臺灣博碩士論文加值系統

在本篇論文中，我們提出了包含兩種基於無線射頻技術(RFID)應用下，一套關於RFID驗證協定之安全設計與一套以RFID系統為驗證基礎之影音光碟線上租賃系統。有關我們的第一個設計，改良了Wang等學者在2007年發表的RFID驗證協定，因其協定中有洩漏訊息隱私與設計上不合理的問題，我們對此提出質疑並設計解決方法，以相同條件的限制下，達到真正保障隱私之RFID驗證協定; 而我們的第二個設計，整體環境架構是啟發於Lan等學者在2006年發表的結合RFID系統之應用於保護影音光碟的數位產權管理系統，由於他們系統中存在著一些不合理的設計，將導致其系統的不實用與不安全，因此我們利用了RFID授權驗證的這種概念，提出了一套全新的線上影音光碟租賃系統，不但排除他們設計中所存在的問題，並能更安全且合適地在影音光碟租賃環境下應用，進而達成租賃業者與消費者雙贏的目標。

In this paper, we propose two kinds of designs based on the RFID system, including an improved secure RFID authentication protocol and a novel RFID-based DRM system for disc renting.
Our first protocol is designed to refine and improve the RFID authentication protocol proposed by Wang et al. in 2007. Our protocol not only keeps the advantage of high authentication efficiency, but also improves the drawbacks in their design. Our proposal contributes a practical and more secure design in current RFID infrastructures.
The other protocol is a new design for disc renting inspired by the RFID-based DRM system proposed by Lan et al. in 2006. With the RFID system, their design can verify the genuineness of discs and restrict the playing limit in order to prevent illegally disc playing and copy. However, there exists some problems in their design. Under the consideration of disc renting with more business opportunities, we propose a novel online disc renting system. Our system is not only a reasonable DRM mechanism but also has the features of security and convenience. And it will be a win-win design for the rental business and the consumers.

致謝......................................................i
中文摘要.................................................ii
英文摘要................................................iii
目錄.....................................................iv
表目次..................................................vii
圖目次..................................................vii
第一章 緒論...............................................1
1.1 研究背景與動機........................................1
1.1.1 無線射頻辨識系統(RFID)的介紹....................1
1.1.1.1 RFID基本元件...............................1
1.1.1.2 RFID的特性與優點...........................3
1.1.1.3 RFID的安全議題.............................3
1.2 研究目的............................................6
1.3 本文架構............................................7
第二章 無線射頻辨識系統驗證機制之研究.....................8
2.1 驗證協定中常用的安全機制介紹........................8
2.1.1 雜湊函式與其應用....................................8
2.1.2 挑戰與回應驗證機制.................................11
2.2 以樹狀結構指派RFID標籤金鑰的相關研究...............12
2.2.1 應用動機.......................................12
2.2.2 Lu等人的SPA協定...............................13
2.2.3 Wang等人的SAPA協定............................15
第三章 改良SAPA之RFID驗證協定............................18
3.1 協定架構...........................................18
3.1.1 參與角色與階段淺介.............................18
3.1.2 符號列表.......................................18
3.2 本協定之介紹.......................................19
3.2.1 核發RFID標籤階段...............................19
3.2.2 驗證RFID標籤階段...............................20
3.3 安全需求分析.......................................22
3.3.1 保障隱私.......................................23
3.3.2 不可追蹤.......................................23
3.3.3 竊聽無效.......................................23
3.3.4 防止重送攻擊...................................24
3.3.5 偽造無效.......................................24
3.4 本協定與SPA、SAPA協定之比較........................24
3.5 本協定之總結.......................................26
第四章 無線射頻辨識系統授權驗證應用之研究................27
4.1 RFID授權驗證的特性與優缺點..........................27
4.1.1 RFID授權驗證的特性..............................27
4.1.2 RFID授權驗證的優缺點............................28
4.2 RFID授權驗證之相關研究..............................30
4.2.1 Tan等學者的協定...............................30
4.2.2 Fouladgar等學者的協定.........................32
4.3 RFID授權驗證設計之可行議題.........................35
4.3.1 Lan等學者的研究...............................35
4.3.1.1 CSS光碟防拷技術...........................35
4.3.1.2 Lan等學者的協定...........................36
4.3.1.3 Lan等學者的協定分析.......................39
4.3.2 線上影音光碟租賃更進一步發展的可能性...........40
