Systems and methods for RFID security

• US 7,492,258 B1
• Filed: 03/21/2006
• Issued: 02/17/2009
• Est. Priority Date: 03/21/2006
• Status: Active Grant

• Current Assignee: Knapp Investment Company Limited
• Original Assignee: Radiofy, LLC
• Inventors: Shoarinejad, Kambiz, Soltan, Maryam
• Primary Examiner(s): PHAM, TOAN NGOC
• Application Number:
  US11/386,540
• Time in Patent Office: 1,064 Days
• Field of Search: 340/572.1, 340/10.2, 340/572.4, 340/10.4, 340/5.8, 340/5.82, 235/375
• US Class Current: 340/572.1
• CPC Class Codes: G06K 7/00 Methods or arrangements for sensing record carriers, e.g. for reading patterns methods or arrangements for marking the record carrier in digital fashion G06K1/00; pattern recognition G06F18/00; arrangements for image or video recognition or understanding G06V10/00; character recognition, recognising digital ink or document-oriented image-based pattern recognition G06V30/00
• CPC Class Codes: G06K 7/10257 arrangements for protecting the interrogation against piracy attacks computer security in general G06F21/00; jamming of communication, countermeasures H04K3/00; secret communication H04K1/00
• CPC Class Codes: G06Q 20/206 comprising security or operator identification provisions, e.g. password entry
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/12 Card verification
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

An RFID system includes an RFID tag, an RFID reader, and a server. The RFID tag communicates to the server via encrypted information. The information may be encrypted with synchronized encryption keys. In this manner, the reader need not decrypt the information from the RFID tag. The effectiveness of malicious readers is thereby reduced, resulting in improved RFID tag security.

Claims

1. A method of transmitting information between a radio frequency identification (RFID) tag and a server, said method comprising the steps of:

encrypting, by said RFID tag according to a predetermined scheme, identification data identifying said RFID tag, to result in encrypted RFID information;

reading, by a RFID reader, said encrypted RFID information from said RFID tag;

transmitting, from said RFID reader to said server, a transmission, wherein said transmission includes said encrypted RFID information;

decrypting, by said server according to said predetermined scheme, said encrypted RFID information to produce said identification data;

generating, by said RFID tag prior to said step of encrypting, a first pseudorandom number, wherein said step of encrypting is performed using said first pseudorandom number; and

generating, by said server prior to said step of decrypting, a second pseudorandom number, wherein said second pseudorandom number corresponds to said first pseudorandom number, and wherein said step of decrypting is performed using said second pseudorandom number.

2. The method of claim 1, further comprising:

authorizing, by said server, said transmission using said identification data.

3. The method of claim 1, further comprising:

receiving, by said RFID reader, authentication data, wherein said authentication data authenticates said RFID tag to said server, and wherein said transmission, from said RFID reader to said server, includes said authentication data;

authenticating, by said server, said transmission using said authentication data and said identification data.

4. The method of claim 3, wherein:

said step of receiving comprises receiving, by said RFID reader, said authentication data and transaction information, wherein said authentication data authenticates said RFID tag to said server, and wherein said transaction information relates to a transaction involving said RFID tag and said RFID reader; and

said step of transmitting comprises transmitting, from said RFID reader to said server, said transmission, wherein said transmission includes said encrypted RFID information, said transaction information, and said authentication data.

5. The method of claim 4, further comprising:

authenticating, by said server, said transaction using said authentication data and said identification data; and

authorizing, by said server, said transaction using said identification data and said transaction information.

6. The method of claim 3, wherein said authentication data comprises a password, biometric information, or a pseudo-random number.

7. The method of claim 3, wherein said RFID tag displays an authentication code that a user of said RFID tag provides to said reader as said authentication data.

8. The method of claim 1, further comprising:

activating said RFID tag, prior to said step of reading.

9. The method of claim 1, further comprising:

activating said RFID tag, prior to said step of reading, with one of a switch, biometric information, or a password.

10. The method of claim 1, wherein said step of reading is performed by backscattering.

11. A method of transmitting information between a radio frequency identification (RFID) tag and a server, said method comprising the steps of:

encrypting, by said RFID tag according to a predetermined scheme, identification data identifying said RFID tag, to result in encrypted RFID information;

reading, by a RFID reader, said encrypted RFID information from said RFID tag;

transmitting, from said RFID reader to said server, a transmission, wherein said transmission includes said encrypted RFID information;

decrypting, by said server according to said predetermined scheme, said encrypted RFID information to produce said identification data; and

performing, by said server, synchronization contingency processing when said step of decrypting results in a failure.

