WO2006058980A1

WO2006058980A1 - Method for transmitting identification data, method for processing said transmitted data, related devices

Info

Publication number: WO2006058980A1
Application number: PCT/FR2005/002902
Authority: WO
Inventors: Hervé SIBERT; Benoît Calmels; Sébastien CANARD; Marc Girault
Original assignee: France Telecom
Priority date: 2004-11-30
Filing date: 2005-11-22
Publication date: 2006-06-08

Abstract

The invention concerns a method for transmitting identification data from a first device (T) to at least a second device (L1, L2, L3, L4), including the following steps: dividing the identification data (N) into at least one first part of identification data (N1) having a first confidentiality level (C1) and a second part of identification data (N2) having a second confidentiality level (C2) higher than the first confidentiality level; encrypting a first data field including the second part of identification data; transmitting at least a second data field (M) including the first part of the non-encrypted identification data and the first encrypted data field.

Description

METHOD FOR TRANSMITTING IDENTIFICATION DATA, METHOD FOR PROCESSING DATA THUS TRANSMITTED,

ASSOCIATED DEVICES

The present invention relates to the field of the transmission of identification data of an element. It relates more particularly to confidentiality issues related to the traceability of the element.

The invention applies to any field of identification data transmission. She finds a particular interest in the field of contactless identification systems based on a radio transmission of identification data. These systems allow reading operations but also writing (or updating) by a reader, identification data broadcast from an electronic tag, also called tag, with an antenna and associated with an element to identify.

Some of these systems rely for example on RFID technology (Radio Frequency Identification).

Radio identification technologies are used in a variety of applications, such as manufacturing monitoring, logistics and transportation, distribution and sales, anti-counterfeiting, theft detection, after-sales services, etc. .

Electronic tags are able to issue identification data associated with them. These identification data generally identify the product on which the label is attached and allow to deduce various information, for example the type or model of the product, the serial number, the company producing the product etc.

The credentials can identify the user of the product.

Anyone with a tag reader can access the credentials and information provided by this data. It is also possible to deduce information relating to the movements made by the products (and therefore to users of certain products). This unrestricted dissemination may therefore raise issues related to the protection of privacy or the misuse of the information disseminated. These problems constitute obstacles to the deployment of radio identification technologies. There are techniques for partially meeting these needs for restricting access to the information provided by the identifiers broadcast from the tags and privacy protection.

Some labels have a feature to disable them. However this decommissioning is final and therefore makes the label unusable later.

A mechanism named "RSA Blocker Tag" (The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy, Ari Juels, Ronald Rivest and Michael Szydlo, see http://www.rsasecuritv.com/ rsalabs / staff / bios / aiuels /publications/blocker/blocker.pdf), developed by the company RSA Security, allows temporary blocking of the label reading by providing false answers, via a jammer (for example a specific label), to requests of a reader, which prevents him from distinguishing the information disseminated by a label. This mechanism makes it possible to prevent the tracing of data concerning individuals or goods, beyond a defined perimeter. The disadvantage of such a mechanism is that it is intrusive vis-à-vis labels that involuntarily enter the field of action of the jammer and are then involuntarily scrambled. Another mechanism (Squealing Euros: Privacy Protection in RFID-

Enabled Banknotes; Ari Juels and Ravikanth Pappu; cf. http://www.rsasecurity.com/rsalabs/staff/bios/ajuels/publications/euro/Euro.pdf) developed by RSA Security to protect against the risks of traceability in the case of integrated labels to banknotes. However, this mechanism requires a visual access to the banknote (optical reading), to exploit the identifier broadcast by the label, thereby greatly reducing the benefits provided by the wireless link.

The present invention aims to propose a solution that does not have the drawbacks of the techniques of the prior art and makes it possible to limit the unrestricted broadcasting of sensitive information provided by the identifiers provided by the tags practicing radio identification. According to a first aspect, the invention proposes a method of transmitting identification data by a first device to at least a second device.

A method according to the invention comprises the following steps: - distributing the identification data into at least a first part of identification data having a first level of confidentiality and a second part of identification data having a second level of confidentiality higher than the first level of confidentiality;

encrypting a first data field comprising at least the second portion of identification data;

transmitting a second data field comprising at least the first portion of unencrypted identification data and the first encrypted data field.

