KR20110102165A - Radio security leader controlling operation mode, and radio security tag supporting security mode and normal mode - Google Patents

Abstract

A wireless security tag and a wireless security reader are disclosed that support a secure mode and a normal mode. A wireless security reader for controlling an operation mode of a wireless security tag includes: a reader modem receiving an operation mode from a wireless security tag, and identifying the received operation mode as a 'normal mode' or a 'security mode', and identifying the identified operation. And a reader processor for controlling the wireless security tag according to a mode.

Description

RADIO SECURITY LEADER CONTROLLING OPERATION MODE, AND RADIO SECURITY TAG SUPPORTING SECURITY MODE AND NORMAL MODE}

An embodiment of the present invention implements a wireless security tag supporting both a security mode and a normal mode, and selectively operates the wireless security tag in either a security mode or a normal mode according to the active setting of the wireless security reader. It is about a system.

RFID devices can be used in a variety of fields, such as article management. Such an RFID device may communicate according to the ISO / IEC 18000-6 protocol. Such RFID devices require security functions due to the possibility of duplication and data leakage.

In this case, the RFID tag supports various modes (eg, security mode general mode) to provide compatibility with not only a security RFID reader supporting a security function but also a general RFID reader that does not support a security function. There is a need for technology that makes it available.

An embodiment of the present invention is to operate the wireless security tag in one of the security mode or the normal mode, to support the compatibility with not only security readers that support security functions, but also general readers that do not support security functions. It is done.

A wireless security reader for controlling an operation mode of a wireless security tag according to an embodiment of the present invention includes a reader modem for receiving an operation mode from a wireless security tag, and the received operation mode as 'normal mode' or 'security mode'. And a reader processor for identifying and controlling the wireless security tag according to the identified operation mode.

The wireless security tag supporting the security mode and the normal mode according to an embodiment of the present invention may be configured to include a tag modem for transmitting a preset operation mode to the wireless security reader in association with a connection request of a wireless security reader, and the operation mode. And a tag processing unit configured to perform an authentication process according to the performance of the wireless security reader, and operate in response to the control of the authenticated wireless security reader when the wireless security reader is authenticated.

According to an embodiment of the present invention, by operating the wireless security tag in one of the security mode or the normal mode, it is possible to support compatibility with not only the security reader that supports the security function, but also the general reader that does not support the security function. have.

1 is a diagram illustrating a configuration of an RFID system including a wireless security tag and a wireless security reader supporting a security mode and a normal mode according to an embodiment of the present invention.
2 is a message flow diagram illustrating a tag authentication procedure between a wireless security tag, a general reader and an authentication server operating in a normal mode.
3 is a message flow diagram illustrating a mutual authentication procedure after an inventory process between a wireless security tag and a security reader operating in a normal mode.
4 is a message flow diagram illustrating a security inventory process including a mutual authentication procedure between a wireless security tag and a security reader operating in a secure mode.
5 is a diagram illustrating a security command format between a wireless security tag and a security reader operating in a secure mode.
6 is a view illustrating a state change of a wireless security tag for each mode.

Hereinafter, a wireless security tag and a wireless security reader supporting a security mode and a general mode will be described in detail with reference to the accompanying drawings. In the present specification, the wireless security tag may be, for example, an RFID tag. In addition, the security mode in the wireless security tag is a security function, a mode supporting data encryption communication, the general mode may be a mode supporting communication according to the ISO / IEC 18000-6 protocol.

1 is a diagram illustrating a configuration of an RFID system including a wireless security tag and a wireless security reader supporting a security mode and a normal mode according to an embodiment of the present invention.

For convenience of explanation, hereinafter, the wireless security reader 110 shown on the left side of FIG. 1 and the wireless security tag 120 shown on the right side will be described.

First, on the left side of FIG. 1, a wireless security reader 110 for controlling an operation mode of a wireless security tag is shown. The wireless security reader 110 includes a reader modem 111, a reader processing unit 112, and a toggle. The mode command unit 114 and the reader encryption module 113 may be configured.

The reader modem 111 serves to receive an operation mode predetermined and pre-stored in the wireless security tag 120 from the wireless security tag 120.

The reader processing unit 112 functions to identify the received operation mode as 'normal mode' or 'security mode'.

