Enhanced RFID instrument security

• US 8,049,594 B1
• Filed: 05/25/2005
• Issued: 11/01/2011
• Est. Priority Date: 11/30/2004
• Status: Active Grant

• Current Assignee: Qualcomm FYX Incorporated (Qualcomm, Inc.)
• Original Assignee: Xatra Fund MX LLC (Intellectual Ventures LLC)
• Inventors: Baranowski, James A.
• Primary Examiner(s): Holloway, III; Edwin
• Application Number:
  US10/908,767
• Time in Patent Office: 2,351 Days
• Field of Search: 340/5.61, 340/5.62, 340/5.63, 340/10.1, 340/10.51, 340/572.1, 340/572.4, 380/270, 380/271, 380/272, 380/273, 713/169, 713/173, 713/175, 713/176, 713/180, 713/179
• US Class Current: 340/5.61
• CPC Class Codes: G06K 7/10257 arrangements for protecting the interrogation against piracy attacks computer security in general G06F21/00; jamming of communication, countermeasures H04K3/00; secret communication H04K1/00
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A system and method for using an RFID read/write device to secure an RFID-operable instrument or an RF communication is provided. The invention includes security databases in communication with a processor for storing and communicating security protocols to the RFID read/write device. The invention includes a method for restricting the unauthorized use of an RFID read/write device. The invention includes a subscription service for communicating user credentials to a certificate authority to obtain a counter security protocol. The invention also includes decrypting information stored on an RF-operable device or transmitted via radio-frequency using counter security protocols.

Claims

1. A method, comprising:

receiving, at an RFID read device, RFID tag information from an RFID tag, wherein the RFID tag information comprises a tag identification code and an encrypted tag authentication code, and wherein the RFID tag information comprises encrypted data that is encrypted according to a tag security protocol associated with the RFID tag;

decrypting, by the RFID read device, the encrypted tag authentication code using a decryption key to authenticate the RFID tag, wherein the decryption key is associated with the tag identification code, and wherein the RFID tag mutually authenticates the RFID reader; and

validating, by the RFID read device, the encrypted data received from the RFID tag by communicating with a tag processing service (TPS), wherein the encrypted data is decrypted using the tag security protocol maintained by the TPS, and wherein the validating is in response to the RFID read device authenticating the RFID tag.

2. The method of claim 1, wherein the tag security protocol is a counter security protocol.

3. The method of claim 1, further comprising applying a counter security protocol to decrypt the encrypted data from the RFID tag.

4. The method of claim 1, wherein the RFID read device is configured with global positioning system (GPS) capability to be operable in a predetermined area.

5. The method of claim 4, further comprising deactivating the RFID read device in response to the GPS capability indicating the RFID read device has moved outside of the predetermined area.

6. The method of claim 1, wherein the TPS is external to a system that operates the RFID read device.

7. The method of claim 1, wherein the decryption key is unique to the RFID tag.

8. The method of claim 1, wherein the encrypted data includes an encrypted payment account code.

9. The method of claim 1, further comprising communicating with the RFID tag using a communications security protocol distinct from the tag security protocol.

10. The method of claim 9, wherein the communications security protocol is an HTTPS protocol.

11. The method of claim 1, further comprising communicating with the TPS using a communications security protocol distinct from the tag security protocol.

12. The method of claim 1, wherein the encrypted data from the RFID tag is only read by the RFID read device in response to the tag security protocol being applied by at least one of the RFID read device or the TPS.

13. The method of claim 1, further comprising receiving, by the RFID read device, validated data from the TPS, wherein the TPS decrypts the decrypted data to generate the validated data, and wherein the tag security protocol is not delivered to the RFID read device.

14. A method, comprising:

receiving, by a tag processing service (TPS), a request from an RFID read device to validate encrypted data received by the RFID read device from an RFID tag, wherein the encrypted data is encrypted according to a tag security protocol associated with the RFID tag, and wherein the TPS receives the request in response to the RFID read device and the RFID tag mutually authenticating;

obtaining, by the TPS, the tag security protocol from a certificates database; and

transmitting validated data, from the TPS to the RFID read device, wherein the TPS generates the validated data from the encrypted data using the tag security protocol associated with the RFID tag.

15. The method of claim 14, further comprising authorizing the RFID read device with a digital certificate obtained from the certificates database, wherein a certificates authority stores security information in the certificates database.

16. The method of claim 15, further comprising providing a user credential from the certificate authority to the RFID read device.

17. The method of claim 14, further comprising providing the tag security protocol to the RFID read device in response to authorization of the RFID read device by the TPS.

18. The method of claim 14, further comprising validating a digital certificate from the RFID read device to authenticate the RFID read device.