According to this method, the second part of the data, associated with the second level of confidentiality, is disseminated only in encrypted form. It is therefore accessible only to readers equipped with the adapted decryption key.

The first part of the data is broadcast in plain text, without being encrypted. It is therefore accessible to all readers. It can also be part of the encrypted data. Such a method according to the invention thus makes it possible to unrestricted diffusion of a limited part of the identification data associated with the first device, for example an electronic tag, and therefore a limited part of the information contained in this data. 'identification. This limited piece of information may be sufficient to perform certain operations such as managing an inventory, counting present or missing products, etc.

This method also makes it possible to disclose in a restricted manner all of the identification data, and therefore all the information attached to these identification data. These are accessible to the second devices, for example to electronic tag readers, provided with the decryption key corresponding to the encryption key used. This restricted information is required to perform operations for which it is necessary to precisely identify a product, for example as part of an after-sales service.

Such a method may also be advantageously completed by the implementation of a digital signature step, to allow authentication of the first device from which the identification data.

According to a second aspect, the invention proposes a method for processing data received by a second device, said data having been transmitted by a first device, said method comprising the following step: extracting from the received data at least non-data encrypted data comprising a first portion of identification data having a first level of confidentiality.

extracting moreover received data a first encrypted data field; - decrypt said first field;

extracting from said first decrypted field at least a second portion of identification data having a second level of confidentiality higher than the first level.

According to a third aspect, the invention proposes a device for transmitting identification data to at least a second device, comprising means for implementing a method according to the first aspect of the invention.

According to a fourth aspect, the invention proposes a device for receiving and processing transmitted data, comprising means for implementing a method according to the second aspect of the invention.

According to a fifth aspect, the invention provides a computer program, executable by a processing unit of a digital computer in a first device, comprising instructions for executing a method according to the first aspect of the invention in a execution of the program by said processing unit.

According to a sixth aspect, the invention proposes a computer program executable by a processing unit of a digital computer in a second device, comprising instructions for executing a program. method according to the second aspect of the invention during execution of the program by said processing unit.

Other features and advantages of the invention will become apparent on reading the description which follows. This is purely illustrative and should be read in conjunction with the attached drawings in which:

FIG. 1 represents a system embodying an embodiment of the invention;

FIG. 2 represents the RFID tag and the reader L1 of FIG.

1; FIG. 3 is a flowchart of the different steps of a method executed by an RFID tag in one embodiment of the invention;

FIG. 4 is a flowchart of the various steps of a method performed by a reader in one embodiment of the invention.

In Figure 1, a radio identification system 1 of RFID technology is shown. This system 1 comprises various products each having an RFID tag. Each tag is for example welded, riveted or injected into the product. Data identifying the product associated with the tag is stored in the tag.

This system 1 further comprises RFID tag readers. Such a system allows reading by a reader of a tag provided that the reader is in the radio coverage area of the tag. The reader can read several tags at the same time.

The tags considered in this embodiment are passive and therefore do not have their own energy to broadcast a signal. It is the electromagnetic field created by a reader at the tag that provides the energy required to wake up the chip and the broadcast of a signal with the identification data stored in the chip. In other embodiments, the tags are active. The broadcast frequency used by the tag is for example 13.56 MHz. Other frequencies can be used by other tags. In some cases, readers are compatible with different frequency tags.

The identification data considered in the embodiment described is in the form of a single EPC (Electronic Product Code) number specific to each tag and which comprises for example 96 bits. The number

EPC includes several groups of bits, each identifying, for example, the category of a product (indicating whether the product is a shirt, a car, a watch, etc.) or a serial number, the manufacturer of a product, or the country or the geographical area of origin or the distributor etc.

In FIG. 1, a product 2 among the various products of system 1 and four readers L1, L2, L3, L4 have been shown. The product 2 is provided with a tag RFID T, which is associated with it.

The RFID tag T has an antenna 3. As represented in FIG. 2, it also comprises a module 4 for constituting the elements to be transmitted, a memory 5, a pseudo-random number generator 6.

