Radio Frequency Identification (RFID) system can be read by radio wave within several metres without having direct contact. Many research focus on improving security and privacy problem. Recently, Rizomiliotis et al. point out that Song-Mitchell protocol is vulnerable to the denial of service attack, since the attacker can easily modify the data to make the server and the tag out of synchronisation without detection. However, this paper pointed out that Rizomiliotis et al.'s modification was not correct. Therefore, we designed a new authentication scheme, which inherits the advantage of Song-Mitchell protocol and Rizomiliotis et al.'s protocol, along with the assumption that the insecure channel exists between the reader and the server. Finally, this paper provides a security analysis to comparison with other protocols.

In the past researches, most of the authentication protocols were designed in an effort to solve the RFID security and privacy problem regarding the encrypted communication between the database and readers, and readers and tags. Based on the proposal of mobile agent device for RFID privacy protection (MARP), some security problems have been exposed. Later on, protecting the privacy with a mobile agent device in RFID environment (eMARP) has shown improvement on MARP. The mobile agent device provides more powerful computation than the tag, in addition to the privacy protection along with the forgery detection. However, we found out that the authentication protocol of eMARP could not resist location tracking. Therefore, we will discuss and demonstrate that the eMARPbased RFID system doesn't have ability to achieve location tracking in this paper. We have improved the authentication protocol of eMARPbased RFID system and also have eliminated its vulnerability.

No abstract

The proxy agent is one of the approaches to solve security and privacy problems in a radio-frequency identification (RFID) system. In this paper, we will show that the mobile agent device in RFID environment reported by Yeo et al. has some security vulnerabilities, such as tracking and cloning. The adversary could easily eavesdrop, infer, and access the value to track and clone the tag.

No abstract