CN103532718A - Authentication method and authentication system - Google Patents

Abstract

The invention relates to an authentication method and system. The authentication method includes: the reader sends the first random number r ₁ generated by itself to the tag; after receiving the first random number r ₁ , the tag generates the second random number r ₂ and calculates the first random number r 2 according to r ₁ and r ₂ The authentication message M ₁ and the second authentication message M ₂ send the data of all the digits of M ₁ and the data of the set digits of M ₂ to the reader, wherein, M ₁ =x⊕r ₂ , M ₂ = [(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l ; After receiving the first authentication message M ₁ and the second authentication message M ₂ , the reader calculates the second random number according to the first authentication message M ₁ r ₂ ，r ₂ =M ₁ ⊕x, then verify whether (ID,x) exists to satisfy the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , if it exists, go to the next step; read The writer calculates the third authentication message M ₃ , sends the third authentication message M ₃ to the tag, and updates the shared key x to [x ² mod n] _l ; the tag receives and verifies whether the third authentication message M ₃ is correct , if it is correct, it is determined that the authentication is successful. The invention reduces the calculation cost and storage cost of the authentication algorithm.

Description

An authentication method and system

technical field

The invention relates to the communication field, in particular to an authentication method and system.

Background technique

RFID (Radio Frequency Identification, Radio Frequency Identification) technology is a technology that uses radio frequency signals to achieve contactless information transmission, and achieves identification purposes through the transmitted information. RFID system generally consists of three parts: tags, readers and back-end database. Tags include chips and antennas for identification of stored items. The reader obtains the data in the tag through the radio frequency signal, and then transmits it to the back-end database.

In general, assuming that there is a secure communication channel between the back-end database and the reader, the security issues between them can be understood as traditional network security issues. RFID security issues mainly focus on the radio frequency communication security issues between readers and tags. The radio frequency wireless communication between the reader and the tag is vulnerable to attackers. Attacks are mainly divided into two categories: one is passive attack, and the other is active attack. In the passive attack, the attacker just secretly sniffs or eavesdrops on the communication between the reader and the tag, and then conducts cryptanalysis or tracking based on the obtained data. In an active attack, the attacker acts as a third person between the reader and the tag. The attacker intercepts the data exchanged between the reader and the tag, and then sends it to the other party through replay or tampering.

At present, many security and privacy protection mechanisms have been proposed, among which RFID lightweight authentication protocol is a common method. Generally speaking, an RFID authentication protocol should meet the following characteristics: (1) Low cost. As the application of the Internet of Things becomes more and more widespread, especially in the supply chain environment, there will be a large number of items that require RFID tags. The cost of tags has become one of the factors affecting the large-scale application of the Internet of Things. In order to be able to adapt to low-cost RFID tags, the RFID authentication protocol needs to use as few computing resources and storage resources as possible to meet the low-cost requirements. (2) Two-way authentication. In order to avoid the attack of illegal readers, the authentication protocol can not only verify the legitimacy of tags, but also verify the legitimacy of readers. (3) Privacy protection. With more and more RFID applications, such as second-generation ID cards, bus cards, access control cards, etc., they are more and more closely related to people's lives. How to protect the privacy of label owners is also one of the issues to be considered. (4) Can resist common attacks.

