System, method and apparatus for electronically protecting data associated with RFID tags

• US 8,613,107 B2
• Filed: 04/11/2007
• Issued: 12/17/2013
• Est. Priority Date: 03/16/2005
• Status: Active Grant

• Current Assignee: Kloke LLC
• Original Assignee: DT Labs Development LLC
• Inventors: Peckover, Douglas
• Primary Examiner(s): PEARSON, DAVID J
• Application Number:
  US11/733,780
• Publication Number:
  US 20070204329A1
• Time in Patent Office: 2,442 Days
• Field of Search: None
• US Class Current: 726/29
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The present invention provides a system, method and apparatus for protecting sensitive data associated with RFID tags by extracting the sensitive data from RFID data associated with the RFID tag, generating a pointer indicating for the sensitive data, storing the extracted data and the pointer in a secure storage and replacing the sensitive data in the RFID data with the pointer. Furthermore, the present invention provides a method for protecting sensitive data associated with an RFID tag by receiving RFID data from the RFID tag, authenticating the RFID data, retrieving the sensitive data associated with the RFID tag from a secure storage using the RFID data whenever the RFID data is authentic and providing the sensitive data to one or more applications.

Claims

1. A system for protecting sensitive data associated with a RFID tag comprising:

a remotely located server having a storage manager and a secure storage that stores the sensitive data associated with the RFID tag;

a RFID tag reader that obtains RFID data from the RFID tag, wherein the RFID data comprises one or more pointers to the sensitive data associated with the RFID tag stored in the secure storage and the sensitive data was extracted from the RFID data and replaced with the one or more pointers to the sensitive data before the RFID data was embedded within the RFID tag;

an application resident on a client and communicably coupled to the RFID tag reader and the storage manager, wherein the application receives the one or more pointers from the RFID tag reader and requests the sensitive data associated with the RFID tag from the storage manager using the one or more pointers; and

the storage manager communicably coupled to the secure storage, wherein the storage manager receives the one or more pointers from the application, retrieves the sensitive data associated with the RFID tag from the secure storage using the one or more pointers, and provides the sensitive data associated with the RFID tag to the application.

2. The system as recited in claim 1, wherein the RFID data further comprises a RFID key, nonsensitive data or a combination thereof.

3. The system as recited in claim 1, wherein the one or more pointers comprise random data that is of a same data type as the sensitive data.

4. The system as recited in claim 1, wherein the one or more pointers are subsequently used to access the sensitive data after proper authentication.

5. The system as recited in claim 1, wherein access to and storage of the sensitive data is governed by one or more rules.

6. The system as recited in claim 1, further comprising an index communicably coupled to the storage manager.

7. The system as recited in claim 1, wherein the storage manager authenticates the one or more pointers and validates one or more permissions of the application prior to providing the sensitive data to the application.

8. The system as recited in claim 1, further comprising:

a content manager resident on the client and communicably coupled between the application and the storage manager; and

a client storage resident on the client and communicably coupled to the content manager.

9. The system as recited in claim 1, wherein:

the client comprises a computer, a laptop computer, a handheld computer, a desktop computer, a workstation, a data terminal, a phone, a mobile phone, a personal data assistant, a media player, a gaming console, a security device, a surveillance device or a combination thereof; and

the server is communicably coupled to the one or more clients via a computer network, a telecommunications network, a wireless communications link, a physical connection, a landline, a satellite communications link, an optical communications link, a cellular network or a combination thereof.

10. The system as recited in claim 1, wherein the communications between the server and the client are encrypted.

11. The system as recited in claim 1, wherein the server further comprises:

an application program interface layer;

an authentication layer coupled to the application program layer;

a plug-in layer coupled to the authentication layer;

a data layer coupled to the plug-in layer; and

an events layer coupled to the data layer, the plug-in layer and the authentication layer.

12. A system for protecting sensitive data associated with a RFID tag comprising:

a server having a storage manager;

a secure storage communicably coupled to the server, wherein the secure storage stores the sensitive data associated with the RFID tag;

an application resident on a client and communicably coupled to a RFID tag writer and the storage manager, wherein the application receives the RFID data containing the sensitive data, extracts the sensitive data from the RFID data, sends the sensitive data to the storage manger, receives the one or more pointers to the sensitive data stored on the secure server from the storage manager, replaces the sensitive data extracted from the RFID data with the one or more pointers to the sensitive data, and sends the RFID data containing the one or more pointers to the RFID tag writer;

the RFID tag writer receives the RFID data containing the one or more pointers, and embeds the RFID data containing the one or more pointers in the RFID tag; and

the storage manager is communicably coupled to the secure storage, wherein the storage manager receives the one or more pointers from the RFID tag via a subsequent application, retrieves the sensitive data associated with the RFID tag from the secure storage using the one or more pointers, and provides the sensitive data associated with the RFID tag to the subsequent application using the one or more pointers.

