Reader Computation - Path Signature - TRACKER: Product Tracking by a Trusted Party

5.4 TRACKER: Product Tracking by a Trusted Party

5.4.2 Path Signature

5.4.2.1 Reader Computation

A reader that is visited by some tagT, readsT’s current path signature, updates it, and writes the updated path signature into T. To eventually achieve the evaluation of path signature σ_P_l(ID) of pathPl =−−−−−−−−−−−−−−−−−→v₀v₁. . .v_k−1v_kv_k+1. . .v_l, the per reader effort is quite low. Assume that T arrives at reader Rk, i.e., step v_k in the supply chain. So far,T went through (sub-)path Pk−1 =−−−−−−−−→v₀v₁. . .v_k−1, and storesID,H(ID), and path signatureσ_P_k−1(ID).

To getσPk(ID), readerRk simply computes its state transition function fRk defined as:

fRk(x, y) :=x^x⁰ +y^a^k In fact,

fRk(σ_P_k−1(ID), H(ID)) = σ_P_k−1(ID)^x⁰ H(ID)^a^k =H(ID)^φ(P^k−¹^)x⁰ H(ID)^a^k

= H(ID)^x⁰^φ(P^k−1^)+a^k =H(ID)^φ(^{−−−−−→}^P^k−1^v^k⁾ =H(ID)^φ(P^k⁾ (5.2)

= σ_P_k(ID) ReaderR_k then writesσ_P_k(ID) in tagT. 5.4.2.2 Tag State Decoding

This operation corresponds to the Checkfunction of the Trackerprotocol.

5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS

To verify the genuineness of tags in the supply chain managerM stores a list of all possible valid pathsPvalidi together with their corresponding verification keysKⁱ =φ(Pvalidi).

Now when manager M reads the state S_T^j = (ID, H(ID), σ_P(ID)) of some tag T in the supply chain that went through a path P, he first computes H(ID) and verifies the second element of T’s state. If T passes the verification, manager M checks whether there exists a verification keyKⁱ ∈ KV that verifies the following equation:

σP(ID) =H(ID)^Kⁱ =H(ID)^φ(P^validⁱ⁾ 5.4.3 TRACKER

Trackerconsists of an initial setup phase, the preparation of new tags entering the supply chain, reader and tag interaction as part of the supply chain, and finally a path verification conducted by managerM.

• Setup: A trusted third party (TTP) sets up an elliptic curve Elgamal cryptosystem and generates the secret keyskand the corresponding public keypk= (g,˜g=g^sk) such that the order of g is a large primeq, (|q|= 160 bits). Without loss of generality, we denote G=hgi.

Then, it selects a generatorx0of the finite fieldF_q, and generatesη+1 random numbers a_k∈F_q, 0≤k≤η.

Through a secure channel, the TTP sends to each readerR_k, representing step v_k the tuple (x₀, ak,pk), while providing issuerI with the tuple (x₀, a₀,pk). Finally, it supplies managerM with the secret key sk, the generator x₀ and the tuples (k, a_k).

Now, manager M is informed which reader Rk at stepv_k knows whichak. As manager M knows which paths in the supply chain will be valid, he now computes his set of verification keysKV ={K¹, K², ..., K^ν}. Each verification key Kⁱ is computed as the encoding of a valid pathPvalidi in the supply chain using Equation (5.1). That is,

Kⁱ =φ(Pvalidi)

Finally, manager M stores the pairs (Kⁱ,steps), where steps is the sequence of steps composing the pathPvalidi. Accordingly, managerM can verify the validity of the path that a tag took, and if the path is valid he can identify it.

• Tag initialization: For each new tag T entering the supply chain, issuer I draws a random point ID ∈ E which is T’s unique identifier. Now, let H : {0,1}^∗ → G be a cryptographic hash function⁶. H will be viewed in the rest of this section as a random oracle.

6The hash functionH can be computed using the algorithm proposed by Brier et al. (28).

108

5.4 TRACKER: Product Tracking by a Trusted Party Provided with the secret coefficient a₀, issuer I computes

σv0 =H(ID)^a⁰

Next, he selects three random numbers r⁰_ID, r_H⁰, r⁰_σ ∈ F_q to compute the following ci-phertexts:

c⁰_ID = Enc_pk(ID) = (u⁰_ID, v_ID⁰ ) = (g^r^ID⁰ ,ID˜g^r^ID⁰)

c⁰_H = Enc_pk(H(ID)) = (u⁰_H, v⁰_H) = (g^r^H⁰ , H(ID)˜g^r⁰^H) c⁰_σ = Enc_pk(σv0) = (u⁰_σ, v_σ⁰) = (g^r^σ⁰, H(ID)^a⁰g˜^r⁰^σ)

Finally, he writes the stateS_T⁰ = (c⁰_ID, c⁰_H, c⁰_σ) into tagT which can now enter the supply chain.