At present, there have been many attack methods against RFID authentication protocols, such as forgery attacks, replay attacks, and man-in-the-middle attacks. Ohkubo et al. studied the privacy issue of tags, especially the forward security, that is, the information transmitted now will not become insecure due to the leakage of tag information in the future. A hash chain based authentication protocol is proposed (M. Ohkubo, Suzuki K., Kinoshita S. Cryptographic approach to “privacy-friendly” tags.in RFID Privacy Workshop), which can provide forward security. The disadvantage of this scheme is that two hash functions need to be used, and it is vulnerable to replay attacks. A lightweight RFID protocol to protect against traceability and cloning attacks.in Proc.of the First International Conference on Security and Privacy for Dimitriou et al. Emerging Areas in Communications Networks). The protocol is an authentication protocol based on challenge response, which can realize two-way authentication between the reader and the tag. But for tags, the cost of hash calculation is relatively high. Lopez et al. proposed a very lightweight authentication protocol LMAP (P.Peris-Lopez, Hernandez-Castro J.C., Estevez-Tapiador J.M., Ribagorda A. LMAP: A real lightweight mutual authentication protocol for low-cost RFID tags.in Proc. of2nd Workshop on RFID Security). The protocol uses the pseudonym IDS (Index-Pseudonym, pseudonym index) as the index of the label. LMAP does not use a hash function, but only uses simple operations such as bit XOR. The protocol cannot resist asynchronous attacks, that is, the attacker can block the last step of the authentication process, so that the reader cannot authenticate the tag, resulting in the inability to update the IDS and key K, while the tag has already updated the key. In addition, if the attacker sends a Hello message to the tag, the tag will return the current IDS, and the attacker can track the tag, which cannot protect the user's privacy. Chien et al. analyzed the security flaws in the protocols of Karthikeyan et al. and Duc et al., and proposed a new mutual authentication protocol for EPC C1G2 tags (Hung-Yu Chien, ChenChe-Hao. Mutual authentication protocol for RFID conforming to EPCClass1Generation2standards.Computer Standards&Interfaces). The protocol is based on the GEN-2 standard and uses PRNG and CRC operations to resist asynchronous attacks. Ma et al studied two kinds of privacy in RFID: indistinguishable privacy and unpredictability privacy (C.Ma, LiY., Deng R.H., Li T.RFID privacy: relation between two notions, minimal condition, and efficient construction.in Proc. of the16thACM conference on Computer and communications security). Based on PRF (Pseudo Random Function, pseudo-random function), a RFID one-way authentication protocol that satisfies strong unpredictability and privacy is proposed. However, the protocol is vulnerable to denial of service attacks. If the attacker continuously sends challenges c to the tag, the tag will update its count ctr, which will increase the time for the reader to traverse the query. Ding et al proposed a Hash-based RFID security authentication protocol HSAP (Zhenhua Ding, Li Jintao, Feng Bo. Research on hash-based RFID security authentication protocol. Journal of Computer Research and Development). This protocol only uses Hash operation in the tag, and only needs to perform two Hash operations in the tag, so it is more suitable for low-cost RFID systems. At the same time, HSAP is a two-way authentication protocol, which can resist impersonation attacks, replay attacks, prevent tracking, desynchronization and other problems. Essentially, the protocol is a challenge-response protocol. In addition, it does not have forward security. If the current ID is leaked, the attacker can analyze the previous interaction information and track the activity footprint of the tag. In addition, researchers have also proposed many ultra-lightweight authentication protocols. These protocols only use simple operations such as XOR and dot product, and do not use cryptographic elements such as PRNG and CRC. In order to meet the strong privacy requirements, the RFID authentication protocol must at least have the ability of pseudo-random number function. Therefore, these protocols generally have quasi-linear analysis, differential attacks, and asynchronous attacks.

Contents of the invention

The technical problem to be solved by the present invention is to provide an authentication method and system suitable for low-cost RFID tags.

In order to solve the above technical problems, the present invention proposes an authentication method applied to a radio frequency identification system, including:

Step a, the reader sends the first random number r ₁ generated by itself to the tag;

Step b, after receiving the first random number _r1 , the tag generates the second random number _r2 , and calculates the first authentication message _M1 and the second authentication message _M1 and _the second authentication message according to the first random number r1 and the second random number r2 Message M ₂ , sending the data of all digits of the first authentication message M ₁ and the data of the set digits of the second authentication message M ₂ to the reader, wherein, M ₁ =x⊕r ₂ , M ₂ = [(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , the symbol "⊕" means the XOR operation, the symbol "mod" means the modular square operation, and "[] _l " means to take the l of the ciphertext in "[]" Bit, x is the shared key of the known reader and tag, ID is the tag identification, n is the modulus;

Step c, after receiving the first authentication message M ₁ and the second authentication message M ₂ , the reader calculates the second random number r ₂ according to the first authentication message M ₁ , r ₂ =M ₁ ⊕x, and then verifies Whether (ID, x) satisfies the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , if it exists, execute step d;

Step d, the reader calculates the third authentication message M ₃ , sends the third authentication message M ₃ to the tag, and updates the shared key x to [x ² mod n] _l ;

Step e, the tag receives and verifies whether the third authentication message _M3 is correct, and if it is correct, it determines that the authentication is successful.

Further, the above-mentioned authentication method may also have the following characteristics. In step c, if there is no (ID, x) satisfying the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , then further verify whether There exists (ID,x') that satisfies the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , where x' is the share of the previous authentication stored in the reader. If the key exists, replace (ID, x) with (ID, x') and then execute the step d.

