0018-9162/03/$17.00 © 2003 IEEE
2
Computer
Penny Tag Technologies
for Removable
Data Storage
M anufacturers commonly use tags or
markers to authenticate and identify
commercial products. Some typical
applications for authenticating a prod-
uct’s source include visual holograms
on software packaging, fluorescent spectrally
encoded fibers in a garment’s brand label, and hid-
den microscopic brand marking of aerospace parts.
Applications that identify products, either indi-
vidually or within a class, are most ubiquitous in
retail and warehouse logistics. Retailers, manufac-
turers, and distributors spend more than $10 bil-
lion per year to purchase bar codes and their
associated systems for use in tracking countless bil-
lions of dollars in merchandise. These low-cost
structured ink markings allow for quick and reli-
able product identification within a virtually unlim-
ited inventory system. Radio frequency (RF) coil
tags are another product identification technology
used to reduce retail theft. In this case, sensors can
detect the tags if they were not deactivated when
the merchandise was purchased.
Authentication and identification technologies
have also found applications in removable data
storage. For example, cartridge identification sys-
tems can protect a drive from damage that inserting
a foreign object might cause. They can also help
manage forward and backward media format com-
patibility; let drives identify media types for reduced
spin-up and data-access time; and create unique,
unalterable, and authenticatable media serial num-
ber implementations for digital rights management
(DRM) and enterprise security. One beneficial
implementation of the technology is its use to
authenticate parts and prevent counterfeiting in var-
ious industries.
The primary difference between retail and
removable data storage applications is cost con-
straints. The applications for retail settings require
human intervention or instrumentation costing
hundreds, if not thousands, of dollars. However,
the authentication and identification of removable
data storage cartridges must be automated at a very
low cost.
The Massachusetts Institute of Technology
Media Lab has dubbed these low-cost authentica-
tion and identification technologies penny tags.
MIT’s ongoing program to explore and develop
penny tag applications and technology has evolved
into the Auto-ID Center (www.autoidcenter.org),
which focuses on establishing a low-cost RF ID tag
standard.
FIELD-PROVEN TAG TECHNOLOGIES
The varying requirements of specific systems have
driven the progression of Iomega’s penny-tag tech-
nologies, described in the “Evolution of Iomega
Removable Storage Products” sidebar. These tech-
nologies have different features, depending on the
requirements of a particular storage system.
Media unique serialization
High-capacity magnetic removable data storage
typically involves a factory servo write process and
a factory media verification process. These manu-
facturing processes can write a unique serial num-
Low-cost authentication and identification methods for removable data
storage cartridges are the focus of ongoing research. Unlike other security
methods, these “penny tag” technologies must be automated for use in a
removable data storage drive.
Fred Thomas
Iomega
C O V E R F E A T U R E
Published by the IEEE Computer Society
ber to the media in an area that is not rewriteable
by drives in the field, such as in areas for grey codes
and flagged sectors.
Iomega has applied these unique serial numbers
to all its removable magnetic media products dat-
ing back to the Bernoulli boxes of the 1980s.
Retroreflective tags
A retroreflective tag (retrotag) produces a struc-
tured or patterned reflection of light from the
removable data storage cartridge that disk drives
can uniquely discriminate from other types of
reflections. The “Patents for Removable Data
Storage Tag Technologies” sidebar provides addi-
tional information about patents on this and other
related technologies. The Iomega retrotag used on
Zip and Jaz cartridges has an array of corner
cubes molded into a clear, optical plastic tag. This
tag is similar to a roadside retroreflective safety
marker.
July 2003
3
The evolution of building cartridge identification and authen-
tication into a removable data storage drive at Iomega illus-
trates the varied requirements of this technology.
Initially, when Iomega’s researchers created the Zip 100
(super floppy), they felt that the drive needed a means other
than the cartridge’s physical size to discriminate between a func-
tional Zip disk and a foreign object. This was mainly because
the 3.5-inch floppy fit into the Zip drive media opening. A
floppy could, upon insertion, cause the drive to launch its read-
write heads onto the foreign object and destroy the drive.
Hence, the retroreflective tag (retrotag) was introduced and is
used on the Zip 100, Jaz 1 Gbyte, and Jaz 2 Gbyte
products.
The evolution of the Zip 250 and Pocket Zip (Clikl! 40
Mbyte) produced two new sets of requirements. The Zip 250
drive reduced data track size and differing data and servo fre-
quencies from the original Zip 100. Economics and the desire
to have Zip 100 media compatible with the new 250 drove the
decision to make it the same size and shape as the Zip 100 car-
tridge. However, inserting a Zip 250 cartridge into a Zip 100
drive would potentially destroy the drive. A technology that
would cause the Zip 250 cartridge to be ejected automatically
upon insertion into a Zip 100 drive was ultimately necessary.
