Advertisement

Quantifying Information Leakage in Tree-Based Hash Protocols (Short Paper)

  • Karsten Nohl
  • David Evans
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4307)

Abstract

Radio Frequency Identification (RFID) systems promise large scale, automated tracking solutions but also pose a threat to customer privacy. The tree-based hash protocol proposed by Molnar and Wagner presents a scalable, privacy-preserving solution. Previous analyses of this protocol concluded that an attacker who can extract secrets from a large number of tags can compromise privacy of other tags. We propose a new metric for information leakage in RFID protocols along with a threat model that more realistically captures the goals and capabilities of potential attackers. Using this metric, we measure the information leakage in the tree-based hash protocol and estimate an attacker’s probability of success in tracking targeted individuals, considering scenarios in which multiple information sources can be combined to track an individual. We conclude that an attacker has a reasonable chance of tracking tags when the tree-based hash protocol is used.

Keywords

Information Leakage Attack Model Threat Model Strong Privacy Legitimate Reader 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Avoine, G., Dysli, E., Oechslin, P.: Reducing time complexity in RFID systems. In: Preneel, B., Tavares, S. (eds.) SAC 2005. LNCS, vol. 3897, pp. 291–306. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  2. 2.
    Buttyán, L., Holczer, T., Vajda, I.: Optimal key-trees for tree-based private authentication. In: Danezis, G., Golle, P. (eds.) PET 2006. LNCS, vol. 4258, pp. 332–350. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  3. 3.
    Díaz, C., Seys, S., Claessens, J., Preneel, B.: Towards measuring anonymity. In: Dingledine, R., Syverson, P.F. (eds.) PET 2002. LNCS, vol. 2482, pp. 54–68. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  4. 4.
    Juels, A., Weis, S.: Defining strong privacy for RFID (2006)Google Scholar
  5. 5.
    Molnar, D., Wagner, D.: Privacy and security in library RFID: Issues, practices, and architectures. In: Conference on Computer and Communications Security – ACM CCS (2004)Google Scholar
  6. 6.
    Nohara, Y., Inoue, S., Baba, K., Yasuura, H.: Quantitative evaluation of unlinkable id matching schemes. In: Workshop on Privacy in the Electronic Society – WPES (2006)Google Scholar
  7. 7.
    Nohl, K., Evans, D.: Quantifying information leakage in tree-based hash protocols. Technical Report CS-2006-20, University of Virginia, Computer Science Department (October 2006)Google Scholar
  8. 8.
    Ohkubo, M., Suzuki, K., Kinoshita, S.: Cryptographic approach to “privacy-friendly” tags. In: RFID Privacy Workshop (2003)Google Scholar
  9. 9.
    Poovendran, R., Baras, J.S.: An information-theoretic approach for design and analysis of rooted-tree-based multicast key management schemes. IEEE Transactions on Information Theory (2001)Google Scholar
  10. 10.
    Serjantov, A., Danezis, G.: Towards an information theoretic metric for anonymity. In: Dingledine, R., Syverson, P.F. (eds.) PET 2002. LNCS, vol. 2482, pp. 41–53. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  11. 11.
    Shannon, C.E.: A mathematical theory of communication (1948)Google Scholar
  12. 12.
    Tsudik, G.: YA-TRAP: Yet another trivial RFID authentication protocol. In: PerCom (2006)Google Scholar
  13. 13.
    Weis, S., Sarma, S., Rivest, R., Engels, D.: Security and privacy aspects of low-cost radio frequency identification systems. In: International Conference on Security in Pervasive Computing – SPC (2003)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Karsten Nohl
    • 1
  • David Evans
    • 1
  1. 1.Computer Science DepartmentUniversity of Virginia 

Personalised recommendations