IoT in medical & pharmaceutical: Designing lightweight RFID security protocols for ensuring supply chain integrity

Abstract

Nowadays the sharing of trade in counterfeit and pirated goods is constantly growing and fake products are found in a large number of industries – particularly pharmaceuticals, food, and medical equipment – that can pose serious health and safety risks. With the intention of avoiding any loss of client confidence and any disclosure of sensitive information, Internet of Things (IoT) solutions are increasingly used to fulfill this need for a reliable and secure infrastructure in medical & pharmaceutical industry. When looking at the technologies used to identify products and packaging, balancing security and hardware limitations is often a difficult task and using cost-effective techniques such as bit-oriented lightweight functions is a challenge. In this study, we first assess the security level of a recently proposed protocol and prove its vulnerabilities, due to a lack of complexity in bit-oriented functions. Then, to address these exposed flaws, a lightweight improved protocol based on Authenticated Encryption (AE) cryptosystems is presented. Security analysis results demonstrate that weaknesses of previous efforts have all been adequately addressed; additionally, the improved protocol has a robust security posture in terms of confidentiality and integrity. Moreover, FPGA and ASIC simulations are carried out using five different AE schemes from CAESAR competition to develop three use-cases, in whose best scenario the proposed tag has 731 LUT and needs 3335 gates for the security module.

1. Introduction

Illicit trade in fake goods is a major challenge in the global economy, resulting in a plethora of adverse effects on the economy, as well as on public health, safety, and security [1]. Organized criminal groups operate wherever there is an opportunity to make profits from counterfeiting or piracy operations, frequently bypassing security measures. Despite continuous efforts to monitor this risk, the share of trade in counterfeit and pirated goods is constantly growing, and fake or fraudulent products are found in a large and growing number of industries, particularly pharmaceuticals, food and drink, and medical equipment, that can pose serious health and safety risks. Every day new threats of counterfeits are reported [2] in this billion-dollar market, in which approximately half of the counterfeit pharmaceuticals sold are fraudulent versions of treatments. This is “an unaffordable vulnerability” [3]. With “counterfeiting and piracy on the rise”, it is no surprise that the current context of the COVID-19 pandemic opens great opportunities for counterfeiters [4], as governments the world over are looking for COVID-19 facemasks and test kits. Since the onset of the crisis, many cases have been reported in the news where authorities have intercepted counterfeit COVID-19 test kits, pressing worldwide anti-fraud centers as well as the United States’ Food and Drug Administration (FDA) [5] to alert consumers about unauthorized fraudulent test kits.

To combat this risk surrounding the rising significance of counterfeit products and medications, government agencies (e.g. the FDA) and organization (e.g. pharmaceutical suppliers) are exploring enforcement solutions, among which IoT solutions can help maintain a secure supply chain [6]. Moreover, the adoption of IoT technologies in the healthcare and pharmaceutical sectors is continuously expanding, including – among other aspects – a high demand for hospital-based IoT services oriented towards patient safety, work efficiency, and medical environment management [7]. Within the IoT ecosystem, radio frequency identification (RFID) technologies are among the technologies most used to enable automatic identification and tracking of products, people, and assets. In fact, various RFID initiatives have been undertaken since the early 2000s to secure supply chain integrity by supporting real-time tracking, tracing & authentication of pharmaceuticals products. Since then, the RFID market has grown and is currently estimated to be valued at over one billion US$ [8]. Assuredly, counterfeit drugs concerns have encouraged the industry to use RFID technologies within pharmaceutical supply chains, with industry players ranging from drug manufacturers to packaging solutions providers, warehouse and distribution centers, to clinical facilities. Today “mass serialization” is proposed as the standard for identifying drug packages, by equipping each of them with a unique identifier, such as a 2D barcode or RFID entered into an online database for track-and-trace purposes. Unfortunately, weaknesses in track-and-trace the system leave the system vulnerable to counterfeiters, calling for an increased attention towards RFID technology adoption [9], aligned with the Drug Quality and Security Act [10] and the Drug Supply Chain Security Act [11].

Ironically, if these technologies are to prevent trade in counterfeit and pirated goods, they may themselves constitute an issue. Given the importance of RFID (and other IoT devices) used to track and manage supply chains, security issues are raised by the professional and academic community, calling for security requirements at all layers of any IoT-based infrastructure [12]. In fact, in a recent bibliometric analysis on IoT, Dachyar et al. [13] found a significant increase in the number of articles on IoT – with growth and development in an interdisciplinary manner – and, following a pattern of analysis of research trends, they show a clearly-increasing number of researches on security attacks and protocols. This is particularly important with passive Ultra High Frequency (UHF) RFID tags equipped with a highly constrained microchip holding limited processing power and memory capabilities. These tags, constituting the first layer of an RFID infrastructure (Fig. 1), are used to identify $R_X$ drugs, high value and consignment products in hospitals, to track biospecimen sampling or COVID-19 test kits in the supply chain. Fig. 2 (adapted from GS1[14]) shows the supply chain activities where key steps are undertaken. Without the proposed RFID tag security – at any of these steps – malicious attacks may be undertaken. For better understanding, COVID-19 test kits will be employed here as a realistic use case to illustrate the effect of health and safety risks in bypassing security measures. In the following scenario we consider a supply chain process involved in production of a COVID-19 test kit from a plant to a hospital, assuming that RFID tags are encoded and applied to final assembled kits targeted for tracking as well as to the component products contained in the kits requiring identification. A potential attack scenario could be implemented as follows:

Fig. 1.

The infrastructure of an IoT-enabled traceability system.

Fig. 2.

Opportunities to conduct a malicious attack in the supply chain.

• 1.RFID tags are applied to COVID-19 test kits (for collection of nasal swab specimens) to ensure automatic identification (for efficient logistics management), authentication (for patient safety), and anti-counterfeit measures (for brand protection).
• 2.Kits are shipped from the assembly plant.
• 3.
  Kits are received and completed at the packaging sites (where RFID tag is applied) opportunity to conduct an attack:

  • (a)
    Tags information is captured (using an unauthorizedreader);
  • (b)
    Kits equipped with original RFID tags are identified in the shipping zone;
  • (c)
    New tags are cloned;
  • (d)
    New tags are applied to the fake kits;
  • (e)
    Fake kits are shipped as “authentic kits” to the distribution center;
  • (f)
    Authentic kits are sold to selected customers.
• 4.
  Fake kits are received at the distribution center where they are stored and cross the dock to clinical sites:

  • (a)
    Opportunity for conducting a similar attack to the one described at the packaging site above.
• 5.
  Kits are received at the hospital, where they are temporarily stored and used. Another opportunity to conduct an attack arises here:

  • (a)
    Tags information is captured (using an unauthorizedreader);
  • (b)
    Kits (tags) are identified and retrieved in the storage area in the hospital;
  • (c)
    Authentic kits are stolen;
  • (d)
    Fake kits are produced to replace authentic kits;
  • (e)
    Fake kits are used with potential harmful effects to the health of the patients;
  • (f)
    Authentic kits are sold directly to selected customers (according to the best offer).

As discussed in the above scenario, a malicious attack can be undertaken at various phases of the supply chain, compromising it’s integrity and raising the critical importance for securing any layer of the supporting IT infrastructure. In an IoT-based medical system, one of the weakest layer may be the technology used for item automatic identification and data capture. By incurring an unauthorized access to the information on tags (e.g. passive disclosure attack) an adversary could then compromise the whole system. Therefore, researchers are working on the development of secure authentication and communication protocols to prevent malicious attacks. For example, Li et al. [15] presented an authentication protocol for Telecare Medicine Information Systems (TMIS) and claimed that the proposed protocol is able to satisfy the security requirements of a Medical IoT system. However, Bensallah et al. and Zhou et al. [16], [17], in two different research papers, proved that Li et al.’s protocol is vulnerable to desynchronization and impersonation attacks. In addition, Zheng et al. [18] proposed another lightweight authentication protocol for TMIS system based on a Hash function by which Safkhani and Vasilakos [19] showed that their protocol is not resistant against replay, impersonation, and desynchronization attacks. On the other hand, other researchers attempted to present an authentication protocol based on ECC (Elliptic Curve Cryptography) cryptosystems for medical applications. For example, Liao and Hsiao [20] designed an ECC-based protocol which Zhao et al. [21] proved their vulnerability to a tag disclosure attack. In addition, in order to increase the security level, Chou et al. [22] used a combination of a hash function and an ECC module in their protocol. However, Zhang and Qi [23] – by showing the weaknesses of Zhou et al.’s protocol – presented a new protocol with the same concept. Finally, Farash [24] proved in turn that Zhang and Qi’s protocol is also vulnerable to an impersonation attack. Fotouhi et al. suggested a lightweight protocol based on the two-factor authentication scheme [25]. The proposed protocol was designed for wireless body area networks (WBAN) in health-care IoT applications and by using XOR and hash functions provided a secure environment. Another WBAN-based protocol for e-health systems was introduced by Arfaoui et al. [26]. In order to respect patients’ privacy and protect the confidential data of medical records, the authors presented a context-aware and lightweight anonymous authentication and key agreement scheme which was suitable for applications in emergency and normal situations.

Since using an ECC cryptosystem alone cannot guarantee the security of a protocol, as well as it causes more burden on a tag’s hardware, some research have been undertaken on ultra-lightweight and lightweight protocols. For instance, Fan et al. [27] recently proposed a lightweight RFID mutual authentication scheme and suggested relevance to application in medical privacy protection in IoT systems. The authors analyzed the security of the proposed protocol and claimed that it provides tag anonymity, replay attack resistance, synchronization attack resistance, forward secrecy, mutual authentication, and DoS attack resistance. However, a subsequent review revealed that the proposed protocol suffers from trivial weaknesses, as was shown by Aghili and Malla [28] and more comprehensively later by Aghili et al. [29]. In those works, the security of the proposed scheme is scrutinized and serious security pitfalls are shown. More precisely, they present an efficient secret disclosure and traceability attacks that violate the designers’ claims. In addition, by focusing on bit-oriented operations in the ultra-lightweight function, Aghili et al. [29] also proposed an improved protocol called SecLAP following the same design strategy and stated optimum security against an active adversary who can control the channel between the tag and the reader as well as between the reader and the server. Although the authors claimed SecLAP was fully secure, we show that this protocol has serious security breaches, which we intend to address here. We present traceability and passive secret disclosure attacks against this protocol, with the complexity of eavesdropping one session of the protocol and with success probability of ‘1’. The disclosed parameters can be used to trace the tag/reader in any later session, which compromises tag/reader privacy. In addition, we present below a passive full secret disclosure attack against SecLAP which is capable of disclosing a $2n$-bit secret key, $n$-bit $TID$ and $n$-bit $RID$ with the computational complexity of $27n^7$. We explain limitations of ultra-lightweight protocols that cause the above protocols to compromise. Given that new authentication protocols have recently been introduced with lightweight cryptographic methods which have complicated protocol’s structures [30], we present an uncomplicated improved protocol and employ a cryptosystem that provides a higher security level than ultra-lightweight functions and is able to satisfy the hardware requirements of lightweight tags.