If the operation mode is identified as the 'normal mode', the reader processor 112 may perform a first inventory process and an additional authentication process for controlling the wireless security tag 120 (eg, changing the operation mode). A separate authentication process is performed for mutual authentication between the wireless security reader 110 and the wireless security tag 120.

On the other hand, if the operation mode is identified as the 'security mode', the reader processing unit 112 performs a second inventory process including an authentication process. That is, the reader processing unit 121 in the 'security mode' is completed by performing the inventory process without completing a separate command, by completing the mutual authentication procedure between the wireless security reader 110 and the wireless security tag 120, wireless security Enables fast control of the tag 120.

The reader processor 112 identifies the operation mode as a 'normal mode' or a 'security mode', and selectively performs a first inventory process or a second inventory process according to each identified mode, thereby providing a wireless security tag. An environment may be provided that enables control of the 120.

The toggle mode command unit 114 stores the wireless security tag 120 when mutual authentication between the wireless security reader 110 and the wireless security tag 120 is completed through authentication processing performed differently for each mode. Perform the process of changing the existing mode. That is, the toggle mode command unit 114 is completed by the reader processing unit 112, the first inventory process and the additional authentication process, or the second inventory process alone is completed, the wireless security reader 110 When the authentication is completed, it is possible to change the operation mode of the wireless security tag 120, or to change the data recorded in the wireless security tag 120.

Further, as another embodiment, the toggle mode command unit 114 determines the operation mode for the wireless security tag 120 in the initial state in which the operation mode is not determined, and through the reader modem 111, the wireless security tag. By transmitting to 120, the wireless security tag 120 may control to record the determined operation mode.

That is, the toggle mode command unit 114 may change the operation mode of the wireless security tag to one mode (security mode or normal mode) according to the implementation environment with respect to the wireless security tag 120 supporting both security and normal modes. Only operating so that the wireless security tag 120 can be controlled.

Hereinafter, the operation of the reader processing unit 112 for each mode described above will be described in more detail.

As the operation mode from the wireless security tag 120 is received in the 'normal mode', the reader processing unit 112 performs a series of first inventory process, so that the wireless security tag 120 is maintained in a minimum security state. ) To perform communication (from 'ready state' to 'open state' of FIG. 6 to be described later).

Subsequently, when a change of an operation mode is required for the wireless security tag 120, the reader processing unit 112 may perform an additional authentication process to complete authentication of the wireless security reader 110 (the above in FIG. 6). from 'open state' to 'Auth state').

That is, when identifying in the 'normal mode', the reader processing unit 112, after performing the first inventory process, the authentication process for the wireless security reader 110, if necessary, if the wireless security tag ( More extensive rights regarding secure communication with 120 may be allowed, such as updating encryption keys, changing operation modes, and the like.

As an additional authentication process in the 'normal mode' performed after the first inventory process, the reader processing unit 112 receives a first challenge_tag message from the wireless security tag 120 and performs the first challenge. The first challenge_int message is transmitted to the wireless security tag 120 together with the second challenge_tag message that encrypts the_tag message. Thereafter, the reader processing unit 112 receives a second challenge_inject message associated with the first challenge_inject message from the wireless security tag 120 to transmit the second challenge_in message and the first challenge_inin message. If it compares and matches, the wireless security tag 120 can be authenticated.

At this time, the reader processing unit 112 drives the reader encryption module 113 by using the first secret key to decrypt the second challenge_int message received from the wireless security tag 120, and then the first challenge. It can be compared to an insert message. Here, the reader processing unit 112 receives key related information (eg, a Key Index) associated with the second secret key from the wireless security tag 120, and stores a plurality of secret keys using the key related information. By extracting the first secret key (not shown), the reader encryption module 113 may be driven using the same first secret key as the second secret key used in the wireless security tag 120. The reader encryption module 113 in the 'normal mode' is used in the authentication process for the wireless security tag 120 after the completion of the first inventory process.

On the other hand, when the reader processor 112 identifies the operation mode as the 'security mode', that is, when the quick control of the wireless security tag 120 is required, the wireless security reader 110 and the wireless security tag ( After the second inventory process including the authentication process for mutual authentication with 120 is quickly performed (only performing 'Void Ack', 'Sec_Ack', and 'Auth' of FIG. 6 to be described later), the wireless security reader 110 Allows control over

That is, the reader processing unit 112 in the 'security mode' performs a second inventory process including the authentication process, thereby performing wireless security without performing additional (additional) authentication processing such as the above-described 'normal mode'. Allows quick control of the tag 120.

