JP2006262049A - Radio communication information medium and information medium tracking system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a radio communication information medium and information medium tracking system which make it difficult to track whereabouts of object, animals, and persons with radio tags attached thereto while using an anti-collision technique thereby protecting privacy of consumers using the system. <P>SOLUTION: The information medium includes: a power source generation part 202 for generating power source when an energy intensity of the external world has reached a specific value; transmission and reception parts 203 and 204 for transmitting and receiving information to and from an external communication medium; a variable individual ID generation part 206 for generating a variable individual identifier (ID) on the basis of changes in energy intensity in the external world; and a control unit 205 for transmitting the variable individual identifier (ID) from the transmission part 203 when it has received a command from the external communication medium. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an information medium for wireless communication and an information medium tracking system, and in particular, an information medium for wireless communication that handles an individual identifier (ID) such as a contactless IC card or a radio frequency identification tag (RFID) while protecting privacy. And an information medium tracking system.

  A radio frequency identification tag (hereinafter referred to as “wireless tag”) is an information medium on which information such as a product is recorded, and the information is read by wireless access. By attaching this wireless tag to the product, it is possible to improve the tracking and manageability (traceability) of the product to provide consumers with information on the origin of the product, and to improve the efficiency of distribution that enables the product to be provided at a low price There is great expectation for improving efficient inventory management (supply chain management).

FIG. 15 is a block diagram illustrating a conventional wireless tag 100, which includes an antenna 101, a power generation unit 102, a transmission unit 103, a reception unit 104, a control unit 105, a fixed individual ID storage unit 106, and a data storage memory 107.
The antenna 101 transmits and receives radio waves, and the power generation unit 102 transmits an electronic circuit of the wireless tag 100 via the antenna 101 from an electromagnetic field supplied from an external wireless tag access device (hereinafter referred to as “access device”). It is a device for taking out the power to be driven. As a result, power can be supplied from the outside, and there is no need to incorporate a power supply source such as a battery.

  The transmission unit 103 is an electronic circuit that performs high-frequency modulation on the signal transmitted from the control unit 105 and outputs the signal. The modulation signal output therefrom is radiated from the antenna 101 as a radio wave. The receiving unit 104 is an electronic circuit that demodulates the radio wave received by the antenna 104 and sends it to the control unit 105.

  The control unit 105 is a part that controls an electronic circuit constituting the wireless tag 100, and transmits a transmission signal to the transmission unit 103 and receives a reception signal from the reception unit 104. Further, an individual identifier (ID) is read from the fixed individual ID storage unit 106, and data is read from and written to the data storage memory 107. The control unit 105 controls the wireless tag 100 in accordance with an instruction to read and write data to the wireless tag 100 given from an external access device.

  The fixed individual ID storage unit 106 is a device that stores a unique identifier given to each wireless tag 100. The data storage memory 107 is a memory device that stores data.

  Compared to conventional barcodes, wireless tags are superior in terms of the size of information media, the ability to add and change data, and ease of handling, etc. Fields where current barcodes are used Are expected to move to wireless tags in the near future.

  Anti-collision technology, which is one of the advantages of wireless tags over conventional barcodes, is an access protocol technology that simultaneously reads information from multiple wireless tags by wireless access from a remote location. JIS-X-6323 is a typical standard. -3 (ISO / IEC15693-3) exists.

  When accessing a plurality of wireless tags by the anti-collision technology, it is not necessary to access each wireless tag like a barcode, and they can be accessed simultaneously. For example, when a plurality of products equipped with wireless tags are packed together and packed in a box that transmits radio waves, all the wireless tags in the box can be accessed together without unpacking the box. As described above, the anti-collision technology greatly improves the handling property of the wireless tag, and is indispensable from the viewpoint of practicality.

However, in order to use the anti-collision technology, it is necessary to give a unique individual identifier (ID) to each wireless tag according to the protocol requirements. The individual identifier (ID) is different from the information stored in the wireless tag, and corresponds to a so-called Ethernet (registered trademark) MAC (Medium Access Control) address. In the JIS-X-6323-3 standard, this individual identifier (ID) is called a unique identifier (UID), and the size is 64 bits. Since this individual identifier (ID) is used for designating the data access destination, all access devices can always read the individual identifier (ID) of the access target wireless tag.

  That is, as long as the anti-collision technique is used, all wireless tags are assigned individual identifiers (ID) regardless of the data content to be recorded, and all access devices can read the individual identifiers (ID).

However, if the product is sold to a consumer with the wireless tag attached to the product, and the access device is accessed without the consumer being aware that the product is attached with the wireless tag, the individual identifier is remotely accessed by wireless access. (ID) can be read.
In such a case, the whereabouts information of a consumer who moves while carrying a product with a wireless tag attached may be tracked and managed in a manner not desired by the consumer. This is highly undesirable in terms of privacy protection.

  Patent Document 1 can read data such as an ID number, a departure place, a weight, a dimension, a route, and a destination stored in a memory of a wireless tag attached to a product from an electronic device operated by an operator. A detection system is disclosed. According to this detection system, the location of the consumer can be tracked by reading the individual identifier (ID) of the wireless tag.

  The above-mentioned privacy protection problem can be avoided if the wireless tag is removed or the function is invalidated when the product is delivered to the consumer. However, even after the product is delivered to the consumer, there may be a case where the wireless tag is worn while the function is utilized in order to ensure some profit for the consumer or for social needs. For example, when obliging to attach a wireless tag for environmental conservation purposes such as recycling, store the repair history of the car in the wireless tag to improve the safety of used cars. For example, it may be possible to improve the health of the user by storing repelling items in the wireless tag.