The Paper’s Contribution: This paper has three main contributions:

• 1.We provide the first third-party security analysis of SecLAP, which may be the latest attempt to design a secure ultra-lightweight protocol for constrained environments. More precisely, we execute a passive attack, which can partially disclose secret parameters of the protocol with the complexity of eavesdropping on one session of the protocol with negligible computational complexity. In addition, we present a full secret disclosure attack that can extract all secret parameters of the protocol with the complexity of $27n^7$.
• 2.To overcome the security flaws in SecLAP, we present an improved protocol based on an Authenticated Encryption (AE) scheme and provide informal and formal security evaluations to show the robustness of the protocol. This scheme not only is able to solve the confidentiality issues of the current protocols, but also provides the message integrity simultaneously.
• 3.Given that an AE module can use different implementation designs, we simulate the structure of a tag (FPGA and ASIC) under five encryption schemes and measure its hardware requirement as a candidate for constrained environments. We show that the improved protocol can meet the security requirements with a reasonable hardware cost.

Paper Organization : The required preliminaries and a brief description of SecLAP protocol are introduced in Section 2. We present results of security investigation of SecLAP protocol in Section 3. Then, we discuss our suggested encryption scheme in Section 4 and propose the improved protocol in Section 5. The security analysis and hardware implementation results are respectively explained in Sections 6, 7 and we conclude the paper in Section 8.

2. Preliminaries

2.1. Notations

Table 1 depicts the notations used in the rest of this paper. In order to propose a robust ultra-lightweight protocol, Aghili et al. presented a new component called modular rotation function $MRo{t}_{\left(K\right)}(X,Y)$ which is used in the structure of SecLAP. Given two $n$-bit strings $X$ and $Y$ and a $2n$-bit string $K=k_1\parallel k_0$, the modular rotation function $MRo{t}_{\left(K\right)}(X,Y)$ is defined as follows:

Table 1.

Notations used in this paper.

Symbol	Description
$R$	An RFID reader
$RID$	The identification value of the reader $R$
$S$	A cloud server
$T$	An RFID tag
$TID$	The identification value (ID) of the tag $T$
$K$	The current session number
$K_{new}$	The new session number
$PRNG\left(\right)$	The pseudo random number generator
$Cro(x,y)$	The bit-oriented operation defined by Fan et al.
$Rot(x,y)$	The rotation of sting $x$ based on the hamming weight of $y$
$MRo{t}_K(x,y)$	The bit-oriented operation defined which is used in SecLAP
$od\left(x\right)$	Odd bits of string $x$.
$ev\left(x\right)$	Even bits of string $x$.
$\oplus$	The bitwise XOR operation
$\parallel$	The concatenation operation
$Mark$	Two temporary bits that are used to indicate the status of the last session
$\overline{X}$	The bitwise complement of the string $X$
$I{D}_t$	Tag’s ID in the improved protocol
$IDS$	Secret Tag’s ID in the improved protocol
$K_t$	Encryption key
$N_x$	A random number

• •As illustrated in Fig. 3, the odd bits of $X$ are concatenated with the even bits of $Y$, the result is XORed by the bits of $k_1$ and the result is rotated to the left depending on the value of $(Y\oplus k1)modn$. The result is used as the odd bits of the final result. We can represent it as $[(od\left(X\right)\parallel ev\left(Y\right))\oplus k_1]⋘\left[(Y\oplus k_0)modn\right]$, where $od\left(X\right)$ and $ev\left(Y\right)$ respectively denote the odd bits of $X$ and the even bits of $Y$.
• •The even bits of $X$ are concatenated with the odd bits of $Y$, the result is XORed by the bits of $k_0$ and the result is rotated to the left depending on the value of $(Y\oplus k2)modn$. The result is used as the even bits of the final result. We can represent it as $[(ev\left(X\right)\parallel od\left(Y\right))\oplus k_0]⋘\left[(Y\oplus k_1)modn\right]$.

Fig. 3.

The structure of $MRo{t}_{\left(K\right)}(X,Y)$ function in SecLAP, where $K=k_1\parallel k_0$.

It is clear $MRo{t}_{\left(K\right)}(X,Y)$ is more complicated compared to $Cro(X,Y)$ that has been explained in the Appendix.

2.2. Random Oracle Model (ROM)

Random Oracle [31] is a random black box function that provides a unique response for a truly random input as a security proof for evaluating protocols. Every time a same input is given to the random oracle function, the same output is returned. A Random Oracle Model, denoted by $\mathcal{R}$, is defined by $\mathcal{R}:{\{0,1\}}^{\ast }\to {\{0,1\}}^{\infty }$. Here $\mathcal{R}$ is a function chosen uniformly at random from the set of all functions with the same domain and range.

In general (as in our paper), the output’s length of $\mathcal{R}$ is predefined to some fixed value, e.g. $m$ bits. Hence, we re-define $\mathcal{R}$ as ${\mathcal{R}}_m:{\{0,1\}}^{\ast }\to {\{0,1\}}^m$. Given an input $x\in {\{0,1\}}^{\ast }$, ${\mathcal{R}}_m$ will give $y={\mathcal{R}}_m\left(x\right)\in {\{0,1\}}^m$ as the output.

2.2.1. Adversary

We consider a computationally unbounded adversary with access to ${\mathcal{R}}_m$ or a real cryptographic component $\mathcal{C}$, which could be a cryptographic protocol $\mathcal{P}$ and $m$ is the total length of the observable messages in each query. The adversary’s “running time” is determined by the number of oracle queries that it makes to $\mathcal{C}∕{\mathcal{R}}_m$. We use the symbol $O$ (big-Oh), for “the expected running time of at most” and $\Omega$ (big-Omega), for “the expected running time not less than”.

2.2.2. Indistinguishability

In the cryptology terminology, ${\mathcal{R}}_m$ is considered as an ideal system and the distinguisher tries to distinguish the candidate crypto system $\mathcal{C}$ with $m$-bit output length from ${\mathcal{R}}_m$. In the framework of indistinguishability, the distinguisher faces with either $\mathcal{C}$ or ${\mathcal{R}}_m$ and aims to understand whether interacts with $\mathcal{C}$ or ${\mathcal{R}}_m$. Now we present the formal definition of indistinguishability following [32]:

Considering a probabilistic polynomial time (PPT) algorithm $D$ (called distinguisher) as an algorithm that its running time on input $x\in {\{0,1\}}^{\ast }$ is at most $t=p\left(\left|x\right|\right)$ and may use (true) randomness to produce (possibly) non-deterministic results. The crypto system $\mathcal{C}$ and the random oracle ${\mathcal{R}}_m$ are (computationally) indistinguishable if for any PPT distinguisher $D$, interacting with one of these components and generating a binary output ($0$ or $1$), it holds that:

$$|Pr\left[D^{\mathcal{C}}=1\right]-Pr\left[D^{{\mathcal{R}}_m}=1\right]|<ϵ$$

where $ϵ$ is a negligible function of the security parameter $k$.

In this framework, the maximum number of queries is bounded and denoted by $q$.

A crypto system $\mathcal{C}$ is said to be $(t_D,q,ϵ)$ indistinguishable from a random oracle ${\mathcal{R}}_m$ if for any PPT distinguisher $D$ with $t\le p\left(\left|x\right|\right)$ and performs at most $q$ queries to $\mathcal{C}∕{\mathcal{R}}_m$ it holds that:

$$|Pr\left[D^{\mathcal{C}}=1\right]-Pr\left[D^{{\mathcal{R}}_m}=1\right]|<ϵ$$

where $ϵ$ is a negligible function of the security parameter $k$.

2.3. Description of SecLAP

SecLAP was proposed to improve the security drawbacks of its predecessor (Fan et al.) based on a similar designing paradigm. As depicted in Fig. 4, it is implemented as follows:

Fig. 4.

Mutual authentication phase of SecLAP  [29].

• 1.The reader starts the authentication process by generating a new random number $N_R$ and sends it along with $Query$ to the tag.
• 2.
  Once the tag receives the message, it:

  • •
    generates a random number $N_T$;
  • •
    computes $M_1=MRo{t}_{\left(K_i\right)}(TID\oplus N_R,od\left(K_i\right)\oplus N_T)$ and $M_2=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_R,TID\oplus N_T)$;
  • •
    and sends $N_T\Vert M_1\Vert M_2$ to the reader;
• 3.Upon receipt of the message, the reader obtains $TID$ from $M_1$ and verifies the received $M_2$. Then, it computes $ID{X}_i=MRo{t}_{\left(K_i\right)}(RID\oplus od\left(K_i\right),TID)$, $ID{C}_i=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus TID,RID)$, $M_3=ID{X}_i\oplus K_i$ and $M_4=MRo{t}_{\left(K_i\right)}(N_T\oplus od\left(ID{C}_i\right),ev\left(ID{C}_i\right)\oplus N_R)$, and forwards $N_T\parallel N_R\parallel M_3\parallel M_4$ to the server. If the tag is not authenticated, the protocol will be terminated.
• 4.
  When the server receives the message:

  • •
    extracts $ID{X}_i$ and finds the related $K_i$ and $ID{C}_i$ in the database $IDT$ and verifies the received $M_4$;
  • •
    generates another random number $N_S$;
  • •
    computes $M_5=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_S,od\left(ID{C}_i\right)\oplus N_R)$, $M_6=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S,ev\left(ID{C}_i\right)\oplus N_S)$ and sends $M_5\parallel M_6$ to the reader.
• 5.
  Once the reader receives $M_5\parallel M_6$, it:

  • •
    retrieves $N_S$ from $M_6$ and verifies the received $M_5$;
  • •
    computes $M_7=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S,TID\oplus N_T)$ and $M_8=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_S,TID\oplus N_S)$;
  • •
    and sends $M_7\parallel M_8$ to the tag;
• 6.
  Once receipt the message $M_7\parallel M_8$, the tag:

  • •
    retrieves $N_S$ from $M_7$ and verifies $M_8$ to authenticate the server/reader;
  • •
    calculates $K_{i+1}=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S\oplus N_R\oplus N_T\oplus ev\left(K_i\right),TID)$;
  • •
    computes $M_9=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus TID,N_R\oplus N_S)$ and $M_{10}=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus TID\oplus ev\left(K_{i+1}\right),N_S)$;
  • •
    and sends $M_9\parallel M_{10}$ to the reader.
• 7.
  When the reader receives the message, it:

  • •
    calculates $K_{i+1}=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S\oplus N_R\oplus N_T\oplus ev\left(K_i\right),TID)$ and verifies the received $M_9\parallel M_{10}$;
  • •
    computes $M_{11}=MRo{t}_{\left(K_i\right)}(ev\left(ID{C}_i\right)\oplus ev\left(K_{i+1}\right),N_R\oplus N_S)$, $M_{12}=MRo{t}_{\left(K_i\right)}(od\left(ID{C}_i\right)\oplus ed\left(K_{i+1}\right),N_R\oplus N_S)$, $ID{X}_{i+1}=MRo{t}_{\left(K_i\right)}(RID\oplus od\left(K_{i+1}\right),TID)$, $ID{C}_{i+1}=MRo{t}_{\left(K_i\right)}(TID\oplus ev\left(K_{i+1}\right),RID)$, $M_{13}=ID{X}_{i+1}\oplus K_i$, $M_{14}=MRo{t}_{\left(K_i\right)}(ev\left(ID{C}_{i+1}\right)\oplus M_{11},N_R\oplus N_S)$, $M_{15}=MRo{t}_{\left(Ki\right)}(od(IDCi+1)\oplus M_{12},N_T\oplus N_S)$, $M_{16}=MRo{t}_{\left(K_i\right)}(od\left(ID{C}_{i+1}\right)\oplus ev\left(ID{C}_{i+1}\right),N_S)$;
  • •
    and sends $M_{11}\parallel M_{12}\parallel M_{13}\parallel M_{14}\parallel M_{15}\parallel M_{16}$ to the server.
• 8.
  Once the server receives the message, it:

  • •
    extracts $K_{i+1}$, $ID{X}_{i+1}$ and $ID{C}_{i+1}$ respectively from $M_{11}$, $M_{12}$, $M_{13}$, $M_{14}$ and $M_{15}$ and verifies $M_{16}$ accordingly to update $K_i$ and $K_{i+1}$,
  • •
    adds $(ID{X}_{i+1},K_{i+1},ID{C}_{i+1})$ to its database $IDT$,
  • •
    computes $M_{17}=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus ev\left(ID{C}_{i+1}\right),N_S\oplus N_R)$ and sends it to the reader.
• 9.Upon receipt of the message $M_{17}$, the reader verifies it before updating $K_i$ as $K_{i+1}$. If $M_{17}$ is verified correctly, the reader computes $M_{18}=MRo{t}_{\left(K_i\right)}(ev\left(K_{i+1}\right)\oplus N_T\oplus od\left(K_{i+1}\right),TID\oplus N_S)$ and sends it to the tag.
• 10.The tag verifies the correctness of received $M_{18}$ to update $K_i$ as $K_{i+1}=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S\oplus N_R\oplus N_T\oplus ev\left(K_i\right),TID)$ and the protocol is completed.