As the authentication process included in the second inventory process, the reader processor 112 receives a first random number RN16 from the wireless security tag 120 and encrypts the first random number. In addition, a first challenge_CH (CH_int) message is transmitted to the wireless security tag 120. Thereafter, the reader processing unit 112 receives the second challenge_inject message associated with the first challenge_inject message from the wireless security tag 120, compares the second challenge_in message with the first challenge_inin message. If there is a match, the wireless security tag is authenticated.

In addition, the reader processing unit 112 transmits a Sec_ACK command to the wireless security tag 120 as the second inventory process performed as the operation mode is received in the 'security mode'. In response to the Ack (Sec_ACK) command, the security information is received from the wireless security tag 120, and the reader encryption module 113 may be initialized using the security information. Thereafter, the reader processing unit 112 initializes the reader encryption module 113 and transmits an Ack command (ACK) to the wireless security tag 120, and as a response to the Ack command, from the wireless security tag 120. Receives EPC (Electric Product Code) information, and decrypts the EPC information using the initialized reader encryption module 113.

Here, the reader processing unit 112 drives the reader encryption module 113 by using the first secret key to decrypt the second challenge_int message received from the wireless security tag 120, and then the first challenge. It can be compared to an insert message. The reader encryption module 113 in the 'secure mode' may be continuously driven during the execution of the second inventory process.

As the operation mode control, the toggle mode command unit 114 receives a command for maintaining the 'normal mode' or a command to switch to the 'security mode' when the received operation mode is the 'normal mode'. The input command may be transmitted to the wireless security tag 120.

In addition, when the received operation mode is the 'security mode', the toggle mode command unit 114 receives a command for maintaining the 'security mode' or a command to switch to the 'normal mode' from the user, and inputs the input command. To the wireless security tag 120.

The reader encryption module 113 is driven by the toggle mode command unit 114 to encrypt a message (eg, challenge_int message) transmitted to the wireless security tag 120, or from the wireless security tag 120. You can decrypt the messages you receive. In this case, the reader encryption module 113 may be driven using the first secret key stored in the database.

1, a wireless security tag 120 supporting a security mode and a normal mode is shown. The wireless security tag 120 includes a tag modem 121 and a normal mode tag processing unit 122-1. The tag processing unit including the security mode tag processing unit 122-2 and the tag encryption module 123 may be configured.

The tag modem 121 transmits to the wireless security reader 110 an operation mode which has been previously set and stored in association with a connection request of the wireless security reader.

The normal mode tag processing unit 122-1 stores the operation mode in the normal mode, and the wireless security reader 110 performs the first inventory process based on the normal mode. Allows the 120 and the wireless security reader 110 to communicate with minimal security. After completion of the first inventory process, if mutual authentication is requested from the wireless security reader 110 through an additional authentication process, the normal mode tag processing unit 122-1 interworks with this, and wirelessly communicates with the wireless security reader 110. When the security tag 120 is authenticated and the wireless security reader 110 is authenticated, the security tag 120 operates in response to the control of the authenticated wireless security reader 110. For example, the normal mode tag processing unit 122-1 may change the adjusted operation mode and store the new operation mode under the control of the wireless security reader 110.

The security mode tag processing unit 122-2 stores the operation mode stored in the 'security mode', and the wireless security reader 110 based on the 'security mode' includes the wireless security reader 110 and the wireless security tag ( When the wireless security reader 110 is immediately authenticated as the second inventory process is performed between the mutual authentication process between 120, the wireless security reader 110 operates under the control of the authenticated wireless security reader 110.

Specifically, after the normal mode tag processing unit 122-1 performs the first inventory process according to the 'normal mode' in the operation mode 'normal mode' and the wireless security reader 110, an additional authentication process As a result, the mutual authentication process may be performed according to the additional authentication process.

That is, the normal mode tag processing unit 122-1 transmits a first challenge_tag message to the wireless security reader 110 in the additional authentication process, and transmits the first challenge_tag message to the wireless security reader 110. The second challenge tag tag encrypting the challenge tag tag message may be received to compare the second challenge tag tag message with the first challenge tag tag message.