The memory 5 stores the EPC number specific to the RFID tag T and named N hereinafter. It further comprises a cryptographic key SKc and a private key SKs signature. The pseudo-random number generator 6 is adapted to produce random events.

The constitution module 4 is adapted to implement an encryption algorithm on data using the encryption key SKc and to implement a signature algorithm on data using the signature key SKs .

As shown in FIGS. 1 and 2, the reader L1 comprises an antenna 7, a pseudo-random number generator 8, a processing module 9 and a memory 10.

The memory 10 stores a decryption key SKD, associated with the encryption key SKc and a public key signature PKs, associated with the private key SKs, and for verifying said signature.

The processing module 9 is adapted to process the data received by the antenna 7 and originating from an RFID tag of the system 1. It is also suitable for to implement a decryption algorithm on a part of this data using the decryption key SKD and to implement a data authentication algorithm using the public key PKs signature. The reader L2 is adapted to read the data transmitted by the tag T, but has neither the decryption key SK ₀ , nor the public key signature PKs.

The reader L3 is adapted to read the data transmitted by the tag T. It has the decryption key SKD, but does not have the public key PK _S signature.

The reader L4 is adapted to read the data broadcast by the tag T. It has the public key signature PKs, but does not have the decryption key SKD.

According to the invention, it has previously defined a distribution of the bits of any EPC number between parties each associated with a respective level of confidentiality. In this case, two levels are defined. In other embodiments, a higher number of levels can be defined.

In the case considered, a first level of confidentiality C1 is associated with a set of groups of bits of the EPC number, providing general information on the product. A second level of confidentiality C2, superior to the first level C1, is associated with the groups of the EPC number that have not been associated with the first level of confidentiality. These groups correspond to sensitive and confidential information, their knowledge making it possible to precisely identify the product.

In the embodiment described with reference to FIG. 1, the distribution of the groups of bits of the EPC number associated with a tag is as follows: the group of bits identifying the category of the product is associated with the first confidentiality level C1 and constitutes so the first part, the other groups of bits are associated with the second level of confidentiality C2 and constitutes the second part. Very varied distributions can be implemented according to the embodiments of the invention. The operations carried out by the tag T in the embodiment of the invention in question are shown in FIG.

The operations carried out by the reader L1 in the embodiment of the invention in question are represented in FIG. 4. The reader L1 generates, using the generator 8, a random number m, then it diffuses this number m since antenna 7 (step a ').

The RFID tag T receives the hazard m (step a) and stores it in the memory 5.

Then it generates a random r with the pseudo-random generator 6 (step b). The signal constitution module 4 is adapted to implement the distribution of the fields of the number N according to the confidentiality levels C1, C2 as indicated above (step c), the distribution model having for example been stored previously in the memory.

Then, the module 4 constitutes a public field Idp comprising the first identification data part, N1, associated with the confidentiality level C1 and not including the second identification data part, N2, associated with the level C2. It also constitutes a secret field Ids (step d) comprising the second portion N2 of data associated with the level of confidentiality C2. In the embodiment considered, Idp is equal to the first part N1 of the bits of the identifier N, associated with the confidentiality level C1 and Ids is equal to the identifier N.

The module 4 then obtains the data field {r || lds} by concatenating the randomness r and the secret field Ids (step e). Then he encrypts this data field {r || Ids} using the encryption key SK ₀ stored in the memory 5 and thus obtains the encrypted data field {rj | Ids} _sκc (step f).

It then determines the data field M by concatenating the random value m stored in the memory 5, the encrypted data field {r || lds} _sκc and the public field Idp, that is M = m || {r || Ids} _sκc || Idp (step g).

Then the module 4 calculates the signature S of the data field M, using the signature key SKs: S = {M} _sκs (step h). The RFID tag T then diffuses using the antenna 3 the data field M and the signature S (step i).

The reader L1 receives these data M and S picked up by the antenna 7 (step b '). It verifies that the received hazard m is equal to the hazard that it has issued previously

(step c ').

Using the public key signature PKs, the processing module 9 of the reader L1 verifies that the signature S decrypted corresponds to the data field M, which proves that the data come from the tag T (step of) .