3. Security analysis of SecLAP

Aghili et al. have claimed the optimum security of SecLAP against an active adversary, and showed that SecLAP is completely secure by using informal and formal evaluations like Burrows–Abadi–Needham (BAN) logic. In this section, we present a security evaluation and prove that SecLAP is not resistant against secret disclosure and traceability attacks.

3.1. Partial secret disclosure attack

This section explains some properties of SecLAP that can be used to reveal information related to secret parameters. Based on this information, the adversary can trace the tag or the reader which compromise their anonymity. More precisely:

$${\oplus }_{j=0}^{2n-1}{\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)}_j=\left({\oplus }_{j=0}^{n-1}od{\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}ev{\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)}_j\right)$$ (1)

On the other hand, from the definition of $MRo{t}_{\left(K_i\right)}(X,Y)$ we know that the $od\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)=[(od\left(X\right)\parallel ev\left(Y\right))\oplus k_1]⋘\left[(Y\oplus k_0)modn\right]$ and $ev\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)=[(ev\left(X\right)\parallel od\left(Y\right))\oplus k_0]⋘\left[(Y\oplus k_1)modn\right]$. Hence:

$${\oplus }_{j=0}^{2n-1}{\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)}_j=\left({\oplus }_{j=0}^{n-1}{[(od\left(X\right)\parallel ev\left(Y\right))\oplus k_1]}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{[(ev\left(X\right)\parallel od\left(Y\right))\oplus k_0]}_j\right)$$ (2)

The above equation can be simplified as follow:

$${\oplus }_{j=0}^{2n-1}{\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)}_j=\left({\oplus }_{j=0}^{n-1}{X}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{Y}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(K_i\right)}_j\right)$$ (3)

Next, assume that the adversary has eavesdropped the first run of the exchanged messages between the reader and the tag, i.e., $N_R$ and $N_T\Vert M_1\Vert M_2$, where $M_1=MRo{t}_{\left(K_i\right)}(TID\oplus N_R,od\left(K_i\right)\oplus N_T)$ and $M_2=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_R,TID\oplus N_T)$. According to the above argument, we can write:

$${\oplus }_{j=0}^{2n-1}{\left(M_1\right)}_j=\left({\oplus }_{j=0}^{n-1}{(TID\oplus N_R)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}(od\left(K_i\right)\oplus N_T)j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(K_i\right)}_j\right)$$ (4)

and:

$${\oplus }_{j=0}^{2n-1}{\left(M_1\right)}_j\oplus \left({\oplus }_{j=0}^{n-1}{\left(N_R\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}\left(N_T\right)j\right)=\left({\oplus }_{j=0}^{n-1}{\left(TID\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{\left(ev\left(K_i\right)\right)}_j\right)$$ (5)

Similarly, we can argue that:

$${\oplus }_{j=0}^{2n-1}{\left(M_2\right)}_j\oplus \left({\oplus }_{j=0}^{n-1}{\left(N_R\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}\left(N_T\right)j\right)=\left({\oplus }_{j=0}^{n-1}{\left(TID\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{\left(od\left(K_i\right)\right)}_j\right)$$ (6)

and, given Eqs. (5), (6):

$$\left({\oplus }_{j=0}^{2n-1}{\left(M_1\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_2\right)}_j\right)={\oplus }_{j=0}^{2n-1}{\left(K_i\right)}_j$$ (7)

In any of Eqs. (5), (6), the left side is a linear combination of the public parameters and the right side is a linear combination of secret parameters. Hence, each equations reveals a bit of the secret information. In addition, as long as the tag has not updated its secrets those bits of information remain fixed and the adversary can use it as a source of traceability, which compromises the designers claim on the security of the protocol against traceability.

Given that the channel between the reader and the server is also insecure, to trace the reader, the adversary eavesdrops $ID{X}_i$, a sent message from the reader to the server, where $ID{X}_i=MRo{t}_{\left(K_i\right)}(RID\oplus od\left(K_i\right),TID)$. Recall from Eq. (3):

$${\oplus }_{j=0}^{2n-1}{\left(ID{X}_i\right)}_j=\left({\oplus }_{j=0}^{n-1}{\left(RID\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{\left(TID\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{\left(ev\left(K_i\right)\right)}_j\right)$$ (8)

Combining Eqs. (8), (5), reveals a single bit of $RID$ as follows:

$$\left({\oplus }_{j=0}^{2n-1}{\left(ID{X}_i\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_2\right)}_j\right)={\oplus }_{j=0}^{n-1}{\left(RID\right)}_j$$ (9)

It worth noting that the related information in Eq. (9) is independent of the tag’s data. Hence it is enough to compromise the reader anonymity.

Other eavesdropped messages by the adversary could be used to disclose other information as follows:

• 1.$ID{C}_i=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus TID,RID)$, $M_3=ID{X}_i\oplus K_i$ and $M_4=MRo{t}_{\left(K_i\right)}(N_T\oplus od\left(ID{C}_i\right),ev\left(ID{C}_i\right)\oplus N_R)$ sent from the reader to the server,
• 2.$M_5=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_S,od\left(ID{C}_i\right)\oplus N_R)$, $M_6=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S,ev\left(ID{C}_i\right)\oplus N_S)$ sent from the server to the reader,
• 3.$M_7=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S,TID\oplus N_T)$ and $M_8=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_S,TID\oplus N_S)$ sent from the reader to the tag,
• 4.$M_9=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus TID,N_R\oplus N_S)$ and $M_{10}=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus TID\oplus ev\left(K_{i+1}\right),N_S)$ sent from the tag to the reader,
• 5.$M_{11}=MRo{t}_{\left(K_i\right)}(ev\left(ID{C}_i\right)\oplus ev\left(K_{i+1}\right),N_R\oplus N_S)$, $M_{12}=MRo{t}_{\left(K_i\right)}(od\left(ID{C}_i\right)\oplus ed\left(K_{i+1}\right),N_R\oplus N_S)$, $ID{X}_{i+1}=MRo{t}_{\left(K_i\right)}(RID\oplus od\left(K_{i+1}\right),TID)$, $ID{C}_{i+1}=MRo{t}_{\left(K_i\right)}(TID\oplus ev\left(K_{i+1}\right),RID)$, $M_{13}=ID{X}_{i+1}\oplus K_i$, $M_{14}=MRo{t}_{\left(K_i\right)}(ev\left(ID{C}_{i+1}\right)\oplus M_{11},N_R\oplus N_S)$, $M_{16}=MRo{t}_{\left(K_i\right)}(od\left(ID{C}_{i+1}\right)\oplus ev\left(ID{C}_{i+1}\right),N_S)$ sent from the reader to the server,
• 6.$M_{17}=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus ev\left(ID{C}_{i+1}\right),N_S\oplus N_R)$ sent from the server to the reader,
• 7.$M_{18}=MRo{t}_{\left(K_i\right)}(ev\left(K_{i+1}\right)\oplus N_T\oplus od\left(K_{i+1}\right),TID\oplus N_S)$ sent from the reader to the tag,

For example:

$$\left({\oplus }_{j=0}^{2n-1}{\left(M_6\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(ID{C}_i\right)}_j\right)=\left({\oplus }_{j=0}^{n-1}{\left(ev\left(K_i\right)\right)}_j\right)$$ (10)

Now the combination of Eqs. (5), (10), reveals a bit of $TID$, as follows:

$$\left({\oplus }_{j=0}^{2n-1}{\left(M_6\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(ID{C}_i\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_1\right)}_j\right)=\left({\oplus }_{j=0}^{n-1}{\left(ev\left(K_i\right)\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{\left(TID\right)}_j\right)\oplus \left({\oplus }_{j=0}^{n-1}{\left(ev\left(K_i\right)\right)}_j\right)={\oplus }_{j=0}^{n-1}{\left(TID\right)}_j$$ (11)

Given that $TID$ will not be updated at the end of the session, it can be used to compromise the tag’s anonymity and trace the tag holder in any session.

Similarly,

$$\left({\oplus }_{j=0}^{2n-1}{\left(M_9\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_{10}\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(N_R\right)}_j\right)=\left({\oplus }_{j=0}^{n-1}{\left(ev\left(K_{i+1}\right)\right)}_j\right)$$ (12)

and from $ID{X}_{i+1}$ and Eqs. (7), (9), (11) we can disclose $\left({\oplus }_{j=0}^{n-1}{\left(od\left(K_{i+1}\right)\right)}_j\right)$, which combined with Eq. (12) reveals two bits of $K_{i+1}$ and also $\left({\oplus }_{j=0}^{n-1}{\left(K_{i+1}\right)}_j\right)$.

The success probability of disclosing all values mentioned in this section is ‘1’ and the complexity is only eavesdropping one session of the protocol.

In Fig. 5, a toy example of calculation of $M_1=MRo{t}_{\left(K_i\right)}(TID\oplus N_R,od\left(K_i\right)\oplus N_T)$ when $N_R=11100101$, $N_T=111010110$, $TID=01110011$ and $Ki=0011011011000101$ is provided. Following this example, $M_1=1110110011000000$. On the other hand: see equations in Box I.

Fig. 5.

A toy example of calculation of $M_1=MRo{t}_{\left(K_i\right)}(TID\oplus N_R,od\left(K_i\right)\oplus N_T)$.

Box I.

$$\left({\oplus }_{j=0}^7{\left(N_R\right)}_j\right)=1\oplus 1\oplus 1\oplus 0\oplus 0\oplus 1\oplus 0\oplus 1=1\left({\oplus }_{j=0}^7{\left(N_T\right)}_j\right)=1\oplus 1\oplus 1\oplus 0\oplus 1\oplus 0\oplus 1\oplus 1\oplus 0=0\left({\oplus }_{j=0}^{15}{\left(M_1\right)}_j\right)=1\oplus 1\oplus 1\oplus 0\oplus 1\oplus 1\oplus 0\oplus 0\oplus 1\oplus 1\oplus 0\oplus 0\oplus 0\oplus 0\oplus 0\oplus 0=1\left({\oplus }_{j=0}^7{\left(TID\right)}_j\right)=0\oplus 1\oplus 1\oplus 1\oplus 0\oplus 0\oplus 1\oplus 1=1\left({\oplus }_{j=0}^7{\left(ev\left(K_i\right)\right)}_j\right)=0\oplus 1\oplus 1\oplus 0\oplus 1\oplus 0\oplus 1\oplus 1=1\left({\oplus }_{j=0}^7{\left(N_R\right)}_j\right)\oplus \left({\oplus }_{j=0}^7{\left(N_T\right)}_j\right)\oplus \left({\oplus }_{j=0}^{15}{\left(M_1\right)}_j\right)=1\oplus 0\oplus 1=0\left({\oplus }_{j=0}^7\left(ev\left(K_i\right)\right)\right)\oplus \left({\oplus }_{j=0}^7{\left(TID\right)}_j\right)=1\oplus 1=0$$

Which shows that as it is expected from Eq. (5), ${\oplus }_{j=0}^{15}{\left(M_1\right)}_j\oplus \left({\oplus }_{j=0}^7{\left(N_R\right)}_j\right)\oplus \left({\oplus }_{j=0}^7\left(N_T\right)j\right)=\left({\oplus }_{j=0}^7{\left(TID\right)}_j\right)\oplus \left({\oplus }_{j=0}^7{\left(ev\left(K_i\right)\right)}_j\right)$. In this way, the adversary could extract one bit hidden information.

