Thesis

Level of privacy (R)
1
0.9
0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
Simulation result
Formal result
0
0 50 100 150 200
Number of compromised members (c)
Level of privacy(R)
1
0.9
0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
2.8. Related work
Tree based authentication
Group based authentication
0
0 50 100 150 200
Number of compromised members (c)
Figure 2.8: On the left hand side: The analytical results obtained for the expected value of R
match the averaged results of ten simulations. The parameters are: N = 2 14 and γ = 64. On the
right hand side: Results of the simulation aiming at comparing the key-tree based scheme and
the group-based scheme. The curves show the level R of privacy as a function of the number c of
the compromised tags. The parameters are: N = 2 10 and γ = 64. The confidence intervals are
not shown, because they are in the range of 10 −3 , and therefore, they would be hardly visible. As
we can see, the group-based scheme achieves a higher level of privacy when c is below a threshold.
Above the threshold, the key-tree based approach is slightly better, however, in this region, both
schemes provide virtually no privacy.
no privacy. Thus, for any practical purposes, the group-based scheme is better than the key-tree
based scheme (even if optimal key-trees are used).
2.8 Related work
The problem of private authentication has been extensively studied in the literature recently, but
most of the proposed solutions are based on public key cryptography. One example is Idemix, which
is a practical anonymous credential system proposed by Camenisch and Lysyanskaya in [Camenisch
and Lysyanskaya, 2001]. Idemix allows for unlinkable demonstration of the possession of various
credentials, and it can be used in many applications. However, it is not applicable in resource
constraint scenarios, such as low-cost RFID systems. For such applications, solutions based on
symmetric key cryptography seem to be the only viable options. A comprehensive bibliography
of RFID related privacy problems is maintained by Avoine in [Avoine, 2012]. A recent survey of
RFID privacy approaches is published by Langheinrich [Langheinrich, 2009], where he overviews
60 papers in this field. Another important paper by Syamsuddin et al. survey the hash chain
based RFID authentication protocols in [Syamsuddin et al., 2008]. In the following I try to focus
on the methods similar to the ones described in this thesis, and encourage the reader to read the
aforementioned surveys for a broader view.
The key-tree based approach for symmetric key private authentication has been proposed by
Molnar and Wagner in [Molnar and Wagner, 2004]. However, they use a simple b-ary tree, which
means that the tree has the same branching factor at every level. Moreover, they do not analyze
the effects of compromised members on the level of privacy provided. They only mention that
compromise of a member has a wider effect than in the case of public key cryptography based
solutions.
An entropy based analysis of key trees can be found in [Nohara et al., 2005]. Nohara et al.
prove that their K-steps ID matching scheme (which is very similar to [Molnar and Wagner, 2004])
is secure against one compromised tag, if the number of nodes are large enough. They consider
only b-ary trees, no variable branching factors.
27