Reusable electronic tag for secure data accumulation

[0001] The present invention relates generally to an electronic tag and, more specifically, to a mobile, reusable electronic tag.

[0002] When a mailpiece is sent by a sender to a recipient, it is useful to track the mailpiece to find out how the mailpiece is delivered, what route it takes and where and at what time the mailpiece is processed during transit. It is possible to use a radio frequency identification device (RFID) as a tag to be attached to a mailpiece to gather information en route. The RFID tag has a plurality of memory locations to allow the sender and some or all of the mailpiece handlers to write messages in the tag. For this application, one must ensure that data can be written as needed, and that the data written onto the tag remains indefinitely, if so desired. While tags that provide read/write data capability can be used to write data as needed, the data written onto the tag is not protected. That is, the data written onto the tag may be overwritten. One solution to this problem is to protect the written data by password such that only the person who has the password can overwrite the memory content. However, tags that are password-protected require the password to be disseminated to all possible writers—something that may be difficult to achieve.

[0003] Tags that can be written once or that have a locking capability such that data can be written as needed and that the data written onto them can remain indefinitely do exist. However, they cannot be reused.

[0004] Additionally, there may be a desire to protect the information from general read access, especially if the tag traverses competitive organizations, which the current tags do not address.

[0005] It is thus desirable and advantageous to provide a reusable memory device onto which data can be written as needed, and the written data can remain as long as desired.

[0006] It is a primary objective of the present invention to provide a reusable electronic tag having a plurality of memory locations to allow a user to write data onto the tag. The written data is protected in that an unauthorized user is not allowed to alter the written data. This objective can be achieved by granting a user access rights to a memory location based on whether the user has a valid password and whether the memory block has been written. Furthermore, the user's ability to access the memory location is dependent on the granted access type and the level of restriction set for the memory location, as summarized in the following table:

[0007]

User Access	Unrestricted Mode	Restricted Mode
Open	User can write memory,	User cannot write.
	mode changes to	May be able to read, based
	restricted afterward	on how restrictive mode is.
Authorized	User can write memory,	User can read/write/clear.
	mode changes to	If memory cleared, mode
	restricted afterward	changes to unrestricted.

[0008] As shown in the table, there are two access types: open and authorized. If the memory location is set in the unrestricted mode, the user's ability to access the memory location does not depend on whether or not the user is authorized. But, if the memory location is set at the restricted mode, only an authorized user can write or clear that memory location. Such user is allowed to clear the memory location so that the electronic tag can be reused.

[0009] When the user is granted with said first access type—open type, the user is only allowed to access the memory locations in a first operational mode—write unprotected mode.

[0010] When the user is granted with the first access type, the user is allowed to access the memory locations in a second operational mode—write protected mode, but only to read the information stored therein.

[0011] When the user is granted with the first access type, the user is allowed to cause only the memory locations in the first operational mode to store information supplied by the user and to cause said memory locations to change from the first operational mode to the second operational mode after said storing.

[0012] Thus, when the user is granted with the second access type—authorized type, the user is allowed to read stored information in said subset of memory locations regardless whether said memory locations are in the first operational mode or in the second operational mode.

[0013] Thus, when the user is granted the second access type, the user is allowed to alter stored information in at least some of the subset of memory locations in the second operational mode.

[0014] Thus, when the user is granted with the second access type, the user is allowed to delete stored information in at least some of the subset of memory locations in the second operational mode and to cause said memory locations to change from the second operational mode to the first operational mode after said deletion.

[0015] The present invention will become apparent upon reading the description taken in conjunction with FIGS. 1–9.

