Systems and methods for RFID security

• US 8,325,043 B2
• Filed: 12/21/2011
• Issued: 12/04/2012
• Est. Priority Date: 03/21/2006
• Status: Active Grant

• Current Assignee: Knapp Investment Company Limited
• Original Assignee: Radiofy, LLC
• Inventors: Shoarinejad, Kambiz, Soltan, Maryam
• Primary Examiner(s): PHAM, TOAN NGOC
• Application Number:
  US13/333,778
• Publication Number:
  US 20120087501A1
• Time in Patent Office: 349 Days
• Field of Search: 340/572.1, 340/572.4, 340/10.1, 340/10.2, 340/10.4, 340/5.8, 340/5.82, 235/375
• US Class Current: 340/572.1
• CPC Class Codes: G06K 7/00 Methods or arrangements for sensing record carriers, e.g. for reading patterns methods or arrangements for marking the record carrier in digital fashion G06K1/00; pattern recognition G06F18/00; arrangements for image or video recognition or understanding G06V10/00; character recognition, recognising digital ink or document-oriented image-based pattern recognition G06V30/00
• CPC Class Codes: G06K 7/10257 arrangements for protecting the interrogation against piracy attacks computer security in general G06F21/00; jamming of communication, countermeasures H04K3/00; secret communication H04K1/00
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/12 Card verification
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

An RFID system includes an RFID tag, an RFID reader, and a server. The RFID tag communicates to the server via encrypted information. The information may be encrypted with synchronized encryption keys. In this manner, the reader need not decrypt the information from the RFID tag. The effectiveness of malicious readers is thereby reduced, resulting in improved RFID tag security.

Claims

1. An apparatus comprising a tag for use in a system including a tag reader and a server communicatively coupled to the tag reader, the tag comprising:

a transceiver to communicate with the tag reader through a wireless link; and

a processor coupled to the transceiver, the processor to execute sets of instructions to (i) receive information from the tag reader that enables encryption of identification data identifying the tag and (ii) encrypt the identification data according to the predetermined encryption scheme using the received information to produce encrypted data for the reader to transmit to the server, the encrypted data for the server to decrypt according to the predetermined encryption scheme in order to produce the identification data of the tag.

2. The apparatus of claim 1, wherein the identification data is for the server to authorize transmission from the reader.

3. The apparatus of claim 1, wherein the tag further comprises a display to display an authentication code for a user of the tag to provide to the reader as authentication data.

4. The apparatus of claim 1, wherein the tag further comprises a switch for activating the tag.

5. The apparatus of claim 1, wherein the tag further comprises an input device to receive one of a password and biometric information to activate the tag.

6. The apparatus of claim 1, wherein the processor of the tag is further to execute a set of instructions to generate a pseudorandom number based on the information received from the reader, wherein the processor uses the pseudorandom number to encrypt the identification data.

7. The apparatus of claim 1, wherein the information received from the reader comprises an encryption key generated by the server, wherein the processor of the tag uses the encryption key to encrypt the identification data, wherein the server uses a same encryption key to decrypt the encrypted data.

8. The apparatus of claim 1, wherein the server and the tag share an encryption key, wherein the processor of the tag generates an updated encryption key according to a defined process using the information and encrypts the identification data using the updated encryption key, wherein the server generates a same updated encryption key according to the defined process using said information and uses the same updated encryption key to decrypt the encrypted data.

9. The apparatus of claim 1, wherein the reader reads the encrypted data by backscattering.

10. The apparatus of claim 1, wherein the reader is an electronic device acting as a conduit of information between the tag and the server without encrypting or decrypting the information exchanged between the tag and the server.

11. The apparatus of claim 1, wherein the tag is a small electronic device for placing on an object to track the object.

12. The apparatus of claim 11, wherein the tag comprises memory to store the identification data.

13. A method of transmitting information between a tag and a server via a reader, the method comprising:

at the tag, generating a pseudorandom number according to a predetermined scheme; and

at the tag, encrypting identification data identifying the tag using the pseudorandom number, the predetermined scheme shared with the server for the server to generate a same pseudorandom number and decrypt the encrypted identification data using the pseudorandom number.

14. The method of claim 13 further comprising activating the tag when an activation switch changes position prior to generating the pseudorandom number.

15. The method of claim 14 further comprising activating the tag after receiving one of a biometric information and a password.

16. The method of claim 13 further comprising:

receiving from the reader information for verification by a user of the tag; and

transmitting the encrypted identification data to the reader when the user verifies the information received from the reader.

17. The method of claim 16, wherein the tag comprises a display, the method further comprising displaying the information received from the reader on the display.

18. The method of claim 13, wherein the tag comprises a display, the method further comprising displaying the generated pseudorandom number on the display.

19. The method of claim 13 further comprising sending the encrypted identification data from the tag to the server through the reader, the reader acting as a conduit of information exchanged between the tag and the server without encrypting and decrypting the exchanged information.

20. The method of claim 13 further comprising sending the encrypted identification data from the tag to the server through the reader, wherein the reader further encrypts the encrypted information data received from the tag prior to sending the encrypted information data to the server.

21. A system comprising:

a tag; and

a server;

the tag (i) to generate a pseudorandom number according to a predetermined scheme for encryption of identification data, the identification data identifying the tag, (ii) to encrypt the identification data using the generated pseudorandom number, and (iii) to send the encrypted identification data to a server; and

the server (i) to receive the encrypted data transmitted by the tag, (ii) to generate a same pseudorandom number according to the predetermined scheme, and (iii) to decrypt the encrypted identification data using the generated pseudorandom number.

22. The system of claim 21, wherein the tag is further to generate the pseudorandom number after the tag has been activated.

23. The system of claim 21 further comprising a reader, wherein the tag is further to receive information from the reader, the information received from the reader by the tag for a user to verify and activate the tag, wherein the tag is further to send the encrypted identification to the server only when the user verifies the information received by the tag from the reader.

24. The system of claim 23, wherein the tag comprises a display, wherein the tag is further to display the information on the display.

25. The system of claim 21, wherein the tag comprises a display, wherein the tag is further to display the pseudorandom number on the display.

26. The system of claim 21 further comprising an electronic device communicatively coupling the tag and the server, the electronic device acting as a conduit of information between the tag and the server without encrypting or decrypting the information exchanged between the tag and the server.

27. The system of claim 21, wherein the tag is a small electronic device for placing on an object to track the object.

28. The system of claim 21, wherein the tag comprises memory to store the identification data.