This new tag system also needed to allow for Zip 100 inser-
tion into a Zip 250 drive and appropriate detection and access
to the previous generation cartridge.
Iomega needed to retain its foreign-object protection func-
tionality and, if possible, the ability to identify multiple types
of the new tag. This capability would be advantageous for
future cartridge backward and forward compatibility man-
agement scenarios.
The Pocket Zip 40-Mbyte drive’s small size and the reduced
working distances between the cartridge and any identification
system in the drive made the Zip 100 retrotag discrimination
physics unworkable. This product also needed to support the
licensed distribution of music content directly from recording
houses to consumers’ handheld play devices. This made authen-
tication of the media’s source part of the new technology
requirements.
These requirements in aggregate drove the development of
two parallel path tag technologies: the latent-irradiance-tag
and the holographic-tag (X-LSD). The ability of both tech-
nologies to support identification of multiple authenticatable
tag types opens the path for implementing various specialty
media types such as cleaning disks, computer access authenti-
cation disks, drive-calibration disks, and restricted drive
firmware upgrade paths.
The need for a technology that would offer an unalterable
media serial number source for robust DRM implementations
also fueled the development of the laser-marking technology or
disk indelible utility mark (DIUM) for the Pocket Zip. Most
recently, work on robust DRM and enterprise security imple-
mentations has focused on means for including source-protected
cryptographic keys within the removable data storage cartridge.
To this end, the Peerless cartridge includes a smart card-directed
secure memory with cryptographic authentication IC in its
design. This seems to be a good direction for removable media,
which has a native electrical interface with the drive platform.
Evolution of Iomega Removable Storage Products
Patents for Removable Data Storage Tag Technologies
The patents issued for retroreflective tags (retrotags) and other iden-
tification and authentication technologies for removable data storage
include the following:
• F. Thomas, Retroreflective Marker for Data Storage Cartridge, US
patent 5,638,228, Patent and Trademark Office, Washington, D.C.,
1997.
• F. Thomas, Thin Retroreflective Marker for Data Storage Cartridge,
US patent 5,986,838, Patent and Trademark Office, Washington,
D.C., 1999.
• F. Thomas and G. Dixon, Latent Illuminance Discrimination
Marker System for Authenticating Articles, US patent 6,264,107
B1, Patent and Trademark Office, Washington, D.C., 2001.
• F. Thomas, Readable Indelible Mark on Storage Media, US patent
6,324,026 B1, Patent and Trademark Office, Washington, D.C.,
2001.
4
Computer
Figure 1 illustrates retroreflection in contrast
with the two other principal types of reflection from
objects that might be inserted into a drive: specu-
lar and diffuse. Retroreflection is principally light
reflected back at the source of the illuminating radi-
ation. This property clearly defines the reflection’s
location, and its magnitude at that location is large
relative to what equivalently sized diffuse or spec-
ular reflectors would provide.
Another retrotag characteristic is that the illu-
mination and detection system’s location relative
to the tag is flexible. In Iomega drive implementa-
tions, a proximate LED and phototransistor/pho-
todiode pair are positioned on the drive printed cir-
cuit board (PCB) below the retrotag location on the
cartridge when the cartridge is fully in the drive.
As long as a significant portion of the LED irra-
diance is hitting the tag and the emitter/detector
pair is within approximately a 40-degree cone of
the tag’s centroid, the system works well as a reflec-
tion-type discriminator. This latitude in locating the
detection system provides flexibility in designing
future compatible drive platforms. It also allows a
generous tolerance of the retrotag’s alignment to
the detection system during manufacture.
The images in Figure 2 illustrate a bug’s eye view
of the reflection from a Zip retrotag from the loca-
tion where the LED is illuminating the tag in the
drive. A laser beam profiling software program and
a frame-grabber system based on a charge-coupled
device were used to generate these images.
The superposition of the array of 12 corner cubes
found on the tag creates the reflection’s hexagonal
structure. The hexagonal reflection’s size at the short
working distances used in drive implementations is
principally twice the diagonal size of the corner cubes.
To take advantage of this bright structured reflec-
tion, the detection device (phototransistor or pho-
todiode) must be proximal to the LED, which is
located at the hexagonal reflection’s center.
Therefore, the corner cubes’ size must be physically
matched to the separation distance on the PCB
between the emitter and detector the system uses.
In Figure 2, this distance is approximately 2.5 mm.
