EPID attestation using RFID
View Patent ↗Technologies for verification include storage with private keys, wherein each private key is associated with a group affiliation. The storage also includes characteristic information about an apparatus. The technologies also include a wireless interface configured to receive a request from a reader for verification of membership of the apparatus within a group affiliation. The technologies further include a controller with programmable logic for configuring the controller to determine whether to verify membership of the apparatus within a given group affiliation. The controller is also configured to verify membership of the apparatus within the given group affiliation by signing data with a private key associated with the given group affiliation. The signed data is sent to the reader. Membership within the given group affiliation conveys a subset of the characteristic information.
1. An apparatus, comprising:
a storage including:
a plurality of private keys, each private key associated with a respective group affiliation of which the apparatus is a member; and
a plurality of characteristic information associated with the apparatus;
a wireless interface configured to receive a request from a reader for verification of membership of the apparatus within one of the group affiliations; and
a controller including programmable logic for configuring the controller to:
determine whether to verify membership of the apparatus within a first group affiliation;
verify membership of the apparatus within the first group affiliation by signing data with a first private key, the first private key associated with the first group affiliation, wherein membership within the first group affiliation is configured to convey a subset of the characteristic information; and
send the signed data to the reader.
2. The apparatus of claim 1 , wherein:
the wireless interface is further configured to receive an additional request from the reader for verification of membership of the apparatus within another one of the group affiliations; and
the controller is further configured to:
determine whether to verify membership of the apparatus within any second group affiliations; and
ignore the additional request based upon a determination that the apparatus is not a member of any second group affiliations to be reported to the reader.
3. The apparatus of claim 1 , wherein:
the signed data is configured to be verified by a public key, the public key a counterpart to the first private key; and
the public key is configured to verify a plurality of private keys configured to denote membership in the first group affiliation by respective members of the first group affiliation.
4. The apparatus of claim 1 , wherein the first private key is unique to the apparatus.
5. The apparatus of claim 1 , wherein membership in the first group affiliation is verifiable by the first private key and by a second private key, the first private key different from the second private key.
6. The apparatus of claim 1 , wherein:
signing the data with the first private key verifies membership of the apparatus within the first group affiliation and in a second group affiliation;
the first group affiliation is a subset of the second group affiliation;
the signed data is configured to be verified by a public key, the public key a counterpart to the first private key; and
the public key is configured to verify that the signed data correctly identifies membership in the first group affiliation.
7. The apparatus of claim 1 , wherein:
signing the data with the first private key verifies membership of the apparatus within the first group affiliation and in a second group affiliation;
the first group affiliation is a subset of the second group affiliation;
the signed data is configured to be verified by a first public key, the first public key a counterpart to the first private key;
the first public key is configured to verify the signed data correctly identifies membership in the first group affiliation;
the signed data is further configured to be verified by a second public key; and
the second public key is configured to verify that the signed data correctly identifies membership in the second group affiliation.
8. The apparatus of claim 1 , wherein the controller is further configured to refuse to verify membership of the apparatus within any group affiliation based on a security evaluation of the reader.
9. The apparatus of claim 1 , wherein the controller is configured to identify the first private key from the plurality of private keys based upon a determination to share the subset of the characteristic information with the reader.
10. The apparatus of claim 1 , wherein the wireless interface includes a radio-frequency identification (RFID) circuit.
11. The apparatus of claim 1 , wherein the private keys are Enhanced Privacy Identification (EPID) keys.
12. The apparatus of claim 1 , wherein the programmable logic of the controller is embodied in one or more of:
instructions in a memory for execution by a processor;
an Application-Specific Integrated Circuit (ASIC); or
a Field-Programmable Gate Array (FPGA).
13. At least one non-transitory machine-readable medium, comprising instructions for execution on a processor, the instructions, when loaded and executed by the processor, cause the processor to:
receive a request from a reader through a wireless interface, wherein:
the request is for verification of membership of an apparatus within one of a plurality of group affiliations of which the apparatus is a member;
the apparatus includes a plurality of characteristic information associated with the apparatus;
determine whether to verify membership of the apparatus within a first group affiliation;
verify membership of the apparatus within the first group affiliation by signing data with a first private key, the first private key associated with the first group affiliation; and
send the signed data to the reader;
wherein membership within the first group affiliation is configured to convey a subset of the characteristic information.
14. The medium of claim 13 , wherein:
the signed data is configured to be verified by a public key, the public key a counterpart to the first private key; and
the public key is configured to verify a plurality of private keys configured to denote membership in the first group affiliation by respective members of the first group affiliation.
15. The medium of claim 13 , wherein:
signing the data with the first private key verifies membership of the apparatus within the first group affiliation and in a second group affiliation;
the first group affiliation is a subset of the second group affiliation;
the signed data is configured to be verified by a first public key, the first public key a counterpart to the first private key;
the first public key is configured to verify the signed data correctly identifies membership in the first group affiliation;
the signed data is further configured to be verified by a second public key; and
the second public key is configured to verify that the signed data correctly identifies membership in the second group affiliation.
16. The medium of claim 13 , further comprising instructions for causing the processor to identify the first private key from the plurality of private keys based upon a determination to share the subset of the characteristic information with the reader.