If the wireless tag is not removed or invalidated in this way, tracking management is possible on the one hand, and privacy infringement may occur on the other hand.
In order to solve this problem, it is conceivable to prevent an unintended access by the consumer who is the owner of the wireless tag by using a disturbing device that transmits a fake individual identifier (ID).

  Japanese Patent Laid-Open No. 2004-26883 discloses an individual identifier transmitted last time when a wireless tag that has received a transmission command for an individual identifier (ID) from a tag reader (access device) has not passed 5 seconds since the previous transmission of the individual identifier (ID). Disclose a privacy protection identifier transmitter that can be used as a disturbing device that transmits a false individual identifier (ID) based on the count value of a random counter when the same ID as (ID) is transmitted and 5 seconds have elapsed is doing. According to this privacy protection identifier transmission device, it is possible to prevent the invasion of consumer privacy as described above.

  However, this disturbing device interferes with the normal operation of the wireless tag, or interferes with another wireless tag existing in the vicinity to inhibit communication. For this reason, the operation cannot always be performed, and it is necessary to appropriately switch between the normal operation mode and the disturbance mode, and there is a problem that the operation becomes complicated. In addition, such a complicated operation always causes an operation error due to human factors, and there is a problem that privacy infringement may occur due to a mistake in mode switching operation of the disturbing device.

  As another solution for preventing privacy infringement, Patent Document 3 discloses an electronic labeling method. The electronic labeling method includes writing a value into a first memory, writing a type into a second memory, and accessing the first memory in response to the first and second steps. A step of evaluating an access control rule is provided, and tracking of a wireless tag and rewriting of data in a memory are controlled by evaluating the access control rule.

  With this electronic labeling method, access control can be performed on information held by the wireless tag. In addition, it is possible to limit the person who can read the individual identifier (ID), or to overwrite the individual identifier (ID) and delete the property as the individual identifier (ID). Apart from this method, the same effect can be obtained by performing encryption processing on the information held by the wireless tag.

  However, these solutions make tracking management difficult by disabling reading of the individual identifier (ID) by the access device, and the anti-collision technology that requires the access device to be able to read the individual identifier. Has the problem of being incompatible in principle.

  As another solution for preventing privacy infringement, Patent Document 4 discloses a product search system. The product search system obtains an identification code including product attribute information and an email address for identifying a product from a communication terminal, searches for a product to which a wireless tag having the identification code is attached in advance, and the search result Is sent to the e-mail address of the identification code.

  Since the product search system notifies the search result to a known e-mail address, it is possible to track and manage the product with the wireless tag attached while protecting the privacy.

However, the tracking management system itself manages the location information only by guaranteeing that the privacy information is not leaked to the system user. This is a system that relies on the system administrator's sexuality theory, and there is a problem that is not true privacy protection.
JP-A-6-123773 JP 2004-192645 A JP 2002-31001 A JP 2002-215848 A

  As described above, according to the conventional method, apparatus, and system, since the anti-collision technology is used, a unique individual identifier (ID) is assigned to each wireless tag according to a request in the protocol, and the individual identifier (ID) Is readable from all access devices. For this reason, in order to make it difficult to track and manage the wireless tag, if the reading of the individual identifier (ID) by the access device is disabled, there arises a problem that the privacy protection of the consumer and the anti-collision technology are not compatible.

  Accordingly, an object of the present invention is to provide an information medium for wireless communication that uses anti-collision technology and at the same time makes it difficult to track the location of an object, animal, person, etc., to which a wireless tag is attached, and protects the privacy of consumers who use it And providing an information medium tracking system.

  The present invention includes a power generation unit that generates power when the energy intensity of the outside world reaches a predetermined value, a transmission / reception unit that transmits / receives information to / from an external communication medium, and a variable individual identifier based on a change in the energy intensity. And an information medium for wireless communication provided with a control unit that transmits the variable individual identifier from the transmission / reception unit when a command is received from the external communication medium.

In this wireless communication information medium, when entering an external energy intensity, for example, a magnetic field of a predetermined operation level, the power generation unit generates a power based on the magnetic field, and the variable individual identifier generation unit generates the variable individual identifier. Generate. At this time, when an identifier transmission command is received from an external communication medium (access device), the control unit transmits the variable individual identifier from the transmission / reception unit to the external communication medium (access device).
Here, the wireless communication information medium is a wireless tag, a wireless IC card, or the like, but is not limited thereto.

In an embodiment of the present invention, the power generation unit generates a power when an external magnetic field is higher than a predetermined operation level,
The variable individual identifier generation unit can generate a variable individual identifier different from the previous one when the power source is generated.
In this embodiment, a threshold is provided at a level at which the power generation unit operates by an external magnetic field, and the power generation unit does not operate at a magnetic field below the threshold.

In another embodiment of the present invention, the variable individual identifier generation unit can generate the variable individual identifier that does not collide with a variable individual identifier of another wireless communication information medium.
In this embodiment, the variable individual identifier generation unit can include, for example, a pseudorandom number generator.

In another embodiment of the present invention, the variable individual identifier generation unit generates an individual identifier list array storage unit that stores a plurality of individual identifiers, and generates a pseudo random number as a salt value based on the change in the energy intensity. A salt value generation unit configured to read the address of the individual identifier list array storage unit as a read index address of the individual identifier list array storage unit and a variable individual identifier as a value read from the individual identifier list array storage unit.
In this embodiment, it is possible to prevent collision between variable individual identifiers of a plurality of wireless communication information media.

