CN1433558A - Method of authenticating tag - Google Patents

Abstract

The present invention discloses a method for authenticating tags such as radio frequency identification (RFID) by providing an RFID tag with a stored security block cryptographically associated with the tag address; deriving the tag address from the tag; converting at least the tag address and the private data set to obtain a security block; this security block is then compared with the stored security block. If the two security blocks match, the tag is considered authenticated. Alternatively, at least the stored security block is cryptographically transformed using the private data set to obtain the tag address, and the tag address is then compared with the stored tag address. If the two tag addresses match, the tag is considered authenticated.

Description

Method of Authentication Label

field of invention

The present invention relates to a method of authenticating a device, tag, tag or the like, and in one embodiment to a method of cryptographically authenticating a tag of a matched component system such that hardware that is part of the matched component system is only required to query for authentication as the matched component system part of the label.

Background of the invention

Encryption has been used for many years to keep information secure and prevent efforts to obtain it by those who should not have access to it. The information is first encoded by a first authorized user and then decoded by a second authorized user to gain access to the information. A simple example of encryption is to make each letter of the alphabet correspond to a unique number, and then use these numbers instead of letters to represent information of interest. Someone who knows the encryption algorithm (replacing each letter with a unique number) can then decode this information to gain access to it. However, such simple encryption is easy to break and therefore not very secure.

Especially now, other more complex forms of encryption are used to secure information transmitted electronically from one authorized user to another. For example, it is often desirable to send private information such as messages, credit card numbers, etc. over the Internet and encrypt the information in a suitable secure manner. A suitable type of encryption for these purposes is "public key/private key" encryption, which is described in general textbooks and patents on encryption.

This patent document includes a series of references to the use of technology to track manufactured items or to complete the authentication of items. See, for example, European Patent 0 710 934 A2 entitled "Methods and System for Performing Article Authentication"; European Patent 0 889 448 A2 entitled "Method of Preventing Counterfeiting of Articles of Manufacture", and European Patent 0 889 448 A2 entitled "System for Identifying, Authenticating and US Patent No. 5,768,384 for "Tracking Manufacturing Article". However, the methods described in these and other references are not suitable for using tags as a means of authentication as described below with reference to the present invention.

Summary of the invention

Tags or tags containing information about the item can be provided as part of a matching component system along with hardware for reading, scanning or interrogating those tags and tags. Examples of such systems include bar code labels (or printing devices) and scanners; and radio frequency identification (RFID) tags and RFID interrogators. One reason to encourage the use of matching component systems is to enable the system to avoid interrogating tags belonging to other systems. As a result, there are fewer error messages and it is possible to use two or more systems to identify different materials at the same location. Other reasons relate to product and system warranties. That is, manufacturers often warrant their products for a period of time, or perform a given function only when those products are used with components that the manufacturer used to repeatedly test the product, but otherwise no or reduced warranty. In the case of matched component systems of the type described here, the system provider warrants the operation of the system if the tag interrogator is used with an authenticated tag, and not otherwise. Specifically, the system provider may warrant the operation of the RFID system when it sells the user RFID tags and the equipment used to write information to and/or read information from those tags.

For example, the authentication method described herein enables a system or user to authenticate a radio frequency identification (RFID) tag by providing the RFID tag with a stored security block cryptographically associated with the tag address, deriving the tag address from the tag, translating the cryptographic at least Applied to the tag address and private data set to obtain a security block, which is then compared with the stored security block. If the two security blocks match, the tag is considered authenticated. Additionally, the stored security block can be cryptographically up-converted using at least one private data set to obtain the tag address, which can then be compared with the stored tag address. If the two tag addresses match, the tag is considered authenticated. RFID tags using the present invention are also described. The present invention finds particularly useful application in the interrogation of RFID tags in library materials, such as books, by portable or fixed RFID interrogators.

Brief description of the drawings

The present invention is described in more detail with reference to the accompanying drawings, in which:

Figure 1 is a process diagram illustrating an embodiment of the inventive method for providing a tag with a cryptographically translated security block as the tag address.

