Method and Apparatus for Providing Security in a Radio Frequency Identification System

• US 20090028333A1
• Filed: 12/31/2007
• Published: 01/29/2009
• Est. Priority Date: 07/23/2007
• Status: Active Grant

• Current Assignee: Savi Technology Incorporated
• Original Assignee: Savi Technology Incorporated
• Inventors: Cargonja, Nikola, Zhu, Liping Julia, Stough, Stephen Alan, Shiledar, Devendra, Evans, Allan M., Balabine, Igor V.
• Granted Patent: US 8,116,454 B2
• Time in Patent Office: Days
• US Class Current: 380/258
• CPC Class Codes: G06K 19/0723 the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

One aspect involves receiving by a tag of wireless communications that utilize a first security provision, and wireless communications that utilize a second security provision different from the first security provision. A different aspect involves receiving by an entity of an authentication request that is based on a first digital certificate unknown to the entity, and determining by the entity, without external authentication of the first digital certificate, whether the first digital certificate is in a trust relationship with a second digital certificate that is different from the first digital certificate and that is known to the entity.

Claims

1. An apparatus comprising a tag that can receive wireless communications utilizing a first security provision, and that can also receive wireless communications utilizing a second security provision different from said first security provision.

2. An apparatus according to claim 1,

wherein wireless communications utilizing said first security provision enjoy a first level of secure access to said tag;

and

wherein wireless communications utilizing said second security provision enjoy a second level of secure access to said tag, said second level of secure access being different from said first level of secure access.

3. An apparatus according to claim 1, wherein said first security provision includes use of a first encryption key, and said second security provision includes use of a second encryption key different from said first encryption key.

4. An apparatus according to claim 1, wherein said wireless communications all conform to a predetermined communications protocol.

5. An apparatus according to claim 4, wherein said communications protocol is ISO 18000-7.

6. A method comprising:

receiving by an entity of an authentication request that is based on a first digital certificate unknown to said entity; and

determining by said entity, without external authentication of said first digital certificate, whether said first digital certificate is in a trust relationship with a second digital certificate that is different from said first digital certificate and that is known to said entity.

7. A method according to claim 6, wherein a source of said authentication request is a further entity, and including before said receiving:

generating by said further entity of a transient keyset that includes said public key and a corresponding private key;

generating by said further entity of a random number; and

transmitting by said further entity of said authentication request, where said authentication request includes said first digital certificate, said public key, said random number, source information that includes a unique identification of said further entity, and a list identifying at least one authentication technique.

8. A method according to claim 6, wherein said authentication request includes said first digital certificate, a public key, a first random number, source information that includes a unique identification of a source of said authentication request, and an identification of at least one authentication technique, and including:

selecting by said entity of an authentication technique identified in said authentication request;

generating by said entity of a second random number;

encrypting by said entity, using said public key, of said second random number and an authentication identification identifying said selected authentication technique; and

transmitting by said entity to the source of said authentication request a communication that includes said encrypted second random number, said encrypted authentication identification, and entity information that includes a unique identification of said entity.

9. A method according to claim 8,

including configuring said authentication request to include an identification of at least one encryption technique;

including selecting by said entity of an encryption technique identified in said authentication request;

wherein said encrypting by said entity includes encrypting an encryption identification identifying said selected encryption technique; and

wherein said transmitting includes transmitting said encrypted encryption identification in said communication.

10. A method according to claim 8, wherein the source is a further entity, and including after said transmitting:

receiving by said further entity of said communication;

decrypting by said further entity, using a private key corresponding to said public key, of said encrypted second random number and authentication identification;

computing by said further entity, according to said selected authentication technique, of an authentication value;

generating by said further entity of a third random number;

signing by said further entity, using said private key, of information that includes said authentication value and said third random number; and

transmitting by said further entity of said information signed by said private key.

11. A method according to claim 8, including after said transmitting:

receiving by said entity of information signed with a private key corresponding to said public key, said information including a first authentication value computed according to said selected authentication technique, and a third random number;

verifying by said entity, using said public key, of the signature of said signed information;

computing by said entity of a second authentication value according to said selected authentication technique;

comparing by said entity of said first and second authentication values to verify they are the same;

deriving by said entity, using a selected technique, of a cryptographic keyset as a function of said source information, said entity information, and said first, second and third random numbers; and

transmitting by said entity of a selected communication to the source.

12. A method according to claim 11, wherein the source is a further entity, and including after said transmitting of said selected communication:

receiving by said further entity of said selected communication; and

deriving by said further entity, using said selected technique, of said cryptographic keyset as a function of said source information, said entity information, and said first, second and third random numbers.

13. A method according to claim 6,

wherein said entity is a tag;

and

wherein said receiving includes receiving by said tag of a wireless communication that contains said authentication request.

14. A method according to claim 13, including transmitting said wireless communication from an interrogator that is separate from said tag.