• Tag state update by readers: Assume a tag T arrives at reader Rk that is as-sociated with step v_k in the supply chain. Reader R_k reads out T’s current state S_T^j = (c^j_ID, c^j_H, c^j_σ). Without loss of generality, we assume that the path that tagT took so far is P.

Given the ciphertexts c^j_H = (u^j_H, v^j_H), c^j_σ = (u^j_σ, v^j_σ), generator x₀, and a_k, reader R_k computes c^j+1_σ = (u^j+1_σ , v_σ^j+1) as follows:

u^j+1_σ = fRk(u^j_σ, u^j_H) = (u^j_σ)^x⁰(u^j_H)^a^k

= g^x⁰^r^j^σg^a^k^r^j^H =g^x⁰^r^σ^j^+a^k^r^j^H =g^r^j+1^σ v_σ^j+1 = f_R_k(v^j_σ, v_H^j ) = (v^j_σ)^x⁰(v_H^j )^a^k

H(ID)^φ(P)g˜^r^j^σx0

H(ID)˜g^r^j^Hak

= H(ID)^x⁰^φ(P)˜g^x⁰^r^σ^jH(ID)^a^k˜g^a^k^r^j^H

= H(ID)^x⁰^φ(P)H(ID)^a^kg˜^x⁰^r^j^σ˜g^a^k^r^j^H

= H(ID)^(x⁰^φ(P)+a^k⁾g˜^x⁰^r^j^σ^+a^k^r^H^j

= H(ID)^φ(^−−→^Pv^k⁾g˜^r^σ^j+1

= σ^−−→_Pv

k(ID)˜g^r^j+1^σ

To getc^j+1_ID andc^j+1_H , reader R_k re-encryptsc^j_ID andc^j_H respectively: it picks randomly two numbers r_ID^′ and r_H^′ ∈F_q and outputs two new ciphertexts c^j+1_ID = (u^j+1_ID , v^j+1_ID ) = (g^r^ID^′ u^j_ID,˜g^r^′^IDv^j_ID) and c^j+1_H = (u^j+1_H , v_H^j+1) = (g^r^H^′ u^j_H,g˜^r^H^′ v_H^j ).

The reader also re-encrypts c^j+1_σ . It picks randomly r^′_σ ∈ F_q and outputs: c^′j+1_σ = (u^′j+1_σ , v_σ^′j+1) = (g^r^σ^′u^j+1_σ ,g˜^r^σ^′v^j+1_σ ). Finally, reader R_k writes the new state S_T^j+1 = (c^j+1_ID , c^j+1_H , c^′j+1_σ ) into tagT.

5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS

• Path verification by manager M: This operation corresponds to Tracker’s re-alization of the Check function. Upon reading the state S_T^l = (c^l_ID, c^l_H, c^l_σ) stored into tagT, manager M decrypts c^l_ID and gets ID∈ G. Manager M checks first for cloning by looking upID in his database DB_M. If ID∈DB_M, then manager M outputs 0 and rejects tagT.

Otherwise, manager M decrypts c^l_H, gets a point g^′ ∈ E and verifies whether the equation g^′ = H(ID) holds. If it does not, manager M outputs 0 and rejects tag T.

If g^′ =H(ID), then manager M decryptsc^l_σ which results in another point ˜σ. Given H(ID), manager M verifies whether there exists Kⁱ∈ K^V such that

σ=H(ID)^Kⁱ =H(ID)^φ(P^validⁱ⁾

If it is not the case, manager M outputs 0 and rejects the tag T. Otherwise, manager M outputs 1 and adds ID to his databaseDB_M.

5.4.4 Security Analysis

In this section, we present the main security theorems regardingTracker. Theorem 5.1. Tracker is complete.

Proof. We note that if a tag T went through a valid path Pvalidi, then T will store a state S_T = (c_ID, c_H, c_σ) such that:

cID = Enc_pk(ID) cH = Enc_pk(H(ID))

c_σ = Enc_pk(σ_P_valid

i(ID)) =Enc_pk(H(ID)^φ(P^validⁱ⁾)

When manager M decrypts the state S_T, he obtains the tuple (ID, H(ID), σ_P_valid

i(ID)).

