Method and apparatus for providing security in a radio frequency identification system

• US 8,204,225 B2
• Filed: 12/31/2007
• Issued: 06/19/2012
• Est. Priority Date: 07/23/2007
• Status: Active Grant

• Current Assignee: Savi Technology Incorporated
• Original Assignee: Savi Technology Incorporated
• Inventors: Evans, Allan M., Zhu, Liping Julia, Shiledar, Devendra, Stough, Stephen Alan, Balabine, Igor V., Cargonja, Nikola
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US11/967,907
• Publication Number:
  US 20090028334A1
• Time in Patent Office: 1,632 Days
• Field of Search: 380/270, 380/277, 340/572
• US Class Current: 380/270
• CPC Class Codes: G06K 19/0723 the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

One aspect involves a communication that contains a portion encrypted with a selected key can be wirelessly transmitted by a part for reception and decryption by plural tags. A different aspect involves a tag receiving a first sequence of wireless communications that each contain sequencing information regarding the first sequence, while receiving a second sequence of wireless communications that each include sequencing information regarding the second sequence, and further involves monitoring the sequencing information from received communications of the first sequence while separately monitoring the sequencing information from received communications of the second sequence.

Claims

1. A radio frequency identification (RFID) system, comprising:

a plurality of RFID tags; and

at least one RFID interrogator, wherein the at least one RFID interrogator comprises;

a transmitter configured to wirelessly transmit an interrogation communication to the plurality of tags at a predetermined carrier frequency;

a receiver configured to receive a response frequency from the plurality of tags at the predetermined carrier frequency; and

a memory, the memory storing a firmware module, the firmware module including a security shim, wherein;

the security shim is configured to encrypt at least a portion of the interrogation communication with a first key, the first key being randomly generated for each transmitted communication;

the security shim is configured to encrypt the first key with a second key corresponding to a private key stored in a memory of at least one of the plurality of tags; and

the transmitter is further configured to transmit the interrogation communication including the at least one encrypted portion and the encrypted first key.

2. The system according to claim 1, wherein the encrypted portion of the interrogation communication includes a command for at least one of the plurality of tags.

3. The system according to claim 1, wherein the at least one tag storing the private key can receive said encrypted interrogation communication and decrypt said encrypted portion thereof with said private key.

4. The system according to claim 3, wherein a plurality of the tags lack possession of the private key.

5. The system according to claim 1, wherein said interrogation communication conforms to a communications protocol, and has a payload that includes said encrypted portion.

6. The system according to claim 5, wherein said communications protocol is ISO 18000-7.

7. A method of operating a tag, comprising:

receiving a first sequence of wireless communications that each contain encrypted information and sequencing information regarding said first sequence while receiving a second sequence of wireless communications that each include encrypted information and sequencing information regarding said second sequence, using a single transceiver operating at a fixed carrier frequency to receive said first and second sequences; and

monitoring said sequencing information from received communications of said first sequence while separately monitoring said sequencing information from received communications of said second sequence, the monitoring comprising;

comparing a first sequence number associated with the first sequence with a second sequence number associated with the second sequence;

determining that an error has occurred if the second sequence number is less than or equal to the first sequence number;

calculating, by the tag, an authentication checksum;

comparing the calculated authentication checksum with a predetermined authentication checksum associated with the first sequence and the second sequence; and

decrypting the encrypted information associated with the first sequence and the second sequence if the calculated authentication checksum is equal to the predetermined authentication checksum and no error is determined by comparing the first sequence number and the second sequence number.

8. A method according to claim 7, including transmitting said first and second sequences from respective different sources.

9. A method according to claim 7, including:

transmitting said first sequence from a first interrogator; and

transmitting said second sequence from a second interrogator different from said first interrogator.

10. A method according to claim 7, wherein said monitoring of each said sequence further comprises identifying a situation in which a received communication of that sequence is a duplicate of a previously-received communication of that sequence.