Fig. 2 is a process diagram showing that the method of the present invention encrypts and compares an authentication tag by field

Example.

Fig. 3 is a process diagram showing that the method of the present invention deciphers and compares an authentication tag on the spot

Example.

Figure 4 is a schematic diagram of an RFID tag according to the present invention.

Detailed description of the invention

I. Overview

Briefly, a preferred method of authenticating an RFID tag according to the present invention includes the following steps. First obtain the tag address identifying the tag from the tag memory. Next, the tag address and the private data set and optionally the public data set are cryptographically converted to provide a secure block stored in the tag's memory. Third, when it is desired to authenticate the tag, the tag address is again obtained and cryptographically converted with the data set to provide a security block which is compared with the stored security block. Or, alternatively, use the inverse of the initial transformation to cryptographically transform the security block, include the appropriate data, and obtain the tag address, which is compared to the stored tag address. Fourth, if two security blocks (or tag addresses , depending on which process is used), the tag is authenticated. Otherwise, the label is not certified.

These steps, and other features, variations and embodiments of the invention will be described in more detail below. Although the invention has been described in terms of an RFID system, other systems capable of writing information to or reading (preferably electronically) information from tags are also within the scope of the invention.

II. Label

RFID tags suitable for use in connection with the present invention are described in PCT Publication No. 99/65006 entitled "Identification Tag With Enhanced Security," the rights of which are assigned to the assignee of the present invention. As shown in FIG. 4, RFID tag 10 generally includes an antenna 12 connected to a memory device 14, such as an integrated circuit (IC). The tag can include a power source such as a battery or capacitor, or can be powered solely by the RFID interrogator so that it receives both power and information in the form of radio waves from the RFID interrogator. Labels can be provided with an adhesive (usually a pressure sensitive adhesive). This enables it to be glued to e.g. library books. Those skilled in the art appreciate that Figure 4 represents only one of many embodiments of geometries and antenna designs suitable for RFID tags.

A commercial example of a suitable RFID tag is available under the designation "TIRIS Tag-it" from Texas Instruments Company of Dallas, Texas. RFID tags of the Tag-it trademark include a first memory storage area (referred to as "permanent tag memory") that stores immutable data such as unique immutable data that identifies a particular tag (referred to herein as a "tag address"); and a second memory storage area (referred to herein as "variable tag memory") for storing variable information provided by the user. Current Tag-it branded RFID tags include 256 bits of variable tag memory, although more memory on these or other RFID tags appears to be available in the future. Tag-it trademarked RFID tags operate on the 13.56MHz communication frequency, although tags and interrogators operating on other frequencies can be used. The Tag-it Trademark RFID Labeling System can also be used with Windows-compatible software from Texas Instruments to simplify the use of Tag-it Trademark RFID labels and equipment.

A. Permanent Tag Storage

Tag addresses are preferably stored in permanent tag memory. And it is preferable that the tag address is unique, so as to ensure that a specific tag can be identified and accessed during use. For example, the tag address can be 32 bits long, allowing over 4 billion unique addresses. Typically this tag address is programmed into the tag during manufacture and is "factory locked" so that it cannot be modified later. As described below, tag addresses may include information stored in permanent tag memory and variable tag memory.

B. Variable Tag Memory

Subject to any application limitations of the amount of memory available, variable tag memory can be used to store information about the maker of the tag and the tag itself (such as when and where the tag was made), and/or information about the item to which the tag is or will be attached . For example, when an RFID tag is to be attached to a book or other material in a library, the title, author, borrowing times, checking status and usage statistics about the book can be stored in the variable tag memory. Other information stored in variable tag memory includes the name of the library that owns the book and material, the specific library department that lent the book, the appropriate location for the book and material (e.g., a specific shelf location), the type of item (book, CD, videotape, etc.) )wait.

