Security provision in standards-compliant RFID systems
View Patent ↗Enhanced security is provided in an RFID system comprising a plurality of RFID devices and at least one reader which communicates with one or more of the devices. In one aspect of the invention, a first command is transmitted from the reader to write a first data unit to a memory of given one of the RFID devices. A reply is received in the reader from the given RFID device indicating that a second data unit determined based on contents of the first data unit is available in the memory to be accessed by the reader. A second command is transmitted from the reader to the given RFID device to allow the reader to read the memory to thereby obtain the second data unit. The first and second data units comprise information exchanged as part of a cryptographic protocol carried out between the reader and the given RFID device. In an illustrative embodiment, the cryptographic protocol may comprise a challenge-response authentication protocol.
1. A method for use in an RFID system comprising a plurality of RFID devices and at least one reader which communicates with one or more of the devices, the method comprising the steps of:
transmitting a first command from the reader to write a first data unit to a memory of a given one of the RFID devices;
receiving a reply in the reader from the given RFID device indicating that a second data unit determined based on contents of the first data unit is available in the memory to be accessed by the reader; and
transmitting a second command from the reader to the given RFID device to allow the reader to read the memory to thereby obtain the second data unit;
wherein the first and second data units comprise information exchanged as part of a cryptographic protocol carried out between the reader and the given RFID device; and
wherein the second command is transmitted to the given RFID device responsive to receipt of the reply from the given RFID device.
2. The method of claim 1 wherein the given RFID device comprises an electronic product code (EPC) tag.
3. The method of claim 2 wherein the EPC tag comprises a Class-1 Gen-2 EPC tag.
4. The method of claim 1 wherein the reply received in the reader indicating that a second data unit is available in the memory to be accessed by the reader comprises a reply of the reader to a successful BlockWrite command as defined in the EPCglobal Class-1 Gen-2 standard.
5. The method of claim 1 wherein the reader reads the memory by receiving a second reply containing the second data unit.
6. The method of claim 1 wherein the first command indicates that the first data unit should be written to a first designated location in the memory of the given one of the RFID devices.
7. The method of claim 6 wherein the second command indicates that the second data unit should be read from a second designated location in the memory of the given RFID device.
8. The method of claim 1 wherein the first and second data units are stored in a common designated location starting with a specified word in a specified bank of a multi-bank memory of the given RFID device.
9. The method of claim 1 wherein the cryptographic protocol carried out between the reader and the given RFID device comprises a challenge-response authentication protocol.
10. The method of claim 9 wherein the first data unit comprises a challenge value of the challenge-response authentication protocol.
11. The method of claim 9 wherein the second data unit comprises a response value of the challenge-response authentication protocol.
12. The method of claim 11 further including the step of authenticating the given RFID device based on the response value.
13. The method of claim 9 wherein an implied challenge value of the challenge-response protocol is determined by the given RFID device based on a current value of at least one of a real-time clock and a counter.
14. The method of claim 13 wherein the first data unit comprises information associated with a request by the reader for a one-time password from the given RFID device and the second data unit comprises a one-time password generated by the given RFID device responsive to the request.
15. The method of claim 1 wherein the first and second data units comprise application protocol data units configured in accordance with an ISO 7816 protocol.
16. The method of claim 1 wherein at least one of the application protocol data units configured in accordance with the ISO 7816 protocol comprises a command transmitted in a compressed format which includes a header indicating presence or absence of one or more of a command class byte, a command instruction byte and a command parameters byte.
17. The method of claim 3 wherein the first and second commands comprise one of the following:
(i) respective BlockWrite and Read commands of the EPCglobal Class-1 Gen-2 standard;
(ii) respective new commands defined in a manner compliant with the EPCglobal Class-1 Gen-2 standard but not part of that standard; and
(iii) respective custom commands defined in a manner compliant with the EPCglobal Class-1 Gen-2 standard but not part of that standard.
18. The method of claim 1 wherein the cryptographic protocol is carried out between the reader and the plurality of RFID devices, with the same first data unit being provided by the reader to each of the plurality of RFID devices, and multiple second data units being obtained individually by the reader from respective ones of the RFID devices.
19. An article of manufacture comprising a computer-readable storage medium storing one or more software programs which when executed by a processor implement the steps of the method of claim 1 .