In another embodiment of the present invention, the variable individual identifier generation unit includes a secret individual identifier storage unit that stores a secret individual identifier that cannot be read out from the wireless communication information medium, and the energy intensity It is composed of a salt value generation unit that generates pseudo random numbers as salt values based on changes, and a one-way function calculation unit that performs conversion that is difficult to reversely convert, and the secret individual identifier and the salt value are stored in a one-way function calculation unit. An output value obtained by inputting can be used as a variable individual identifier.
In this embodiment, the need for a large-capacity storage device is avoided while preventing variable individual identifiers from colliding among a plurality of wireless communication information media.

In another embodiment of the present invention, the variable individual identifier generation unit periodically generates a variable individual identifier, and the period is the same as a predetermined standard value or the maximum of the period and the standard value The common divisor can be made sufficiently large.
In this embodiment, even when an external communication medium (access device) collects variable individual identifiers transmitted by the wireless communication information medium, it is possible to prevent the tracking probability of the wireless communication information medium from increasing. .

  In another embodiment of the present invention, the variable individual identifier generation unit may prevent the same variable identifier from being duplicated during one cycle of generating the variable individual identifier.

Further, in another embodiment of the present invention, the variable individual identifier generation unit is configured by an individual identifier list array storage unit that stores a plurality of individual identifiers and a counter having a predetermined standard value period, The count value of the counter can be used as a read index address of the individual identifier list array storage unit, and the value read from the individual identifier list array storage unit can be used as a variable individual identifier.
In this embodiment, it is possible to realize a circuit configuration in which the variable individual identifier is periodically changed so that one individual identifier appears only once in one cycle.

In another embodiment of the present invention, the variable individual identifier generation unit includes a secret individual identifier storage unit that stores a secret individual identifier that cannot be read out from the wireless communication information medium, and a predetermined standard. It is composed of a counter having a value period and a one-way function calculation unit that performs conversion that is difficult to reversely convert, and obtained by inputting the secret individual identifier and the counter value of the counter to the one-way function calculation unit The output value can be a variable individual identifier.
In this embodiment, it is possible to realize another circuit configuration in which the variable individual identifier is periodically changed so that one individual identifier appears only once in one cycle.

  In another embodiment of the present invention, it is preferable that the variable individual identifier generation unit is a natural number with a period of 2 for periodically generating the variable individual identifier.

Further, in another embodiment of the present invention, the variable individual identifier generation unit does not generate a new variable individual identifier when the elapsed time from the generation of the previous variable individual identifier is within a predetermined value. The previously generated variable individual identifier can be used again.
In this embodiment, the scanning of the variable individual identifier pattern is made long by increasing the scanning time.

  Further, in another embodiment of the present invention, the variable individual identifier generation unit generates a new variable when communicating with the same external communication medium as the external communication medium when the previous variable individual identifier was generated. The variable individual identifier generated last time can be used again without generating the individual identifier.

In another embodiment of the present invention, the variable individual identifier generation unit can change the pattern generated by the variable individual identifier according to the time of a built-in clock.
Further, the present invention is an information medium for wireless communication equipped with a variable individual identifier generating unit that is attached to an object, an animal, or a person and generates a variable individual identifier that changes based on a change in the energy intensity of the outside world,
There is provided an information medium tracking system including an external communication medium that transmits and receives to / from the wireless communication information medium and reads the variable individual identifier.

  In another embodiment of the present invention, the object, animal, or person can wear a plurality of wireless communication information media.

In another embodiment of the present invention, the plurality of wireless communication information media can generate the variable individual identifier in the same period in the variable individual identifier generation unit.
In this embodiment, even if the object, animal, or person wears a plurality of wireless communication information media, it is possible to prevent the probability of tracking the wireless communication information media from increasing.

  According to the information medium for wireless communication and the information medium tracking system of the present invention, while maintaining compatibility with the anti-collision technology and protecting the privacy of the user of the information medium such as the wireless tag and the wireless IC card, the user Contrary to the intention, it is difficult to track the location of an object, animal, or person wearing the information medium.

[First Embodiment]
FIG. 1 is a block diagram of a wireless tag 200 as an information medium for wireless communication in the first embodiment of the present invention. The wireless tag 200 includes an antenna 201, a power generation unit 202, a transmission unit 203, a reception unit 204, a control unit 205, a variable individual ID generation unit 206, and a data storage memory 207. The wireless tag 200 includes a variable individual ID generation unit 206 instead of the fixed individual ID storage unit 106 of the conventional wireless tag 100, and the other configuration is the same as that of the conventional wireless tag 100.

  Although the conventional wireless tag 100 has only one individual identifier (ID), the wireless tag 200 according to the first embodiment generates a variable individual identifier that generates different types of individual identifiers (ID) in accordance with instructions from the control unit 205. A generation unit 206 is provided, and an individual identifier (ID) that changes depending on conditions when the access device is accessed is used.

  FIG. 2 is a flowchart showing a processing flow of the wireless tag 200 shown in FIG. The wireless tag 200 is initially in a power-off state (301). When the wireless tag 200 enters the operating magnetic field generated by the external access device (302), the power generation unit 202 converts the operating magnetic field to generate power (303). Subsequently, the variable individual ID generation unit 206 generates an individual identifier (ID) (304). After generating the individual identifier (ID), the state of the wireless tag 200 shifts to the operation state (305). When the wireless tag 200 goes out of the operating magnetic field while in the operating state, it shifts to a power-off state (306). When the wireless tag 200 is in the operating magnetic field in the operating state, processing is performed in accordance with the instruction command given from the external access device based on the individual identifier (ID) generated in step 304 (307). The protocol used in this processing is, for example, JIS-X-6323 (ISO / IEC15693).

