RFID readers and RFID tags exchanging encrypted password

[0001] This application claims the benefit of U.S. Provisional Applications Ser. No. 60/610,808 filed on Sep. 17, 2004 and Ser. No. 60/574,359 filed on May 24, 2004, which is hereby claimed under 35 U.S.C. § 119(e). Both Provisional Applications are incorporated herein by reference.

[0002] The present invention relates to Radio Frequency IDentification (RFID) systems and components, more particularly, to RFID readers, RFID tags, and methods of exchanging an encrypted data or a password.

[0003] Radio Frequency IDentification (RFID) systems typically include RFID tags and RFID readers (the latter are also known as RFID reader/writers or RFID interrogators). RFID systems can be used in many ways for locating and identifying objects to which the tags are attached. RFID systems are particularly useful in product-related and service-related industries for tracking large numbers of objects being processed, inventoried, or handled. In such cases, an RFID tag is usually attached to an individual item, or to its package.

[0004] In principle, RFID techniques entail using an RFID reader to interrogate one or more RFID tags. The reader transmitting a Radio Frequency (RF) wave performs the interrogation. A tag that senses the interrogating RF wave responds by transmitting back another RF wave. The tag generates the transmitted back RF wave either originally, or by reflecting back a portion of the interrogating RF wave in a process known as backscatter. Backscatter may take place in a number of ways.

[0005] The reflected back RF wave may further encode data stored internally in the tag, such as a number. The response is demodulated and decoded by the reader, which thereby identifies, counts, or otherwise interacts with the associated item. The decoded data can denote a serial number, a price, a date, a destination, other attribute(s), any combination of attributes, and so on.

[0006] An RFID tag typically includes an antenna system, a power management section, a radio section, and frequently a logical section, a memory, or both. In earlier 10 RFID tags, the power management section included a power storage device, such as a battery. RFID tags with a power storage device are known as active tags. Advances in semiconductor technology have miniaturized the electronics so much that an RFID tag can be powered solely by the RF signal it receives. Such RFID tags do not include a power storage device, and are called passive tags.

[0007] The invention facilitates communication between RFID system components. Accordingly, the invention provides RFID readers, RFID tags, and methods for their communication where at least a portion of a password is transmitted in encrypted form.

[0008] According to some embodiments, an RFID reader transmits a command to access the tag. In addition, the reader transmits a callout that encrypts at least a portion of data or a password, using an encryption kernel. This way, the data or the password are not transmitted un-encrypted in the open, which provides for better security from another, rogue reader that could be eavesdropping.

[0009] In some of those embodiments, the RFID reader receives the kernel from the RFID tag itself. This way, the encryption itself is better protected, if a rogue reader is not close enough to eavesdrop on the tags.

[0010] According to some embodiments, an RFID tag receives a command and a callout. The tag then decrypts the callout, to derive data or a password, using an encryption kernel. The tag may even not perform an action in conformance with the command, unless a decrypted password is proper. In some of those embodiments, the RFID tag itself transmits the kernel.

[0026] Various embodiments of the present invention will be described in detail with reference to the drawings, where like reference numerals represent like parts and assemblies throughout the several views. Reference to various embodiments does not limit the scope of the invention, which is limited only by the scope of the claims attached hereto. Additionally, any examples set forth in this specification are not intended to be limiting and merely set forth some of the many possible embodiments for the claimed invention.

[0027] Throughout the specification and claims, the following terms take at least the meanings explicitly associated herein, unless the context clearly dictates otherwise. The meanings identified below are not intended to limit the terms, but merely provide illustrative examples for the terms. The meaning of “a,” “an,” and “the” includes plural reference, the meaning of “in” includes “in” and “on.” The term “connected” means a direct electrical connection between the items connected, without any intermediate devices. The term “coupled” means either a direct electrical connection between the items connected or an indirect connection through one or more passive or active intermediary devices. The term “circuit” means either a single component or a multiplicity of components, either active and/or passive, that are coupled together to provide a desired function. The term “signal” means at least one current, voltage, charge, temperature, data, or other signal. The terms “RFID reader” and “RFID tag” are used interchangeably throughout the text and claims with the terms “reader” and “tag”.