13. The system as recited in claim 12, wherein the RFID data further comprises a RFID key, nonsensitive data or a combination thereof.

14. The system as recited in claim 12, further comprising a pointer generator communicably coupled to the storage manager.

15. The system as recited in claim 12, wherein the one or more pointers are subsequently used to access the sensitive data after proper authentication.

16. The system as recited in claim 12, wherein access to and storage of the sensitive data is governed by one or more rules.

17. The system as recited in claim 12, further comprising an index communicably coupled to the storage manager.

18. The system as recited in claim 12, wherein the storage manager authenticates the one or more pointers and validates one or more permissions of the application prior to providing the sensitive data to the application.

19. The system as recited in claim 12, wherein the server comprises a remotely located server.

20. The system as recited in claim 12, further comprising:

a content manager resident on the client and communicably coupled between the application and the storage manager; and

a client storage resident on the client and communicably coupled to the content manager.

21. The system as recited in claim 12, wherein:

the client comprises a computer, a laptop computer, a handheld computer, a desktop computer, a workstation, a data terminal, a personal data assistant, a media recorder, a security device, a surveillance device or a combination thereof; and

the server is communicably coupled to one or more clients via a computer network, a telecommunications network, a wireless communications link, a physical connection, a landline, a satellite communications link, an optical communications link, a cellular network or a combination thereof.

22. The system as recited in claim 12, wherein the communications between the server and the client are encrypted.

23. The system as recited in claim 12, wherein the server further comprises:

an application program interface layer;

an authentication layer coupled to the application program layer;

a plug-in layer coupled to the authentication layer;

a data layer coupled to the plug-in layer; and

an events layer coupled to the data layer, the plug-in layer and the authentication layer.

24. An apparatus for protecting sensitive data associated with a RFID tag comprising:

a RFID tag writer;

a data storage having a RFID data containing the sensitive data;

one or more applications communicably coupled to the RFID tag writer;

a communications interface to a remote server having a secure storage that stores the sensitive data associated with the RFID tag;

a content manager communicably coupled to the data storage, the one or more applications and the communications interface, wherein the content manager controls access to the data storage, receives the RFID data containing the sensitive data from the data storage, extracts the sensitive data from the RFID data, sends the extracted data to the remote server for storage via the communications interface, receives one or more pointers indicating where the extracted data has been stored on the secure storage, replaces the sensitive data in the RFID data with the one or more pointers, and sends the RFID data containing the one or more pointers to the RFID tag writer to be written on the RFID tag; and

wherein the one or more pointers are received from the RFID tag via a subsequent application, the content manager retrieves the sensitive data associated with the RFID tag from the secure storage using the one or more pointers, and provides the sensitive data associated with the RFID tag to the subsequent application using the one or more pointers.

25. The apparatus as recited in claim 24, wherein the content manager further receives a first request from the one or more applications for data stored on the data storage, determines whether the requested data includes the sensitive data associated with the RFID tag, provides the requested data to the one or more applications whenever the requested data does not include the sensitive data associated with the RFID tag, and performs the following steps whenever the requested data includes the sensitive data associated with the RFID tag:

sends a second request containing the one or more pointers to a server that authenticates the second request, denies the first request whenever the authentication fails, and receives and provides the sensitive data associated with the RFID tag to the one or more applications whenever the authentication succeeds.

26. A method for protecting sensitive data associated with a RFID tag comprising the steps of:

extracting the sensitive data from a RFID data associated with the RFID tag using a client and sending the sensitive data associated with the RFID tag from the client to a server communicably coupled to the client;

generating one or more pointers for the sensitive data associated with the RFID tag using the server;

storing the extracted data and the one or more pointers in a secure storage that stores the sensitive data extracted from the RFID data associated with the RFID tag using the server and sending the one or more pointers to the sensitive data from the server to the client;

replacing the sensitive data in the RFID data with the one or more pointers using the client; and

wherein the one or more pointers are received from the RFID tag via a subsequent application, the one or more pointers are sent to the server, the server retrieves the sensitive data associated with the RFID tag from the secure storage using the one or more pointers, and provides the sensitive data associated with the RFID tag to the subsequent application using the one or more pointers.