Now it is clear that for Kⁱ = φ(Pvalidi), the equation H(ID)^Kⁱ =σ_P_valid

i(ID) holds, leading the check function to output “1”.

Theorem 5.2. Tracker is sound under the CDH assumption in G in the random oracle model.

Proof. Assume there is an adversary A who breaks the security of Tracker with a non-negligible advantage ǫ, we build an adversary B that uses A as a subroutine to break the CDH assumption with a non-negligible advantageǫ^′.

Let OCDH be an oracle that selects randomly x, y∈F_q, and returnsg, g^x, g^y ∈G.

Proof overview. If adversaryA has a non-negligible advantageǫin breaking the security of Tracker, then adversary A will be able to output a challenge tag T_c that stores an encrypted state STc, such that:

110

5.4 TRACKER: Product Tracking by a Trusted Party i.) Check(S_T_c, M) = 1, i.e., there is a valid path Pvalidi that corresponds toT_c’s state;

ii.) ∃ v_k ∈ Pvalidi such that step v_k is not corrupted by adversaryA; iii.) T_c did not go through step v_k.

To break the CDH assumption, adversaryB simulates a Trackersystem for A where he creates a step v_kin the supply chain such that Sec_k= (x₀, g^x) instead of Sec_k = (x₀, a_k).

Without loss of generality, we assume in the rest of the proof that v_k = v₀ and that adversaryA corrupts all readers in the supply chain.

Now, adversaryB must convince adversaryAthat v₀ is associated with secret coefficient a₀ =xthat corresponds tog^x received from the oracleO^CDH. That is, adversaryBhas to be able to compute H(ID)^x only by knowing g^x. To this end, adversary B simulates a random oracle Hto compute the hash function H.

WhenHis queried in the learning phase with identifierIDj,Bpicks a random numberrj

and computes H(IDj) =g^r^j.

When adversaryAqueries the random oracleHwith the identifierID_cof the challenge tag T_c, adversaryB simulates Hby picking a random numberr_c and computing H(ID_c) =g^yr^c.

In the challenge phase, adversaryAreturns the challenge tag T_c to B.

As adversary A has a non-negligible advantage in winning the soundness game, it fol-lows that the challenge tag T_c stores an encrypted valid state that corresponds to the tuple (IDc, H(IDc), σc) such thatσc =H(IDc)^φ(P^validⁱ⁾, while T_c did not go through the stepv₀.

We assume that tag T_c stores a state S_T_c that corresponds to the valid path Pvalidi =

−−−−−→ g^xy. This breaks the CDH assumption leading to a contradiction.

Simulation of the random oracle H. To respond to the queries of the random oracle H, the adversaryB keeps a tableTH of tuples (IDj, rj,coin(IDj), H(IDj)) as explained below.

On a queryH(ID_i), adversaryB replies as follows:

1. If there is a tuple (ID_i, r_i,coin(ID_i), H(ID_i)) that corresponds to ID_i, then B returns H(IDi).

5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS

2. If ID_i has never been queried before, then B picks a random number r_i ∈ F_q and flips a random coin coin(IDi) ∈ {0,1} such that: coin(IDi) = 1 with probability p, and it equals to 0 with probability 1−p. If coin(IDi) = 0, then B answers with H(IDi) =g^rⁱ. Otherwise, he answers with H(IDi) = (g^y)^rⁱ. Finally, he stores the tuple (IDi, ri,coin(IDi), H(IDi)) in tableTH.

Construction. First, adversaryB queriesOCDH to receive g, g^x, g^y ∈G. Then, adversary B simulates the challengerC:

• AdversaryBgenerates a pair of matching Elgamal public and secret keys (sk,pk). Then, he generates η random coefficientsak.

• Next, he provides each reader Rk inTrackerwith the pairSec_k= (x0, ak).

• He provides the issuerI with the pair (x0, g^x), as ifa0=x.

• Instead of computing the verification keys Kⁱ as the encoding of valid paths in the supply chainφ(Pvalidi), adversaryB computes Kⁱ =g^φ(P^validⁱ⁾.

Without loss of generality, a valid pathPvalidi in the supply chain could be represented as Pvalidi = −−−−−→

v₀Pvalid^′ i. Thus, g^φ(P^validⁱ⁾ = g^xx^l⁰^+φ(P^valid^′ ⁱ⁾, wherel is the length of path Pvalidi.