  As described above, every time an operating magnetic field of an external access device is entered, an individual identifier (ID) is newly generated and used, so that it is not tracked and managed by the individual identifier (ID). It is possible to use a collision technique.

  FIG. 3 shows a configuration of a pseudo-random number generator 401 as the variable individual ID generation unit 206. When the pseudo-random number generator 401 receives a request for generating an individual identifier (ID) from the control unit 205, the pseudo-random number generator 401 calculates a pseudo-random number using an internal parameter held in the internal state holding unit 402 configured by a non-volatile memory, for example. To do. After recording the internal parameter changed by the calculation process in the internal state holding unit 402, the pseudo-random number generator 401 outputs the calculated pseudo-random number as a variable individual identifier (ID).

It is desirable that the algorithm for generating the pseudo-random number is difficult to predict the next output and the internal state even if an output having a certain length is observed. For example, the M series is not suitable.
In addition, since the internal circuit of the wireless tag 200 is not supplied with power outside the operating magnetic field, the internal state holding unit 402 needs to be configured by a nonvolatile storage device such as a flash memory. This is relatively expensive to manufacture and requires a large amount of power to write data. In addition, since the guaranteed number of rewrites is also limited, it is desirable that the amount of information in the internal state be as small as possible.

  Pseudorandom numbers do not guarantee uniqueness. For this reason, the same pseudo-random number happens to be generated in different wireless tags, and variable individual identifiers (IDs) may overlap. If a wireless tag using the same individual identifier (ID) exists among a plurality of wireless tags accessed simultaneously (individual identifier (ID) collision), these wireless tags become inaccessible.

  The probability that such a state will occur is inversely proportional to the size of the pseudorandom range, and if the bit length of the generated pseudorandom number is increased, the probability that a collision will occur becomes very small. However, the probability of collision cannot be made zero.

  In addition, in order to generate a pseudo-random number that has a long output bit length and is difficult to predict, the amount of information in the internal state becomes large, and the capacity required by the internal state holding unit inevitably increases.

[Second Embodiment]
FIG. 4A shows a configuration of the variable individual ID generation unit 206 according to the second embodiment of the present invention, which guarantees that there is no collision of individual identifiers (ID). The salt value generation unit 501 and the individual An ID list array storage unit 502 is included. Upon receiving the individual ID generation request, the salt value generation unit 501 generates a random number (salt value) having a relatively short bit length. As shown in FIG. 4B, the individual ID list array storage unit 502 is a storage device that holds a plurality of individual identifiers ID1, ID2, ID3,... A list of a plurality of individual identifiers (ID) for guaranteeing that the information is not stored is stored in advance.

  The individual ID list array storage unit 502 selects one individual identifier (ID) from a plurality of held individual identifiers (ID) as an index address for reading out the salt value generated by the salt value generation unit 501. To do. The selected individual identifier (ID) is used as the variable individual ID. Thereby, it is possible to generate an individual identifier (ID) that is guaranteed not to collide with an individual identifier (ID) of another wireless tag in any case.

  However, since it is necessary to store a large number of individual identification (ID) children in the individual identifier list array storage unit 502, the storage capacity becomes very large, which may increase the manufacturing cost.

  FIG. 5 shows a configuration of the variable individual ID generation unit 206 according to the third embodiment of the present invention that guarantees that individual identifiers (IDs) do not collide and does not require a large-capacity storage device. An ID storage unit 601, a salt value generation unit 602, and a one-way function calculation unit 603 are included.

  The secret individual ID storage unit 601 stores a secret individual identifier (ID) of the wireless tag 200. This secret individual identifier (ID) cannot be accessed from the outside and cannot be read. Similar to the salt value generation unit 501 in FIG. 4A, the salt value generation unit 602 generates a random number (salt value) having a relatively short bit length when receiving an individual ID generation request from the control unit 205. The one-way function calculation unit 603 performs one-way function conversion using, for example, a 32-bit secret individual ID and a 16-bit salt value, for example, and outputs the result as a variable individual ID.

[Third Embodiment]
FIG. 6 shows a configuration of a one-way function calculation unit 603 according to the third embodiment of the present invention, which includes a selector 702, nonlinear conversion units 703 to 708, a bit transposition unit 709, and an adder 710. This example computes a one-way function of 48-bit input and 48-bit output. The conversion process of the one-way function calculation unit 603 is a bijection map, and it is necessary to perform inverse conversion to obtain an input value from an output value and to predict the next output.

  In FIG. 6, a 48-bit input value 701 obtained by adding the 32-bit output of the secret individual ID storage unit 601 of FIG. 5 and the 16-bit output of the salt value generation unit 602 passes through the selector 702, and 6 bits every 8 bits. The data is divided into two groups and transmitted to the nonlinear conversion units 703 to 708 assigned to the respective groups. The nonlinear conversion units 703 to 708 incorporate 8 bits × 256 kinds of map data, and output 8 bits data mapped to 8 bits input values. Each of the six nonlinear conversion units 703 to 708 has different map data.

  The output data of the six nonlinear conversion units 703 to 708 are collected into 48 bits and transmitted to the bit transposing unit 709. The bit transposing unit 709 transposes (shuffles) the bit positions of the 48-bit input data and outputs 48-bit data. One input bit of the bit transposing unit 709 always corresponds to only one of the output bits. A gate element is not required for mounting the bit transposing portion 709, and it can be mounted only by wiring.