12. The method of claim 11, further comprising:

authorizing, by said server, said transmission using said identification data.

13. The method of claim 11, further comprising:

receiving, by said RFID reader, authentication data, wherein said authentication data authenticates said RFID tag to said server, and wherein said transmission, from said RFID reader to said server, includes said authentication data;

authenticating, by said server, said transmission using said authentication data and said identification data.

14. The method of claim 13, wherein:

said step of receiving comprises receiving, by said RFID reader, said authentication data and transaction information, wherein said authentication data authenticates said RFID tag to said server, and wherein said transaction information relates to a transaction involving said RFID tag and said RFID reader; and

said step of transmitting comprises transmitting, from said RFID reader to said server, said transmission, wherein said transmission includes said encrypted RFID information, said transaction information, and said authentication data.

15. The method of claim 14, further comprising:

authenticating, by said server, said transaction using said authentication data and said identification data; and

authorizing, by said server, said transaction using said identification data and said transaction information.

16. The method of claim 13, wherein said authentication data comprises a password, biometric information, or a pseudo-random number.

17. The method of claim 13, wherein said RFID tag displays an authentication code that a user of said RFID tag provides to said reader as said authentication data.

18. The method of claim 11, wherein said server generates an encryption key and transmits said encryption key to said RFID tag, wherein said RFID tag uses said encryption key when encrypting, and wherein said server uses said encryption key when decrypting.

19. The method of claim 11, wherein said server generates an encryption key and transmits said encryption key to said RFID tag, wherein said RFID tag updates said encryption key according to a defined process to result in an updated encryption key, wherein said RFID tag uses said updated encryption key when encrypting, wherein said server updates said encryption key according to said defined process to result in said updated encryption key, and wherein said server uses said updated encryption key when decrypting.

20. A method of transmitting information between a radio frequency identification (RFID) tag and a server, said method comprising the steps of:

encrypting, by said RFID tag according to a predetermined scheme, identification data identifying said RFID tag, to result in encrypted RFID information;

reading, by a RFID reader, said encrypted RFID information from said RFID tag;

transmitting, from said RFID reader to said server, a transmission, wherein said transmission includes said encrypted RFID information;

decrypting, by said server according to said predetermined scheme, said encrypted RFID information to produce said identification data;

communicating, by said reader, timing information to said RFID tag; and

updating, by said RFID tag, an encryption key using said timing information, wherein said encryption key is used in said step of encrypting.

21. The method of claim 20, further comprising:

authorizing, by said server, said transmission using said identification data.

22. The method of claim 20, further comprising:

receiving, by said RFID reader, authentication data, wherein said authentication data authenticates said RFID tag to said server, and wherein said transmission, from said RFID reader to said server, includes said authentication data;

authenticating, by said server, said transmission using said authentication data and said identification data.

23. The method of claim 22, wherein:

said step of receiving comprises receiving, by said RFID reader, said authentication data and transaction information, wherein said authentication data authenticates said RFID tag to said server, and wherein said transaction information relates to a transaction involving said RFID tag and said RFID reader; and

said step of transmitting comprises transmitting, from said RFID reader to said server, said transmission, wherein said transmission includes said encrypted RFID information, said transaction information, and said authentication data.

24. The method of claim 23, further comprising:

authenticating, by said server, said transaction using said authentication data and said identification data; and

authorizing, by said server, said transaction using said identification data and said transaction information.

25. The method of claim 22, wherein said authentication data comprises a password, biometric information, or a pseudo-random number.

26. The method of claim 22, wherein said RFID tag displays an authentication code that a user of said RFID tag provides to said reader as said authentication data.

27. The method of claim 20, wherein said server generates an encryption key and transmits said encryption key to said RFID tag, wherein said RFID tag uses said encryption key when encrypting, and wherein said server uses said encryption key when decrypting.

28. The method of claim 20, wherein said server generates an encryption key and transmits said encryption key to said RFID tag, wherein said RFID tag updates said encryption key according to a defined process to result in an updated encryption key, wherein said RFID tag uses said updated encryption key when encrypting, wherein said server updates said encryption key according to said defined process to result in said updated encryption key, and wherein said server uses said updated encryption key when decrypting.

