A minimum disclosure approach to authentication and privacy in RFID systems

In this paper we present a novel approach to authentication and privacy in RFID systems based on the minimum disclosure property and in conformance to EPC Class-1 Gen-2 specifications. We present two security schemes that are suitable for both fixed reader and mobile/wireless reader environments, the mutual authentication and the collaborative authentication schemes respectively. Both schemes are suited to the computational constraints of EPC Class-1 Gen-2 passive RFID tags as only the cyclic redundancy check (CRC) and pseudo random number generator (PRNG) functions that passive RFID tags are capable of are used. Detailed security analysis of both our schemes show that they offer robust security properties in terms of tag anonymity, tag untraceability and reader privacy while at the same time being robust to replay, tag impersonation and desynchronisation attacks. Simulations results are also presented to study the scalability of the schemes and its impact on authentication delay. In addition, Yeh et al. (2010) [20] proposed a security scheme for EPC Class-1 Gen-2 based mobile/wireless RFID systems. We show that this scheme has a security vulnerability and is not suitable for mobile/wireless RFID systems.