A study on scalable and untraceable authentication protocol of RFID tags

Abstract

RFID (Radio Frequency IDentification) is recently becoming popular, and plays definitely an important role in moving to ubiquitous society due to deploying its convenience and economic efficiency. Furthermore, RFID nowadays comes into the spotlight as a technology to substitute the barcode system since RFID can solve several problems in the barcode system: (1) to require line of sight for scanning, (2) no read/write capability including limited capacity for encoding information, (3) opportunities of human error, and more problems in [48, 45]. RFID is expected to achieve unlimited economic gain. For example, in case that one billion of tagged items are sold by consumer product manufacturers, then a difference of one cent between tags and the barcode can give ten million dollar economic gain since tags can be attached to any kinds of items [42]. RFID technology, on the other hand, is jeopardized from various attacks and problems preventing widespread RFID deployment: replay attack, spoofing, traceability, desynchronization, scalability, and tag cloning. We focus ourselves on untraceabily and scalability in this thesis. We give the reason why untraceability and scalability is important to deploy RFID widely. To prevent an adversary from tracing tagged item is most important in RFID system since it infringes personal privacy. For example, in [49], Albrecht who organized a Benetton boycott called RFID tags “spy chips” due to the traceability of tags. And moreover, tags with unique ID can be associated with a personal identity. Garfinkel $\It{et al}$. [12] dealt with personal privacy threats as follows: action, association, location, preference, constellation, transaction, and breadcrumb threat. There must be a trade-off between scalability and untraceability. However, we try to keep the constant computational time in back-end server regardless of the number of tags when designing an untraceable protocol. If a response from $\It{T}$, as an example, does not inc...