GB2446178A

GB2446178A - An electronic seal

Info

Publication number: GB2446178A
Application number: GB0701708A
Authority: GB
Inventors: Helen Balinsky; Edward Mcdonnell; Lior Lewinz
Original assignee: Hewlett Packard Development Co LP
Current assignee: Hewlett Packard Development Co LP
Priority date: 2007-01-30
Filing date: 2007-01-30
Publication date: 2008-08-06
Also published as: GB0701708D0

Abstract

An electronic seal which can be used to detect and provide evidence of unauthorised opening of eg a container. The seal is made of two portions, a first portion (10) which includes a memory tag (2) and the second portion (12) having a memory tag reader. The two portions can communicate when in close proximity (either by way of a cable or wirelessly). The memory tag reader (ironically) transmits a random data item to the memory tag, the memory tag in response transmits for example an encrypted version of the random data thereby authenticating the memory tag to the memory tag reader. The memory tag may be in RFID tag. The memory tag reader may transmit an alert signal if a response has not been received from the memory tag. The memory tag reader may also include GPS so as to monitor the location of the seal. Tag response and location information may be logged. The memory tag reader may include a recess (22) to receive another memory tag (202) which may provide an alternative expected response.

Description

I

ELECTRONIC SEAL

A security seal or tamper indicating device is designed to leave non-erasable, unambiguous evidence of entry or tampering to the container or premises that is sealed. Unlike a lock, the seals are not intended to necessarily delay or resist unauthorised access but to simply provide evidence that access has occurred. A simple example is the high visibility adhesive tape often used by police personnel to seal an entry to a crime scene. Although the sealed door can still be opened even though the adhesive tape is applied across the door opening, the act of opening the door either breaks the adhesive tape or removes it from the opening completely, thus provided a clear visual indication on subsequent inspection that access to the premises has occurred. Another example of where it is desirable to either inhibit or at least record unauthorised access to a container is where the container is being used to deliver high value items. For example, in the case of a delivery truck carrying high value electronic equipment it would be beneficial to the electronic equipment manufacturer for any unauthorised opening of the truck, or opening at non predefined locations, to be at the least recorded, yet still allow normal, authorised, deliveries to occur without replacing the seal on completion of every delivery. Conventional seal technology does not provide a good solution to this problem, since whilst conventional seals may record that unauthorised access has occurred, they arc either too difficult to replace on a repeated basis, as would be required for a delivery container, or conversely are too easy to replace, thus circumventing their function of providing the visual indication in the first place.

According to a first aspect of the present invention there is provided an electronic seal comprising a first portion having a memory tag and a second portion having a memory tag reader, the first and second portions being movable relative to one another between a first position in which the portions are in close proximity to each other and in which the memory tag and memory tag reader are capable of communication with each other and a second position in which the portions are physically separated from one another and in which communication is not possible between the memory tag and memory tag reader wherein the memory tag reader is arranged to periodically transmit a random data item to the memory tag and the memory tag is arranged in response to receiving the random data item to perform a prcdcfined computation on the random data item and transmit the result of the computation to the memory tag reader for authentilication by the memory tag reader.

The predefined computation may comprise combining the received random data item with a further data item stored in the memory tag and performing a hash operation on said combination. Alternatively, the predefined computation comprises encrypting the received random data item according to an encryption algorithm stored on the memory tag.

Preferably the second portion may further include an output interface arranged to provide an alert signal whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid. Furthermore, the output interface may be arranged to transmit the alert signal to a location remote from the electronic seal.

Additionally or alternatively, the second portion may include a data storage unit and may be arranged to store a data log entry in the data storage unit whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid.

Additionally or alternatively, the second portion may include a location sensor arranged to determine the location of the electronic seal. Furthermore, the second portion may be arranged to generate a data log entry including the location of the seal whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid. Additionally or alternatively, one or more authorised locations may be stored in the second portion and the second portion may be arranged to generate a data log entry and/or generate an alert signal whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid, and the location of the seal does not correspond as to one of the authonsed locations. Furthermore, the alert signal may include the location of the seal.

Additionally or alternatively the second portion may include a recess arranged to receive a third portion therein, the third portion including a further memory tag arranged such that on insertion of the third portion into the recess the further memory tag provides the expected response to the random data items transmitted by the memory tag reader.

