The protocol begins when the TTP receives the OT request from the current owner.
The Ownership Transfer phase has 2 steps. First step is between the TTP and the new owners and the second step is between the TTP and all the Tags in the Tag-Group.
Step 1: T T P → New Owners → T T P . Here, the new owners are given the Tag IDs and each owner’s respective new secret to the tags in the group.
Step 1A: T T P performs the following:
• T T P generates a pseudo-random number S2rand a new secret SOsnthat is shared between the T T P and the owners. Then, for each new owner i:
– T T P generates a new secret Nsi which the owner shares with all the tags in the tag-group. It then computes M 1i = Oidi ⊕ P RNG(SOs⊕ S2r), M 2i = S2r⊕ P RNG(Oidi⊕ SOs), M 3i = Nsi⊕ P RNG(Oidi⊕ SOs⊕ S2r), M 0i = SOsn⊕P RNG(M1i⊕Oidi⊕SOs). M 1i is used in M 0ito keep all the PRNG operations unique for each message.
– Then, for each Tag j in the Tag-Group, T T P computes M 4j = Tidj ⊕ P RN G(Nsi ⊕ SOs⊕ S2r) and Mjc = P RN G(M 0i⊕ SOs)⊕ P RNG(M3i⊕ SOs)⊕ P RNG(M4j⊕ S2r).
– T T P sends M 0i, M 1i, M 2i, M 3i, M 4(1..j) and M(1..j)c to each new owner i.
• T T P repeats the process for the next owner.
Step 1B: Each new owner i performs the following:
• Using the stored Oid, SOseach owner extracts S2ras: M 2i⊕P RNG(Oid⊕SOs)→ S2r and verifies if Oid= M 1i⊕ P RNG(SOs⊕ S2r).
• If the check fails, the owner uses the previous secret SOs in the above step. If either one of the secrets result in a match, then the T T P is authenticated and the owner knows that the message is for itself. This validation ensures that M 1i
and M 2i are not tampered by an adversary during transmission. Otherwise, the protocol aborts. For the reminder of the operations either SOs or SOs will be used based on which one returned a successful match.
6.2. THE PROPOSED PROTOCOL 103
• Then, using the stored SOs, extracted S2r and received values, for all j, the owners verify if P RN G(M 0i⊕SOs)⊕P RNG(M3i⊕SOs)⊕P RNG(M4j⊕S2r) =
(1..j) that it is authorized to access and its own secret as OTs = Nsi.
• Once that is accomplished, the owner generates pseudo-random number O1r, com-putes RN Do= O1r⊕ Oid⊕ SOs and ACKo = Oid⊕ OTs⊕ P RNG(SOs⊕ O1r).
The owner then sends RN Do, ACKo to the T T P .
• Finally, if Oid was matched using SOs then the owner updates the shared secret as SOs ← SOs and SOs← SOsn.
Step 1C: For each new owner’s reply, T T P performs the following: Using the stored Oidi and SOs, the T T P extracts O1r as RN Do⊕ Oidi ⊕ SOs → O1r. It then verifies if Oidi ⊕ Nsi = ACKo ⊕ P RNG(SOs ⊕ O1r). If it is successful, the new owner is authenticated and it also confirms that the new secret has been successfully updated for that new owner. If the T T P does not receive acknowledgements from all the new owners within a stipulated time, it will restart the process from Step 1A. Otherwise, it updates the shared secret SOs as SOs← SOsn and commences Step 2.
Trusted Third Party (TTP) New Owners
Step 1A Step 1B
Generate S2r M 2i⊕ P RNG(Oid⊕ SOs)→ S2r
Generate TTP To Owner-Group New Secret SOsn if Oid= M 1i⊕ P RNG(SOs⊕ S2r)
For each New Owner i TTP Authenticated; & Message is for this Owner;
Generate Owner To Tag-Group New Secret Nsi else
M 1i= Oidi⊕ P RNG(SOs⊕ S2r) Use SOsin the above steps and try again;
Figure 6.2: Proposed Multi Owner/Tag Ownership Transfer Protocol - Step 1 Step 2: T T P → Tag-Group → T T P . Here, the T T P sends the new owner IDs and their respective new secret, to the tags in the tag-group.
