RFID tags and readers employing QT command to switch tag profiles

RFID readers transmit a Quiet Technology (QT) command to RFID tags causing at least one of the tags to transition between a private profile and a public profile. When a tag is inventoried in the private profile, it replies to the reader with contents from its private memory. When a tag is inventoried in the public profile, it replies to the reader with contents from its public memory, where the contents of the public memory may be a subset and/or modified version of the private memory contents, or entirely different altogether. The tag's profile can be switched again by another QT command from the reader, or following a loss of power at the tag. An access password and/or a short-range mechanism may be employed to allow only authorized readers to transition tag profiles or interrogate the private memory contents of tags in the public profile.

BACKGROUND

Radio Frequency Identification (RFID) systems typically include RFID tags and RFID readers. RFID readers are also known as RFID reader/writers or RFID interrogators. RFID systems can be used in many ways for locating and identifying objects to which the tags are attached. RFID systems are particularly useful in product-related and service-related industries for tracking objects being processed, inventoried, or handled. In such cases, an RFID tag is usually attached to an individual item, or to its package.

In principle, RFID techniques entail using an RFID reader to interrogate one or more RFID tags. The reader transmitting a Radio Frequency (RF) wave performs the interrogation. The RF wave is typically electromagnetic, at least in the far field. The RF wave can also be predominantly electric or magnetic in the near field.

A tag that senses the interrogating RF wave responds by transmitting back another RF wave. The tag generates the transmitted back RF wave either originally, or by reflecting back a portion of the interrogating RF wave in a process known as backscatter. Backscatter may take place in a number of ways.

The reflected-back RF wave may further encode data stored internally in the tag, such as a number. The response is demodulated and decoded by the reader, which thereby identifies, counts, or otherwise interacts with the associated item. The decoded data can denote a serial number, a price, a date, a destination, other attribute(s), any combination of attributes, and so on.

An RFID tag typically includes an antenna section, a radio section, a power management section, and frequently a logical section, a memory, or both. In some RFID tags the power management section includes an energy storage device, such as a battery. RFID tags with an energy storage device are known as active or battery-assisted tags. Advances in semiconductor technology have miniaturized the electronics so much that an RFID tag can be powered solely by the RF signal it receives. Such RFID tags do not include an energy storage device such as a battery, and are called passive tags. Regardless of the type, all tags typically store or buffer some energy temporarily in passive storage devices such as capacitors.

Tags are sometimes removed from tagged items, such as at point-of-sale or when the item is removed from its tagged packaging. Tags sometimes remain on tagged items, for future uses such as item returns to a store or in tagged identity cards. In some cases, especially when the tag remains on the item, the owner of the item may not want unauthorized readers to be able to read or track the item, such as for privacy reasons. Most conventional tags are always capable of being inventoried; those that inhibit regular inventory typically require a password-based challenge-response authentication with a reader before allowing themselves to be inventoried. The former tag types pose privacy risks to their owners; the latter tag types require complex password-based authentication that adds complexity to the reader and to the tag and makes it difficult to use the tags unless the interrogating reader has knowledge of both the authentication algorithm and the tag's secret password.

BRIEF SUMMARY

Embodiments are directed to a Quiet Technology (QT) command transmitted from an RFID reader to one or more RFID tags, causing at least one of the tags to transition between exposing a private profile and a public profile, or vice versa. When a tag in the private profile is inventoried, it replies to the reader with contents from its private memory. When a tag in the public profile is inventoried, it replies to the reader with contents from its public memory. The private and public memory contents may be different and completely distinct, or one may be a subset and/or modified version of the other. The tag may also switch profiles in response to subsequent QT commands, or in some cases after a predefined period of time or upon loss of power to the tag. According to some embodiments, a tag may employ password protection to only accept QT commands from authorized readers. According to some embodiments, a tag may employ range reduction whereby the tag only accepts QT commands from readers that are physically close to the tag. According to yet other embodiments, a tag may employ password protection and range reduction.

DETAILED DESCRIPTION

FIG. 1is a diagram of components of a typical RFID system100, incorporating embodiments. An RFID reader110transmits an interrogating Radio Frequency (RF) wave112. RFID tag120in the vicinity of RFID reader110may sense interrogating RF wave112and generate wave126in response. RFID reader110senses and interprets wave126.

Reader110and tag120exchange data via wave112and wave126. In a session of such an exchange each encodes, modulates, and transmits data to the other, and each receives, demodulates, and decodes data from the other. The data can be modulated onto, and demodulated from, RF waveforms. The RF waveforms are typically in a suitable range of frequencies, such as those near 900 MHz, 2.4 GHz, and so on.

Encoding the data can be performed in a number of ways. For example, protocols are devised to communicate in terms of symbols, also called RFID symbols. A symbol for communicating can be a delimiter, a calibration symbol, and so on. Further symbols can be implemented for ultimately exchanging binary data, such as “0” and “1”, if that is desired. In turn, when the symbols are processed internally by reader110and tag120, they can be equivalently considered and treated as numbers having corresponding values, and so on.

Tag120can be a passive tag, or an active or battery-assisted tag (i.e., having its own power source). Where tag120is a passive tag, it is powered from wave112.

FIG. 2is a diagram of an RFID tag220, which can be the same as tag120ofFIG. 1. Tag220is implemented as a passive tag, meaning it does not have its own power source. Much of what is described in this document, however, applies also to active and battery-assisted tags.

Tag220is typically formed on a substantially planar inlay222, which can be made in many ways known in the art. Tag220includes an electrical circuit which is preferably implemented as an IC224. IC224is arranged on inlay222.