In this case, the normal mode tag processing unit 122-1 drives the tag encryption module 123 using the second secret key to decrypt the second challenge_tag message received from the wireless security reader 110. The first challenge_tag message may be compared with the first challenge_tag message.

The security mode tag processing unit 122-2 may perform an authentication process included in the second inventory process as the operation mode is a 'security mode' and accordingly performs a second inventory process in the wireless security reader 110. Can be done.

That is, the security mode tag processing unit 122-2 is a mutual authentication process between the wireless security reader 110 and the wireless security tag 120 included in the second inventory process, and establishes a connection from the wireless security reader 110. Upon receiving the _ACC_ACK command, the tag encryption module 123 may be initialized using the security information, and the security information may be transmitted to the wireless security reader 110.

Thereafter, when the security mode tag processing unit 122-2 receives the Ack command ACK from the wireless security reader 110, the security mode tag processing unit 122-2 encrypts the EPC information using the initialized tag encryption module 123. The encrypted EPC information may be transmitted to the wireless security reader 110.

In addition, the security mode tag processing unit 122-2 is an authentication process included in the second inventory process when the operation mode is the 'security mode'. The wireless security reader 110 assigns a first random number RN16 to the security process 110. ) And a second random number obtained by encrypting the first random number from the wireless security reader 110, and comparing the second random number with the first random number. Here, the security mode tag processing unit 122-2 drives the tag encryption module 123 using the second secret key to decrypt the second random number received from the wireless security reader 110, and then the first random number. It can be compared with a random number.

On the other hand, the normal mode tag processing unit 12201 operates in the 'normal mode' when receiving the command to maintain the 'normal mode' or the command to switch to the 'normal mode' from the wireless security reader 110, The mode tag processing unit 122-2 may operate in the 'security mode' when receiving the command to maintain the 'security mode' or the command to switch to the 'security mode' from the wireless security reader 110.

The tag encryption module 123 is driven by the normal mode / secure mode tag processing units 122-1 and 122-2 to encrypt a message (eg, a challenge_tag message) transmitted to the wireless security reader 110, or Alternatively, the message received from the wireless security reader 110 may be decrypted. In this case, the tag encryption module 123 may be driven using the second secret key stored therein.

Here, the tag encryption module 123 may be the same as the reader encryption module 113 described above, and the second secret key may be the same as the first secret key utilized by the reader encryption module 113.

Hereinafter, the relationship between the wireless security tag and the wireless security reader will be described.

The wireless security tag operates based on the ISO / IEC 18000-6 protocol under 'Normal Mode' and is a method to provide the wireless security reader with the current security status and whether the security function for the wireless security tag is supported. You can use the data format of XPC (eXtended Protocol Control) used in the 18000-6 protocol.

The XPC is a data structure for providing a wireless security reader with functions supported by the wireless security tag (for example, a sensor and a battery support function). The XPC may include 16 bits and may include extra bits for future use.

The wireless security tag may indicate whether the security function is supported and the current operation state by using the extra bits included in the XPC. Specifically, the wireless security tag may use 2 bits among the extra bits included in the XPC, and indicates whether or not the security function for the wireless security tag is supported using 1 bit (ST). 0 ': normal tag,' 1 ': security tag) and another 1 bit (VI: Void Identifier) to indicate whether the EPC conforming to the XPC is normal EPC or meaningless EPC (e.g.' 0 ': normal EPC, '1': meaningless EPC).

Here, when the VI bit of the XPC received from the wireless security tag is '0', the wireless security reader may know that the wireless security tag operates in the normal mode in addition to the normal EPC. In the case of 1 ', it can be seen that the wireless security tag operates in a secure mode. In this case, when the wireless security tag does not support the security function, the wireless security reader may ignore the VI bit of the XPC.

The wireless security tag is set according to the ISO / IEC 18000-6 protocol according to the control of an authorized security reader and, when set to 'Normal Mode', not only the security reader that supports the security function but also the general reader that does not support the security function. It supports the inventory process and all commands, and can expose the UII of wireless security tags to security readers or general readers.

In addition, when the wireless security tag is set to a security mode under the control of an authenticated security reader, the wireless security tag drives an encryption module that performs a security function and a encryption module that exists inside the tag to perform tag authentication and reader authentication functions. Command or authentication protocol.