Further, the above authentication method may also have the following characteristics, n uses a Mersenne number, that is, n=2 ^k −1, where k is the length of the shared key x.

Further, the above authentication method may also have the following feature, the set number of digits is less than or equal to the total number of digits of the second authentication message _M2 .

Further, the above authentication method may also have the following features, if in step e, the third authentication message _M3 is correct after being verified by the label, then step f is executed after it is determined that the authentication is successful: the label updates the shared key x to [x ² mod n] _l .

In order to solve the above technical problems, the present invention proposes an authentication system, which is applied to a radio frequency identification system, including:

The first generating and sending module is placed in the reader, and is used to send the first random number _r1 generated by the reader to the tag;

The second generating and sending module is placed in the tag and is used to receive the first random number r ₁ , generate the second random number r ₂ , and calculate the first random number r 2 according to the first random number r ₁ and the second random number r ₂ The authentication message M ₁ and the second authentication message M ₂ send the data of all the digits of the first authentication message M ₁ and the data of the set digits of the second authentication message M ₂ to the reader, wherein M ₁ = x⊕r ₂ , M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² modn] _l , the symbol "⊕" means XOR operation, the symbol "mod" means modular square operation, "[] _l " means take "[ ]” in the ciphertext, x is the shared key of the known reader and tag, ID is the tag identification, and n is the modulus;

A verification module, placed in the reader, for receiving the first authentication message M ₁ and the second authentication message M ₂ , and calculating the second random number r ₂ according to the first authentication message M ₁ , r ₂ =M ₁ ⊕x, and then verify whether there is (ID, x) satisfying the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , if it exists, start the calculation and update the module;

The calculation and update module is placed in the reader and is used to calculate the third authentication message M ₃ , send the third authentication message M ₃ to the tag, and update the shared key x to [x ² mod n] _l ;

The judging module, placed in the tag, is used to receive and verify whether the third authentication message _M3 is correct, and if it is correct, judge that the authentication is successful.

Further, the above authentication system may also have the following features, the verification module includes a re-verification unit for satisfying the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n when there is no (ID, x) ] _l , further verify whether (ID, x') satisfies the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , where x' is the current authentication stored in the reader If there is a shared key in the previous authentication, replace (ID, x) with (ID, x') and start the calculation and update module.

Further, the above authentication system may also have the following characteristics, n uses a Mersenne number, that is, n=2 ^k −1, where k is the length of the shared key x.

Further, the above authentication system may also have the following feature, the set number of digits is less than or equal to the total number of digits of the second authentication message _M2 .

Further, the above-mentioned authentication system may also have the following features, the determination module includes a key update unit, and the key update unit is used to determine the current authentication when the third authentication message _M3 is verified as correct by the label. After success, update the shared key x in the label to [x ² mod n] _l .

The authentication method and system of the present invention can resist known attack methods, including replay attacks, asynchronous attacks, and man-in-the-middle attacks, and can provide forward security; and, the authentication method and system of the present invention only use pseudo-random functions, reducing The calculation cost and storage cost of the authentication algorithm are reduced, and it is suitable for application in low-cost tags.

Description of drawings

Fig. 1 is the process schematic diagram of RFID lightweight two-way authentication among the present invention;

Fig. 2 is the flowchart of authentication method in the embodiment of the present invention;

Fig. 3 is a structural block diagram of the authentication system in the embodiment of the present invention.

Detailed ways

The principles and features of the present invention are described below in conjunction with the accompanying drawings, and the examples given are only used to explain the present invention, and are not intended to limit the scope of the present invention.

The RFID authentication protocol mainly solves the security and privacy issues of wireless transmission between the reader and the tag. This paper mainly discusses the interaction process between the reader R and the tag T. Let the symmetric key between the reader R and the tag T be x, and the tag ID be ID. According to the working mode of the reader and the tag, it can be divided into: reader first talk (RTF) mode and tag first talk (TTF) mode. Most low-cost tags are passive, generally in RTF mode. Without loss of generality, the RTF mode is discussed here.