Tag220also includes an antenna for exchanging wireless signals with its environment. The antenna is often flat and attached to inlay222. IC224is electrically coupled to the antenna via suitable antenna terminals (not shown inFIG. 2).

The antenna may be made in a number of ways. In the example ofFIG. 2, the antenna is made from two distinct antenna segments227, which are shown here forming a dipole. Many other embodiments are possible, using any number of antenna segments. In some embodiments, an antenna can be made with even a single segment. Different points of the segment can be coupled to one or more of the antenna terminals of IC224. For example, the antenna can form a single loop, with its ends coupled to the terminals. It should be remembered that even a single segment could behave like multiple segments at the frequencies of RFID wireless communication.

In operation, a signal is received by the antenna and communicated to IC224. IC224both harvests power, and responds if appropriate, based on the incoming signal and the IC's internal state. In order to respond by replying, IC224modulates the reflectance of the antenna, which generates backscatter126from wave112transmitted by the reader. Coupling together and uncoupling the antenna terminals of IC224can modulate the antenna's reflectance, as can a variety of other means.

In the embodiment ofFIG. 2, antenna segments227are separate from IC224. In other embodiments, antenna segments may alternatively be formed on IC224, and so on. Furthermore, an interface element may be used to couple the IC224to the antenna segments227(not shown inFIG. 2).

The components of the RFID system ofFIG. 1may communicate with each other in any number of modes. One such mode is called full duplex. Another such mode is called half-duplex, and is described below.

FIG. 3is a conceptual diagram300for explaining the half-duplex mode of communication between the components of the RFID system ofFIG. 1, especially when tag120is implemented as passive tag220ofFIG. 2. The explanation is made with reference to a TIME axis, and also to a human metaphor of “talking” and “listening”. The actual technical implementations for “talking” and “listening” are now described.

RFID reader110and RFID tag120talk and listen to each other by taking turns. As seen on axis TIME, when reader110talks to tag120the communication session is designated as “R→T”, and when tag120talks to reader110the communication session is designated as “T→R”. Along the TIME axis, a sample R→T communication session occurs during a time interval312, and a following sample T→R communication session occurs during a time interval326. Of course interval312is typically of a different duration than interval326—here the durations are shown approximately equal only for purposes of illustration.

In terms of actual technical behavior, during interval312, reader110talks to tag120as follows. According to block352, reader110transmits wave112, which was first described inFIG. 1. At the same time, according to block362, tag120receives wave112and processes it, to extract data and so on. Meanwhile, according to block372, tag120does not backscatter with its antenna, and according to block382, reader110has no wave to receive from tag120.

During interval326, tag120talks to reader110as follows. According to block356, reader110transmits a Continuous Wave (CW), which can be thought of as a carrier signal that ideally encodes no information. As discussed before, this carrier signal serves both to be harvested by tag120for its own internal power needs, and also as a wave that tag120can backscatter. Indeed, during interval326, according to block366, tag120does not receive a signal for processing. Instead, according to block376, tag120modulates the CW emitted according to block356, so as to generate backscatter wave126. Concurrently, according to block386, reader110receives backscatter wave126and processes it.

FIG. 4is a block diagram showing a detail of an RFID IC, such as the one shown inFIG. 2. Electrical circuit424inFIG. 4may be formed in an IC of an RFID tag, such as IC224ofFIG. 2. Circuit424has a number of main components that are described in this document. Circuit424may have a number of additional components from what is shown and described, or different components, depending on the exact implementation.

Circuit424includes at least two antenna connections432,433, which are suitable for coupling to one or more antenna segments (not shown inFIG. 4). Antenna connections432,433may be made in any suitable way, such as using pads and so on. In a number of embodiments more than two antenna connections are used, especially in embodiments where more antenna segments are used.

Circuit424includes a section435. Section435may be implemented as shown, for example as a group of nodes for proper routing of signals. In some embodiments, section435may be implemented otherwise, for example to include a receive/transmit switch that can route a signal, and so on.

Circuit424also includes a Rectifier and PMU (Power Management Unit)441. Rectifier and PMU441may be implemented in any way known in the art, for harvesting raw RF energy received via antenna connections432,433. In some embodiments, Rectifier and PMU441may include more than one rectifier.

In operation, an RF wave received via antenna connections432,433is received by Rectifier and PMU441, which in turn generates power for the electrical circuits of IC424. This is true for either or both reader-to-tag (R→T) and tag-to-reader (T→R) sessions, whether or not the received RF wave is modulated.

Circuit424additionally includes a demodulator442. Demodulator442demodulates an RF signal received via antenna connections432,433. Demodulator442may be implemented in any way known in the art, for example including an attenuator stage, an amplifier stage, and so on.

Circuit424further includes a processing block444. Processing block444receives the demodulated signal from demodulator442, and may perform operations. In addition, it may generate an output signal for transmission.

Processing block444may be implemented in any way known in the art. For example, processing block444may include a number of components, such as a processor, memory, a decoder, an encoder, and so on.

Circuit424additionally includes a modulator446. Modulator446modulates an output signal generated by processing block444. The modulated signal is transmitted by driving antenna connections432,433, and therefore driving the load presented by the coupled antenna segment or segments. Modulator446may be implemented in any way known in the art, for example including a driver stage, amplifier stage, and so on.

In one embodiment, demodulator442and modulator446may be combined in a single transceiver circuit. In another embodiment, modulator446may include a backscatter transmitter or an active transmitter. In yet other embodiments, demodulator442and modulator446are part of processing block444.

Circuit424additionally includes a memory450, which stores data452. Memory450is preferably implemented as a Nonvolatile Memory (NVM), which means that data452is retained even when circuit424does not have power, as is frequently the case for a passive RFID tag.