Here, tag authentication may be used for authenticity verification of the security tag, and reader authentication may be used for the purpose that only an authorized security reader may write or modify data or secret keys related to security in the security tag.

In order to support tag authentication in a general reader, a wireless security tag and an authentication server supporting security functions must have the same encryption module and the same secret key. Here, the general reader has no information and data related to security, supports only the specific command for recognition of the wireless security tag and the wireless security tag authentication, and sends a response message to the authentication server to verify whether the authenticity of the authentication server. It can operate as a structure that receives a result for.

In addition, in order to support reader authentication in the wireless security tag, the wireless security tag supporting the security reader and the security function must have the same encryption module and the same secret key.

2 is a message flow diagram illustrating a tag authentication procedure between a wireless security tag, a general reader and an authentication server operating in a normal mode.

Referring to FIG. 2, the wireless security tag 203 operating in the normal mode may perform an inventory process and all commands according to the general reader 202 and the ISO / IEC 18000-6 protocol. The wireless security tag 203 operating in the normal mode may transmit the PC, the XPC, and the EPC transmitted to the general reader 202 to the general reader 202 during the inventory process. At this time, the wireless security tag 203 sets the ST bit in the XPC to '1' and sets the VI bit to '0' and transmits the result to the general reader 202, whereby the wireless security tag 203 is a security tag. It may inform that EPC (Normal Mode) is transmitted.

When the general reader 202 receives a Handle message from the wireless security tag 203 as a response message to the ReqRN command, the general reader 202 terminates the inventory process and wirelessly issues a Get_SecParam command to obtain security information in the wireless security tag 203. Send to the security tag (203). At this time, when receiving the Get_SecParam command, the wireless security tag 203 transmits security information (eg, SecParam and KI: Key Index) to the general reader 202.

The generic reader 202 generates a random CH_int message and sends a TagAuth command containing the CH_int message to the wireless security tag 203. The wireless security tag 203 may generate an arbitrary CH_tag message, and generate an Auth message by eXclusive-ORing the CH_tag message and the CH_int message received from the general reader 202. The wireless security tag 203 generates an Auth_Data by generating a CH_tag message and an Auth message in 128 bits (padding to '0' after connecting two messages) and using the encryption module of the wireless security tag 203. After the generated Auth_Data is encrypted, it may be transmitted to the general reader 202. The general reader 202 is an authentication server 201 connected to the wired or wireless network by EPC information, security information and encrypted data (PC, XPC, EPC, SecParam, KI, CH_int, encrypted Auth_Data) of the wireless security tag 203. ), And waits for authentication of the wireless security tag 203.

The authentication server 201 may obtain the CH_tag and the Auth message by decrypting the encrypted Auth_Data using the security information transmitted from the general reader 202. The authentication server 201 extracts the CH_tag message by eXclusive-OR the decrypted CH_int and Auth messages, and compares the extracted CH_tag message with the CH_tag message obtained by decrypting the Auth_Data to determine whether the wireless security tag is a legitimate tag. Can be determined. That is, as a result of the comparison, the authentication server 201 may be determined as a legitimate wireless security tag, and if not identical, may be determined as an invalid tag and provided to the general reader 202.

3 is a message flow diagram illustrating a mutual authentication procedure after an inventory process between a wireless security tag and a security reader operating in a normal mode.

Referring to FIG. 3, the wireless security tag 302 operating in the normal mode may perform an inventory process and all commands according to the security reader 301 and the ISO / IEC 18000-6 protocol. The wireless security tag 302 operating in the normal mode may transmit the PC, XPC, and EPC transmitted to the security reader 301 to the security reader 301 during the inventory process. At this time, the wireless security tag 302 transmits the ST bit set to '1' and the VI bit set to '0' in the XPC to the security reader 301, whereby the wireless security tag 302 is a security tag and a normal EPC ( Normal mode) can be transmitted.