OnceKⁱ are computed for all the valid paths in the supply chain,Bprovides the pairs (Kⁱ,steps) to the manager M.

• B simulates the issuerI and createsntags T_j ofTracker. For each tag T_j,Bselects randomlyID_j ∈Gand simulates the random oracleHto get the tuple (IDj, rj,coin(IDj), H(ID_j)).

If coin(IDj) = 1, i.e., H(IDj) = g^yr^j, then B cannot compute H(IDj)^x = g^xyr^j as he does not know bothx and y. Consequently, Bstops the soundness game.

Otherwise, using rj, adversary Bcomputes H(IDj)^x= (g^x)^r^j.

Finally, adversary B encrypts the tuple (ID_j, H(ID_j), σ_v₀(ID_j)) using the public key pk of Elgamal cryptosystem. Bstores the resulting ciphertexts (c⁰_ID_j, c⁰_H_j, c⁰_σ_j) into tagTj. Learning phase. B then calls adversaryAand simulates the challengerC as follows.

• AdversaryBsimulates the oracleOCorruptR forA. For ease of understanding, we assume that adversaryA corrupts all readers Rk in the supply chain.

• AdversaryBsimulates readersRkalong the supply chain. LetTj be a tag which arrives at step v_k. B updates the state of tag T_j using the secret coefficient a_k and Elgamal public key pk.

112

5.4 TRACKER: Product Tracking by a Trusted Party

• AdversaryBsimulates the oracle OCheck. LetT_j be a tag that went through some path P in the supply chain. Tag Tj stores a stateSTj = (cIDj, cHj, cσj).

B first decrypts the state of tag Tj and gets a tuple of points (IDj, g_j^′,σ˜j). He then looks upID_j inT_H to retrieve (ID_j, r_j,coin(ID_j), H(ID_j)), verifies whetherH(ID_j) =g_j^′, and finally, checks whether there is a valid path Pvalidi in the supply chain such that

σj = (Kⁱ)^r^j and Kⁱ =g^φ(P^validⁱ⁾.

Note. Here, we assume that coin(ID_j) = 0 for ease of understanding. Otherwise, adversary B has to stop the soundness game whenever coin(IDj) = 1, as he cannot verify the validity of the path that tag Tj took.

Challenge phase. AdversaryA outputs a tagT_c.

Since adversaryA has a non-negligible advantage in the soundness game, it follows that i.) Check(STc, M) = 1, andii.) T_c did not go through step v₀.

Without loss of generality, we assume that the state of tag T_c corresponds to the tuple (ID_c, H(ID_c), σ_c), and thatT_c’s path signatureσ_c corresponds to path Pvalidi =−−−−−→ Letl denote the length of pathPvalidi. Accordingly,

φ(Pvalidi) = a₀x^l₀+φ(Pvalid^′ i) =xx^l₀+φ(Pvalid^′ i) Provided with the random numberr_c, adversaryB finally computesg^xy.

Here we compute the advantageǫ^′ofB. We indicate that without knowing the value ofx, adversaryBcannot identify the valid path that the state of the challenge tagT_c encodes. As a result, B picks randomly a valid pathPvalidi from his set of ν valid paths, and he succeeds in breaking the CDH assumption only if, 1.) his guess of the valid path that the state of tag Tc encodes is correct and if2.) he does not stop the soundness game.

1.) AdversaryBmakes a correct guess of the valid path that the state of tagTc encodes with probability 1

ν.

2.) Adversary B stops the soundness game in the learning phase, if during the initialization phase of thentags inTracker, there is a tagTj with identifierID_j such thatcoin(IDj) =

5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS

1. This event occurs with probability p. Hence, the probability that Bdoes not stop the soundness game in the learning phase is: (1−p)ⁿ.

3.) Adversary B does not stop the game during the challenge phase, ifcoin(IDc) = 1, which occurs with probability p.

Let E denote the event: B does not stop the soundness game.

Let E₁ denote the event: B does not stop the soundness game in the learning phase, P r(E₁) = (1−p)ⁿ.

Let E₂ denote the event: B does not stop the soundness game in the challenge phase, P r(E₂) =p. Hence,

π = P r(E) =P r(E₁)P r(E₂)

= p(1−p)ⁿ

Now, if adversary Ahas a non-negligible advantage ǫin breaking the security of Tracker, then adversary B can break the CDH assumption with a non-negligible advantage ǫ^′ = π

νǫ, leading to a contradiction.