[0027] A mailpiece 10 is sent by a sender 20 to a recipient 40 via a certain courier 30. The courier 30 has a delivery route 90 defined by a plurality of mailpiece processing sites 32₁, 32₂, . . . , 32_n, as shown in FIG. 1. During transit, the mailpiece 10 is supposed to be processed by all of the processing sites. According to the present invention, an information gathering device 100 is provided in the mailpiece 10, as shown in FIG. 2, either inside or outside the mailpiece 10. The device 100 is capable of recording information provided by the sender and information provided by the processing sites. As shown in FIG. 3a, the sender 20 has a transmitter 26 capable of sending signals 120 to the information gathering device 100. As shown, the device 100 has a memory unit 102 for storing the information 110 contained in the signals 120 provided by the sender. For example, the signals 120 contain data 22 indicative of the sender identity or other information the sender wishes to convey to the recipient. Preferably, the sender's identity is encrypted by an encryption module 24 such that only an authorized party can decipher the encrypted information. The sender's identity contained in the signals 120 can be a personal signature. The means for providing a personal signature is well known in the art, and may include the use of public key encryption. In addition, it may be desirable that the stored information 110 also contains the time of sending the mailpiece by the sender.

[0028] When the mailpiece 10 is delivered to the recipient 40, the recipient 40 can read the stored information 110 from the memory 102 of the device 100, as shown in FIG. 4, in order to retrieve the personal signature of the sender. While the signature provides the recipient with verification that the item was originated by the sender, the item may become unsafe as it processes through various processing sites in the mail stream because of biohazard contamination, for example. The recipient may reject the item unless some evidence of its route is also provided. For this level of verification, the processing sites 32₁, 32₂, . . . , 32_n provide a service for encoding site and time information onto the device 100. For example, when the mailpiece 10 is processed by the processing site 32₁, it receives a signal 130₁ provided by the processing site 32₁ via a transmitter 26₁, as shown in FIG. 3b. The signals 130₁ contain data 34 indicative of the identity of the processing site 32₁ and the time the mail piece is processed at the processing site 32₁. This recorded information indicative of the data 34 is denoted by reference numeral 112. However, any information provided in during transit should be protected in that the information will not be overwritten. Additionally, among the processing sites 32₁, 32₂, . . . , 32_n, there may be competitors. Thus, some of the processing sites may not want the information visible by other processing sites. For that reason, the encoding service is provided only for specialized tags that provide read protection to this information.

[0029] Upon receiving the mailpiece 10, the recipient 40 can retrieve the stored information 110, 112, . . . , stored in the memory 102 of the device 100. As shown in FIG. 4, the recipient 40 has a reader 42 for reading the content in the memory 102 via a signal 140. Preferably, the recipient has a key 46 to decrypt encrypted information using a decryption module 44. Based on the retrieved information, the recipient can verify the identity of the sender, the identity of each of the mail processing sites in the delivery route, and the time information. Thus, the recipient can determine whether it is safe to accept the mailpiece.

[0030] Preferably, the information gathering device 100 is an electronic device which is capable of electronically recording information and electronically releasing information. For example, the information gathering device 100 can be a radio frequency identification device (RFID) or tag. Typically, an RFID comprises a memory unit 102, a read/write module 104, and an antenna 106, as shown in FIG. 5. The antenna 106 is operatively connected to the read/write module 104 so as to convey signals 120, 130 to the read/write module 104 for writing data in the memory unit 102, and to transmit signals 140 containing data read from the memory unit 102. The signals 120, 130 and 140 are radio frequency signals. An RFID can be an active device, which contains a battery to power the device components, or it can be a passive device in that it is powered by an external device by means of inductive coupling. RFID's are known in the art. A major advantage of using an RFID as an information gathering device is that the device can be disposed inside the mailpiece for concealment or protection purposes.

[0031] While an RFID is a preferred device for information gathering, it is also possible to use an electronic device that receives and transmits optical signals, instead of radio frequency signals.

[0032] Advantageously, the recorded information on the device 100 remains with the mailpiece during transit. That is, the recorded information is not overwritten by any of the processing sites 32_j. Additionally, should the mailpiece pass through a competitor site, the courier 30 may wish that the recorded information not be available to the competitor. The recorded information can be encoded in such a way that the recorded information is protected against unauthorized reading and against being overwritten, tampered or erased by an unauthorized party.

