A Privacy Preserving Improvement for SRTA in Telecare Systems

A Privacy Preserving Improvement for SRTA in Telecare Systems

 

Abstract

Radio Frequency Identification (RFID) is a modern communication technology, which provides authentication and identification through a nonphysical contact. Recently, the use of this technology is almost developed in healthcare environments. Although RFID technology can prepare sagacity in systems, privacy and security issues ought to be considered before. Recently, in 2015, Li et al. proposed SRTA, a hash-based RFID authentication protocol in medication verification for healthcare. In this paper, we study this protocol and show that SRTA protocol is vulnerable to traceability, impersonation and DoS attacks. So it does not provide the privacy and security of RFID end-users. Therefore, we propose an improved secure and efficient RFID authentication protocol to enhance the performance of Li et al.’s method. Our analyze show that the existing weaknesses of SRTA’s protocol are eliminated in our proposed protocol.

Keyword: RFID Authentication protocol, Privacy, Security, Telecare, Traceability attack, DoS attack, Impersonation attack.

1. Introduction

Radio Frequency Identification (RFID) technology has outlined a novel future for our world. Aviation, building management, financial services, livestock and animal tracking, marina, passenger transport, supply chain, rail way and health-care are some examples of RFID usages which describe the variety of  its application in our life [1-4]. Nowadays, the increased utilization of RFID systems in healthcare has been grown substantially, for instant patient tracking, wait-time monitoring, medication authentication and control asset management, docum-

main parts: tag, reader and back-end server. The tag is placed inside the products or the proposed items, for authentication and identification in contact with the readers. Tags are categorized in one of the three classes: active, passive and semi-active. A passive tag does not have any battery, so it cannot start a new connection unless locates in the electromagnetic field of the reader, to gain enough power for transmitting its messages. An active tag normally operates at 433MHz Ultra High Frequency (UHF) and has an inner battery which lets it to start a new conversation with the reader whenever it wants; Of course these properties increase the cost and the volume of this type of tags which constrain its usage in military applications, at microwave and ultra-wide band frequency ranges [7]. A semi-active tag has a battery, which only uses it to perform internal operations; rely on the reader’s signal to power their antenna and modulator [8]. The back-end server connects to the readers through the secure or unsecure channels and stores all the identification information of the readers and the tags in its database for further processing.

“98000 people annually die due to medication related mistakes in the United States,” reported by the Institute of Medicine (IOM) [9] which is the result of three main facts: similarity in the name of medicine, packing  and  types  of  labels  [10].  Nowadays, in

F:SalmanunivSRBIThesisPaperPaper2- Lipicrfid sys tmis2.png

Figure 1. RFID system

order to establish confidentiality and privacy, and solve the problems of existing methods, new protocols have been proposed [11]; According to the state of the IOM, a number of those are specifically considered for Telecare Medicine Information System (TMIS). It is undeniable that an efficient RFID security scheme can increase the security and privacy of RFID end-users significantly [12].

In 2011, Chen et al. [13] proposed a tamper resistant prescription RFID access control protocol for different certified readers where both authentication and access right authorization mechanisms were and it was claimed to guarantee patient’s right. In the same year, a new hash-based RFID mutual authentication protocol was proposed by Cho et al. [14]; they believe that their protocol makes it difficult for an attacker to launch an effective brute-force attack against RFID users. But Kim et al. [15] showed that Cho et al.’s protocol is weak against desynchronization attack and proposed a hash-based mutual authentication protocol to solve the security problems in Cho et al.’s protocol and privacy problems in previous RFID authentication protocols. In 2012, Yu et al. proposed a grouping proof protocol [16] for low cost RFID tags and showed that not only the number of logic gates in their protocol was reduced but also it requires fewer computational power and operation costs versus the last proposed protocol. In the same year, Wu et al. [17] showed that Yu et al.’s protocol was still vulnerable to impersonation attacks and proposed a lightweight binding proof protocol to overcome their weaknesses.

Srivastava et al. [5] proposed a protocol in 2015 to strengthen the security level of common protocol, using hash algorithm and synchronized secret value shared between the tag and the back-end server; which was believed to be safe against various active and passive attacks. However, Li et al. [6] showed in SRTA (Secure RFID Tag Authentication) protocol that Srivastava et al.’s tag authentication protocol has security problem which let an adversary use the lost reader to connect to the medical back-end server. Moreover, they believe that Srivastava et al.’s protocol fails to provide mutual authentication between the reader and the back-end server, so they have proposed a secure and efficient RFID tag authentication protocol to overcome the mentioned weaknesses.