3.2. Full secret disclosure attack

The secret parameters of SecLAP are $K_i\in {\{0,1\}}^{2n}$, $TID\in {\{0,1\}}^n$ and $RID\in {\{0,1\}}^n$, where $TID$ and $RID$ are constant values while $K_i$ is a dynamic value which is updated after each successful run of the protocol. Most of the transferred messages are masked by $K_i$ and produced by $MRo{t}_{\left(K_i\right)}(.)$, which is more complicated than the $Cro(.)$ used by Fan et al. Hence, designers of SecLAP expect decent protocol security against secret disclosure attacks. However, we present an attack to extract those secret parameters efficiently. Despite the designers’ claim that SecLAP is secure even against an active adversary – with full control over the channel between the tag and the reader and the reader and the server – we consider the weakest adversary who can only eavesdrop the channel between the tag and the reader, let alone the server and the reader. To initiate the attack, we assume that the adversary eavesdrops any transferred message from the tag $T$ to the reader $R$ or from the $R$ to $T$ in session $i$; this is known as the learning phase of the attack. Hence, at the end of this learning phase, the adversary very likely has the following information:

• •$N_R$ sent from $R$ to $T$;
• •$M_1=MRo{t}_{\left(K_i\right)}(TID\oplus N_R,od\left(K_i\right)\oplus N_T)$ and $M_2=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_R,TID\oplus N_T)$ and $N_T$ sent from $T$ to $R$;
• •$M_7=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S,TID\oplus N_T)$ and $M_8=MRo{t}_{\left(K_i\right)}(ev\left(K_i\right)\oplus N_S,TID\oplus N_S)$ sent from $R$ to $T$;
• •$M_9=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus TID,N_R\oplus N_S)$ and $M_{10}=MRo{t}_{\left(K_i\right)}(od\left(K_{i+1}\right)\oplus TID\oplus ev\left(K_{i+1}\right),N_S)$ sent from $T$ to $R$;
• •$M_{18}=MRo{t}_{\left(K_i\right)}(ev\left(K_{i+1}\right)\oplus N_T\oplus od\left(K_{i+1}\right),TID\oplus N_S)$ sent from $R$ to $T$;

On the other hand, from the definition of $MRo{t}_{\left(K_i\right)}(X,Y)$ we know that the $od\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)=[(od\left(X\right)\parallel ev\left(Y\right))\oplus k_1]⋘\left[(Y\oplus k_0)modn\right]$ while $ev\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)=[(ev\left(X\right)\parallel od\left(Y\right))\oplus k_0]⋘\left[(Y\oplus k_1)modn\right]$ is used to produce the even bits of $MRo{t}_{\left(K_i\right)}(X,Y)$. Hence, we can argue that any bit $r$ of the output, $O_r=\left(MRo{t}_{\left(K_i\right)}{(X,Y)}_r\right)$, is a linear function of a bit from $K$ with either a bit from $X$ or a bit from $Y$, i.e. $O_r=c\times {\left(X\right)}_s\oplus \overline{c}\times {\left(Y\right)}_t\oplus {\left(K_b\right)}_u$, where $b,c\in \{0,1\}$, $r\in \{0,1,\dots ,2n-1\}$, and $s,t,u\in \{0,1,\dots ,n-1\}$. However we may not know the exact value of $s,t$ and $u$, from the definition of $MRo{t}_{\left(K_i\right)}(X,Y)$, we know that if $r$ is an odd value then $s$ will also be an odd value while $t$ will be even and if $r$ is an even value then $s$ will also be even while $t$ will be odd. In addition, if $O_r={\left(X\right)}_s\oplus {\left(Y\right)}_t\oplus {\left(K_b\right)}_u$ then $O_{r+2z}={\left(X\right)}_{s+2z}\oplus {\left(Y\right)}_{t+2z}\oplus {\left(K_b\right)}_{u+2z}$, for any $z\in \{0,1,\dots ,n-1\}$, obviously addition takes place module $n$. In addition, given $u$ and $b$ in ${\left(k_b\right)}_u$, we can uniquely determine related values of $s$ and $t$. It comes from the fact that $od\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)⋙\left[(Y\oplus k_0)modn\right]=[(od\left(X\right)\parallel ev\left(Y\right))\oplus k_1]$ while $ev\left(MRo{t}_{\left(K_i\right)}(X,Y)\right)⋙\left[(Y\oplus k_1)modn\right]=[(ev\left(X\right)\parallel od\left(Y\right))\oplus k_0]$. Therefore, given to extract $2n$-linear equation out of $MRo{t}_{\left(K_i\right)}(X,Y)$, the only unknown parameter will be $\left[(Y\oplus k_1)modn\right]$ and $\left[(Y\oplus k_0)modn\right]$, which has the total complexity of $n+n=2n$. In the rest of the paper, we use odd-offset $of$ and even-offset $ef$ to denote $\left[(Y\oplus k_1)modn\right]$ and $\left[(Y\oplus k_0)modn\right]$ respectively. Now, given the eavesdropped $M_1,M_2,N_R$ and $N_T$ from a session of the protocol and the above properties of $MRo{t}_{\left(K_i\right)}(X,Y)$, the adversary uses the below procedure to extract the secret parameters of SecLAP:

• 1.for $of1=0,\dots ,n-1$:
• 2.
  for $ef1=0,\dots ,n-1$:

  • (a)
    $od\left(M_1\right)⋙of1\to \{[od(TID\oplus N_R)\parallel ev(od\left(K_i\right)\oplus N_T)]\oplus k_0\}$;
  • (b)
    $ev\left(M_1\right)⋙ef1\to \{[ev(TID\oplus N_R)\parallel od(od\left(K_i\right)\oplus N_T)]\oplus k_1\}$;
  • (c)
    for $of2=0,\dots ,n-1$:
  • (d)
    for $ef2=0,\dots ,n-1$:

    • i.
      $od\left(M_2\right)⋙of2\to \{[od(ev\left(K_i\right)\oplus N_R)\parallel ev(TID\oplus N_T)]\oplus k_0\}$;
    • ii.
      $ev\left(M_2\right)⋙ef2\to \{[ev(ev\left(K_i\right)\oplus N_R)\parallel od(TID\oplus N_T)]\oplus k_1\}$;
    • iii.
      Steps 2a, 2b, 2(d)i and 2(d)ii produce $4n$ linear equations while the unknown parameters are $TID\in {\{0,1\}}^n$ and $K_i\in {\{0,1\}}^{2n}$. Hence, the adversary uses $3n$ linearly independent equations to determine $TID$ and $K_i$ and the rest of equations to filter wrong guesses.
    • iv.
      return the candidate $TID$ and $K_i$ $of1,ef1,of2$ and $ef2$.
• 3.Given that $of1=\left[((od\left(K_i\right)\oplus N_T)\oplus k_1)modn\right]$, $ef1=\left[((od\left(K_i\right)\oplus N_T)\oplus k_0)modn\right]$, $of2=\left[((TID\oplus N_T)\oplus k_1)modn\right]$ and $ef2=\left[((TID\oplus N_T)\oplus k_0)modn\right]$ the returned $TID$ and $K_i$ should also pass.

The above attack has the complexity of $4n$ time solving a linear equation with $4n$ equations of $3n$ independent variable. Hence, it is expected to do not return any candidate exclude the correct pair of $TID$ and $K_i$ in Step 2(d)iv. However, any possible wrong guess also filtered in Step 3. Given that any wrong guess passes Step 3 with the probability of $n^{-4}$, the algorithm will return the correct value of $TID$ and $K_i$. Next, given $TID$ and $K_i$ and also the eavesdropped $M_7$ the adversary extracts $N_S$ and calculates $K_{i+1}$ as $K_{i+1}=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S\oplus N_R\oplus N_T\oplus ev\left(K_i\right),TID)$. The adversary can also use other eavesdropped messages, i.e. $M_8$, $M_9$, $M_{10}$ and $M_{18}$ to filter any possible wrong guess.

Because the computational complexity of solving a system of linear equation of $N$ variables has the complexity of $O\left(N^3\right)$, the expected complexity of extracting $TID$, $K_i$ and $K_{i+1}$ is $n^4{\left(3n\right)}^3=27n^7$. For $n=128=2^7$, the adversary will be able to extract those secret parameters with the complexity of $O\left(2^{54}\right)$, while the expected complexity is at least $2^{128}$, which shows a huge gape.

It should be noted that since the channel between the reader and the server is also insecure, the adversary can eavesdrop $ID{X}_i=MRo{t}_{\left(K_i\right)}(RID\oplus od\left(K_i\right),TID)$. Assuming that the adversary has already disclosed $TID$ and $K_i$, it can easily also extract $RID$. Similarly, the adversary can use $M_7$ to extract $N_S$ which – along with other known parameters – can be used to construct $K_{i+1}=MRo{t}_{\left(K_i\right)}(od\left(K_i\right)\oplus N_S\oplus N_R\oplus N_T\oplus ev\left(K_i\right),TID)$. In this way, the adversary reveals the entire secret parameter of the protocol with the computation complexity of $27n^7$ with only one eavesdropping session of the protocol between the parties, i.e. tag, reader, and server.

3.3. Traceability attack

In Section 3.2, we presented an attack where any passive adversary who eavesdrops the transferred messages of a session of the protocol between the legitimate tag, the reader, and the server will be able to extract $TID$, $RID$, $K_i$ and $K_{i+1}$ with the complexity of $O\left(2^{54}\right)$. Given that $TID$ and $RID$ are constant values for any tag/reader and will not be updated after the protocol completion, they can be used to trace the tag/reader, which contradicts the designers’ claim.

3.4. Distinguishability in ROM

In this section, we show that SecLAP is not also a secure protocol in ROM. To distinguish SecLAP from ROM we use the observation used to partial recover secret parameters in Section 3.1. From the structure of the messages one can deduce that:

$$\left({\oplus }_{j=0}^{2n-1}{\left(M_1\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_2\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_3\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(ID{X}_i\right)}_j\right)=0$$ (13)

This property can be used as a metric to determine that the used protocol is SecLAP and not $\mathcal{R}$.

To distinguish SecLAP $\mathcal{P}$ from ${\mathcal{R}}_m$, the adversary does as follows:

• 1.eavesdrops messages of a session of the given protocol, transferred over the channel.
• 2.evaluates Eq. (13) and returns $\mathcal{P}$ if it is true; otherwise returns ${\mathcal{R}}_m$.