A portion of the variable tag memory can be locked so that it cannot be inadvertently modified, for example, data on the tag related to items belonging to a library can be protected from RFID-based airline package handling systems or other RFID writers inadvertent modification. The locking process varies between different RFID tag suppliers. In the case of Texas Instruments Tag-it brand RFID tags, the smallest block of variable memory that can be locked in this way is 32 bits, which can store certain cryptographic information in the following manner.

III. Reader (query source) and writer (programmer)

The RFID tags used in one embodiment of the invention are readable and programmable. That is, the RFID tag can be read or interrogated by an interrogating source to obtain some or all of the information stored in the tag's variable tag memory for use or processing by the user, and the RFID tag can also be programmed (written) with system or user-supplied information. enter). A suitable RFID interrogation source and RFID writer is commercially available from Texas Instruments of Dallas, Texas under the designation "Commander 320".

In one embodiment of the invention, certain information is cryptographically converted and written to a portion of the variable tag memory available by the RFID writer, and in use the RFID reader interrogates the tag to determine if the tag is authentication, which will be described in detail below. Preferably, the RFID reader can actually interrogate multiple RFID tags simultaneously (the Interrogation Source of the Commander 320 brand can currently interrogate 30 RFID tags per second), although this feature is not required.

IV. Encryption

Before a tag is authenticated, certain information is obtained from the tag and other information is stored in it. Specifically, the tag address is obtained from the tag, cryptographically converted as described below, and the resulting security block is stored in the tag. An exemplary process for providing a tag with a stored security block according to the present invention is shown in FIG. 1 .

Step 100 reads or interrogates the tag to obtain the tag address 102 . The tag address is then concatenated with at least one data set, preferably two data sets. If a data set is used, it is a private data set 106 which is generally not available to the general public, but is stored and used by the query source. If, as in the remainder of this description, two data sets are used, one data set is private and the other is public data set 104, as shown in FIG. 1 . Tag addresses and data sets can be interleaved or mixed coded if desired (rather than concatenated), although this is not believed to add much to the security and reliability of the system.

The public and private data sets can include any string of characters and/or numbers, and can be human-readable strings represented as binary data using standard methods such as ASCII, UTF-8 or Unicode. Public data can be widely distributed or not, as required. In other words, public and private data groups are just two data groups to which users impose different levels of security. The data set, especially the private data set, is preferably a random string of characters and/or numbers, making it difficult or impossible to reverse engineer the data set from the cryptographically converted information. To create data sets, random or substantially random processes can be used, such as random number generators.

Public or private data sets can be included in the software used to create and authenticate tags. Often, software includes machine language instructions that are not easily understood by humans and cannot be deciphered unless a very specialized human spends a significant amount of time doing it. Therefore, the data set is preferably difficult to locate in the software, so that even if the software itself is widely distributed, the data set is considered private for all practical purposes. The form of public and private data sets may also be selected to facilitate legal protection under copyright, trade secret or other laws such that any unauthorized user of the data set would violate legally protected rights.

Although the tag address, public data group, and private data group can have any desired length and content, for example, the tag address can have 32 bits of information, the public data group has at least 32 bytes of information, and the private data group has at least 32 bytes of information . An exemplary tag address is the hexadecimal value 0x012345678, an exemplary public data set may be the ASCII string "3M Radio Frequency Identification Systems", and an exemplary private data set may be 0x0001E2882AC7B5C613FAF447170E90702957A5053C5C013D7235168E268DE99