19. The method of claim 14, wherein the tag security protocol is not revealed to the RFID read device.

20. The method of claim 14, wherein the tag security protocol comprises at least one of a Wired Equivalent Privacy (WEP) key, a Wi-Fi Protected Access (WPA) key, a WPA2 key, an HTTPS protocol, or Federal Information Processing Standards (FIPS) information.

21. The method of claim 14, wherein the tag security protocol comprises a combination security protocol.

22. An RFID read device including a tangible, non-transitory memory having instructions stored thereon that, in response to execution by the RFID read device, cause the RFID read device to perform operations comprising:

receiving, at the RFID read device, RFID tag information from an RFID tag, wherein the RFID tag information comprises a tag identification code and an encrypted tag authentication code, and wherein the RFID tag information comprises encrypted data that is encrypted according to a tag security protocol associated with the RFID tag;

decrypting, at the RFID read device, the encrypted tag authentication code using a decryption key to authenticate the RFID tag, wherein the decryption key is associated with the tag identification code, and wherein the RFID tag mutually authenticates the RFID reader; and

validating, at the RFID read device, the encrypted data received from the RFID tag by communicating with a tag processing service (TPS), wherein the encrypted data is decrypted using the tag security protocol maintained by the TPS, and wherein the validating is in response to the RFID read device authenticating the RFID tag.

23. An RFID read device, comprising:

a transponder configured to receive RFID tag information from an RFID tag, wherein the RFID tag information comprises a tag identification code and an encrypted tag authentication code, and wherein the RFID tag information comprises encrypted data that is configured to be encrypted according to a tag security protocol associated with the RFID tag; and

a processor configured to decrypt the encrypted tag authentication code using a decryption key to authenticate the RFID tag, wherein the decryption key is associated with the tag identification code, and wherein the RFID tag is configured to mutually authenticate the RFID reader;

wherein the processor is configured to validate the encrypted data received from the RFID tag by communicating with a tag processing service (TPS), wherein the encrypted data is configured to be decrypted using the tag security protocol maintained by the TPS, and wherein the processor is configured to validate the encrypted data in response to the RFID read device authenticating the RFID tag.

24. An RFID read device, comprising:

means for receiving, at the RFID read device, RFID tag information from an RFID tag, wherein the RFID tag information comprises a tag identification code and an encrypted tag authentication code, and wherein the RFID tag information comprises encrypted data that is encrypted according to a tag security protocol associated with the RFID tag;

means for decrypting, at the RFID read device, the encrypted tag authentication code using a decryption key to authenticate the RFID tag, wherein the decryption key is associated with the tag identification code, and wherein the RFID tag mutually authenticates the RFID reader; and

means for validating, at the RFID read device, the encrypted data received from the RFID tag by communicating with a tag processing service (TPS), wherein the encrypted data is decrypted using the tag security protocol maintained by the TPS, and wherein the validating is in response to the RFID read device authenticating the RFID tag.

25. A tag processing service (TPS) including a tangible, non-transitory memory having instructions stored thereon that, in response to execution by a computing device, cause the computing device to perform operations comprising:

receiving, by the TPS, a request from an RFID read device to validate encrypted data received by the RFID read device from an RFID tag, wherein the encrypted data is encrypted according to a tag security protocol associated with the RFID tag, and wherein the TPS receives the request in response to the RFID read device and the RFID tag mutually authenticating;

obtaining, by the TPS, the tag security protocol from a certificates database; and

transmitting validated data from the TPS to the RFID read device, wherein the TPS generates the validated data from the encrypted data using the tag security protocol associated with the RFID tag.

26. A tag processing service (TPS), comprising:

a network interface configured to receive a request from an RFID read device to validate encrypted data received by the RFID read device from an RFID tag, wherein the encrypted data is configured to be encrypted according to a tag security protocol associated with the RFID tag, and wherein the network interface is configured to receive the request in response to the RFID read device and the RFID tag mutually authenticating; and

a certificates database configured to store the tag security protocol;

wherein the network interface is configured to transmit validated data to the RFID read device, wherein the validated data is configured to be generated from the encrypted data using the tag security protocol associated with the RFID tag.

27. A tag processing service (TPS), comprising:

means for receiving, by the TPS, a request from an RFID read device to validate encrypted data received by the RFID read device from an RFID tag, wherein the encrypted data is encrypted according to a tag security protocol associated with the RFID tag, and wherein the TPS receives the request in response to the RFID read device and the RFID tag mutually authenticating;

means for obtaining, by the TPS, the tag security protocol from a certificates database; and

means for transmitting validated data from the TPS to the RFID read device, wherein the TPS generates the validated data from the encrypted data using the tag security protocol associated with the RFID tag.