Weaknesses of fingerprint‐based mutual authentication protocol. Issue 12 (13th November 2014)

• Record Type: Journal Article
• Authors: Picazo‐Sanchez, Pablo; Ortiz‐Martin, Lara; Peris‐Lopez, Pedro; Bagheri, Nasour
• Is Part Of: Security and communication networks. Volume 8:Issue 12(2015)
• Page Start: 2124
• Page End: 2134
• Publication Date: 2014-11-13
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1161
• Languages: English
• ISSNs: 1939-0114

Abstract

<abstract abstract-type="main" id="sec1161-abs-0001"> <title>Abstract</title> <p id="sec1161-para-0001">The Internet of Things is an emerging paradigm, which is used to link physical objects with Internet. One of the most common ways of communicating and identifying objects on Internet of Things is using Radio Frequency IDentification (RFID) systems between different objects. Researchers have focused on developing improvements of RFID authentication protocols that stave off privacy threats and well‐known security problems. Recently, Khor <italic>et al.</italic> have proposed a new authentication protocol that conforms to the Electronic Product Code Class‐1 Generation‐2 standard (ISO/IEC 18000‐6C for RFID systems). In this paper, we show the vulnerabilities of this authentication protocol concerning to full disclosure, impersonation, traceability, de‐synchronization, and Denial‐of‐Service attacks. These attacks make the protocol unfeasible to introduce it with an adequate security and sufficient privacy protection level. Finally, we present a new protocol, called <italic>F</italic><italic>i</italic><italic>n</italic><italic>g</italic><italic>e</italic><italic>r</italic><italic>p</italic><italic>r</italic><italic>i</italic><italic>n</italic><italic>t</italic>⁺ protocol, which is based on ISO/IEC 9798‐2 and ISO/IEC 18000‐6C and whose security is formally verified using BAN logic. Copyright © 2014 John Wiley &amp; Sons, Ltd.</p> </abstract>