  This work considers identity attack on a radio-frequency identification
(RFID)-based backscatter communication system. Specifically, we consider a
single-reader, single-tag RFID system whereby the reader and the tag undergo
two-way signaling which enables the reader to extract the tag ID in order to
authenticate the legitimate tag (L-tag). We then consider a scenario whereby a
malicious tag (M-tag)---having the same ID as the L-tag programmed in its
memory by a wizard---attempts to deceive the reader by pretending to be the
L-tag. To this end, we counter the identity attack by exploiting the
non-reciprocity of the end-to-end channel (i.e., the residual channel) between
the reader and the tag as the fingerprint of the tag. The passive nature of the
tag(s) (and thus, lack of any computational platform at the tag) implies that
the proposed light-weight physical-layer authentication method is implemented
at the reader. To be concrete, in our proposed scheme, the reader acquires the
raw data via two-way (challenge-response) message exchange mechanism, does
least-squares estimation to extract the fingerprint, and does binary hypothesis
testing to do authentication. We also provide closed-form expressions for the
two error probabilities of interest (i.e., false alarm and missed detection).
Simulation results attest to the efficacy of the proposed method.