Step 2A: The T T P performs the following:
Trusted Third Party (TTP) Each Tag in Tag-Group
Step 2A Step 2B
Generate S1r M 8j⊕ P RNG(Tid⊕ STs)→ S1r
Generate TTP To Tag-Group New Secret STsn
For each New Owner i If Tid= M 7j⊕ P RNG(Tid⊕ STs⊕ S1r)
Next Tag Remove Previous Owners’ IDs & Secrets from Tag
Insert Oid(1..i), OTs= Ns(1..i), OTs= Ns(1..i)
Step 2C Generate T 1r
For each Tag’s Reply: RN Dt= T 1r⊕ Tid⊕ STs
RN Dt⊕ Tid⊕ STs→ T 1r ACKt= Tid⊕ (Oid||OTs)(1..i)⊕ P RNG(STs⊕ T 1r) if Tidj⊕ (Oid||Ns)(1..i)= ACKt⊕ P RNG(STs⊕ T 1r)
Tag Authenticated RN Dt, ACKt
New Owners & Secrets Successfully Inserted <− − − − −
If All ACK NOT Received then If Tidmatched using STs
Goto Step 2A STs← STs
else STs← STsn STs← STsn
Figure 6.3: Proposed Multi Owner/Tag Ownership Transfer Protocol - Step 2
• T T P generates a pseudo-random number S1r and a new secret STsn which the T T P shares with all the tags in the tag-group. Then for each new owner i:
• T T P computes M5i = Nsi ⊕ P RNG(STs ⊕ S1r), M 6i = Oidi ⊕ P RNG(Nsi ⊕
Step 2B: Each Tag in the Tag-Group performs the following:
• Using stored Tid, STs tag extracts S1r as M 8j ⊕ P RNG(Tid⊕ STs) → S1r and verifies if Tid= M 7j⊕ P RNG(Tid⊕ STs⊕ S1r).
• If the check fails, the tag uses the previous secret STs in the above step. If either one of the secrets result in a match, then the T T P is authenticated and the tag knows that the message is for itself. This validation ensures that M 7j and M 8j are not tampered by an adversary during transmission. Otherwise, the protocol aborts. For the reminder of the operations either STs or STs will be used based on which one returned a successful match.
• The tag then extracts STsn as M 9j⊕P RNG(M7j⊕Tid⊕STs)→ STsn. Then, for all i, using the stored STs, extracted S1r and received M 5i, M 6i, the tag verifies if P RN G(M 5i⊕ S1r⊕ STsn)⊕ P RNG(M6i⊕ STs) = Mic . This validation ensures that M 5i, M 6i and M 9j are not tampered by an adversary during transmission.
The tag then extracts the new owner IDs and their respective secrets as M 5i⊕
6.3. SECURITY ANALYSIS 105
P RN G(STs⊕ S1r) → Nsi and M 6i⊕ P RNG(Nsi⊕ STs⊕ S1r) → Oidi. If the check fails for any i, the protocol aborts.
• It then removes all the previous owner IDs that are stored and inserts the new owners Oid(1..i) and sets the current and previous shared secrets as OTs= Ns(1..i), OTs = Ns(1..i). One row for each owner i is inserted in the form{Oidi, OTsi, OTs
i}.
• Once that is accomplished, the tag generates a fresh pseudo-random number T 1r
and computes RN Dt = T 1r ⊕ Tid ⊕ STs and ACKt = Tid⊕ (Oid1||OTs1) ⊕ (Oid2||OTs2) ⊕... ⊕ (Oidi||OTsi) ⊕P RNG(STs⊕ T 1r). For ease of representation, this computation is shown in the Figure 6.3 as ACKt = Tid⊕ (Oid||OTs)(1..i)⊕ P RN G(STs⊕ T 1r). The tag then sends RN Dt, ACKt to the T T P
• Finally, if the Tid was matched using STs then the tag updates the shared secret as STs ← STs and STs← STsn.
Step 2C: For each Tag’s reply, the T T P performs the following: It extracts T 1r using stored Tid, STsas RN Dt⊕Tid⊕STs→ T 1rand verifies if Tidj⊕ (Oid1||Ns1)⊕(Oid2||Ns2)
⊕... ⊕ (Oidi||Nsi) = ACKt⊕ P RNG(STs⊕ T 1r). If it is successful, the tag is authen-ticated and it also confirms that the new owners and their respective secrets have been successfully inserted in that tag. For ease of representation, this computation is shown in the Figure 6.3 as if Tidj⊕ (Oid||Ns)(1..i)= ACKt⊕ P RNG(STs⊕ T 1r). If the T T P does not receive acknowledgements from all the tags in the Tag-Group within a stipu-lated time, it will restart the process from Step 2A. Otherwise, it updates the shared secret STs as STs ← STsn. As the last step in the process, the T T P sends a Owner-ship Transfer Confirmation message to the current owner and completes the OwnerOwner-ship Transfer process.