TELKOM
NIKA
, Vol.13, No
.3, Septembe
r 2015, pp. 1
054
~10
6
1
ISSN: 1693-6
930,
accredited
A
by DIKTI, De
cree No: 58/DIK
T
I/Kep/2013
DOI
:
10.12928/TELKOMNIKA.v13i3.1440
1054
Re
cei
v
ed
De
cem
ber 2
6
, 2014; Re
vi
sed
April 20, 201
5; Acce
pted
May 11, 20
15
SLRV: An RFID Mutual Authentication Protocol
Conforming to EPC Generation-2 Standard
Mu’a
w
y
a Na
ser
1
*, Ismat Aldmour
2
, Rahmat Budia
r
to
2
, Pedro Peris-Lo
pe
z
3
1
Khalifa C
i
t
y
W
o
mens C
o
ll
eg
e
,
Higher C
o
ll
eg
e of
T
e
chnol
og
y HCT
, Abu Dh
abi, UAE
2
Colle
ge of Co
mputer Scie
nc
e and Inform
ati
on T
e
chnol
og
y, Albaha U
n
iv
e
r
sit
y
,
P.O. Box
1998 Albaha, Kin
gdom of Saudi Arabia
3
Computer Sec
u
rit
y
L
ab (COS
EC), Compute
r
Science D
e
partment, Carlos III
Univer
sit
y
of Madrid, Spa
i
n
*Corres
p
o
ndi
n
g
author, e-ma
i
l
: mua
w
ya.a
lda
l
aie
n
@
h
ct.ac.ae
A
b
st
r
a
ct
Havin
g
don
e a
n
an
alys
is o
n
t
he sec
u
rity vu
l
nera
b
il
ities of Radi
o
F
r
e
que
n
cy Identific
atio
n (RF
I
D)
throug
h a d
e
sy
nchro
n
i
z
a
t
i
on
and
an i
m
p
e
rs
onati
on attacks
, it
is reveale
d
that the secret
infor
m
atio
n (i.
e
.:
secret key
an
d
static i
dentifi
e
r) s
hare
d
betw
een
the t
ag
an
d the
rea
der
is
un
necess
a
ry.
T
o
overc
o
me t
h
e
vuln
erab
ility, t
h
is
pap
er i
n
tr
oduc
es S
hel
le
d L
i
ght
w
e
i
ght
Ra
ndo
m Va
l
ue (S
LRV)
pr
otocol;
a
mutual
authe
nticati
on
protoco
l
w
i
th hi
gh-se
c
u
rity pot
entia
ls conf
ormi
ng to
electr
onic
prod
uct c
ode (EP
C
) Cl
a
ss-1
Generati
on-
2
T
ags, base
d
on l
i
ghtw
e
i
ght
and sta
n
d
a
rd
cryptogra
phy
on the t
a
g
’
s
and r
ead
er
’
s
side,
respectiv
e
ly. S
L
RV pr
unes de-synchr
oni
z
a
t
i
on atta
cks where the updating of
in
ternal values is
only
execute
d
o
n
t
he ta
g
’
s si
de
and
is a
con
d
i
t
ion to
a succ
essful mutu
al authe
nticati
on.
Resu
lts of se
curit
y
ana
lysis of SL
RV, and co
mp
ariso
n
w
i
th
existing protoc
ols,
are prese
n
ted.
Ke
y
w
ords
: lig
htw
e
ight RF
ID, EPC Class-1
Gen-2, mutual
authe
nticati
on protoco
l
,
securi
ty
analysis
Copy
right
©
2015 Un
ive
r
sita
s Ah
mad
Dah
l
an
. All rig
h
t
s r
ese
rved
.
1. Introduc
tion
Radi
o Fre
q
u
ency IDe
n
tification (RFI
D)
is a technol
o
g
y highly de
mande
d
in
nu
me
ro
us
appli
c
ation
s
and dom
ain
s
and therefo
r
e is unde
r
a
continuo
us
and ra
pid de
velopment [1
-4].
Secu
ring RF
ID
tags
ag
ai
nst security threats
is
c
o
n
s
ide
r
ed
th
e ma
in
ob
s
t
ac
le
fac
i
n
g
the
wide
sp
rea
d
a
doption
of RFID technolo
g
y [5-11],
wh
ere h
und
re
ds of RFID
protocol
s h
a
ve b
een
prop
osed a
n
d
focu
sed
o
n
providi
ng
a se
cu
re
co
ntact bet
wee
n
rea
ders a
nd tags
over the
inse
cu
re ra
di
o chan
nel. Neverthele
s
s, due to the lim
itations of tags in te
rm
s
of circuitry (g
ate
equivalent
s),
stora
ge, a
n
d
po
wer con
s
umption, the
de
sign
of a
n
efficie
n
t an
d secure
mu
tual
authenti
c
atio
n
p
r
oto
c
ol prese
n
ts an
i
m
mense chal
l
e
nge. De
signi
ng se
curity p
r
otocols
is
e
v
en
more
challe
nging
for l
o
w-co
st te
chnolo
g
ies
such
a
s
the
lightweight
RFI
D
se
curity
proto
c
ol
swhe
reby the tag
s
im
poses stro
nger hardware
and
me
mo
ry limitations. Among the
set
of ri
sks li
nke
d
to
RFID technolo
g
y, priv
acy a
nd
de
-synchroni
zatio
n
a
r
e th
e mo
st challe
ngin
g
a
s
the majority o
f
design
ed protocol
s fail to offer prote
c
tio
n
again
s
t the
s
e thre
ats.
RFID tag
s
compliant with
EPC Class-1 Gene
ration
-2 (G
en-2 in sho
r
t ) are b
a
se
d on
transpon
de
rs with limited reso
urce
s.
In detail, Gen
-
2
tags o
n
ly sup
port a 1
6
-bit
pse
udo
-rand
om
numbe
r
gen
erato
r
(PRNG), a
16
-bit
cycli
c
re
du
ndan
cy che
c
k cod
e
(CRC), and
bit
w
ise
operation
s
su
ch a
s
XOR, AND, an
d OR [
12].
Several proto
c
ol
s we
re p
r
o
posed with th
e ai
m of secu
ring Ge
n-2 tags. Unfo
rtuna
tely the
majority of these
proto
c
ol
s failed eithe
r
to fu
lfill Gen-2 requi
reme
nts or to
sati
sfy the claim
e
d
se
curity
pro
p
e
rties.