29. A method of transmitting information between a radio frequency identification (RFID) tag and a server, said method comprising the steps of:

encrypting, by said RFID tag according to a predetermined scheme, identification data identifying said RFID tag, to result in encrypted RFID information;

reading, by a RFID reader, said encrypted RFID information from said RFID tag;

transmitting, from said RFID reader to said server, a transmission, wherein said transmission includes said encrypted RFID information;

decrypting, by said server according to said predetermined scheme, said encrypted RFID information to produce said identification data;

communicating, by said server, timing information to said RFID tag; and

updating, by said RFID tag, an encryption key using said timing information, wherein said encryption key is used in said step of encrypting.

30. The method of claim 29, further comprising:

authorizing, by said server, said transmission using said identification data.

31. The method of claim 29, further comprising:

receiving, by said RFID reader, authentication data, wherein said authentication data authenticates said RFID tag to said server, and wherein said transmission, from said RFID reader to said server, includes said authentication data;

authenticating, by said server, said transmission using said authentication data and said identification data.

32. The method of claim 31, wherein:

said step of receiving comprises receiving, by said RFID reader, said authentication data and transaction information, wherein said authentication data authenticates said RFID tag to said server, and wherein said transaction information relates to a transaction involving said RFID tag and said RFID reader; and

said step of transmitting comprises transmitting, from said RFID reader to said server, said transmission, wherein said transmission includes said encrypted RFID information, said transaction information, and said authentication data.

33. The method of claim 32, further comprising:

authenticating, by said server, said transaction using said authentication data and said identification data; and

authorizing, by said server, said transaction using said identification data and said transaction information.

34. The method of claim 31, wherein said authentication data comprises a password, biometric information, or a pseudo-random number.

35. The method of claim 31, wherein said RFID tag displays an authentication code that a user of said RFID tag provides to said reader as said authentication data.

36. The method of claim 29, wherein said server generates an encryption key and transmits said encryption key to said RFID tag, wherein said RFID tag uses said encryption key when encrypting, and wherein said server uses said encryption key when decrypting.

37. The method of claim 29, wherein said server generates an encryption key and transmits said encryption key to said RFID tag, wherein said RFID tag updates said encryption key according to a defined process to result in an updated encryption key, wherein said RFID tag uses said updated encryption key when encrypting, wherein said server updates said encryption key according to said defined process to result in said updated encryption key, and wherein said server uses said updated encryption key when decrypting.

38. A method of transmitting information between a radio frequency identification (RFID) tag and a server, said method comprising the steps of:

encrypting, by said RFID tag according to a predetermined scheme, identification data identifying said RFID tag, to result in encrypted RFID information;

reading, by a RFID reader, said encrypted RFID information from said RFID tag;

transmitting, from said RFID reader to said server, a transmission, wherein said transmission includes said encrypted RFID information;

decrypting, by said server according to said predetermined scheme, said encrypted RFID information to produce said identification data, wherein said RFID tag stores a first plurality of encryption keys, wherein said server stores a second plurality of encryption keys, wherein said first plurality of encryption keys corresponds to said second plurality of encryption keys; and

communicating, by said server via said reader, a pointer to said RFID tag, wherein said pointer points to a selected one of said first plurality of encryption keys, wherein said RFID tag uses said selected one of said first plurality of encryption keys when encrypting, and wherein said server uses a corresponding selected one of said second plurality of encryption keys when decrypting.

39. The method of claim 38, further comprising:

authorizing, by said server, said transmission using said identification data.

40. The method of claim 38, further comprising:

receiving, by said RFID reader, authentication data, wherein said authentication data authenticates said RFID tag to said server, and wherein said transmission, from said RFID reader to said server, includes said authentication data;

authenticating, by said server, said transmission using said authentication data and said identification data.

41. The method of claim 40, wherein:

said step of receiving comprises receiving, by said RFID reader, said authentication data and transaction information, wherein said authentication data authenticates said RFID tag to said server, and wherein said transaction information relates to a transaction involving said RFID tag and said RFID reader; and

said step of transmitting comprises transmitting, from said RFID reader to said server, said transmission, wherein said transmission includes said encrypted RFID information, said transaction information, and said authentication data.

42. The method of claim 41, further comprising:

authenticating, by said server, said transaction using said authentication data and said identification data; and

authorizing, by said server, said transaction using said identification data and said transaction information.

