Once the setup phase is complete, the connection to the verifier is not needed anymore.
The reader can function independently since it is equipped with all the necessary in-formation to gather grouping proofs whenever required. This makes the verifier totally
4.2. THE PROPOSED PROTOCOL 65
Table 4.3: Sample Dataset Stored in a Reader
GID T Sr T Sv V 11..m V 2 μ1..m RTs1..m RTsn
1..m
Gid1 T Sr1 T Sv1 .. .. .. .. ..
Gid1 T Sr2 T Sv2 .. .. .. .. ..
Gid1 T Sr3 T Sv3 .. .. .. .. ..
.. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. ..
Gid1 T Srn T Svn .. .. .. .. ..
Gid2 T Sr1 T Sv1 .. .. .. .. ..
Gid2 T Sr2 T Sv2 .. .. .. .. ..
.. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. ..
Gidp T Sr1 T Sv1 .. .. .. .. ..
Gidp T Sr2 T Sv2 .. .. .. .. ..
.. .. .. .. .. .. .. ..
offline. As noted earlier, the collection phase has two parts. The details are presented below.
PART 1: Here, the reader collects partial-proofs from each tag for all m tags and is composed of 4 steps. Steps 1 and 2 are depicted in Figure 4.2, and Steps 3 and 4 are depicted in Figure 4.3.
Step 1: Reader computes its challenge, gets the current timestamp from T T S, and sends it along with the pre-computed server challenge to tag 1. This step is described below.
• Reader generates a fresh pseudo-random number Rr and computes δ1 = P RN G(
Rid⊕ RTs)⊕ Rr, δ2 = P RN G(Rid⊕ RTsn)⊕ Rr.
• The pre-computed verifier messages V 11, V 2, μ1, T Sv are randomized using Rr. As seen in the initialization phase, these messages are sufficiently randomized by the verifier and they would be significantly different for each tag and for each run.
But, if a protocol run was interrupted for some reason and the reader had to rerun it, it will use these same pre-computed messages for that run. But, as they are randomized again using the freshly generated Rr, an attacker won’t be able to distinguish the messages, even if they were sent again for the same run.
• The reader then requests a timestamp from the T T S. The T T S gets the current timestamp CT S, encrypts it using the secret key ktv as T Sc= Ektv(CT S). It then sends T Sc to the reader. As soon as T T S sends the first timestamp, it marks the beginning of the protocol run.
• The reader then computes R1 = Rid⊕ P RNG(T Sv⊕ T Sc⊕ Rr)
• It sends V 11, V 2, μ1, R1, δ1, δ2, T Sv and T Sc to tag 1.
Step 2: Tag 1 validates the incoming messages, authenticates the reader, computes its partial-proof and sends it back to the reader. This step is described below.
Reader Step 1 Generate Rr for Tag 1; Using RTs, RTsn of Tag 1 Compute:
δ1 = P RN G(Rid⊕ RTs)⊕ Rr; δ2 = P RN G(Rid⊕ RTsn)⊕ Rr; V 11 = V 11⊕ Rr; V 2 = V 2⊕ Rr;
μ1= μ1⊕ Rr; T Sv = T Sv⊕ Rr;
Get T Sc from TTS (Marks the beginning of the protocol run) R1 = Rid⊕ P RNG(T Sv⊕ T Sc⊕ Rr)
Send V 11, V 2, μ1, R1, δ1, δ2, T Sv, T Sc to Tag 1
Tag 1 Step 2
Extract: P RN G(Rid⊕ RTs)⊕ δ1 → Rr
If (Rid= R1⊕ P RNG(T Sv⊕ T Sc⊕ Rr)) Reader Authenticated
Message Integrity of R1, δ1, T Sv and T Sc Verified else
Use δ2 to extract Rr and try again. If unsuccessful, abort.
If Rr= R−1r then abort; else Rr−1← Rr
Extract: V 11⊕ Rr→ V 11; V 2⊕ Rr→ V 2;
Extract: μ1⊕ Rr→ μ1; T Sv⊕ Rr→ T Sv
Extract: Tid⊕ V Ts⊕ μ1→ Vr
If (Gid = V 2⊕ P RNG(T Gs⊕ Vr) and Tid = V 11⊕ Ts⊕ P RNG(V Ts⊕ Vr))
Group ID and Tag ID Authenticated
Message Integrity of V 11, V 2 and μ1 Verified else
Use V Ts to extract Vr and try again. If unsuccessful, abort.
