Radio frequency identification (RFID) system that meets data protection requirements through owner-controlled RFID tag functionality

[0001] This application is a continuation application of, and claims priority to, International Application Number: PCT/DE2005/000648, filed on Apr. 13, 2005, the entire contents of which is hereby incorporated by reference.

[0002] This description relates to RFID (Radio Frequency Identification) systems and, in particular, to RFID systems that meet data protection requirements through owner-controlled RFID tag functionality.

[0003] RFID tags and the necessary infrastructure, such as, for example, readers, can be used for labeling objects. RFID tags can include a transmitting and receiving device with which the tag, among other things, can transmit a label (e.g., identification data) to a reader and can execute other functions ordered (i.e., “called”) by the reader as soon as an RFID tag is within effective range of the reader.

[0004] The label can serve for the identification of the RFID tags and thus identification of an object associated with the tag. In the near future these RFID tags may replace the barcodes used on many consumer products to simplify the logistics processes as well as the processes in the supermarket. For example, self-operating cash registers are planned since a shopping cart's contents provided with RFID tags can be completely scanned in one step.

[0005] Privacy issues exist with RFID technology. For example, because each RFID tag should bear a unique serial number, the path of each consumer product (e.g., each individual object) can be read out unnoticed, even after leaving the supermarket. Thus, people can be tracked with the aid of these serial numbers and in addition can be scanned by anyone with regard to all the products they are carrying with them (for example, their clothing). Should these data, as is at least to be feared, be collected, stored with the aid of databases, and evaluated, the scenario of “glass people” feared by data protection personnel and privacy activists may become a reality.

[0006] Previously, the industry countered this issue with a so-called kill function, in which the RFID tags, e.g., after the customer paid for the associated items at the supermarket, were permanently deactivated. Unfortunately, the permanent deactivation of the RFID tags prevents a number of applications. In particular, applications are affected that normally come into use only after the purchase of a product, such as, for example, an intelligent washing machine that automatically determines the washing temperature and program for washing clothes based on the identity of articles of clothing put into the washing machine, which identity can be determined based on the RFID tags associated with the clothing. RFID tags that make such a kill function available are described in the EPCglobal specifications, version 1.0, of the EPCglobal community, which is accessible at www dot epcglobal dot com.

[0007] The invention solves the described privacy problem of the previous RFID technology and at the same time, unlike the known kill function, makes possible further use of the technology for intelligent (e.g., networked) devices with an RFID tag and/or a reader.

[0008] In this description, reference is made repeatedly to the example that products can be distinguished through use of an RFID tag. This example is merely a typical application, and those skilled in the art will recognize that other uses of the RFID technology are also conceivable.

[0009] The functionality of the RFID tags can be enhanced by dynamic activation, deactivation, or restriction of the (identification) functionality of the RFID tags. Specifically, it is meant thereby that with the aid of an internal state of the RFID tag it can be decided which functions an RFID tag executes, and to what extent, when a certain request from the reader is received. In particular, a state is provided in which the RFID tag outputs none of the internally stored data which customarily make identification possible.

[0010] However, in each state the RFID tag should fulfill the communication protocols that are valid between the reader and the RFID tag to the extent that transmitting and receiving of data and commands is possible.

[0011] For example, an RFID tag must signal its presence vis-à-vis a reader and participate in a so-called singulation or anti-collusion protocol in order to be able to receive individual commands. In the EPCglobal specifications an anti-collusion protocol is presented that runs without the use of the stored identifying data. Anti-collusion protocols are described in German Patent Publication No. DE 101 61 302 which are based on regularly regenerated random values instead of on identifying data.

[0012] In one implementation, the RIFD tag can provide a function for changing the internal state of the tag. This function is only executed after the reader calling the function has demonstrated knowledge of a secret data set, which can be, for example, a bit sequence stored on the RIFD tag. The secret data set is designated herein as a password. The detection function is designated herein as verification.

[0013] In another implementation, the RIFD tag can provide a rewritable, non-transient memory location for storing the password. Thus, the first password can be set during the production process of the RIFD tag or during connection of a product to the RIFD tag. The writing of the password may occur together with the writing of the identification data, since both the password and the identification data should be transmitted in each step of the logistics chain with the product.

[0014] Two useful developments of password verification are disclosed in the RFID system as follows.

[0015] In a first development, the password can be transmitted from the reader to the RFID tag to verify the password. This method of verification is very simple to implement on the RFID tag because only one function comparing the stored password with the received password is needed. However, the password can be determined by other devices by eavesdropping on the radio communication.