In terms of processing a signal, circuit424operates differently during a R→T session and a T→R session. The different operations are described below, in this case with circuit424representing an IC of an RFID tag.

FIG. 5Ashows version524-A of components of circuit424ofFIG. 4, further modified to emphasize a signal operation during a R→T session (receive mode of operation) during time interval312ofFIG. 3. An RF wave is received by antenna connections432,433; a signal is demodulated by demodulator442; and the demodulated signal is input to processing block444as C_IN. In one embodiment, C_IN may include a received stream of symbols.

Version524-A shows as relatively obscured those components that do not play a part in processing a signal during a R→T session. Indeed, Rectifier and PMU441may be active, but only in converting raw RF power. And modulator446generally does not transmit during a R→T session. Modulator446typically does not interact with the received RF wave significantly, either because switching action in section435ofFIG. 4decouples the modulator446from the RF wave, or by designing modulator446to have a suitable impedance, and so on.

Whereas modulator446is typically inactive during a R→T session, it need not be always the case. For example, during a R→T session, modulator446could be active in other ways. For example, it could be adjusting its own parameters for operation in a future session.

FIG. 5Bshows version524-B of components of circuit424ofFIG. 4, further modified to emphasize a signal operation during a T→R session during time interval326ofFIG. 3. A signal is output from processing block444as C_OUT. In one embodiment, C_OUT may include a stream of symbols for transmission. C_OUT is then modulated by modulator446, and output as an RF wave via antenna connections432,433.

Version524-B shows as relatively obscured those components that do not play a part in processing a signal during a T→R session. Indeed, Rectifier and PMU441may be active, but only in converting raw RF power. And demodulator442generally does not receive during a T→R session. Demodulator442typically does not interact with the transmitted RF wave, either because switching action in section435decouples the demodulator442from the RF wave, or by designing demodulator442to have a suitable impedance, and so on.

Whereas demodulator442is typically inactive during a T→R session, it need not be always the case. For example, during a T→R session, demodulator442could be active in other ways. For example, it could be adjusting its own parameters for operation in a future session.

FIG. 6is a block diagram of a whole RFID reader system600according to embodiments. System600includes a local block610, and optionally remote components670. Local block610and remote components670can be implemented in any number of ways. It will be recognized that reader110ofFIG. 1is the same as local block610, if remote components670are not provided. Alternately, reader110can be implemented instead by system600, of which only the local block610is shown inFIG. 1.

Local block610is responsible for communicating with tags. Local block610includes a block661of an antenna and a driver of the antenna for sending signals to and receiving signals from the tags. Some readers, like that shown in local block610, contain a single antenna and driver. Some contain multiple antennas and drivers and a method to switch signals among them, including sometimes using different antennas for transmitting and for receiving. And some readers contain multiple antennas and drivers that can operate simultaneously. A demodulator/decoder block653demodulates and decodes RF waves received from the tags via antenna block661. Modulator/encoder block654encodes and modulates an RF wave that is to be transmitted to the tags via antenna block661.

Local block610additionally includes an optional local processor656. Processor656may be implemented in any number of ways known in the art. Such ways include, by way of examples and not of limitation, digital and/or analog processors such as microprocessors and digital-signal processors (DSPs); controllers such as microcontrollers; software running in a machine such as a general purpose computer; programmable circuits such as Field Programmable Gate Arrays (FPGAs), Field-Programmable Analog Arrays (FPAAs), Programmable Logic Devices (PLDs), Application Specific Integrated Circuits (ASIC), any combination of one or more of these; and so on. In some cases, some or all of the decoding function in block653, the encoding function in block654, or both, may be performed instead by processor656. In some cases processor656may implement an encryption or authorization function; in some cases one or more of these functions can be distributed among other blocks such as encoding block654, or may be entirely incorporated in another block.

Local block610additionally includes an optional local memory657. Memory657may be implemented in any number of ways known in the art. Such ways include, by way of examples and not of limitation, nonvolatile memories (NVM), read-only memories (ROM), random access memories (RAM), any combination of one or more of these, and so on. These memories can be implemented separately from processor656, or in a single chip with processor656, with or without other components. Memory657, if provided, can store programs for processor656to run, if needed.

In some embodiments, memory657stores data read from tags, or data to be written to tags, such as Electronic Product Codes (EPCs), Tag Identifiers (TIDs) and other data. Memory657can also include reference data that is to be compared to the EPC codes, instructions and/or rules for how to encode commands for the tags, modes for controlling antenna661, and so on. In some of these embodiments, local memory657is provided as a database.

Some components of local block610may treat the data as analog, such as the antenna/driver block661. Other components such as memory657may treat the data as digital. At some point there is a conversion between analog and digital. Based on where this conversion occurs, a whole reader may be characterized as “analog” or “digital”, but most readers contain a mix of analog and digital functionality.

If remote components670are indeed provided, they are coupled to local block610via an electronic communications network680. Network680can be a Local Area Network (LAN), a Metropolitan Area Network (MAN), a Wide Area Network (WAN), a network of networks such as the internet, or a mere local communication link, such as a USB, PCI, and so on. In turn, local block610then includes a local network connection659for communicating with network680. Communications on the network can be secure, such as if they are encrypted or physically protected, or insecure, such as if they are not encrypted or otherwise protected.

There can be one or more remote component(s)670. If more than one, they can be located at the same location, or in different locations. They can access each other and local block610via network680, or via other similar networks, and so on. Accordingly, remote component(s)670can use respective remote network connections. Only one such remote network connection679is shown, which is similar to local network connection659, etc.

