[Paper Review] Providing a hybrid cryptography algorithm for lightweight authentication protocol in RFID with urban traffic usage case

V. Chegeni, Hamid Haj Seyyed Javadi+2 more|arXiv (Cornell University)|Apr 15, 2021

Advanced Authentication Protocols Security4 citations

TL;DR

This paper proposes a lightweight, hybrid-cryptography-based mutual authentication protocol for RFID systems in urban traffic management, combining symmetric and asymmetric cryptography to ensure high-speed, secure tag-reader communication. The protocol resists spoofing, tracking, and replay attacks while minimizing computational overhead, making it suitable for real-time, resource-constrained environments like smart city infrastructure.

ABSTRACT

Today, the Internet of Things (IoT) is one of the emerging technologies that enable the connection and transfer of information through communication networks. The main idea of the IoT is the widespread presence of objects such as mobile devices, sensors, and RFID. With the increase in traffic volume in urban areas, the existing intelligent urban traffic management system based on IoT can be vital. Therefore, this paper focused on security in urban traffic based on using RFID. In our scheme, RFID tags chose as the purpose of this article. We, in this paper, present a mutual authentication protocol that leads to privacy based on hybrid cryptography. Also, an authentication process with RFID tags is proposed that can be read at high speed. The protocol has attempted to reduce the complexity of computing. At the same time, the proposed method can withstand attacks such as spoofing of tag and reader, tag tracking, and replay attack.

Motivation & Objective

• To address security vulnerabilities in RFID-based urban traffic management systems.
• To design a lightweight authentication protocol suitable for resource-constrained RFID tags.
• To ensure mutual authentication between RFID tags and readers with strong privacy protection.
• To mitigate common attacks such as tag spoofing, tracking, and replay attacks.
• To reduce computational complexity for high-speed operation in real-time traffic applications.

Proposed method

• The protocol integrates symmetric-key cryptography (e.g., lightweight block ciphers) for fast authentication and asymmetric cryptography (e.g., ECC) for key exchange.
• Mutual authentication is achieved through a three-message exchange involving challenge-response mechanisms.
• Tag and reader identities are protected using one-way hash functions and randomization to prevent tracking.
• The use of elliptic curve cryptography (ECC) reduces key size and computational cost compared to traditional public-key systems.
• All cryptographic operations are optimized for low-power RFID tags to ensure high-speed reading and minimal latency.
• The protocol incorporates message integrity checks using hash-based MACs to prevent message tampering.

Experimental results

Research questions

• RQ1 How can a lightweight RFID authentication protocol be designed to meet the performance and security demands of urban traffic systems?
• RQ2 What hybrid cryptographic approach can balance security, efficiency, and resistance to common attacks in RFID systems?
• RQ3 To what extent can computational complexity be reduced while maintaining strong mutual authentication and privacy?
• RQ4 Can the proposed protocol effectively resist spoofing, tracking, and replay attacks in a real-world urban traffic setting?
• RQ5 How does the protocol perform in terms of speed and resource usage compared to existing RFID authentication schemes?

Key findings

• The proposed protocol achieves mutual authentication between RFID tags and readers with minimal computational overhead, suitable for low-power devices.
• The integration of ECC and symmetric cryptography reduces key size and processing time, enhancing performance in high-speed environments.
• The protocol effectively resists spoofing attacks by binding authentication to unique, time-sensitive challenges.
• Tag tracking is prevented through the use of randomized identifiers and one-way hash functions.
• Replay attacks are mitigated by incorporating timestamps and sequence numbers in the challenge-response mechanism.
• The protocol maintains strong privacy by ensuring that no static or predictable information is exposed during communication.