When the security reader 301 receives a Handle message from the wireless security tag 302 as a response message to the ReqRN command, it terminates the inventory process, randomly generates a Seed (1) for initialization of the encryption module, and mutual authentication. In order to transmit the Sec_ACK command including the generated Seed (1) to the wireless security tag 302. At this time, the wireless security tag 302 transmits its security information and randomly generated Seed 2 to the security reader 301, and simultaneously uses the Seed (1 + 2) encryption module of the wireless security tag 302. Initialize

The security reader 301 initializes the encryption module of the security reader 301 by using the security information received from the wireless security tag 302 and Seed (1 + 2), and then sends a ReaderAuth command to the wireless security tag 302. And wait for a reader authentication response from the wireless security tag 302. The wireless security tag 302 encrypts a randomly generated CH_tag message with an encryption module and transmits the encrypted CH_tag message to the security reader 301 as a response message to the ReaderAuth command.

The security reader 301 decrypts the encrypted CH_tag message with an encryption module, re-encrypts the decrypted CH_tag message, optionally generates a CH_int message, and encrypts the generated CH_int message. The security reader 301 transmits the re-encrypted CH_tag message and the encrypted CH_int message to the wireless security tag 302 through the Get_ReaderAuth command.

The wireless security tag 302 decrypts the CH_tag and CH_int messages received from the security reader 301, and compares the decrypted CH_tag message with the CH_tag message randomly generated by the wireless security tag 302. Re-encrypt the decrypted CH_int message as a response message to the Get_ReaderAuth command, and transmits it to the security reader 301 to perform an authentication procedure for the security reader 301. If not, the response message is sent to the security reader 301. The reader authentication procedure is terminated without transmitting to the server.

When the security reader 301 receives the re-encrypted CH_int message from the wireless security tag 302, the security reader 301 decrypts the re-encrypted CH_int message and compares the decrypted CH_int message with the CH_int message randomly generated by the security reader 301. The authentication of the wireless security tag 302 may be performed, and whether to modify the security information on the wireless security tag 302 may be determined according to the authentication result.

4 is a message flow diagram illustrating a security inventory process including a mutual authentication procedure between a wireless security tag and a security reader operating in a secure mode.

Referring to FIG. 4, when the wireless security tag 402 operates in a secure mode, only the security reader 401 may perform an inventory process with the wireless security tag 402 using a separate security protocol. The security protocol includes a mutual authentication process between the security reader 401 and a wireless security tag 402 operating in a secure mode and a process of transmitting and receiving encrypted data. At this time, only the security reader 401 having the same encryption module and the same secret module as the wireless security tag 402 can see the normal EPC (UII) of the wireless security tag 402, and data communication after inventory is possible. .

In addition, when the general reader accesses the wireless security tag 402 set in the security mode, the wireless security tag 402 transmits a Void EPC (UII) complying with the ISO / IEC 18000-6 protocol to the general reader. Here, the Void EPC is defined as a Tag ID having a constant value and the rest are all '0' values, or as any EPC value valid only while the wireless security tag 402 receives a continuous wave (CW). It prevents malfunction with the reader and maintains compatibility.

The wireless security tag 402 operating in the secure mode may perform the inventory process and all commands according to the security reader 401 and the ISO / IEC 18000-6 protocol.

The wireless security tag 402 operating in the secure mode may transmit the PC, the XPC, and the Void EPC to the security reader 401 which are transmitted to the security reader 401 during the inventory process. At this time, the wireless security tag 402 transmits the ST bit set to '1' and the VI bit set to '1' to the security reader 401 in the XPC, whereby the wireless security tag 402 is a security tag and the EPC is Void. Because it is an EPC, it can be informed that it operates in secure mode. Meanwhile, when the general reader receives the Void EPC, the inventory process may be terminated by reading the Void EPC as a tag UII and ending the ReqRN command.

The security reader 401 transmits a Sec_ACK command to the wireless security tag 402 to communicate with the wireless security tag 402 set to the security mode after receiving the PC, XPC, and Void EPC through the inventory process. The wireless security tag 402 transmits security information to the security reader 401 as a response to the Sec_ACK command, and performs initialization of the encryption module in the wireless security tag 402. The security reader 401 performs initialization of the encryption module using the security information received from the wireless security tag 402, and transmits an ACK command to the wireless security tag 402.

The wireless security tag 402 encrypts the PC, XPC, and EPC of the wireless security tag 402 through an initialized encryption module and transmits the ACK command to the security reader 401. The security reader 401 verifies the EPC of the wireless security tag 402 by restoring the original plain text by decrypting the encrypted data through the encryption module.