[0028] FIG. 1 is a diagram of a typical RFID system 100, incorporating aspects of the invention. System 100 includes an RFID reader 120 and N RFID tags 110-1, 110-2, . . . , 110-K, . . . , 110-N in the vicinity of each other and of reader 120.

[0029] RFID reader 120 has an antenna 128, and is in communication with database 132. Reader 120 transmits an interrogating Radio Frequency (RF) wave 122, which can be perceived by tags 110-1, 110-2, . . . , 110-K, . . . , 110-N.

[0030] RFID tags 110-X (X here stands for 1, 2, . . . , K, . . . , N) can be passive tags or active tags, i.e. having their own power source. Where tags 110-X are passive tags, they are powered from wave 122.

[0031] Each tag 110-X includes an antenna 118-X. Upon sensing interrogating RF wave 122, each tag 110-X may generate a wave 112-X in response. RFID reader 120 senses and interprets waves 112-X.

[0032] In FIG. 1, as in other FIGURES, interrogating RF wave 122 is shown as larger than waves 112-X. This is to signify that interrogating RF wave 122 has a higher intensity, and thus my be overheard by an eavesdropping rogue reader, a fact that will become more significant from the below.

[0033] Reader 120 and tag 110-X thus exchange data via waves 122 and 112-X. In a session of such an exchange, each encodes, modulates, and transmits data to the other, and each receives, demodulates, and decodes data from the other. The data is modulated onto, and decoded from, RF waveforms, as will be seen in more detail below.

[0034] Encoding the data can be performed in a number of different ways. For example, protocols are devised to communicate in terms of symbols, also called RFID symbols. A symbol for communicating can be a preamble, a null symbol, a symbol 0, a symbol 1, and so on. Further symbols can be implemented for ultimately exchanging binary data, such as “0” and “1”, if that is desired.

[0035] In addition, groups of these bits and/or symbols are named according to their function. For example, it is customary to refer to such groups as are “commands”, “data”, “payload”, “handle”, “kernel”, and so on.

[0036] FIG. 2 is a diagram of RFID tag 210, which can be any one of tags 110-X. Tag 210 is implemented as a passive tag, meaning it does not have its own power source. Much of what is described in this document, however, applies also to active tags.

[0037] Tag 210 is formed on substantially planar inlay 222, which can be made in many ways known in the art. Tag 210 also includes two antenna segments 227, which are usually flat and attached to inlay 222. Antenna segments 227 are shown here forming a dipole, but many other embodiments using any number of antenna segments are possible.

[0038] Tag 210 also includes an electrical circuit, which is preferably implemented in integrated circuit (IC) 224. IC 224 is also arranged on inlay 222, and electrically coupled to antenna segments 227. Only one method of coupling is shown, while many are possible.

[0039] In operation, a signal is received by antenna segments 227, and communicated to IC 224. IC 224 both harvests power, and decides how to reply, if at all. If it has decided to reply, IC 224 modulates the reflectance of antenna segments 227, which generates the backscatter from a wave transmitted by the reader. Coupling together and uncoupling antenna segments 227 can modulate the reflectance, as can a variety of other means.

[0040] In the embodiment of FIG. 2, antenna segments 227 are separate from IC 224. In other embodiments, antenna segments may alternately be formed on IC 224, and so on.

[0041] The components of the RFID system of FIG. 1 may communicate with each other in any number of modes. One such mode is called full duplex. Another such mode is called half-duplex, and is described below.

[0042] FIG. 3 is a conceptual diagram 300 for explaining the half-duplex mode of communication between the components of the RFID system of FIG. 1, especially when tags 110-X are implemented as shown for passive tag 210 of FIG. 2. The explanation is made with reference to a TIME axis, and also to a human metaphor of “talking” and “listening”. The actual technical implementations for “talking” and “listening” are now described.

[0043] RFID reader 120 and RFID tags 110-X talk and listen to each other by taking turns. As seen on axis TIME, when reader 120 talks to one or more of tags 110-X, the session is designated as “R→T”, and when tags 110-X talk to reader 120 the session is designated as “T→R”. Along the TIME axis, a sample R→T session occurs during a time interval 322, and a following sample T→R session occurs during a time interval 316. Of course intervals 322, 316 can be of different durations—here the durations are shown approximately equal only for purposes of illustration.

