Method, transponder, and system for secure data exchange

• US 20080061941A1
• Filed: 06/25/2007
• Published: 03/13/2008
• Est. Priority Date: 06/23/2006
• Status: Active Grant

• Current Assignee: Atmel Corporation (Microchip Technology Incorporated)
• Original Assignee: Atmel Corporation (Microchip Technology Incorporated)
• Inventors: Friedrich, Ulrich, Fischer, Martin, Ziebertz, Dirk, Masuch, Jens, Pangels, Michael
• Granted Patent: US 8,138,889 B2
• Time in Patent Office: Days
• US Class Current: 340/10.1
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A method for data exchange is provided, whereby a first code is generated by a transponder, which is transmitted to a base station, a first transmission information is generated by the base station by encoding a base station code with a first identification and the first random number code, the first transmission information is transmitted to the transponder and the base station code is extracted by the transponder, a second code is generated by the transponder, which is transmitted to the base station upon an associated request from the base station, whereby before a transmission to the base station the second code is encoded with the extracted base station code, a second encoded transmission information comprising a second identification is generated by the base station with use of the second code and transmitted to the transponder, and at least one memory region of the transponder is released for read and/or write access after the second identification was verified as valid. The invention relates further to a transponder and to a system for secure data exchange.

Claims

1. A method for secure data exchange between a base station and a transponder that is a passive and/or backscatter-based transponder, whereby an access password of the transponder is subdivided into a first identification and a second identification, which are transmitted successively during transmission of the access password by the base station to the transponder, and the first identification and the second identification and/or a test value, assigned to the second identification, are stored in a nonvolatile memory of the transponder, the method comprising:

providing a first code by the transponder, which is transmitted to the base station upon an associated request from the base station;

generating a first encoded transmission information, which includes the first identification, by the base station based on the first code, and which is transmitted to the transponder;

providing a second code by the transponder, which is transmitted to the base station upon an associated request from the base station; and

generating a second encoded transmission information, which includes the second identification of the base station based on the second code and transmitted to the transponder;

wherein a base station code is generated by the base station,

wherein the first encoded transmission information is generated by the base station by encoding the base station code with the first identification and the first code,

wherein the base station code is extracted by the transponder with acceptance of a correct transmission of the first identification,

wherein the second code is encoded with the extracted base station code before transmission to the base station and transmitted encoded to the base station,

wherein the second identification is extracted by the transponder from the second encoded transmission information and verified, and

wherein at least one memory region of the transponder is released for read and/or write access or permanently blocked after the second identification is verified as valid.

2. The method according to claim 1, wherein a configuration bit in the transponder signals whether the second identification is stored in the transponder as a test value or as plain text.

3. The method according to claim 1, wherein the first code, the second code, and/or the base station code are generated by random numbers.

4. The method according to claim 1, wherein for coding, data are linked by a logical operation, particularly an XOR operation.

5. The method according to claim 1, wherein the base station code is used as a preload value for a random number series, and wherein the read and/or write access to the transponder is encoded by the random number series.

6. The method according to claim 5, wherein the random number series is generated by an LFSR process.

7. The method according to claim 1, wherein the base station is signaled by a signal in a header of a transmission message that the first identification is encoded with the base station code.

8. The method according to claim 7, wherein the base station is signaled by a set bit in a header of a transmission message that the first identification is encoded with the base station code.

9. The method according to claim 1, wherein a transmission of the first encoded transmission information is acknowledged by a handle.

10. The method according to claim 9, wherein after receipt of the handle the second code is requested with use of the handle.

11. A transponder for secure data exchange with a base station, particularly a passive and/or backscatter-based transponder, wherein a first identification and a second identification and/or a test value, assigned to the second identification, are stored in a nonvolatile memory of the transponder and a first and a second code can be provided by the transponder,

wherein a base station code is extracted by the transponder from a received first encoded transmission information with knowledge of the first identification and of the first code,

wherein the second code is encoded by the base station code for transmission by the transponder,

wherein the second identification is extracted via the second code from a received second encoded transmission information and verified, and

wherein at least one memory region of the transponder is released for read and/or write access or permanently blocked after the second identification is verified as valid.

12. The transponder according to claim 11, wherein a test value is generated by the transponder from the received second identification for comparison with the test value stored in the transponder.

13. The transponder according to claim 11, wherein a bit is from a header of a received signal, and extraction of the base station code is activated by an associated value of the bit.

14. A system for secure data exchange comprising:

a base station; and

a transponder,

wherein;

a first code is provided in the transponder, which is transmitted to the base station upon an associated request by the base station,

a base station code is generated by the base station,

a first encoded transmission information is generated by the base station from the first identification, the base station code, and the first code, and is transmitted to the transponder,

the base station code is extracted by the transponder via the first identification,

a second code is provided in the transponder that is encrypted with the base station code and is transmitted to the base station,

a second encoded transmission information is generated from the second identification and the second code by the base station and transmitted to the transponder,

the second identification is extracted by the transponder from the second encoded transmission information and verified, and

at least one memory region of the transponder is released for read and/or write access or permanently blocked after the second identification is verified as valid.