Fo
r in
stan
ce, [13]
pre
s
ente
d
a
proto
c
ol
u
s
in
g a
PIN p
a
ssword to
secu
rize
the commu
ni
cation.
Thi
s
p
r
otocol
suffers from
seve
ra
l attacks a
s
th
e on
es me
ntioned
in [1
4] a
n
d
[15]. First, it
wa
s vuln
era
b
le to a
de
-synchroni
zatio
n
attack a
s
a co
nsequ
en
ce of th
e
we
ak
updatin
g me
cha
n
ism
of t
he
se
cret
keys a
nd
sha
r
ed val
u
e
s
.
Secon
d
ly, it doe
s n
o
t o
ffer
prote
c
tion
ag
ainst re
play attacks and
a
pa
ssiv
e at
tacker can
reuse to
ken
s
from
previo
us
se
ssi
on
s. Thi
r
dly, it wa
s
susceptibl
e
to
a tra
c
ea
bility attack si
nce
tags
re
sp
ond
with the
sa
m
e
value every time – in this a
ttack, the atta
cker
h
a
s to in
terce
p
t the u
pdating me
ssage an
d the tag
woul
d re
spo
n
d
with a co
nst
ant value.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
SLRV: An RF
ID Mutual Authentication Prot
ocol
Confo
r
m
i
ng to EPC
… (Mu
’
awya
Na
ser)
1055
Yeh et al.’s protocol [16] ai
ms t
o
se
cu
re
E
P
C
Clas
s-
1
Gen-
2
stand
ard. Similar t
o
many
previou
s
ly propo
sed p
r
oto
c
ol
s, it can be cate
gori
z
ed und
er the
class of lig
htweig
ht mutual
authenti
c
atio
n proto
c
ol
s,
followin
g
the
cla
ssifi
cati
o
n
pro
p
o
s
ed i
n
[17]. In this catego
ry, it is
assume
d tha
t
tags can g
enerate a
ra
ndom n
u
m
b
e
r
but they d
o
not have th
e co
mputatio
nal
resou
r
ces to
sup
port o
n
-b
oard
ha
sh fu
nction. On th
e other h
and,
and simil
a
r t
o
other lig
htweight
RFID auth
e
n
t
ication
proto
c
ol
s, Yeh
et
al.’
s sche
m
e
is de
sig
n
ed
with a
n
e
w
pa
ramet
e
r
rep
r
e
s
entin
g a databa
se in
dex value.
1.1. Vulnerabilit
y
of Ye
h
et al.’s Protocol
Na
ser et al. [
18] sho
w
ed
h
o
w th
e p
r
oto
c
ol is vulne
r
ab
le ag
ainst
de
-synchro
nization a
nd
imperso
natio
n attacks. T
he attacks can be
co
ndu
cted by a m
a
licio
us
rea
d
e
r, whi
c
h
m
a
inly
forwa
r
d
s
me
ssag
e an
d do
e
s
si
mple m
o
d
i
fication
s expl
oiting the
we
akn
e
sse
s
of t
he bitwi
s
e X
O
R
operation
s
.
1.2. De-sy
n
c
h
roniza
tion
Attac
k
Yeh et al.’s protocol wa
s d
e
sig
ned u
s
in
g tw
o set
s
of authenti
c
atio
n and a
c
cess keys to
comb
at DoS
attack, which
cau
s
e
s
a de
-syn
ch
r
oni
zat
i
on state bet
wee
n
the tag
and the se
rv
er.
The autho
rs in [16] critici
z
ed the fa
ct that
its pred
ece
s
sor
sche
me (i.e., Chi
en and
Huan
g’s
proto
c
ol [14]
) update
d
the
key value
s
(K
old
and P
old
) on every
su
ccessful
m
u
tual auth
entication
se
ssi
on at th
e datab
ase si
de. Motivated by this,
Yeh
et al. prop
osed to add
a validation
crite
r
io
n
for this up
dat
ing me
ch
ani
sm to solve th
e de
-syn
ch
ro
nizatio
n
attack, which Chi
en an
d
Che
n
’
s
proto
c
ol
suff
er, an
d i
s
b
a
s
ed
on
the u
s
ag
e of th
e
new value
s
o
f
D, E, and
C
i
. Neverthel
ess,
des
pit
e
t
hese
v
a
lidat
ion t
o
ken
s
,
we,
in t
h
is pap
er,
s
h
ow ho
w re
pla
y
at
t
a
cks
can
de-sy
n
c
h
r
oni
ze
the protocol.
The u
s
e
d
a
d
v
ersa
ry (mali
c
iou
s
rea
der) ha
s to
be a
b
le to i
n
terru
p
t and
forwa
r
d
messag
es on
ly, and it do
e
s
n
o
t nee
d to
have the
ca
pability to co
mmuni
cate
with the data
b
a
se.
This adversary will execute two
se
ssion
procedures in one sessio
n. That i
s
, both
comm
uni
cati
on
se
ssi
on
s are
execute
d
alm
o
st in parallel
but
with only a slight difference in time:
In the (i+
1
)
th
authenti
c
atio
n sessio
n, th
e mali
ciou
s
reade
r
will int
e
rcept the
la
st messag
e
from the dat
aba
se an
d throw
away M
2
messag
e to kee
p
the tag
using the
sa
me index val
ue
C
i+1
. At the same time, th
e datab
ase will updat
e it
s l
o
cal
paramet
ers,
spe
c
ifical
ly C
old
would
be
C
new
, and C
i+1
, and its C
new
woul
d be C
i+2
.
In a sli
ghtly
poste
rio
r
session
(alm
ost
a pa
rallel
session), the
ma
licious reader
will
resend a n
e
w Message 3.
Ho
wever, in
stead of co
ntai
ning (V, M1, D, C
i
, E, N
R
), it will send (V,
M1, D
RN
D,
C
i
, E
RND
, N
R
),
whi
c
h
will allow the database to
understand
that it is a new
se
ssi
on.
The
s
e v
a
lue
s
(i.
e
.
,
V
,
M1, D
RN
D, C
i
, E
RND, and
NR) will facili
tate the tag to be
authenti
c
ated
by the database be
cau
s
e N
R
co
ntinu
e
s to re
prese
n
t the same
values from the
eavesdro
ppe
d se
ssion.
N
T
will becom
e
NT
RND, wh
ich i
s
corre
c
tly used i
n
D
a
nd E me
ssag
es.