The tag address 102 and private data set 106 and optional public data set 104 are then fed into a cryptographic transformation algorithm 108, such as a cryptographic hash algorithm, which transforms the data and outputs a message digest 110, eg, 160 bits long. Cryptographic transformations include traditional reversible encryption such as the Data Encryption Standard (DES, which is also known as the Data Encryption Algorithm (DEA) by ANSI and DEA-1 by ISO), and other related techniques such as the use of secure hashing algorithms such as 1 Or a one-way cryptographic hash like SHA1. Examples of both types of algorithms are included in the book Applied Cryptography, Protocols, Algorithms, and Source Code in C (John Wiley and Sons, Inc. 1996 (2d edition)) by Bruce Schneier, along with detailed source code for the C programming language, page 442 at the beginning of page 1 and in the beginning of page 238 of A. Menezes et al., "Handbook of Applied Cryptography." Although other cryptographic algorithms such as DES-CBC-MAC and DES-DMAC can also be used as the cryptographic conversion method of the present invention, cryptographic hash algorithms such as SHA1, MD5, and RIPEMD-160 are preferred because they are specific to existing cryptographic algorithms. Provides a fairly high level of security against attempts to reverse-manipulate private data while knowing message digests and public data sets, also because they are readily available, easy to implement, and free from significant government restrictions on use. Source programs related to SHA1 as described in the reference Applied Cryptography cited above are now available on computer disks from Bruce Schneier, Counterpane Systems, 7115 W. North Ave., Suit 16, Oak Park, IL 60302-1002.

If it is desired not to store the entire message digest on the tag due to variable tag memory limitations, then a particular portion of the message digest can be designated and stored (written) into the RFID tag's variable tag memory. This part of the message digest is the security block 112 . In addition, as mentioned above, if it is desired to lock the security block in the variable tag memory to prevent inadvertent changes, it may be a 32-bit variable tag memory lock unit or block, which can be specified or stored in the variable tag memory The message digest determines the appropriate size of the security information block. It may also be desirable to store the message digest or security block, or only the message digest or security block, in permanent tag memory, which is typically made by the tag's maker, or someone else makes it for them. For convenience, the output of cryptographic conversion (such as SHA1) is called "message digest", and the whole or part of the message digest stored in the RFID tag is called "safety block". Thus, the security block 112 can be established by specifying at least a partial message digest, which is then written to the RFID tag in the manner shown at step 114 above.

V. Certification

Once a security block representing a message digest or a portion of a message digest is stored in a tag according to a cryptographic transformation, the tag can be used for field authentication. Authentication is accomplished in a number of different ways, two of which are described below. The first involves following the same process for encrypting the tags, then comparing the result (the security block) with the stored security block to determine if they are the same. If the two security blocks are the same, the tag is authenticated. If they are different, the label is not certified. This is called "field encryption and comparison".

The second authentication process described below mainly includes the reverse process. That is, the authentication process begins by retrieving the stored security block from the tag memory, using the private data set, including the public data set if necessary, performing an inverse cryptographic transformation to obtain the tag address. The tag address is then compared to the stored tag address. If the addresses of two tags are the same, the tags are authenticated. If they are different, the tag is not certified. This is called "field decryption and comparison". To use this second authentication procedure, the security block should include the entire message digest.

These authentication processes are described in more detail with reference to FIGS. 2 and 3 .

A. Field Encryption and Comparison

Figure 2 illustrates the field encryption and comparison process steps used to determine whether a tag is authenticated. The field user follows the same method as shown in Figure 1, then compares the final value to the stored security block to determine if the tag is authenticated.

In the embodiment shown in FIG. 2 , steps 200 to 212 are the same as the corresponding parts in FIG. 1 . That is, the tag address 200 is obtained; the tag address 202, private data set 206 and optional public data set 204 are provided to a cryptographic transformation algorithm 208 which provides a message digest 210 from which a security block 212 is built. To authenticate the tag by comparison, the RFID reader obtains the stored security block from the tag as shown at 214 and compares the result of the security block 212 (shown at 216 ) with the stored security block obtained from the tag at 214 . If the two security blocks are the same, the tag is authenticated. If the two messages do not match, the user can conclude that the item is not authenticated and take any appropriate action. Such action includes, for example, terminating processing of items with this label attached.

B. Field decryption and comparison

Figure 3 shows the field decryption and comparison process steps for determining whether a tag is authenticated or not. As shown in Figure 3, step 300 obtains security block (in this embodiment security block is equivalent to message digest) from label; Security block 302, private data set 306 and optional public data set 304 are sent to cryptographic conversion algorithm 308 , the latter providing the tag address 310. The RFID reader then obtains the stored tag address 312 from the tag and compares the tag address 310 with the stored tag address obtained in 312 (shown as 314). If the addresses of two tags are the same, the tags are authenticated. If the addresses of the two tags are different, the tags are not authenticated. The cryptographic transformation may be a reversible block cipher, stream cipher, or other suitable process.

