RFID Intrusion Protection System and Methods

• US 20090021343A1
• Filed: 05/10/2006
• Published: 01/22/2009
• Est. Priority Date: 05/10/2006
• Status: Abandoned Application

• Current Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Sinha, Amit
• Application Number:
  US11/382,590
• Publication Number:
  US 20090021343A1
• Time in Patent Office: Days
• US Class Current: 340/5.200
• CPC Class Codes: H04K 2203/20 for contactless carriers, e.g. RFID carriers record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04K 3/43 characterized by the control of the jamming power, signal-to-noise ratio or geographic coverage area
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04W 12/08 Access security

Abstract

Systems and methods for RFID intrusion protection are defined. The system uses RFID sensors coupled with one or more servers to detect unauthorized scanning or programming of RFID tags. The system has active defense mechanisms to block unauthorized communications between a rogue RFID reader and one or more tags. Special IPS tags implement active defenses and log activity for tags that are not within the protected perimeter or in transit.

Claims

1. A method for monitoring radio frequency identification (RFID) networks for intrusion and policy violations with RFID sensors, the method comprising the steps of:

a) setting configuration and policy information;

b) scanning for RFID transmissions;

c) logging statistics to a data store over a set time interval;

d) determining the existence of intrusions or policy violations;

e) generating an alarm responsive to any of intrusions and policy violations; and

f) repeating steps b) through, d).

2. The method of claim 1, further comprising the step of signaling an intrusion protection server responsive to an intrusion and policy violation.

3. The method of claim 1, further comprising the step of updating the statistics and events in the data store on an intrusion protection server responsive to any of the end Of a statistics interval and a request from the server.

4. The method, of claim 1, further comprising the step of receiving configuration and policy updates from the server.

5. The method of claim 1, wherein steps a) through e) are performed by RFID sensors, RFID readers/sensors, and combinations thereof physically distributed throughout an RFID infrastructure.

6. The method of claim 2, further comprising the step of activating defenses responsive to any of intrusions and policy violations.

7. The method of claim 6, wherein the defenses comprise jamming the RFID channel, spoofing RFID tag responses, and combinations thereof.

8. The method of claim 7, wherein the jamming comprises transmitting a jamming signal at adjustable power to disrupt RFID communications.

9. The method of claim 7, wherein the spooling comprises transmitting a spoofed signal configured to mislead an RFID reader.

10. The method of claim 1, further comprising the step of generating an alarm responsive to any of protocol abuse and anomalous behavior.

11. A radio frequency identification (RFID) sensor, the sensor comprising:

an antenna configured, to receive and transmit wireless transmissions of signals in an adjustable range of frequencies;

memory capable of storing received data and program data;

a system processor comprising one or more processing elements, wherein the system processor is in communication with the antenna and the memory and wherein the system processor'"'"'s one or more processing elements are programmed or adapted to;

i) extract RFID data into one or more logical, units from signals received by the antenna;

ii) inspect each extracted logical unit;

iii) store information derived from the inspection of each logical unit in memory; and

iv) communicate the information to a server.

12. The sensor of claim 11, further comprising a communications interface configured to communicate with an intrusion protection server, wherein the communications interface transmits information to the server and receives policy and configuration updates from the server.

13. The sensor of claim 12, wherein the communications interface is a secure interface comprising any of an Ethernet port and a wireless local area network interlace.

14. The sensor of claim 12, wherein the system processor is further programmed or adapted to detect RFID readers interrogating RFID tags based on the information, and signal the server responsive to foe detection of an RFID reader.

15. The sensor of claim 14, wherein the sensor is configured to transmit a jamming signal to disrupt RFID communications and a spoofing signal to confuse RFID readers responsive to any of a detection of an RFID reader, a policy violation, an intrusion, and a request from the server.

16. The sensor of claim 11, wherein the system processor is further programmed or adapted to interrogate RFID tags.

17. The sensor of claim 12, further comprising a user interface accessible through any of a screen on the sensor and a network connection through the communications interface.

