Patent Application
20090015385
The invention relates to an RFID tag, an RFID system and a method for communicating between an RFID tag and reader.
The term RFID (radio frequency identification) describes the use of radio frequency signals to provide automatic identification of items. RFID technology is used in numerous applications, most of which require a relatively high standard of security. Also, interoperability between different actors may be required.
Basically, RFID tags are electronic microcircuits equipped with an RF (Radio Frequency) antenna. An RFID tag is a passive electronic device containing data, for example identification data of an item to which the RFID tag is attached. RFID devices are relatively small, and can be attached to virtually every item. The passive RFID tag can be activated and powered by radio-frequent (RF) energy. When this happens, the tag transmits its stored information, via the built-in RF antenna. Thus, data can be read from the tag. Alternatively, information is broadcasted towards the tag and received by the built-in RF antenna. Thus, data can be written to the tag.
An RFID system generally comprises an RFID reader in addition to the RFID tag. The reader receives RF transmissions from the tag and passes the data to a host system for processing. The reader generally also includes an RF transceiver, which generates the RF energy for activating the tag. It should be emphasized that the reader performs both tag reading and writing operations.
As is clear from the above, a feature of the passive RFID tags is that they do not require any battery. An RFID tag is powered directly by the RF energy supplied to it by the RF transceiver. As a consequence, RFID systems generally operate over relatively short communication distances; for example, in a system based on the ISO-14443 standard, the tag and reader generally can no longer communicate when the distance between them becomes greater than 10 centimeters.
This proximity tends to be seen as an inherent security feature. However, it has recently been found that attacks on the RFID system can be performed from further away than expected. For example, a successful attack on the communication from reader to tag has recently been demonstrated at a distance of 50 meters from the RFID system. This is especially a problem when writing information to the tag. For more details, see the Internet article “Picking Virtual Pockets using Relay Attacks on Contactless Smartcard Systems” by Z. Kfir and A. Wool, which can be viewed at web address http://eprint.iacr.org/2005/052.pdf. This article is incorporated herein by reference.
It is possible to increase security by establishing of a completely secure communication channel, however this requires a full smartcard solution, where, instead of the relatively simple RFID tags, real smartcards incorporating CPU, RAM, ROM, and means for handling public cryptography operations have to be used. Such a solution is relatively expensive.
It is an object of the invention to increase security in the communication between RFID devices, in particular between an RFID tag and an associated RFID reader, at relatively low costs.
According to a first aspect of the invention, a method of controlling storage in an RFID tag communicating with an RFID reader is provided. The method is performed in the RFID tag and comprises the steps of:
The random data may, in other words, be generated according to a one time pad scheme, and the random data may be derived from measuring any of thermal resistance noise, thermal shot noise, atmospheric noise and nuclear decay. The random data and decrypted information may furthermore have the same length, thereby fulfilling the properties of a one time pad.
The step of decrypting the information may be followed by the step of overwriting or deleting the random data, and said steps may be preceded by the steps of receiving a request to read, and sending RFID tag information. The step of generating the random data may also be followed by the step of storing the random data.
An RFID tag comprising means arranged to perform the methods according to the first aspect above, is also provided.
According to a second aspect of the invention, a method of controlling writing of information by an RFID reader communicating with an RFID tag is provided. The method is performed in the RFID reader and comprises the steps of:
According to this seconded aspect of the invention, the step of receiving the random data may be followed by the step encrypting information by using the random data, and the steps may be preceded by the steps of sending a request to read and receiving RFID tag information. The step of sending the encrypted information may also involve writing the information on the memory of the RFID tag, and the random data may, in other words, be a one time pad scheme.
An RFID reader comprising means arranged to perform the methods according to the second aspect above, is also provided.
According to a third aspect of the invention, a method of communication for an RFID system comprising an RFID reader communicating with an RFID tag is provided. The method comprises the steps of:
According to this third aspect of the invention, the random data may, in other words, be a one time pad scheme, and the random data may be derived from measuring any of thermal resistance noise, thermal shot noise, atmospheric noise and nuclear decay. Furthermore the random data and decrypted information may have the same length, thereby fulfilling the properties of a one time pad.
The method according to the third aspect of the invention may have the step of decrypting the information followed by the step of overwriting or deleting, by the RFID tag, the random data, and the steps according to the third aspect may be preceded by the steps of sending, from the RFID reader to the RFID tag, a request to read, and sending, from the RFID tag to the RFID reader, RFID tag information. The step of generating the random data may also be followed by the step of storing the random data, by the RFID tag, on a memory of the RFID tag.
An RFID system comprising an RFID reader according to above communicating with an RFID tag according to above, is also provided.
The invention makes use of the feature that an RFID communication is strongly asymmetric: the reader-to-tag communication can be eavesdropped from a much larger distance than the tag-to-reader communication. Therefore, in order to increase security, it appears to be sufficient to protect only half of the RFID communication against eavesdropping, in particular the insecure half, which is the reader-to-tag communication.