Due to
modifi
ed Me
ssage
3 se
nt by the
read
er, the
d
a
taba
se
will u
pdate its C
new
value ba
se
d
on
the C
x
(in this c
a
s
e
, X
=
old) from
C
i+2
to
C
i+3
. At the same time, th
e
malici
o
u
s
re
ader will
forward
the sto
r
ed
M
2
me
ssage to
the tag,
cau
s
ing the ta
g to
update
its va
lues f
r
om
(K
i+1
, P
i+1
and C
i+
1
)
to (K
i+2
, P
i+
2
a
nd C
i+2
).
At this step the tag will
store
C
i+2
as index value, and the dat
abase will
keep the values
C
i+1
and
C
i+3
. Therefore, th
e tag a
nd the
databa
se
lost
its syn
c
hroni
zation
and
this is pe
rma
n
e
n
t.
In fact, the tag ca
n neve
r
be identifie
d becau
se
the sea
r
ch ind
e
x stored int
o
its memory
is
different from
the two indices (ol
d
and n
e
w)
stored in
the databa
se.
1.3. Impersonation Attac
k
Tag imp
e
rso
nation atta
ck is cond
ucte
d by a di
sho
nest
read
er.
The
key poin
t
s of thi
s
attack a
r
e b
a
s
ed o
n
the u
s
e of N
T
n
o
n
c
e in b
o
th D
and E toke
ns and the ab
u
s
ive use of the
bitwise XOR
operation
s
. Bitwise op
era
t
ions like
XOR are lin
ea
r functio
n
s, whi
c
h are vulne
r
able
to active and
passive attacks. Th
e pro
p
o
s
ed atta
ck i
s
sketch
ed bel
ow:
a) (i + 1
)
th
au
then
tica
tion phase
(1)
R
Tag
x
: N
R
(2) Tag
R: M1, D, C
i
, E
M1=
PRNG
(EPC
S
N
R
)
K
i
D = N
T
K
i
E =
N
T
PR
NG
(C
i
K
i
)
(3)
R
DB: V, M1, D, C
i
, E,
N
R
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 13, No. 3, September 20
15 : 1054 – 10
61
1056
(4)
DB
R: M2,
Info
(5)
R
Tag
x
: At
tac
k
The attack can be pe
rformed usi
ng two method
s. The first is by
preventin
g the read
e
r
from forwa
r
di
ng any me
ssage
s to the t
ag. Alter
nativ
ely, the adve
r
sa
ry
can int
e
rrupt the la
st
messag
e an
d
sen
d
a fraud
ulent me
ssag
e co
ntainin
g
an in
corre
c
t value of M
2
. At this point, th
e
targeted ta
g i
s
isolated a
n
d
the mali
cio
u
s read
er
ca
n repl
ace an
d imperso
nat
e the ori
g
inal
tag
by computin
g
simple bitwi
s
e XOR ope
rat
i
ons a
s
de
scri
bed in the foll
owin
g.
b) (i + n)
th
au
then
tica
tion phase
(n>2)
Basically the
fraud
ulent
reade
r
simula
tes that the
tag al
ways in
corre
c
tly re
ceives the
messag
e M
2
. The
r
efo
r
e, th
e up
dating
p
hase i
s
not
run
in
the
tag and previous M1
me
ssag
e is
valid. M1, D, E, N
R
, and V are the pi
cked valu
es
o
f
a previou
s
legitimate se
ssi
on. After the
reception
of
M2, the read
er bl
ock thi
s
messag
e a
n
d
simul
a
tes th
e tag in
co
rre
c
tly re
ceived
M2.
After that, the fraudul
ent re
ader
se
nd
s M1, D
RND
, E
RN
D, N
R
, V, where
RND re
pre
s
e
n
ts
an
arbitrary
ran
d
o
m valu
e. Th
e tag
is auth
e
n
ticated
si
nce
M1 i
s
legitim
a
te. The
rand
om n
u
mbe
r
N
T
'
asso
ciated
to
this
se
ssion
is th
e bit
w
ise XOR bet
ween
N
T
and
RND. We sketch
th
e
p
r
o
c
ess
belo
w
:
DB
R: M2, Info Fake R
DB: M1, D
RN
D, E
R
ND, N
R
, V
The propo
se
d attack
can
be execute
d
indefin
itely as the origi
nal schem
e doe
s no
t
assume
any t
h
re
shol
d for t
he nu
mbe
r
of
times
the
M
2
me
ssage
can be i
n
terru
p
ted, altered,
or
inco
rrectly re
ceived.
2. Rese
arch
Metho
d
In an
accu
m
u
lative effort
to enh
an
ce t
he
se
cu
rity o
f
Yeh et
al.’s protocol, we
propo
se
two po
ssible
solutio
n
s fo
r
the de
synchronization
threat. The first is the
cre
a
tion of two ex
tra
fields fo
r e
a
ch tag’
s record in th
e d
a
ta
base a
s
a
sh
ort me
mory f
o
r
ran
dom
n
u
mbe
r
s (N
R
, N
T
)
gene
rated i
n
the (i+1)
th
se
ssi
on. The
sh
ort memo
ry u
s
ing th
ese two extra field
s
(N
R_last
, N
T_
l
a
s
t
)
indicates th
at they will b
e
overwritten at
every su
cce
ssful
mut
ual
authenti
c
atio
n
(i
+2)
th
se
ssi
on.
The second
solutio
n
invol
v
es the modif
i
cation of
the
formula
s
for
D and E valu
es, executed
b
y
the tag, as not to be able to
misuse or m
anipul
ate these du
ring tra
n
s
a
c
tion (e.g., by using a no
n-
recta
ngul
ar f
unctio
n
such
as
a rotatio
n
functi
o
n
). Ho
wever,
th
e
s
e
p
r
o
p
o
s
ed solutio
n
s are
not
compl
e
tely effective; other
atta
cks can b
e
config
ure
d
based on the
original p
r
oto
c
ol plot de
sig
n
,
whi
c
h de
pen
ds on u
pdatin
g values of common
se
cre
t
s betwe
en ta
g and ba
cken
d databa
se.