Remote component(s)670can also include a remote processor676. Processor676can be made in any way known in the art, such as was described with reference to local processor656. Remote processor676may also implement an encryption function, similar to local processor656.

Remote component(s)670can also include a remote memory677. Memory677can be made in any way known in the art, such as was described with reference to local memory657. Memory677may include a local database, and a different database of a Standards Organization, such as one that can reference EPCs. Remote memory677may also contain information associated with QT command, tag profiles, or the like, similar to local memory657.

Of the above-described elements, it may be advantageous to consider a combination of these components, designated as operational processing block690. Block690includes the following components: local processor656, remote processor676, local network connection659, remote network connection679, and by extension an applicable portion of network680that links remote network connection679with local network connection659. The portion can be dynamically changeable, etc. In addition, block690can receive and decode RF waves received via antenna661, and cause antenna661to transmit RF waves according to what it has processed.

Block690includes either local processor656, or remote processor676, or both. If both are provided, remote processor676can be made such that it operates in a way complementary with that of local processor656. In fact, the two can cooperate. It will be appreciated that block690, as defined this way, is in communication with both local memory657and remote memory677, if both are present.

Accordingly, block690is location agnostic, in that its functions can be implemented either by local processor656, or by remote processor676, or by a combination of both. Some of these functions are preferably implemented by local processor656, and some by remote processor676. Block690accesses local memory657, or remote memory677, or both for storing and/or retrieving data.

Reader system600operates by block690generating communications for RFID tags. These communications are ultimately transmitted by antenna block661, with modulator/encoder block654encoding and modulating the information on an RF wave. Then data is received from the tags via antenna block661, demodulated and decoded by demodulator/decoder block653, and processed by processing block690.

Embodiments of an RFID reader system can be implemented as hardware, software, firmware, or any combination. It is advantageous to consider such a system as subdivided into components or modules. A person skilled in the art will recognize that some of these components or modules can be implemented as hardware, some as software, some as firmware, and some as a combination. An example of such a subdivision is now described, together with the RFID tag as an additional module.

FIG. 7is a block diagram illustrating an overall architecture of an RFID reader system700according to embodiments. It will be appreciated that system700is considered subdivided into modules or components. Each of these modules may be implemented by itself, or in combination with others. In addition, some of them may be present more than once. Other embodiments may be equivalently subdivided into different modules. These modules can be implemented in a variety of ways such as by discrete circuitry, integrated circuits, analog or digital signal processors, FPGAs, microprocessors, databases, interfaces, and so on. It will be recognized that some aspects are parallel with what was described previously.

An RFID tag703is considered here as a module by itself. Tag703conducts a wireless communication706with the remainder, via the air interface705. It is noteworthy that air interface705is really only a boundary, in that signals or data that pass through it are not intended to be transformed from one thing to another. Specifications as to how readers and tags communicate with each other, for example the Gen 2 Specification, also properly characterize that boundary as an interface.

RFID reader system700includes one or more antennas710, and an RF Front End720, for interfacing with antenna(s)710. These can be made as described above.

RFID reader system700also includes a Signal Processing module730. In one embodiment, module730exchanges waveforms with Front End720, such as I and Q waveform pairs.

RFID reader system700also includes a Physical Driver module740, which is also known as Data Link. In one embodiment, module740exchanges bits with module730. Data Link740can be the stage associated with framing of data.

RFID reader system700additionally includes a Media Access Control module750, which is also known as MAC layer. In one embodiment, module750exchanges packets of bits with module740. MAC layer750can make decisions for sharing the medium of wireless communication, which in this case is the air interface.

RFID reader system700moreover includes an Application Programming Library module760. This module can include Application Programming Interfaces (APIs), other objects, etc.

All of these RFID reader system functionalities can be supported by one or more processors. One of these processors can be considered a host processor. Such a host processor might include a Host Operating System (OS) and/or Central Processing Unit (CPU)770. In some embodiments, the processor is not considered as a separate module, but one that includes some of the above-mentioned modules of system700. In some embodiments the one or more processors may perform operations associated with influencing a behavior of a tag based on the tag's public or private profile.

A user interface780may be coupled to library760, for accessing the APIs. User interface780can be manual, automatic, or both. It can be supported by the host processor770mentioned above, or a separate processor, etc.

It will be observed that the modules of RFID reader system700form a chain. Adjacent modules in the chain can be coupled by appropriate instrumentalities for exchanging signals. These instrumentalities include conductors, buses, interfaces, and so on. These instrumentalities can be local, e.g. to connect modules that are physically close to each other, or over a network, for remote communication.

The chain is used in one direction for receiving RFID waveforms and in the other direction for transmitting RFID waveforms. In receiving mode, antenna(s)710receives wireless waves, which are in turn processed successively by the various modules in the chain. Processing can terminate in any one of the modules. In transmitting mode, waveform initiation can be in any one of the modules. Ultimately, signals are routed to antenna(s)710to be transmitted as wireless waves.

The architecture of RFID reader system700is presented for purposes of explanation, and not of limitation. Its particular subdivision into modules need not be followed for creating embodiments. Furthermore, the features of the present disclosure can be performed within a single one of the modules, or by a combination of them.

As mentioned previously, embodiments are directed to RFID readers causing RFID tags to switch between public and private profiles by means of a QT command. Embodiments additionally include programs, and methods of operation of the programs. A program is generally defined as a group of steps or operations leading to a desired result, due to the nature of the elements in the steps and their sequence. A program is usually advantageously implemented as a sequence of steps or operations for a processor, such as the processors described above.