[0044] According to blocks 332 and 336, RFID reader 120 talks during interval 322, and listens during interval 316. According to blocks 342 and 346, one or more of RFID tags 110-X listen while reader 120 talks (during interval 322), and talk while reader 120 listens (during interval 316).

[0045] In terms of actual technical behavior, during interval 322, reader 120 talks to tags 110-X as follows. According to block 352, reader 120 transmits wave 122, which was first described in FIG. 1. At the same time, according to block 362, tags 110-X receive wave 122 and process it. Meanwhile, according to block 372, tags 110-X do not backscatter with their antennas 118-X, and according to block 382, reader 120 has no wave to receive from tags 110-X.

[0046] During interval 316, one or more tags 110-X talk to reader 120 as follows. According to block 356, reader 120 transmits a Continuous Wave (CW), which can be thought of as a carrier signal that ideally encodes no information. As discussed before, this carrier signal serves both to be harvested by tags 110-X for their own internal power needs, and also as a wave that tags 110-X can backscatter. Indeed, during interval 316, according to block 366, tags 110-X do not receive a signal for processing. Instead, according to block 376, tags 110-X modulate the CW emitted according to block 356, so as to generate backscatter waves 112-X. Concurrently, according to block 386, reader 120 receives backscatter waves 112-X and processes them.

[0047] Backscatter waves 112-X may be many at once. As will be seen later in this document, reader 120 may limit tags 110-X to where fewer of them talk, or even just one.

[0048] FIG. 4 is a block diagram of an electrical circuit 430. Circuit 430 may be formed in an IC of an RFID tag, such as IC 224 of FIG. 2. Circuit 430 has a number of main components that are described in this document. Circuit 430 may have a number of additional components from what is shown and described, or different components, depending on the exact implementation.

[0049] Circuit 430 includes at least two antenna connections 432, 433, which are suitable for coupling to antenna segments (not shown in FIG. 4). Antenna connections 432, 433 may be made in any suitable way, such as pads and so on. In a number of embodiments more antenna connections are used, especially in embodiments where more antenna segments are used.

[0050] Circuit 430 includes a section 435. Section 435 may be implemented as shown, for example as a group of nodes for proper routing of signals. In some embodiments, section 435 may be implemented otherwise, for example to include a receive/transmit switch that can route a signal, and so on.

[0051] Circuit 430 also includes a Power Management Unit (PMU) 441. PMU 441 may be implemented in any way known in the art, for harvesting raw RF power received via antenna connections 432, 433. In some embodiments, PMU 441 includes at least one rectifier, and so on.

[0052] In operation, an RF wave received via antenna connections 432, 433 is received by PMU 441, which in turn generates power for components of circuit 430. This is true for either or both of R→T sessions (when the received RF wave carries a signal) and T→R sessions (when the received RF wave carries no signal).

[0053] Circuit 430 additionally includes a demodulator 442. Demodulator 442 demodulates an RF signal received via antenna connections 432, 433. Demodulator 442 may be implemented in any way known in the art, for example including an attenuator stage, amplifier stage, and so on.

[0054] Circuit 430 further includes a processing block 444. Processing block 444 receives the demodulated signal from demodulator 442, and may perform operations. In addition, it may generate an output signal for transmission.

[0055] Processing block 444 may be implemented in any way known in the art. For example, processing block 444 may include a number of components, such as a processor, a memory, a decoder, an encoder, and so on. In addition, in some embodiments, processing block 444 may be considered to include other blocks, including some of those shown as separate. For example, processing block 444 may be considered to be parsing the signal received via the antenna, and so on.

[0056] Circuit 430 additionally includes a modulator 446. Modulator 446 modulates an output signal generated by processing block 444. The modulated signal is transmitted by driving antenna connections 432, 433, and therefore driving the load presented by the coupled antenna segments. Modulator 446 may be implemented in any way known in the art, for example including a driver stage, amplifier stage, and so on.