  The output of the bit transposing unit 709 is input to the adder 710. An addition constant 711 is also input to the adder 710, and the adder 710 outputs a value obtained by adding the output of the bit transposing unit 709 and the addition constant 711 as an output value 712. The carry bit generated by this operation is not used.

The conversion process so far is called one stage, and the output of the adder 710 is the final output of the conversion process of one stage.

  The output of the first stage is fed back via the selector 702, and the conversion process of the second stage is performed. Similarly, the output of the second stage is fed back, and the conversion process of the third stage is performed. In this way, the conversion process is repeated many times. When the conversion process for a predetermined number of stages is completed, the output is output as the calculation result of the one-way function unit.

  As long as the predetermined number of stages is 3 or more, it may be any number. However, if the number of stages is increased, the time required for calculation increases and the power consumption also increases. Therefore, generally, the number of stages is 3.

  The map data of the six nonlinear conversion units 703 to 708, the transposition map data of the bit transposition unit 709, and the addition constant 711 are important parameter data of the one-way function and need to be kept secret. These parameter data are set at the same time as or before the setting of the secret individual ID performed when the wireless tag 200 is manufactured.

The one-way function calculation unit 603 according to the third embodiment can be implemented with a considerably smaller number of gates than the number of necessary gates in the individual ID list array storage unit 502.
With the configuration of the third embodiment, it is possible to generate an individual identifier (ID) that is guaranteed not to collide without using a large-capacity storage device. However, in order to guarantee collisionlessness, the number of patterns of variable individual IDs generated is limited by the number of patterns of salt values (the bit length of salt values), and decreases. For example, if the bit length of the secret individual ID is 32 bits and the bit length of the salt value is 16 bits, the number of patterns of the variable individual ID is 2536, which is 65536.

  The number of patterns of variable individual IDs and the difficulty of tracking management are closely correlated. For example, it is assumed that only one variable individual ID used by the wireless tag 200 is recorded at a certain point in time and is tracked and managed as a tracking target identifier (ID). If there is an environment in which the individual identifiers (IDs) of all accessible wireless tags 200 can be collected by an access device that exists in a public space or a private space, the tracking target identifier (ID) is selected from the collected individual identifiers (ID). ) Can be searched to find out where the tracked wireless tag 200 is located.

  In such an environment, when tracking and managing an object, an animal, or a person wearing only one wireless tag 200 using 65536 kinds of variable individual IDs at random, the access device accesses the wireless tag 200 to be tracked. Even so, the probability that the read individual identifier (ID) matches the tracking target identifier (ID) recorded in advance is only 1/65536. In other words, it can be detected only with a very low probability, and tracking management becomes difficult.

  FIGS. 7A and 7B show the tracking method of the wireless tag 200 described above. FIG. 7A shows that when the tracking target identifier (ID) is A-1, when the tag reader 801 as the access device reads the variable individual ID of the wireless tag 200 via the antenna 802, the variable individual ID is Since it is A-1234, it has shown that it was not able to be tracked (NOT MATCH). The probability of untrackable access is 65535/65536. FIG. 7B shows a case where the wireless tag 200 is tracked when the variable individual ID is A-1, and since the tag reader 801 reads the variable individual ID of A-1 from the wireless tag 200, tracking was possible. (MATCH) is shown. The probability of access that can be tracked is 1/65536.

  The lower the match probability, the higher the difficulty of tracking management. Since the match probability is inversely proportional to the number of patterns of the variable individual ID, tracking management becomes more difficult as the number of patterns of the variable individual ID increases.

  In order to increase the number of patterns of the variable individual ID, the bit length of the salt value of the salt value generation unit 602 may be increased. However, for that purpose, it is necessary to shorten the bit length of the secret individual ID in the secret individual ID storage unit 601, and the number of individuals to which the identifier (ID) is assigned is reduced. Therefore, it is not possible to increase the bit length of the salt value indiscriminately.

  In general, if the access device (tag reader 801) captures only with a probability of 1/65536, it can be said that the difficulty of tracking management is sufficiently high.

  However, when a plurality of wireless tags 200 are attached at the same time, the difficulty of tracking management is considerably reduced. A description will be given of tracking management when three wireless tags are attached in the assumed tracking management environment described above.

  In FIG. 8A, three individual identifiers (ID) A-1, B-1, and C-1 recorded at a certain time are used as tracking target identifiers (ID). Here, the wireless tags 200A, 200B, and 200C to be accessed are attached to the same object, animal, or person, and the tag reader 801 reads the variable individual IDs of A-1, B-54321, and C-2345. . Assuming that the number of variable individual identifier (ID) patterns of each of the wireless tags 200A, 200B, and 200C is 65536, the probability of matching is approximately 3/65536, which is proportional to the number of wireless tags compared to only one wireless tag. Thus, the probability of matching increases.

  In FIG. 8A, the individual identifiers (ID) of A-1, B-54321, and C-2345 are read, and A-1 matches the tracking target identifier. At this time, the identifiers (ID) of B-54321 and C-2345 read other than the matched A-1 are highly likely to be different patterns of the variable individual identifiers (ID) of the wireless tags 200B and 200C. Therefore, as shown in FIG. 8B, identifiers (ID) of B-54321 and C-2345 are also added to the tracking target identifier list. Accordingly, as shown in FIG. 8C, the matching probability is improved to 5/65536, and tracking management becomes easier.

  For a new tracking target identifier (ID), a search is performed for an identifier (ID) read in the past and an identifier (ID) to be read from now on. As shown in FIG. 8D, since the searched items can be further increased to the tracking target identifier list in the same procedure, the variable individual identifier (ID) patterns can be collected in the following formula.

