Systems and methods for RFID security

• US 7,952,481 B2
• Filed: 01/07/2009
• Issued: 05/31/2011
• Est. Priority Date: 03/21/2006
• Status: Active Grant

• Current Assignee: Knapp Investment Company Limited
• Original Assignee: Radiofy, LLC
• Inventors: Shoarinejad, Kambiz, Soltan, Maryam
• Primary Examiner(s): PHAM, TOAN NGOC
• Application Number:
  US12/349,717
• Publication Number:
  US 20100007466A1
• Time in Patent Office: 874 Days
• Field of Search: 340/572.1, 340/10.2, 340/572.4, 340/10.4, 340/5.8, 340/5.82, 235/375
• US Class Current: 340/572.1
• CPC Class Codes: G06K 7/00 Methods or arrangements for sensing record carriers, e.g. for reading patterns methods or arrangements for marking the record carrier in digital fashion G06K1/00; pattern recognition G06F18/00; arrangements for image or video recognition or understanding G06V10/00; character recognition, recognising digital ink or document-oriented image-based pattern recognition G06V30/00
• CPC Class Codes: G06K 7/10257 arrangements for protecting the interrogation against piracy attacks computer security in general G06F21/00; jamming of communication, countermeasures H04K3/00; secret communication H04K1/00
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/12 Card verification
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

An RFID system includes an RFID tag, an RFID reader, and a server. The RFID tag communicates to the server via encrypted information. The information may be encrypted with synchronized encryption keys. In this manner, the reader need not decrypt the information from the RFID tag. The effectiveness of malicious readers is thereby reduced, resulting in improved RFID tag security.

Claims

1. A method of transmitting information between a radio frequency identification (RFID) tag and a server, the method comprising:

at the RFID tag, receiving information from an RFID reader that enables encryption of identification data according to a predetermined encryption scheme used by the server, the identification data identifying the RFID tag; and

at the RFID tag, encrypting the identification data according to the predetermined encryption scheme using the received information to produce encrypted RFID data for the RFID reader to transmit to the server for the server to decrypt the encrypted RFID data according to the predetermined scheme in order to produce the identification data of the RFID tag.

2. The method of claim 1, wherein the identification data is for the server to authorize transmission from the RFID reader.

3. The method of claim 1 further comprising:

at the RFID reader, receiving authentication data;

sending the authentication data from the RFID reader to the server; and

at the server, performing authentication using the authentication.

4. The method of claim 3, wherein receiving the authentication data comprises receiving, at the RFID reader, transaction information, relating to a transaction involving the RFID tag and the RFID reader, the method further comprising transmitting the transaction information and the authentication data from the RFID reader to the server.

5. The method of claim 4 further comprising:

at the server, authenticating a user of the RFID reader using the authentication data; and

at the server, authorizing the transaction based on the transaction information.

6. The method of claim 3, wherein the authentication data comprises a password, biometric information, or a pseudo-random number.

7. The method of claim 1 comprising displaying on a display of the RFID tag an authentication code that a user of the RFID tag provides to the RFID reader as authentication data.

8. The method of claim 1 further comprising activating the RFID tag prior to receiving the information from the RFID reader.

9. The method of claim 1 further comprising activating the RFID tag with one of a switch, biometric information, or a password prior to receiving the information from the RFID reader.

10. The method of claim 1 further comprising generating, at the RFID tag, a pseudo-random number based on the information from the RFID reader, wherein the encrypting comprises using the pseudo-random number to encrypt the identification data.

11. The method of claim 1, wherein the information received at the RFID tag from the RFID reader comprises an encryption key generated by the server, wherein the encrypting comprises using the encryption key to encrypt the identification data, wherein the server uses a same encryption key to decrypt the encrypted RFID data.

12. The method of claim 1, wherein the server and RFID tag share an encryption key wherein the encrypting comprises generating an updated encryption key according to a defined process using the information and encrypting the identification data using the updated encryption key, wherein the server generates a same updated encryption key according to the defined process using the information and uses the same updated encryption key to decrypt the encrypted RFID data.