第五章 結合RFID之線上影音光碟租賃系統....................42
5.1 系統架構...........................................42
5.1.1 參與角色.......................................42
5.1.2 符號列表.......................................42
5.2 本系統之介紹.......................................43
5.2.1 線上租賃交易階段...............................43
5.2.2 驗證與播放影音光碟階段.........................44
5.2.3 影音光碟多次傳租階段...........................48
5.3 設計分析...........................................49
5.3.1 導入RFID奠定可判斷影音光碟與執照真偽之基礎.....49
5.3.2 執照的安全性...................................49
5.3.3 影音播放設備與影音光碟的相互驗證...............50
5.3.4 達成限制播放設備與次數的DRM運作模式............51
5.3.5 驗證執照的有效性...............................51
5.3.6 影音光碟多次傳租模式之特色與其安全分析.........52
5.4 本系統之總結.......................................53
第六章 研究貢獻與未來工作................................54
6.1 改良SAPA之RFID驗證協定的研究貢獻...................54
6.2 結合RFID之線上影音光碟租賃系統的研究貢獻...........54
6.3 未來工作...........................................55
參考文獻.................................................56
投稿論文列表.............................................61

[1] 鄭同伯, “RFID EPC 無線射頻辨識完全剖析,” 書號. NE20219. 2004年出版
[2] 顏憶茹、張淳智, “物流管理 原理、方法與實例,” (Logistics Management Theory, Methods and Cases) 前程文化出版
[3] “線上DVD出租-經營典範Netflix之發展背景及服務模式,” 資策會MIC, 2007.4 [4] “線上DVD出租-經營典範Netflix之成功關鍵因素及未來面臨之挑戰,” 資策會MIC, 2007.5. http://trade.1111.com.tw/pg804.asp?eid=fjtmcgyHQvlO
[5] Intelligent Times (2006), “未來商店(書摘) ,” http://140.92.88.29/magazine/article_single_207.htm
[6] 費伊 (2007), “美國應用RFID技術管理CD/DVD自助租賃,” 《RFID世界網》http://www.1000security.com/html/2007-04/26903.html
[7] 經濟部RFID應用推動辦公室(2007), “RFID讓店家善用DVD架面陳列,” http://www.rfid.org.tw/content.php?sn=155
[8] 賽迪網(2007), “RFID技術新用途:防止DVD光碟被盜,” http://news.ccidnet.com/art/1032/20070513/1079653_1.html
[9] Alfred J. Menezes, Paul C. van Oorshot, and Scott A. Vanstone. Handbook of Applied Cryptography, chapter 1.9. CRC Press, 1996.
[10] Jim Taylor, DVD Demystified, McGraw-Hill Professional, 2nd Edition, New York, 2001.
[11] D. Molnar and D. Wagner, “Privacy and Security in Library RFID: Issues, Practices, and Architectures,” in Proceedings of ACM CCS, 2004.
[12] T. Dimitriou, “A Lightweight RFID Protocol to protect against Traceability and Cloning attacks,” Proceedings of the IEEE International Conference on Security and Privacy for Emerging Areas in Communication Networks – SECURECOMM, 2005.
[13] D. N. Duc, J. Park, H. Lee and K. Kim, “Enhancing Security of EPCglobal Gen-2 RFID Tag against Traceability and Cloning,” The 2006 Symposium on Cryptography and Information Security, 2006
[14] Sepideh Fouladgar and Hossam Afifi, “A Simple Delegation Scheme for RFID Systems (SiDeS),” IEEE International Conference on, 26-28 March 2007. [15] S. L. Garfinkel, A. Juels, R. Pappu, “RFID privacy : an overview of problems and proposed solutions,” IEEE Security & Privacy, Vol. 3, No. 3, pp. 34-43, 2005.
[16] A. Juels, R. L. Rivest, M. Szydlo, “The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy,” Proceedings of the 10th ACM conference on Computer and communications security, pp. 103-111, 2003.
[17] H. Knospe and H. Pohl, “RFID Security,” Information Security Technical Report, Vol.9, No.4, pp.39-50, Dec. 2004.
[18] D. Molnar, A. Soppera, and D. Wagner, “A Scalable, Delegatable Pseudonym Protocol Enabling Owner-ship Transfer of RFID Tags,” in Proceedings of SAC, 2005.
[19] Stephen A. Weis, Sanjay E. Sarma, Ronald L. Rivest, and Daniel W. Engels, “Security and Privacy Aspects of Low-Cost Radio Frequency Identification Systems,” First International Conference on Security in Pervasive Computing, 2003.
[20] T. Dimitriou, “A Secure and Efficient RFID Protocol that Could make Big Brother (partially) Obsolete,” in Proceedings of IEEE PerCom, 2006.
[21] L. Lu, J. Han, L. Hu, Y. Liu, L. M. Ni, “Dynamic Key-Updating: Privacy-Preserving Authentication for RFID Systems,” in Proceedings of IEEE PerCom, 2007.
[22] C. Turcu, R. Prodan, M. Cerlinca, T. Cerlinca, C. Turcu, “Information Storage on RFID Tags: Some Structural Optimizing Solutions,” RFID Eurasia, 2007 1st Annual.