Furthermore, a plurality of further data items may be stored in the memory tag and the random data item transmitted by the memory tag reader may further include a key ID identifying the secret key to be used in the hashing operation. Embodiments of the present invention will now be described, by way of illustrative example only, with reference to the accompanying figures, of which: Figure 1 schematically illustrates an implementation of a memory tag and tag reader used in embodiments of the present invention; Figure 2 illustrates the challenge/response function performed by embodiments of the present invention; Figure 3 schematically illustrates an electronic seal according to a first embodiment of the present invention; and Figure 4 schematically illustrates a second embodiment of the present invention; In embodiments of the present invention each electronic seal comprises two physically separate elements, the first element being a memory tag and the second element being a memory tag reader. In use, the electronic seal is created by permanently attaching the memory tag to one side of an opening and the memory tag reader to the other side of the opening. For example, the memory tag is attached to a door or hatch in a container, whilst the memory tag reader is attached to the container itself adjacent to the memory tag. As will be explained in more detail below, it is necessary in embodiments of the present invention for the memory tag and tag reader to be in communication with one another.

Whilst this communication may be accomplished with a physical transmission medium, such as an interconnecting cable, in preferred embodiments the communication is achieved wirelessly.

An example of a suitable implementation for a wireless memory tag and tag reader is schematically illustrated in Figure 1, in which conventional component identifications (C-capacitor, L-inductance, R-rcsistor, D-diode and S-switch) are used. The memory tag 2 includes an interface circuit 4 and a memory module 6 that are connected to one another via a data bus. The memory tag interface 4 comprises an RF transponder circuit including a capacitor C2 which, in combination with an antenna coil L2, forms a resonant circuit with component values being chosen to tune the combination to a frequency of approximately 2.45GHz (for example) for inductive coupling with the tag reader 8. The portion of transponder circuit responsible for power supply is diode Dl and capacitor C4, with diode Dl rectifying the alternating current generated by the inductive coupling and the capacitor C4 acting as a power supply storage. The portion of the memory tag interface responsible for the reception and transmission of data from and to the tag reader 8 is diode D2, capacitor C5 and resistor Ri, which together form a simple envelope detector. Data thus received by the memory tag is stored in the memory 6. The portion of the interface 4 of the memory tag responsible for reading data back from the memory 6 is formed by the tuned circuit L2/C2 in combination with SI and C3. Switching C3 in and out of the circuit using Si changes the resonance of the tuned circuit L2/C2 resulting in phase modulation of the reflected power directed from the memory tag 2 to the tag reader 8.

The functionality of the memory tag and tag reader as a seal, i.e. the ability to detect and provide evidence of unauthorised opening, is achieved in use by the periodic authentification of the memory tag by the memory tag reader. The authentification process involves the memory tag reader 8 transmitting a random data item, such as a random number, to the memory tag, the memory tag performing a predefined computation on the random data item, the computation using a further data item known to both the memory tag and memory tag reader, and transmitting the result of the computation back to the tag reader. The tag reader can authenticate the memory tag by virtue of independently performing the same computation and comparing its result with the result received from the tag. The further data item is unique to the particular memory tag and cannot be externally read from the memory tag memory. A possible authcntification process is illustrated in Figure 2. The memory tag reader generates a random number and transmits this random number together with the ID of a stored secret (encryption key) to the memory tag. Both the reader and memory tag store a number of secrets, for example 16 different secrets, and the transmitted secret ID serves to identify to the memory tag which secret is to be subsequently used. On receipt of the random number and secret ID, which constitutes the challenge, the memory tag performs the predetermined hashing operation on the random number and the identified secret, the result being denoted on Figure 2 as hashT.

The hash generated by the memory tag, hashT, is subsequently transmitted back to the tag reader, this transmission constituting the response part of the challenge/response. At the same time that the memory tag is computing its hash, the tag reader also generates a hash using the same random number and secret, the hash functions of the tag reader and memory tag being identical. In Figure 2 the hash generated by the tag reader is denoted hashR. On receipt of the hash from the memory lag, the memory reader compares the received hash from the memory tag with the hash generated by the tag reader itself. To verify the response from the memory tag the two hash values should be identical. An alternative to performing the hashing operation may be to encrypt the transmitted random data item using the encryption key stored on the memory lag.