[0057] In one embodiment, demodulator 442 and modulator 446 may be combined in a single transceiver circuit. In another embodiment, modulator 446 may include a backscatter transmitter or an active transmitter. In yet other embodiments, demodulator 442 and modulator 446 are part of processing block 444.

[0058] It will be recognized at this juncture that circuit 430 can also be the circuit of an RFID reader according to the invention, without needing PMU 441. Indeed, an RFID reader can typically be powered differently, such as from a wall outlet, a battery, and so on. Additionally, when circuit 430 is configured as a reader, processing block 444 may have additional Inputs/Outputs (I/O) to a terminal, network, or other such devices or connections.

[0059] For both a reader and a tag, transmission is by circuitry therefore modulating a wave that is transmitted. Reception is by parsing bits out of a wave received by the antenna.

[0060] In terms of processing a signal, circuit 430 operates differently during a R→T session and a T→R session. The treatment of a signal is described below.

[0061] FIG. 5A shows version 530-A of circuit 430 of FIG. 4. Version 530-A shows the components of circuit 430 for a tag, further modified to emphasize a signal operation during a R→T session (receive mode of operation) during time interval 322 of FIG. 3. An RF wave is received from antenna connections 432, 433, a signal is demodulated from demodulator 442, and then input to processing block 444. In one embodiment according to the present invention, what is input to processing block 444 may include a received stream of symbols.

[0062] Version 530-A shows as relatively obscured those components that do not play a part in processing a signal during a R→T session. Indeed, PMU 441 may be active, but only in converting raw RF power. And modulator 446 generally does not transmit during a R→T session. Modulator 446 typically does not interact with the received RF wave significantly, either because switching action in section 435 of FIG. 4 decouples the modulator 446 from the RF wave, or by designing modulator 446 to have a suitable impedance, and so on.

[0063] While modulator 446 is typically inactive during a R→T session, it need not be always the case. For example, during a R→T session, modulator 446 could be active in other ways. For example, it could be adjusting its own parameters for operation in a future session.

[0064] FIG. 5B shows version 530-B of circuit 430 of FIG. 4. Version 530-B shows the components of circuit 430 for a tag, further modified to emphasize a signal operation during a T→R session during time interval 316 of FIG. 3. A signal is output from processing block 444, which can be a transmission stream of symbols. The signal output from processing block 444 is then modulated by modulator 446, and output as an RF wave via antenna connections 432, 433.

[0065] Version 530-B shows as relatively obscured those components that do not play a part in processing a signal during a T→R session. Indeed, PMU 441 may be active, but only in converting raw RF power. And demodulator 442 generally does not receive during a T→R session. Demodulator 442 typically does not interact with the transmitted RF wave, either because switching action in section 435 decouples the demodulator 442 from the RF wave, or by designing demodulator 442 to have a suitable impedance, and so on.

[0066] While demodulator 442 is typically inactive during a T→R session, it need not be always the case. For example, during a T→R session, demodulator 442 could be active in other ways. For example, it could be adjusting its own parameters for operation in a future session.

[0067] FIG. 6 illustrates the RFID system 100, which was first presented in FIG. 1. In addition, RFID tag 110-K has been singulated by reader 120, as shown by relationship 605. This singulation has caused all tags 110-X except tag 110-K to not transmit, so that reader 120 and singulated tag 110-K can exchange data without interference.

[0068] Reader 120 has accomplished singulation by first issuing appropriate commands, which have caused tags 110-X to transition to appropriate internal states. In this example, at least tag-K 110-K is in a state where it can receive an access-type command, while the remaining tags are in states where generally they do not respond or take action, until reader 120 and singulated tag 110-K complete their exchanges.

[0069] The term singulation, as used for the present document, generally means a process for distinguishing a tag from other tags. As such, singulation may be unnecessary when a single reader is addressing a single tag, or where there is no interference from, or concern about any other RFID components such as other RFID tags. The term singulation, as used here, may by coincidence be functionally the same as a specific term “singulation”, which means a process of a reader that can be performed with many or even a single tag.

[0070] FIG. 7 illustrates additional functional blocks of an RFID reader 720 and an RFID tag 710, engaged when tag 710 is singulated by reader 720 from other tags (not shown). It will be appreciated that what is said in relation to FIG. 7 can also apply to what is shown in FIG. 6.