[23] W. Wang, Y. Li, L. Hu, L. Lu, “Storage-Awareness: RFID Private Authentication based on Sparse Tree,” in Proceedings of IEEE PerCom, 2007.
[24] Jeffrey A. Bloom, etc., “Copy Protection for DVD Video,” Consumer Proceedings of IEEE, vol. 87, no. 7, pp. 1267-1276, July 1999.
[25] Xien-Chen Xie, “The Study and Application of Computer Software Protection,” Electronic Theses and Dissertations System, July 2002.
[26] Bo Lan and Tzekian Tan, “A DRM System Implementing RFID to Protect AV Content,” Consumer Electronics, 2006. ISCE ''06. 2006 IEEE Tenth International Symposium on.
[27] Chiu C. Tan, Bo Sheng, and Qun Li, “Secure and Serverless RFID Authentication and Search Protocols,” Wireless Communications, IEEE Transactions on, April 2008.
[28] Hong Lei and Tianjie Cao, “RFID Protocol enabling Ownership Transfer to protect against Traceability and DoS attacks,” The First International Symposium on Data, Privacy, and E-Commerce (ISDPE), 1-3 Nov. 2007, pp.508-510.
[29] M.J.B Robshaw, “An overview of RFID tags and new cryptographic developments,” information security technical report II, 2006, pp.82–88.
[30] I. J. Kim, E. Y. Choi, D. H. Lee, “Secure Mobile RFID system against privacy and security problems,” Third International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing, 2007, pp.67-72.
[31] C.M. Roberts, “Radio frequency identification (RFID),” Computers & Security on Volume 25, Issue 1, February 2006, Pages 18-26.
[32] R. Angeles, “RFID Technology: supply-chain applications and implementations issues,” Information Systems Management, Vol.22, No.1, 2005, pp. 51-65.
[33] S. H. Choi and C. H. Poon, “An RFID-based Anti-counterfeiting System,” LAENG International Journal of Computer Science, 35:1.
[34] C. Chatmom, T. V. Le and M. Burmester, “Secure Anonymous RFID Authentication Protocols,” Technical Report TR-060112, Florida State University, Department of Computer Science, Tallahassee, Florida, USA 2006.
[35] W. H. Chen, S. W. Wang, C. S. Ong, Li. Liu, and Y. W. Chuang, “RFID Application in Hospitals: A case Study on a Demonstration RFID Project in a Taiwan Hospital,” Proceedings of the 30th Annual Hawaii International Conference, Vol. 8, pp. 184, 2006.
[36] S. Dominikus, E. Oswald and M. Feldhofer, “Symmetric Authentication for RFID systems in practice,” ECRYPT Workshop on RFID and Lightweight Crypto, Graz, Austria, July 2005.
[37] Batbold Toiruul, KyungOh Lee, “An Advanced Mutual-Authentication Algorithm Using AES for RFID Systems,” IJCSNS International Journal of Computer Science and Network Security, VOL.6 No.9B, September 2006
[38] Sanjay E. Sarma, Stephen A. Weis, and Daniel W. Engels, “RFID Systems and Security and Privacy Implications,” in Workshop on Cryptographic Hardware and Embedded Systems, pages 454–470. Lecture Notes in Computer Science, 2002.
[39] M. Ookuhbo, K. Suzuki, S. Kinoshita, “Cryptographic Approach to a Privacy Friendly Tag,” RFID Privacy WorkshopIT, NOV., 2003.
[40] D. Henrici and P. Müller, “Hash-based Enhancement of Location Privacy for Radio-Frequency Identification Devices using Varying Identifiers,” Proceedings 2nd of the IEEE Annul Conference on Pervasive Computing and Communications Workshops (PERCOMW’04), 2004.
[41] H.W. Kim, S.Y. Lim, H.J. Lee, “Symmetric Encryption in RFID Authentication Protocol for Strong Location Privacy and Forward-Security,” Hybrid Information Technology, 2006. ICHIT''06. Vol. 2. International Conference on Volume 2, pp. 718-723, 2006.
[42] J. Ma, A. Nakamura and R. Huang, “A Random ID Update Scheme to Protect Location Privacy in RFID-based Student Administration Systems,” Database and Expert Systems Applications, Aug. 2005, pp. 22-26.
[43] Online Segment Driving Worldwide Movie Rental Market, 2008.11
http://www.giichinese.com.tw/chinese/koan78397-movie-rental.html
[44] NETFLIX, © 1997-2009 Netflix, Inc. http://www.netflix.com/
[45] iVideo, Copyright© 1999 WaveThink Technology Inc. http://www.ivideo.com.tw/
[46] Motion Picture Association of America(MPAA) http://www.mpaa.org/
[47] EPCglobal http://www.epcglobalinc.org/home