Motivated by the abovem
enti
one
d disa
dvantage in
enha
nci
ng
Yeh et al.’s protocol, a
new
proto
c
ol
wa
s devel
op
ed utilizi
ng th
e strength
s
a
nd ad
dre
s
sin
g
the wea
k
ne
sses
of existi
ng
proto
c
ol
s, particularly the v
u
lner
abilitie
s in the said
protocol
(See F
i
gure
1). The
goal in cre
a
ting
the ne
w p
r
o
t
ocol
wa
s to
pro
d
u
c
e a
lightwei
ght o
ne with
hig
h
e
r
se
curity l
e
vel and
lo
wer
comp
utationa
l powe
r
requi
reme
nts for t
he EPC
Cl
ass-1
Gen
e
ration-2
stan
dard for RFID ta
gs.
The p
r
oto
c
ol
pre
s
ent
s tra
n
sa
ction
s
of
the origi
nal stored d
a
ta combine
d
with
rand
om valu
es,
and
en
cap
s
ul
ated in
sh
ell
values capab
le of tra
n
spo
r
ting hidd
en
d
a
ta bet
wee
n
the tag
and t
he
read
er with
o
u
t co
mpromi
sing o
r
reveali
ng thi
s
dat
a
.
Ba
s
e
d on
its
c
h
ar
ac
te
r
i
s
t
ics
,
th
e p
r
o
p
o
se
d
proto
c
ol i
s
n
a
med
as Sh
elled Li
ghtweight
Rand
o
m
ized
Value
(SL
R
V), wh
ich fo
cu
se
s
on
se
curi
ng the
cha
nnel
between the ta
g a
nd the
re
a
der, the rea
der
and the
data
base, and vi
ce-
versa.
We int
r
odu
ce the fol
l
owin
g notatio
ns for the p
r
o
t
ocol:
a)
Ψ
:
encryption va
lue holdin
g
th
e EPC
S
b) K
e
:
encryption ke
y with fixed value for all ta
gs sto
r
ed in t
he datab
ase
c)
N
i
:
rand
om num
ber ge
ne
rate
d by the database at every (i)
th
se
ssi
on
d) R
temp
:
temporary value cal
c
ul
ated
by the database at every (i+1)
th
sess
ion
e)
K1, K2: two d
i
stinct
se
cret
keys
with
fixe
d value
s
for
each tag
stored in the ta
g
and
the corre
s
po
nding
re
co
rd
in the
data
b
a
se
We reco
mmend
that
these
two
se
cret
key
s
(K
1
, K
2
)
be c
h
anged from time to ti
me to maintain a higher s
e
c
u
rity level.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
SLRV: An RF
ID Mutual Authentication Prot
ocol
Confo
r
m
i
ng to EPC
… (Mu
’
awya
Na
ser)
1057
Figure 1. Shelled Light
weig
ht R
and
omized Value (SL
R
V) protocol
The protocol con
s
i
s
ts of the followin
g
ph
ase
s
:
2.1. Initializ
ation Phase
For ea
ch
ta
g,
den
oted as Tag
x
, the ma
nufactu
re
r
ra
ndomly g
ene
rates two
se
cret
keys
and EPC
S
value
s
and
store
s
these in the tag in
a corre
s
po
n
d
ing re
co
rd i
n
the databa
se
identified by EPC
S
. The
m
anufa
c
ture
r li
ke
wise g
ene
rates
an
en
cryption key K
e
a
n
d
s
t
or
es
it in
the datab
ase
,
gene
rates
a ra
ndom
nu
mber
and
st
ore
s
it in the
tag as N
i
, a
nd ge
nerates an
encryption va
lue usi
ng the
formula
Ψ
=
E
NC(EPC
S
N
i
)
Ke
and sto
r
es it in the tag a
s
Ψ
.
In the (i + 1)
th
tag authe
n
tication p
h
a
se
1) R
Tag
x
: N
R
The
rea
der g
enerates a
n
once
rand
om
N
R
to
the ta
g
as a
challen
ge. Upon
receiving
N
R
,
the tag gene
rates a rando
m numbe
r N
T
to be used in
the following
formula
s
:
a)
α
i
=Rot(Rot
(N
T
EPC
S
K
1
)N
R
⨁
K
2
),K
1
b)
β
i
=P
RN
G(
N
T
||
N
R
||EPC
S
||
Ψ
i
)
K
2
W
h
er
e
α
i
is
use
d
to
hide
N
T
and
β
i
i
s
u
s
e
d
to
ch
eck the
me
ssag
e inte
grit
y by the
databa
se.
2) Tag
R:
Ψ
i
,
α
i
,
β
i
and N
i
Whe
n
the re
ader
re
ceive
s
the messa
g
e
, it will com
pute V value
using V
=
H(RID
N
R
),
whi
c
h is the hashed value
of the
reader’s ID (RID) XORe
d with N
R
. The reade
r then forwa
r
d
s
it
with co
ntents
of Message
s
1 and 2 to the
backen
d
dat
aba
se for the
purp
o
se of tag identificatio
n.
3) R
DB:
Ψ
i
,
α
i
, N
i
,
β
i
,V, and N
R
Once Messa
ge 3 is re
ceived, the databa
se p
e
r
form
s the followin
g
ope
ration
s
seq
uentially, whe
r
e e
a
ch is condition
ed
to the su
cce
ss
of its pre
d
ece
s
sor
ope
ration or el
se
will
abort the
session:
2.2. Reade
r
Authen
ticati
on Phase
The d
a
taba
se iteratively
picks up
ea
ch stored RI
D
an
d com
p
utes H(RID
N
R
) to
authenti
c
ate t
he read
er
ba
sed
on th
e v
a
lue of V.Fo
r
ea
ch
RID i
n
DB test th
e f
o
llowin
g
fo
rm
ula
:
H(
RID
N
R
)=? V
2.3. Tag Iden
tifica
tion Phase
The datab
ase
extracts EPC
S
value using
the followin
g
formul
a:
EPC
s=
Dec(
Ψ
i
)k
e
N
i
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 13, No. 3, September 20
15 : 1054 – 10
61
1058
The read
er u
s
e
s
this fo
rm
ula to extra
c
t EPCs by de
crypting
Ψ
i
u
s
ing K
e
an
d
N
i
, and
locks u
p
the tag’s
co
rre
sp
o
nding
se
cret
keys in
th
e d
a
taba
se. Sub
s
eq
uently, it start
s
the mut
ual
authenti
c
atio
n pha
se only
if the EPCs are verified.