Let the reader and tag in the authentication message, the set of parameters that can be used is τ, then τ={ID,x,r ₁ ,r ₂ }. Let the set of lightweight operators and cryptographic elements that can be used be σ (that is, the set of operations), then σ={⊕,←,·,CRC,PRNG,MAC,…}, where "⊕" is an XOR operator, "←" is a shift operator, and "·" is a point Multiplication operation, CRC is cyclic redundancy check, PRNG is pseudo-random generator, MAC stands for message digest function, common such as Hash function, etc. Let the set of authentication messages be ξ={F _i |i∈Ζ}. All authentication message functions F _i are some combination of parameter set τ and operation set σ. In order to protect the privacy of the tag, the ID of the tag will not be directly transmitted to the reader in plain text for authentication during the authentication process. Therefore, before the authentication is completed, the reader does not know which tag is currently to be authenticated. Therefore, in the present invention, an identity equation about ID and shared key x is generated through the authentication messages M ₁ and M ₂ , and the identity of the tag to be authenticated is traversed and queried. Under normal circumstances, the reader will send this information to the database, and the database will traverse the query. For the computing power of the database, such a traversal query is feasible. In addition, the hit rate can also be provided through other mechanisms such as calculation in advance, cache, and parallel calculation. For the reader, since it is unknown which tag participates in the authentication, both the key x and the random number r ₂ are unknown. In the present invention, if M ₁ is set to x⊕r ₂ , then the reader can use x to express r ₂ , that is, r ₂ =M ₁ ⊕x, so that an identity equation about x can be constructed. And the message M ₂ is the MAC function on the set τ. After the database finds the corresponding record, it sends (ID,x) to the reader. The reader calculates the authentication message M3 and sends it to the tag. The main purpose of M3 is to authenticate the tag to the reader, and the reader needs to use M3 to show that it knows the secret between them, such as the shared key x, or the random number r ₂ , etc. Because of this information, only legal readers can obtain it through authentication messages M ₁ and M ₂ . The process of RFID lightweight two-way authentication in the present invention is shown in FIG. 1 .

Fig. 2 is a flow chart of the authentication method in the embodiment of the present invention. The authentication method can be applied to a radio frequency identification system. As shown in Figure 2, in this embodiment, the process of the authentication method may include the following steps:

Step S201, the reader sends the first random number r ₁ generated by itself to the tag;

Step S202, after receiving the first random number _r1 , the tag generates the second random number _r2 , and calculates the first authentication message _M1 and the second authentication message _M1 and _the second authentication message according to the first random number r1 and the second random number r2 Message M ₂ , sending the data of all digits of the first authentication message M ₁ and the data of the set digits of the second authentication message M ₂ to the reader, wherein, M ₁ =x⊕r ₂ , M ₂ = [(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , the symbol "⊕" means the XOR operation, the symbol "mod" means the modular square operation, and "[] _l " means to take the l of the ciphertext in "[]" Bit, x is the shared key of the known reader and tag, ID is the tag identification, n is the modulus;

The function of r ₂ is mainly to prevent the attacker from identifying the tag for tracking according to the authentication messages M ₁ and M ₂ returned by the tag. If the tag generates its own random number r ₂ in each authentication process, the protocol can avoid this problem. It can be seen that in the authentication process of the present invention, the reader and the tag generate random numbers r ₁ and r ₂ respectively, so the replay attack can be effectively resisted.

In a preferred embodiment, a Mersenne number can be used for n, that is, n=2 ^k −1, where k is the length of the shared key x.

Wherein, the set number of digits is less than or equal to the total number of digits of the second authentication message _M2 .

Step S203, after receiving the first authentication message M ₁ and the second authentication message M ₂ , the reader calculates the second random number r ₂ according to the first authentication message M ₁ , r ₂ =M ₁ ⊕x, and then verifies Whether there is (ID, x) that satisfies the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , if it exists, execute step S204;

In this step, if there is no (ID,x) that satisfies the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , then further verify whether there is (ID,x') that satisfies the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , where x' is the shared key of the previous authentication of this authentication stored in the reader, if it exists, use (ID,x' ) to replace (ID, x) and execute step S204.

Due to the uncertainty of the radio frequency communication between the reader and the tag, or due to the existence of an attacker, the tag cannot receive M ₃ correctly, so that the key cannot be updated after verifying M ₃ . In the next authentication, the tag uses the old key to generate messages M ₁ and M ₂ , and the reader cannot find the correct shared key x. In order to solve this situation, the reader needs to save the last shared key x' (that is, the shared key in the previous authentication of this authentication), which is used to restore the key inconsistency caused by the last terminated authentication process. In order to ensure the forward security of the protocol, the key updating function F ₄ (τ) should be one-way. It should be noted that the forward security here is for tags. Because the reader can restore the key of the previous authentication, the reader cannot achieve forward security.