To determine the adversary’s advantage, it is clear if the adversary communicates with SecLAP then with the probability of ‘1’ returns $\mathcal{P}$ in Step 2 while if it communicates with ${\mathcal{R}}_m$ then returns $\mathcal{P}$ with the probability of ‘2⁻¹’. To improve the adversary’s advantage, we can increase the number of eavesdropped sessions. For an adversary who eavesdropped $q$ sessions, the advantage will be as follows:

$|Pr\left[D^{\mathcal{C}}=1\right]-Pr\left[D^{{\mathcal{R}}_m}=1\right]|=1-2^{-q}$ which is the maximum advantage that an adversary can get after $q$ queries. It should be noted that the other combinations of transferred messages can also be used for distinguishing SecLAP from ROM. For example:

$$\left({\oplus }_{j=0}^{2n-1}{\left(M_1\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_2\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_7\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(M_8\right)}_j\right)\oplus \left({\oplus }_{j=0}^{2n-1}{\left(N_T\right)}_j\right)=0$$ (14)

An interesting point with Eq. (14) is the fact that to distinguish the protocol the adversary only requires to eavesdrop the channel between the tag and the reader. It is clear that the adversary can use both Eqs. (13), (14) (and several other combinations) to achieve same advantage with eavesdropping less number of sessions. Therefore, SecLAP has security flaws in ROM.

4. Authenticated encryption

Given that the improved protocol in Section 5 uses an AE-based encryption module, in this section we provide a brief introduction to this concept. The common approach to provision of confidentiality and integrity in a communication process is to use a secure encryption scheme and a secure message authentication code (MAC) respectively. Authenticated encryption (AE) provides these two security objectives simultaneously. An important objective in using an AE scheme as opposed to a simple encryption function is to prevent message forgery. By adding an authentication service to the message, the received ciphertext is not accepted as it is and will be verified to determine whether it has been manipulated or forged. Encrypt-then-MAC, Encrypt-and-MAC and MAC-then-Encrypt are traditional approaches of AE scheme designs. Unfortunately, these methods are inefficient, as they use two separate keys, one for encryption and another for authentication [33].

An AEAD scheme is an AE model which supports associated data (AD) also. Associate data is part of the transferred information, for which confidentiality may not appear important but integrity in this element is nonetheless necessary, e.g. with headers or routing information. As shown in Fig. 6, the AEAD takes a plaintext of an arbitrary length upper-bounded to a fixed value, a key, and a nonce, and produces a ciphertext and a MAC-value. Its encryption and decryption functions are respectively as follows, where $K,N,A,P,C,MAC$ are key, nonce, associated data, plaintext, ciphertext, and MAC-value, respectively.

$$E_K(N,A,P)=(C,MAC).$$

$$D_K(N,A,C,MAC)=(P,\perp ).$$

MAC generator is a built-in component of an AEAD module that generally receives the output of the last step of an encryption process and transforms data by some simple operations. In most AEAD schemes, if the MAC-value ($MAC$) is verified then the decryption function returns the plaintext $P$; otherwise it returns an error symbol, e.g. $\perp$.

Fig. 6.

General structure of an AEAD module.

To design a secure AEAD scheme for different applications, in 2014 a competition entitled CAESAR (Competition for Authenticated Encryption: Security, Applicability, and Robustness) was created [34], which was a competition to promote research related to authenticated encryption and to boost the understanding of AE in the cryptographic research community. Such competitions have a long and promising story in the field of symmetric cryptography, e.g. AES [35], eStream [36], SHA3 [37], and PHC [38]. It should be noted that NIST [39] has also begun a competition for standardization of lightweight AE and hash function schemes for which the candidates of its second round were announced September 9, 2019. A secondary aim of the CAESAR competition was to design a dedicated AEAD scheme which could be more resource-efficient than conventional approaches. A dedicated scheme would indicate an AE module that needs only one key for encryption and MAC processes. The first round of CAESAR received 57 submissions, and all of them have been confirmed as approved candidates. After almost five years of analysis and comparisons by independent researchers, following the last round in 2019, six designs were been selected as the final portfolio to be implemented here in our protocol. As shown in Table 2, the selected designs were classified into three use-cases, (i) lightweight applications; (ii) high-performance applications; and (iii) defense in depth.

Table 2.

CAESAR Competition final portfolio [34].

Use-case category	CAESAR finalist candidates
Lightweight applications	ACORN [40] & ASCON [41]
High-performance applications	AEGIS-128 [42] & OCB [43]
Defense in depth	COLM [44] & Deoxys-II [45]

5. AE-based improved protocol

In order to overcome the security flaws of previous protocols, in this section we propose an AE-based authentication protocol. The goal of using an AE module is to achieve a higher security level (i.e. confidentiality and integrity simultaneously) rather than previous protocols with reasonable hardware and communication cost. The notations employed from the improved protocol have been listed in Table 1. Since the structure of this protocol is based on an AEAD design with single-key, the stored information in the header is not encrypted and the sender could transfer some general values via this route. In addition, by using only one key for encryption and integrity processes, the structure of the protocol and the tag could be simpler. To gain a deeper understanding of the counterfeiting scenario in the introduction, an authentication process for a COVID-19 test kit in a hospital is considered. Hence, we assume each kit has been equipped with an RFID tag and the nurse uses an RFID reader to detect the tag and check its authenticity. Our proposed protocol has two phases and functions as follows:

5.1. Initialization phase

In this phase, the default values of the parameters are stored into the parties (Tag, Reader, and Database) and the encryption key is shared. In the database there is a record for each tag that consists the set $({ID{S}_t}_i^{new},{K_t}_i^{new}),({ID{S}_t}_i^{old},{K_t}_i^{old}),{I{D}_t}_i$, where $({ID{S}_t}_i^{new},{K_t}_i^{new})$ and $({ID{S}_t}_i^{old},{K_t}_i^{old})$ respectively denotes the old and the new tag’s parameters. These values are updated after each successful session of the protocol and $({ID{S}_t}_i^{old},{K_t}_i^{old})$ are initially blank. $({I{D}_t}_i,{ID{S}_t}_i^{new},{K_t}_i^{new})$ is also stored in the tag. The database could be local and integrated with the reader or a dedicated server with remote access.

In Fig. 7, we assume the reader hosts the local database; in the security analysis section, we discuss two different situations.

Fig. 7.

Authentication and key agreement phase of the improved protocol.

5.2. Authentication phase

When a nurse wants to use a kit, she has to activate the reader and the following steps must be taken.

• 1.The reader generates a random number $\left(N_{1R}\right)$, and sends $N_{1R}$ and Hello message to the embedded tag in the kit.
• 2.Upon receiving the messages, the tag generates $N_{1t}$ as a nonce and computes $M1$ as $M1=E_{kt}({I{D}_t}_i\oplus N_{1R}\parallel N_{1t})$ and its $MAC$ using an AEAD scheme, actually the output of the AEAD scheme will be $AD\Vert C\Vert MAC$ and $C$ is the ciphertext. The random number $N_{1t}$ is used in the AD part of the message and the tag sends $\{M1,{ID{S}_t}_i,N_{1t},MAC\}$ to the reader.
• 3.When the reader receives the messages, given ${ID{S}_t}_i$, looks up the database, finds related $({I{D}_t}_i,{K_t}_i)$, decrypts $M_1$ and verifies the received $MAC$ to authenticate the tag.
• 4.It then generates $N_{2R}$ and updates the tag’s records as ${ID{S}_t}_i^{old}={ID{S}_t}_i$, ${K_t}_i^{old}={K_t}_i$, $({ID{S}_t}_i^{new}\parallel K_t^{new})=\left(E_{k{t}_i}(({ID{S}_t}_i\oplus N_{1t})\Vert ({K_t}_i\oplus N_{1R})\parallel N_{2R})\right)\oplus (({ID{S}_t}_i\oplus N_{1t})\Vert ({K_t}_i\oplus N_{1R}))$, –${ID{S}_t}_i^{new}$ and $K_t^{new}$ have same length– and updates its database accordingly. It worth noting $N_{2R}$ is used in the AD segment and $({ID{S}_t}_i\oplus N_{1t}\parallel {K_t}_i\oplus N_{1R})$ is XORed with the ciphertext part,
• 5.Since the tag has the required parameters to compute ${ID{S}_t}_i^{new}\parallel K_t^{new}$ and in order to decrease the communication cost, the reader only sends the generated $MAC$ and $N_{2R}$ to the tag.
• 6.After receiving the messages, the tag computes $({ID{S}_t}_i^{new}\parallel K_t^{new})=\left(E_{kt}(({ID{S}_t}_i\oplus N_{1t})\Vert ({K_t}_i\oplus N_{1R})\parallel N_{2R})\right)\oplus (({ID{S}_t}_i\oplus N_{1t})\Vert ({K_t}_i\oplus N_{1R}))$ and verifies the received $MAC$. If the comparison holds, the tag authenticates the reader and updates its ${ID{S}_t}_i$ to ${ID{S}_t}_i^{new}$ and ${K_t}_i$ to ${K_t}_i^{new}$. Therefore, the mission is completed and the kit is valid; otherwise it terminates the session.

6. Security analysis of the improved protocol

The following section describes the security evaluation of the improved protocol. Both informal and formal methods are utilized to prove that the proposed protocol is resistant against various kinds of IoT threats. In terms of the informal evaluation, the protocol robustness is analyzed against various attacks such as traceability, replay, and disclosure. In addition, the formal evaluation is performed by a manual as well as an automated method, which will be introduced later.

6.1. Informal security analysis

In order to assess the resistance of the improved protocol based on the informal method, we present an adversary model with some assumptions. We consider that the adversary has access to communication channels and can eavesdrop all transferred messages. She can intercept the line and transfer her packets to the tag or the reader. In addition, she is able to run all functions – such as PRNG and encryption – without having access to secret keys.

6.1.1. Traceability attack

To perform the traceability attack on a protocol, the adversary needs an instant and fixed value to detect a tag in various situations. In the proposed protocol, the tag transfers $M1$ and $ID{S}_t$ that $M1$ is randomized by $N_{1t}$ and $N_{1R}$ and $ID{S}_t$ is also updated after each successful session of the protocol. Although, as far as the tag has not participated in a successful session of the protocol, $ID{S}_t$ is constant and could be used to trace the tag, however, it is not possible to use it to do traceability attack after a successful session of the protocol. It should be noted $ID{S}_t$ is used to provide scalability in the proposed protocol. In this way, the reader finds the related tag in its database in constant time, independent of the number of tags that are covered by the reader. If After receiving a new Hello message with an iterative $N_{1R}$, the tag typically generates a fresh $N_{1t}$ and calculates a new $M1$; consequently the adversary could not find the similarity among different messages from a tag and the protocol is resistant against the traceability attack, assuming that it has participated in a successful session. It worth noting that it is possible to drop $ID{S}_t$ in the sent message by the tag. Thereby, the adversary will not be able to trace the tag even if the tag has not participated in a successful session, because it sends $M1,MAC$ and $N_{t1}$, and $M1$ and the $MAC$ are randomized by $N_{1t}$ and $N_{1R}$. However, in this case the reader must do an exhaustive search in its database to find the target tag, which is not scalable.

Table 3.

GNY logic notations and logic rules in this paper.