43. The method of claim 40, wherein said authentication data comprises a password, biometric information, or a pseudo-random number.

44. The method of claim 40, wherein said RFID tag displays an authentication code that a user of said RFID tag provides to said reader as said authentication data.

45. A method of transmitting information between a radio frequency identification (RFID) tag and a server, said method comprising the steps of:

encrypting, by said RFID tag according to a predetermined scheme, identification data identifying said RFID tag, to result in encrypted RFID information;

reading, by a RFID reader, said encrypted RFID information from said RFID tag;

transmitting, from said RFID reader to said server, a transmission, wherein said transmission includes said encrypted RFID information;

decrypting, by said server according to said predetermined scheme, said encrypted RFID information to produce said identification data, wherein said RFID tag stores a first plurality of encryption keys, wherein said server stores a second plurality of encryption keys, wherein said first plurality of encryption keys corresponds to said second plurality of encryption keys;

communicating, by said reader, a pointer to said RFID tag, wherein said pointer points to a selected one of said first plurality of encryption keys, and wherein said RFID tag uses said selected one of said first plurality of encryption keys when encrypting; and

communicating, by said reader, said pointer to said server, wherein said pointer points to a corresponding selected one of said second plurality of encryption keys, and wherein said server uses said corresponding selected one of said second plurality of encryption keys when decrypting.

46. The method of claim 45, further comprising:

authorizing, by said server, said transmission using said identification data.

47. The method of claim 45, further comprising:

receiving, by said RFID reader, authentication data, wherein said authentication data authenticates said RFID tag to said server, and wherein said transmission, from said RFID reader to said server, includes said authentication data;

authenticating, by said server, said transmission using said authentication data and said identification data.

48. The method of claim 47, wherein:

said step of receiving comprises receiving, by said RFID reader, said authentication data and transaction information, wherein said authentication data authenticates said RFID tag to said server, and wherein said transaction information relates to a transaction involving said RFID tag and said RFID reader; and

said step of transmitting comprises transmitting, from said RFID reader to said server, said transmission, wherein said transmission includes said encrypted RFID information, said transaction information, and said authentication data.

49. The method of claim 48, further comprising:

authenticating, by said server, said transaction using said authentication data and said identification data; and

authorizing, by said server, said transaction using said identification data and said transaction information.

50. The method of claim 47, wherein said authentication data comprises a password, biometric information, or a pseudo-random number.

51. The method of claim 47, wherein said RFID tag displays an authentication code that a user of said RFID tag provides to said reader as said authentication data.

52. An apparatus including a radio frequency identification (RFID) tag for use in an RFID system including an RFID reader and a server, said RFID tag comprising:

a transceiver that communicates with said RFID reader;

a processor, coupled to said transceiver, that encrypts, according a predetermined scheme, identification data that identifies said RFID tag, and that generates an authentication code;

a display, coupled to said processor, that displays said authentication code; and

wherein said RFID tag further comprises a switch, where said RFID tag receives information from a reader, and a user verifies the information from the reader and activates the tag using the switch, and said RFID tag transmits information to the reader only if said user verifies the information from the reader.

53. The apparatus of claim 52, wherein said RFID tag further comprises a switch for activating said RFID tag.

54. An apparatus including a radio frequency identification (RFID) tag for use in an RFID system including an RFID reader and a server, said RFID tag comprising:

a processor, coupled to said transceiver, that encrypts, according a predetermined scheme, identification data that identifies said RFID tag, and that generates an authentication code; and

a display, coupled to said processor, that displays said authentication code,

wherein said RFID tag receives information from a reader and displays the information to a user, and

wherein said RFID tag displays the information from the reader to the user before said RFID tag sends an encrypted identification data to the reader.

55. An apparatus including a radio frequency identification (RFID) tag for use in an RFID system including an RFID reader, said RFID tag comprising:

a switch for activating said RFID tag;

a transceiver that communicates with said RFID reader; and

a processor, coupled to said transceiver, that processes information received from said RFID reader,

wherein said RFID tag receives first information from said RFID reader and displays at least a portion of the first information to a user, and wherein identification data is transmitted from said RFID tag to said RFID reader if the first information has been verified using said switch.

56. The apparatus of claim 55, further comprising a display, coupled to said processor, that displays information received from said RFID reader.

57. The apparatus of claim 55, wherein said RFID tag receives first information from said RFID reader if said switch is activated and said transceiver is disabled if said switch is deactivated.