Figure 2 shows that the reflections from a retro-
tag are essentially localized to a small hexagonal
area. Based on this reflective localization, we can
create an even more effective discrimination sys-
tem by adding a second photodetector positioned
slightly outside this reflective lobe and using the dif-
ference between the signal inside the lobe and out-
side the lobe as the retrotag discrimination signal.
In fact, for the most difficult possible reflective
sources that this system is intended to discrimi-
nate—specular reflectors such as metal foil or a pol-
ished shutter on a 3.5-inch floppy disk—this system
enhancement improves performance significantly.
Figure 3a shows a contour plot for probability of
discrimination of a specular reflector from a retro-
tag for the original single-detector system, and
Figure 3b shows a contour plot for the differential
dual-detector system. A Monte Carlo analysis sys-
tem model generated these plots, which include
empirical data on the reflective variability of the two
different types of reflective markers among 20 other
system variables with their distributions modeled.
The white sloping bands in Figures 3a and 3b
Specular (mirrorlike)
Diffuse
Retroreflection
(b)
(c)
(a)
Figure 1. Principal types of reflection contrasted: (a) specular (mirrorlike),
(b) diffuse, and (c) retroflection.
Figure 2. Reflective irradiance pattern of Zip 100 retrotag. The reflected
irradiance in the structure is brightest in the hexagon’s lobes where the photo-
sensitive detector is placed.
denote the region of 100-percent specular reflec-
tive foreign-object discrimination as a function of
the system’s photodetector gain (y) and the retrotag
detection threshold voltage (x). These figures
demonstrate that adding a $0.20 phototransistor
to the design can broaden the 100-percent dis-
crimination band by more than 60-fold.
Holographic tags
The large geometric size (2.5 mm) of the corner
cubes used for reflection with the retrotag creates
a structured irradiance pattern around the illumi-
nating source LED. Holographic-tag technology
does principally the same thing but with signifi-
cantly more flexibility in the geometry of the struc-
tured, reflected light pattern. This follow-on
invention uses the combination of a tiny retrore-
flective array material (150 microns across corner
cubes) with a refractive holographic light shaping
diffuser (LSD) material. Laminating these plastic
film materials together creates a reflector, which in
turn creates an assortment of structured light pat-
terns upon reflection.
Figure 4 shows the reflected irradiance pattern that
an X Light Shaping Diffuser (X-LSD), a holographic
tag used on data storage cartridges, generates. The
point at which the axes cross is the illuminating
LED’s location. To use the X-LSD for tag identifica-
tion, three phototransistors are placed on the drive
PCB on three axes separated by 45 degrees around
the LED. The tag-cartridge identification is based on
reflective illumination of the phototransistors. In this
case, in which the tag has three photodetectors, the
system can detect eight separate states.
Latent-irradiance tags
Latent-irradiant materials—more commonly
described as fluorescent and phosphorescent—glow
after being irradiated with light. The characteristic
that distinguishes between fluorescent and phos-
phorescent materials is that the time period of light
re-emission is longer than 10–8 seconds for phos-
phorescent materials and shorter for fluorescent
materials.
The output spectra of different latent-irradiance
materials have a distinguishing amplitude profile
when illuminated with light having color within their
absorption bands. Stokes materials irradiate at wave-
lengths longer than the stimulating irradiance, and
anti-Stokes materials irradiate at shorter wavelengths.
Researchers have historically used the differen-
tiation in spectral profiles of various latent-irradi-
ance materials for authentication. For example, the
fluorescent fibers in a $100 bill glow red when they
are irradiated with a UV source. A respected British
scientist working in this area once told me that MI5
secret agents (made famous by the fictional agent
007, James Bond) wore phosphorescent authenti-
cation rings during World War II. In these cases,
July 2003
5
Figure 4. Reflected irradiance pattern for X-LSD
holographic cartridge tag. The point at which the axes
cross is the illuminating LED’s location.
Figure 3. (a) Single-detector cartridge discrimination performance (retrotag ver-
sus specular reflector). (b) Dual-detector cartridge discrimination performance
(retrotag versus specular reflector).
0
1
2
3
4
5
Detection threshold voltage (volts)
(b)
0
1
2
3
4
5
Detection threshold voltage (volts)
(a)
1
2
3
4
On-axis gain (volts/amp × 105)1
2
3
4
On-axis gain (volts/amp × 105)10
20
30
40
50
60
70
80
90
100
100
100
100
10-90
6
Computer
authentication requires using either simple visual
ID of a color or an elaborate and expensive photo-
spectral analysis instrument.
