4.8 Peculiarities of the Introduction …
379
the EPC standard has a pseudo-random number generator (PRNG). This pseudorandom number generator can easily be used by an attacker in the Trojan-triggering
mechanism by adding an element of randomness, so the HT activation will be more
complicated because, although the rare sequence is repeated X times, the counter
only increases the number of times that the time slot (slot) is correct.
Figure 4.48b shows a possible algorithm for implementing such a rare sequence.
This kind of triggering organization can be very difficult for testers to activate,
but, on the other hand, such a Trojan requires additional space for implementation,
as will be shown below.
C. Modifying Frame Content
This triggering organization scheme is based on the modification of the low-level
information present in the data frame. In other words, it suggests changing the frames
sent by a reader to a tag. While line monitoring checks the sequence of commands
exchanged in a system, testing at the level of individual bits is more optional, since
bit errors can be caused by measuring interference.
A typical frame for EPC C1G2 consists of the OpCode command, a set of parameters and integrity control (i.e., based on cyclic redundancy code CRC [231, 232]). A
change in frame content causes a change in individual bits in these fields of the frame.
We can change, respectively, OpCode (the first bits in the frame), or the parameters
(in the middle of the frame) without changing the CRC (the last bits in the frame),
or do the opposite, modifying the CRC without changing the remaining part of the
frame. As a result, the CRC will not be correct and the frame will be deleted when
the tag checks it.
(1) Triggering based on changing parameters
As described above, the CRC is calculated using OpCode and parameters. The
method for the invisible triggering of a Trojan can destroy the parameters so that:
(1) when the tag calculates the CRC, it does not correspond to the code sent by the
reader, then the command is ignored;
(2) the result of the CRC calculated by the tag corresponds to the gold value stored
in the tag that triggers the Trojan.
Such a triggering requires a small change in the tag design and adds very few components. Moreover, such a triggering is very difficult to detect by monitoring the line,
since this may be due to a malfunction of bits in the communication system itself.
Therefore, this may be a good opportunity. In this case, the triggering will be added
to the command decoder, where the results of the CRC5/16 are compared with the
expected value.
(2) CRC modification
This approach is very similar to the one described above. In this case, the element
that is being modified is the CRC, it is there instead of the command data.
379
the EPC standard has a pseudo-random number generator (PRNG). This pseudorandom number generator can easily be used by an attacker in the Trojan-triggering
mechanism by adding an element of randomness, so the HT activation will be more
complicated because, although the rare sequence is repeated X times, the counter
only increases the number of times that the time slot (slot) is correct.
Figure 4.48b shows a possible algorithm for implementing such a rare sequence.
This kind of triggering organization can be very difficult for testers to activate,
but, on the other hand, such a Trojan requires additional space for implementation,
as will be shown below.
C. Modifying Frame Content
This triggering organization scheme is based on the modification of the low-level
information present in the data frame. In other words, it suggests changing the frames
sent by a reader to a tag. While line monitoring checks the sequence of commands
exchanged in a system, testing at the level of individual bits is more optional, since
bit errors can be caused by measuring interference.
A typical frame for EPC C1G2 consists of the OpCode command, a set of parameters and integrity control (i.e., based on cyclic redundancy code CRC [231, 232]). A
change in frame content causes a change in individual bits in these fields of the frame.
We can change, respectively, OpCode (the first bits in the frame), or the parameters
(in the middle of the frame) without changing the CRC (the last bits in the frame),
or do the opposite, modifying the CRC without changing the remaining part of the
frame. As a result, the CRC will not be correct and the frame will be deleted when
the tag checks it.
(1) Triggering based on changing parameters
As described above, the CRC is calculated using OpCode and parameters. The
method for the invisible triggering of a Trojan can destroy the parameters so that:
(1) when the tag calculates the CRC, it does not correspond to the code sent by the
reader, then the command is ignored;
(2) the result of the CRC calculated by the tag corresponds to the gold value stored
in the tag that triggers the Trojan.
Such a triggering requires a small change in the tag design and adds very few components. Moreover, such a triggering is very difficult to detect by monitoring the line,
since this may be due to a malfunction of bits in the communication system itself.
Therefore, this may be a good opportunity. In this case, the triggering will be added
to the command decoder, where the results of the CRC5/16 are compared with the
expected value.
(2) CRC modification
This approach is very similar to the one described above. In this case, the element
that is being modified is the CRC, it is there instead of the command data.