In this paper, we analyze the SRTA protocol [6] and show that there are still weaknesses with their protocol. Using timestamp in the structure of their protocols was the novelties of Srivastava et al. and Li et al. which prevents data forgery and replay attacks. However, we show that declaring timestamps explicitly through the protocol in one hand and inaccuracy in producing the messages on the other hand, lead to the tag impersonation and reader impersonation attacks. Moreover, expressing the reader and tag’s identification values through the authentication phases and lack of appropriate updating procedure put the privacy of their protocol at risk. In order to investigate the privacy of this protocol, we use Ouafi and Phan privacy model [18] and by consuming the mentioned vulnerabilities, we present the tag and reader traceability attacks on SRTA protocol [6]. Besides, it should be known that low cost of RFID’s tag results in computation and complexity restrictions in the tag side, but this restriction is not so serious in the back-end server due to the presence of powerful processors [12]. Therefore, we propose an improved version of SRTA protocol [6] that prevents the mentioned attacks and decreases the computation cost in the tag side.

The rest of the paper is organized as follows: the privacy model of Ouafi and Phan is described in Section 2. SRTA protocol is reviewed in Section 3. In Section 4, SRTA protocol is analyzed and its weaknesses are discussed. An improved version of Li et al.’s protocol is proposed in Section 5 and analyzes of our improved version are discussed in Section 6. Finally, the paper is concluded in Section 7.

2. Privacy model of Ouafi and Phan

Providing a confidential communication for RFID users is one of the main goals of each RFID communications scheme. As a result, studying privacy of the proposed authentication protocols always is more prominent for researchers [19, 20]. In order to evaluate the privacy of RFID protocols, different models have been proposed, and one of the appropriate and well-known model is Ouafi and Phan privacy model [18], which is described in this section. It is an Untraceable Privacy (UPriv) model which can briefly mentioned as follows:

The reader

Rand the tag

Tare the components of the model and the communications between all protocol parties are managed by an adversary

A, based on the protocol definition. The following queries can be run by an adversary

A:

∎Execute R,T,i query

: This query is categorized as passive attack and let the attacker

Aeavesdrop the transmitted messages between the reader

Rand the tag

Tin the

ith session of the protocol.

∎Send U,V,i,mquery

: An active attack is modeled with this query by sending the message

mfrom the

U∈tag

T(reader

R) to the

V∈reader

R(tag

T) in the

ith session of protocol. Besides, the adversary

Acan alter or block the exchanged messages.

∎Corrupt T,k query

: The attacker

Ais able to obtain

K’, the secret value of the tag

Tand set it to

K.

          Back-end Server                                                     Reader                                                           Tag

 

(IDk, Vk, Wk,xj,

xj-1,

sj,

sj-1,

RIDk)

xj,RIDk                                                     

sj,IDk

4.1
Place your order
(550 words)

Approximate price: $22

Calculate the price of your order

550 words
We'll send you the first draft for approval by September 11, 2018 at 10:52 AM
Total price:
$26
The price is based on these factors:
Academic level
Number of pages
Urgency
Basic features
  • Free title page and bibliography
  • Unlimited revisions
  • Plagiarism-free guarantee
  • Money-back guarantee
  • 24/7 support
On-demand options
  • Writer’s samples
  • Part-by-part delivery
  • Overnight delivery
  • Copies of used sources
  • Expert Proofreading
Paper format
  • 275 words per page
  • 12 pt Arial/Times New Roman
  • Double line spacing
  • Any citation style (APA, MLA, Chicago/Turabian, Harvard)

Our Guarantees

Money-back Guarantee

You have to be 100% sure of the quality of your product to give a money-back guarantee. This describes us perfectly. Make sure that this guarantee is totally transparent.

Read more

Zero-plagiarism Guarantee

Each paper is composed from scratch, according to your instructions. It is then checked by our plagiarism-detection software. There is no gap where plagiarism could squeeze in.

Read more

Free-revision Policy

Thanks to our free revisions, there is no way for you to be unsatisfied. We will work on your paper until you are completely happy with the result.

Read more

Privacy Policy

Your email is safe, as we store it according to international data protection rules. Your bank details are secure, as we use only reliable payment systems.

Read more

Fair-cooperation Guarantee

By sending us your money, you buy the service we provide. Check out our terms and conditions if you prefer business talks to be laid out in official language.

Read more