VERIFICATION OF MOVEMENT OF ITEMS

• US 20100109851A1
• Filed: 03/11/2008
• Published: 05/06/2010
• Est. Priority Date: 03/14/2007
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Burbridge, Trevor, Soppera, Andrea
• Granted Patent: US 8,310,346 B2
• Time in Patent Office: Days
• US Class Current: 340/10.420
• CPC Class Codes: G06Q 10/08 Logistics, e.g. warehousing, loading or distribution; Inventory or stock management
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

Apparatus and system for verifying a route taken during movement of an RFID tag, comprising a trusted platform module; sealed storage (80) comprising one or more stores (50, 52) for storing a public key (64), a private key (68) and a policy (62); and processors arranged to: receive data (60) read-out from the RFID tag (4) and comprising an RFID tag identity and an encrypted signature (9); use the public key (64) to decrypt the encrypted signature (9); verify that the decrypted signature (9) corresponds to a first entity from which, according to the policy (62), a second entity is authorised to receive the given RFID tag (4); use the private key (68) to provide an encrypted signature (9); and forward data comprising the encrypted signature (9) to an RFID tag writer (22).

Claims

1. Verification apparatus for use in verification of a route taken during movement of an RFID tag (4), the verification apparatus comprising:

a trusted platform module;

sealed storage (80) comprising a store (54) for storing a private key (68); and

one or more processors arranged to;

(i) use the private key (68) to provide, for the given RFID tag identity, an encrypted signature (9); and

(ii) forward data comprising the encrypted signature (9) to an RFID tag writer (22) for writing to the RFID tag (4).

2. Apparatus according to claim 1, further comprising:

one or more stores (50, 52) for storing a public key (64) and a policy (62); and

wherein the one or more processors are further arranged to;

(i) receive, from an RFID tag reader (22), data (60) read-out from the RFID tag (4) and comprising an RFID tag identity and an encrypted signature (9);

(ii) use the public key (64) to decrypt the encrypted signature (9) from the data (60) read-out from the RFID tag (4); and

(iii) verify that the decrypted signature (9) corresponds to a first entity from which, according to the policy (62), a second entity associated with the verification apparatus is authorised to receive an RFID tag (4) with the given RFID tag identity.

3. Apparatus according to claim 2, wherein the sealed storage (80) further comprises one or more of the stores (50, 52) for storing a public key (64) and a policy (62).

7. Apparatus according to claim 1, wherein the apparatus further comprises the RFID tag reader (22) and the RFID tag writer (22).

8. Apparatus according to claim 1, arranged to allow remote attestation by a third party.

9. Apparatus according to claim 1, wherein the one or more processors are further arranged to report the verification to one or more third parties.

10. Apparatus according to claim 1, wherein the one or more processors are further arranged to raise an alarm responsive to the verifying step determining that the decrypted signature (9) does not correspond to an entity from which the second entity is authorised to receive an RFID tag (4) with the given RFID tag identity.

11. Apparatus according to claim 9, wherein a third party to which verification is reported and a third party by whom remote attestation is allowed are identical.

12. A system for verifying a route taken during movement of an RFID tag (4), the system comprising:

a first verification apparatus according to claim 1

13. A system according to claim 12, further comprising one or more further verification units.

14. A system according to claim 12, further comprising a controller apparatus (6).

15. A system according to claim 14, wherein the controller apparatus (6) is arranged to provide one or more of a public key (64), a private key (68) and a policy (62) to one or more of the verification apparatus of the system.

16. A system according to claim 14, wherein the controller apparatus (6) is arranged to perform remote attestation of one or more of the verification apparatus of the system.

4. Verification apparatus for use in verification of a route taken during movement of an RFID tag (4), the verification apparatus comprising:

a trusted platform module;

sealed storage (80) comprising one or more stores (50, 52) for storing a public key (64) and a policy (62); and

one or more processors arranged to;

(i) receive, from an RFID tag reader (22), data (60) read-out from the RFID tag (4) and comprising an RFID tag identity and an encrypted signature (9);

(ii) use the public key (64) to decrypt the encrypted signature (9) from the data (60) read-out from the RFID tag (4); and

(iii) verify that the decrypted signature (9) corresponds to a first entity from which, according to the policy (62), a second entity associated with the verification apparatus is authorised to receive an RFID tag (4) with the given RFID tag identity.

5. Apparatus according to claim 4, further comprising:

a store (54) for storing a private key (68); and

wherein the one or more processors are further arranged to;

(i) use the private key (68) to provide, for the given RFID tag identity, an encrypted signature (9); and

(ii) forward data comprising the encrypted signature (9) to an RFID tag writer (22) for writing to the RFID tag (4).

6. Apparatus according to claim 5, wherein the sealed storage (80) further comprises the store (54) for storing a private key (68).