Radio frequency identification (RFID) based authentication methodology using standard and private frequency RFID tags

• US 8,176,323 B2
• Filed: 07/11/2008
• Issued: 05/08/2012
• Est. Priority Date: 07/11/2008
• Status: Active Grant

• Current Assignee: Taiwan Semiconductor Manufacturing Company Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Anemikos, Theodoros, Fetterolf, Shawn P., McPadden, Adam J.
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US12/171,621
• Publication Number:
  US 20100011212A1
• Time in Patent Office: 1,397 Days
• Field of Search: 713/168, 713/171, 713/185, 380/270, 380/277, 726/9
• US Class Current: 713/168
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

Disclosed is a self-contained hardware-based authentication system that incorporates different authentication protocols for access to soft and/or hard assets with different security levels. The system embodiments include the use of a RFID device that comprises dual RFID tags operating under different frequencies. Specifically, one RFID tag operates on a public frequency and, when activated, transmits an identifier encrypted using a public key. The other RFID tag operates on a private frequency and, when activated, transmits a private key that can be used to decrypt the encrypted identifier. Upon receipt by a processor (e.g., a local processor or security server) of a request for access to a specific asset, a security level for the specific asset is determined. Then, depending upon the particular security level (e.g., low, medium or high) different authentication protocols are instituted using the RFID device. Also disclosed are embodiments of an associated authentication methodology.

Claims

1. A radio frequency identification (RFID) authentication system comprising:

a RFID device comprising;

a first RFID tag comprising;

a first integrated circuit device storing an encrypted identifier for a specific user, said encrypted identifier encrypted with a public key; and

a first RFID tag antenna connected to said first integrated circuit device, said first RFID tag antenna transmitting said encrypted identifier, when activated; and

a second RFID tag comprising;

a second integrated circuit device storing a private key; and

a second RFID tag antenna connected to said second integrated circuit device, said second RFID tag antenna transmitting said private key, when activated,

said first RFID tag antenna operating at a first radio frequency and said second RFID tag antenna operating at a second radio frequency different from said first radio frequency and having restricted use relative to said first radio frequency; and

a RFID reader comprising a first RFID reader antenna for activating said first RFID tag antenna and second RFID reader antenna for activating said second RFID tag antenna.

2. The radio frequency identification (RFID) authentication system of claim 1, further comprising a security server in communication with and controlling said RFID reader, said security server comprising a first database storing security levels associated with different assets, said security server further receiving a request, by said specific user, for access to a specific asset and accessing said first database to determine a security level associated with said specific asset.

3. The radio frequency identification (RFID) authentication system of claim 2, said security server further comprising a second database storing said encrypted identifier encrypted with said public key and said security server further performing a first level of user authentication by causing said first RFID tag antenna to be activated by said first RFID reader antenna and comparing said encrypted identifier as stored by said second database and said encrypted identifier as transmitted by said first RFID tag antenna.

4. The radio frequency identification (RFID) authentication system of claim 3, said security server further performing one of the following:

denying said specific user access to all of said assets when said encrypted identifier as stored by said second database and said encrypted identifier as transmitted by said first RFID tag antenna are not identical; and

allowing said specific user access to said specific asset, when said encrypted identifier as stored by said second database and said encrypted identifier as transmitted by said first RFID tag antenna are identical and when said security level comprises a low security level.

5. The radio frequency identification (RFID) authentication system of claim 3, said security server further comprising a third database storing an unencrypted identifier for said specific user, said security server further performing a second level of user authentication by causing said second RFID tag antenna to be activated by said second RFID reader antenna, decrypting said encrypted identifier with said private key so as to generate a decrypted identifier for said specific user, and comparing said decrypted identifier to said unencrypted identifier, when said security level is greater than said low security level.

