A privacy-restoring mechanism for offline RFID systems

  • Authors:
  • Gildas Avoine;Iwen Coisel;Tania Martin

  • Affiliations:
  • Université catholique de Louvain, Louvain-la-Neuve, Belgium;Université catholique de Louvain, Louvain-la-Neuve, Belgium;Université catholique de Louvain, Louvain-la-Neuve, Belgium

  • Venue:
  • Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Authentication protocols are usually designed to face an adversary who is able to tamper with the channel, possibly with the prover, but rarely with the verifier. When considering large-scale RFID applications, e.g., mass transportation or ticketing, the last threat is no longer a fiction. A typical case is the loss or theft of a handheld reader. If the protocol is expected to be privacy-friendly, and run by offline readers, there is no solution currently to restore the privacy once the readers are compromised except renewing all the tags, which is definitely impractical. We introduce a privacy-friendly authentication protocol that is able to maintain the security level in case of compromised readers, but also gradually restores the privacy thanks to the mobility of the customers in the system. We provide a thorough security analysis and a precise performance evaluation of our proposal. The efficiency of our solution is also demonstrated on a real-life case: we analyze the logs of 55 offline readers used during a 3-day sport event in 2010 that involved more than 100,000 tags.