2.4. Tag Authentic
a
tion
Phase
The d
a
taba
se uses the v
a
lue
s
it a
c
qu
ired
(EPC
S
, K
1
, K
2
) and
resolves A
i
shell by
inversi
ng the
function A
i
=ROT
(ROT(N
T
EPC
S
K
1
, N
R
^K
2
), N
R
K
1
) to extract the value of the
rand
om n
u
m
ber
N
T
. Next, the re
ade
r checks the int
egr
ity of the
messag
e by
verifying B
i
value
usin
g the followin
g
formul
a:
PRNG
(
N
T
||
N
R
||EPCs
|
|
Ψ
i
)
K
2
=?
β
i
2.5. Tag upd
ating Phas
e
The database authenticates the tag,
creates a new random value (N
i+1
), and uses
K
1
,
K
2
, and N
T
to calculate R
temp
using the following formula:
R
temp
=Rot
(R
o
t
(N
t
⨁
N
R
,K
2
),
K
2
⨁
K
1
)
The data
b
a
s
e then creat
es ne
w tag
para
m
eters f
o
r the value
s
(
Ψ
i+1
,
γ
i
, and Info)
seq
uentially u
s
ing the follo
wing:
a)
Ψ
i+1
=
Enc(EPC
S
N
i+1
)K
e
b)
γ
i
=P
RN
G(
Ψ
i+
1
||
α
i
||
R
te
m
p
||
N
i+1
)
c
)
Info=
(RID
DATA)
Whe
r
e
γ
i
is u
s
ed to che
ck
the messag
e integrity by the databa
se.
1) DB
R:
Ψ
i+
1
,
γ
i
, N
i+1
, and Info
When the reader receives
Message 4, it
obtains
DATA from the
info field by
inversing
the formula DATA=info
RID using the RID stored in it. It forwards
Ψ
i+1
,
γ
i+1
, N
i+1
to the tag.
2) R
Tag:
Ψ
i+1
,
γ
i+1
, N
i+1
Whe
n
Messa
ge 5 is delive
r
ed, the tag recal
c
ul
ates
N
temp
using the followin
g
formula:
R
temp
=Rot
(R
o
t
(N
T
N
R
,K
2
),
K
2
K
1
)
Next, the
tag checks
the integrit
y of the
message by
verifying G
i
value using the
following formula:
PRNG
(
Ψ
i+1
A
i
R
temp
)=?
γ
i
If
γ
i
value
verification failed,
the tag pr
esumes
manipulation in
the message and
therefore aborts
the session.
Ot
herwise, the
tag completes
mut
ual authentication,
authenticates
the
database, and
concludes the session
in t
he final
phase (Tag Updating)
by updating its
values and overwriting the old values as the following:
a)
Ψ
i
=
Ψ
i+1
b) N
i
=N
i+1
As illustrated in
Figure 1, two
shells (
α
and
γ
) are generated
in every session.
This
makes the embedded values difficult
to predict,
and these values
would be useless if
obtained
after the
session is
terminated. Furthermore,
there are
three verification
tokens —
V,
β
, and
γ
—
that allow the system to te
rminate unsuccessful session in
four positions: EPCs lock up
in
reader
authentication, tag identific
ation, tag authentication, and t
ag updating. These tokens start
a new session in another timeframe.
3. Securit
y
A
n
aly
s
is
We
con
d
u
c
te
d se
cu
rity an
alysis
again
s
t
the mo
st rel
e
vant threat
s
discu
s
sed in
previou
s
literature. An
alysis was condu
cted
by
invest
ig
atin
g ea
ch
atta
ck a
n
d
its
re
quire
ment
s a
nd
prop
ertie
s
in the followi
ng categori
e
s:
User d
a
ta co
nfiden
tialit
y
:
S
e
cret
key
s
K
1
and K
2
are ca
refully hi
dden in
sid
e
α
,
β
, and
γ
. In every new sessio
n, the key
s
are
mixed with two differe
nt random n
u
mb
ers
N
T
an
d N
R
.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
SLRV: An RF
ID Mutual Authentication Prot
ocol
Confo
r
m
i
ng to EPC
… (Mu
’
awya
Na
ser)
1059
More
over, if
any of the
sub
-
me
ssag
e
s
in
α
,
β
, or
γ
was broken, tag i
d
entity will rem
a
in
anonymo
us t
o
the adve
r
sa
ry. This i
s
b
e
c
au
se th
e tag
EPCs
wa
s X
O
Re
d with
a
rand
om n
u
m
ber
and su
bsequ
ently encrypt
ed usin
g a se
cret key t
hat exists o
n
ly in the reader’
s
data
b
a
se.
Therefore, th
e tag’s ide
n
tity can be
re
co
gnized only b
y
legitimate reade
rs.
Tag ano
n
y
m
it
y
:
Sub-messag
es a
r
e
up
dated in eve
r
y session’
s transactio
n
, an
d tag-
read
er-data
b
a
se
me
ssag
es a
r
e
mixe
d with
ran
d
o
m
numb
e
rs.
As a
re
sult,
the adve
r
sary is
unabl
e to re
cogni
ze the ta
g’s lo
cation o
r
tra
c
e it
unle
ss the
adversary co
nt
inue
s to interru
pt the
comm
uni
cati
on between t
he sa
me tag
and any le
gitimate rea
d
e
r
; this lead
s to t
he tran
smi
ssi
on
of the same
messag
e val
ues of
Ψ
i
a
nd N
i
eve
r
y tim
e
. This sce
n
a
r
io
wa
s n
o
t consi
dered
of any
con
s
id
era
b
le
value an
d ha
d bee
n igno
red in mo
st
p
r
evious
studi
e
s
in the
dom
ain si
nce the
tag
wa
s unabl
e to rand
omize itself due to the limited
re
cou
r
se. An in-de
p
th anal
ysis of all these
scena
rio
s
ha
s bee
n given
in detail in [19].
Mutual a
u
th
entica
tion a
nd dat
a
inte
grit
y
:
Our m
u
tual auth
enti
c
ation
proto
c
ol ca
n be
perfo
rmed
on
ly betwee
n
le
gitimate re
ad
ers an
d legiti
mate tag
s
o
w
ing to the
su
b
-
me
ssage
s
α
,
β
,
and
γ
; these
are g
ene
rate
d usin
g the
common
se
cre
t
keys K
1
and
K
2
, which a
r
e only held i
n
the
tag an
d b
a
ckend
datab
ase an
d n
o
t co
mmuni
cated
i
n
plai
n valu
e
s
ove
r
an
op
en
cha
nnel. I
n
addition, ve
rifying the val
u
es
of
β
and
γ
com
p
o
s
ed
by the tag
an
d the
datab
a
s
e,
re
spe
c
tively,
provide
s
st
ro
ng data integ
r
ity validation.
