RFID authentication architecture and methods for RFID authentication

• US 8,681,987 B2
• Filed: 01/30/2009
• Issued: 03/25/2014
• Est. Priority Date: 01/30/2008
• Status: Active Grant

• Current Assignee: Smart Cosmos Solutions Incorporated
• Original Assignee: Neology Incorporated (OEP Technologie BV)
• Inventors: Fairbanks, John, Moran, Douglas, Liu, Jun
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US12/363,605
• Publication Number:
  US 20100150348A1
• Time in Patent Office: 1,880 Days
• Field of Search: 380/270, 380/44, 713/169
• US Class Current: 380/270
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A method for mutual authentication in an RFID system comprising an RFID reader and an RFID tag, the method comprising requesting an identification from the tag, receiving the identification, using the received identification to select a password associated with the identification, generating a password key based on the selected password, encrypting the selected password using the password key, and transmitting the encrypted password to the tag.

Claims

1. A method for mutual authentication in an RFID system comprising an RFID reader and an RFID tag, the method comprising:

requesting an identification from the tag;

receiving the identification;

using the received identification to select a password associated with the identification;

generating a password key based on the selected password, wherein the password key is generated using a mathematical kernel selected from a set of indexed mathematical kernels, wherein each mathematical kernel is adapted to receive a respective set of inputs, each set of inputs comprising a tap set, a number of cycles to be run, and an initialization vector;

encrypting the selected password using the password key; and

transmitting the encrypted password to the tag.

2. The method of claim 1, further comprising:

receiving an acknowledgement from the tag indicating that the tag was able to decrypt the password and authenticate the reader based on the transmitted, encrypted password;

generating a read memory request;

transmitting the read memory request to the tag; and

receiving data from the tag in response to the read memory request.

3. The method of claim 1, further comprising:

receiving a negative acknowledgement from the tag indicating that the tag could not decrypt the password and authenticate the reader based on the transmitted, encrypted password;

indexing to a known password key state;

transmitting an index for the known password key state to the tag;

receiving an acknowledgement from the tag indicating that the tag received the index;

encrypting the password with the known password key; and

transmitting the newly encrypted password to the tag.

4. The method of claim 3, further comprising:

receiving an acknowledgement from the tag indicating that the tag was able to decrypt the password and authenticate the reader based on the transmitted, newly encrypted password;

generating a read memory request;

transmitting the read memory request to the tag; and

receiving data from the tag in response to the read memory request.

5. The method of claim 1, further comprising scrambling the selected password.

6. The method of claim 5, wherein scrambling the selected password comprises shuffling bits of the password.

7. The method of claim 5, wherein scrambling the selected password comprises exchanging bits of the password.

8. The method of claim 5, wherein scrambling the selected password comprises altering bits of the password.

9. The method of claim 1, wherein the mathematical kernel is selected based on a length of the selected password.

10. A method for mutual authentication in an RFID system comprising an RFID reader and an RFID tag, the method comprising:

providing a tag identifier to the reader;

receiving an encrypted password in response;

decrypting the encrypted password using a password key, wherein the password key is generated using a mathematical kernel selected from a set of indexed mathematical kernels, wherein each mathematical kernel is adapted to receive a respective set of inputs, each set of inputs comprising a tap set, a number of cycles to be run, and an initialization vector;

verifying the decrypted password;

sending an acknowledgement if the password can be detected and verified;

receiving a read memory request in response to the acknowledgement; and

executing the read memory request.

11. The method of claim 10, further comprising:

transmitting a negative acknowledgement if the password cannot be decrypted and verified;

receiving an index to a known password key state in response to the negative acknowledgement;

transmitting an acknowledgement in response to the known password key index;

receiving an encrypted password;

decrypting the encrypted password using the known password key;

verifying the decrypted password;

sending an acknowledgement if the password can be detected and verified;

receiving a read memory request m response to the acknowledgement; and

executing the read memory request.

12. The method of claim 10, wherein the encrypted password is also scrambled, and herein the method further comprises descrambling the selected password.

13. The method of claim 12, wherein descrambling the selected password comprises shuffling bits of the password.

14. The method of claim 12, wherein descrambling the selected password comprises exchanging bits of the password.

15. The method of claim 12, wherein descrambling the selected password comprises altering bits of the password.

16. The method of claim 10, wherein the mathematical kernel is selected based on a length of the selected password.