In one embodiment, the memory 10 stores in fact a plurality of public signature keys associated respectively with multiple tag identifiers. And the selection by the module 9 of the public key signature to be used is carried out among the public keys associated with identifiers whose bit portion associated with the first level of confidentiality C1 is equal to the public field Idp.

Then the processing module 9 of the reader decrypts the encrypted portion of the data field M using the decryption key SKD stored in the memory 10 (step e '). Ii thus obtains the hazard r and the secret field Ids (step f), which delivers the identifier N (step g ').

The role of the hazard m is to allow the reader L1 to ensure that the signature of the tag is not a simple replay of a previous signature.

The role of the hazard r is to make it possible to make the encryption non-deterministic, in order to prevent a tag from being traceable by a reader that would send back the hazard m and that would deduce the presence of the tag by detecting the same response M, S.

The reader L1 thus has access to all the identification data N and has validated the source of these data. It is thus able to perform operations requiring the knowledge of all the identification data N. For example, in the context of an after-sales service, it is necessary to find the secret field to determine the series of a product and validate the need for a workshop feedback. Or when the reader finds lost or stolen objects, it is necessary to find the secret field to identify the owner.

The reader L2 receives via its antenna 7 the data field M and the signature S. Having no key, it will extract from the data field the public field Idp, available in unencrypted form. He can not access the secret field Ids or the identifier N. He therefore does not have access to confidential data. In particular, it does not have access to data by which it is possible to infringe the privacy of a user of the product. Such a reader can detect what he does not read (that is, react if he does not find a public field that is supposed to be present), as part of the fight against theft. It can use the information provided by the public Idp field on the product and the user. It can count or control a quantity of products based on public field data. It can be used to facilitate a search, for example of an object lost in a room. It makes it possible to detect an exceeding of minima, in the context of customs operation for example. The operations carried out by the reader L2 are without guarantee however on the fact that this field was not sent in a malicious way, since it can not verify the signature. The reader L3 receives via its antenna 7 the data field M and the signature S. It will extract from the data field the public field Idp, available in unencrypted form. It has the decryption key SKp, but does not have the PKs signature public key. It will therefore decrypt the secret field Ids and thus obtain the identifier N. It may use the information provided by the full identifier N, but no guarantee on the source of this identifier, since it can not verify the signature.

The reader L4, when receiving the data M and S via its antenna 7 obtains the public field Idp, as the reader L2. Since it has the public key PKs signature, it can further verify the validity of public field data Idp. It can thus be used as part of the fight against counterfeiting of luxury goods, banknotes, identity cards, etc. In one embodiment, the reader L4 has a memory where the set of public keys for signing tags whose public field data Idp are identical, are stored in association with this data Idp. In the example described above, the readers L2, L3 and L4 receive the data M and S generated by the tag T from the reception of the hazard m to be provided by the reader L1. However, each of these readers can directly trigger the sending of similar data (including or not a random provided by the reader) from the tag T. In other embodiments, the secret field Ids consisting of

The RFID tag T comprises the bits of the second bit portion of the identifier N associated with the confidentiality level C2, but does not include the full N identifier.

Any type of pseudo random generator is usable by the invention. However, it must use a minimum of logic gates in order to be easily implantable in an RFID tag. In one embodiment, an anti-clone function of the type described in document FR 01 08586, filed on June 26, 2001, which may be performed in approximately 500 logic gates, will be used. Any encryption algorithm (symmetrical or asymmetrical) can be used to implement the invention. However, it must use a minimum of logic gates in order to be easily implantable in an RFID tag. In one embodiment of the invention, the implementation of AES described in "Strong Authentication for RFID Systems using the AES Algorithm" (M. Felhofer, S. Dominikus, J.

Wolerstorfer, Proceedings of CHES 2004) and which requires 3600 logic gates. It is also possible to use the anti-clone functions mentioned above.

In another mode of implementation, we use an asymmetric encryption algorithm, implementing the NTRU algorithm (see www.ntru.com) in 2500 logic gates.

