No abstract

Owing to the low cost and convenience of identifying an object without physical contact, Radio Frequency Identification (RFID) systems provide innovative, promising and efficient applications in many domains. An RFID grouping protocol is a protocol that allows an off-line verifier to collect and verify the evidence of two or more tags simultaneously present. Recently, Huang and Ku (J. Med. Syst, 2009) proposed an efficient grouping protocol to enhance medication safety for inpatients based on low-cost tags. However, the Huang-Ku scheme is not secure; an attacker can easily make up fake grouping records to cheat the verifier. This weakness would seriously endanger the safety of inpatient medication safety. This paper will show the weaknesses, and then propose two RFID-based solutions to enhance medication safety for two different scenarios. The proposed schemes are practical, secure and efficient for medication applications.

No abstract

No abstract

This paper focuses on two interesting radio-frequency identification (RFID) cryptographic protocols: the server-less RFID authentication protocol that allows readers to authenticate tags without the help of any online backend servers, and the RFID searching protocol in which the verifier explicitly specifies the target tag to be searched and authenticated. These two kinds of RFID protocols play important roles in many RFID applications; however, the existing protocols either had security weaknesses or exhibited poor efficiency. This paper shows the weaknesses, and then proposes our server-less RFID authentication protocol and RFID searching protocol. The proposed protocols greatly enhance the security using one more hashing.Conventional RFID authentication protocols are based on the 'central database model ' [13], where the system consists of three kinds of entities-backend server, readers and tags, and readers authenticate tags via the help of online servers. This model makes sense for many application scenarios, but it cannot cover some other scenarios. Tan et al.[13] listed one example. A trucker is dispatched to an off-site location to collect some merchandize labeled with RFID tags. He has an RFID-reader-embedded PDA, but the communication quality cannot ensure the connection to the backend server. A simple solution is to let the driver download all the data into his PDA from the central database before he heads for his destination. However, unlike a stationary server which can be well protected, a portable and mobile device like PDA might be stolen and the secrets inside could be used to forge the tags (the products) and violate the privacy. Therefore, Tan et al. proposed another solution-server-less RFID authentication whose portable and mobile device is loaded with some reader-specific secrets to enable it to authenticate tags but an adversary still cannot use the inside data from a compromised reader to forge tags (products). Later Lin et al. [15] proposed their server-less RFID authentication to improve the computational performance. But, we find that the two previous schemes shared the same weaknesses: they only provided unilateral authentication instead of mutual authentication, and Lin et al.'s scheme is vulnerable to impersonation attack.RFID searching protocol is an RFID cryptographic protocol that allows a verifier to search for a specific tag among many tags. It is interesting and important, but it did not attract too much attention from the research community earlier. The conventional RFID authentication protocol does not specify any specific tag to be authenticated when the reader broadcasts its probe, whereas an RFID searching protocol explicitly specifies which tag it is interested in its probe. Suppose we want to find a specific product with a labeled tag in a warehouse where there are N tags. Without RFID searching protocol, a user should authenticate all the N tags one-by-one first and then try to filter out the target tag. The complexity of authentication and filtering is O(N ). It is ver...