For
w
a
r
d
se
c
u
rit
y
:
It is not possibl
e for a
n
adve
r
sary to infer a
n
y data patte
rns from
past
comm
un
ication
s
a
m
o
ng the ta
g, re
ader,
and
dat
aba
se. Thi
s
i
s
be
ca
use a
n
y previou
s
d
a
t
a
sent i
n
o
n
e
session
will
ha
ve no
mea
n
in
g in
any
su
bseque
nt sessi
ons;
ea
ch
me
ssage
is ba
sed
on a ran
dom
numbe
r that is che
c
ked f
o
r integ
r
it
y for the se
ssi
on
it was creat
ed in. Therefore,
the integrity check will
re
cogni
ze
that the value i
s
n
o
t cre
a
ted
du
ring the
sam
e
se
ssi
on, an
d it
consequently will termin
ate the session
unsuccessfully. Moreov
er, Keys K
1
and K
2
are not
drop
ped.
Ho
wever, th
ey are
difficult to obtai
n
and
can
be
ch
a
nged f
r
equ
en
tly, renderi
n
g
this
attack q
u
ite impossibl
e. Assuming the
tag is som
e
how
comp
ro
mised; the
r
e
remain
sev
e
ral
unkno
wn dat
a variable
s
in
the serve
r
, such a
s
K
e
.
Resis
t
an
ce to repla
y
attacks:
An a
d
ve
rsa
r
y may ea
vesdrop on a
n
y of the exchang
ed
messag
es.
Howeve
r, it wo
uld n
o
t be
u
s
eful to
sen
d
i
t
back to
eith
er the
data
b
a
s
e
or th
e tag
.
This i
s
be
ca
use e
a
ch m
e
ssag
e is b
a
se
d on ran
dom num
be
rs that are
chang
ed in e
v
ery
su
ccessful a
u
thenticati
on
se
ssi
on. Accordin
gly, a replay a
ttack
can b
e
dete
c
ted immediat
ely
once the messag
e is re
ceiv
ed by
either the tag or the
databa
se.
Data
-up
d
ate
-
con
f
irmatio
n
and
de
s
y
n
c
hronization
:
Maj
o
rity of rece
nt authen
tication
proto
c
ol
s req
u
ire u
pdatin
g
the se
cret keys’ value
s
b
e
twee
n the t
ag an
d re
ad
er. Cases
wh
ere
transmitted data had b
een modifie
d
or even
interrupted le
ad to desy
n
ch
roni
zatio
n
.
A
desyn
ch
roni
zation attack i
s
the first vulnera
b
ility
that comm
only a
ppea
rs i
n
all
curre
n
t proto
c
ol
s.
In ou
r p
r
oto
c
ol, the tag
do
es
not
requi
re up
datin
g
of
its lo
cal
dat
a in
othe
r e
n
t
ities. Moreov
er,
even if any of these messa
ges a
r
e modi
fied or
interru
p
ted, any modification can
be discovere
d
easily
wh
en t
he valu
es of
V,
β
i
, and
γ
i
are verified. I
n
terruptions
will not make any difference
becau
se ta
g
data
will b
e
u
pdated
only
a
fter re
ce
ivin
g
and ve
rifying
the la
st me
ssage. T
h
u
s
, th
e
read
er i
s
nev
er affecte
d
an
d alway
s
obta
i
ns
the ori
g
in
al EPCs for e
v
ery new session.
Resis
t
an
ce to man-in-the
-middle atta
cks and disc
losure attac
ks:
Ma
n-in
-th
e
-mid
dle
attacks
can
not affect S
L
RV p
r
oto
c
ol
sin
c
e all
e
x
chan
ged m
e
ssag
es
are
verified a
n
d
all
modificatio
n
s can be
simpl
y
detected. Similarly,
in a disclo
sure attack wh
en an
attacker ma
kes
changes in any message
sent from
dat
abase to tag
or vice versa,
SLRV protocol will detect
any
alteration a
n
d
ignore the m
e
ssag
e.
A signifi
cant
asp
e
ct
of SL
RV is that it i
s
b
a
sed on classical crypt
ogra
phy
p
r
im
itives
on
the databa
se
serve
r
’s
sid
e
.
At the same time, t
he pro
t
ocol is
ba
se
d on lightwei
ght crypto
gra
phy
on the tag’
s side. M
o
re
pre
c
isel
y, the protocol u
s
e
s
a
com
b
i
nation of tri
a
ngula
r
an
d n
on-
triangul
ar fun
c
tion
s. Non-t
r
iangul
ar fu
nct
i
ons u
s
e
a
d
o
uble-rotatio
n
f
unctio
n
in
ste
ad of th
e
sim
p
le
XOR functio
n
to obtain a
greate
r
diffusion effect an
d comb
at cry
p
tanalysi
s
of the proto
c
ol [12,
19]. Utilizin
g
com
putation
a
l capabilitie
s o
n
the
da
tabase serve
r
’s sid
e
for usin
g
cl
assi
cal
cryptog
r
a
phy primitives a
n
d
usin
g a tria
ngula
r
and
n
on-tri
ang
ular
function
s coll
ectively provi
de a
highe
r
se
curit
y
and p
r
ote
c
t again
s
t all
known ki
nd
s o
f
discl
osure a
ttacks that
ot
her proto
c
ol
s fail
to defend
ag
a
i
nst. Addition
ally, a meani
ngle
ss
me
ssa
ge cann
ot affect the ta
g o
r
rea
der,
but o
n
ly
results in e
n
d
i
ng the curre
n
t sessio
n un
su
ccessf
ully, enabli
ng a ne
w se
ssion to
begin in a
not
her
timeframe.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 16
93-6
930
TELKOM
NIKA
Vol. 13, No. 3, September 20
15 : 1054 – 10
61
1060
Databa
se lo
ading:
Finall
y
, to cover a
ll po
ssibl
e th
reats to SL
RV, an adve
r
sary can
perfo
rm data
base loadi
ng
attacks by
modifying
an
y of the values in the
me
ssage fo
rwarded
from the tag.