  As described above, since the number of tracking target identifiers (ID) can be increased, the number of patterns that can be collected increases exponentially and the tracking management becomes easier as the number of attached wireless tags increases.

[Fourth Embodiment]
FIGS. 9A and 9B show a wireless tag as an information medium for wireless communication according to the fourth embodiment of the present invention. In order to prevent tracking management from being facilitated by the exponential increase in the number of patterns that can be collected, the variable individual ID generation unit 206 stops generating identifiers (IDs) at random, and periodically The identifier (ID) is changed so as to be generated, and the period is made uniform for all the wireless tags. As a result, the variable individual identifiers (ID) of all the wireless tags change synchronously in the same cycle.

  FIGS. 9A and 9B show tracking management when the variable individual identifiers (ID) of the three wireless tags 200A, 200B, and 200C change in synchronization.

  In FIG. 9A, the variable individual identifiers (ID) read from the wireless tags 200A, 200B, and 200C by the tag reader 801 are A-2349, B-2349, and C-2349. Therefore, it is a case where it cannot be tracked (NOT MATCH). The probability of untrackable access is 65535/65536.

  In FIG. 9B, the variable individual identifiers (ID) that change in the same period in the wireless tags 200A, 200B, and 200C read by the tag reader 801 are A-1, B-1, and C-1. This is the case when it can be traced (MATCH). The probability of access that can be tracked is 1/65536.

  In FIG. 9B, since all the wireless tags 200A, 200B, and 200C transmit the same variable individual ID as the tracking target identifier, a new identifier (ID) pattern is not read. That is, the variable individual identifier (ID) pattern is not collected in the formula.

  In general, there is a trade-off between the number of variable individual identifier (ID) patterns and the manufacturing cost of a wireless tag, and an inexpensive wireless tag that has a relatively low tracking management difficulty depending on the application, and the tracking management difficulty is very high. It is desirable to be able to select which of the expensive wireless tags is used. However, in order to do so, it is unreasonable to set the variable individual identifier (ID) change period to the same period for all wireless tags.

  For example, when the cycle of a certain type of wireless tag is 10,000 accesses and the cycle of another type of wireless tag is 20000, the two types of wireless tags are mixed if the cycle is in a small integer ratio. Even if it is used, the change pattern of the variable individual identifier (ID) is well synchronized, so that the difficulty of tracking management is not so weak as compared with the case where the period is the same. Strictly speaking, if the greatest common divisor of two periods is sufficiently large, the difficulty of tracking management will not be reduced.

  If the period is defined in this way, it is relatively safe to use wireless tags having different variable individual identifier (ID) change periods.

  Further, in a variable individual identifier (ID) generation pattern, tracking management becomes more difficult if one individual identifier (ID) pattern appears only once in one cycle.

[Fifth Embodiment]
FIG. 10 shows a variable individual ID generation unit 206 according to the fifth embodiment of the present invention. In this embodiment, the variable individual identifier (ID) is periodically changed, and one individual identifier (ID) pattern appears only once in one cycle.

  10 is obtained by replacing the salt value generation unit 501 shown in FIG. 4 with a gray counter 1101, and the individual ID list array storage unit 502 is the same as FIG.

[Sixth Embodiment]
FIG. 11 shows the variable individual ID generation unit 206 according to the sixth embodiment of the present invention. In this embodiment, as in the fifth embodiment, the variable individual identifier (ID) is periodically changed, and one individual identifier (ID) pattern appears only once in that cycle.
11 is obtained by replacing the salt value generation unit 602 shown in FIG. 5 with a gray counter 1202, and the secret individual ID storage unit 601 and the one-way function calculation unit 603 are the same as those in FIG.

In the fifth and sixth embodiments, since the gray counters 1101 and 1202 are used instead of the salt value generation units 501 and 602, a variable individual identifier (ID) can be periodically generated. One individual identifier (ID) pattern appears only once in a cycle. In addition, the variable individual identifier (ID) generation cycle is always a natural number power of 2. Specifically, if the bit length of the counter is n bits, the number of accesses is ²ⁿ . This is because even if the wireless tag using the variable individual ID generation unit 206 having different counter bit lengths is used in combination, the greatest common divisor of the cycle of the variable individual identifier (ID) is the bit length of the counter. It is a cycle of a variable individual identifier (ID) of a short wireless tag, and it can be guaranteed that it is sufficiently large.

  Here, the counter is not necessarily a gray counter, and may be a binary counter. However, by adopting the gray counter, the gray counter has a characteristic that only one bit changes at the time of counting. Therefore, when the counter value is recorded in a non-volatile memory such as a flash memory cell at power-off, only the memory cell for one bit is used. The value can be reversed. Therefore, the rewriting frequency of the nonvolatile memory cell can be suppressed to the minimum necessary, and there is an advantage that the life of the memory cell can be extended and the power consumption can be reduced as compared with the case where the binary counter is used.

  Naturally, the one-way function calculation unit 603 in FIG. 11 needs to implement a one-way function that makes the input unpredictable from the output even if there is an input regularity that the change is only 1 bit.

  FIG. 12 is a flowchart showing the timing at which the gray counters 1101 and 1202 increment the counter value by 1 (count up) in the fifth and sixth embodiments. When the wireless tag 200 enters an operating magnetic field in the power-off state (1301) (1302), the counter value is incremented by 1 (1303), and a variable individual identifier (ID) is generated based on the value (1304). The operating state (1305) is entered. When the wireless tag 200 comes out of the operating magnetic field when in the operating state (1306), the wireless tag 200 returns to the power-off state (1301).

  Thus, by increasing the counter value, a different individual identifier (ID) can be used each time the access device accesses.

