System and method for disabling data on radio frequency identification tags

[0001] This application claims priority from U.S. Provisional Patent Application entitled “RFID Privacy Protection,” filed on May 31, 2001 under Ser. No. 60/294,952, and which is herein incorporated by reference in its entirety.

[0002] The present invention relates to radio frequency identification (RFID), and more particularly, this invention relates to disabling/destroying data on RFID tags.

[0003] Radio frequency identification (RFID) is a technology that incorporates the use of electromagnetic or electrostatic coupling in the radio frequency (RF) portion of the electromagnetic spectrum to uniquely identify an object, animal, or person. RFID is coming into increasing use in industry as an alternative to the bar code. The advantage of RFID is that it does not require direct contact or line-of-sight scanning. RFID is sometimes also called dedicated short range communication (DSRC).

[0004] In an RFID system, multiple wireless tags are interrogated by sending information from an interrogating transmitter to the tags and having information transmitted by the tag in response. This is commonly accomplished by having the tag listen for an interrogation and for it to respond with a unique serial number and/or other information. However, it is desirable to extend the range of wireless tags so that it is not necessary to bring each tag close to a reader for reading. Two problems are evident when extending the range of the reading system. One of the problems is that there is limited power available for transmission from the wireless tag, and that if the range is significant, it is possible that many tags will be within range of the interrogating system and their replies may corrupt each other.

[0005] There are a number of methods and apparatuses that address these problems and enable the fabrication of wireless tags with longer ranges and an ability of the system to handle many tags in the sensitive range.

[0006] In one application, RFID tags can be used to identify items for purchase, inventory, etc. And, as outlined, there are known methods that enable one specific tag in a group of many tags to be interrogated without corruption by other tags of information sent by that one particular tag to the reader and without accidental transmission of data or commands to other tags of information sent to that particular tag.

[0007] The least expensive tags usually have read only memory. This is adequate for identifying a tag and for executing a purchase. However, at times, the purchaser might require privacy after the purchase so that another party cannot perform a scan and learn the contents of that purchaser's purse, car or home. Further, the tags may need to be disabled to allow the product to be taken through a security device that recognizes intact tags.

[0008] Thus, there are times when it is desirable to disable or destroy an RFID tag after purchase. This disablement may be either partial or complete and may be accomplished by data erasure, modification, etc. However, tags with destructible memory may be susceptible to thievery, in that a thief with the proper equipment could potentially disable a tag. Thus, it is desirable to require some type of validation of authority to disable a tag. Furthermore, when a tag is destroyed it is desirable that other tags within range of the disabling device, typically a reader, are not also destroyed.

[0009] The disclosed embodiments of the present invention are used to permanently disable or destruct a radio frequency identification (RFID) so that it is no longer possible to read some or all of the data encoded on the RFID tag. In one method for disabling data on a radio frequency identification RFID tag, an RFID tag is identified and its identity is confirmed. Verification that a prerequisite event has occurred is obtained, occurrence of which is required prior to disablement of the data. For example, the data of the RFID tag may be associated with an item, where the prerequisite event is a purchase of the item. A destruct instruction is transmitted to the RFID tag. The RFID tag verifies that the destruct instruction is valid and disables the data upon verifying validity of the destruct instruction. The tag may disable its data by erasing the data, locking tag data, destroying only a portion of the data, auto-destructing (physical destruction of the device), or performing any operation that makes the data unreadable or unavailable. The tag may also be disabled so that the data can be resurrected upon application of a proper code or other means of authorization.

[0010] In one embodiment, the authorization of a user to order disabling of the data is verified prior to disablement of the data. In another embodiment, receipt of a request for disablement is received prior to disabling the data. Thus, the request for disablement may be required prior to transmission of the destruct instruction to the RFID tag. A request for disablement can be automatically generated upon occurrence of the prerequisite event, such as when an item is a final sale.

[0011] In an embodiment, transmission of further destruct commands is disabled for a predetermined period of time after an unsuccessful attempt to disable the data. In a further embodiment, the destruct instruction includes a unique destruct code.

[0012] A radio frequency identification (RFID) system according to one embodiment includes an RFID tag having data stored thereon. The RFID tag is capable of disabling the data upon receipt of a destruct instruction. Communication logic, such as a transceiver, communicates with the RFID tag via an antenna. In particular, the communication logic transmits a destruct instruction to the RFID tag. Identification logic identifies the RFID tag, and confirmation logic confirms an identity of the RFID tag.

[0016] The following description is the best embodiment presently contemplated for carrying out the present invention. This description is made for the purpose of illustrating the general principles of the present invention and is not meant to limit the inventive concepts claimed herein.