Notations	Description
$♯\left(X\right)$	$X$ is fresh
$(X,Y)$	Combination of two formula $X$ and $Y$
$〈K〉$	Shows $K$ is a secret parameter
${\left\{X\right\}}_K$	$X$ is encrypted using $K$ as the key
$P◃X$	$P$ receives $X$
$P\stackrel{K}{⟷}Q$	$K$ is securely shared between $P$ and $Q$
$P\ni K$	$P$ possesses $K$
$\varphi \left(X\right)$	$X$ is recognizable
$\ast \left(X\right)$	$X$ was not originated by the party who receives it.
$F1:\frac{P|\equiv ♯\left(X\right)}{P|\equiv ♯(X,Y),P|\equiv ♯\left(F\left(X\right)\right)}$	Means that if $P$ believes freshness of $X$, then it deduced that $P$ believes freshness of any formula of $X$.
$F10:\frac{P|\equiv ♯\left(X\right),P\ni X}{P|\equiv ♯H\left(X\right)}$	Means that if $P$ believes freshness of $X$ and $P$ possesses $X$, then it deduced that $P$ believes freshness of any one-way formula of $X$ i.e. $H\left(X\right)$.
$P2:\frac{P\ni \left(X\right),P\ni \left(Y\right)}{P\ni (X,Y),P\ni F(X,Y)}$	Means that if $P$ possesses $X$ and $Y$, it also possesses any formula of them.
$I3:\frac{A}{B}$, where $A:P◃\ast H(X,〈S〉),P\ni (X,S),P|\equiv P\stackrel{S}{⟷}Q$, $P|\equiv ♯(X,S)$ and $B:P|\equiv Q|\sim (X,〈S〉),P|\equiv Q|\sim H(X,〈S〉)$	Means that if $P$ receives an one-way formula of $X$ and a secret parameter $S$ which was not originated by itself, and he possesses $X$ or $S$ and he believes $S$ is a shared secret between itself and $Q$, and also believes freshness of $X$ or $S$, then it is deduced that $P$ believes $Q$ sent a formula of $X$ with $S$, and also believes $Q$ sent the one-way formula of $X$ and $S$ i.e. $H(X,〈S〉)$ .

6.1.2. Secret disclosure attack

The secret disclosure attack occurs when the tag or the reader is unable to protect confidential information (e.g. encryption keys or identification numbers) against unauthorized users. In the improved protocol, the confidential and important tag’s parameters are $K_{ti}$ and ${I{D}_t}_i$. Hence, if the attacker has access to them or is able to reveal them, she can potentially have full access to the system. Given that all transferred messages on a public channel will be encrypted by an AE-based algorithm and the important parameters are not sent as a cleartext, if the attacker eavesdrops transferred packets, useful information about confidential values cannot be found and the probability of revealing information is negligible. Therefore, the proposed protocol is not vulnerable to the secret disclosure attack.

6.1.3. Replay attack

To implement the replay attack on a protocol, the adversary needs to store what is being exchanged on a channel and later sends to the same tag or reader as a valid response without knowing the content of the message itself. To prevent this attack in the improved protocol, both parties must transfer fresh data. Hence, two random numbers $N_{1t}$ and $N_{2R}$ guarantee the freshness of $M1$ and $M2$ messages. If the adversary eavesdrops the transferred messages in a valid session and sends this to the reader as a legitimate tag, when the reader checks the validity of $M1$ based on a fresh $N_{1R}$, the comparison does not hold. In addition, due to using a fresh $N_{1t}$ in the tag’s side, the replay attack is also impossible on the tag. Therefore, we can claim that the improved protocol is resistant against the replay attack.

6.1.4. Back-end channel security

As mentioned earlier, the communication channel between the tag and the reader is public and the adversary is able to capture transferred messages. The implementation concerning the back-end channel between the reader and the server could adopt one of two possible models. The channel could be private and the adversary would thus have no access to it, or it could be considered as a public channel. Because a modern reader like the ZEBRA MC3390R handheld RFID reader has powerful hardware components (e.g. 1.8 GHz hexa-core 64-bit Processor, up to 4 GB RAM, and Android operating system), it can support all encryption algorithms and can establish a VPN (Virtual Private Network) connection. Therefore, by assuming a public channel between the reader and the server in the improved protocol, the transferred messages are protected and the protocol remains secure. Furthermore, whether the database server is local or cloud-based has no significant impact on the improved protocol security.

6.2. Formal analysis

While in Section 6.1 we heuristically proved the security of the improved protocol against various attacks, in this section we use formal approaches to validate the robustness. To evaluate the security of a cryptography protocol, several formal methods are available from literature, which are either manual, such as GNY logic [46] and BAN logic [47] or automatic such as Scyther [48], AVISPA [49], Proverif [50] and CryptoVerif [51]. Among them, in this section, we use GNY logic – as a manual method – and Scyther tool – as an automated method – to analyze the security of the improved protocol formally, and both are widely accepted in literature to validate the security of a cryptographic protocol formally (e.g. see [52], [53], [54]).

6.2.1. Formal security evaluation through GNY logic

According to Table 3’s notations, the robustness of the improved protocol is deduced as below:

• 1.The messages of the improved protocol are rewritten using GNY logic notations, as represent in Table 4.
• 2.The plain messages are deleted that Table 5 shows the output.
• 3.The improved protocol’s assumptions and goals are extracted, as represented in Table 6.
• 4.Given messages and protocol assumptions and using GNY logic rules, we deduce security goals as depicted in Table 7.

Table 4.

Improved protocol messages’ GNY logic expression.

# M.	Description
$M1$	$T_i◃Hello,N_{1R}$
$M2$	$R_j◃M1={\{{I{D}_t}_i,N_{1R},N_{1t}\}}_{{K_t}_i},ID{S}_t,N_{1t},MAC(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$
$M3$	$T_i◃N_{2R},MAC(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$

Table 5.

Improved protocol messages’ idealization (M. denotes Message).

# M.	Description
$IM2$	$R_j◃M1={\{{I{D}_t}_i,N_{1R},N_{1t}\}}_{{K_t}_i},MAC(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$
$IM3$	$T_i◃MAC(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$

Table 6.

Assumptions and security goals of improved protocol (A./G. denotes Assumption/Goal).

# A./G.	Description
$A1$	$R_j|\equiv ♯N_{1R}$
$A2$	$R_j\ni N_{1R}$
$A3$	$R_j|\equiv \varphi \left(N_{1R}\right)$
$A4$	$R_j|\equiv ♯N_{2R}$
$A5$	$R\ni N_{2R}$
$A6$	$R_j|\equiv \varphi \left(N_{2R}\right)$
$A7$	$T_i|\equiv ♯N_{1t}$
$A8$	$T\ni N_{1t}$
$A9$	$T_i|\equiv \varphi \left(N_{1t}\right)$
$A10$	$R_j|\equiv R_j\stackrel{K_t,{I{D}_t}_i,ID{S}_t}{⟷}{T}_i$
$A11$	$T_i|\equiv T_i\stackrel{K_t,{I{D}_t}_i,ID{S}_t}{⟷}{R}_j$
$A12$	$R_j\ni K_t$
$A13$	$R_j\ni {I{D}_t}_i$
$A14$	$R_j\ni ID{S}_t$
$A15$	$T_i\ni K_t$
$A16$	$T_i\ni {I{D}_t}_i$
$A17$	$T_i\ni ID{S}_t$
$G1$	$R_j|\equiv T_i|\sim MAC(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$
$G2$	$T_i|\equiv R_j|\sim MAC(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$

Table 7.

Security goals deduction of the improved protocol.

DN	GMA	UR	DD	GN
$D1$	$A1$	$F1$	$R_j|\equiv ♯(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$	$-$
$D2$	$A2$, $A12$, $A13$, $A14$	$P2$	$R_j\ni (N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$	–
$D3$	$D1,D2$	$F10$	$R_j|\equiv ♯MAC(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$	–
$D4$	$IM1$, $D3$, $A10$, $D1$	$I3$	$R_j|\equiv T_i|\sim MAC(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$	$G1$
$D5$	$A7$	$F1$	$T_i|\equiv ♯(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$	$-$
$D6$	$A8$, $A15$, $A16$, $A17$	$P2$	$T_i\ni (N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$	–
$D7$	$D5,D6$	$F10$	$T_i|\equiv ♯MAC(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$	–
$D8$	$IM2$, $D7$, $A11$, $D5$	$I3$	$T_i|\equiv R_j|\sim MAC(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$	$G2$

As presented in Table 7, according to $F1$ rule of GNY logic and considering $A1$, we deduce that $D1:R_j|\equiv ♯(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$. Then, using $A2,A12,A13,A14$ and based on rule $P2$, it is deduced that $D2:R_j\ni (N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$. Given $D1,D2$ and based on rule $F10$, since $MAC$ is one-way function we deduce that $D3:R_j|\equiv ♯MAC(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$. Considering $IM1,D3,A10,D1$ and based on rule $I3$, it is deduced that $D4:R_j|\equiv T_i|\sim MAC(N_{1R},{I{D}_t}_i,N_{1t},ID{S}_t,〈K_t〉)$ which is the $G1$ security goal. $G1$ guaranties the integrity of the messages which are sent by $T_i$ through the insecure channel. According to $F1$ rule of GNY logic and considering $A7$, we deduce that $D5:T_i|\equiv ♯(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$. Then, using $A8,A15,A16,A17$ and based on rule $P2$, it is deduced that $D6:T_i\ni (N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$. Given $D5,D6$ and based on rule $F10$, since $MAC$ is one-way function, we deduce that $D7:T_i|\equiv ♯MAC(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$. Considering $IM2,D7,A11,D5$ and based on rule $I3$, it is deduced that $D8:T_i|\equiv R_j|\sim MAC(N_{2R},N_{1t},N_{1R},ID{S}_t,〈K_t〉)$ which is the $G2$ security goal.Similar to $G1$, $G2$ guaranties the integrity of the random number $N_{2R}$, which is sent by $R_j$.

6.2.2. Formal security evaluation through Scyther tool

The Scyther tool as an automated security evaluation method is also considered as part of this analysis. The evaluation begins with the description of the improved protocol in the Security Protocol Description Language (SPDL) as the input for the Scyther tool. As Fig. 8 depicts, there is no security breach in the verification results and the robustness of the protocol has been confirmed.

Fig. 8.

Security results of improved protocol through the Scyther tool.

In reliance on the analysis results and security breaches reported for previous protocols, Table 8 compares the robustness of the improved protocol to other protocols against traceability, desynchronization, replay and secret disclosure attacks. As shown, the AE-based protocol can resist against attacks and has an acceptable security level.

Table 8.

Comparison of resistance to different attacks.

Protocols	Liao and Hsiao [20]		Zheng et al. [18]		Fan et al. [27]		SecLAP [29]		AE-based
Resistance to traceability attacks	No		No		No		No		Yes
Resistance to desynchronization attacks	No		No		No		No		Yes
Resistance to replay attacks	No		No		No		No		Yes
Resistance to secret disclosure attacks	No		Yes		No		No		Yes

7. Hardware implementation

In order to better understand the impact of using different cryptography schemes on the proposed protocol, the FPGA and ASIC implementation of a tag were simulated. By the FPGA implementation, the very low-level information and fundamental building blocks of a proposed tag (e.g. Lookup Table (LUT) and Flipflop) were measured. In addition, ASIC implementation was also simulated, with the intention of having the manufacturing technology information and Gate Equivalent (GE) comparison.

For FPGA implementation, Vivado 2017.7 synthesis tool of Xilinx has been employed to synthesize the proposed cryptography algorithms on spartan-7 FPGA family of Xilinx of which Table 9 shows the results. However, as the aim of the proposed protocol is to introduce a new lightweight authentication protocol, the hardware implementation was simulated for five CAESAR finalist candidates with different use-cases. Namely, ACORN and ASCON from the lightweight use-case, OCB and AEGIS-128 from the high-performance category, and COLM from the defense-in-depth use-case have been selected. As an example, the schematic model of ACORN has been illustrated in Fig. 9 consisting of the encryption module, PRNG, XOR, and Concatenation functions, and the hardware implementation result is based not only on the encryption module but also covers a group of all mentioned components.

