Research On Authentication Protocol Of RFID Based On Multi-Level Security Policy

With the rapid development of the Internet of Things and the progress of RFID Technology, the technology of RFID has been applied widely in daily life such as logistic tracking, Smart Home, identity authentication and transportation, Etc. On the one hand, RFID technology makes people’s daily life more convenient. On the other hand, it brought forward more stringent requirement for the protection of personal data. Especially in the low-cost RFID system, it gets more and more attention about how to protect the user’s privacy better. Traditional RFID security authentication protocol has less safety performance, high requirement for hardware of tags, large amount of communication volume and it is difficult to meet the security demand for low-cost RFID system.Multi-level security policy mechanism brings up new ideas for improving the security of the low-cost RFID system and reducing the hardware requirement of the tags. Role based access control policy is designed to classify the authentication users and significantly reduce the communications volume of the system, meanwhile, content access control mechanism can control the security of tags’privacy with more flexibility. However, up to now, the combination of these two methods is not many, so there are many technical problems need to be solved. Therefore, in order to increase the security and reduce the hardware requirements for the RFID system, the multi-level security policy of RFID system which based on the RBAC mechanism and content access control mechanism was proposed in this dissertation. Firstly, object-based access control mechanism was used to authenticate the use’s competence in the first level certification. In order to prohibit the unprivileged user and assailants from entering the first-level certification and reduce the amount of communications volume and system power consumption, RBAC mechanism was used in this part. Then, the use of Object-based access control mechanism which sets permissions for attribute, security policy to specific restrictions user’s access scope. In order to protect user privacy more flexible on-demand. Finally, using partial ID, XOR operation to reduce the hardware requirements for the tag, which i n order to achieve the requirements of low-cost RFID systems.Security and performance analysis and experimental results show that compared with traditional authentication protocol of RFID system, the presented authentication protocol of RFID system based on multi-level security policy not only reduced the power consumption system and hardware requirements of tags, but also can be more flexible and safer to protect users’ privacy. A series of attacks experiments and security analysis show that the performance of the proposed protocol is better than traditional protocols. This protocol can effectively resist various known attacks, and specially can withstand unauthorized tag attack and authorized tag’s unauthorized information attack. On the other hand, this protocol has higher security, lower hardware requirements, so it is more suitable for low-cost RFID system.