在极低限要求相互认证协议(M^2AP)的基础上,通过对传输的信息进行一定的保护,提出了一种改进型极低限要求相互认证协议(IM^2AP).该协议通过标签和阅读器之间共享的假名和密钥实现互有认证,认证通过之后再进行隐私信息的传输.为了确保标签和阅读器的互有认证过程不被攻击者恶意干扰,标签利用密钥的汉明权重产生了一个可以和阅读器共享的随机数,并根据这个随机数对传输的信息进行一次循环移位,使得攻击者无法对某一特定位进行篡改,从而有效地避免了去同步攻击和整体揭露攻击.通过安全分析和性能分析,表明该协议能够在轻量型安全认证协议安全性普遍较弱的情况下,用有限的成本增加来大幅提高系统的安全性和可靠性,具有较高的实用价值.
An improved minimalist mutual-authentication protocol (IMZAP) is proposed by protecting the messages transmitted between the reader and tag. It achieves mutual authentication by the pseudonym and key shared between the tag and reader, and then they start to transmit the private messages. In order to ensure that the mutual authentication of the tag and reader will not be attacked by malicious interference, the tag generates a random number by the Hamming weight of the key which can be shared with the reader and then uses the random number to protect the transmitted message on the cyclic shift. Thus the attacker can't tamper with a particular bit and the protocol effectively avoids de-synchronization and the full disclosure attack. Analysis of security and performance shows that when the security of the lightweight security authentication protocols is generally weak, this protocol can improve the security and reliability of the system with limited cost, so it has a high practical value.