27. The method as recited in claim 26, further comprising the steps of:

receiving or creating the RFID data;

determining whether the RFID data contains the sensitive data;

modifying or creating one or more permissions and authentications for future access to the extracted data; and

writing the RFID data to the RFID tag.

28. The method as recited in claim 27, further comprising the steps of:

sending the extracted data to the server;

receiving the extracted data from the client;

sending the one or more pointers to the client; and

receiving the one or more pointers from the server.

29. The method as recited in claim 26, wherein the RFID data comprises a RFID key, nonsensitive data or a combination thereof.

30. The method as recited in claim 27, wherein:

the client comprises a computer, a laptop computer, a handheld computer, a desktop computer, a workstation, a data terminal, a phone, a mobile phone, a personal data assistant, a media player, a gaming console, a security device, a surveillance device or a combination thereof; and

the server is communicably coupled to one or more clients via a computer network, a telecommunications network, a wireless communications link, a physical connection, a landline, a satellite communications link, an optical communications link, a cellular network or a combination thereof.

31. The method as recited in claim 26, wherein the received sensitive data cannot be further transferred or stored.

32. The method as recited in claim 26, wherein the sensitive data comprises personal data, financial data, corporate data, legal data, government data, police data, immigration data, military data, intelligence data, security data, surveillance data, technical data, copyrighted content or a combination thereof.

33. A computer program embodied on a non-transitory computer readable medium for protecting sensitive data associated with a RFID tag comprising:

a code segment for extracting the sensitive data from a RFID data associated with the RFID tag using a client and sending the sensitive data associated with the RFID tag from the client to a server communicably coupled to the client;

a code segment for generating one or more pointers for the sensitive data associated with the RFID tag using the server;

a code segment for storing the extracted data and the one or more pointers in a secure storage that stores the sensitive data extracted from the RFID data associated with the RFID tag using the server and sending the one or more pointers to the sensitive data from the server to the client;

a code segment for replacing the sensitive data in the RFID data with the one or more pointers using the client; and

wherein the one or more pointers are received from the RFID tag via a subsequent application, the one or more pointers are sent to the server, the server retrieves the sensitive data associated with the RFID tag from the secure storage using the one or more pointers, and provides the sensitive data associated with the RFID tag to the subsequent application using the pointer.

34. A method for protecting sensitive data associated with a RFID tag comprising the steps of:

receiving RFID data from the RFID tag at an application resident on a client, wherein the RFID data comprises one or more pointers to the sensitive data associated with the RFID tag stored in a secure storage communicably coupled to a server, and the sensitive data was extracted from the RFID data and replaced with the one or more pointers to the sensitive data before the RFID data was embedded within the RFID tag;

authenticating the RFID data using the server;

retrieving the sensitive data associated with the RFID tag from the secure storage using the server and the one or more pointers to the sensitive data associated with the RFID tag whenever the RFID data is authentic; and

providing the sensitive data associated with the RFID tag to the application.

35. The method as recited in claim 34, wherein the RFID data comprises a RFID key, nonsensitive data or a combination thereof.

36. The method as recited in claim 34, further comprising the steps of:

passing the RFID tag within a range of a RFID reader;

determining whether the RFID data contains the pointer; and

writing the RFID data to the RFID tag.

37. The method as recited in claim 36, wherein:

the steps of receiving RFID data from the RFID tag and providing the sensitive data to one or more applications are performed by a client; and

the client is communicably coupled to the server.

38. The method as recited in claim 37, further comprising the steps of:

sending the RFID data to the server;

receiving the RFID data from the client;

sending the sensitive data associated with the RFID tag to the client; and

receiving the sensitive data associated with the RFID tag from the server.

39. A computer program embodied on a non-transitory computer readable medium for protecting sensitive data associated with a RFID tag comprising:

a code segment for receiving RFID data from the RFID tag at an application resident on a client, wherein the RFID data comprises one or more pointers to the sensitive data associated with the RFID tag stored in a secure storage communicably coupled to a server, and the sensitive data was extracted from the RFID data and replaced with the one or more pointers to the sensitive data before the RFID data was embedded within the RFID tag;

a code segment for authenticating the RFID data using the server;

a code segment for retrieving the sensitive data associated with the RFID tag from the secure storage using the server and the one or more pointers associated with the RFID tag whenever the RFID data is authentic; and

a code segment for providing the sensitive data associated with the RFID tag to the application.