  However, in this counter value increasing algorithm, it is possible to read a large number of individual identifier (ID) patterns in a short period of time by intentionally continuously turning on and off the operating magnetic field. For example, when the bit length of the counter is 16 bits, the number of individual identifier (ID) patterns is at most 65536. If a different individual identifier (ID) can be read once every 10 milliseconds, all patterns can be scanned in less than 11 minutes. If all patterns of individual identifiers (ID) are recorded, tracking management can be performed.

  FIG. 13 is another flowchart showing the timing when the gray counters 1101 and 1202 increase the counter value by 1 (counter up) in the fifth and sixth embodiments, and all patterns can be scanned in less than 11 minutes as described above. Is to prevent When the wireless tag enters the operating magnetic field in the power-off state (1401) (1402), it is examined how long the power-off state has continued (1403). If the power-off state continues for 5 seconds or more, the counter value is incremented by 1 (1404). Otherwise, the counter value does not change. Thereafter, the same processing as in the example shown in FIG. 12 is performed. A variable individual identifier (ID) is generated (1405), and an operation state is entered (1406). When the wireless tag 200 comes out of the operating magnetic field when in the operating state (1407), the wireless tag 200 returns to the power-off state (1401).

  As described above, when the gray counters 1101 and 1202 are controlled, a new variable individual ID is not used unless an interval of 5 seconds or more is provided. This makes it difficult to scan a variable individual identifier (ID) pattern continuously in a short time. For example, it takes 91 hours at the shortest to scan all 65536 patterns. That is, it is possible to increase the difficulty of collecting variable individual identifier (ID) patterns.

  However, although it takes time, it is not impossible to collect all patterns of variable individual identifiers (ID).

[Seventh Embodiment]
FIG. 14 shows a variable individual ID generation unit 206 according to the seventh embodiment of the present invention, which includes a secret individual ID storage unit 1501, a real-time clock 1502, an adder 1503, a gray counter 1504, and a one-way function calculation. A unit 1505 is included to prevent the collection of all the above-described variable individual identifier (ID) patterns.

  The secret individual ID storage unit 1501 stores a secret individual identifier (ID). However, the secret individual identifier (ID) must be an even number. That is, the least significant bit is fixed to 0. The real-time clock 1502 is a clock device that outputs a value such as a quasi-Julian day (MJD), where the number of days elapsed from a certain reference time (epoch time) is an integer. Since the output of the real-time clock 1502 changes only in units of days, the power consumption can be greatly reduced. The adder 1503 adds the secret individual identifier (ID) output from the secret individual ID storage unit 1501 and the elapsed days output from the real-time clock 1502 and transmits the result to the one-way function calculation unit 1505. The gray counter 1504 is a gray counter that counts up in response to a variable individual ID generation request from the control unit 205, and its value is output to the one-way function calculation unit 1505. The one-way function calculation unit 1505 performs irreversible conversion from the addition result of the adder 1503 and the value of the gray counter 1504 to generate a variable individual identifier (ID).

  With this configuration, the variable individual identifier (ID) generation pattern changes each time the quasi-Julian day (MJD) advances after one day. For example, if the bit length of the gray counter 1504 is 16 bits, the number of variable individual identifier (ID) generation patterns is 65536. However, when the number of days elapsed of the real-time clock 1502 changes, 65536 different patterns of variable individual identifiers (IDs) are generated.

  If the reference time is the same in all the wireless tags 200, when accessing at the same time, as long as the real-time clock is accurate, the variable individual identifier (ID) will not collide. The actual real-time clock is somewhat inaccurate as the clock advances or lags due to errors. However, by limiting the secret individual identifier (ID) to an even number, the variable individual identifier (ID) does not collide even if the real-time clock is slightly shifted.

  Also, if the reference time is shifted randomly within a range of ± 9 hours, the timing of changing the pattern of the variable individual identifier (ID) varies depending on the individual of the wireless tag 200, and the prediction of the variable individual identifier (ID) pattern is performed. Becomes more difficult.

  With the configuration and processing procedure described above, the wireless communication information medium and the tracking system of the present invention generate a variable individual identifier (ID) as necessary and use it as an individual identifier. Accordingly, the location of the user of the wireless tag 200 as the wireless communication information medium is tracked against the intention of the user of the wireless tag 200 as the wireless communication information medium while using the anti-collision technology. Make it difficult. That is, there is an effect that the privacy of the user of the wireless tag 200 as an information medium for wireless communication can be protected.

1 is a block diagram of a wireless tag as an information medium for wireless communication according to a first embodiment of the present invention. 2 is a process flowchart of the wireless tag of FIG. 1 according to the present invention. The block diagram which shows the variable individual ID production | generation part of FIG. 1 of this invention. The block diagram which shows the variable individual ID production | generation part of the 2nd Embodiment of this invention. The block diagram which shows the variable individual ID production | generation part of the 3rd Embodiment of this invention. The block diagram which shows the one way function calculating part of the 3rd Embodiment of this invention. Explanatory drawing which shows the tracking management at the time of using the radio | wireless tag of FIG. 1 of this invention alone. Explanatory drawing which shows the tracking management at the time of using the several radio | wireless tag of FIG. 1 of this invention. Explanatory drawing which shows the tracking management at the time of using the several radio | wireless tag from which the individual identifier (ID) changes synchronously in the 4th Embodiment of this invention. The block diagram which shows the variable individual identifier production | generation part of the wireless tag from which the individual identifier (ID) changes synchronously in the 5th Embodiment of this invention. The block diagram which shows the variable individual identifier production | generation part of the radio | wireless tag from which the individual identifier (ID) changes synchronously in the 6th Embodiment of this invention. The processing flowchart of the gray counter contained in the variable individual identifier (ID) in the 5th and 6th embodiment of this invention. The processing flowchart of the gray counter contained in the variable individual identifier (ID) in the 5th and 6th embodiment of this invention. The block diagram which shows the variable individual ID production | generation part containing the real-time clock in the 7th Embodiment of this invention. The block diagram of the conventional wireless tag.