Table 9.

FPGA and ASIC implementation results, where SM and AE-P denote Security-module and AE-protocol respectively.

Encryption scheme	FPGA		ASIC
	LUT	FlipFlop	Area ($\mathrm{\mu }$m${}^2$)	Delay (ns)	Power (mW)	GE (SM)	GE (AE-P)
ACORN	731	476	23 321.49	1.42	1.003	3338	6743
ASCON	1540	980	41 962.73	0.59	1.167	12 157	15 565
AEGIS-128	5582	1970	110 996.52	1.71	7.396	38 934	42 342
OCB	4124	1699	245 625.71	0.62	5.869	71 966	75 374
COLM	7535	2771	276 981.16	0.61	4.690	107 810	111 218

Fig. 9.

Schematic model of ACORN circuit.

In addition, the key-length and data-length of the encryption module have been considered, at 128-bit and 64-bit respectively. As shown in Table 9, in terms of the area of FPGA simulation, two lightweight candidates show the least LUT and are suitable for designing alightweight tag.

For ASIC implementation, the CMOS 90 nm technology was used in 1-round. The implementation target was set to reach a minimum area and maximum performance. Hence, the number of gates (GE), area overhead, power consumption, and delay are reported in Table 9.

By using ACORN, a given tag totally needs to accommodate 6743 gates for all components (named AE-Protocol) that 3408 gates are used to implement PRNG and logical functions, and 3335 gates for the ACORN cryptography module (named Security-module). It is worth noting that 3335 gates are the total amount of a complete encryption module, including cipher core, pre-processor and post-processor. The results of other encryption schemes are listed in Table 9 and it is clear that the proposed protocol could be applicable in different domains and applications.

In order to have a clearer picture of the tag’s weight and required area on a chip, Fig. 10 compares five candidates based on LUT and GE.

Fig. 10.

Area Comparison based on FPGA and ASIC results.

As expected – and as shown in the chart – both CAESAR lightweight schemes (i.e. ACORN and ASCON) utilize the least amount of hardware circuits to implement an RFID tag. However, the number of LUT of the new protocol is greater than LUT in Fanet al. and SecLAP, a lightweight tag needs roughly 3K to 4K GE for the security module [55]. Hence, the proposed protocol can satisfy the lightweight requirements and the results prove that it is applicable in other domains of IoT with minimum resource consumption.

8. Discussion and conclusion

At the starting point of this paper, we have looked at illicit trade in fake goods as a major challenge in the global economy, and discussed IoT technologies as a mean to combat this risk and help maintain a secure supply chain. While the presented scenario relies on compromising the supply chain integrity for COVID-19 test kits, the reader is aware that the same malicious attacks could be conducted in any supply chain; raising the importance of securing the supporting IT infrastructure.

Within the scope of this paper, we have focused on the data capture/sensing layer of an IoT infrastructure and explored the recent development of secure authentication and communication protocols to prevent malicious attacks. Accordingly, we have presented a traceability and passive secret disclosure attacks against the studied protocols (e.g. SecLAP) where we extracted all secret parameters with the complexity of $27n^7$. In fact, attempting to increase the robustness of current protocols by improving the way messages are calculated, while keeping their basic structure would just provide incremental improvements, and would not prevent ways to break them. By their nature, we believe that the weak-point of ultra-lightweight protocols is the structure of bit-oriented functions. Therefore, we proposed an AE lightweight uncomplicated improved protocol that employs a cryptosystem able to satisfy the hardware requirements of lightweight tags. Informal and formal security evaluations to show the robustness of the protocol were also provided. The security analysis and hardware implementation results were also presented to validate our work. More specifically, we simulated the structure of a tag (FPGA and ASIC) under five encryption schemes and measured its hardware requirement as a candidate for constrained environments. While the scope of the discussion was limited to passive UHF RFID technologies, similar research may be conducted for ensuring the data integrity gathered from other technologies used (a) in different activities of a supply chain (b) at all the layers of the supporting IoT infrastructure. For instance, for the data capture/sensing layer, numerous competitive technologies and techniques are available to develop counterfeit-proof packaging. For instance, passive HF RFID tags for NFC (Near Field Communications) are increasingly used in retail applications for security purposes as well as a means to interact with customers. Otherwise, with billions of bar codes scanned every day one can rightly argue that automatic recognition technologies such as bar codes should be considered as a stand-alone or as a complementary technology to prevent counterfeiting. This is particularly true for innovative covert bar codes using inks that fluoresce when exposed to ultraviolet (UV) or infrared (IR) light. Since they cannot be detected or duplicated by commonly available methods, covertly printed two-dimensional (2D) QR or Data Matrix codes can be used to replicate the ID encoded in the RFID tag applied or integrated into the packaging. At the point of use, there is therefore a need to have a reader equipped with an RFID module as well as a UV–IR lighting module to illuminate and decipher the code using the proper decoding algorithms. More recently we have also witnessed the availability of invisible bar code hidden into colored surfaces (e.g. Digimarc Barcode) that carries the same data as 2D Data Matrix codes and repeated across the entire surface of thermal-printed labels. With the compatibility of numerous cameras and scanners, existing reading devices would then need to be upgraded by installing the required automatic content recognition software to unlock the code and verify it. This last step can also be done using a track & match application with related information hosted on an IoT platform. Otherwise, security issues of “less constrained devices” could be explored, including electronic data loggers used to verify the end-to-end condition compliance in a distribution channel or active RFID tags used for wireless monitoring of environmental fluctuations with real-time alert capabilities. These devices rely on other technologies and use other authentication and communication protocols, but all of them may be vulnerable to security breaches. Whatever the selected identification–authentication technology, stakeholders may also want to track the progress of the products (i.e. COVID-19 kits) throughout the supply chain, using ubiquitous cloud based-IoT traceability platforms. As these platforms constitute another layer in the IoT Infrastructure (Fig. 1), they are used to store critical information and prevent counterfeit and pirated goods, but, they may themselves constitute another target in the design of a secure solution. This has raised higher requirements for data encryption, and the design of secure public key encryption schemes for securing sharing of sensitive data in the cloud [56], [57] as well for the development of lightweight AE scheme to prevent unauthorized data manipulation (i.e. data integrity) and access to information hosted on the cloud (i.e. data confidentiality) [58], [59] Security and privacy become even more important, as healthcare organizations are increasingly targeted by cyberattacks leading experts to call for national standards in “battle” against healthcare data security breaches [60]. In this context, this is no surprise that the Canadian Centre for Cybersecurity released a warning that the COVID-19 pandemic presents an elevated level of risk to the cybersecurity of Canadian health organizations involved in the national response to the pandemic [61]. But while organizations are warned to apply cyber defense best practices, they mainly analyze their monitoring of network logs, monitor the behavior of their servers, and address security vulnerabilities as they discover them — but they never look at the thousands of sensors evolving in their own ecosystem.

CRediT authorship contribution statement

Masoumeh Safkhani: Conception and design of study, Acquisition of data, Analysis and/or interpretation of data, Writing - original draft, Writing - review & editing. Samad Rostampour: Conception and design of study, Acquisition of data, Analysis and/or interpretation of data, Writing - original draft, Writing - review & editing. Ygal Bendavid: Conception and design of study, Acquisition of data, Analysis and/or interpretation of data, Writing - original draft, Writing - review & editing. Nasour Bagheri: Conception and design of study, Acquisition of data, Analysis and/or interpretation of data, Writing - original draft, Writing - review & editing.

Declaration of Competing Interest

No author associated with this paper has disclosed any potential or pertinent conflicts which may be perceived to have impending conflict with this work. For full disclosure statements refer to https://doi.org/10.1016/j.comnet.2020.107558.

Biographies

Masoumeh Safkhani is an assistant professor at Computer Engineering Department, Shahid Rajaee Teacher Training University, Tehran, Iran. She received her Ph.D. in electrical engineering from Iran University of Science and Technology, 2012, with the security analysis of RFID protocols as her major field. Her current research interests include the security analysis of lightweight and ultra-lightweight protocols, targeting constrained environments such as RFID, IoT, VANET and WSN. She is the author/coauthor of more than 50 technical articles in information security and cryptology in major international journals and conferences.

Samad Rostampour is a professor at Vanier College, Montréal-Canada and a Researcher at IoT Laboratory in the department of Analytics, Operations & Information Technology (AOTI) / School of Management (ESG) at the Université du Québec à Montréal (UQAM). He works in the design and the implementation of IoT systems. Prior to join the IoT Lab., Samad completed his Ph.D. in computer systems architecture where he worked on the security of RFID systems. As a specialist in RFID/IoT he is a member of the judges for RFID Journal awards.

Ygal Bendavid is a full professor in the department of Analytics, Operations & Information Technology (AOTI)/School of Management (ESG) at the Université du Québec à Montréal (UQAM) - Canada. Dr. Bendavid holds M.Sc. and Ph.D. degrees in industrial engineering from the École Polytechnique de Montréal. He is the director of the IoT Lab, a collaborative applied research environment with the goal to develop and share an expertise in IoT. As a specialist in RFID/IoT he is a frequent presenter at RFID Journal LIVE! Conferences, and a member of the judges for RFID Journal awards.

Nasour Bagheri is an associate professor at the Electrical Engineering Department, Shahid Rajaee Teacher Training University, Tehran, Iran. He is also a part-time researcher with the Institute for Research in Fundamental Sciences (IPM). Nasour Bagheri received the M.S. and Ph.D. degrees in electrical engineering from the Iran University of Science and Technology (IUST), Tehran, Iran, in 2002 and 2010, respectively. He is the author of more than 100 articles in information security and cryptology. His research interests include cryptology, more precisely, designing and analysis of symmetric schemes, such as lightweight ciphers, e.g., block ciphers, hash functions, and authenticated encryption schemes, cryptographic protocols for constrained environments, such as RFID tags and the IoT edge devices and hardware security, e.g., the security of symmetric schemes against side-channel attacks, such as fault injection and power analysis.

Appendix. Fan et al. ’s protocol

In this section, we explain Fan et al.’s protocol and investigate its security level against secret disclosure and traceability attacks. Moreover, we evaluate the protocol in the ROM and showed that the adversary’s advantage to distinguish it from an ideal protocol, is $1-q^{-2}$, where $q$ is the complexity of eavesdropped messages. Although Fan et al.’s protocol is already known to be insecure, this is another look at the protocol which provides better understanding of the design.

A.1. Cro. function

Fan et al. introduced a special bit-oriented operation in their protocol, called $Cro(X,Y)$. Assuming that $X=X_0,\dots ,X_{n-1}$ and $Y=Y_0,\dots ,Y_{n-1}$ as the binary representation of $X$ and $Y$ respectively, where $X_i$ denotes the $i$th bit of string $X$. Since the $Cro(X,Y)=O_0,\dots ,O_{2n-1}$ operation is defined as below, for $i=0,\dots ,[n-1]$:

$$O_{2i}={(\overline{X}\parallel Y)}_{2i}\oplus {(\overline{Y}\parallel X)}_{2i+1}$$

$$O_{2i+1}={(\overline{X}\parallel Y)}_{2i+1}\oplus {(\overline{Y}\parallel X)}_{2i}$$

We provide an example to show the functionality of $Cro(X,Y)$ as follows:

Based on this expression, the length of $Cro(X,Y)$ will be equal to the length of $\overline{X}\parallel Y$ and $\overline{Y}\parallel X$ which is twice that of $X$ or $Y$. On the other hand, later we see that this function is used to update a secret value $K$ as $K_{new}=Cro(N_R\oplus N_S\oplus N_T,K)$ which makes a confusion, because the length of $K_{new}$ then will be twice that of the length of $K$. However, per our personal communication with the protocol designers[62], they stated that to reduce the length of the produced $K_{new}$, XOR operation is performed on the top and the bottom of the $Cro\left(\right)$ operation result, see Fig. A.11. Hence, the length of $K_{new}$ and $K_{old}$ would be the same before the next round of authentication is begun.