Cryptographic transformation 308 may be the inverse of the cryptographic transformation used to create the security block stored on the RFID tag. In one embodiment, the cryptographic transformation may be a block cipher, such as DES that operates in an encryption mode (encrypted security block) and a decrypted mode (deciphered security block in situ), where the key of the block cipher is a function of the public and private data sets. For example, a data set can be passed through a cryptographic hash function to produce a 160-bit message digest, and a predetermined subset of these bits selected to create a 56-bit key for a DES block cipher. For block ciphers that accept long keys like RC5, the key can be a concatenation or other predetermined arrangement of bits making up the data set.

VI. Variations of the Process of the Invention

It should be noted that some of the steps shown in Figures 1, 2 and 3 can be performed in a different order than shown in the figures. For example in Figure 2 the step 214 of retrieving the stored security block from the tag may occur at an earlier stage of the process, even as the first step of the process. Similarly, step 312 of retrieving the stored tag address from the tag in FIG. 3 may occur at an earlier stage in the process. Also, while the tag address, public data set, and private data set are shown as separate inputs to the cryptographic transformation algorithm, they may be concatenated, interleaved, or otherwise combined as described above prior to input into the cryptographic transformation algorithm.

In another embodiment, the roles of tag address and security block can be reversed. Such inversion is useful when storing tag addresses and security blocks makes one more difficult to change than the other. Reversing the role of the tag address and security block is useful in some cases if the tag manufacturer writes the tag address and the application distributor writes the security block.

According to the following examples, the present invention is described in more detail.

example

This example is a representation of arbitrary tag addresses, public data sets, and private data sets that can be used in conjunction with the method of the present invention. In hexadecimal notation, the tag address can be 0×12345678. This address can be concatenated with the ASCII string public data set "Copyright(c) 2000, 3M IPC.ALL Rights Reserved", whose hexadecimal notation is "0×43 0×6f 0×70 0×79 0× 72 0×69 0×67 0×68 0×74 0×200×28 0×63 0×29 0×20 0×32 0×30 0×30 0×30 0×2c 0×20 0×33 0× 4d 0×20 0×490×50 0×43 0×2e 0×20 0×41 0×6c 0×6c 0×20 0×52 0×69 0×67 0×68 0×74 0×730×20 0×52 0×65 0×73 0×65 0×72 0×76 0×65 0×64”. This concatenated data will be further concatenated with the following hexadecimal dedicated data set: "0×e0 0×34 0×c7 0×f0 0×f9 0×f7 0×37 0×260×f6 0×19 0 ×53 0×15 0×11 0×64 0×e5 0×30 0×45 0×4b 0×e3 0×bf 0×6a 0×ca0×dc 0×6e 0×be 0×b4 0×84 0 ×e3 0×b1 0×2d 0×77 0×38”, the latter can be generated by a computer using a pseudo-random number generator. The entire concatenated string is processed using the SHA1 cryptographic hashing algorithm, and the final message digest in hexadecimal is 0×3 3 8 5 2 7 5 8 9 1 c e b 2 e 6 9cdc4a56031276413d6d702d. From which the lower nibbles (4 bits) of each of the first 8 bytes in the message digest are selected (as indicated by the underscore character in the message digest above), which are then concatenated to provide the security block, in hexadecimal The format is expressed as 0×35781e26, which can be stored on the RFID tag by the RFID writer. The tag is then authenticated using the field encryption and comparison process described above to determine whether the tag is authenticated.

The authentication method described here finds particularly useful application in the authentication of RFID tags for use with library materials such as books. A portable (eg, hand-held) RFID interrogator can be used to interrogate the RFID tag and, if the tag is authenticated, obtain other information useful to the librarian from the RFID tag. Stationary RFID interrogators, such as customer self-service kiosks, staff workstations, and sites where only light barcoded library materials are converted to have RFID tags, can also use the authentication method of the present invention.