In Iomega’s patented technology for reducing the
cost of a drive-automatable ID and authentication
system, a single photodetector acquires a combi-
nation of spectral and temporal information from
a latent-irradiance tag. After illuminating the tag
with an LED within the tag’s absorption band, a
photodectector with a low-cost, dye-based poly-
mer filter can monitor both the decay time and the
temporal profile of the latent irradiance that the tag
emits.
Blending combinations or matrices of different
phosphor components can create multiple decay
profiles, much like combining discrete frequencies
in a Fourier series can describe any arbitrary piece-
wise temporal function. Figure 5 illustrates the typ-
ical exponential temporal decay profile of a single
constituent phosphor component used to create
such a matrixed latent-irradiance material. This
temporal information is extracted from the data
storage drive’s microprocessor to identify and
authenticate different tags types.
Security phosphors are a class of latent irradi-
ance materials typically used for authentication
on currency and other financial instruments.
Developers can engineer these latent-irradiance
materials so that they present a significant reverse-
engineering hurdle to those trying to replicate their
spectral and temporal response.
Generally, a phosphor matrix’s response is fab-
rication-process dependent, so that constituent
analysis only partially discloses information. In
addition, numerous masking and obfuscating meth-
ods can further thwart reverse-engineering efforts,
making this a robust means of authentication. A
potential future application that leverages this secu-
rity feature is to use a drive’s read-write laser as the
excitation source for DRM protection of content
on optical data storage media.
Laser-marked media
The disk indelible utility mark (DIUM) is a laser-
marking system that ablates a microscopic bar code
into the media’s magnetic recording layer. In one
sense, this is a high-tech cattle brand for media.
Figure 6 shows a magnified image of a DIUM on a
piece of flexible magnetic data storage media. Four
copies of the same code, which is several data tracks
wide, are ablated for redundancy at the disk’s inner
diameter.
This technology creates an unalterable media ser-
ial number that a drive’s magnetic head can read,
but the drive cannot replicate it with a magnetic
write operation. Because the mark, or code, is
ablated into the media, overwriting it with a mag-
netic tone does not erase it. In practice, the drive
firmware implementation of a DIUM-read consti-
tutes an AC overwrite of the mark to ensure that
the encode data is ablated and genuine.
The amortized costs of this technology for a
removable data storage cartridge can be as low as
one cent per disk. Analogous implementations for
optical phase change media are also possible.
Solid-state secure memory devices
The Iomega Peerless cartridge has a built-in
secure memory device that contains 192 bytes of
memory.1 Selectable portions of this memory are
fusible at the factory, providing absolute in-the-field
inalterability of those locations. Access to this
memory requires the drive’s firmware to engage in
a cryptographic challenge-and-response protocol
that unlocks the device’s secret key.
The secure memory device was developed for
financial transaction security in smart card appli-
cations such as cash-resident debit cards. Peerless
drives leverage the SMD’s unalterable feature to
provide a trusted source for the DRM media serial
number. All Peerless drives support commands for
query and return of this unique cartridge-resident
media serial number.
Figure 6. A disk indelible utility mark on Pocket Zip flexible media. DIUM creates
an unalterable media serial number that a drive’s magnetic head can read but not
replicate.
Time (µsec)
Intensity (volts)4.0V
3.6V (90%)
0.4V (10%)
t0
t1
t2
t = t1 – t2
t0 flood LED turned off
Figure 5. Typical temporal signal profile of a latent-irradiance material. The
detection circuitry for this signal can implement automatic gain control (AGC)
techniques. These implementations provide a significant level of system
measurement robustness with varying signal amplitude.
Any removable data storage drive that incorpo-
rates an SMD also can leverage this digital and
physical information safe by storing an assortment
of security information in it. These codes enable
many interesting data security applications includ-
ing robust DRM support. This SMD-embedded
information would include a series of crypto-
graphic keys and sequences as well as the cartridge’s
unique media serial number.
SMD-embedded codes offer an asymmetric,2 or
public-private encryption, technology that imple-
ments a secure-pipe delivery of the media serial
number to host PC DRM applications. In a secure
pipe, the media serial number is provided to the
DRM software application on the drive-attached
host PC in an encrypted string so that it is resilient
to attacks from software shims and emulators.
Content providers in the music, video, and pub-
lishing industries can use this technology to
robustly tie their content to an individual remov-
able data storage cartridge.
A cartridge-supported application of this tech-
nology stores a subset of public-key hashes on the
SMD to facilitate cryptographic drive authentica-
tion of software and hardware querying devices. To
support enterprise-centric data-security solutions,
a second portion of the secure memory device can
store encryption keys. This implementation specif-
ically addresses concerns about employees who are
intent on removing proprietary digital content. It
maintains the flexibility and transportability of data
within the enterprise that removable data storage
cartridge technology inherently provides.