Note thatπ is maximal whenp= 1

n andπmax= 1−_n¹n

n ≃ 1

en. 5.4.5 Privacy Analysis

In this section, we prove thatTrackerensures tag unlinkability under the DDH assumption (see Definition 2.29).

Theorem 5.3 (Tag Unlinkability). Tracker ensures tag unlinkability under the DDH as-sumption.

Proof. Assume there is an adversary A whose advantage ǫ in winning the tag unlinkability game is non-negligible. We below construct a new adversary B that executes A and breaks the DDH assumption inG=hgiwith a non-negligible advantage ǫ^′.

LetO^DDH be an oracle that when queried selects two random elementsx, y∈F_q and flips a fair coin b∈ {0,1}. If b= 1, thenODDH sets z=xy; otherwise it randomly selects z from F_q. Finally, it returns the tuple (g, g^x, g^y, g^z).

To break the DDH assumption in G, adversaryBproceeds as follows:

He queries the oracleODDHand gets the tuple (g, g^x, g^y, g^z). Then, he simulates challenger C and creates a supply chain for theTracker protocol where the public key of Elgamal is defined aspk= (g,g˜=g^x).

Learning phase. He calls adversary A who enters the learning phase of the tag unlinka-bility game.

114

5.4 TRACKER: Product Tracking by a Trusted Party

• AdversaryAqueries the oracleOCorruptR with the identity ofr readersR_k in the supply chain. Bsimulates the oracleOCorruptRand returns to adversaryAthe secret information of readersR_k defined asSec_k= (x₀, a_k).

• Simulating the oracle OTag, adversaryB supplies adversary A with two challenge tags T₀ andT₁ that have just been issued by issuer I (i.e.,T₀ and T₁ have just entered the supply chain).

• Adversary A iterates the supply chain ρ times. Before each iteration j of the supply chain:

1.) A reads and writes into tagsT₀ and T₁.

2.) Simulating the oracle OStep, adversary BprovidesAwith the next step of tags T₀ and T₁.

3.) B simulates the oracles OTag andOStep and suppliesAwith stags T_(i,j) together with their next step vT_(i,j) in the supply chain.

Challenge phase.

• AdversaryB simulates the oracles OStep and provides adversaryA with the next steps of tags T₀ and T₁. Then, he iterates the supply chain for tags T₀ and T₁ outside the range of adversary A, updates the path signature and re-encrypts the states of tags T₀ and T₁ according to Tracker. Finally, adversaryB simulates the oracle OFlip as follows.

• Now, adversaryB returns tag T_b to adversary A.

Notice that ifz =xy, then the state S_T^′_b is a correct re-encryption of the state STb, i.e., S_T^′_b is a valid state that corresponds to tagT_b. Consequently, the simulation ofTrackerby adversaryB does not differ from an actual Trackersystem, and adversary Acan output a correct guess b^′ for the value ofb with a non-negligible advantageǫ.

5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS If z 6= xy, then the state S_T^′

b does not correspond to tag T_b, and adversaryA’s view of the tag unlinkability game is independent ofb. Therefore, adversaryA has only a negligible advantage in outputting a correct guessb^′ for the bitb.

This leads to a statistical distinguisher between the two distributions (g, g^x, g^y, g^xy) and (g, g^x, g^y, g^z), x, y, z∈F_q, breaking hereby the DDH assumption in G.

If adversary A outputs b^′ =b, then adversary B outputsz =xy; otherwise adversary B outputsz6=xy.

In conclusion, if there is an adversary A(r, s, ρ, ǫ) who breaks the tag unlinkability of Tracker, then there is an adversaryB who breaks the DDH assumption inG with a non-negligible advantage ǫ^′=ǫ.

5.4.6 Evaluation

Tracker can be implemented using today’s available RFID tags. It requires tags to only store data, i.e, the encryptedID, the encrypted hash and the encrypted path signature. Con-sequently, the tag stores three Elgamal ciphertextscID= (g^r^ID,ID˜g^r^ID) ,cH = (g^r^H, H(ID)˜g^r^H) andcσ = (g^r^σ, σ_P(ID)˜g^r^σ), which results in an overall storage of 2·3·160 = 960 bits. Storing only 1 Kbit of data is feasible for today’s EPC Class 1 Gen 2 UHF tags, for example Alien Technology’s Higgs 3 tags (2).