The use of an authentication method eliminates the possibility for an unauthoriscd user to separately transmit previously recorded memory tag responses to a tag reader on a seal, since the correct response from the memory tag is different for any given challenge, or to create another physical device to impersonate the original seal memory tag, since the secret, or secrets, from the memory tag are arranged to bc non-readable. The opening of the container, and thus the "breaking" of the electronic seal, is detected by virtue of the fact that the tag reader will no longer receive a response to issued challenges, since the memory tag will no longer be in communication with the tag reader. In embodiments where communication between memory tag and tag reader is accomplished wirelessly the range must be fixed such that communication ceases as soon as physical opening of the protected container/opening occurs. In preferred embodiments of the present invention the selected memory tag is a "memory spot", which is a proprietary RFID tag produced by the applicant, since the memory spots can be arranged to have a communication range of no more than approximately 1mm. The relatively short communication range of the "memory spots" makes them particularly attractive for implementing embodiments of the present invention since it effectively prevents the seal from being opened whilst still maintaining communication between the memory tag and reader. For example, if a convention RFII) tag and reader were to be used having a communication range of typically 1 -2m then access to container protected by the seal could be made without contact between the tag and reader being broken and thus without the access being recorded. The intervals at which the tag reader issues the challenges may vary depending upon the particular application and the expected frequency of opening of the protected container. However, in preferred embodiments it is anticipated that the interval between the challenges will be relatively small, i.e. in the order of seconds or less. Furthermore, for any given application the time intervals between challenges may be randomised, with the maximum time between any two consecutive challenges preferably being less than the minimum time required to "attack" the seal. The order in which the stored secrets arc used is also preferably randomised.

An electronic seal according to a first embodiment of the present invention is schematically illustrated in Figure 3 and comprises a first portion 10 that includes a memory tag 2 of the kind previously discussed and a second portion 12 that includes a tag reader 8. The first and second portions of the seal are either arranged to be disconnected from one another or have no physical connection in the first place, such that they can be located on either side of an opening to be sealed. The second portion 12 of the seal also includes a microprocessor 14 that is in communication with the memory tag 8. The microprocessor 14 is also in communication with a global positioning system (GPS) receiver 16, an output interface 18 and local data storage unit 20. The GPS receiver is preferably provided such that the physical location of the seal is always known to itself. This allows predetermined locations at which the seal may be opened to be prc-prograrnmcd, with the locations being stored either in the local memory unit 20 or in onboard memory included within the microprocessor 14. This allows the container being protected to be opened at the predetermined locations, for example at an expected delivery site of the contents of the container, without the opening of the seal generating any alarm or emergency response.

Conversely, by comparing the current location of the seal with the one or more stored authorised locations the microprocessor 14 can determine when the seal has been opened at an unauthorised location. The unauthonsed opening may then be recorded in the local memory unit 20, with details of the physical location and time of opening, for example, or may alternatively or additionally be notified to a remote location by means of the output interface 18. The output interface will preferably comprise a wireless communication module, such as a GPRS or GSM telecommunication modem to allow the seal to communicate the fact that an unauthorised opening has occurred to a predetermined remote location, such as the container owners premises or a third party security service. In other embodiments one or both of the output interface 18 and local data storage 20 may be omitted, with the detection of an unauthorised opening of the seal causing a local alert action, such as the activation of a visual or audible alarm, or may additionally or alternatively cause a secondary locking device to be activated in order to secure the container.

Figure 4 schematically illustrates an electronic seal according to a further embodiment of the present invention. Where applicable, like for like components with reference to Figure 3 have been numbered identically in Figure 4. In the embodiment illustrated in Figure 4 a physical slot or recess 22 is provided in the second portion of the seal in which the tag reader 8 is located and is provided in close physical proximity to the actual tag reader 8.