The security reader 401 may perform mutual authentication with the wireless security tag 402 using the Sec_ReqRN command. When mutual authentication is completed, the wireless security tag 402 may perform a state transition to end the inventory process, or may perform another command conforming to the ISO / IEC 18000-6 protocol.

The security reader 401 encrypts the randomly generated CH_int and RN16 received from the wireless security tag 402, and transmits a Sec_ReqRN command including the encrypted CH_int and RN16 to the wireless security tag 402. The wireless security tag 402 decrypts CH_int and RN16 received from the security reader 401, and generates a response message when the decrypted RN16 is normal (for example, when the decrypted RN16 and the RN16 generated by the wireless security tag are the same). In case of abnormal transmission (for example, when the decrypted RN16 and the RN16 generated by the wireless security tag are not the same), the inventory process may be terminated. When RN16 is normal, the wireless security tag 402 re-encrypts the decrypted CH_int message, encrypts a randomly generated Handle message, and then transmits the re-encrypted CH_int message and the encrypted Handle message to the security reader 401. Can be.

The security reader 401 decrypts the CH_int and Handle messages received from the wireless security tag 402, and compares the decrypted CH_int message with the CH_int message generated by the security reader 401. The tag 402 is authenticated to continue the inventory process. If not, the inventory process is terminated.

When the normal CH_int is received (for example, when the decrypted CH_int message and the CH_int message generated by the security reader are the same), all the commands and response data used thereafter are encrypted and decrypted through the encryption module. And communicate with the wireless security tag 402 only via an encryption channel.

5 is a diagram illustrating a security command format between a wireless security tag and a security reader operating in a secure mode.

Referring to FIG. 5, the Sec_ReqRN command may include Command (0xE1XX), CH_int, RN16, and CRC16, and the Sec_ReqRN response may include CH_int, Handle, and CRC16.

The TagAuth command may include Command (0xE1XX), CH_int, Handle, and CRC16, and the TagAuth response may include Header, Auth_Data, Handle, and CRC16.

The ReaderAuth command may include Command (0xE1XX), Handle and CRC16, and the ReaderAuth response may include CH_tag, Handle and CRC16.

The Get_Reader Auth command may include Command (0xE1XX), CH_tag, CH_int, Handle, CRC16, and the Get_Reader Auth response may include CH_int, Handle, CRC16.

6 is a view illustrating a state change of a wireless security tag for each mode.

Referring to FIG. 6, first, the wireless security tag is in a ready state under the control of the wireless security reader. In the 'ready state', an activated tag that is not expired and does not participate in the current inventory round is shown as a 'holding state'.

Under normal mode, when the reader receives a continuous wave (CW), the wireless security tag is in an arbitration state of 'arbitrate state'. In the 'arbitrate state', the slot counter is set to participate in the current inventory round. A tag that takes a nonzero value is represented by a 'holding state'.

Thereafter, the wireless security tag that takes the slot counter as a zero value according to the progress of the inventory round operates in a reply state of 'reply state', and when a reply is input to the tag in the 'reply state', RN 16 is transmitted to the reader. do. At this time, if the wireless security tag receives a valid ACK is switched to the 'acknowledged state', while if the ACK is not received, or receives an invalid ACK is returned to the 'arbitrate state'.

When switched to the 'acknowledged state', the wireless security tag may switch to any state except the expired (killed) according to the received comment.

A tag in an 'acknowledged state' with an access password of nonzero transitions to an 'open state' upon receipt of a received 'Req_RN command' and, in the 'open state', a subsequent command at the reader and a tag corresponding thereto. Send a new RN 16 to cause a subsequent answer of.

On the other hand, a tag in an 'acknowledged state' with an access password of zero transitions to a 'secured state' upon receiving a received 'Req_RN command', and under the 'secured state', a subsequent command from the reader and Send a new RN 16 to allow subsequent responses in the tag to be generated.

Thereafter, when the 'Kill command' is received in the 'open state' or 'secured state', the wireless security tag enters the 'killed state' which is an expired state.

On the other hand, in the security mode, the wireless security tag branched from the 'ready state' is switched to the 'Void Ack' state, providing an untraceability function for the wireless security tag, and invalid or random Answer the UII.

Thereafter, the wireless security tag, in the 'Sec_Ack' state, grants an authenticated authority to the authenticated reader and also responds with an encrypted UII.