6. The radio frequency identification (RFID) authentication system of claim 5, said security server further performing one of the following:

denying said specific user access to all of said assets, when said decrypted identifier and said unencrypted identifier are not identical; and

allowing said specific user access to said specific asset, when said decrypted identifier and said unencrypted identifier are identical and when said security level comprises a medium security level.

7. The radio frequency identification (RFID) authentication system of claim 5, further comprising a user interface, said security server further performing a third level of user authentication by prompting said specific user to enter said unencrypted identifier and comparing said unencrypted identifier as entered by said specific user through said user interface with said unencrypted identifier as stored by said third database, when said security level comprises a high security level.

8. The radio frequency identification (RFID) authentication system of claim 7, said security server further performing one of the following:

denying said specific user access to all of said assets, when said unencrypted identifier as entered by said specific user through said user interface and said unencrypted identifier as stored by said third database are not identical; and

allowing said specific user access to said specific asset, when said unencrypted identifier as entered by said specific user through said user interface and said unencrypted identifier as stored by said third database are identical.

9. A radio frequency identification (RFID) authentication method comprising:

receiving a request by a specific user for access to a specific asset, said specific user having a RFID device, said RFID device comprising;

a first RFID tag comprising;

a first integrated circuit device storing an encrypted identifier for said specific user, said encrypted identifier encrypted with a public key; and

a first RFID tag antenna connected to said first integrated circuit device, said first RFID tag antenna transmitting said encrypted identifier, when activated; and

a second RFID tag comprising;

a second integrated circuit device storing a private key; and

a second RFID tag antenna connected to said second integrated circuit device, said second RFID tag antenna transmitting said private key, when activated;

determining a security level associated with said specific asset; and

depending upon said security level, performing at least one level of user authentication using said RFID device.

10. The method of claim 9, said determining of said security level comprising accessing a first database storing said security level for said specific asset.

11. The method of claim 9, said performing of at least one level of user authentication comprising performing a first level of user authentication when said security level comprises one of a low security level, a medium security level and a high security level, said performing of said first level of user authentication comprising:

causing a first RFID reader antenna of a RFID reader to activate said first RFID tag antenna in order to receive said encrypted identifier;

accessing a second database storing said encrypted identifier for said specific user; and

comparing said encrypted identifier as transmitted by said first RFID tag antenna with said encrypted identifier as stored in said second database.

12. The method of claim 11, said performing of said first level of user authentication further comprising one of the following:

denying said specific user access to all of said assets when said encrypted identifier as stored by said second database and said encrypted identifier as transmitted by said first RFID tag antenna are not identical; and

allowing said specific user access to said specific asset, when said encrypted identifier as stored by said second database and said encrypted identifier as transmitted by said first RFID tag antenna are identical and when said security level comprises a low security level.

13. The method of claim 11, said performing of said at least one level of user authentication further comprising performing a second level of user authentication when said security level comprises one of said medium security level and said high security level, said performing of said second level of user authentication comprising:

causing a second RFID reader antenna of said RFID reader to activate said second RFID tag antenna in order to receive said private key;

decrypting said encrypted identifier with said private key so as to generate a decrypted identifier for said specific user;

accessing a third database storing an unencrypted identifier for said specific user; and

comparing said decrypted identifier to said unencrypted identifier.

14. The method of claim 13, said performing of said second level of user authentication further comprising one of the following:

denying said specific user access to all of said assets, when said decrypted identifier and said unencrypted identifier are not identical; and

allowing said specific user access to said specific asset, when said decrypted identifier and said unencrypted identifier are identical and when said security level comprises said medium security level.

15. The method of claim 13, said performing of at least one level of user authentication further comprising performing a third level of user authentication when said security level comprises said high security level, said performing of said third level of user authentication comprising:

prompting said specific user to enter said unencrypted identifier through a user interface; and

comparing said unencrypted identifier as entered through said user interface with said unencrypted identifier as stored in said third database.