Performing the steps, instructions, or operations of a program requires manipulating physical quantities. Usually, though not necessarily, these quantities may be transferred, combined, compared, and otherwise manipulated or processed according to the steps or instructions, and they may also be stored in a computer-readable medium. These quantities include, for example, electrical, magnetic, and electromagnetic charges or particles, states of matter, and in the more general case can include the states of any physical devices or elements. It is convenient at times, principally for reasons of common usage, to refer to information represented by the states of these quantities as bits, data bits, samples, values, symbols, characters, terms, numbers, or the like. It should be borne in mind, however, that all of these and similar terms are associated with the appropriate physical quantities, and that these terms are merely convenient labels applied to these physical quantities, individually or in groups.

Embodiments furthermore include storage media. Such media, individually or in combination with others, have stored thereon instructions of a program made according to the embodiments. A storage medium according to the embodiments is a computer-readable medium, such as a memory, and is read by a processor of the type mentioned above. If a memory, it can be implemented in a number of ways, such as Read Only Memory (ROM), Random Access Memory (RAM), etc., some of which are volatile and some nonvolatile.

Even though it is said that the program may be stored in a computer-readable medium, it should be clear to a person skilled in the art that it need not be a single memory, or even a single machine. Various portions, modules or features of it may reside in separate memories, or even separate machines. The separate machines may be connected directly, or through a network such as a local access network (LAN) or a global network such as the Internet.

Often, for the sake of convenience only, it is desirable to implement and describe a program as software. The software can be unitary, or thought of in terms of various interconnected distinct software modules.

FIG. 8illustrates how a tag can be switched between public and private profiles and back again, according to embodiments.

Normal RFID inventory operations permit a reader to determine, at least, the identity of a tag in its field-of-view unless the reader specifically and selectively takes action to exclude the tag from the inventorying. This ubiquitous inventory capability has the benefit of allowing a reader to identify all tags in its field of view, but has the disadvantage of permitting anyone to scan a tagged item and then locate it again later, raising privacy concerns and potentially providing useful information to thieves.

As mentioned previously, embodiments are directed to RFID readers with the ability to cause RFID tags to transition between public and private profiles using a QT command, and to tags that adjust their responses to readers depending on their currently exposed profile.

As shown in diagram800, a tag according to some embodiments may be capable of being in one of two profiles: a public profile814and a private profile818. In public profile814the tag may act more carefully because it is in “public” and so it may restrict the information it provides to a reader. In private profile818the tag may act less carefully and provide less restrictive information to the reader because it is in an environment where a rogue or illicit reader is not expected to be operating. In some embodiments the monikers “public” and “private” may simply denote two different profiles in which the tag exposes one set of memory contents in one profile and a different set of memory contents in the other profile. In some embodiments one or both of the profiles may hide the identifier of the item to which the tag is attached. In some embodiments the two profiles may expose totally different memory contents; in other embodiments there may be some overlap of the memory contents. In yet other embodiments that tag may expose more than two profiles.

The tag transitions between profiles in response to QT command(s)812received from a reader. The QT command that causes the transitioning may have fixed parameters and simply cause the tag to “toggle” between profiles, or it may contain variable parameters that tell the tag to perform one or more specific actions like toggling the profile, or it may be two or more different commands altogether. As an example, a QT command with variable parameters may contain a password, an indicator for which profile the tag should choose from a plurality of profiles, and an instruction to store the new profile into nonvolatile memory.

FIG. 9is a diagram900illustrating how a tag physical memory such as the memory shown inFIG. 4can be partitioned and organized to store data.

Tag memory950may be partitioned into banks that include user data in partition952, an identifier for the tag itself (a TID) in partition954, an identifier for the item to which the tag is attached (often an electronic product code—an EPC) in partition956, and information such as passwords that are reserved for the tag itself in partition958. In other embodiments, memory950may be partitioned in other ways with fewer or more partitions, or not partitioned at all. Data may be stored in the memory during tag manufacturing or during an operation by processing block444ofFIG. 4, typically in response to a command received from a reader. Processing block444may also access the stored information.

Information stored in memory950may be used in tag operations such as inventory. For example, EPC partition956can be arranged to store a CRC-16 (cyclic redundancy check) for the EPC, protocol control (PC) information that identifies parameters of the EPC, and the EPC itself. The tag may provide this information to a reader in response to an inventory command or commands.

FIGS. 10A and 10Billustrate example tag memory contents in exemplary private and public profiles.

According to embodiments, an RFID tag may have two or more profiles, each implementing a different memory configuration, in a single IC. An RFID tag employs a single profile and a corresponding single memory configuration at a time. The RFID tag can switch between these profiles, typically when commanded to do so by a reader. For reasons of clarity this detailed description highlights two profiles, labeled “public” and “private”, but more than two profiles and different labeling are possible.FIG. 10Ashows an example memory configuration1010for the private profile. This memory configuration is exemplary, and other memory configurations are possible. When in the private profile a tag employs private memory1010which includes user memory1012, TID memory1014, EPC memory1016, and reserved memory1018. TID memory1014is partitioned into a model number, serial number, and public EPC.

FIG. 10Bshows an example memory configuration1020for the public profile. This memory configuration is exemplary, and other memory configurations are possible. When in the public profile a tag employs public memory1020which includes user memory1022which is not available and therefore unreadable in the public profile, TID memory1024, EPC memory1026, and reserved memory1028. Notice, by comparison with private memory1010, that public memory1020does not expose user memory at all, exposes only the tag model number in TID memory1024, and exposes a public EPC rather than a private EPC in EPC memory1026.

FIG. 11illustrates switching the exposed tag memory from private to public, and vice versa, according to embodiments.