13. The method of claim 1, wherein the RFID reader reads the encrypted RFID data by backscattering.

14. The method of claim 1, wherein the information received from the RFID reader includes timing information, the method further comprising:

at the RFID tag, comparing the timing information with previously stored timing information; and

at the RFID tag, generating a pseudo-random number based on the comparison, wherein the encrypting comprises encrypting the identification data according to the predetermined encryption scheme using the pseudo-random number.

15. The method of claim 1, wherein the RFID tag stores a plurality of encryption keys, wherein the information from the RFID reader includes pointer information, the method further comprising selecting an encryption key from the plurality of encryption keys using the pointer information, wherein the encrypting comprises encrypting the identification data according to the predetermined encryption scheme using the selected encryption key.

16. The method of claim 1 further comprising sending preliminary information from the RFID tag to the RFID reader, the preliminary information for the RFID reader to send to the server, wherein the information received from the RFID reader includes an encryption key generated by the server based on the preliminary information sent from the RFID reader to the server.

17. A radio frequency identification (RFID) system comprising:

an RFID tag configured to receive information that enables encryption of identification data according to a predetermined scheme to produce encrypted RFID data, the identification data identifying the RFID tag;

an RFID reader configured to communicate with the RFID tag by sending the information to the RFID tag and reading the encrypted RFID data; and

a server configured to receive the encrypted RFID data transmitted by the RFID reader and to produce the identification data by decrypting the encrypted RFID data according to a same predetermined scheme used by the RFID tag.

18. The system of claim 17, wherein the server is further configured to authorize the transmission using the identification data.

19. The system of claim 17, wherein the RFID reader is further configured to receive authentication data, wherein the transmission from the RFID reader to the server includes the authentication data.

20. The system of claim 19, wherein the server is further configured to perform authentication using the authentication data.

21. The system of claim 19, wherein:

the RFID reader is further configured to receive the authentication data and transaction information that relates to a transaction involving the RFID tag and the RFID reader; and

the server is further configured to receive the authentication data from the RFID reader, to perform authentication using the authentication data and the identification data, and to authorize the transaction using the transaction information.

22. The system of claim 19, wherein the RFID tag comprises:

a transceiver configured to communicate with the RFID reader;

a processor coupled to said transceiver and configured to encrypt the identification data according to said predetermined scheme; and

a display coupled to the processor and configured to display an authentication code that a user provides to the RFID reader as authentication data.

23. The system of claim 17, wherein the RFID tag comprises:

a transceiver configured to communicate with the RFID reader; and

a processor coupled to the transceiver and configured to encrypt the identification data according to the predetermined scheme.

24. The system of claim 17, wherein the RFID tag comprises:

a transceiver configured to communicate with the RFID reader;

a memory configured to store a plurality of encryption keys; and

a processor coupled to the transceiver and memory, and configured to encrypt the identification data according to the predetermined scheme, the identification data for selecting one of the plurality of encryption keys.

25. The system of claim 17, wherein the RFID tag comprises:

a switch configured to activate the RFID tag;

a transceiver configured to communicate with the RFID reader when the RFID tag is active; and

a processor coupled to the switch and transceiver, and configured to encrypt the identification data according to the predetermined scheme.

26. The system of claim 17, wherein the RFID tag comprises:

a switch configured to activate the RFID tag, wherein the switch includes one of a physical toggle, a biometric sensor, or a password processing system;

a transceiver configured to communicate with the RFID reader when the RFID tag is active; and

a processor coupled to the switch and transceiver, and configured to encrypt the identification data according to the predetermined scheme.