This
will eit
her
result in
perfo
rming
excessive EP
Cs l
o
ck-up processes in t
h
e
databa
se fo
r invalid EPCs when
mani
pulating th
e
Ψ
i
or
N
i
values
, or in the verific
a
tion
of a
manipul
ated PRNG
value
(
s). Ho
wever, this
atta
ck
wil
l
not p
r
od
uce
a si
gnificant
effect be
ca
use
the SLRV
u
s
es
a bin
a
ry
search
algo
rith
m for EP
Cs l
o
ckup,
whi
c
h
is m
ode
ratel
y
fast where
the
lock
up c
o
mplexity
is
O
(
log n
). Furthe
rm
ore, the data
base in
SLRV maintains t
he assum
p
tio
n
that all value
s
a
r
e fixed
o
n
ce
add
ed, E
P
Cs
are
se
ri
alize
d
, and
d
a
ta are ind
e
xed. The
r
efo
r
e
,
it
results i
n
a
compl
e
xity value of
O(1) for EPC
s l
o
ckup,
which
minimizes th
e effect of
DoS
at
t
a
ck
s.
Comp
ari
s
o
n
with
rel
a
ted proto
c
ol
s,
su
ch
a
s
Juel
s Protocol, Duc Protocol, etc., is
summ
ari
z
ed
in Table
1.
SLRV covers well a
ll a
s
pect
s
of security being
consi
dered from
confid
entiality to the databa
se loa
d
ing a
s
pect.
Table 2. Co
m
pari
s
on of Lig
h
tweig
h
t Authenticatio
n Pro
t
ocol
Con
f
ide
n
tiali
ty
A
non
y
m
i
ty
A
u
t
h
en
ticati
on
Forw
a
r
d
Securit
y
Repla
y
A
tta
ck
s
Des
y
nc
hro
n
iz
at
i
on
and D
o
S
MIM
A
DB
Load
i
n
g
Juels
prot
ocol
o x
o
x
x
x
x
x
Duc et
al.
o o
x
x
x
x
x
x
Lies et
al.
x x
x
x
x
x
x
x
Sun an
d
Ting
x o
o
o
o
x
o
x
Karthik
e
y
an an
d
Neste
n
ko
o x
x
x
x
x
x
x
Chien and
Chen
o o
x
x
x
x
x
x
Yeh et al.
o o
x
x
x
x
x
o
SLRV
o o
o
o
o
o
o
o
4. Conclusio
n
We h
a
ve p
r
opo
sed SL
RV as a
ne
w lightwe
i
ght
authenti
c
atio
n proto
c
ol
capabl
e of
providin
g tra
n
sa
ction
s
of shell
ed value
s
able to
tra
n
s
po
rt en
cap
s
ulated en
cryp
ted private d
a
ta
betwe
en the tag, the rea
d
e
r
, and the dat
aba
se wi
th
ou
t compromi
si
ng the data.
This g
uarant
ees
privacy an
d a
nonymity of the tags’ hol
d
e
r. The ma
in
advantage o
ffered by this protocol is that
each session
is consi
d
e
r
e
d
an atom
e
n
tity wher
e
n
o
data fro
m
previou
s
se
ssion
s
a
r
e
sto
r
ed
after se
ssi
on terminatio
n. In addition, no
data va
lues can be
cha
n
g
ed on the tag’s side u
n
til all
transactio
n
s
have been e
x
ecuted an
d
validated su
cc
essfully, ensu
r
ing d
a
ta
integrity on the
RFID ta
g, re
ader,
and
ba
ckend
data
b
a
s
e
entities at
all
times. Co
mpari
ng
to previous
protocols
in the lightwei
ght RFID field
,
the propo
se
d prot
o
c
ol (S
LRV
)
cov
e
r
s
all asp
e
ct
s of
se
curit
y
.
Additionally, we u
r
ge
prot
ocol
desi
gne
rs to che
ck th
eir p
r
oto
c
ols
again
s
t comp
atibility
with stan
dard
s
ca
refully (e.
g
., EPC-C1
G
2 or IS
O/IEC 1800
6-C), be
aring in mi
nd
that the desig
n
of a secure
a
nd efficie
n
t RFID auth
entication p
r
oto
c
ol
is n
o
t a
sim
p
le issu
e but
a compli
cate
d
chall
enge th
a
t
requires in
many ca
se
s a trade
-off be
tween o
b
je
ctives.
Referen
ces
[1]
Kim MC, Kim
CO, Hong SR, K
w
o
n
IH. F
o
rw
a
r
d-B
a
ck
w
a
r
d
Anal
ys
is of RF
ID-Enab
led
Supp
l
y
Cha
i
n
Using
Fuzz
y
Cog
n
itive
Ma
p
an
d Ge
netic
Algorit
hm.
Jou
r
nal
of Exp
e
rt
Systems
w
i
th
App
licati
ons
.
200
8; 35(3): 11
66-1
176.
[2]
Sun Q, Z
hang
H, Mo L. Dual Rea
der W
i
r
e
less
Protoc
ol
s F
o
r Dense Active
RF
ID Identific
atio
n.
Internatio
na
l Journ
a
l of Co
mmu
n
ic
ation Sys
t
ems
. 20
11; 24
(11): 143
1-1
4
4
4
.
[3]
Cho K, P
a
ck
SH, K
w
o
n
T
Y
, Cho
i
YH. An
Exte
ns
ib
le
and
Ubi
quito
us R
F
ID Manag
em
ent F
r
ame
w
o
r
k
Over Ne
xt Generati
on N
e
t
w
ork.
Internatio
nal Jo
urn
a
l of
Commun
i
cati
on Syste
m
s
. 2
009; 2
3
(9-1
0):
109
3-11
10.
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
1693-6
930
SLRV: An RF
ID Mutual Authentication Prot
ocol
Confo
r
m
i
ng to EPC
… (Mu
’
awya
Na
ser)
1061
[4]
Che
n
YN,
F
ang
F
,
Ding
DH, Z
h
u
XH, Ya
ng Y
K
. Organic R
F
ID Based o
n
T
r
aceabi
lit
y
S
y
stem
of R
i
c
e
Su
ppl
y
C
hai
n.
T
E
LKOMNIKA Indo
nes
ian
Jour
nal
of E
l
ectrical
Eng
i
n
e
e
rin
g
. 20
14;
12(5): 37
69-
37
76.
[5]
Den
g
M, Z
hu
W
.
Des
y
nc
hro
n
izati
on Attack
s on RF
ID Se
curit
y
Pr
otoco
l
s.