Complexity for readers is also low in Tracker. A reader R_k at step v_k is required to store the pair (x₀, ak) ∈F_q and the public key of Elgamal pk = (g,g). So, the total storage˜ per reader is approximately 80 bytes. Regarding computation, R_k is required to update the path signature of the tags passing by and to re-encrypt three ciphertexts: this sums up to a total of eight exponentiations in G. Based on previous research (17), we conjecture this to be feasible even for lightweight embedded readers.

The manager M is required to maintain two lookup tables. The first table stores the list of valid paths in the supply chain, while the second corresponds to the managerM’s database DB_M that contains the identifiers of tags that he has read. Therefore, the storage required in M is linear in the number of valid paths, and the number of tags in the supply chainO(ν+n).

The path verification on the other hand, requires the managerM to1.) decrypt three elliptic curve ciphertexts to getID,H(ID) andσ_P(ID). Then,2.) to parse its databaseDB_M for clone detection. Finally, if no cloning is detected,3.) managerM is required to check for each valid path Pvalidi in the supply chain whether the equation H(ID)^Kⁱ = H(ID)^φ(P^validⁱ⁾ = σP(ID) holds or not, which results in performingO(ν) exponentiation inG.

However, we note that the path verification can be optimized to reach a constant time complexity O(1) by trading off computation load on the manager and the storage on tags.

The main idea is to store into tags the encryption of the tuple (ID, H(ID), H(ID)^φ(P^validⁱ⁾, g^φ(P^validⁱ⁾). Now, the verification key Kⁱ of the valid path Pvalidi in the supply chain is defined as Kⁱ = (φ(Pvalidi), g^φ(P^validⁱ⁾) ∈ F_q ×G. When a tag arrives at manager M, the latter decrypts the tag’s state and retrieves the tuple (ID, g^′, σP(ID),σ). Manager˜ M first

116

5.5 CHECKER: On-site Checking in Supply Chains checks for clones using ID. Then, he verifies whether g^′ = H(ID) and whether there is an entry in his set of verification keys that matches ˜σ. If so, manager M verifies the path that the tag took using the path encoding that corresponds to ˜σ. The manager thus verifies the paths of tags in constant time while tags are required to store an encryption of g^φ(P^validⁱ⁾ which counts for an additional 320 bits.

5.5 CHECKER: On-site Checking in Supply Chains

Although Tracker allows for efficient, secure and privacy preserving product tracking in the supply chain, it suffers from two major drawbacks. 1.) It requires a centralized,trusted party called“manager”to carry out the path verification; otherwise, the manager is able to inject fake products into the supply chain. 2.) The verification can only be performed once the tags arrive at the manager, but not before. This limits the wide deployment of such a solution, especially in a context where partners do not trust each other and demand to be able to verify product genuineness in real-time “on-site”.

Therefore, we propose in this section another solution for product tracking and hence genuineness verification calledChecker. Checkeraddresses the problem of on-site checking by enabling each reader R_k in the supply chain to verify the validity of the path taken by the tag, instead of a global path verification performed by a trusted party that only takes place at the end of the supply chain. Using the notations of Section 5.2, this corresponds to a tracking system, where each step in the supply chain is a checkpoint, and each reader in the supply chain is a verifier.

Accordingly inChecker, each tag stores an identifier ID along with the path signature of ID computed using the polynomial path encoding presented in Section 5.4.1. The main idea behindCheckeris to use a combination of polynomial path encoding and mechanisms of public key signatures to allow readers in the supply chain to verify the path that tags went through while preventing these same readers from injecting fake products. By verifying the signature in the tag, each reader thus validates the path taken that far, and by signing theID the reader updates the path encoding. To protect tag privacy against readers in the supply chain, we encrypt tag identifiers and the corresponding path signature using an IND-CCA (see Definition 2.17) encryption, namely elliptic curve Cramer-Shoup encryption (41).

5.5.1 Overview

In Checker, a tag T going through a valid path Pvalidi stores a randomly encrypted state S_T^j = (Enc(ID),Enc(σ_P_valid

i(ID))), such that ID is T’s identifier and σ_P_valid

i(ID) is the path signature defined as σ_P_valid

i(ID) =H(ID)^φ(P^validⁱ⁾.

At initialization, the issuerIwrites into a tagT an initial encrypted stateS_T⁰ = (Enc_pk₁(ID), Enc_pk₁(σv0(ID))), wherepk₁ is the public key of T’s next step in the supply chain.

5. RFID-BASED PRODUCT TRACKING IN SUPPLY CHAINS

Without loss of generality, we assume that whenever tag T visits a readerR_k, the latter

Dans le document Security and privacy in RFID systems (Page 131-0)