臺灣博碩士論文加值系統

RFID技術是一項新世代最被看好的技術之ㄧ，而RFID技術很可能會改變人類生活方式與習慣，並且引發供應鏈環境中的下一波工業革命。雖然大家ㄧ致看好RFID的前景發展，但在目前RFID的應用上，因為低成本標籤的運算能力受到極大的限制，因此如傳統AES、RSA等等的密碼學演算法便無法應用在RFID低成本的標籤上。RFID技術若要能夠普遍大量使用，則必須面對此技術可能帶來的安全及隱私問題。
本研究針對低成本標籤設計一套RFID輕量型驗證協定。本方法只需使用一些如XOR、模除(mod)及位元旋轉等基本的運算技巧，以符合RFID低成本輕量型協定標籤的硬體成本，且透過本方法設計有效地達成RFID的安全及隱私需求。本方法設計一個假名方式，除了能夠有效防止追蹤問題之外，重要的是當後端資料庫儲存標籤數量很多時，能夠使後端資料庫有效率地搜尋到標籤的相關資料，以減輕後端資料庫的負擔。最後本方法使用設定秘密金鑰的方式有效地保護供應鏈上供應商所擁有標籤的秘密，不會被更改，在所有權轉移過程中達到完整的安全保護。

Radio Frequency Identification (RFID) is an example of the most promising technology. The RFID technology is believed to change our lifestyle and habits, and very likely triggers a revolution in the supply chain environment. Although the prospects of the RFID are brightening, but low-cost hardware tags have great limitations in computing power. Traditional cryptographic algorithms like AES and RSA cannot be used in low-cost RFID tags. For widespread application, the potential security and privacy issues must be addressed.
This thesis proposes a lightweight authentication protocol by using some basic operations, such as XOR, mod, bit rotation etc. These operations are all affordable in low-cost RFID tags. The requirements of security and privacy are achieved by the following two designs. First, pseudonyms are used to effectively prevent the tracking problems. It is important that, when the backend database stores the large number of tags, the proposed design still can efficiently search for necessary information with which to communicate with tags. Besides, pseudonym can alleviate the burden on searching the backend database. The second design is that our proposed method uses secret keys to protect supply chain partners’ secrets, which will not be changed, in order to achieve security in copyright transfer.

目錄
誌謝 i
摘要 ii
Abstract iii
目錄 v
圖目錄 vii
表目錄 viii
第一章 緒論 1
1.1 研究背景 1
1.2 研究動機 3
1.3 研究目的 4
第二章 文獻探討 5
2.1 RFID介紹 5
2.1.1 標籤(Tag) 5
2.1.2 讀取器(Reader) 6
2.1.3 後端資料庫(Back-End Database) 7
2.2 RFID保護隱私的方法 7
2.2.1 刪除指令式標籤 (Killing Tags) 7
2.2.2 護罩式標籤(Shielding Tags) 8
2.2.3 選擇式阻礙標籤(Selective Blocking Tags) 8
2.2.4 鎖定式標籤(Locking Tags) 8
2.2.5 編碼機制標籤 10
第三章 研究方法 34
3.1 問題定義與需求分析 34
3.1.1問題描述 34
3.1.2 需求分析 35
3.2 研究方法設計 37
3.2.1 研究假設 37
3.2.2 研究方法架構 38
3.2.3 資料庫及標籤欄位設計 41
3.2.4 方法操作流程 44
第四章 討論與分析 52
4.1 方法設計的原因 52
4.2 安全性分析 55
4.3 效能分析 65
4.3.1計算成本分析 65
4.3.2 標籤儲存成本分析 68
4.3.3 通訊量分析 69
4.3.4 後端資料庫搜尋成本分析 72
4.4 仍無法避免之問題 74
第五章 結論 75
5.1 結論 75
5.2 研究建議 76
5.3 未來研究方向 77
參考文獻 78
圖目錄
圖 1.1 : RFID產值成長圖 2
圖 2.1：鎖定式標籤鎖定與解除鎖定的流程圖 9
圖 2.2：Protecting RFID Communications in Supply Chains方法的流程圖 12
圖 2.3：驗證階段認證過程圖 15
圖 2.4：所有權轉移階段的認證過程圖 16
圖 2.5：RFID Authentication Protocol for Low-cost Tags方法的流程圖 19
圖 2.6：A New Hash-Based RFID Mutual Authentication Protocol Providing Enhanced User Privacy Protection方法的流程圖 22
圖 2.7：Enhancing Security of EPCglobal Gen-2 RFID Tag against Traceability and Cloning方法的流程圖 25
圖 2.8：LMAP方法的流程圖 28
圖 3.1：本方法流程圖 39
圖 3.2：本方法標籤的狀態圖 41
圖 3.3：驗證階段流程圖 47
圖 3.4：所有權轉移階段流程圖 49
圖 3.5：更新假名階段流程圖 51
表目錄
表2.1：RFID隱私保護方式分類表 7
表2.2：編碼機制標籤文獻特性比較表 30
表3.1：標籤欄位設計表 42
表3.2：標籤欄位說明表 42
表3.3：資料表欄位說明表 43
表3.4：本方法使用符號說明表 45
表3.5：本方法資料庫對應關係表 45
表4.1：文獻與本研究方法安全特性比較表 59
表4.2：文獻與本研究方法的安全性儲存成本比較表 64
表4.3：計算成本表 65
表4.4：文獻與本研究方法計算成本比較表 66
表4.5：文獻與本研究方法儲存成本比較表 68
表4.6：本研究方法各階段通訊量統計表 70
表4.7：文獻與本研究方法通訊量比較表 71
表4.8：文獻與本研究方法後端資料庫搜尋成本比較表 72