The tag-to-reader communication channel is still considered as inherently secure, due to the high proximity required to eavesdrop a message broadcast over this channel. The invention makes use of this feature, by using the relatively secure tag-to-reader channel for protecting the relatively insecure reader-to-tag channel.
In a preferred embodiment, when the reader reads information from the tag, the information is sent by the tag as usual. However, when the reader has to write information, the tag first generates random data. Preferably, this random data is then broadcasted over the secure channel to the reader, which uses it to encode information to be written to the tag.
After this, encoded data can be sent over the insecure channel towards the tag. The tag generally stores the random data it generated in a memory, and uses this to decode the information received from the reader. Thus, the original information is written to the tag. However, if an attacker intercepts the communication channel from reader to tag, he will not know which random data was used to encode the information to be written to the tag, and therefore he can only write random bits to the tag's memory when he broadcasts a message over the reader-to-tag channel.
Thus, a relatively secure communication can be obtained with inexpensive means, in particular using an RFID tag. Moreover, the communication according to the invention can be set up faster than when using a completely secure communication channel as there is no cryptographic handshake to process, and software development on the reader is easier as no cryptographic handshake routine need be implemented.
It is well known how to implement a means for generating random numbers into the RFID tag. For example, this can be done using the publicly available INTEL® Random Number Generator design. This design is elucidated in the paper with the same name, that can be retrieved from web address http://cnscenter.future.co.kr/resource/crypto/algorithm/random/criwp.pdf
This paper is incorporated herein by reference. The block diagram at page 3 shows the involved blocks and the needed functionality. The basis of the random number generator is a general noise source, that can be based on a resistor together with an amplifier that stimulates a first oscillator, which gets sampled by at least a second oscillator. After some digital corrections and statistical shaping the resulting bitstream can be used as random data. Because of the white noise character of the noise source, the generated data can be considered as truly random in nature.
Preferably, the communication method according to the invention incorporates a one time pad scheme (Vernam cipher) as disclosed in U.S. Pat. No. 1,310,719. This scheme requires the use of a true random data generating means in the tag, such as the above mentioned INTEL® Random Number Generator design to generate the pad. Moreover, the pad must be transmitted over a secure channel such as the tag-to-reader communication channel. Encoding of data in the one time pad scheme is straightforward and can be as simple as performing an XOR (exclusive OR) operation on the data using the pad.
Embodiments of the present invention will now be described, by way of example, with reference to the accompanying schematic drawings, in which:
When information M2 is to be written 126 to the tag 102, the reader 101 sends 116 a request to write to the tag 102. In response to this, the tag 102 activates its random data generator 202 for generating a one time pad P. This pad P is stored 118 in the tag memory 103 itself, or alternatively a dedicated memory in the tag 102, and is subsequently transmitted 122 over the relatively secure channel to the reader 101, in response to the write request. The reader 101 is arranged for encoding the information to be written M2 involving the pad P, for example by performing an XOR operation. The encoded data E is then sent 124 over the relatively insecure reader-to-tag channel to the RFID tag 102. The tag 102 uses the stored pad P for decoding the encoded data E, thus obtaining original information M2 to be written 126 to the tag memory 103.
In
In the scheme set out above, the tag 102 first generated pad P to fill 118 its memory 103 and then sends 122 it to the reader 101, but there is in practice no restriction on this sequence, as long as the tag 102 remembers which pad P was sent 122 to the reader 101. In this scheme, there is no guarantee that the second message (encoded data E) actually comes from the intended reader 101. But, if a malicious reader sends data instead of the intended reader 101, the message will result in random bits on the tag's memory 103, as the attacker does not know the pad P.
To further improve on this scheme, it may be possible to add a message integrity mechanism for the tag 102 to the message, in order to verify the decrypted message. Due to the properties of the one time pad (P), a cryptographically insecure message integrity mechanism such as CRC-32 is enough. Alternatively, or in addition, a reader 101 can verify the tag content the next time the tag 102 will be read.
In summary, the invention proposes to protect the relatively insecure reader-to-tag RFID communication with dedicated electronics, which is much cheaper than a full smartcard solution. Basically the RFID tag 102 is provided with a means to generate random data. When a reader 101 wants to write information to the tag 102, it first retrieves random data via the secure tag-to-reader communication channel. This data is used to encrypt the data to be written to the tag 102. Thus, encrypted data is sent via the insecure reader-to-tag channel and subsequently decoded in the tag 102. If an attack is carried out on the insecure channel, the attacker can only write meaningless data into the tag 102.
| Number | Date | Country | Kind |
|---|---|---|---|
| 05104959.1 | Jun 2005 | EP | regional |
| 05111441.1 | Nov 2005 | EP | regional |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/IB06/51761 | 6/1/2006 | WO | 00 | 12/3/2007 |