[0071] Reader 720 includes at least an encryption block 729. Block 729 may be implemented in any number of ways, such as by hardware, software, Application Specific Integrated Circuits (ASICs), standalone or as part of a processor, microprocessors, and so on. It may also be implemented in conjunction with an encryption block.

[0072] In the preferred embodiment, block 729 is a logical XOR gate. When thus implemented, block 729 is suitable for XORing something to be encrypted (e.g. a password or a portion of it) with an encryption kernel.

[0073] The term encryption is used in this document with its general meaning. In some embodiments, it includes a specific term called “cover coding”, and so on.

[0074] XORing is the preferred encryption for the invention. That is because a string of binary values encrypted by XORing can be decrypted by passing it through another logical XOR gate, using the same kernel.

[0075] In an operation reader 720 receives a kernel from tag 710 via a reverse link. Reader 720 uses the kernel to encrypt a password or a portion of it, and then transmits the encrypted password via a forward link. This way, the password is not transmitted un-encrypted in the open, which provides for better security.

[0076] Tag 710 includes a processing block 744, which can be the same as processing block 444 of FIG. 4. In addition, block 744 includes at least a decryption block 719. Block 719 may be implemented in any way known in the art, and also as described above with reference to block 729. Similarly, in the preferred embodiment, decryption is performed by XORing and block 719 is implemented by a logical XOR gate.

[0077] Block 744 may also include memory 760. Memory 760 is arranged to store data associated with tag 710. Accordingly, memory 760 may be implemented from one or more nonvolatile memory cells, nonvolatile memory circuits, volatile memory cells, programmable logic arrays (PLAs), latches, registers, EPROMs, EEPROMs, and the like.

[0078] The data stored in memory 760 may include identification information associated with tag 710, information associated with an item the tag is attached to, communication parameters such as a password, and the like. Data may be stored in memory 760 during a production stage, or during an operation by processing block 744. Processing block 744 may access memory 760 to store the received command, password, kernel. Processing block 744 may access memory 760 also to change its contents based on the command received from reader 720.

[0079] In the embodiment of FIG. 7, memory 760 is partitioned into object identification portion 764, tag identification portion 762 to store information associated with a tag identifier, user specific portion 766 to store user-specified information, and system parameter portion 768 to store at least one system parameter. Object identification portion 764 can be arranged to store, as convenient, a protocol control (PC) parameter, an EPC code, and/or a CRC 16 (cyclic redundancy check).

[0080] In operation, tag 710 transmits a kernel to reader 720 via the reverse link. Then if it receives an access type command, it also waits for a callout. Block 719 decrypts the callout using the kernel, and then another component (not shown) validates the decrypted callout against a password. If the password is proper, then an action is taken in accordance with the command. For example, tag 710 may transition to a different state.

[0081] FIG. 8 is a conceptual drawing illustrating a group 800 of contents of exchanges between RFID reader 120 and singulated RFID tag-K 110-K of FIG. 6. The contents are characterized in terms of their function. The exchanges themselves that include the contents may take place in any meaningful order. Physically, they take place as part of a transmission, as will be understood by a person skilled in the art, in view of what has already been described. A transmission may include the whole exchange content, or just parts of it.

[0082] Tag singulation is included in an optional mutual exchange content 805, to be performed as per the above. Content 805 is preferred, in the event there are more than one tags that could respond in a way that interferes. Content 805 is not necessary, if there are no other tags in the vicinity, or if there are, but their responses are dealt with otherwise. Content 805 is mutual, in that both reader 120 and tag-K 110-K transmit and receive.

[0083] An optional exchange content 820 includes a handle request, and is transmitted from reader 120 to tag-K 110-K. The handle request can be a random-number request.

[0084] An optional exchange content 830 includes a handle that is transmitted from tag-K 110-K to reader 120. Content 830 is preferably generated in response to communicating content 820. The handle can be generated by the tag, and can be an identity code, a random number, and so on.

