Method and Apparatus for Providing Security in a Radio Frequency Identification System

• US 20090028337A1
• Filed: 12/31/2007
• Published: 01/29/2009
• Est. Priority Date: 07/23/2007
• Status: Abandoned Application

• Current Assignee: Savi Technology Incorporated
• Original Assignee: Savi Technology Incorporated
• Inventors: Cargonja, Nikola, Zhu, Liping Julia, Stough, Stephen Alan, Shiledar, Devendra, Evans, Allan M., Balabine, Igor V.
• Application Number:
  US11/968,002
• Publication Number:
  US 20090028337A1
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06K 19/0723 the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A method and apparatus involve storing in a tag a selected digital certificate that permits secure access to said tag from externally thereof.

Claims

1. An apparatus comprising:

a tag having a memory storing a selected digital certificate that permits secure access to said tag from externally thereof.

2. An apparatus according to claim 1,

wherein said memory of said tag stores a further digital certificate that is different from said selected digital certificate;

wherein said selected digital certificate permits a first range of secure access to said tag from externally thereof; and

wherein said second digital certificate permits a second range of secure access to said tag from externally thereof, said second range of secure access being different from said first range of secure access.

3. An apparatus according to claim 2, wherein said first and second ranges of secure access are mutually exclusive from a security perspective.

4. An apparatus according to claim 2,

wherein said selected digital certificate has associated therewith a first set of rules defining said first range of secure access;

and

wherein said further digital certificate has associated therewith a second set of rules defining said second range of secure access, said first set of rules being different from said second set of rules.

5. An apparatus according to claim 2, wherein said tag can receive wireless communications that utilize said first range of secure access, and can receive wireless communications that utilize said second range of secure access.

6. An apparatus according to claim 5, wherein said wireless communications all conform to a predetermined communications protocol.

7. An apparatus according to claim 6, wherein said communications protocol is ISO 18000-7.

8. An apparatus according to claim 2, wherein said first range of secure access includes use of a first key, and said second range of secure access involves use of a second key different from said first key.

9. An apparatus according to claim 2, wherein said first range of secure access includes use of a first set of keys, and said second range of secure access involves use of a second set of keys, said second set being different from said first set.

10. An apparatus according to claim 9,

wherein said keys of said first set include first and second key subsets that provide respective different levels of secure access to said tag;

and

wherein said keys of said second set include third and fourth key subsets that provide respective different levels of secure access to said tag.

11. An apparatus according to claim 1, including a part that is separate from and spaced from said tag, that has a memory storing a further digital certificate corresponding to said selected digital certificate, and that can exchange wireless communications with said tag to authenticate said further digital certificate to said selected digital certificate in order to establish secure communication between said part and said tag.

12. An apparatus according to claim 11,

wherein said part is a mobile device;

and

wherein said further digital certificate was installed into said memory of said part from a portable memory device having said further digital certificate stored therein.

13. An apparatus according to claim 12, wherein said portable memory device is a smartcard.

14. A method comprising:

storing in a tag a selected digital certificate that permits secure access to said tag from externally thereof.

15. A method according to claim 14, including responding to arrival of said tag at a site by establishing at least one cryptograpic key associated with said digital certificate.

16. A method according to claim 15, wherein each said cryptographic key remains valid so long as said tag is present at said site.

17. A method according to claim 15, including invalidating each said cryptographic key when said tag leaves said site.

18. A method according to claim 14, including establishing a set of cryptographic keys associated with said digital certificate, wherein said cryptographic keys include first and second key subsets that permit respective different levels of secure access to said tag.

19. A method according to claim 14, including:

responding to arrival of said tag at a first site by establishing at least one first cryptograpic key associated with said selected digital certificate;

invalidating each said first cryptographic key when said tag leaves said first site;

responding to arrival of said tag at a second site different from said first site by establishing at least one second cryptograpic key associated with said selected digital certificate and different from said each said first cryptographic key; and

invalidating each said second cryptographic key when said tag leaves said second site.

20. A method according to claim 14, including storing in said tag a further digital certificate that is different from said selected digital certificate and that permits secure access to said tag from externally thereof.

21. A method according to claim 20, wherein said storing of said further digital certificate is carried out pursuant to secure access obtained under said selected digital certificate.

22. A method according to claim 20, including:

responding to arrival of said tag at a first site by establishing at least one first cryptograpic key associated with said selected digital certificate;

invalidating each said first cryptographic key when said tag leaves said first site;

responding to arrival of said tag at a second site different from said first site by establishing at least one second cryptograpic key associated with said further digital certificate and different from each said first cryptographic key; and

invalidating each said second cryptographic key when said tag leaves said second site.

23. A method according to claim 20,

wherein said selected digital certificate permits a first range of secure access to said tag from externally thereof;

and

wherein said second digital certificate permits a second range of secure access to said tag from externally thereof, said second range of secure access being different from said first range of secure access.

24. A method according to claim 23, including configuring said first and second ranges of secure access to be mutually exclusive from a security perspective.

25. A method according to claim 23, including:

associating with said selected digital certificate a first set of rules defining said first range of secure access; and

associating with said further digital certificate a second set of rules defining said second range of secure access, said first set of rules being different from said second set of rules.

26. A method according to claim 23, including causing said tag to receive wireless communications that utilize said first range of secure access, and to receive wireless communications that utilize said second range of secure access.

27. A method according to claim 26, including configuring said wireless communications to all conform to a predetermined communications protocol.

28. A method according to claim 27, including selecting ISO 18000-7 as said predetermined communications protocol.

29. A method according to claim 23, wherein said first range of secure access includes use of a first cryptographic key, and said second range of secure access involves use of a second cryptographic key that is different from said first cryptographic key.

30. A method according to claim 23, wherein said first range of secure access includes use of a first set of cryptographic keys, and said second range of secure access involves use of a second set of cryptographic keys, said second set being different from said first set.

31. A method according to claim 30,

wherein said cryptographic keys of said first set include first and second key subsets that permit respective different levels of secure access to said tag from externally thereof;

and

wherein said cryptographic keys of said second set include third and fourth key subsets that permit respective different levels of secure access to said tag from externally thereof.

32. A method according to claim 14, including:

receiving said selected digital certificate from externally of said tag using a first communications protocol, and thereafter carrying out said storing of said selected digital certificate;

authenticating to said selected digital certificate a further digital certificate received by said tag from externally thereof using a second communications protocol different from said first communications protocol, and then establishing a cryptographic first keyset associated with said selected digital certificate;

responding to receipt by said tag of an externally originated communication utilizing said first keyset and said second communications protocol by establishing a cryptographic second keyset associated with said selected digital certificate, said first and second keysets being different and permitting respective different degrees of secure access to said tag from externally thereof;

responding to receipt by said tag of an externally originated communication utilizing said first keyset and said second communications protocol by storing in said tag a further digital certificate different from but of the same type as said selected digital certificate;

responding to receipt by said tag of an externally originated communication utilizing said first keyset and said second communications protocol by storing in said tag a recipient digital certificate identifying a recipient for tag data and containing a cryptographic key of the specified recipient; and

responding to receipt by said tag of an externally originated communication utilizing said second keyset and said second communications protocol by transmitting externally of said tag a communication containing tag data encrypted with said cryptographic key.