[1]H.K.C. Chang, L.C. Yen, “A Study on the Security of RFID with Enhancing Privacy Protection”, The 7th European Conference on Information Warfare and Security (ECIW 2008), 2008.
[2]H.Y. Chien, “SASI: A New Ultralightweight RFID Authentication Protocol Providing Strong Authentication and Strong Integrity”, IEEE Transactions on Dependable and Secure Computing, vol. 4, no. 4, pp. 337-340, 2007.
[3]T. Dimitriou, “ A Lightweight RFID Protocol to protect against Traceability and Cloning attacks”, Security and Privacy for Emerging Areas in Communications Networks Conf. , pp. 59-66, 2005.
[4]D.N. Duc, J. Park, H. Lee, K. Kim, “Enhancing Security of EPCglobal Gen-2 RFID Tag against Traceability and Cloning”, The Symposium on Cryptography and Information Security(SCIS) Conf. , 2006.
[5]D. Henrici, J. Gotze, P. Muller, “A Hash-based Pseudonymization Infrastructure for RFID Systems“, Security Privacy and Trust in Pervasive and Ubiquitous Computing Conf., pp. 22-27, 2006.
[6]A. Juels, “Minimalist cryptography for low-cost RFID tags”, The Fourth International Conference on Security in Communication Networks, pp. 149-164, 2004.
[7]A. Juels, “RFID Security and Privacy: A Research Survey”, IEEE Journal On Selected Areas in Communications, vol. 24, issue. 4, pp. 381-394, 2006.
[8]A. Juels, R.L. Rivest, M. Szydlo, “The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy”, 8th ACM Conference on Computer and Communications Security, pp. 103-111, 2003.
[9]S. Kinoshita, F. Hoshino, T. Komuro, A. Fujimura, M. Ohkubo, “Low-cost RFID Privacy Protection Scheme”, Journal on Transactions of Information Processing Society of Japan , vol. 45, no. 8, pp. 2007-2021, 2004.
[10]H. Lei, T. Cao, “RFID Protocol enabling Ownership Transfer to protect against Traceability and DoS attacks”, The First International Symposium on Data, Privacy, and E-Commerce, pp. 508-510, 2007.
[11]T. Li, G. Wang, “Security Analysis of Two Ultra-Lightweight RFID Authentication Protocols”, 22nd IFIP TC-11 Int’l Information Security Conf. , pp. 109-120, 2007.
[12]Y. Li, X. Ding, “Protecting RFID Communications in Supply Chains”, Computer and Communications Security Proceedings of the 2nd ACM symposium, pp. 234-241, 2007.
[13]J. Lim, H. Oh, S. Kim, “A New Hash-Based RFID Mutual Authentication Protocol Providing Enhanced User Privacy Protection”, The 4th Information Security Practice and Experience Conference , pp. 278-289, 2008.
[14]K. Osaka, T. Takagi, K. Yamazaki, O. Takahashi, “An Efficient and Secure RFID Security Method with Ownership Transfer”, Computational Intelligence and Security Conf. , pp. 1090-1095, 2006.
[15]P. Peris-Lopez, J.C. Hernandez-Castro, J.M. Estevez-Tapiador, A. Ribagorda, “LMAP: A Real Lightweight Mutual Authentication Protocol for Low-Cost RFID Tags”, Second Workshop RFID Security, 2006.
[16]B. Song, C. J. Mitchell, “RFID Authentication Protocol for Low-cost Tags”, Wireless Network Security Conf., pp. 140-147, 2008.
[17]S.A. Weis, S.E. Sarma, R.L. Rivest, D.W. Engels, “Security and Privacy Aspects of Low-Cost Radio Frequency Identification Systems”, First International Conference on Security in Pervasive Computing, pp. 201-212, 2003.
[18]Y. Xiao, X. Shen, B. Sun, L. Cai, “Security and Privacy in RFID and Applications in Telemedicine”, IEEE Communications Magazine, pp. 64-72, 2006.
[19]RFID產業資料庫，http://www.u-rfid.com.tw。
[20]李禮安，「以動態身份為基礎來保護低成本被動式無線射頻辨識標籤的使用者隱私」，國立交通大學資訊工程學系碩士論文，民國95年。
[21]陳宏宇，「RFID系統入門－無線射頻辨識系統」，松崗圖書，民國94年。
[22]鄭同伯，「RFID EPC－無線射頻辨識完全剖析」，博碩文化，民國93年。