[0085] An exchange content 840 includes a kernel request that is transmitted from reader 120 to tag-K 110-K. Content 840 is optional, in the sense that it need not be made explicitly, or even at all (a tag could be always transmitting proposed kernels). The kernel request can be implicit, based on context. As will be seen below, the request can be implied when by convention it is agreed that, after a tag sends identifying data, it receives a request for a random number. In that instance, the random number is to be treated as the kernel.

[0086] An optional exchange content 850 includes an encryption kernel that is transmitted from tag-K 110-K to reader 120. This is performed preferably in response to exchange 840. Again this is optional, in that a kernel could be predetermined, as a password. In the preferred embodiment, however, the kernel is received by the reader from the tag.

[0087] A distinction is important at this juncture. Both the handle of exchange content 830 and the kernel of exchange content 850 can be random numbers, and even similarly generated. By random number, in this context, is meant a number generated by the tag, and communicated to the reader, and which includes at least a component that has a degree of randomness. The degree of randomness can be true randomness, or pseudo-randomness.

[0088] The kernel and the handle, however, are treated differently. The handle, if used, is repeated openly by the reader to differentiate the singulated tag. The kernel is not repeated openly by the reader, lest it be overheard by an eavesdropping rogue reader, as will be described also below.

[0089] An exchange content 860 includes a command that is transmitted from reader 120 to tag-K 110-K. The command is preferably an access type command, such as Req_RN (requesting a random number), Read, Write, Kill, Lock, Access, BlockWrite, and BlockErase.

[0090] An exchange content 880 includes a callout that is transmitted from reader 120 to tag-K 110-K. The callout is associated with the command of content 860. In addition, the callout contains data or at least a portion of a password that has been encrypted using at least a portion of the kernel of content 830. The password portion is associated with any one or more of the tag, the action and the command.

[0091] The callout may be part of a transmission separate from the command of content 860. In the preferred embodiment, however, the command of content 860 includes a payload. All or a portion of the callout is included in the payload. For example, the encrypted payload can be data to be written according to a Write command, or a BlockWrite command.

[0092] An optional exchange content 890 includes a handle that is transmitted from reader 120 to tag-K 110-K. It is preferred that the handle of content 890 be the same as the handle of content 830. This can ensure that associated command content 860 and/or callout content 880 are intended for tag-K and not necessarily other tags, if present.

[0093] FIG. 9 illustrates a timing diagram 900 of exchanges that can include the contents of FIG. 8 according to embodiments. The timing diagram also shows icons of reader 120 and tag-K 110-K.

[0094] Between time points 910 and 920, singulation 905 takes place. That is performed as is described elsewhere. As a result, an identity ID of the tag is learned.

[0095] Between time points 930 and 940, a handle is optionally requested, as per the above. Between time points 940 and 950, a handle is optionally transmitted, as also per the above. The handle may have been obtained, in some embodiments, as part of singulation 905.

[0096] Between time points 950 and 960, a kernel is optionally requested, as per the above. Between time points 960 and 970, a kernel is optionally transmitted, as also per the above.

[0097] Between time points 970 and 980, a command is transmitted, along with a callout and a handle, as per the above.

[0098] FIG. 10 illustrates a timing diagram of some detailed exchanges that can be used to implement singulation 905 of FIG. 9. Singulation may, in different contexts use different exchanges than what is shown in FIG. 10.

[0099] Between time points 1001 and 1003, a command is transmitted, such as a Query or Adjust command. This can be performed multiple times, if multiple tags are responding.

[0100] Between time points 1003 and 1005, tag-K 110-K responds by generating and transmitting a 16-bit random number, such as RN16. This can serve as the handle, so that step might not need to be repeated later.

[0101] Between time points 1005 and 1007, reader 120 transmits an acknowledgement. This can take the form of the ACK command, followed by the immediately received RN16.

[0102] Between time points 1007 and 1009 tag-K 110-K responds by transmitting its own identifier. The identifier may be the tag's identification code, an identifier associated with an item attached to the tag, and the like.

[0103] The singulation process is completed with reader 120 receiving the identifier at time point 1009. At this stage, reader 120 knows which one of many tags it is going to establish secure communications with.

[0104] FIG. 11 shows a flowchart 1100 for describing a method. The method of flowchart 1100 may also be practiced by other embodiments described herein, such as reader 120. Many of the individual boxes are performed as described above.