While most of the above disclosure is limited to authenticating the specific content of an RFID tag by an RFID reader using certain encryption (and in some cases decryption) techniques, variations of the methods disclosed are within the scope of the present invention. For example, tags, readers and writers operating at frequencies other than radio frequency may be substituted for those described. With appropriate modifications, the present invention can be applied to barcodes (including two-dimensional barcodes) where the barcode address replaces the RFID tag address, and so on.

Claims (100)

1. A method for providing an RFID tag with a safety block, is characterized in that, comprising the following steps: (a) Obtain the tag address; (b) performing a cryptographic transformation of at least the tag address and private data set to provide a security block; and (c) Storing the security block on the tag. 2. The method of claim 1, wherein the tag includes a permanent tag memory and a variable tag memory. 3. The method of claim 2, wherein the tag address is stored in a permanent tag memory. 4. The method of claim 2, wherein at least part of the tag address is stored in a variable tag memory. 5. The method of claim 2, wherein step (c) includes storing the security block in variable tag memory. 6. The method of claim 5, further comprising the steps of: (d) locking at least the portion of variable tag memory storing the security block to prevent inadvertent modification of the security block. 7. The method of claim 2, wherein step (c) includes storing the security block in the persistent tag memory. 8. A method as claimed in any one of claims 1 to 7, characterized in that the cryptographic transformation comprises the use of a cryptographic hashing algorithm. 9. A method as claimed in any one of claims 1 to 7, characterized in that the cryptographic transformation comprises the use of a block or stream cipher. 10. A method according to any one of claims 1 to 7, wherein step (b) includes at least cryptographically converting the tag address and the private data set to provide a message digest, and designating at least a portion of the message digest as a security block . 11. The method of claim 10, wherein the cryptographic transformation includes using a cryptographic hash algorithm. 12. The method according to any one of claims 1 to 7, characterized in that step (b) includes performing cryptographic conversion on the tag address, private data group and public data group. 13. The method of claim 12, wherein step (b) includes cryptographically converting the tag address, private data set, and public data set to provide a message digest, and designating at least a portion of the message digest as a security block. 14. The method according to claim 11, characterized in that step (b) further comprises performing cryptographic conversion on the tag address, private data group and public data group. 15. The method according to claim 12, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 16. The method according to claim 13, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 17. The method according to claim 14, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 18. The method of claim 12, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 19. The method of claim 13, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 20. The method of claim 14, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 21. A method of authenticating an RFID tag having a stored tag address identifying the tag and a stored security block derived at least in part from the tag address, characterized in that the method comprises the steps of: (a) Obtain the tag address; (b) performing a cryptographic transformation of at least the tag address and private data set to provide a security block; and (c) comparing the security block in step (b) with the security block stored on the tag to determine whether the two security blocks are the same. 22. The method of claim 21, wherein the tag includes a permanent tag memory and a variable tag memory. 23. The method of claim 22, wherein the tag address is stored in a permanent tag memory. 24. The method of claim 22, wherein at least part of the tag address is stored in a variable tag memory. 25. The method of claim 22, wherein the stored security block is stored in variable tag memory. 26. The method of claim 25, wherein at least part of the variable tag memory storing the stored security block is locked to prevent inadvertent modification of the stored security block. 27. The method of claim 22, wherein the stored security block is stored in persistent tag memory. 28. A method as claimed in any one of claims 21 to 27, characterized in that the cryptographic transformation comprises the use of a cryptographic hashing algorithm. 29. A method as claimed in any one of claims 21 to 27, wherein the cryptographic transformation comprises the use of a block or stream cipher, wherein the cipher operates in an encrypted manner. 30. A method as claimed in any one of claims 21 to 27 wherein step (b) includes cryptographically converting at least the tag address and private data set to provide a message digest and designating at least a portion of the message digest as a security block. 31. The method of claim 30, wherein the cryptographic transformation includes using a cryptographic hash algorithm. 