RFID secure authentication

Patent metadata

Field	Value
Publication number	US-10298403-B2
Application number	US-201715692110-A
Country	US
Kind code	B2
Filing date	Aug 31, 2017
Priority date	Mar 14, 2013
Publication date	May 21, 2019
Grant date	May 21, 2019

Abstract

Authentication systems and methods for a population of devices each associated with an RFID tag are described. For each device, a secret key is combined cryptographically with a publicly-readable unique identifier (UID) of an RFID tag to obtain a unique authorization signature. The RFID tag is prepared utilizing the unique authorization signature as memory-access and/or tag-operation password(s). The systems and methods may safeguard against attacks whereby compromise of a single tag will not compromise the entire population of devices and may reduce or eliminate the use of inappropriate surgical devices during a surgical procedure.

First claim

What is claimed is:

1. A method of authenticating, the method comprising:
encrypting a secret key stored on a first device with a unique identification code of the first device to generate an original authentication signature at the first device;
storing the original authentication signature in a memory associated with the first device;
reading the unique identification code from the memory using a second device;
encrypting a copy of the secret key stored on the second device with the unique identification code of the first device to generate a second authentication signature at the second device;
comparing the second authentication signature to the original authentication signature; and
determining authenticity of the first device based on a comparison of the second authentication signature and the original authentication signature.

2. The method according to claim 1 , wherein the original authentication signature and the second authentication signature are generated by performing a hash function on the secret key stored in the memory or the copy of the secret key stored at the second device, respectively, and the unique identification code of the first device.

3. The method according to claim 2 , wherein the hash function is selected from the group consisting of an SHA-1 function, an SHA-1 HMAC function, an SHA-2function, and an MD5 function.

4. The method according to claim 1 , wherein the original authentication signature and the second authentication signature are generated by:
concatenating the unique identification code of the first device and the secret key stored in the memory or the copy of the secret key stored at the second device to create a bitstring; and
performing a hash function on the bitstring.

5. The method according to claim 4 , wherein the hash function is selected from the group consisting of an SHA-1 function, an SHA-1 HMAC function, an SHA-2function, and an MD5 function.

6. The method according to claim 1 , further comprising:
dividing the original authentication signature into a plurality of bitstrings; and
performing an XOR operation on a first bitstring of the plurality of bitstrings and on a second bitstring of the plurality of bitstrings to obtain an intermediate signature.

7. The method according to claim 6 , further comprising:
performing an XOR operation on the intermediate signature and on a third bitstring of the plurality of bitstrings.

8. The method according to claim 1 , wherein determining authenticity of the first device further includes performing at least one of a read function, a write function, or a read-write function on the memory by the second device.

9. A system for authenticating a surgical instrument, the system comprising:
a surgical instrument including:
a first memory configured to store a unique identifier of the surgical instrument;
and
a password module configured to store a password; and

an authentication unit, including:
a communication module configured to communicate with the first memory;
a second memory configured to store a secret key;
a processor coupled to the second memory and the communication module, the processor configured to:
read the unique identifier from the first memory;
encrypt the secret key with the unique identifier to generate an authentication signature;
transmit the authentication signature to the password module; and
receive a verification status from the password module in response to the authentication signature matching the password.

10. The system according to claim 9 , further comprising an electrosurgical generator operably coupled to the authentication unit.

11. The system according to claim 10 , wherein the electrosurgical generator is configured to enable an operational mode in response to the verification status.

12. The system according to claim 11 , wherein the first memory is further configured to store data and the authentication unit is configured to modify the data stored in the first memory.

Assignees

• Covidien Lp

Inventors

• Klammer Peter F
• Paterson William G

Classifications

• G06F21/44 Primary

  Program or device authentication · CPC title

• H04W12/06

  Authentication · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• G06F21/82

  Protecting input, output or interconnection devices · CPC title

• G06K19/0723

  the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs · CPC title