Although SMD offers significant flexibility and
utility, the system architecture requires direct elec-
trical connectivity to the removable data storage
cartridge with the drive.
RELATIVE IMPLEMENTATION COSTS
Depending on the cost, technical, and market
requirements of a particular removable data stor-
age system, one system might prove more com-
pelling than another. For these systems, it is not
enough to have a low-cost tag technology; the
drive-based automated detection system must be
low cost as well.
Table 1 summarizes the approximate costs for
implementing these penny tag systems on a remov-
able data storage cartridge as well as in the mating
drive. The detection cost listed for latent-irradiance
tags assumes that a drive microprocessor is avail-
able with access to a multiplexed analog-to-digital
converter. The fourth column in the table is anno-
tated with six abbreviations that summarize the
principal obstacles of tag forgery and, hence, com-
promise of the tag system’s authentication attrib-
utes. The last column places an order of magnitude
estimate on the number of identifiable different
states that the tag technology and detection system
can support. The infinity symbol means at least tens
if not hundreds of bits.
I omega has developed a cadre of low-cost penny
tag technologies with associated low-cost auto-
mated detection systems for removable data
storage cartridge identification and authentication.
In particular, the latent-irradiance technique
remains under most active development at Iomega.
Patents issued to Iomega on the temporal signal
discrimination techniques for latent-irradiance sig-
nals make licensing this technology to third parties
for other applications a possible future direction for
this work. Potential applications include authenti-
cation or identification of items such as optical data
storage media, aerospace or nuclear facility fasten-
ers, factory authorized auto parts, critical con-
struction components, and financial and business
instruments such as checks and credits cards.
Field-operable detection devices for applications
without leverageable in situ electronics, such as a
disk drive, can be manufactured in low volumes at
July 2003
7
Table 1. Relative cartridge penny tag costs.
Technology
Tag cost ($)
Detection cost ($)
Authentication means
ID states
Written media serial no.
0.00
0.00
Low
∞
Retrotag
0.03
0.75
IP
1 bit
Holographic tag (X-LSD)
0.10
1.00
IP, CI, RE
3+ bits
Latent-irradiance tag
0.07
1.00
IP, CI, SRE
4+ bits
Laser mark (DIUM)
0.01
0.00
IP, CI
∞
Smart-card IC (SMD)
0.40
0.20 to 2.00
Encrypt
∞
Abbreviations: IP: intellectual property; CI: capital investment; RE: reverse engineering; SRE: significant reverse engineering;
Encrypt: encryption and other protected secret methods.
8
Computer
costs comparable to a volt-ohm meter ($20-$100).
With high volume production, such devices could
reasonably cost less than $10. The actual cost would
depend on the desired level of sophistication.
The higher cost of detection presently precludes
using powerless RF tags in removable data storage
cartridges, except in automated cartridge reposi-
tory management for enterprise and government
applications where information security and
accountability are at a premium.
Using security technologies always invokes the
issue of raising the bar relative to attack and com-
promise. Implementing a variety of such means in
tandem further raises that bar. A good example is
the implementation of more than 30 authentication
features for higher denominations of US currency.
Many believe that tag technologies provide inno-
vative physical identification and authentication
methods that have a high associated overall secu-
rity-to-cost quotient. The current use of these tech-
nologies in more than 350 million data storage
cartridges confirms their field worthiness. ■
Acknowledgments
I thank my Iomega colleagues who read the draft
of this article and made several useful comments and
contributions, especially Dave Griffith, Dave Hall,
Todd Shelton, and Tom Wilke. Iomega presently has
patents issued or pending on all the removable data
storage cartridge penny tag approaches described in
this article.
References
1. F. Thomas, “Peerless DRM & Enterprise Security-
Enabled Removable Data Storage Cartridges (A Dis-
cussion of Security Issues and Architectures for
Removable Data Storage),” Proc. RSA E-Security
Conf. 2002, RSA Security, 2002, www.rsaconference.
net/RSApresentations/pdfs/newthu1015_thomas.pdf.
2. B. Schneier, Applied Cryptography, 2nd ed., John
Wiley & Sons, 1996, pp. 21-46.
Fred Thomas is chief technologist in the Advanced
R&D Group at Iomega Corporation. He received
an MS in mechanical engineering from Bucknell
University. He holds 30 US patents. Thomas’s
research interests include developing technologies
that make magnetic recording in removable car-
tridge implementations more robust, novel optical
data storage techniques, low-cost sensors, and dig-
ital information security technologies and their
implementation. He is a member of SPIE and
ASME. Contact him at thomasf@iomega.com.