Fig. A.11.

To reduce the output length of $Cro(X,Y)$ [62].

A.2. Protocol description

The Fanet al. authentication protocol, as depicted in Fig. A.12, is executed as follows:

Fig. A.12.

Mutual authentication phase of Fan et al.’s protocol [27].

• 1.The reader starts the authentication process by generating a new random number $N_R$ and sending it along with $Query$ to the tag.
• 2.
  Once the tag receives the message, it:

  • •
    generates a random number $N_T$;
  • •
    computes $Cro(RID\oplus TID,K)$;
  • •
    sets $Mark=00$
  • •
    and sends $N_T$ and $Cro(RID\oplus TID,K)$ to the reader;
• 3.Upon receipt of the message, the reader stores $N_T$ and sends $N_R$, $N_T$ and $Cro(RID\oplus TID,K)$ to the server.
• 4.
  When the server receives the message, it:

  • •
    stores $N_R$ and $N_T$;
  • •
    searches its database for any entry related to received $Cro(RID\oplus TID,K)$;
  • •
    generates another random number $N_S$;
  • •
    computes $Cro(RID\oplus TID,K\oplus N_S)$, $Rot(K\oplus TID,K\oplus RID)\parallel (N_S\oplus K)$ and sends them to the reader.
• 5.
  Once the reader receives the message, it:

  • •
    retrieves $TID$ and $N_S$ from $Rot(K\oplus TID,K\oplus RID)$ and $N_S\oplus K$ respectively;
  • •
    computes $Cro(RID\oplus TID,K\oplus N_S)$ and checks whether it equals with the received $Cro(RID\oplus TID,K\oplus N_S)$; if it does not then it stops the protocol, otherwise calculates $TID\oplus N_R$;
  • •
    and sends $TID\oplus N_R$ and $N_S$ to the tag;
• 6.
  Once receipt the message, the tag:

  • •
    retrieves $TID$ as $TID\oplus N_R\oplus N_R$;
  • •
    checks whether the retrieved $TID$ equals with its $TID$ or not; if it does not then it stops the protocol, otherwise updates the key as $K_{new}=Cro(N_R\oplus N_S\oplus N_T,K)$;
  • •
    computes $Cro(RID\oplus TID,K_{new})$;
  • •
    and sends $Cro(RID\oplus TID,K_{new})$ to the reader.
• 7.
  When the reader receives the message, it:

  • •
    calculates $Cro(RID\oplus TID,Cro(N_R\oplus N_S\oplus N_T,K))$ and checks whether it is equal to the corresponding received value or not; if it does not then it terminates the protocol, otherwise updates $K$ as $K_{new}=Cro(N_R\oplus N_S\oplus N_T,K)$
  • •
    and sends $Cro(RID\oplus TID,K_{new})$ to the server.
• 8.
  Once the server receives the message, it:

  • •
    calculates $Cro(RID\oplus TID,Cro(N_R\oplus N_S\oplus N_T,K))$ and checks whether it equals to the corresponding received value or not; if it does not then it terminates the protocol otherwise updates $K$ as $K_{new}=Cro(N_R\oplus N_S\oplus N_T,K)$;
  • •
    and sends $K_{new}\oplus N_T\oplus N_R$ to the reader.
• 9.Upon receipt of the message, the reader extracts $K_{new}$, verifies it and if the verification is passed, the reader sends $K_{new}\oplus N_T\oplus N_R$ to the tag.
• 10.The tag verifies the correctness of $K_{new}$ by computing $K_{new}\oplus N_T\oplus N_R\oplus N_T\oplus N_R$ and if $K_{new}$ passes the verification, the tag sets $Mark=01$ and sends $Mark\oplus N_S$ to the server through the reader.
• 11.
  The server:

  • •
    checks whether $Mark$ equals to $01$, if it is, a new record $\{Cro(RID\oplus TID,K_{new}),Rot(K_{new}\oplus TID,K_{new}\oplus RID)\}$ will be generated and added in the database;
  • •
    sends a record completion notification to the tag via the reader.
• 12.When the tag received the message, sets $Mark=10$.

A.3. Secret disclosure and traceability attacks

Fan et al.’s protocol has trivial vulnerabilities, also reported by Aghili and Mala [28]. More precisely, consider a passive adversary which only eavesdrops the transferred messages between a legitimate reader $R$ and the target tag $T$. In this case, the adversary achieves the following set of information that is transferred over an insecure channel between $T$ and $R$:

• •$N_R$ is sent from $R$ to $T$;
• •$Cro(RID\oplus TID,K)$ and $N_T$ are sent from $T$ to $R$;
• •$TID\oplus N_R$ and $N_S$ are sent from $R$ to $T$;
• •$Cro(RID\oplus TID,K_{new})$ is sent from $T$ to $R$;
• •$K_{new}\oplus N_T\oplus N_R$ is sent from $R$ to $T$;
• •$Mark\oplus N_S$ is sent from $T$ to $R$;

Given the above information, it would be trivial to extract, $TID$ and $K_{new}$, as follows:

$$TID=(TID\oplus N_R)\oplus N_R;$$

$$K_{new}=(K_{new}\oplus N_T\oplus N_R)\oplus N_T\oplus N_R.$$

Given that $TID$ is a constant parameter which determines the tag identity, it can be employed to trace the tag holder. This fact compromises the security of the protocol against traceability and tag anonymity.

Remark

This attack does not depend on the definition of $Cro(X,Y)$ and works for any $Cro(X,Y)$. Hence it is not possible to improve the security of the protocol against this attack by only using a more complicated function instead of the current $Cro(X,Y)$.

On the other hand, on Step 6, the tag sends $Cro(RID\oplus TID,K_{new})$ to the reader over public channel. Now assume that the adversary also eavesdrops that message between $R$ and $T$, where the values of $TID$ and $K_{new}$ have been extracted by the adversary already.

Given $Cro(RID\oplus TID,K^{\prime })$, we denote $C_i={\left(Cro(RID\oplus TID,K^{\prime })\right)}_i$ for simplicity, i.e. its $i$th bit. Given that $\overline{\mathcal{X}}=\mathcal{X}\oplus 1$ any $\mathcal{X}\in \{0,1\}$, for an even value of $n$, we can extract the following equations, for different cases of $i$:

$$\left\{\begin{array}{cc}\hfill 0\le i\le \frac{l}{2}-1\hfill & \hfill C_{2i}=RI{D}_{2i+1}\oplus TI{D}_{2i+1}\oplus K_{2i}^{\prime }\hfill \\ \hfill \hfill & \hfill C_{2i+1}=RI{D}_{2i}\oplus TI{D}_{2i}\oplus K_{2i+1}^{\prime }\hfill \\ \hfill \frac{l}{2}\le i\le n-1\hfill & \hfill C_{2i+1}=RI{D}_{2i+l}\oplus TI{D}_{2i+l}\oplus 1\oplus K_{2i}^{\prime }\oplus 1\hfill \\ \hfill \hfill & \hfill C_{2i+1}=RI{D}_{2i}\oplus TI{D}_{2i}\oplus 1\oplus K_{2i+1}^{\prime }\oplus 1\hfill \end{array}\right)$$ (A.1)

where $n$ is the length of parameters in the protocol, e.g. $TID\in {\{0,1\}}^n$. In Eq. (A.1), exclude $RI{D}_j$ for $0\le j\le n-1$, all variables are known. Hence, $RID$ will be retrieved easily from that linear equations. Given $RID$, the reader anonymity is compromised.

Remark

It should be noted the success probability of the presented attack to recover $RID$ depends on the exact definition of $Cro(X,Y)$. Hence, it may be possible to improve the security of the protocol against this attack by only using a more complicated function instead of the current $Cro(X,Y)$.

A.4. Fan et al. ’s protocol distinguishability in ROM

Any cryptographic scheme is expected to behave unpredictable form the adversary’s point of view. To model this property, indistinguishability from a random oracle is used, which we defined in Section 2.2. In this section, we show that Fan et al.’s protocol is not a secure protocol in ROM. Given that for any value of $x$ we can state that $x\oplus 1\oplus 1=x\oplus 0=x$, Eq. (A.1) can be rewritten as follows:

$$\left\{\begin{array}{cc}\hfill 0\le i\le \frac{n}{2}-1\hfill & \hfill C_{2i}=RI{D}_{2i+1}\oplus TI{D}_{2i+1}\oplus K_{2i}^{\prime }\hfill \\ \hfill \hfill & \hfill C_{2i+1}=RI{D}_{2i}\oplus TI{D}_{2i}\oplus K_{2i+1}^{\prime }\hfill \\ \hfill \frac{n}{2}\le i\le n-1\hfill & \hfill C_{2i+1}=RI{D}_{2i+l}\oplus TI{D}_{2i+l}\oplus K_{2i}^{\prime }\hfill \\ \hfill \hfill & \hfill C_{2i+1}=RI{D}_{2i}\oplus TI{D}_{2i}\oplus K_{2i+1}^{\prime }\hfill \end{array}\right)$$ (A.2)

It is clear that, for $i\in \{0,2,\dots ,n-2\}$ and for even values of $n$, $C_i=C_{n+i+1}$ and $C_{i+1}=C_{n+i}$. This property can be used as a metric to determine that the used protocol is the Fan et al.’s protocol and not $\mathcal{R}$. Moreover, Fan et al.’s protocol has zero-sum property. More precisely, it is easy to show that:

$$\begin{array}{cc}\hfill {\oplus }_{i=0}^{2n-1}{C}_i=\hfill & \hfill C_0\oplus C_1\oplus \cdots {\oplus }_{2n-1}=0\hfill \end{array}.$$ (A.3)

It comes for the fact that any variable appears in the above summation exactly two times, e.g. $RI{D}_0$ or $K_0$, and for any $\mathcal{X}\in \{0,1\}$ and any value of $x$ we have $x\oplus \mathcal{X}\oplus \mathcal{X}=x\oplus 0=x$. This property can be used as a metric to determine that the used protocol is the Fan et al.’s protocol or ${\mathcal{R}}_m$.

To distinguish Fan et al.’s protocol $\mathcal{P}$ from ${\mathcal{R}}_m$, the adversary does as follows:

• 1.eavesdrops a message produced by $Cro(.)$ function, transferred over channel, e.g. $C=Cro(K\oplus TID,K)$.
• 2.if ${\oplus }_{i=0}^{2n-1}{C}_i=0$ returns $\mathcal{P}$; otherwise returns ${\mathcal{R}}_m$.

To determine the adversary’s advantage, it is clear that if the adversary communicates with Fan et al.’s protocol then with the probability of ‘1’ returns $\mathcal{P}$ in Step 2 while if it communicates with ${\mathcal{R}}_m$ then returns $\mathcal{P}$ with the probability of ‘2⁻¹’. To improve the adversary’s advantage, we can increase the number of eavesdropped messages. For an adversary who eavesdropped $q$ messages, all produced by $Cro(.)$ function, the advantage will be as follows: $|Pr\left[D^{\mathcal{C}}=1\right]-Pr\left[D^{{\mathcal{R}}_m}=1\right]|=1-2^{-q}$ which is the maximum advantage that an adversary can get after $q$ queries. Hence, Fan et al.’s protocol has security flaws in ROM.