A PUF-Based Authentication Protocol to Address Ticket-Switching of RFID-Tagged Items

Mauw, Sjouke; Piramuthu, Selwyn

doi:10.1007/978-3-642-38004-4_14

Cited by 16 publications

(11 citation statements)

References 24 publications

(34 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Hardware-based solutions(e.g., a Physical Unclonable Function (PUF)-based authentication [41] ) Detect abnormal nodes [3] An IoT object should have a technique to detect abnormal nodes and activities IDS techniques (e.g., a method based on Markov model [42]) Prevent node replication [3] An IoT should have a method to safeguard its identification number…”

Section: Purpose Implementation Techniquesmentioning

confidence: 99%

A Novel Methodology for Securing IoT Objects Based on their Security Level Certificates

Abdulghani¹,

Konstantas²,

Nijdam³

2020

Preprint

View full text Add to dashboard Cite

Internet of Things (IoT) provides a huge business value for customers, organizations, and governments due to the developments of so many applications in different sectors like energy and healthcare. Nevertheless, as a new emerging technology, IoT faces several security concerns that are more challenging than conventional Internet because of its limited resources as well as its complex ecosystem. Toward this end, we first highlight IoT security challenges and briefly discuss its security goals like confidentiality and integrity. Second, we discuss the most common attacks against IoT, along with their violated security goals. We also review the existing frameworks of security and privacy guidelines for IoT and illustrate their shortcomings. Third, we propose a novel framework for securing IoT objects, the key objective of which is to assign different Security Level Certificates (SLCs) for IoT objects based on their hardware capabilities and protection measures. Objects with SLCs, therefore, will be able to communicate with each other or with the Internet in a secure manner. The proposed framework is composed of five main phases. In phase 1, we classify IoT assets into four components: (i) physical objects, (ii) protocols, (iii) data at rest, and (iv) software, which includes operating systems, middlewares, and applications. We also classify IoT objects into five categories based on their hardware capabilities. In phase 2, we propose security and privacy guidelines for previously mentioned IoT assets, along with their protection measures. In phase 3, we classify protection measures into five SLCs, and then we assign different SLCs for IoT objects. In phase 4: we develop a communication plan between objects based on their SLCs. In phase 5, we propose a four-step method to seamlessly integrate our objects with legacy objects ( objects are not developed according to our framework). Fourth, the feasibility and application of this framework are illustrated using smart homes as a case study. Finally, we investigate how our framework would lessen several attacks and threats against IoT like routing attacks and physical damage. We also provide qualitative arguments to show that this framework could be utilized to solve some of IoT security challenges such as tight resource constrains. Moreover, we discuss the shortcomings of our suggested framework.

show abstract

Section: Purpose Implementation Techniquesmentioning

confidence: 99%

A Novel Methodology for Securing IoT Objects Based on their Security Level Certificates

Abdulghani¹,

Konstantas²,

Nijdam³

2020

Preprint

View full text Add to dashboard Cite

show abstract

“…Since a price sticker is affixed or attached on the item, it is easy to switch, but the priceswitched item has a positive probability of being discovered by knowledgeable check-out personnel. Ticket-switching is difficult to accomplish with RFID since (a) unlike printing a cheap item's bar code, it is difficult to copy/clone (e.g., [14]) the content of the cheap item's RFID tag and (b) the tag may be embedded in the item. Moreover, the customer cannot switch the RFID tag from an already-purchased cheap item since the system knows that that tagged item was already purchased from the store -i.e., can't buy the same (unique coded) item more than once.…”

Section: Ticket-switchingmentioning

confidence: 99%

“…The research publications that discuss ticket-switching that we are aware of include [4,5,14,25,26]. However, all but the last of these publications consider different (e.g., video analysis, cryptography) means to address ticketswitching through deterrence, prevention, or recognition as it occurs.…”

Section: Ticket-switchingmentioning

confidence: 99%

“…Ticket-switching is the process of switching the ticket or item identifier on an expensive item with that from a (relatively) cheap item with the explicit intention of 'purchasing' the expensive item but paying only the cheap item's price [14,25]. A ticket-switching incident manifests different impacts on actual in-store inventory and the retail store's inventory information system.…”

Section: Introductionmentioning

confidence: 99%

“…However, very few stores (e.g., Trasluz, American Apparel) currently have 100% store-wide item-level RFID tags in place, while several other retailers have only a few products (e.g., shoes at Macy's, Wrangler jeans at Wal-Mart, Levi's jeans at Kohl's) with item-level RFID tags. Nevertheless, complete store-wide item-level RFID tags may not necessarily eliminate ticket-switching incidents (e.g., [14]). …”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations