采用云和PUF的轻量级RFID双标签认证协议  

Lightweight RFID dual-tag authentication protocol using cloud and PUF

作　　者：艾璐琳 常正泰 范文兵[1] 孔德涵 AI Lulin;CHANG Zhengtai;FAN Wenbing;KONG Dehan(School of Electrical and Information Engineering,Zhengzhou University,Zhengzhou 450001,China)

机构地区：[1]郑州大学电气与信息工程学院,河南郑州450001

出　　处：《西安电子科技大学学报》2023年第1期177-191,共15页Journal of Xidian University

基　　金：国家自然科学基金(61306106);河南省科技攻关项目(192102210086);郑州市黄河人才计划(郑发2020年14号)。

摘　　要：针对医药系统中药品和说明书同时认证的应用需求,提出一种快速双标签身份认证方案。该方案引入云服务器和物理不可克隆函数,确保了射频识别系统的可扩展性和标签的不可克隆性。针对传统射频识别系统逐一认证双标签效率较低的问题,提出一种双标签响应合并流程;针对物理不可克隆函数引发的系统错误认证问题,计算了物理不可克隆函数响应的最佳认证阈值,以降低系统的认证错误率;针对云服务器的不可信问题,提出3种超轻量级位流函数以实现两种加密机制,从而保护前向信道免受云服务器隐私泄露的威胁。安全分析表明,快速双标签身份认证协议可满足标签匿名性和不可追踪性,并能有效地抵抗克隆攻击、去同步化攻击、重放攻击等恶意攻击。此外,使用BAN逻辑分析和AVISPA工具,进一步验证了协议的安全性。与近期的认证协议相比,快速双标签身份认证协议的服务器搜索耗时最短,在满足各项安全属性的同时,以近似单标签的资源开销实现了对双标签的快速认证,适用于资源受限的大规模双标签认证场景。Focusing on the simultaneous authentication of drugs and instructions in the medical system,a rapid dual-tag authentication scheme(CP-LRDP)is proposed,which introduces a cloud server and PUF to ensure the scalability of the RFID system and the unclonability of tags.Aiming at the problem of sequential dual-tag authentication with a low efficiency in a traditional RFID system,a dual-tag response merging process is proposed.For the system error authentication problem caused by the PUF,the optimal authentication threshold of the PUF response is calculated to reduce the authentication error rate of the system.To solve the untrusted problem of the cloud server,three ultra-lightweight bitstream functions are proposed to implement two encryption mechanisms for protecting the forward channel from the threat of cloud server privacy leakage.Security analysis shows that the CP-LRDP not only satisfies the tag anonymity and untraceability,but also can effectively resist cloning attacks,desynchronization attacks,replay attacks and other malicious attacks.In addition,BAN logic analysis and the AVISPA tool are used to further verify the security of the protocol.Compared with recent authentication protocols,the CP-LRDP with the shortest server search time not only meets various security properties,but also realizes achieving rapid dual-tag authentication with resource costs similar to those of single-tag,which is suitable for resource-constrained large-scale dual-tag authentication scenarios.

关 键 词：射频识别 双标签 云服务器 物理不可克隆函数 BAN逻辑分析 AVISPA工具 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]