Step S204, the reader calculates the third authentication message M ₃ , sends the third authentication message M ₃ to the tag, and updates the shared key x to [x ² mod n] _l ;

Step S205, the tag receives and verifies whether the third authentication message _M3 is correct, and if it is correct, it determines that the authentication is successful.

If in step S205, the third authentication message M ₃ is correct after being verified by the tag, the following step may be further performed after determining that the authentication is successful: the tag updates the shared key x to [x ² modn] _l .

The authentication method of the present invention can resist known attack methods, including replay attacks, asynchronous attacks, and man-in-the-middle attacks, and can provide forward security; and, the authentication method of the present invention only uses pseudo-random functions, which reduces the complexity of authentication algorithms. Computing cost and storage cost, suitable for application in low-cost tags.

The present invention also proposes an authentication system for implementing the above authentication method.

Fig. 3 is a structural block diagram of the authentication system in the embodiment of the present invention. As shown in FIG. 3 , in this embodiment, the authentication system includes a first generation and transmission module 310 , a second generation and transmission module 320 , a verification module 330 , a calculation and update module 340 and a determination module 550 . The first generating and sending module 310 , the second generating and sending module 320 , the verifying module 330 , the calculating and updating module 340 and the judging module 550 are serially connected in series. Wherein, the first generating and sending module 310 is placed in the reader-writer, and is used for sending the first random number r ₁ generated by the reader-writer itself to the tag. The second generating and sending module 320 is placed in the tag, and is used to receive the first random number r ₁ , generate the second random number r ₂ , and calculate the first random number r 2 according to the first random number r ₁ and the second random number r ₂ The authentication message M ₁ and the second authentication message M ₂ send the data of all the digits of the first authentication message M ₁ and the data of the set digits of the second authentication message M ₂ to the reader, wherein M ₁ = x⊕r ₂ , M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , the symbol "⊕" means the XOR operation, the symbol "mod" means the modular square operation, and "[] _l " means to take " []” in the ciphertext, x is the shared key of the known reader and tag, ID is the tag identification, and n is the modulus. The verification module 330 is installed in the reader, for receiving the first authentication message M ₁ and the second authentication message M ₂ , and calculating the second random number r ₂ according to the first authentication message M ₁ , r ₂ =M ₁ ⊕x, and then verify whether there is (ID, x) satisfying the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , if it exists, start the calculation and update the module. Calculation and update module 340, placed in the reader, used to calculate the third authentication message M ₃ , send the third authentication message M ₃ to the tag, and update the shared key x to [x ² mod n] _l . The determination module 550 is placed in the tag, and is used to receive and verify whether the third authentication message _M3 is correct, and if it is correct, determine that the authentication is successful.

In the embodiment of the present invention, the verification module 330 may include a re-verification unit. The re-verification unit is used to further verify whether (ID, x') satisfies the equation M when there is no (ID, x) that satisfies the equation M ₂ =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _{l 2} =[(r ₁ ⊕r ₂ ⊕ID) ² mod n] _l , where x' is the shared key of the previous authentication of this authentication stored in the reader, if it exists, use (ID,x ') instead of (ID, x) to start the calculation and update module 340 .

Wherein, n may use a Mersenne number, that is, n=2 ^k −1, where k is the length of the shared key x.

Wherein, the set number of digits is less than or equal to the total number of digits of the second authentication message _M2 .

In this embodiment of the present invention, the determination module 550 may include a key update unit. The key updating unit is configured to update the shared key x in the tag to [x ² mod n] _l after judging that the authentication is successful when the third authentication message M ₃ is verified to be correct by the tag.

The authentication system of the present invention can resist known attack methods, including replay attacks, asynchronous attacks, and man-in-the-middle attacks, and can provide forward security; and, the authentication system of the present invention only uses pseudo-random functions, which reduces the complexity of authentication algorithms. Computing cost and storage cost, suitable for application in low-cost tags.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (10)

1. an authentication method, is applied to radio frequency identification system, it is characterized in that, comprising:

Step a, the first random number r that read write line produces self ₁send to label;

Step b, label receives the first random number r ₁after, produce the second random number r ₂, and according to described the first random number r ₁with the second random number r ₂calculate the first authentication message M ₁with the second authentication message M ₂, the first authentication message M ₁data and the second authentication message M of whole figure places ₂the data of setting figure place send to read write line, wherein, M ₁=x ⊕ r ₂, M ₂=[(r ₁⊕ r ₂⊕ ID) ²mod n] _l, symbol " ⊕ " represents XOR, symbol " mod " represents computing module-square, " [] _l" representing to get the l position of ciphertext in " [] ", x is the shared key of known read write line and label, and ID is tag identifier, and n is modulus;