[0017] FIG. 1 depicts an RFID system 100 according to one embodiment. As shown, the system includes three components: an antenna 102 and transceiver 104 (here combined into one reader 106) and one or more transponders 108 (the tags). The transceiver is a combination transmitter/receiver in a single package. The system may also include identification logic 110 for identifying the RFID tag and confirmation logic 112 for confirming an identity of the RFID tag.

[0018] The antenna uses radio frequency waves to transmit a signal that activates a tag. When activated, the tag transmits data back to the antenna. The data is used to notify a programmable logic controller 114 that an action should occur. The action could be as simple as raising an access gate or as complicated as interfacing with a database to carry out a monetary transaction. High and low-frequency systems may be used in any of the embodiments described herein. Illustrative low-frequency RFID systems (30 KHz to 16 MHz) have short transmission ranges (generally less than six feet). Illustrative high-frequency RFID systems (850 MHz to 950 MHz and 2.4 GHz to 2.5 GHz) can offer longer transmission ranges (more than 90 feet).

[0019] The disclosed embodiments of the present invention are used to permanently disable or destruct an RFID so that it is no longer possible to read some or all of the data encoded on the tag. More particularly, the methodology according to a preferred embodiment includes a unique series of steps to permanently disable or destroy data on the RFID tag. It should be noted that in this description the words disable, destruct, kill, and destroy may be used interchangeably and are used to indicate that data encoded on the tag can no longer be read and not necessarily to indicate the physical destruction of the tag.

[0020] FIG. 2 is a flow diagram of a destruct sequence 200 and related operations according to a preferred embodiment. The destruct sequence is performed on a selected tag.

[0021] In operation 202, the tag to be disabled is identified and selected. The selected tag may be sufficiently close to the reader or previously known to be unique so that no specific procedure need be undertaken to select the tag. Alternatively, the tag may be one of many tags within range of the reader. In this case an anti-collision procedure may need to be performed to select the tag, that is, to prevent information from and to the tag from being corrupted by other tags. As will be apparent to one skilled in the art, there are a number of known methods of performing anti-collision to select one specific RF tag from many RF tags responding to a given reader signal.

[0022] Preferably, each tag contains a unique binary identification code unlike that of any other tag. When reset, all tags respond to any query from the reader. The reader need discriminate only between two conditions: either “no response” or “one or more responses”.

[0023] The reader starts with the query “are there any tags within range?”. If there are, the reader then begins loading code bits into the tags one bit or more at a time. As the tag bit registers begin to fill up, the tags become progressively more discriminating about responding to the reader.

[0024] For example, three 2-bit commands may be used to control a search of all tags. Such a search is efficient and is linearly proportional to the number of tags times the length of the code.

[0025] Once the tag is selected the destruct sequence begins. The destruct sequence leads to the permanent destruction of the tag provided that the circuitry of the tag is designed to destroy the tag when the appropriate sequencing conditions are met.

[0026] Once the tag is selected and its identity is believed to be known, a destruct sequence is performed. The destruct sequence comprises a series of steps in the following sequence: an ID CONFIRMATION, a PURCHASE, DESTRUCT CODE TRANSMISSION and VERIFICATION AND DESTRUCTION. Furthermore, a REQUEST FOR DESTRUCTION must occur somewhere during the sequence.

[0027] It is important to emphasize that there can be different levels of security. Someone taking inventory may be able to access certain tag information, but will not be allowed to disable or destroy the tag. For example, the person taking inventory may have access to a CONFIRM CODE to verify a tag's identity but not to other steps in a disable or destroy sequence or may have access to a Confirm Code to start a destruct sequence but not to a second special Destruct Code required to complete a destruct sequence. Other personnel, for example a checkout person might have access to all the necessary means to initiate a destruct sequence to destruct a tag.

[0028] In operation 204, a request to confirm the identity of the tag is received. The identity of the tag is confirmed in operation 206, such as by using a CONFIRM CODE. An example of the use of a CONFIRM CODE is that at the end of a search, a reader calculates an 8-bit CRC (sufficient to enable the tag to detect multiple bit errors) and sends the CRC to the tag. The tag compares the CRC with a pre-calculated 8-bit code and mutes if there is no match. If the codes match on the tag, the tag will send another stored 8-bit code back to the reader. If the identity of the tag cannot be confirmed, the sequence aborts.

[0029] The second step is the PURCHASE. Once a purchase is made, the ability to download a disable or destruct code is permitted. That is, the purchase of the item makes it possible to download the code required to destroy a tag. The DESTRUCT CODE can be, for example a unique 8 bit code.

