Embedding protected memory access into a RFID authentication process based on a challenge-response mechanism

A RFID reader, comprising:

• a radio frequency receiver and a radio frequency transmitter;
• and
• a controller coupled to the radio frequency receiver and to the radio frequency transmitter,
• wherein the radio frequency transmitter transmits a request for a challenge to a RFID tag,
• wherein the radio frequency receiver receives a reply from the RFID tag, the reply including a challenge, generated by the tag, in plaintext, wherein the reader has no knowledge of a value of the challenge prior to receiving the challenge from the tag,
• wherein the radio frequency transmitter transmits, in a single transmission, an enhanced write command to the RFID tag, the enhanced write command including:
• a response to the challenge, the response being a correct encryption by the reader of the challenge received from the tag,
• encrypted data that is to be written to a memory of the RFID tag, and
• information, in plaintext, needed for writing the encrypted data to the memory of the RFID tag, the information including identifying a data protection mode that was used to encrypt the encrypted data, the data protection mode being one of:
• confidentiality only (CBC) or confidentiality with integrity (CBC+CMAC),
• the information also including a data include enable field, a pointer field and a word count field, wherein the data include enable field defines whether the enhanced write command includes a data operation,
• wherein the radio frequency receiver receives an enhanced second reply from the RFID reader, the enhanced second reply including one of:
• a success header if writing the encrypted data to the memory of the RFID tag succeeded, and
• an error header and an error code to identify a specific type of error, if writing the encrypted data to the memory of the RFID tag failed.

A RFID tag, comprising:

• a radio frequency receiver and radio frequency transmitter;
• circuitry, coupled to the radio frequency receiver and radio frequency transmitter;
• a memory, coupled to the circuitry, for storing un-encrypted data and a cryptographic key;
• and
• a cryptographic engine, coupled to the circuitry, for performing cryptographic operations,
• wherein the RFID tag, after being singulated by a reader, receives an enhanced read command from the reader during an access phase of the reader, wherein the enhanced read command includes
• a tag authentication challenge in plaintext, generated by the reader, wherein the tag has no knowledge of a value of the tag authentication challenge in advance of receiving the enhanced read command,
• a data request comprising a data include enable field, a pointer field and a word count field, wherein the data include enable field defines whether a reply to the enhanced read command includes a data operation, and
• information requesting a data protection mode including a mode selector, wherein the mode selector selects one of:
• plaintext mode, MAC protected mode, encrypted mode, and encrypted and MAC protected mode, wherein the data protection mode includes parameters defining a key pointer, a key size, and a definition of a cryptographic algorithm,
• wherein, subsequent to receiving the enhanced read command, the RFID tag encrypts, using the cryptographic algorithm, an authentication of the tag authentication challenge, and, only when the encrypted mode or the encrypted and MAC protected mode is selected, the RFID tag encrypts, using the selected data protection mode, the un-encrypted data in the memory, the encryption of the un-encrypted data in the memory executed by the tag without requiring reception of any command during the access phase of the reader that requires use of cryptography other than the enhanced read command, and
• wherein the RFID tag transmits, in a single wireless transmission, a reply consisting of one of:
• the authentication and the un-encrypted data when the plaintext mode or the MAC protected mode is selected, and
• the authentication and encrypted data derived from the un-encrypted data when the encrypted mode or the encrypted and MAC protected mode is selected.