ ,a ,a ,a ,a ,b ,b ,b ,b }
◟-1------k-u1------uk--u1-----uk--u1-----u◝k◜---u1----uk--00-01--10--11-00--01--10--11◞

_{(5k+8) unknowns}. Since there is no other way to solve a linear system where the number of unknown variables is grater than the number of equation. Therefore, the system is secure.

Resistance against Eavesdropping Attack
Introduce a session based random, μ. If an eavesdropper had been monitoring for k successful sessions,

Session 1:
…
Session k:

In this imported scheme, there are still 2k equations, but the number of unknowns has increased to {◟x1,...,xk,μ1,..◝.◜,μk,u,su, ¯au, ¯bu}◞

_{(2k+4) unknowns}. Thus, the system is secure.

Resistance against Brute Force Attack
If an adversary attempts to exhaustively break the data, <

(γ₂),

(γ₂) >, transmitted from a user smart tag, he may find it to be a desperate approach. First, γ₂ is a 160-bit hashed value. Second, the bit length of both function output depends on the size of the finite field, which is around 2¹⁶⁰ in our implementation.
Resistance against Replay Attack
Another common approach for an attacker is to overhear the communication, and replay the authentication data in the past session. Nevertheless, this attack will not be effective, because γ₂ is defined to be session-distinctly different from time to time.
Resistance against Reader Compromise Attack
If an attacker has compromised the reader, then Ĉ(x),

(x),E(x) are compromised. Due to the NP-hard ECDLP problem, it is computationally infeasible to find out the secret coefficients, such as c₁,c₀,d₁,d₀. In addition, without those coefficients, knowing E(x) would not help to compute any user’s secret functions, A(x,u)andB(x,u) that satisfy the equality for authentication. Therefore, it is impossible to impersonate an innocent smart tags in finite time.

[next] [prev] [prev-tail] [front] [up]