(Use V Ts or V Ts from here based on the match) Extract: P RN G(Tid⊕ V Ts)⊕ Vr⊕ T Sv → T Sr
Generate T 1r
M 1 = P RN G(Tid⊕ Ts⊕ V Ts⊕ RTs)⊕ P RNG(T Sr⊕ T Sc⊕ T 1r) β1 = T 1r⊕ P RNG(Tid⊕ V Ts⊕ RTs)
Y 1 = Gid⊕ P RNG(T Gs⊕ Vr)⊕ P RNG(RTs⊕ Rr) Rc= Rid⊕ P RNG(M1 ⊕ β1 ⊕ Y 1 ⊕ RTs⊕ Rr) If Tid matched using V Tsthen:
V Ts ← V Ts; V Ts← P RNG(V Ts);
If Rid matched using δ1 then RTs← P RNG(RTs) Send M 1, β1, Y 1, Rc to Reader
Figure 4.2: Proposed Offline Grouping Proof Protocol - Step 1 & Step 2
• Using stored {Rid, RTs}, Rris extracted from δ1 as P RN G(Rid⊕RTs)⊕δ1 → Rr.
• Then, using Rr and other stored/received values, the tag verifies if Rid = R1⊕ P RN G(T Sv⊕T Sc⊕Rr). If successful, it authenticates the reader and also confirms the message integrity of R1, δ1, T Sv, T Sc. Otherwise, the above two steps are repeated using δ2. If either one results in a successful match for Rid, the protocol proceeds, otherwise it aborts.
4.2. THE PROPOSED PROTOCOL 67
• The tag then checks if Rr = R−1r . If yes, it does not respond and the protocol aborts. This is to make sure that an attacker is not replaying the message from the previous run. This attack cannot be attempted using the messages from the runs before that, since the Rid is matched only using RTs or RTsn and everything else will fail. Messages from a genuine reader will always be fresh since Rr is freshly generated every time. If it is not a replayed message, the tag updates Rr−1 as R−1r ← Rr.
• The original pre-computed messages of the verifier are extracted by xor-ing Rr1
with V 11, V 2, μ1, T Sv.
• The tag then extracts Vr from μ1 as Tid⊕ V Ts⊕ μ1→ Vr.
• Now, the tag verifies if (Gid = V 2⊕ P RNG(T Gs⊕ Vr) and Tid = V 11 ⊕ Ts⊕ P RN G(V Ts⊕Vr)). If the verification fails, it uses V Ts and repeats the operation.
If either one results in a Gid, Tid match, it confirms that the messages are for this tag and also confirms the message integrity of V 11, V 2, μ1. Otherwise the protocol aborts. Depending on whether V Ts or V Ts resulted in a match, the tag will use that when it continues the operation.
• The tag then extracts the Timestamp T Sras P RN G(Tid⊕V Ts)⊕Vr⊕T Sv→ T Sr.
• It then generates a pseudo-random number T 1r and computes M 1, β1, Y 1, Rc as:
– M 1 = P RN G(Tid⊕ Ts⊕ V Ts⊕ RTs)⊕ P RNG(T Sr⊕ T Sc⊕ T 1r) – β1 = T 1r⊕ P RNG(Tid⊕ V Ts⊕ RTs)
– Y 1 = Gid⊕ P RNG(T Gs⊕ Vr)⊕ P RNG(RTs⊕ Rr) – Rc = Rid⊕ P RNG(M1 ⊕ β1 ⊕ Y 1 ⊕ RTs⊕ Rr)
• Finally, tag 1 updates V Ts ← V Ts and V Ts ← P RNG(V Ts). This is done only if Tid was matched using V Ts. If V Ts was used, this update is not performed. It also updates RTs as RTs ← P RNG(RTs) if Rid was matched using δ1.
• Finally, tag 1 sends M1, β1, Y 1 and Rc to the reader.
Step 3: Here, the reader validates the response from tag 1, computes the reader challenge, gets the current timestamp from T T S and sends them to tag 2 along with the pre-computed server challenge and the partial-proof from the first tag.
• Using the stored Rid, RTs and the received values, the reader verifies if Rid = Rc ⊕ P RNG(M1 ⊕ β1 ⊕ Y 1 ⊕ RTs⊕ Rr). If successful, it authenticates the tag and also confirms the integrity of the messages M 1, β1, Y 1. Otherwise, the above step is repeated using RTsn. If either one results in a successful match for Rid, the protocol proceeds, otherwise it aborts.
• Using RTs or RTsn, the reader extracts Y 1 as Y 1 = Y 1⊕ P RNG(RTs ⊕ Rr).
This ensures that the tag group information is kept intact. Tag 2 will use Y 1 to authenticate tag group and also to ensure that its predecessor is from the same group.
• The reader then updates RTs← RTsn and RTsn← P RNG(RTsn).
Reader Step 3 If Rid= Rc⊕ P RNG(M1 ⊕ β1 ⊕ Y 1 ⊕ RTs⊕ Rr)
Tag Authenticated
Message Integrity of M 1, β1, Y 1 and Rc Verified else
Use RTsn above and try again. If unsuccessful, abort.