32. The method according to any one of claims 21 to 27, wherein step (b) includes cryptographically converting the tag address, private data set and public data set. 33. The method of claim 32, wherein step (b) includes converting the tag address, private data set, and public data set to provide a message digest, and selecting at least a portion of the message digest as a security block. 34. The method according to claim 31, characterized in that step (b) further comprises cryptographic conversion of tag address, private data group and public data group. 35. The method according to claim 32, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 36. The method according to claim 33, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 37. The method according to claim 34, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 38. The method of claim 32, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 39. The method of claim 33, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 40. The method of claim 34, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 41. A method of authenticating an RFID tag having a stored tag address identifying the tag and a stored security block at least partially derived from the tag address, the method comprising the steps of: (a) obtaining a security block; (b) cryptographically transforming the security block using at least one private data set to provide a tag address; and (c) comparing the tag address in step (b) with the stored tag address to determine whether the two tag addresses are the same. 42. The method of claim 41, wherein the tag addresses include permanent tag memory and variable tag memory. 43. The method of claim 42, wherein the stored tag address is stored in a permanent tag memory. 44. The method of claim 42, wherein at least some of the stored tag addresses are stored in a variable tag memory. 45. The method of claim 42, wherein the stored security blocks are stored in variable tag memory. 46. The method of claim 45, wherein at least part of the variable tag memory stored in the stored security block is locked to prevent inadvertent modification of the security block. 47. The method of claim 42, wherein the stored security block is stored in persistent tag memory. 48. A method as claimed in any one of claims 41 to 47, characterized in that the cryptographic transformation comprises the use of a block or stream cipher, wherein the cipher operates in a decrypted manner. 49. A method as claimed in any one of claims 41 to 47 wherein step (b) includes cryptographically converting the security block, the private data set and the public data set to provide the tag address. 50. The method of claim 49, wherein the cryptographic transformation includes using a block or stream cipher, wherein the cipher operates in a decrypted manner. 51. The method according to claim 49, wherein the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 52. The method according to claim 50, wherein the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 53. The method of claim 49, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 54. The method of claim 50, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 55. A method of providing and authenticating an RFID tag having a stored tag address identifying the tag and a stored security block derived at least in part from the tag address, the method comprising the steps of: (a) Provide a secure block of storage through the following steps (i) Obtain the tag address; (ii) perform a cryptographic transformation of at least the tag address and private data set to provide a security block; and (iii) storing the security block on the tag; and (b) Authenticate the label by (i) obtain the tag address; (ii) perform a cryptographic transformation of at least the tag address and private data set to provide a security block; and (iii) comparing the security block of step (b)(ii) with the stored security block to determine whether the two security blocks are identical. 56. The method of claim 55, wherein the tag includes a permanent tag memory and a variable tag memory. 57. The method of claim 56, wherein the tag address is stored in a permanent tag memory. 58. The method of claim 56, wherein at least part of the tag address is stored in a variable tag memory. 59. The method of claim 56, wherein step (a)(iii) includes storing the security block in variable tag memory. 60. The method of claim 59, wherein at least part of the tag memory storing the stored security block is locked to prevent inadvertent modification of the stored security block. 61. The method of claim 56, wherein step (a)(iii) includes storing the security block in the persistent tag memory. 62. A method as claimed in any one of claims 56 to 61 wherein the cryptographic transformations in steps (a) and (b) each include the use of a cryptographic hash algorithm. 63. A method as claimed in any one of claims 56 to 61 wherein the cryptographic transformations in steps (a) and (b) each comprise the use of a block cipher or a stream cipher. 64. The method of claim 63, wherein the password operates in an encrypted manner. 65. A method as claimed in any one of claims 56 to 61, wherein steps (a)(ii) and (b)(ii) include at least cryptographically transforming the tag address and private data set to provide a message digest, and at least Specifies a portion of the message digest as a security block. 