TOA: a tag‐owner‐assisting RFID authentication protocol toward access control and ownership transfer

Abstract

This paper addresses radio frequency identification (RFID) authentication and ownership transfer in offline scenarios. Four typical related works are reviewed in detail. A series of shortcomings and vulnerabilities of them are pointed out. A new RFID authentication protocol based on a novel tag-owner-assisting architecture is proposed, making a tag's owner an essential participant of the RFID authentication process. The proposed protocol is distinguished from existing works in providing ownership transfer, access control, and mutual authentication without any centralized database neither on a backend server nor in a reader. The security of the proposed protocol is verified by using automated validation of Internet security protocols and applications tool. The proposed protocol is server-less, simple, scalable, untraceable, and device-independent. These features are simultaneously achieved in a single RFID authentication protocol for the first time.

RFID Applications and Security Review

“…This access control can be performed by applying frameworks to stop unauthorized readers from accessing tags that could result in unauthorized access to stored information [166]. In the same way, when the access needs to be limited to the right stakeholders and systems, different methods have been investigated, for example, asymmetric keys for mutual authentication [167], digital signature systems [168], role-based access applied to the readers [169], or using protocols based on the ownership of the tags [170]. In the past, systems have been breached, such as the case of the cloning of MiFare Passes [171].…”