Secure transmission of local private encoding data

• US 10,003,577 B2
• Filed: 02/02/2016
• Issued: 06/19/2018
• Est. Priority Date: 12/16/2015
• Status: Active Grant

• Current Assignee: Materna Virtual Solution GmbH
• Original Assignee: Virtual Solution AG
• Inventors: Jakobi, Thomas, Hausen, Doris, Schmidberger, Frank
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US15/013,322
• Publication Number:
  US 20170180326A1
• Time in Patent Office: 868 Days
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/43 using shared identity modules, e.g. SIM sharing
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

A method of secure transfer of local private encoding data between a first communication device and a second communication device, the first communication device and the second communication device being operable to communicate with each other via a communication connection there between, a respectively adapted first communication device, a respectively adapted second communication device, a system comprising such first and second communication devices and also a computer program product for carrying out the above method.

Claims

1. A method of secure transfer of local private encoding data between a first communication device having a first interface unit and a second communication device having a second interface unit, the first communication device and the second communication device being configured to communicate with each other via a communication connection there between, the method comprising:

providing secure access information by the second communication device;

transmitting the secure access information from the second communication device to the first communication device via a first secure communication path, the first secure communication path comprising the second interface unit and the first interface unit and being physically and/or logically separated from the communication connection, wherein the transmitting comprises;

displaying or sending, by the second interface unit, of the secure access information; and

acquiring or receiving, by the first interface unit, of the secure access information;

establishing, based on the secure access information, a secure communication link between the first communication device and the second communication device on the communication connection between the first communication device and the second communication device; and

transferring the local private encoding data via the secure communication link on the communication channel between the first communication device and the second communication device.

2. A method according to claim 1,

wherein the first communication device has the local private encoding data, wherein the transferring of the local private encoding data is from the first communication device to the second communication device, the method further comprising:

storing the received local private encoding data at the second communication device.

3. A method according to claim 1, wherein the second communication device has the local private encoding data, wherein the transferring the local private encoding data is from the second communication device to the first communication device, the method further comprising:

storing the received local private encoding data at the first communication device.

4. A method according to claim 1, further comprising:

verifying the secure communication link via a second secure communication path.

5. A method according to claim 1, wherein the local private encoding data includes one of the following:

a public encoding key, a private encoding key, a public encoding key certificate, a symmetric encoding key, a symmetric HMAC key.

6. A method according to claim 1, wherein the secure access information includes one of the following:

a public encoding key, an IP address of the other communication device, a physical access interface, a UDP port of the second communication device, a Bluetooth device ID of the second communication device, a displayable code.

7. A method according to claim 1, wherein the second interface unit comprises a display unit of the second communication device, wherein the first secure communication path comprises the display unit and wherein the transmitting comprises displaying, by the display unit, of the secure access information.

8. A method according to claim 1, wherein the first interface unit comprises an input unit or an image/video camera and wherein the transmitting comprises acquiring the secure access information.

9. A method according to claim 1, wherein the secure communication link comprises one of the following:

a TCP connection, a TLS connection.

10. A communication device, comprising:

a first communication interface configured to communicate with another communication device via a communication connection;

a processor configured to;

receive or acquire, via a first interface unit and a first secure communication path being physically and/or logically separated from the communication connection, secure access information provided by the other communication device;

establish, based on the secure access information, a secure communication link to the other communication device on the communication connection to the other communication device; and

transfer local private encoding data to the other communication device via the secure communication link on the communication connection.

11. A communication device according to claim 10, further comprising:

a data memory unit comprising the local private encoding data to be transferred.

12. A communication device according to claim 10, further comprising:

a memory unit being configured to store local private encoding data of the other communication device transferred therefrom via the secure communication link on the communication connection.

13. A communication device according to claim 10, wherein the processor is configured to verify the secure communication link by means of at least one of:

verifying identification information provided by the other communication device,

reproducing identification information provided by the other communication device.

14. A system comprising:

a first communication device comprising;

a first communication interface configured to communicate with another communication device via a communication connection;

a first processor configured to;

receive or acquire, via a first interface unit and a first secure communication path being physically and/or logically separated from the communication connection, secure access information provided by the other communication device;

establish, based on the secure access information, a secure communication link to the other communication device on the communication connection to the other communication device;

transfer local private encoding data to the other communication device via the secure communication link on the communication connection, and

a second communication device comprising;

a second communication interface configured to communicate with another communication device via a communication connection; and

a second processor configured to provide secure access in a manner that the secure access information is adapted for transmission to the other communication device via a second interface unit and the first secure communication path and configured to receive local private encoding data from the other communication device via the secure communication link on the communication channel.

15. A computer program product stored on a non-transitory computer readable storage medium including program code configured to, when executed by a computing device, to at least:

provide secure access information by a second communication device having a second interface unit;

transmit the secure access information from the second communication device to a first communication device having a first interface unit via a first secure communication path, the first secure communication path comprising the second interface unit and the first interface unit and being physically and/or logically separated from the communication connection, wherein the transmitting comprises;

displaying or sending, by the second interface unit, of the secure access information and

acquiring or receiving, by the first interface unit, of the secure access information;

establish, based on the secure access information, a secure communication link between the first communication device and the second communication device on the communication connection between the first communication device and the second communication device; and

transfer the local private encoding data via the secure communication link on the communication channel.