[0016] In a second development, a function can be available in the RFID tag as well as in the reader, which combines the password and an additional value to form a test value. In addition, a random number generator available in the RFID tag can generate a random value. The details of the random number generator for generating the random value are, in principle, arbitrary. For example, a noise source with a sampling circuit (e.g., a diode) can be used, or a hash function can be applied repeatedly to an initial value issued individually during production, and the random sequence can be formed from parts of the respective intermediate values. Calculating the test value can be performed in a variety of ways. For example, a cryptographically secure one-way function or a symmetric encryption function can be used, where one of the input values would be used as the key, since in this way reversing the function or the determination of an unknown third value from knowledge of the other two would be difficult or impossible.

[0017] A test value means also may carry out the calculation only on the basis of an input value, where either only the internal password is used or an additional arbitrary means is used to combine the input values. The options for realizing the test value means also include the possibility of carrying out the calculation on the basis of more than two input values. The options for realizing the test value means also include the possibility of calculating more than one output value.

[0018] In this method of verification the RFID tag may generate a random value, store the value in a memory, and transmit the random value to the reader. The reader can use the test value means, where the password and the received random value are used as input, and the reader can output a test value that is transmitted to the RFID tag. The RFID tag calculates a second test value with the aid of the stored password and the stored random value and compares both test values. If both test values agree, the function protected by the verification is executed.

[0019] Alternatively, the RFID tag can also reverse the calculation. That is, it can calculate from the test value and an input value another test value and compare it to the received test value. The advantage of the second development of the verification is the security against eavesdropping. The disadvantage is the higher complexity in the circuit technology of the RFID tag.

[0020] The security of the process, and the protection against the password being determined by third parties, depends on the cryptographic quality of the test value means (i.e., how difficult it is to reverse the one-way function or to determine the unknown value), the cryptographic quality of the random value generator, and the length of the bit sequences used for the password, the random value, and the test value.

[0021] Furthermore, in one implementation the RFID tag provides a function for changing the password, which may be executed only after successful verification of the previous password. Therein, the new password can be transmitted from the reader to the RFID tag.

[0022] Two useful developments of the transmission of a password from the reader to the RFID tag of the RFID system are disclosed as follows.

[0023] In the first development of the password transmission the new password can be transmitted from the reader to the RFID tag. An advantage of this development is that it is simple to implement on the RFID tag. However, eavesdropping by another device is also possible.

[0024] In the second development of the password transmission, there can be, in the RFID tag as well as in the reader, circuitry that can calculate from two input values a third value. The calculation must be reversible to the extent that the second input value can be calculated from the first input value and the output value. For example, arbitrary symmetric encryption functions or the bitwise XOR superposition of the two input values can be used. The calculation also can be carried out on the basis of more than two input values, and more than one output value can be calculated.

[0025] An advantage of this development is greater security against eavesdropping, however, higher complexity in the circuit technology of the RFID tag is required. The security of the process depends on the cryptographic quality of the means used and on the length of the values used, where the simple bitwise XOR superposition (one-time pad) already offers maximum security and is thus optimal.

[0026] So that the password or the state of the RFID tag can be changed, it is necessary for the current owner of an RFID tag to know the current password. In contradistinction to the previous realization on the basis of kill functions (e.g., as according to the EPC Standard), the password can be passed, e.g., at or after the cash register, to the customer (for example, by printout on the receipt). Thereby, the customer gets complete control over the functionality of her/his RFID tag.

[0027] By changing the password the current owner can take over sole control of the functionality of an RFID tag, since the previous owners have then stored an incorrect password in their data bases.

[0028] In another implementation, an advantageous process for changing the passwords can allow for identification of the RFID tags that are in the deactivated state and whose passwords thus cannot be determined. Thus, an owner can store the same password in all the RFID tags in her/his possession prior to deactivation of the RFID tags. This process can occur, for example, when the new owner takes possession of the objects to which the RFID tags are attached, e.g., at the supermarket register.

[0029] When the ownership of an RFID tag changes, e.g., at the register of a supermarket, several events may occur. First, the previous owner may change the password of the RFID tag to be transferred to a randomly chosen value. On transfer of the object and its associated RFID tag the old owner communicates the password used to the new owner. Second, the new owner carries out, in so far as possible outside of radio range (e.g., in her/his confidential area) a second change of password, where the new owner customarily uses a password common to all her/his RFID tags.

[0030] Thus, when an item is purchased at a supermarket register the following steps may occur: 1) a random value is chosen as the new password by the reader; 2) the identification of an RFID tag is read out; 3) the password of the RFID tag is changed to the new value, and the reader receives the currently necessary previous password by querying a data base, e.g., the product inventory data base of the supermarket; 4) the RFID tag is deactivated; 5) if additional RFID tags are present, step 2 is repeated; and 6) the password for this purchase is submitted to the new owner of the products, e.g., by printing on the cash register receipt or by transmitting to a device in the possession of the customer (for example, a chip card).