Diagram1100shows the transition between private profile1110and public profile1120, where different portions of tag memory are hidden from or visible to a reader. In the private profile the tag exposes user memory; TID memory containing a tag model number, tag serial number, and a public EPC; and EPC memory containing a private EPC. Diagram1100does not explicitly show reserved memory1018ofFIG. 10Abecause, although reserved memory may be present in the tag, it is typically not exposed for reading by a reader. Portions of private memory1100may be writeable by a reader, such as the public EPC. In some applications a reader writes a value into this public EPC memory location and then “publicizes” the tag using a QT command. Readers are free to encode as little or as much information into this public EPC field as they choose (including no information at all) before publicizing the tag.

One usage model for private and public profiles includes a tag containing a private EPC in private EPC memory that indicates the item to which the tag is attached. At point-of-sale a reader may write sale information, such as a store code or a sale code, into the public EPC location located in TID memory, then issue a QT command to switch the tag's exposed memory profile from private to public. Once switched, the tag conceals its user memory, TID serial number, and private EPC. Instead the tag exposes its public EPC in public EPC memory, remapped from the prior location in TID memory. During inventory, the tag will now send this public EPC to a reader, which may contain the sale code but typically not the EPC of the item to which the tag is attached. Notice that in this example the tag's public memory is a subset of the tag's private memory—the tag remaps its model number and public EPC from the private-state TID memory bank to a model number and public EPC located in the public-state TID and public-state EPC memory banks, respectively. Of course, the public memory need not be a subset of the private memory, but could be totally different, as could the choice of memory locations to transfer from private state to public. Finally, as shown inFIG. 11, in some embodiments the state switching is reversible, allowing the reader to instruct the tag to switch from exposing its private memory back again to exposing its public memory.

FIG. 12is a tag state diagram according to the Gen2 Specification.

Diagram1200illustrates tag states according to the Gen2 Specification. Diagram1200also illustrates commands that transition a tag from one state to another, as well as the corresponding tag replies. Note that diagram1200is a subset of the actual state diagram in the Gen2 Specification, omitting some tag states that are not necessary for an understanding of the present invention. An energized tag enters the state diagram in the Ready state1202. After being inventoried by a reader the tag is in the Acknowledged state1204. If a tag in the Acknowledged state receives a Req_RN command then it may transition to either the Open state1206or the Secured state1208. If the tag's access password is zero then the tag transitions directly from the Acknowledged state to the Secured state. If the tag's access password is non-zero then the tag transitions from the Acknowledged state to the Open state. A tag in the Open state transitions to the Secured state upon receiving a valid access password from a reader. The Open state can be viewed as a gateway to the Secured state for tags that implement access-password-protected security.

A tag in the Secured state1208is allowed to implement some commands and functions that are disallowed in the Open state1206. For example, according to the Gen2 Specification, a tag in the Secured state is allowed to implement a Lock command but a tag in the Open state is not. In a similar vein, the QT command can be allowed from the Secured state but not from the Open state. Of course, it is possible to construct a QT command that is allowed from both the Secured and Open states, or even from other states such as the Acknowledged state, but if a tag is only allowed to implement a QT command from the Secured state, and the tag has a nonzero access password (i.e. the tag implements access-password-protected security), then the tag will only execute the QT command after the reader has sent the proper access password to the tag. By this means the QT command can be password protected in accordance with the Gen2 Specification. Of course, it is possible to construct a QT command that is itself protected by a password, or by another security means, but using the security mechanisms that are an integral part of the Gen2 Specification allows for a simple QT command implementation.

There are other ways to restrict a tag's ability to execute a QT command. For example, a tag could require that a reader be physically close to the tag (for example, within 30 cm of the tag) before executing a QT command. The tag might enforce such a short-range restriction by measuring the power it receives from the reader and only executing a QT command if the RF power level exceeds a threshold. Because one purpose for a QT feature is protecting consumer privacy, restricting QT to nearby readers means that the holder of the tag will be able to see the reader and determine if the operator is a “bad guy” executing the command. Protecting unauthorized readers from executing a QT command by a short-range restriction can be separate from, or in addition to, access-password-protected security. For example, a tag could be designed to only implement the QT command from the Secured state. If the tag has a zero-valued access password and enters the Secured state1208directly from the Acknowledged state1204, the tag could still require that the reader be close to the tag before executing a QT command. If the tag has a nonzero access password and enters the Secured state after receiving the proper access password, the tag could again refuse to execute the QT command unless the reader is close to the tag. Alternatively, the tag could be designed to allow the QT command from the Open state, with or without short-range protection, or even from other states like the Acknowledged state. Furthermore, other protection mechanisms are possible, such as the tag requiring that the reader physically contact the tag before executing the QT command, or the tag requiring a valid “PIN” code before it executes the QT command. These protection mechanisms can be layered on top of each other, or implemented solely, and can be allowed from one or more states of the Gen2 Specification.

As a specific example, assume a tag with a short-range behavior that reduces the tag's sensitivity (i.e. requires a nearby reader) before entering the Open or Secured states. The tag may have normal sensitivity during inventory. However, prior to transitioning from Acknowledged to the Open or Secured states the tag checks the RF power level. If the power level is above the short-range threshold then the tag enters the Open or Secured state. Otherwise, the tag returns to the Ready state. The tag can still be inventoried at long range. However, if the tag is designed to only execute a QT command when in the Secured state, this power check effectively prevents the tag from accepting a QT command at long range. Said another way, a reader is always able to read the tag's currently exposed EPC (public or private, as appropriate for the current profile) at maximum range. However, when the tag's short-range mechanism is enabled, a reader at long range that tries to instruct the tag to enter the Open or Secured state and switch the tag's profile (for example, from public to private to read the tag's user memory) will see the tag drop out of its dialog with the reader and return to the Ready state. The short-range mechanism ensures that protected information in the tag is not readable unless the reader is close to the tag.