[0033] In a preferred embodiment of the present invention, the device 100 uses a special password-protected read/write memory 102. This memory includes the use of a bit array, 1 bit per memory block, for example, to determine whether a memory block has been written to. If a block has been written to, the associated bit is set. Two levels of protection can be achieved: write protection and full access protection. For write protection, the memory block can be written if the associated bit is clear, even by an unauthorized party who does not posses the password. However, once the associated bit is set after the block has been written, the bit disables all writes to the block unless a password is provided. For full access protection, the bit also disables reads if the bit has been set.

[0034] To illustrate how stored information can be protected, FIG. 6 shows the allocation of memory. As shown, the first two memory blocks are reserved for setting the tag's password and for holding the passwords that are provided in order to access the data. For these purposes, the third block includes a tag ID that can be used with a database system to store tag passwords for future use. The tag ID can also be used to specify a tag type. For example, if the tag is a strict type, a user without a password is only allowed to write a memory block if that memory block has not been written. In a cooperative tag type, a user without a password is allowed to read the data in a memory block even when the memory block has been written by another user. The rest of the memory blocks can be used to accumulate data as the tag moves along the delivery route and the mailpiece is processed by the processing sites. In FIG. 6, the access bits are shown for each word. These bits are called WP (for Written and Protect). The WP flag for memory block 0 is ignored and so it can be set to 0. The WP flag for memory block 1 (the user supplied password) must be “tied” to 0. As this location can be written by anyone who has access to the password, that person also has the authorization to read the information.

[0035] The password is carried securely on the tag. Once the memory block for storing the password is written, it is no longer available for reading or further writing. This memory block is only used as a control circuit to determine whether a password entered by a user is the same as the written password. FIG. 7 is an exemplary circuit that allows the tag to be encoded with a secure password. As shown, the password is held in memory block 0, which has been initialized at the factory, for example, to 0's. Accordingly, access of memory block 0 is allowed only when all bits are 0. Thus, once a password has been written to the block (a password of all zeros is not allowed), the block can no longer be written or read.

[0036] Other memory blocks can be written in two ways. In one way, the block can be written if its WP flag is not set, as shown in FIG. 8a. Once the flag is set, writes and reads (if so protected) are disabled. In the other way, the blocks can be written only after a password is written into memory block 1. If the password written to memory block 1 matches the tag password, as provided in memory block 0, then the WP flag is ignored and the access is allowed, as shown in FIG. 8b.

[0037] When the mailpiece 10 is delivered to the recipient 40, the information gathering device 100 (the tag) will supply the sender's signature and the identity of each of the processing sites in the delivery route. The recipient needs to read this information from the device 100. If the tag protects the information from both writes and reads, the recipient 40 needs to obtain the password to the sender 20, using a standard password distribution technique. Such techniques are known in the art. The tag can be cleared for reuse by the recipient or the sender, if so desired.

[0038] With the device 100 as described above, it is possible to grant a user access rights to a memory block based on whether the user has a valid password and whether the memory block is write-protected. As shown in the flowchart 200 of FIG. 9, when a user makes a request to access the memory block of the device 100 at step 210, the device 100 determines at step 220 whether a valid password is provided. If the valid password is not provided, then the user will be granted only some limited access rights to a memory block based on whether the memory block is write-protected. Thus, at step 230, it is determined whether the write-protection flag WP=1 or 0. If WP=0, the user is granted a less restricted access right at step 240. Otherwise, the user is granted a more restricted access right at step 242. The less-restricted access right may include the right to write information onto the memory block. The more-restricted access right may include the right to read the information written onto the memory block. The user with the more-restricted access right is not allowed to overwrite the memory block or to delete the data contained therein. With a certain memory device, the user may be denied access if he or she does not have a valid password and WP=1.

[0039] If a valid password is provided, the user is granted a different type of access rights at step 244. In this case, the user could be the sender and the user may be allowed to write the memory block, to alter the contents in the memory block, and to clear the memory block so that the device 100 can be reused. However, the user may be the recipient of the mailpiece or a certain individual in the mail stream.

[0040] Although the invention has been described with respect to a preferred embodiment thereof, it will be understood by those skilled in the art that the foregoing and various other changes, omissions and deviations in the form and detail thereof may be made without departing from the scope of this invention.