An additional "key" 202 is also provided that is arranged to be removably received within the recess 22 within the second portion 12 of the seal. The physical key 202 includes a second memory tag (not illustrated) that is functionally equivalent to the first memory tag 2 included in the first portion 10 of the seal. In other words, the first and second memory tags have the same "secrets" stored therein and are arranged to perform the same hashing function on received challenges from the tag reader 8. The physical key 202 is issued only to persons authorised to have access to the protected container. In use, an authorised person would insert the physical key 202 into the recess 22 in the second portion of the seal. Subsequent challenges issued by the tag reader 8 would be received preferentially by the memory lag located in the physical key and the correct responses would be provided, as previously explained. This would allow the first memory tag 2 within the first portion 10 of the seal to be moved away from the memory tag reader 8 by virtue of the container being opened without the tag reader 8 detecting its absence and thus without reporting an unauthorised opening of the seal. The insertion of the physical key 202 may be detected by the tag reader 8 and this may subsequently be noted in the local data storage 20 via the microprocessor 14 for subsequent audit purposes.

In both the embodiments shown in Figures 3 and 4 each of the memory tag and tag reader are provided with a tamper resistant outer casing to prevent a physical attack on the seal intended to either gain access to the individual components or to damage and render inoperative the individual components.

Electronic seals according to embodiments of the present invention benefit from the preferred short access range that the memory tags provide and that allows detection of even small alterations in the physical configuration of the electronic seal i.e. to provide an alert even on small openings. The onboard authentication process provided by the electronic seal makes it extremely difficult to fake the presence of the memory tag. Further advantages include the fact that the electronic seal does not prevent authorised or legitimate access to the container and is not physically weakened or destroyed by such permitted access. However, the electronic seals provide full logging facilities above authonsed and unauthorised accesses with the capability of providing an instant alert for imauthorised events. In the preferred wireless embodiments the device is inherently dust and dirt resistant and can thus be deployed in environments prone to pollutants, such as oil distribution for example.

Claims

An electronic seal comprising a first portion having a memory tag and a second portion having a memory tag reader, the first and second portions being movable relative to the one another between a first position in which the portions are in close proximity to each other and in which the memory tag and memory tag reader are capable of communication with each other and a second position in which the portions are physically separated from one another and in which communication is not possible between the memory tag and memory tag reader, wherein the memory tag reader is arranged to periodically transmit a random data item to the memory tag and the memory tag is arranged in response to receiving the random data item to perform a predefmed computation on the random data item and transmit the result of the computation to the memory tag reader for authentification by the memory tag reader.
2. An electronic seal according to claim 1, wherein the predefined computation comprises combining the received random data item with a further data item stored in the memory tag and performing a hash operation on said combination.
3. An electronic seal according to claim 1, wherein the predefmed computation comprises encrypting the received random data item according to an encryption algorithm stored on the memory tag.
4. An electronic seal according to any preceding claim, wherein the second portion further includes an output interface arranged to provide an alert signal whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid.
5. An electronic seal according to claim 4, wherein the output interface is arranged to transmit the alert signal to a location remote from the electronic seal.
6. An electronic seal according to any preceding claim, wherein the second portion includes a data storage unit and is arranged to store a data log entry in the data storage unit whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid.
7. An electronic seal according to any preceding claim, wherein the second portion includes a location sensor arranged to determine the location of the electronic seal.
8. An electronic seal according to claim 7, wherein the second portion is arranged to generate a data log entiy including the location of the seal whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid.
9. An electronic seal according to claim 7 or 8, wherein one or more authorised locations are stored in the second portion and the second portion is arranged to generate a data log entry and/or generate an alert signal whenever either no response is received from the memory tag in reply to the transmission of the random data item by the memory tag reader or the received response from the memory tag is determined to be invalid and the location of the seal does not correspond to one of the authorised locations.
10. An electronic seal according to claim 9, wherein the alert signal includes the location of the seal.
11. An electronic seal according to any preceding claim, wherein the second portion includes a recess arranged to receive a third portion therein, the third portion including a further memory tag arranged such that on insertion of the third portion into the recess the further memory tag provides the expected response to the random data items transmitted by the memory tag reader.
12. An electronic seal according to claim 2, wherein a plurality of further data items arc stored in the memory tag and the random data item transmitted by the memory tag reader includes a key ID identifying the secret key to be used in the hashing and/or encryption operation.