Step c, read write line receives the first authentication message M ₁with the second authentication message M ₂after, according to the first authentication message M ₁calculate described the second random number r ₂, r ₂=M ₁⊕ x, then whether checking exists (ID, x) to meet equation M ₂=[(r ₁⊕ r ₂⊕ ID) ²mod n] _lif exist and perform step d;

Steps d, read write line calculates the 3rd authentication message M ₃, by the 3rd authentication message M ₃send to label, and shared key x is updated to [x ²mod n] _l;

Step e, label receives and verifies the 3rd authentication message M ₃whether correct, if correctly judge this authentication success.

2. authentication method according to claim 1, is characterized in that, in step c, if do not exist (ID, x) to meet equation M ₂=[(r ₁⊕ r ₂⊕ ID) ²mod n] _l, further whether checking exists (ID, x') to meet equation M ₂=[(r ₁⊕ r ₂⊕ ID) ²mod n] _l, wherein, x' is this authentication of preserving in read write line front shared key while once authenticating, and uses (ID, x') to replace carrying out described steps d after (ID, x) if exist.

3. authentication method according to claim 1, is characterized in that, n is used Mersenne number, i.e. n=2 ^k-1, wherein, k is the length of shared key x.

4. authentication method according to claim 1, is characterized in that, described setting figure place is less than or equal to described the second authentication message M ₂total bit.

5. authentication method according to claim 1, is characterized in that, if in step e, and the 3rd authentication message M ₃through label, checking is correct, after judging this authentication success, performs step f: label is updated to [x by shared key x ²mod n] _l.

6. a Verification System, is applied to radio frequency identification system, it is characterized in that, comprising:

First produces and sending module, is placed in read write line, for the first random number r that read write line self is produced ₁send to label;

Second produces and sending module, is placed in label, for receiving the first random number r ₁, produce the second random number r ₂, and according to described the first random number r ₁with the second random number r ₂calculate the first authentication message M ₁with the second authentication message M ₂, the first authentication message M ₁data and the second authentication message M of whole figure places ₂the data of setting figure place send to read write line, wherein, M ₁=x ⊕ r ₂, M ₂=[(r ₁⊕ r ₂⊕ ID) ²modn] _l, symbol " ⊕ " represents XOR, symbol " mod " represents computing module-square, " [] _l" representing to get the l position of ciphertext in " [] ", x is the shared key of known read write line and label, and ID is tag identifier, and n is modulus;

Authentication module, is placed in read write line, for receiving the first authentication message M ₁with the second authentication message M ₂, according to the first authentication message M ₁calculate described the second random number r ₂, r ₂=M ₁⊕ x, then whether checking exists (ID, x) to meet equation M ₂=[(r ₁⊕ r ₂⊕ ID) ²mod n] _lif exist and start and calculate and update module;

Calculate and update module, be placed in read write line, for calculating the 3rd authentication message M ₃, by the 3rd authentication message M ₃send to label, and shared key x is updated to [x ²mod n] _l;

Determination module, is placed in label, for receiving and verify the 3rd authentication message M ₃whether correct, if correctly judge this authentication success.

7. Verification System according to claim 6, is characterized in that, described authentication module comprises authentication unit again, for not existing (ID, x) to meet equation M ₂=[(r ₁⊕ r ₂⊕ ID) ²mod n] _ltime, further whether checking exists (ID, x') to meet equation M ₂=[(r ₁⊕ r ₂⊕ ID) ²mod n] _l, wherein, x' is this authentication of preserving in read write line front shared key while once authenticating, and uses (ID, x') to replace starting described calculating and update module after (ID, x) if exist.

8. Verification System according to claim 6, is characterized in that, n is used Mersenne number, i.e. n=2 ^k-1, wherein, k is the length of shared key x.

9. Verification System according to claim 6, is characterized in that, described setting figure place is less than or equal to described the second authentication message M ₂total bit.

10. Verification System according to claim 6, is characterized in that, described determination module comprises key updating units, and key updating units is used at described the 3rd authentication message M ₃through label, be verified as when correct, after judging this authentication success, the shared key x in label be updated to [x ²mod n] _l.

Images