In summary, a QT-enabled tag can use physical protection (e.g. short-range), logical protection (e.g. access password), or both to prevent unauthorized access, even while allowing readers to inventory the tag and read its EPC (public or private, as appropriate for the current profile) at maximum range

FIG. 13illustrates an example QT command that a reader might send to a tag. Note that the command1300ofFIG. 13is an example only—a QT command for transitioning an RFID tag between two or more profiles may have a different length and include more or less parameters than the example shown inFIG. 13.

Example QT command1300may be 68 bits long and include a 16-bit command code1302, a read/write bit1303, a persistence bit1304, two RFU bits1305, a 16-bit payload1306, a 16 bit handle1307, and a 16-bit cyclic redundancy check (CRC)1308.

The 16-bit command code1302tells a tag that the incoming command is a QT command. The read/write bit1303indicates whether a reader wants to read QT control data from the tag or write QT control data to the tag. Read/write=0 means read; read/write=1 means write. If read/write=1 then persistence bit1304tells the tag whether to write QT control data to volatile or nonvolatile memory. Persistence=0 means volatile memory; persistence=1 means nonvolatile memory.

Persistence bit1304offers an additional security mechanism. Consider an authorized reader that wants to temporarily switch a tag from the public state to private, for example to read from user memory, but then inadvertently leaves the tag in the private state. The tag could later compromise its private data. To prevent such a security breach, the persistence bit1304ofFIG. 13allows a reader to temporarily switch the tag's state, but to store the information about the state change in volatile memory. When the tag loses power this volatile memory bit will “forget” its setting and the tag will automatically revert to its public profile.

RFU field1305is ignored by the tag. RFU stands for “reserved for future use” and provides for command extensibility for the future. Payload1306carries control data for the QT functionality. A tag ignores these bits when read/write=0 (i.e. read), but implements them when read/write=1 (i.e. write). These bits tell a tag whether to use the short-range security mechanism discussed above, whether the tag should be in the public profile or the private profile, and allows other QT functionality that might be required. RN (random number)1307contains a handle that a reader uses to indicate which tag it is communicating with. In some embodiments a tag ignores the command if the handle indicates that the reader is communicating with a different tag. Finally, CRC1308contains a CRC that a tag uses to ensure that the QT command has not undergone bit errors during transmission.

FIGS. 14A and 14Billustrate example tag responses to a QT command.FIG. 14Ashows an example response to a QT command with read/write=0 (read).FIG. 14Bshows an example response to a QT command with read/write=1 (write).

The tag response1400inFIG. 14Ato a QT read command may include a header bit1402whose value is set to zero, 16-bit data1403that tells the reader the tag's current QT control data, a 16-bit RN1404which is the handle that the reader sent to the tag, and 16-bit CRC1405to ensure that the tag's reply has not undergone bit errors during transmission.

The tag response1410inFIG. 14Bto a QT write command may include a header bit1412whose value is set to zero, a 16-bit RN1413which is the handle that the reader sent to the tag, and 16-bit CRC1414to ensure that the tag's reply has not undergone bit errors during transmission. A reader should not presume that a tag has properly executed a QT Write command until and unless it receives the response shown inFIG. 14B.

Embodiments also include methods. Some are methods of operation of an RFID reader or an RFID reader system. Others are methods for controlling an RFID reader or an RFID reader system. Yet others are methods for controlling one or more RFID tags. These methods can be implemented in any number of ways, including the ways described in this document. One such way is by machine operations, of devices of the type described in this document.

Another optional way of implementing these methods is for one or more of the individual operations of the methods to be performed in conjunction with one or more human operators performing some of them. These operators need not be collocated with each other, but each can be with a machine that performs a portion of a program or operation.

FIG. 15Ais a flowchart for a process of an RFID reader controlling an RFID tag's behavior via a QT write command according to embodiments.

Process1500begins at operation1510, in which a reader transmits a QT write command to a tag. The QT command may instruct the tag to transition from a public profile to a private profile, or vice versa. At optional operation1520the reader may receive a confirmation from the tag indicating that the tag has successfully performed the transition. This confirmation may be the tag response ofFIG. 14B.

FIG. 15Bis a flowchart for a process of an RFID reader inventorying an RFID tag that implements public and private profiles according to embodiments.

Process1550begins at operation1560, in which a reader inventories a tag that implements public and private profiles. The tag's response to the inventory process is determined by the tag's profile at decision operation1570. If the tag is in the private profile, it replies to the reader at operation1580with its private EPC. If the tag is in the public profile, it replies to the reader at operation1590with its public EPC.

The operations described in processes1500and1550are for illustration purposes only. A reader according to embodiments may cause a tag to transition between private and public profiles using a QT command employing additional or fewer operations, or the reader may choose to read the tag's QT profile information rather than writing the tag profile information, or the reader may implement or be required by the tag to implement one or more security operations such as a password exchange or moving to short range, or the commands may occur in different orders, or there may be more than two profiles, or other differences or enhancements in the commands or replies or ordering, using the principles described herein.

The above-described QT features can be implemented by a so-called utility of an RFID system. For example, a utility can include one or more of the above-described components, operational processing blocks, an article of manufacture, etc. The invention further provides interfacing, to expose a functionality of this utility to an agent, as is described in more detail below.

FIG. 16is a block diagram illustrating an architecture1600for an interface converter according to embodiments. Architecture1600includes a utility1640, which is a mechanism for performing some or all of the reader and tag features described above. More particularly, utility1640may cause a tag to switch between public and private profiles thereby influencing the information the tag transmits to a querying reader.