Y 1 = Y 1⊕ P RNG(RTs⊕ Rr) (Or use RTsn, based on match) RTs← RTsn; RTsn← P RNG(RTsn);
Generate Rr for Tag 2; Using RTs, RTsn of Tag 2 Compute:
δ1 = P RN G(Rid⊕ RTs)⊕ Rr; δ2 = P RN G(Rid⊕ RTsn)⊕ Rr; V 12= V 12⊕ Rr; μ2= μ2⊕ Rr;
Get T Scfrom TTS
R1 = Rid⊕ P RNG(M1 ⊕ T Sc⊕ Rr)
Send V 12, μ2, M 1, Y 1, R1, δ1, δ2, T Scto Tag 2
Tag 2 Step 4
Extract: P RN G(Rid⊕ RTs)⊕ δ1 → Rr
If (Rid= R1⊕ P RNG(M1 ⊕ T Sc⊕ Rr)) Reader Authenticated
Message Integrity of M 1, R1, δ1 and T Sc Verified else
Use δ2 to extract Rr and try again. If unsuccessful, abort.
If Rr= Rr−1then abort; else R−1r ← Rr
Extract: V 12⊕ Rr → V 12; μ2⊕ Rr → μ2;
Extract Tid⊕ V Ts⊕ μ2→ Vr
If (Gid= Y 1⊕ P RNG(T Gs⊕ Vr) and Tid= V 12⊕ Ts⊕ P RNG(V Ts⊕ Vr))
Group ID and Tag ID Authenticated
Message Integrity of V 12, Y 1 and μ2Verified else
Use V Ts to extract Vr and try again. If unsuccessful, abort.
(Use V Ts or V Ts from here based on the match) Generate T 2r
M 2 = P RN G(Tid⊕ Ts⊕ V Ts⊕ RTs)⊕ P RNG(M1 ⊕ T Sc⊕ T 2r) β2 = T 2r⊕ P RNG(Tid⊕ V Ts⊕ RTs)
Y 2 = Gid⊕ P RNG(T Gs⊕ Vr)⊕ P RNG(RTs⊕ Rr) Rc= Rid⊕ P RNG(M2 ⊕ β2 ⊕ Y 2 ⊕ RTs⊕ Rr)
If Tid matched using V Ts then:
V Ts ← V Ts; V Ts← P RNG(V Ts);
If Rid matched using δ1 then RTs← P RNG(RTs) Send M 2, β2, Y 2, Rc to Reader
Figure 4.3: Proposed Offline Grouping Proof Protocol - Step 3 & Step 4
• For the next tag, the reader generates a fresh Rr. This is done for each tag to prevent tag impersonation attacks. Then, using RTs, RTsnof tag 2, the reader per-forms similar operations as in Step 1. Finally, it sends V 12, μ2, M 1, Y 1, R1, δ1, δ2 and T Sc to tag 2.
4.2. THE PROPOSED PROTOCOL 69
Step 4: Tag 2 validates the incoming messages, authenticates the reader, computes its partial-proof using the partial-proof from tag 1 and sends it back to the reader. As the operations are similar to tag 1, only the minor variations are pointed out below.
• Reader authentication and message integrity check is accomplished using M1 by verifying if Rid= R1⊕ P RNG(M1 ⊕ T Sc⊕ Rr).
• To verify group, tag 2 uses Y 1 instead of V 2, as in: if (Gid= Y 1⊕P RNG(T Gs⊕Vr) and Tid= V 12⊕ Ts⊕ P RNG(V Ts⊕ Vr)). This way, tag 2 ensures that the other participant belongs to the same group.
• After generating a pseudo-random number T 2r, it computes M 2 = P RN G(Tid⊕ Ts⊕ V Ts⊕ RTs)⊕ P RNG(M1 ⊕ T Sc⊕ T 2r). Note that M 2 uses M 1 of tag 1, thereby satisfying the dependency property.
• Tag 2 then updates V Ts, RTsusing the same principles described in Step 2. Finally, it sends M 2, β2, Y 2 and Rc to the reader.
The same procedure is repeated for the remaining tags, with the mth tag taking inputs V 1m, μm, M (m−1), Y (m−1), R1, δ, T Sc. After receiving the messages from the last tag Mm, βm, Ym and Rc, the reader gets the final timestamp T Sc from TTS which marks the end of the protocol run.
PART 2: The reader compiles all the partial-proofs to form the grouping proof and encrypts them. The proof is sent to the verifier either immediately or when more proofs have been generated at a later time.
• The reader compiles the proof P as P = {Gid, Rid, (M 1, β1, Rr, RTs, RTsn, T Sc, Rc), (M 2, β2, Rr, RTs, RTsn, T Sc, Rc), ...(Mm, βm, Rr, RTs, RTsn, T Sc, Rc).
• The proof P is then encrypted as Ekrv(P ) using the secret key krv that it shares with the verifier.