Ad hoc one-time pairing of remote devices using online audio fingerprinting

• US 10,074,374 B2
• Filed: 04/07/2014
• Issued: 09/11/2018
• Est. Priority Date: 04/07/2014
• Status: Active Grant

• Current Assignee: Barco NV
• Original Assignee: Barco NV
• Inventors: Brands, Johannes Willem, Herreman, Christophe Gustaaf Rita
• Primary Examiner(s): JACKSON, JAKIEDA R
• Application Number:
  US14/246,812
• Publication Number:
  US 20150287416A1
• Time in Patent Office: 1,618 Days
• Field of Search: 704273, 379 9302, 379 9303, 455410, 455411
• CPC Class Codes: G10L 19/018 Audio watermarking, i.e. embedding inaudible data in the audio signal
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04M 2203/6054 Biometric subscriber identification
• CPC Class Codes: H04M 2203/6081 Service authorization mechanisms
• CPC Class Codes: H04M 3/56 Arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities video conference systems H04N7/15

Abstract

Participants of a phone conference can share electronic data without a need to exchange passwords to link two devices nor to login to access data. The invention is resistant to eavesdropping, and provides methods, devices and systems to easily and automatically find, identify and authenticate participants on a computer network for electronic data exchange. Samples of the audio are used to create a stream of audio fingerprints which are sent to a matching service. This matching service finds the fingerprints that correspond to the same conversation, and exchanges identifiers. When instructed by the user, the device can setup a secure data connection.

Claims

1. A method for setting up data channels in parallel to an existing voice communication, the method comprising:

automatically one-time ad-hoc setting up data channels in parallel to the existing voice communication between first and second user equipment of first and second users, respectively, the data channel being adapted for exchanging electronic data;

creating a first fingerprint of first ad-hoc real time audio signals of the voice communication at the first user equipment and a second fingerprint of second ad-hoc real-time audio signals of the voice communication at the second user equipment, the first and second ad-hoc real-time audio signals being exchanged between the two users;

sending the first and second fingerprints using the first user equipment and the second user equipment to a central matching service in small batches;

comparing the first and second fingerprints with each other in accordance with a matching algorithm, and if the comparing meets a requirement of matching similarity, receiving a user action authenticating the data channel across a second network,

wherein before the comparing the first and second fingerprints in accordance with the matching algorithm there is an anonymizing function.

2. The method of claim 1, wherein the first and second network are the same network.

3. The method of claim 1, wherein the voice communication is a phone call, a phone conference or a video conference.

4. The method of claim 1, wherein when the comparing meets the requirement of matching similarity at least one user is informed thereof by a visual message, or by a tactile signal, an audible signal or any combination of these.

5. The method of claim 1, further comprising generating a session key by using a fingerprint of one or more participants as a seed for an encryption routine.

6. The method of claim 5, wherein the session key is a secret session key or a random session key.

7. The method of claim 1, wherein the voice communication is a bi-directional audio communication.

8. The method of claim 1, wherein when the comparing meets the requirement of matching similarity an identification message related to the identities of the users is passed to each user.

9. The method of claim 7, wherein the identification message is a user id token structure of the participant of the phone call optionally with authorization schemas of access granting protocol(s) and the authorization keys that grant access to networked resources.

10. The method of claim 9, wherein the token may include any one or combination of the following attributes:

A name of the participant;

A picture or image of the person, and/or an avatar;

One or more email addresses;

An identity provider;

The URL or URI of online resources, including a domain name;

An OpenID connect ID token.

11. The method of claim 9, wherein the token may be one or more device id tokens, identifying devices that the participant uses.

12. The method of claim 11, wherein the device ID token includes any of the following attributes:

A network address,

An HTTP tracking cookie;

the URL or URI of online resources, including a domain name;

An SSID of a wireless local area network (WLAN), where the device is able to be reached;

A phone number, and/or an IMSI number;

A GPS location of the device.

13. The method of claim 1, wherein time shifts that appear in matching pairs of streams of fingerprints due to time lapse to traverse the first and/or second network are detected.

14. The method of claim 13, further comprising tracking the time shifts, to distinguish between silent participants and potential eavesdroppers and the users.

15. The method of claim 1, wherein the first and second fingerprints are determined using a one-way function.

16. The method of claim 15, wherein the one way function is a hash.

17. The method of any one of the preceding claims, wherein all connections are torn down after termination of the voice communication or electronic data exchange leaving no surviving rights or permissions.

18. The method of claim 1, wherein the first and second user equipment of first and second users are discovered automatically on the first or second network.

19. The method of claim 1, wherein the comparing step includes matching similarity using metadata.

20. The method of claim 1, further comprising the step of exchanging electronic data across the data channel in parallel with the existing voice communication.

21. The method of claim 1, wherein the anonymizing function comprises an anonymizing proxy, wherein said anonymizing proxy receives at least the first and second fingerprints from the first and second user equipment and forwards the first and second fingerprints to a matching service through a secure and anonymizing tunnel.

22. A system for setting up of data channels in parallel to an existing voice communication comprising:

means for automatic one-time ad hoc authentication of a data channel in parallel to an existing voice communication across a first network between first and second user equipment of first and second users, respectively, the data channel being adapted for exchanging electronic data;

means for creating a first fingerprint of first ad-hoc real-time audio signals of the voice communication at the first user equipment and a second fingerprint of second ad-hoc real time audio signals of the voice communication at the second user equipment, the first and second ad-hoc real-time audio signals being exchanged between the two users;

means for comparing the first and second fingerprints with each other in accordance with a matching algorithm, and for determining if the comparing meets a requirement of matching similarity;

means for receiving a user action authenticating the data channel across a second network;

means for anonymizing located before the means for comparing the first and second fingerprints in accordance with the matching algorithm,

wherein the means for comparing is a central matching service, and

wherein the first user equipment and the second user equipment are configured to send the first and second fingerprints to the central matching service in small batches.

23. The system of claim 22, wherein the first and second network are the same network.

24. The system of claim 22, wherein the voice communication is a phone call, a phone conference or a video conference.

25. The system of claim 22, further comprising means for informing at least one user by a visual message, or by a tactile signal, an audible signal or any combination of these when the comparing meets the requirement of matching similarity.

26. The system of claim 22, wherein the voice communication is a bi-directional audio communication.

27. The system of claim 22, further comprising means for transmitting an identification message related to the identities of the users when the comparing meets the requirement of matching similarity.

28. The system of claim 22, further comprising means for detecting time shifts that appear in matching pairs of streams of fingerprints due to time lapse to traverse the first and/or second network.

29. The system of claim 28, further comprising means for tracking the time shifts, to distinguish between silent participants and potential eavesdroppers and the users.

30. The system of claim 22, wherein the means for creating the first and second fingerprints uses a one-way function.

31. The system of claim 30, wherein the one-way function is a hash.

32. The system of claim 22, wherein the means for creating first and second fingerprints is activated on receipt of an ingoing or on setting up of an outgoing voice communication.