Explanation of symbols

100 wireless tag 101 antenna 102 power generation unit 103 transmission unit 104 reception unit 105 control unit 106 fixed individual ID recording unit 107 data storage memory 200 wireless tag 200A wireless tag 200B wireless tag 200C wireless tag 201 antenna 202 power generation unit 203 transmission unit 204 Reception unit 205 Control unit 206 Variable individual ID generation unit 207 Data storage memory 401 Pseudorandom number generation device 402 Internal state holding unit 501 Salt value generation unit 502 Individual ID list array storage unit 601 Secret individual ID storage unit 602 Salt value generation unit 603 Direction function operation unit 701 Input value 702 Selector 703 to 708 Non-linear conversion unit 709 Bit transposition unit 710 Adder 711 Addition constant 712 Output value 801 Tag reader (access device)
802 Antenna 1101 Gray counter 1202 Gray counter 1501 Secret object ID storage unit 1502 Real time clock 1503 Adder 1504 Gray counter 1505 One-way function calculation unit

Claims (16)

A power generation unit that generates power when the external energy intensity reaches a predetermined value;
A transmission / reception unit for transmitting / receiving information to / from an external communication medium;
A variable individual identifier generating unit that generates a variable individual identifier based on the change in the energy intensity;
An information medium for wireless communication, comprising: a control unit that transmits the variable individual identifier from the transmission / reception unit when receiving an instruction from the external communication medium. The power generation unit generates a power when an external magnetic field is greater than a predetermined operation level,
The wireless communication information medium according to claim 1, wherein the variable individual identifier generation unit generates a variable individual identifier different from the previous one when the power source is generated.   The variable individual identifier generation unit generates the variable individual identifier that does not collide with a variable individual identifier of another wireless communication information medium.   The variable individual identifier generation unit includes an individual identifier list array storage unit that stores a plurality of individual identifiers, and a salt value generation unit that generates a pseudo random number as a salt value based on the change in the energy intensity, and the salt value 2. The information medium for wireless communication according to claim 1, wherein a value read from the individual identifier list array storage unit is set as a variable individual identifier using a read index address of the individual identifier list array storage unit.   The variable individual identifier generation unit generates a secret individual identifier storage unit that stores a secret individual identifier that cannot be read out from the wireless communication information medium, and generates a pseudo random number as a salt value based on the change in the energy intensity. A salt value generation unit and a one-way function calculation unit that performs conversion that is difficult to reversely transform, and an output value obtained by inputting the secret individual identifier and the salt value to the one-way function calculation unit is a variable individual. The wireless communication information medium according to claim 1, wherein the information medium is an identifier.   The variable individual identifier generation unit periodically generates a variable individual identifier, and the period is the same as a predetermined standard value, or the greatest common divisor of the period and the standard value is sufficiently large. 1. An information medium for wireless communication according to 1.   The wireless communication information medium according to claim 1, wherein the variable individual identifier generation unit does not generate the same variable individual identifier repeatedly during one cycle of generating the variable individual identifier.   The variable individual identifier generation unit includes an individual identifier list array storage unit that stores a plurality of individual identifiers, and a counter having a predetermined standard value period, and the count value of the counter is stored in the individual identifier list array storage unit. 2. The information medium for wireless communication according to claim 1, wherein a value read from said individual identifier list array storage unit is used as a variable individual identifier as a read index address of.   The variable individual identifier generation unit includes a secret individual identifier storage unit that stores a secret individual identifier that cannot be read out from the wireless communication information medium, a counter having a predetermined standard value period, and reverse conversion is difficult. A one-way function calculation unit that performs a simple conversion, and an output value obtained by inputting the secret individual identifier and the counter value of the counter to the one-way function calculation unit is a variable individual identifier, The information medium for wireless communication according to claim 1.   The wireless communication information medium according to claim 6, wherein the variable individual identifier generation unit periodically generates the variable individual identifier by a natural number power of two.   The variable individual identifier generation unit re-uses the previously generated variable individual identifier again without generating a new variable individual identifier when the elapsed time from the generation of the previous variable individual identifier is within a predetermined value. The wireless communication information medium according to claim 6.   When the variable individual identifier generation unit communicates with an external communication medium that is the same as the external communication medium when the previous variable individual identifier was generated, the variable individual identifier generation unit does not generate a new variable individual identifier, The information medium for wireless communication according to claim 6, wherein the individual identifier is used again.   The wireless communication information medium according to claim 1, wherein the variable individual identifier generation unit changes a pattern generated by the variable individual identifier according to a time of a built-in clock. An information medium for wireless communication equipped with a variable individual identifier generating unit that is attached to an object, an animal, or a person, and generates a variable individual identifier that changes based on a change in the energy intensity of the external environment;
An information medium tracking system comprising: an external communication medium that reads and transmits the variable individual identifier by transmitting and receiving to and from the wireless communication information medium.   15. The information medium tracking system according to claim 14, wherein the object, animal, or person is equipped with a plurality of information media for wireless communication.   16. The information medium tracking system according to claim 15, wherein the plurality of information media for wireless communication generate the variable individual identifier in the same period in the variable individual identifier generation unit.