RFID tag and reader authentication by trusted authority
A Radio Frequency Identification (RFID) reader containing a reader key authenticates an RFID tag containing a tag key by receiving a tag identifier from the tag; challenging the tag with a tag challenge; receiving a tag response based at least on the tag challenge and the tag key but not including the tag key; sending a second message including at least the tag identifier and the tag response to a verification authority; and receiving a reply from the verification authority. The reader and the verification authority may mutually authenticate each other before, during, or after the tag authentication process. The verification authority may notify a designated party if a response is incorrect.
1. A method for authenticating a Radio Frequency Identification (RFID) tag, the method comprising:
receiving a first identifier from the tag;
challenging the tag with a first challenge;
receiving, from the tag, a first response based on at least the first challenge and a first key contained in the tag;
identifying a verification authority for authenticating the first response;
authenticating the verification authority; and
sending a first message including at least the first identifier and the first response to the authenticated verification authority.
2. The method of claim 1 , wherein identifying the verification authority comprises at least one of:
determining a verification-authority identifier from at least one of the first identifier and the first challenge;
receiving the verification-authority identifier from the tag; and
retrieving the verification-authority identifier from a memory.
3. The method of claim 1 , wherein authenticating the verification authority comprises:
challenging the verification authority with a second challenge;
receiving, from the verification authority, a second response; and
authenticating the second response based on at least the second challenge and a second key associated with the verification authority.
4. The method of claim 1 , wherein authenticating the verification authority comprises at least one of:
verifying the authenticity of an electronically signed response from the verification authority; and
determining that the verification authority knows a shared state or data.
5. The method of claim 1 , wherein a reader component communicates with the tag and a remote component, separate from the reader component, identifies, authenticates, and communicates with the verification authority.
6. The method of claim 5 , further comprising authenticating at least one of the reader component and the remote component to the verification authority.
7. The method of claim 6 , wherein authenticating at least one of the reader component and the remote component to the verification authority comprises at least one of:
sending a response to a component challenge from the verification authority, the response based on a component key;
signing the first message with an electronic signature; and
indicating, to the verification authority, a shared state or data.
8. A Radio Frequency Identification (RFID) system configured to authenticate RFID tags, the system comprising:
an RFID reader configured to:
receive a first identifier from a tag;
challenge the tag with a first challenge; and
receive, from the tag, a first response based on at least the first challenge and a first key contained in the tag; and
a processor block configured to:
identify a verification authority for authenticating the first response;
authenticate the verification authority; and
send a first message including at least the first identifier and the first response to the authenticated verification authority.
9. The system of claim 8 , wherein the processor block is configured to identify the verification authority by at least one of:
determining a verification-authority identifier from at least one of the first identifier and the first challenge;
receiving the verification-authority identifier from the tag; and
retrieving the verification-authority identifier from a memory.
10. The system of claim 8 , wherein the processor block is configured to authenticate the verification authority by:
challenging the verification authority with a second challenge;
receiving, from the verification authority, a second response; and
authenticating the second response based on at least the second challenge and a second key associated with the verification authority.
11. The system of claim 8 , wherein the processor block is configured to authenticate the verification authority by:
verifying the authenticity of an electronically signed response from the verification authority; and
determining that the verification authority knows a shared state or data.
12. The system of claim 8 , wherein the processor block and the RFID reader are separate.
13. The system of claim 8 , wherein at least one of:
the RFID reader is further configured to authenticate itself to the verification authority; and
the processor block is further configured to authenticate at least one of the processor block and the RFID reader to the verification authority.
14. The system of claim 13 , wherein at least one of the RFID reader and the processor block is configured to at least one of:
sending a response to a third challenge from the verification authority, the response based on a third key associated with at least one of the processor block and the RFID reader;
signing the first message with an electronic signature; and
indicating, to the verification authority, a shared state or data.
15. A method for a Radio Frequency Identification (RFID) remote component to authenticate an RFID tag having a first identifier, the method comprising:
receiving, from an RFID reader component, the first identifier and a first response from the tag, the first response based on at least a first challenge sent to the tag and a first key contained in the tag;
identifying a verification authority for authenticating the first response;
authenticating the verification authority; and
sending a first message including at least the first identifier and the first response to the authenticated verification authority.
16. The method of claim 15 , wherein identifying the verification authority comprises at least one of:
determining a verification-authority identifier based on the first identifier;
receiving the verification-authority identifier from the tag;
determining the verification-authority identifier based on the RFID reader component; and
retrieving the verification-authority identifier from a memory.
17. The method of claim 15 , wherein authenticating the verification authority comprises:
challenging the verification authority with a second challenge;
receiving, from the verification authority, a second response; and
authenticating the second response based on at least the second challenge and a second key associated with the verification authority.
18. The method of claim 15 , wherein authenticating the verification authority comprises at least one of:
verifying the authenticity of an electronically signed response from the verification authority; and
determining that the verification authority knows a shared state or data.
19. The method of claim 15 , further comprising authenticating at least one of the reader component and the remote component to the verification authority.
20. The method of claim 19 , wherein authenticating at least one of the reader component and the remote component to the verification authority comprises at least one of:
sending a response to a component challenge from the verification authority, the response based on a component key;
signing the first message with an electronic signature; and
indicating, to the verification authority, a shared state or data.