[0031] So that all the RFID tags in the possession of a person/a household have the same password, the change of password should be repeated by a reader in the confidential area of the person. In so doing, a similar sequence of steps can be used with the difference that step 1 is only carried out once and the password stored once in the device is used for all the RFID tags. The previous password, necessary in step 3, is available to the user through step 6 of the previous change of password and must be, in certain cases, transmitted to the reader. Step 6 can be omitted.

[0032] Three possibilities are proposed for how the intermediate password can be communicated to the user. First, the password can be transmitted to any electronic device in the possession of the customer (for example, a cellular telephone). Second, the password can be transmitted directly to the in-house system of the customer (in particular for long-distance selling/ordering by internet). Third, the password can be printed on the cash register receipt. The third possibility could be particularly important in a startup phase of the technology if only a few customers have intelligent household devices. One could, so to speak, migrate important RFID tags retroactively when such a device is acquired. On the other hand, in this way, purchase is possible without the electronic device that stores the passwords.

[0033] In another implementation, the change of owner is done only by transfer of the previous password. This possibility is, under certain circumstances, practical at the supermarket cash register since the RFID tags are assigned an individual password during production. However, this process is not to be recommended for transmitting from one confidential area to another since in this case the password common to all RFID tags of the previous owner would have to be communicated to the new owner.

[0034] The above-described privacy problems of RFID technology, which relate to all the processes of the RFID tag after leaving the supermarket, can be obviated by techniques and structures described herein since deactivated RFID tags identify themselves only with respect to authorized scanners.

[0035] Through the password-based possibility for restricting access to the RFID tag functionality it is achieved, among other things, that an RFID tag can only be completely controlled by verified readers. By changing the password the control of the RFID tag can be restricted to the current owner. In addition, the owner can arbitrarily restrict access by unauthorized parties. Thus, the following exemplary restrictions would be conceivable:

[0036] Complete anonymization: An unverified reader receives no part of the label, that is, the RFID tag is not identifiable.

[0037] Anonymization of the serial number of an object: RFID tags can be used so that they output only a product code component of an EPC (electronic product code), even though the EPC can include both a product code and a serial number of the individual object. Thus, the identity of the particular object of the product remains concealed.

[0038] Anonymization of the identification number but disclosure of other information: The output of the identification number can be restricted to verified readers but arbitrary other information that can be changed by a verified reader, callable via additional functions, is generally available. This makes it possible, for example, to structure recycling information concerning the chemical components in such a manner that it is readable or for information concerning packaging required for deposit in automatic return devices.

[0039] An additional useful development provides for calculating a test value from two input values. For example, a cryptographic hash function (one-way function) or a symmetric encryption function can be used for the calculation. With the aid of a challenge-response process and with the cooperation of the RFID tag or product manufacturer, the authenticity of the RFID tag, and thus with restrictions also the authenticity of the product, can be checked.

[0040] Thus, it is possible to produce freely programmable RFID tags, for reasons of product technology nearly all the RFID tags are permitted to be produced without concrete identification numbers and instead they only receive their first and final programming on the product. RFID tags without verifiable identification numbers will thus make corruptions of the product easier rather than more difficult.

[0041] For this development, in the RFID tag along with the password an additional secret value must be stored that can be stored in a non-rewritable memory. In addition, the computer system of the product or RFID tag manufacturer must be able to repeat or reverse the calculation of the RFID tag. In addition, the reader generally needs an online-connection to the computer system of the manufacturer. The manufacturer furthermore needs a database that stores, for each RFID tag, at least the identification number and the secret value also stored in the RFID tag.

[0042] In an implementation, the reader can transmit a random value to the RFID tag. The RFID tag can calculate the test value, where the random value and the secret value stored in the RFID tag are used as input. The test value can be transmitted back to the reader. The reader can transmit the combination of RFID tag identification data, the random value, and the test value to the manufacturer. The manufacturer then can test the correctness with the aid the secret value stored in its data base for the queried RFID tag. In so doing, two of the three values (i.e., the random value, the test value, and the secret value of the RFID tag) are used as input values and the result compared to the third value. The manufacturer reports the result of the comparison to the reader.

[0043] In another useful development of the process, the reader has already received in advance one or more valid combinations of the random value and the test value for a certain RFID tag. The testing of the authenticity of the RFID tag can then be done locally without an online connection being necessary by the random value contained in the combination being transmitted to the RFID tag and the reply of the RFID tag being compared to the test value.

[0044] Components of the application can include (networked) readers with the following particular functionalities: a function for verifying (transmitting the password or execution of the challenge-response process and the corresponding means for detecting knowledge of the password); calling the function after verification of the password; a function for changing the state of the RFID tag; a function for changing the password; a method of storing the common password and only forwarding to other devices known to be trustworthy; a method of taking possession of new RFID tags by specification of the current passwords by changing the passwords to the common password.