Any signature / authentication algorithm is usable by the invention. However, it must use a minimum of logic gates in order to be easily implantable in an RFID tag. The GPS algorithm (see the document FR 9401271 filed 04/02/1994) can meet this need. The "Public Key Authentication with one (on-line) Single Addition" document (M. Girault, D. Lefranc, Proceedings of CHES 2004) describes the embodiments of this algorithm within an RFID tag. This signature / authentication algorithm requires the storage of coupons (integers previously calculated by a calculator outside the tag) in the RFID tag. As a result, the number of possible signatures / authentications by the RFID tag is limited by its storage capacity (each authentication corresponds to a new coupon and there can be no replay). To overcome this problem, it is possible, in the context of the invention, to consider an update of the RFID tag resulting in an addition of new coupons. Indeed, in some applications, the object containing the RFID tag necessarily and regularly returns to its origin. For example, in the case of banknotes, most banknotes are often returned to the Banque de France, which can each time fill the RFID tag with new coupons, thus allowing the latter to recharge in order to to authenticate a maximum of times.

It is also possible to use low-cost signature algorithms that do not use coupons and therefore do not require the reloading of the RFID tag.

The invention can be implemented in any radio identification system. It can also be applied in systems where identification data is transmitted from a first device to at least a second device, via communication links other than radio, for example a wired network.

Thus, the present invention enables a tag to broadcast its identification data, giving unrestricted access to a portion of its identification data, associated with a low level of confidentiality. The present invention, by encrypting a second portion of its data associated with a high level of confidentiality, allows these sensitive data to be read only by readers having the appropriate decryption key. The protection of the privacy of the users of the products is thus reinforced. The portion of the identification data associated with a low confidentiality level, is in embodiments, used to perform operations such as counting a quantity of products, searching for products. The present invention thus makes it possible to restrict the traceability of the products / users of the tags.

Advantageously, the invention further comprises the implementation of a digital signature process by the tag.

Claims

A method of transmitting identification data by a first device (T) to at least a second device (L1, L2, L3, L4), said method comprising the following steps:

distributing the identification data (N) into at least a first portion of identification data (N1) having a first level of confidentiality

(C1) and a second portion of identification data (N2) having a second level of confidentiality (C2) higher than the first level of confidentiality;

- encrypting a first data field comprising at least the second part of identification data (N2);

transmitting a second data field (M) comprising at least said first portion of unencrypted identification data (N1) and said first encrypted data field.

2. The method of claim 1, wherein the first encrypted data field is further function of a random (r) generated by the first device (T).

3. Method according to any one of the preceding claims, wherein a digital signature (S) of at least a portion of the second data field (M) is determined, and said signature is further transmitted.

4. Method according to any one of the preceding claims, wherein the second data field (M) further comprises a random (m) generated by the second device (L) and previously transmitted to the first device (T).

The method of any of the preceding claims, wherein the first data field comprises the first (N1) and second (N2) pieces of identification data.

6. A method of processing data received by a second device (L1, L2, L3, L4), said data having been transmitted by a first device (T), said method of processing comprising the following steps:

extracting from the received data at least unencrypted data comprising a first portion (N1) of identification data having a first level of confidentiality (C1);

extracting moreover received data a first encrypted data field;

- decrypt said first field;

extracting from said first decrypted field at least a second portion (N2) of identification data having a second level of confidentiality higher than the first level.

7. The method of claim 6, wherein further extracted unencrypted data received a random (m) provided by the second device to the first device before receiving said data.

8. The method of claim 6 or 7, wherein is further extracted from said first deciphered field, a random (r) generated by the first device (T).

9. Method according to one of claims 6 to 8, wherein further extracted data received, a digital signature (S) of at least a portion of the received data, and one verifies the validity of said signature.

Apparatus for transmitting identification data to at least a second device, comprising means for implementing a method according to one of claims 1 to 5.

11. Device according to claim 10, integrated in an RFID tag.

12. Device for receiving and processing transmitted data, comprising means for implementing a method according to one of claims 6 to 9.

13. Computer program, executable by a processing unit of a digital computer in a first device, comprising instructions for executing a method according to one of claims 1 to 5 during execution of the program by said processing unit. treatment.

14. Computer program, executable by a processing unit of a digital computer in a second device, comprising instructions for executing a method according to one of claims 6 to 9 during execution of the program by said processing unit. treatment.