Finally, the wireless security tag which has mutually authenticated with the reader transitions to the Auth state, and in the Auth state, it can communicate as encrypted data.

That is, the wireless security tag may communicate with the wireless security reader through a procedure or command distinguished for each operation mode.

According to an embodiment of the present invention, by operating the wireless security tag in one of the security mode or the normal mode, if necessary, by controlling the authentication security reader to change the mode of the wireless security tag, security to support the security function In addition to the wireless security reader, it can support compatibility with general wireless security readers that do not support security functions.

Embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

110: wireless security reader for controlling the operation mode of the wireless security tag
111: reader modem 112: reader processing unit
113: reader encryption module 114: toggle mode command unit
120: Wireless Security Tag Supports Security Mode and Normal Mode
121: tag modem
122-1, 122-2: normal mode / secure mode tag processing unit
123: tag encryption module

Claims (10)

A reader modem for receiving an operating mode from a wireless security tag; And
A reader processor that identifies the received operation mode as a 'normal mode' or a 'security mode' and controls the wireless security tag according to the identified operation mode.
Wireless security reader for controlling the operation mode of the wireless security tag comprising a. The method of claim 1,
If identified as the 'normal mode',
The reader processing unit,
And after performing a first inventory process, authenticate the wireless security tag and, if authenticated, allow to control the wireless security tag. The method of claim 2,
The reader processing unit,
As the authentication process,
Receiving a first challenge_tag (CH_tag) message from the wireless security tag, along with a second challenge_tag (CH_tag) message encrypting the first challenge_tag (CH_tag) message, a first challenge_int (CH_int) ) Sends a message to the wireless security tag,
Receiving the second Challenge_Int message associated with the first Challenge_Int message from the wireless security tag and comparing the second Challenge_Int message with the first Challenge_Int message; Wireless security reader to control the operation mode of the wireless security tag, to authenticate the. The method of claim 1,
If identified as the 'secure mode',
The reader processing unit,
And after performing a second inventory process including authentication processing for the wireless security tag, allowing the wireless security tag to be controlled. The method of claim 4, wherein
The reader processing unit,
As the authentication process included in the second inventory process,
Receive a first random number (RN16) from the wireless security tag, and transmits a first challenge_CH (CH_int) message to the wireless security tag, along with a second random number encrypting the first random number,
Receiving the second Challenge_Int message associated with the first Challenge_Int message from the wireless security tag and comparing the second Challenge_Int message with the first Challenge_Int message; Wireless security reader to control the operation mode of the wireless security tag, to authenticate the. The method of claim 1,
The reader processing unit,
When the wireless security tag transitions to the 'authentication state', controlling the operation mode of the wireless security tag, to maintain or change the operation mode to the wireless security tag, or to change the data recorded in the wireless security tag Wireless security reader. The method of claim 1,
Toggle mode command unit for determining an operation mode and setting the determined operation mode in the wireless security tag through the reader modem.
The wireless security reader for controlling the operation mode of the wireless security tag further comprising. A tag modem for transmitting a preset operation mode to the wireless security reader in association with a connection request of a wireless security reader; And
A tag processing unit that performs an authentication process according to the performance of the wireless security reader based on the operation mode, and operates in response to the control of the authenticated wireless security reader when the wireless security reader is authenticated.
Wireless security tag that supports security mode and normal mode, including. The method of claim 8,
The tag processing unit includes a normal mode tag processing unit,
When the set operation mode is 'normal mode',
The normal mode tag processing unit,
After performing the first inventory process in the wireless security reader, the authentication process,
Transmitting a first challenge_tag message to the wireless security reader, receiving a second challenge_tag message that encrypts the first challenge_tag message from the wireless security reader, and receiving the second challenge_tag message. Comparing the first challenge tag tag message with a wireless security tag that supports a secure mode and a normal mode. The method of claim 8,
The tag processing unit includes a security mode tag processing unit,
If the set operation mode is 'security mode',
The security mode tag processing unit,
In the authentication process of performing a second inventory process in the wireless security reader,
Send a first random number (RN16) to the wireless security reader, receive a second random number encrypting the first random number from the wireless security reader, and compares the second random number and the first random number A wireless security tag that supports security mode and normal mode.

Images