[0105] For flowchart 1100, and for other methods of the invention, the reader sends (or transmits) by its circuitry modulating data and/or symbols onto a transmission wave transmitted by the reader. Similarly, the reader receives by parsing a signal received from the antenna, and processed by blocks of the reader such as a processing block.

[0106] According to a box 1110, a reader simulates one of many tags. This is performed as described above.

[0107] According to an optional next box 1120, the reader sends a request for a handle. According to an optional next box 1125, the reader receives a handle.

[0108] According to an optional next box 1130, the reader sends a request for a kernel. According to an optional next box 1135, the reader receives a kernel.

[0109] According to a next box 1140, the reader transmits a command. According to an optional next box 1150, the reader transmits a callout associated with the command.

[0110] FIG. 12 shows a flowchart 1200 for describing another method. The method of flowchart 1200 may also be practiced by a tag, such as tag-K 110-K that has been singulated. For flowchart 1200, and for other methods of the invention, the tag sends (or transmits) by its circuitry modulating data and/or symbols onto a reflection wave. Similarly, the tag receives by parsing a signal received from the antenna, and processed by blocks of the tag such as a processing block.

[0111] According to an optional box 1210, the tag is singulated from other tags.

[0112] According to an optional next box 1220, the tag receives a request for a handle. According to an optional next box 1225, the tag sends a handle.

[0113] According to an optional next box 1230, the tag receives a request for a kernel. According to an optional next box 1235, the tag sends a kernel.

[0114] According to a next box 1240, the tag receives a command. According to a next box 1250, the tag receives a callout associated with the command.

[0115] According to a next box 1260, the callout is decrypted using a kernel, such as the kernel sent in box 1235. From the decryption, either data or a password is derived.

[0116] If data has been derived at box 1260, then according to a next box 1270, the data is used according to the command. For example, the data may be written into memory according to a Write command.

[0117] If a password has been derived at box 1260, then according to a next box 1280, it is determined whether the derived password is valid. If it is, then according to a next box 1290, the command is followed. This means that an action is taken in conformance with the command.

[0118] FIG. 13 illustrates a portion of a state diagram 1300 for an RFID tag implementing the method of FIG. 12, according to one embodiment. In the embodiment of state diagram 1300, shaded ovals denote reader action, and non-shaded ovals denote tag actions and states.

[0119] State diagram 1300, of course, can be part of a larger state diagram for a reader to transmit and a tag to execute a Kill command. Further, it does not include other possibilities, such as what happens if an exchange is not transmitted or received properly, safeguards to ensure such transmissions (e.g. CRC16), additional exchanges so that a kernel and a password are divided into many parts, additional calls to confirm an action, additional ovals that execution might branch to, and so on.

[0120] Briefly, state diagram 1300 includes an oval 1310, where an interrogator uses a handle to request a kernel. The kernel will be a random number, and the request is a random-number request, as per the above.

[0121] According to a next oval 1320, the tag responds with the kernel requested at oval 1310.

[0122] According to a next oval 1330, the reader issues a Kill command. The command has a payload of a proper password that is XORed with the kernel of oval 1320.

[0123] According to a next oval 1340, the tag transitions to a killed state.

[0124] FIG. 14 illustrates a situation where the invention prevents loss of privacy of the tags of FIG. 1 or FIG. 6. A rogue reader 1400 eavesdrops on legitimate reader 120. Reader 120 transmits at high power, because it must also power tags 110-1, 110-2, . . . , 110-K, . . . , 110-N. In this scenario, it is assumed that rogue reader 1400 cannot eavesdrop on tags 110-1, 110-2, . . . , 110-K, . . . , 110-N themselves, as is often the case for secure warehouse environments, and so on.

[0125] Rogue reader 1400 will not hear the password of tags 110-1, 110-2,. . . 110-K, . . . , 110-N. That is because it is transmitted at oval 1330, but in an encrypted form, as per the above. This is a particularly good example of the utility of the invention, since it is desired to not let a rogue reader learn how to issue valid Kill commands to one's RFID tags.

[0126] The above specification, examples and data provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the spirit and scope of the invention, the invention resides in the claims hereinafter appended.