Radio-frequency identification(RFID) technology is widely applied in daily human life. The RFID cards are seen everywhere, from entrance guard to consumption. The information security of RFID cards, such as data confidentiality, tag anonymity, mutual authentication etc, has been fully studied. In the paper, using the RFID cards in MIFARE Classic and DESFire families, a bidirectional covert channel via multipurpose RFID cards between service providers is built to leak sensitive data between two simulation systems. Furthermore, by calculations and experiments, the daily channel capacity to leak data of the channel is obtained. Although the storage capacity of a single RFID card is very small, a large user base can still bring about a considerable amount to leak data. Then, the reasons for the existence of such channels are discussed. To eliminate this type of covert channels, a new authentication protocol between RFID cards and card readers are proposed. Our experimental results show a significant security improvement in prevention of such covert communications while keeping user convenience.
@cite_0: RFID-enabled credit cards are widely deployed in the United States and other countries, but no public study has thoroughly analyzed the mechanisms that provide both security and privacy. Using samples from a variety of RFID-enabled credit cards, our study observes that (1) the cardholder's name and often credit card number and expiration are leaked in plaintext to unauthenticated readers, (2) our homemade device costing around $150 effectively clones one type of skimmed cards thus providing a proof-of-concept implementation for the RF replay attack, (3) information revealed by the RFID transmission cross contaminates the security of RFID and non-RFID payment contexts, and (4) RFID-enabled credit cards are susceptible in various degrees to a range of other traditional RFID attacks such as skimming and relaying.
@cite_19: Side-channel attack is a known security risk to smart cards, and there have been efforts by smart card manufacturers to incorporate side-channel attack countermeasures. In this paper, we study a widely used smart card that uses the 3DES algorithm. First, a platform is setup to extract the power consumption information from the electromagnetic wave. Based on the findings from the initial analysis, we determine that the card is equipped with a “head and tail protection” mechanism. Second, a chosen-plaintext power analysis with a complexity of 216 is proposed, which is designed to recover the second round key from the power leakage in the third round. Then, a slicing-collision-algebraic attack is presented, which decreases the complexity to 26 rapidly. The experiments show that after collecting 20000 power traces (in approximately 200 s), only @math key guesses and another 177 searches (about 300 seconds) are sufficient in recovering the 56-bit source keys of DES successfully. In other words, we demonstrate how the security of the 3DES card can be easily compromised, using side-channel attacks. Finally, we recommend that the head and tail protection should extend to the first and last four rounds, at the minimal, in order to be side-channel attack resilience.
@cite_40: The Mifare Classic is the most widely used contactless smartcard on the market.The stream cipher CRYPTO1 used by the Classic has recently been reverse engineered and serious attacks have been proposed. The most serious of them retrieves a secret key in under a second. In order to clone a card, previously proposed attacks require that the adversary either has access to an eavesdropped communication session or executes a message-by-message man-in-the-middle attack between the victim and a legitimate reader. Although this is already disastrous from a cryptographic point of view, system integrators maintain that these attacks cannot be performed undetected.This paper proposes four attacks that can be executed by an adversary having only wireless access to just a card (and not to a legitimate reader). The most serious of them recovers a secret key in less than a second on ordinary hardware. Besides the cryptographic weaknesses, we exploit other weaknesses in the protocol stack. A vulnerability in the computation of parity bits allows an adversary to establish a side channel. Another vulnerability regarding nested authentications provides enough plaintext for a speedy known-plaintext attack.
@cite_24: RFID was considered as an advanced technology for automatic identification of objects. RFID makes usage of radio alerts to discover, tune, kind and stumble on an expansion of items. Security prerequisite is necessary in most of the applications. User’s Authentication at the end of the RFID technology creates one of the major attacks on the system. A crucial challenge in RFID technology research is to provide efficient protection for the systems against tag cloning and information modification. In this paper, we have proposed a system where the information has to be more secured than existing system. We have used an encrypt-decrypt tools which is used for encryption and decryption of the information by a decryption keywords. The encrypted information can be saved to the local database or online cloud storage. But the main advantage of our proposed system is that the whole operation has worked with windows OS. Besides we also analyze the runtime for our system for a particular data and get a relatively better consuming runtime. Safety requirement is critical this packages. Our framework can be used to minimize the unauthorized usage of RFID Card information and focus on the runtime.
@cite_5: This paper proposes a novel approach that applies neural network forecasting to security for closed-loop prepaid cards based on low-cost technologies such as RFID and 1-Wire. The security vulnerability of low-cost RFID closed-loop prepaid card systems originates mostly from the card itself. Criminal organizations counterfeit or clone card data. Although high-security prepaid cards exist, they are often too expensive for transport ticketing, and even their security is not guaranteed for a well-defined period of time. Therefore, data encryption systems are used widely against counterfeiting with success. However, it has not been possible to develop countermeasures with comparable success against cloning. Our proposed security application uses neural network forecasting to determine the recharge day behavioral characteristics of the cardholder and predict the next time the cardholder will recharge their card. Based on the prediction for the recharge time, the expiration date of the low-cost RFID prepaid card is defined, which is a good countermeasure against cloning. FTDNN, LRNN, and NARX network architectures with one hidden layer are considered in this research. The effects of the network architecture, the number of neurons, the training algorithm, and the prediction performance function on the recharge day forecast are investigated. Experimental results confirm the accuracy of the recharge time forecast and confirm countermeasures against cloning. Our proposed security approach with neural network forecasting is applied with success to the Turkish public transport without an online backend system.
In 2007, Heydt- @cite_0 found the vulnerabilities in the first-generation RFID-enabled credit cards. Garcia @cite_40 showed that MIFARE Classic, a widely used smart card, was vulnerable to reverse engineering and man-in-the-middle attack in 2009. D " u zenli @cite_5 proposed a novel approach that applies neural network forecasting to security for closed-loop prepaid cards based on low-cost technologies such as RFID and 1-Wire in 2015. In 2017, @cite_24 proposed a security solution of an RFID card through cryptography. @cite_19 proposed a side-channel attack on a protected RFID card in 2018.