18. A server-based method for monitoring radio frequency identification (RFID) networks for intrusion and policy violations, the method comprising the steps of:

a) obtaining configuration and policy information;

b) establishing communication with a plurality of RFID sensors;

e) receiving events from the plurality of RFID sensors;

d) correlating events from the plurality of RFID sensors;

e) generating an alarm responsive to the correlating step; and

f) repeating steps c) through e)

19. The method of claim 18, wherein the obtaining step comprises either manually or automatically receiving configuration information torn the RFID infrastructure, the RFID infrastructure comprises any of RFID sensors, RFID readers, RFID sensors, and combinations thereof.

20. The method of claim 19, wherein configuration information comprises any of authorized readers, protocols, sensor locations, reader locations, network settings, statistics intervals, and combinations thereof.

21. The method of claim 19, wherein policy information comprises any of system usage time, tag lock policy, tag kill policy, tag write policy, query thresholds, defense activation conditions, and combinations thereof.

22. The method of claim 18, wherein the receiving step comprises receiving any of statistics, events, network configuration information, policy information, and combinations thereof.

23. The method of claim 22, wherein the correlating step comprises analyzing events and statistics from the plurality of RFID sensors to determine policy violations, anomalous behavior, protocol abuse, and combinations thereof.

24. The method of claim 18, further comprising the step of activating a defense responsive to generating an alarm, the defense comprising any of a jamming defense, a spoofing defense, and RFID tag quiet mode.

25. The method of claim 24, wherein the activating step comprises directing one or more RFID sensors to implement the defense.

26. The method of claim 18, further comprising the step of storing events and alarms in a data store.

27. The method of claim 23, further comprising the step of locating the location of an RFID reader based on the correlated events.

28. The method of claim 18, wherein the alarms are generated through one of SNMP traps, syslog messages, email, and SMS.

29. The method of claim 18, further comprising the steps of communicating events and alarms to a master server.

30. A radio frequency identification (RFID) intrusion protection system, the system comprising:

a local intrusion protection server connected to a network;

a data store connected to the server;

wherein, the server is configured to;

establish communications with a plurality of RFID sensors connected to the network;

obtain configuration and policy from the network and RFID infrastructure connected to the network;

receive events and statistics from the plurality of RFID sensors;

store events and statistics in the data store; and

correlate events to identify RFID readers, policy violations, and intrusions.

31. The system of claim 30, further comprising a master intrusion protection server connected through the network to one or more local intrusion protection servers, wherein the master server is configured to perform the functions of the one or more local servers and store events and statistics from the one or more local servers.

32. A tag-based method of intrusion protection for radio frequency identification (RFID) networks, the method comprising the steps of:

initializing an intrusion protection RFID tag; and

activating a defense responsive to the RFID signature, the defense comprising one of a jamming signal and a collision signal.

33. The method of claim 32, wherein die initializing step comprises one of peeling a sticker off the tag, turning the tag on, and adding a battery to the tag.

34. The method of claim 32, further comprising the step of logging RFID activity in local memory.

35. The method of claim 34, further comprising the step of synchronizing with a server, wherein synchronizing comprises sending the local memory to the server.

36. The method of claim 32, wherein the jamming signal defense comprises transmitting a signal to block all RFID communications in the vicinity of the intrusion protection RFID tag, wherein the jamming signal can be transmitted at adjustable power.

37. The method of claim 32, wherein the collision signal defense comprises transmitting a signal in response to any RFID interrogation to confuse an RFID reader.

38. The method of claim 32, wherein the activating step is performed responsive to an unauthorised RFID signature, the unauthorized RFID signature is detected by the intrusion protection RFID tag responsive to a preconfigured policy.

39. An intrusion protection, radio frequency Identification (RFID) tag configured to protect RFID tags located substantially in the same vicinity as the intrusion protection RFID tag, the tag comprises:

an antenna configured to transmit and receive RFID communications at a set frequency, the frequency responsive to the RFID protocol;

a processor coupled to the antenna, the processor configured to;

detect RFID signatures; and

transmit a jamming or a collision signal responsive to an RFID signature.

40. The tag of claim 39, further comprising local memory configured to store RFID events and statistics, and local power.

41. The tag of claim 39, wherein the processor is powered based on backscatter power received from the antenna responsive to an RFID query.