16. The method of claim 15, said performing of said third level of user authentication further comprising one of the following:

denying said specific user access to all of said assets, when said unencrypted identifier as entered by said specific user through said user interface and said unencrypted identifier as stored by said third database are not identical; and

allowing said specific user access to said specific asset, when said unencrypted identifier as entered by said specific user through said user interface and said unencrypted identifier as stored by said third database are identical.

17. A non-transitory computer usable medium having computer usable program code embodied therewith, said computer program code being readable by a computerized device and causing said computerized device to execute a method for performing radio frequency identification (RFID) authentication, said method comprising:

receiving a request by a specific user for access to a specific asset, said specific user having a RFID device, said RFID device comprising;

a first RFID tag comprising;

a first integrated circuit device storing an encrypted identifier for said specific user, said encrypted identifier encrypted with a public key; and

a first RFID tag antenna connected to said first integrated circuit device, said first RFID tag antenna transmitting said encrypted identifier, when activated; and

a second RFID tag comprising;

a second integrated circuit device storing a private key; and

a second RFID tag antenna connected to said second integrated circuit device, said second RFID tag antenna transmitting said private key, when activated;

determining a security level associated with said specific asset; and

depending upon said security level, performing at least one level of user authentication using said RFID device.

18. The non-transitory computer usable medium of claim 17, said determining of said security level comprising accessing a first database listing security levels for specific assets.

19. The non-transitory computer usable medium of claim 17, said performing of said at least one level of user authentication comprising performing a first level of user authentication when said security level comprises one of a low security level, a medium security level and a high security level, said performing of said first level of user authentication comprising:

causing a first RFID reader antenna of a RFID reader to activate said first RFID tag antenna in order to receive said encrypted identifier;

accessing a second database storing said encrypted identifier for said specific user; and

comparing said encrypted identifier as transmitted by said first RFID tag antenna with said encrypted identifier as stored in said second database.

20. The non-transitory computer usable medium of claim 19, said performing of said first level of user authentication further comprising one of the following:

denying said specific user access to all of said assets when said encrypted identifier as stored by said second database and said encrypted identifier as transmitted by said first RFID tag antenna are not identical; and

allowing said specific user access to said specific asset, when said encrypted identifier as stored by said second database and said encrypted identifier as transmitted by said first RFID tag antenna are identical and when said security level comprises a low security level.

21. The non-transitory computer usable medium of claim 19, said performing of said at least one level of user authentication further comprising performing a second level of user authentication when said security level comprises one of said medium security level and said high security level, said performing of said second level of user authentication comprising:

causing a second RFID reader antenna of said RFID reader to activate said second RFID tag antenna in order to receive said private key;

decrypting said encrypted identifier with said private key so as to generate a decrypted identifier for said specific user;

accessing a third database storing an unencrypted identifier for said specific user; and

comparing said decrypted identifier to said unencrypted identifier.

22. The non-transitory computer usable medium of claim 21, said performing of said second level of user authentication further comprising one of the following:

denying said specific user access to all of said assets, when said decrypted identifier and said unencrypted identifier are not identical; and

allowing said specific user access to said specific asset, when said decrypted identifier and said unencrypted identifier are identical and when said security level comprises said medium security level.

23. The non-transitory computer usable medium of claim 21, said performing of said at least one level of user authentication further comprising performing a third level of user authentication when said security level comprises said high security level, said performing of said third level of user authentication comprising:

prompting said specific user to enter said unencrypted identifier through a user interface; and

comparing said unencrypted identifier as entered through said user interface with said unencrypted identifier as stored in said third database.

24. The non-transitory computer usable medium of claim 23, said performing of said third level of user authentication further comprising one of the following:

denying said specific user access to all of said assets, when said unencrypted identifier as entered by said specific user through said user interface and said unencrypted identifier as stored by said third database are not identical; and

allowing said specific user access to said specific asset, when said unencrypted identifier as entered by said specific user through said user interface and said unencrypted identifier as stored by said third database are identical.