[0030] It is noted that in certain circumstances either the purchaser or the seller may choose to not destroy the tag. Thus, even if a purchase has been made, a request for destruction must be present in order to send the DESTRUCT CODE to the tag. It should also be noted that under other circumstances, for example when an item is a final sale and cannot be returned, a purchase triggers an automatic request for destruction.

[0031] The third step is DESTRUCT CODE TRANSMISSION. In the DESTRUCT CODE TRANSMISSION step, provided that a REQUEST FOR DESTRUCTION has been made during the sequence, the destruct code is downloaded and transmitted to the tag.

[0032] The fourth step is DISABLEMENT or DESTRUCT. The tag confirms that the destruct code is valid and destroys the tag.

[0033] In a preferred embodiment, the destruct sequence of commands comprises an identity match; followed by a correct response; followed by a purchase. The cash register reader then may (or may not) provide a unique 8-bit DESTRUCT Code, after which the tag configures itself for destruction, verifies that the DESTRUCT CODE is valid, and is subsequently destroyed by having the tag within a range of, for example, 10 cm from the reader. Receipt of further destruct commands is automatically disabled for 5 seconds or more after any unsuccessful destruct attempt.

[0034] It is important to emphasize that there can be different levels of security. Someone taking inventory may be able to access certain tag information, but will not be allowed to disable or destroy the tag. For example, the person taking inventory may have access to a confirm code to verify a tag's identity but not to other steps in a disable or destroy sequence or may have access to a confirm code to start a destruct sequence but not to a second special destruct code required to complete a destruct sequence. Other personnel, for example a checkout person, might have access to all the necessary means to initiate a destruct sequence to destruct a tag.

[0035] Occurrence of the prerequisite event may be required as a requisite to completing the sequence. In operation 208, a verification that a prerequisite event has occurred is received or retrieved from an internal or external source. If the event has not occurred, or cannot be verified, the sequence is paused, aborted, or retried after a period of time. One example of a prerequisite event is purchase of an item.

[0036] In operation 210, a request for destruction is received. Note that the request for destruction may be received anywhere in the sequence.

[0037] Continuing with the purchase example, in certain circumstances either the purchaser or the seller may choose to not destroy the tag. In such circumstances, even if a purchase has been made, a request for destruction may be required in order to send the destruct code to the tag. If the request has not been received, the sequence may be aborted. It should also be noted that under other circumstances, for example when an item is a final sale and cannot be returned, a purchase triggers an automatic request for destruction.

[0038] In operation 212, a destruct code is retrieved, such as from a remote or local computer or the reader itself, and transmitted to the tag. Transmission of the destruct instruction may be contingent on receipt of a request for destruction during the sequence.

[0039] The destruct instruction can be or include, for example, a unique 8 bit code, that may be unique to each particular tag. Preferably, the destruct code is not algorithmically calculated, but is a random code that can be created by the manufacturer of the item.

[0040] Preferably, the tag uses persistent data storage to defeat attempts to break the code. If a user attempts to destroy the data with an unauthorized code, the tag can remember that event and not allow disabling for a period of time even without power. So someone trying to run through all possible codes might have to try for hours or days before finding the right code.

[0041] In operation 214, the tag confirms that the destruct code is valid, and in operation 216 destroys/disables/destructs/locks some or all of the data in the tag.

[0042] In the context of a purchase example, once a purchase is made, a record of the purchase is created and made accessible. The purchase may be a prerequisite event to disabling the tag. When a request to destroy the tag is received, the record of the purchase is retrieved. The ability to download a disable or destruct code is permitted if the record is found. That is, the purchase of the item makes it possible to download the code required to destroy a tag from a database to the reader. If the item is not purchased, the destruct code is not transmitted to the tag. Further, the destruct code may be accessible only through the cashier's machine.

[0043] In a preferred embodiment for commerce, the destruct sequence of commands comprises an identity match; followed by a correct response; followed by a purchase. The cash register reader then may (or may not) provide a unique 8-bit destruct code (destruct instruction), after which the tag configures itself for destruction, verifies that the destruct code is valid, and is subsequently destroyed by having the tag within a range of, for example, 10 cm from the reader, which acts as the disabling device. Receipt of further destruct commands is automatically disabled for a period of time, such as 5 seconds or more, after any unsuccessful destruct attempt. This lock-out period may be triggered by an unsuccessful destruct attempt or by a loss of power following such unsuccessful attempt.

[0044] While various embodiments have been described above, it should be understood that they have been presented by way of example only, and not limitation. Although disablement has been primarily described herein at point of purchase, it would be obvious to one skilled in the art that such disablement may be done at other times in the life cycle of the tag. Thus, the breadth and scope of a preferred embodiment should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.