[0045] The invention is not restricted to the above-specified example embodiments. Rather, many variants are conceivable which make use of the teaching even with embodiments of a fundamentally different type.

[0046] FIG. 1 is a schematic flow chart of the data flow in an RFID tag while in cooperation with a reader.

[0047] FIG. 2 is a schematic flow chart of the data flow in an RFID with secure password verification.

[0048] FIG. 3 is a flow chart of a process described herein.

[0049] In FIG. 1 an RFID tag 1 includes a memory 5 that can store an unambiguous label for the tag itself. With this label the tag can be unambiguously distinguished from all other tags. The RFID tag 1 also can include a memory 6 that can store an internal password and a memory 7 that can store the internal state of the tag that specifies whether or not certain functions can be executed.

[0050] During operation the RFID tag 1 can interact with a reader 2. The RFID tag 1 and the reader 2 each can include a transmitter 3, 3′ and a receiver 4, 4′, respectively, for transmitting and receiving data that can be thoroughly different from the standard. Individual queries involving the RFID tag 1 and the reader 2 are explained separately with respect to FIG. 3, so that reference is made thereto.

[0051] First, a query for a label can be directed from the reader 2 to the RFID tag 1. Alternatively or in addition, a password can be specified. In a comparator 9 an internal state of the RFID tag 1 can be checked. Whether the internal state is “open” or “blocked” can be checked, and the state can be stored as a flag in the memory 7. If the RFID tag is “blocked,” the unambiguous label stored in the memory 5 is only output to authorized readers 2 that demonstrate knowledge of an internal password stored in the memory 6.

[0052] In another comparator 10 the internal password can be compared to a password, which in certain cases can be read in from the reader (e.g., reader password 6′, shown in FIG. 2). If no password was read in from the reader 2 or if the passwords do not agree, then the process terminates with the final state 8. Optionally, an error message can be output.

[0053] If the internal password and the received password agree, the function requested by the reader 2 can be executed. By means of a branching device 11 it can be decided whether: the unambiguous label from memory 5 is output; the internal state in memory 7 is changed; and/or a new internal password is stored in the memory 6. In making these decisions, it is important that each value stored in an RFID tag 1, which is in the position to identify unambiguously the object to which the RFID tag is attached and therefore turns out to be different in each object, represents an unambiguous label 5 for the RFID tag 1. The sequence of comparisons can be carried out in arbitrary order, and the checking of the internal state can be omitted in all the queries except after the labeling. Furthermore, it is possible as an alternative in the final state 8 to send an error message or the like to the reader 2. In principle, it is arbitrary whether and how the state or password changes are sent back to the reader 2. Also, the combination of the Change Password and Block State function calls can be protected.

[0054] FIG. 2 shows the RFID tag 1 with all the functions represented in FIG. 1 so that reference can be made to the description above. However, the password verification is done in a particularly secure manner. This then happens in two steps: a) first the function is called; and b) thereafter (if the RFID tag 1 is blocked) a random value is sent with which the reader sends the password in an encrypted format, and if successful the previously requested function is executed. This is represented in detail in the following.

[0055] In a modification of the embodiment described in FIG. 1 an altered processing can occur here in the comparator 9. If the internal state (e.g., as stored in memory 7) is blocked, then a random number generator 12 can be addressed which generates a random value that is stored in a buffer 13. Subsequently, this random value can be sent to the reader 2 via the transmitter 3. In parallel, this random value can be processed, together with the internal password from memory 6, by a test value means 14. The test value means 14 calculates from these data a unique test value.

[0056] The reader 2 has, in principle, the same information, namely, a reader password 6′ and the received random value. With a test value means 14′ of comparable construction a test value is also determined in the reader 2 and transmitted to the RFID tag 1.

[0057] In the comparator 10 a comparison between the test value generated by the RFID tag 1 and the test value generated by the reader 2 can be carried out. If the test values agree, then the further processing with the branching device 11 takes place as described in FIG. 1. If the test values do not agree, then termination occurs analogously to FIG. 1. Furthermore, circuitry 15 for changing the internal password is provided in the memory 6. This circuitry can generate a new internal password from the previous internal password and a value received by the reader 2. The branching device 11 outputs in this case a corresponding command. Thus, the RFID tag 1 can query the password if this is required.

[0058] FIG. 3 shows the sequence of a process with the apparatus shown in FIG. 1 and FIG. 2. Therein a query of the unambiguous label and a subsequent change of password (for acceptance by the owner) and a following block of the internal state of the RFID tag is described. With this process an electronic owner acceptance is possible. The knowledge of the internal password of the tag has the same meaning as the status of the “owner.”