66. The method of claim 65, wherein the cryptographic transformations in steps (a) and (b) include use of a cryptographic hash algorithm. 67. The method of any one of claims 56 to 61, wherein steps (a)(ii) and (b)(ii) include cryptographically converting the tag address, private data set and public data set. 68. The method of claim 67, wherein steps (a)(ii) and (b)(ii) include cryptographically converting the tag address, the private data set, and the public data set to provide a message digest and specify at least a portion The message digest acts as a security block. 69. The method of claim 66, wherein steps (a) and (b) further comprise cryptographically converting the tag address, private data group and public data group. 70. The method according to claim 67, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 71. The method according to claim 68, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 72. The method according to claim 69, characterized in that the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 73. The method of claim 67, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 74. The method of claim 68, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 75. The method of claim 69, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 76. A method of providing and authenticating an RFID tag having a stored tag address identifying the tag and a stored security block derived at least in part from the tag address, the method comprising the steps of: (a) Provide a secure block of storage through the following steps (i) obtain the tag address; (ii) perform a cryptographic transformation of at least the tag address and private data set to provide a security block; and (iii) storing the security block on the tag; and (b) Authenticate the label by (i) obtain a stored security block; (ii) perform at least a cryptographic transformation on the stored security block and private data set to obtain the tag address; and (iii) comparing the tag address in step (b)(ii) with the stored tag address to determine whether the two tag addresses are the same. 77. The method of claim 76, wherein the tag includes a permanent tag memory and a variable tag memory. 78. The method of claim 77, wherein the tag address is stored in a persistent tag memory. 79. The method of claim 77, wherein at least part of the tag address is stored in a variable tag memory. 80. The method of claim 77, wherein step (a)(iii) includes storing the security block in variable tag memory. 81. The method of claim 80, further comprising the steps of: (a)(iv) locking the variable tag memory storing at least part of the security block to prevent inadvertent modification of the security block. 82. The method of claim 77, wherein step (a)(iii) includes storing the security block in the persistent tag memory. 83. A method as claimed in any one of claims 76 to 82, characterized in that the cryptographic transformation comprises the use of block or stream ciphers, which are run cryptographically in step (a)(ii) and in step (b)(ii) ) to run in decrypted mode. 84. The method of any one of claims 76 to 82, wherein step (a)(ii) includes cryptographically converting the tag address, private data set, and public data set, and step (b)(ii) includes cryptographically Transform security blocks, private data groups and public data groups. 85. The method of claim 84, wherein the public data set is "Copyright (c) 2000, 3M IPC.ALL Rights Reserved". 86. The method of claim 84, wherein the public data set is protected by copyright, trade secret, trademark or service mark laws. 87. The method of claim 1, wherein the tag address is obtained by an RFID interrogation source, and the security block is stored on the tag by an RFID writer. 88. The method of claim 21 or 41, wherein the method is performed by a handheld RFID reader. 89. The method of claims 21 and 41, wherein the method is performed by a library patron self-service unit. 90. The method of claims 55 and 76, wherein at least step (b) is performed by a portable RFID reader. 91. The method of claims 55 and 76, wherein at least step (b) is performed by a fixed RFID reader. 92. An RFID tag characterized in that the tag has a stored tag address and a stored security block cryptographically linked to the tag address. 93. The RFID tag of claim 92, wherein the tag address and private data set are cryptographically converted to provide a security block. 94. The RFID tag of claim 92, wherein the tag address, private data set and public data set are cryptographically converted to provide a security block. 95. The RFID tag of claim 92, wherein the tag includes a permanent tag memory and a variable tag memory. 96. The RFID tag of claim 95 wherein the tag address is stored in a permanent tag memory. 97. The RFID tag of claim 95, wherein at least part of the tag address is stored in a variable tag memory. 98. The RFID tag of claim 95, wherein the security block is stored in variable tag memory. 99. The RFID tag of claim 95, wherein at least a portion of the variable tag memory storing the stored security block is locked to prevent inadvertent modification of the stored security block. 100. The RFID tag of claim 95 wherein the security block is stored in a permanent tag memory.

Images