Radio Frequency Identification Tag Security Systems

• US 20080165005A1
• Filed: 01/11/2006
• Published: 07/10/2008
• Est. Priority Date: 01/12/2005
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Soperra, Andrea, Burbridge, Trevor
• Granted Patent: US 7,940,179 B2
• Time in Patent Office: Days
• US Class Current: 340/572.1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06K 17/0022 arrangements or provisious for transferring data to distant stations, e.g. from a sensing device "transfer between computer elements G06F13/00 "; data-transmission H04L
• CPC Class Codes: G06K 7/0008 General problems related to the reading of electronic memory record carriers, independent of its reading method, e.g. power transfer
• CPC Class Codes: G06K 7/10049 binary tree
• CPC Class Codes: H04L 2209/30 Compression, e.g. Merkle-Damgard construction
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Security and privacy of tag information in an RFID-based system can be achieved through the usage of pseudonyms generated based on one-way hash functions. A system based on binary one-way trees allows for the scalable generation and decoding of authentication keys to obtain access to tag identities. The apparatus and methods described can also be adapted to provide limited access for readers to tag information.

Claims

1. A method of operating a radio-frequency identification system, the system including a tag, a reader and a third party authority, wherein the tag has a tag name, the tag name comprising a tag identity and a secret value, wherein the secret value is mapped to the tag identity, the method comprising the steps of:

(i) the reader interrogating the tag,

(ii) the tag sending in response a pseudonym, the pseudonym comprising the tag identity and an encryption of the secret value,

(iii) the reader sending a request to the third party authority for release of a decryption key, the request including the pseudonym received from the tag,

(iv) the third party authority, having determined that the reader is authorised to receive the decryption key, sending to the reader the decryption key, and

(v) the reader using the decryption key to obtain the tag identity, wherein the decryption key can be used by the reader to obtain the tag identity a predetermined plurality of times without further contact between the reader and the third party authority.

2. A method according to claim 1, wherein the pseudonym sent in step (ii) changes in response to each interrogation by the reader.

3. A method according to claim 1, wherein in step (ii) the secret value is encrypted using a one-way hash function.

4. A method according to claim 3 wherein in step (ii) the secret value is encrypted using plural one-way hash functions.

5. A method according to claim 4 wherein the pseudonym is part of a one-way hash tree.

6. A method according to claim 5 wherein the decryption key is part of a one-way hash tree.

7. A method according to claim 6 wherein the response of the tag in step (ii) further includes locational information describing the location of the decryption key within the one-way hash tree.

9. Apparatus for use in a method of operating a radio-frequency identification system 0 according to claim 1.

10. A radio-frequency identification transponder for use in a method of operating a radio-frequency identification system according to claim 1.

11. A system to perform the method of operating a radio-frequency identification system according to claim 1.

8. A method of operating a radio-frequency identification system, the system including a tag, a reader and a third party authority, wherein the tag has a tag name, the tag name comprising a tag identity and a secret value, wherein the secret value is mapped to the tag identity, the method comprising the steps of:

(i) the reader interrogating the tag,

(ii) the tag sending to the reader in response, locational information describing the location of a decryption key within a one-way hash tree, 0

(iii) the reader sending a request to the third party authority for release of a decryption key, the request including the locational information received from the tag,

(iv) the third party authority, having determined that the reader is authorised to receive the decryption key, sending to the reader the decryption key, and

(v) the reader using the decryption key to obtain the tag identity, 5 wherein the decryption key can be used by the reader to obtain the tag identity a predetermined plurality of times without further contact between the reader and third party authority.