RFID authentication architecture and methods for RFID authentication

• US 9,231,947 B2
• Filed: 03/25/2014
• Issued: 01/05/2016
• Est. Priority Date: 01/30/2008
• Status: Active Grant

• Current Assignee: Smart Cosmos Solutions Incorporated
• Original Assignee: Neology Incorporated (OEP Technologie BV)
• Inventors: Fairbanks, John, Moran, Douglas, Liu, Jun
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US14/225,343
• Publication Number:
  US 20140341379A1
• Time in Patent Office: 651 Days
• Field of Search: 380/270, 380/44, 713/169
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A method for mutual authentication in an RFID system comprising an RFID reader and an RFID tag, the method comprising requesting an identification from the tag, receiving the identification, using the received identification to select a password associated with the identification, generating a password key based on the selected password, encrypting the selected password using the password key, and transmitting the encrypted password to the tag.

Claims

1. A method for mutual authentication in a radio frequency identification (RFID) system comprising an RFID reader and an RFID tag, the method comprising:

requesting an identifier from the RFID tag;

receiving the identifier;

selecting a password based at least in part on the identifier;

selecting a first of a plurality of indexed mathematical kernels, wherein the first mathematical kernel comprises a first parameter set;

using the first mathematical kernel to generate a first password key

encrypting the password using the first password key; and

transmitting the password encrypted using the first password key to the RFID tag.

2. The method of claim 1, further comprising:

receiving an acknowledgement (ACK) from the RFID tag indicating that the RFID tag was able to successfully verify the password encrypted using the first password;

generating a read memory request in response to the ACK received from the RFID tag;

transmitting the read memory request to the RFID tag; and

receiving data from the RFID tag in response to the read memory request.

3. The method of claim 1, further comprising:

receiving a negative acknowledgement (NACK) from the RFID tag indicating that the RFID tag was not able to successfully verify the password encrypted using the first password key;

selecting, in response to receiving the NACK from the RFID tag, a second of the plurality of indexed mathematical kernels, wherein the second mathematical kernel comprises a second parameter set;

transmitting an index corresponding to the second indexed mathematical kernel to the RFID tag;

receiving a first acknowledgement (ACK) from the RFID tag indicating receipt of the index;

using the second mathematical kernel to generate a second password key;

encrypting the password using the second password key; and

transmitting the password encrypted using the second password key to the RFID tag.

4. The method of claim 3, further comprising:

receiving a second ACK from the RFID tag indicating that the tag was able to successfully verify the password encrypted using the second password key;

generating a read memory request in response to the second ACK received from the RFID tag;

transmitting the read memory request to the RFID tag; and

receiving data from the RFID tag in response to the read memory request.

5. The method of claim 1, further comprising scrambling the password key.

6. The method of claim 5, wherein the password key is scrambled based on one of a plurality of indexed scrambling logic.

7. The method of claim 5, wherein the scrambling of the password key comprises shuffling at least a portion of a plurality of bits comprising the password key.

8. The method of claim 5, wherein the scrambling of the password key comprises exchanging at least a portion of a plurality of bits comprising the password key.

9. The method of claim 5, wherein the scrambling of the password key comprises altering at least a portion of a plurality of bits comprising the password key.

10. The method of claim 1, wherein using the first mathematical kernel to generate the first password key comprises running a pseudorandom sequence generator (PRSG) based at least in part on the first parameter set, wherein a length of the PRSG corresponds to a length of the password.

11. The method of claim 10, wherein the first parameter set includes one or more values for a tap set for the PRSG, a number of cycles to run the PRSG, and an initialization vector (IV) associated with the tap set.

12. A method for mutual authentication in an RFID system comprising an RFID reader and an RFID tag, the method comprising;

providing an identifier to the RFID reader;

in response to the identifier, receiving, from the RFID reader, a password encrypted using a first password key generated using a first of a plurality of indexed mathematical kernels, wherein the first mathematical kernel comprises a first parameter set;

verifying the password encrypted using the first password key;

in response to successfully verifying the password encrypted using the first password key, transmitting a first acknowledgement (ACK) to the RFID reader;

receiving, from the RFID reader, a read memory request in response to the first ACK; and

transmitting at least a portion of the data stored at the RFID tag to the RFID reader in response to the read memory request.

13. The method of claim 12, further comprising:

in response to not successfully verifying the password encrypted using the first password key, transmitting a negative acknowledgement (NACK) to the RFID reader;

receiving, from the RFID reader, an index corresponding to a second of the plurality of indexed mathematical kernels in response to the NACK, wherein the second mathematical kernel comprises a second parameter set;

transmitting, to the RFID reader, a second ACK in response to receiving the index from the RFID reader;

receiving, from the RFID reader, the password encrypted using a second password key generated using the second mathematical kernel;

verifying the password encrypted using the second password key;

in response to successfully verifying the password encrypted using the second password key, transmitting a third ACK to the RFID reader;

receiving a read memory request from the RFID reader in response to the third ACK; and

transmitting at least a portion of the data stored at the RFID tag to the RFID reader in response to the read memory request.

14. The method of claim 12, wherein the first password key is scrambled based on one of a plurality of scrambling logic.

15. The method of claim 14, wherein the password key is scrambled by shuffling at least a portion of a plurality of bits comprising the password key.

16. The method of claim 14, wherein the password key is scrambled by exchanging at least a portion of a plurality of bits comprising the password key.

17. The method of claim 14, the password key is scrambled by altering at least a portion of a plurality of bits comprising the password key.

18. The method of claim 12, wherein using the first mathematical kernel to generate the first password key comprises running a pseudorandom sequence generator (PRSG) based at least in part on the first parameter set, wherein a length of the PRSG corresponds to a length of the password.

19. The method of claim 18, wherein the first parameter set includes one or more values for a tap set for the PRSG, a number of cycles to run the PRSG, and an initialization vector (IV) associated with the tap set.

20. The method of claim 12, wherein verifying the password encrypted using the first password key comprises:

decrypting the password encrypted using the first password key based on a password key corresponding to a last known mathematical kernel; and

comparing the decrypted password to a password stored at the RFID tag.

21. The method of claim 13, wherein verifying the password encrypted using the second password key comprises:

identifying the second mathematical kernel based at least in part on the index received from the RFID reader;

decrypting the password encrypted using the second password key based on a password key corresponding to the second mathematical kernel; and

comparing the decrypted password to a password stored at the RFID tag.

22. The method of claim 13, further comprising:

determining a number unsuccessful attempts to verify encrypted passwords received from the RFID reader; and

in response to determining that the number of unsuccessful attempts exceeds a predetermined threshold, entering a sleep state.