T
E
LKOMNIKA Indon
esi
a
n
Journ
a
l of Elec
trical Eng
i
ne
eri
n
g
. 201
3; 11(2)
: 681-68
8.
[6]
Luo
H, Li
u R,
W
ang Y, C
h
en J. Sec
u
rit
y
Evalu
a
tio
n
fo
r RF
ID S
y
ste
m
: Securit
y
E
v
alu
a
tion
Ind
e
x
Architecture a
n
d
Evalu
a
tion M
ode
l.
T
E
LKOMNIKA Indones
i
an Jour
nal of
E
l
ectrical En
gi
ne
erin
g
. 2014;
12(6): 45
57-
45
62.
[7]
W
e
is SA, Sar
m
a SA, Rives
t RL, Eng
e
ls
DW
. Securit
y
and Pr
ivac
y A
s
pects of L
o
w
-
Cost Ra
di
o
F
r
eque
nc
y Id
e
n
tificatio
n
S
y
st
ems. In: Hutter
D, Mül
l
er
G,
Stepha
n W
,
Ul
lman M.
Ed
i
t
o
r
s
.
Securit
y
in
Pervasiv
e Com
putin
g. Berli
n
Heid
el
ber
g: Sp
ring
er; 200
4: 2802, 20
1-2
12.
[8]
Juels, A.
RF
ID sec
u
rit
y
a
n
d
pr
ivac
y: A
Rese
arch S
u
r
v
e
y
.
IEEE Journal on S
e
lected Areas
in
Co
mmun
icati
o
ns
, 2006: 2
4
(2)
,
381-39
4.
[9]
Lim, C. H., Ko
rkishko, T
.
mCr
y
pto
n
tio
n
a
Li
ght
w
e
ight B
l
oc
k Cip
her F
o
r
Securit
y
of Lo
w
-
C
o
st RF
I
D
T
ags and
Se
n
s
ors. In: So
ng
J-S., K
w
on,
T
-
Y., Yung.
M.
Editors. Inform
ation
Sec
u
rit
y
Appl
icatio
ns.
Berlin H
e
i
del
be
rg: Spring
er; 2006: 24
3-2
58.
[10]
Li JS, L
i
u
KH.
A Hid
de
n Mutu
al Aut
hent
ic
ati
on Pr
otocol
for
Lo
w
Cost
RF
ID T
ags.
Intern
ation
a
l J
ourn
a
l
of Communicat
i
on System
s
. 2
011; 24(
9): 119
6-12
11.
[11]
Peris-L
opez P
,
Herna
ndez-
C
astro JC, T
apiador
JME, Ri
bag
orda A. A
d
vanc
es in
Ul
tralig
ht
w
e
i
g
h
t
Cr
yptogr
aph
y
f
o
r L
o
w
-
C
o
st R
F
ID T
ags: Gossamer
Protocol. In: Chun K
I, Sohn K, Y
u
ng M.
Editors
.
Information Se
curit
y
Ap
pl
icati
ons. Berli
n
Hei
del
berg: Spri
ng
er; 2009: 5
6
-68
.
[12]
Chie
n HY. SA
SI: A Ne
w
U
l
tralig
ht
w
e
ight R
F
ID Au
thentica
t
ion Protoc
ol P
r
ovid
i
ng Stro
ng
Authentic
ation
and Stron
g
Integrit
y
.
IEEE Transactions on Dependab
le and Secure Computing
. 200
7; 4(4): 337-3
40.
[13]
Duc DN, Le
e HR, Kim KJ
. Enha
ncin
g Secu
rity of Epcglob
a
l Gen-
2 Rfi
d
T
ag aga
inst T
r
acea
bil
i
ty a
n
d
C
l
o
ni
ng
. In: Cole P
H
, Ra
nasi
ngh
e DC.
Editors
. Net
w
o
r
ke
d RF
ID S
y
stems a
n
d
Lig
h
t
w
e
i
ght
Cr
yptogr
aph
y.
Berlin H
e
i
del
be
rg: Spring
er; 2008: 26
9-2
77.
[14]
Chie
n HY, H
uan
g CW
. S
e
curit
y
of U
l
tra-Lig
h
t
w
e
i
ght
RF
ID Authe
n
ticatio
n
Prot
ocols
an
d Its
Improveme
n
ts.
ACM SIGOPS
Operating System
s Review
. 200
7; 41(4): 83
-86.
[15]
Sun HM, T
i
ng
W
C
, W
ang KH. On the Se
curit
y
of Chi
e
n'
s Ultra-Li
ght
w
e
ig
ht RF
ID Authentic
atio
n
Protocol.
IEEE Transactio
n
s o
n
Dep
e
n
dab
le
and Sec
u
re C
o
mp
utin
g
. 200
9; 8(2):
315-3
17.
[16]
Yeh T
C
, W
ang YJ, Kuo T
C
, W
ang SS. Securin
g
RF
ID S
y
stems C
onformi
ng to
EPC Class
1
Generati
on 2 S
t
andar
d.
Journ
a
l of Expert Systems w
i
th App
licatio
ns
. 20
10;
37(4): 767
8-7
683.
[17]
EPC gl
ob
al. C
l
a
ss 1 G
ener
ati
on
2 U
H
F
Air I
n
terfac
e Pr
oto
c
ol Sta
ndar
d "
G
en 2
"
Vers
io
n 1.2.0.
2
008.
Avail
abl
e on E
P
Cgl
oba
l
w
e
bs
ite: h
ttp://
w
w
w
.
epcg
l
ob
ali
n
c.or
g/standar
ds/.
[18]
Naser M, Ald
m
our I, Budiar
to R, Peris-Lo
pes P.
Vuln
er
abil
i
ty Analys
is
of
a Mutual
Authentic
atio
n
Protocol C
onf
orming to EP
C Class-1 Ge
nerati
on-2 Sta
ndar
d
. Procee
din
g
s of the 1
st
International
Confer
ence
on
Electrical En
gi
neer
ing, C
o
mp
uter Sc
ince
an
d Informatics (EECSI). Yog
y
a
k
arta. 201
4:
173-
176.
[19] Avoin
e
G, Oechslin P. RF
ID tracea
bil
i
t
y
: A multila
ye
r pro
b
l
em.
Journ
a
l of
F
i
nanci
a
l Cryp
tograp
hy an
d
Data Security
. 200
5; 357
0: 12
5-14
0.
Evaluation Warning : The document was created with Spire.PDF for Python.