Architecture1600additionally includes an interface converter1650and an agent1660. Embodiments also include methods of operation of interface converter1650. Interface converter1650enables agent1660to control utility1640. Interface converter1650is so named because it performs a conversion, a change, as will be described in more detail below. Agent1660, interface converter1650, and utility1640can be implemented in any way known in the art. For example, each can be implemented in hardware, middleware, firmware, software, or any combination thereof. In some embodiments, agent1660is a human.

Between agent1660, interface converter1650, and utility1640there are respective boundaries1655,1645. Boundaries1655,1645are properly called interfaces, in that they are pure boundaries, as is the above described air interface.

In addition, it is a sometimes informal usage to call the space between boundaries1655and1645, which includes interface converter1650, an “interface”1656. Further, it is common to designate this space with a double arrow as shown, with an understanding that operations take place within the arrow. Although “interface”1656is located at a boundary between agent1660and utility1640, it is not itself a pure boundary. Regardless, the usage of the term “interface” is so common for interface converter1650that this document sometimes also refers to it as an interface. It is clear that embodiments of such an “interface”1656can be included in this invention, if they include an interface converter that converts or alters one type of transmission or data to another, as will be seen below.

Agent1660can be one or more layers in an architecture. For example, agent1660can be something that a programmer programs to. In alternative embodiments, where agent1660is a human, interface converter1650can include a screen, a keyboard, etc. An example is now described.

FIG. 17is a sample screenshot1750of an interface converter, such as the interface converter ofFIG. 16. Screenshot1750can be that of a computer screen for a human agent, according to an embodiment. What is displayed in screenshot1750exposes the functionality of a utility, such as utility1640. Inputs by the user via a keyboard, a mouse, etc., can ultimately control utility1640. Accordingly, such inputs are received in the context of screenshot1750. These inputs are determined from what is needed for controlling and operating utility1640. An advantage of such interfacing is that agent1660can prepare RFID applications at a higher level, without needing to know how to control lower level RFID operations. Such lower level RFID operations can be as described in the Gen 2 Spec, in other lower level protocols, etc. Utility1640can be controlled in any number of ways. Some such ways are now described.

Returning toFIG. 16, one way interface converter1650can be implemented is as a software Application Programming Interface (API). This API can control or provide inputs to an underlying software library, and so on.

Communications can be made between agent1660, interface converter1650, and utility1640. Such communications can be as input or can be converted, using appropriate protocols, etc. What is communicated can encode commands, data, etc. Such communications can include any one or a combination of the following: a high-down communication HDNT from agent1660to interface converter1650; a low-down communication LDNT from interface converter1650to utility1640; a low-up communication LUPT from utility1640to interface converter1650; and a high-up communication HUPT from interface converter1650to agent1660. These communications can be spontaneous, or in response to another communication, or in response to an input or an interrupt, etc.

Commands are more usually included in communications HDNT and LDNT, for ultimately controlling utility1640. Controlling can be in a number of manners. One such manner can be to install utility1640, or just a feature of it. Such installing can be by spawning, downloading, etc. Other such manners can be to configure, enable, disable, or operate utility1640, or just a feature of it. These commands can be standalone, or can carry parameters, such as data, confidential information, etc. In some embodiments interface converter1650can convert these commands to a format suitable for utility1640.

Data are more usually included in communications HUPT and LUPT. The data can inform as to success or failure of executing an operation. The data can also include tag data, which can be both codes read from tags (including confidential information) and data about reading from or writing to tags (such as time stamps, confirmation replies, etc.). In some embodiments interface converter1650can convert the data to a format suitable for agent1660, including in some cases aggregating, filtering, merging, or otherwise altering the format or utility of the data.

It should be noted that what passes across a single pure boundary is unchanged (by the mere definition of what is a pure boundary). But what passes through interface converter1650can be changed or not. More particularly, high-down communication HDNT can be being encoded similarly to, or differently from, low-down communication LDNT. In addition, low-up communication LUPT can be encoded similarly to, or differently from, high-up communication HUPT. When different, the difference can be attributed to interface converter1650, which performs a suitable change, or conversion, of one communication to another. The change, or conversion, performed by interface converter1650is for exposing the functionality of utility1640to agent1660, and vice versa. In some embodiments, a command is converted, but a parameter is passed along without being converted. Plus, what is not converted at one module may be converted at another. Such modules taken together can also form an interface converter according to embodiments.

Agent1660, interface converter1650, and utility1640can be implemented as part of a reader, or in a different device, or distributed across devices such as an RFID system.FIG. 18shows a diagram1800of an RFID system where agent1660, interface converter1650, and utility1640can be implemented as reader modules and a tag. Diagram1800shows a correspondence for how the components ofFIG. 16can be implemented by those ofFIG. 7, in embodiments where the interface converter is implemented within the RFID system.

The foregoing detailed description has set forth various embodiments of the devices and/or processes via the use of block diagrams and/or examples. Insofar as such block diagrams and/or examples contain one or more functions and/or aspects, it will be understood by those within the art that each function and/or aspect within such block diagrams or examples (e.g. tags and readers according to embodiments) may be implemented individually and/or collectively by a wide range of hardware, software, firmware, or virtually any combination thereof. Those skilled in the art will recognize that some aspects of the RFID tag embodiments disclosed herein, in whole or in part, may be equivalently implemented employing integrated circuits, as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g. as one or more programs running on one or more microprocessors), as firmware, or as virtually any combination thereof, and that designing the circuitry and/or writing the code for the software and or firmware would be well within the means of one of skill in the art in light of this disclosure.