27. A method of transmitting information between a server and a radio frequency identification (RFID) tag, the method comprising:

at the server, receiving preliminary information of the RFID tag from an RFID reader;

sending an encryption key from the server to the RFID reader based on the preliminary information, the encryption key for the RFID tag to encrypt identification data that identifies the RFID tag according to a predetermined encryption scheme;

at the server, receiving the identification data encrypted by the RFID tag from the RFID reader; and

at the server, decrypting the encrypted identification data according to the predetermined encryption scheme using the encryption key.

28. The method of claim 27 further comprising receiving, at the server, authentication data from the RFID reader.

29. The method of claim 28, wherein the authentication data comprises biometric information or a password.

30. The method of claim 28, wherein the authentication data comprises a pseudo-random number.

31. The method of claim 30, wherein the pseudo-random number is generated by the RFID tag and displayed to a user, and wherein the server includes a synchronized pseudo-random number.

32. A method of transmitting information between a radio frequency identification (RFID) tag and a RFID reader, the method comprising:

at the RFID tag, receiving information from the RFID reader;

displaying at least a portion of the information on a display of the RFID tag;

at the RFID tag, receiving a verification from the RFID reader verifying the information displayed on the display of the RFID tag; and

when the verification is received, transmitting identification data from the RFID tag to the RFID reader.

33. The method of claim 32, wherein receiving the verification comprises activating a switch on the RFID tag to verify the information.

34. The method of claim 32, wherein the information comprises information about a transaction.

35. The method of claim 32, wherein the information comprises a number or a code.

36. The method of claim 32, wherein the information comprises an image.

37. A radio frequency identification (RFID) tag for use in an RFID system including an RFID reader and a server, the RFID tag comprising:

a transceiver configured to communicate with the RFID reader; and

a processor coupled to the transceiver and adapted to execute sets of instructions to generate a pseudo-random number according to a predetermined scheme and to encrypt identification data identifying the RFID tag using the pseudo-random number, the predetermined scheme shared with the server for the server to generate a same pseudo-random number and decrypt the encrypted identification data using the pseudo-random number.

38. The RFID tag of claim 37, wherein the RFID tag further comprises a switch for activating the RFID tag.

39. The RFID tag of claim 37, wherein the RFID tag further comprises a switch, wherein the RFID tag receives information from a reader, and a user verifies the information from the reader and activates the RFID tag using the switch, and said RFID tag transmits the information to the reader only when the user verifies the information from the reader.

40. The RFID tag of claim 37, wherein the RFID tag further comprises a display, and wherein the RFID tag receives information from a reader and displays the information to a user.

41. The RFID tag of claim 37, wherein the RFID tag further comprises a display, coupled to the processor, that displays the pseudo-random number.

42. A radio frequency identification (RFID) tag for use in an RFID system including an RFID reader and a server, the RFID tag comprising:

a display configured to display information;

a transceiver configured to communicate with the RFID reader; and

a processor coupled to the transceiver and configured to execute sets of instructions (i) to encrypt RFID tag data, (ii) to display an authentication code on the display, and (iii) to transmit the encrypted RFID tag data based on a verification of the authentication code.

43. The RFID tag of claim 42 further comprising a switch configured to activate the RFID tag.

44. The RFID tag of claim 42, wherein the processor is further configured to execute sets of instructions to receive the information from the RFID reader and to display the information on the display.

45. A radio frequency identification (RFID) tag for use in an RFID system including an RFID reader, the RFID tag comprising:

a switch configured to enable the RFID tag, while the RFID tag is in an active state, to send RFID tag information to the RFID reader;

a transceiver configured to communicate the information to the RFID reader; and

a processor coupled to the transceiver and configured to process a verification of the information received from the RFID reader that causes the switch to be activated to enable the RFID tag to transmit the RFID tag information to the RFID reader.

46. The RFID tag of claim 45 further comprising a display coupled to the processor and configured to display the information received from the RFID reader.

47. The RFID tag of claim 45, wherein the transceiver is disabled when the switch is deactivated and enabled when the switch is activated, wherein the RFID tag receives the information from the RFID reader when the switch is activated.