20. An apparatus for use in an RFID system, the apparatus comprising:
a reader configured to communicate with one or more RFID devices of the system, the reader comprising a processor, a memory coupled to the processor, and interface circuitry coupled to the processor;
the reader being operative under control of the processor to transmit a first command to write a first data unit to a memory of a given one of the RFID devices, to receive a reply from the given RFID device indicating that a second data unit determined based on contents of the first data unit is available in the memory to be accessed by the reader, and to transmit a second command to the given RFID device to allow the reader to read the memory to thereby obtain the second data unit;
wherein the first and second data units comprise information exchanged as part of a cryptographic protocol carried out between the reader and the given RFID device; and
wherein the second command is transmitted to the given RFID device responsive to receipt of the reply from the given RFID device.
21. A method for use in an RFID system comprising a plurality of RFID devices and at least one reader which communicates with one or more of the devices, the method comprising the steps of:
transmitting a first command from the reader to a given one of the RFID devices;
receiving a reply in the reader from the given RFID device indicating that a data unit is available in the memory to be accessed by the reader; and
transmitting a second command from the reader to the given RFID device to allow the reader to read the memory to thereby obtain the data unit;
wherein the data unit comprises a response value of a challenge-response protocol carried out between the reader and the given RFID device; and
wherein the second command is transmitted to the given RFID device responsive to receipt of the reply from the given RFID device.
22. The method of claim 21 wherein a challenge value of the challenge-response protocol comprises an implied challenge value determined by the given RFID device.
23. A method for use in an RFID system comprising a plurality of RFID devices and at least one reader which communicates with one or more of the devices, the method comprising the steps of:
receiving a first command from the reader in a given one of the RFID devices, the first command being a command specified by an RFID standard; and
prior to execution of the first command, the given RFID device performing responsive to receipt of the first command a non-standard action not specified by the first command or any other command of the RFID standard;
wherein the first command comprises a kill command.
24. The method of claim 23 wherein the given RFID device comprises an EPC tag.
25. The method of claim 23 wherein the non-standard action comprises actuating a switch associated with the given RFID device.
26. The method of claim 23 wherein the non-standard action comprises actuating a visual marker associated with the given RFID device.
27. The method of claim 23 wherein the non-standard action comprises releasing information from circuitry associated with the given RFID device.
28. A method for use in an RFID system comprising a plurality of RFID devices and at least one reader which communicates with one or more of the devices, the method comprising the steps of:
receiving in a given one of the RFID devices a first command from the reader directing that a first data unit be written to a memory of the given RFID device;
transmitting a reply to the reader from the given RFID device indicating that a second data unit determined based on contents of the first data unit is available in the memory to be accessed by the reader; and
receiving a second command in the given RFID device from the reader to allow the reader to read the memory to thereby obtain the second data unit;
wherein the first and second data units comprise information exchanged as part of a cryptographic protocol carried out between the reader and the given RFID device;
wherein the reply is transmitted from the given RFID device responsive to receipt of the first command in the given RFID device.
29. An article of manufacture comprising a computer-readable storage medium storing one or more software programs which when executed by a processor implement the steps of the method of claim 28 .
30. An apparatus for use in an RFID system comprising a plurality of RFID devices and at least one reader which communicates with one or more of the devices, the apparatus comprising:
a given one of the RFID devices, the given RFID device comprising a processor, a memory coupled to the processor, and interface circuitry coupled to the processor;
the given RFID device being operative under control of the processor to receive a first command from the reader directing that a first data unit be written to a memory of the given RFID device, to transmit a reply to the reader indicating that a second data unit determined based on contents of the first data unit is available in the memory to be accessed by the reader, and to receive a second command from the reader to allow the reader to read the memory to thereby obtain the second data unit;
wherein the first and second data units comprise information exchanged as part of a cryptographic protocol carried out between the reader and the given RFID device;
wherein the reply is transmitted from the given RFID device responsive to receipt of the first command in the given RFID device.
31. The method of claim 1 wherein the first command indicates that the first data unit should be written to a designated location in the memory of the given one of the RFID devices and wherein the second command indicates that the second data unit should be read from the designated location in the memory of the given RFID device.