Secure distributed device-to-device network

• US 10,075,447 B2
• Filed: 03/03/2016
• Issued: 09/11/2018
• Est. Priority Date: 03/04/2015
• Status: Active Grant

• Current Assignee: Neone, Inc.
• Original Assignee: Neone, Inc.
• Inventors: Glassco, Dave E, Diacakis, Athanassios H, Cohen, Dan
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US15/060,589
• Publication Number:
  US 20160261568A1
• Time in Patent Office: 922 Days
• CPC Class Codes: H04L 12/06 Answer-back mechanisms or circuits
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/1046 Joining mechanisms
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption

Abstract

An electronic device in a device-to-device network of a user of the electronic device communicates with a group of one or more other instances of the electronic via dynamic connections that are based on pre-established and maintained (i.e., long-lived) associations in the device-to-device network. Moreover, a given dynamic connection between the electronic device and a given instance of the electronic device in the group is setup by the electronic device without assistance of a computer in another network, which conveys the communication within the group. During operation, the electronic device: receives content from the user; generates a message by encrypting the content using an encryption key associated with the user; and provides the message to at least a second instance of the electronic device in the group, which is associated with a second user in the device-to-device network, at a location specified by one of the associations.

Claims

1. An electronic device, comprising:

an interface circuit configured to communicate with a group of one or more other instances of the electronic device via dynamic connections that are based at least in part on pre-established and maintained associations in a device-to-device network of a user of the electronic device, wherein the pre-established and maintained associations are maintained for longer time than the dynamic connections,

wherein a pre-established and maintained association and a given dynamic connection between the electronic device and a given instance of the electronic device in the group is set up by the electronic device without assistance of a computer in a different network than the device-to-device network;

wherein the pre-established and maintained associations are in response to invitations from the user without advertising in the device-to-device network, the device-to-device network partially overlaps one or more other device-to-device networks of users of the one or more other instances of the electronic device, and a given one of the users provides and accesses messages in one of the one or more other device-to-device networks and controls the one of the one or more other device-to-device networks via a given one of the electronic device or the one or more other instances of the electronic device that corresponds to and is dedicated to at least the given one of the users;

wherein the given one of the electronic device or the one or more other instances of the electronic device hosts up to N users, who are in up to N independent device-to-device networks, in which N is an integer; and

wherein the interface circuit is configured to communicate with the given instance of the electronic device via at least a non-wireless communication technique and the different network;

memory; and

a control circuit, coupled to the interface circuit and the memory, configured to;

receive content associated with the user;

access an encryption key associated with the user that is stored in the memory;

generate a message based at least in part on the content, wherein generating the message involves encrypting the content based at least in part on the encryption key; and

provide, via the interface circuit, the message for at least a second instance of the electronic device in the group at a location specified by one of the pre-established and maintained associations, wherein the second instance of the electronic device is associated with a second user in the device-to-device network.

2. The electronic device of claim 1, wherein, prior to receiving the content, the control circuit is configured to establish an account for the user on the electronic device;

and

wherein establishing the account comprises generating the encryption key.

3. The electronic device of claim 2, wherein the account is established via an access device that communicates using wireless communication;

and

wherein establishing the account involves;

generating a device-access key that is specific to the access device and that is used to authenticate the access device, which allows the user to access the account on the electronic device via the access device; and

providing, via the interface circuit, the device-access key for the access device.

4. The electronic device of claim 3, wherein, in response to a request associated with the access device, the control circuit is configured to:

generate a token; and

provide the token for the access device for forwarding to a second access device, which allows the user to access the account on the electronic device via the second access device in order to obtain another device-access key for the second access device.

5. The electronic device of claim 3, wherein, in response to a request associated with the access device, the control circuit is configured to:

generate a token; and

provide the token for the access device for forwarding to a second access device, which allows the user to access the account on the electronic device via the second access device in order to authorize another device-access key for the second access device.

6. The electronic device of claim 1, wherein the encryption key identifies the user in the device-to-device network.

7. The electronic device of claim 1, wherein the communication between the electronic device and the given instance of the electronic device comprises point-to-point communication.

8. The electronic device of claim 1, wherein the interface circuit is configured to communicate with a third instance of the electronic device in a second device-to-device network that is outside of the device-to-device network via the second instance of the electronic device in the group;

wherein the second instance of the electronic device is also included in the second device-to-device network; and

wherein the communication with the third instance of the electronic device occurs when the user responds to a second message received from a second user of the second instance of the electronic device in the group that also was sent to a third user of the third instance of the electronic device.

9. The electronic device of claim 1, wherein, prior to communicating with the second instance of the electronic device, the electronic device confirms that the second instance of the electronic device is associated with a provider of the electronic device.

10. The electronic device of claim 9, wherein the electronic device comprises an authentication circuit that implements a coding technique that is shared by the group;

and

wherein, prior to the communication, the control circuit is configured to;

provide a challenge for the second instance of the electronic device;

generate an encoded version of the challenge using the authentication circuit;

receive another encoded version of the challenge associated with the second instance of the electronic device; and

compare the encoded version and the other encoded version to confirm that the second instance of the electronic device is associated with the provider of the electronic device.

11. The electronic device of claim 1, wherein the message is provided for at least the second instance of the electronic device via a queue associated with the second instance of the electronic device;

wherein the electronic device is configured to attempt to provide the message for the second instance of the electronic device until a delivery confirmation is received; and

wherein the electronic device is configured to delete the message from the queue when the delivery confirmation is received.

12. The electronic device of claim 1, wherein the memory stores encryption keys of users of the other instances of the electronic device in the group.

13. The electronic device of claim 1, wherein the control circuit comprises a processor coupled to the memory;

wherein the memory stores program instructions configured to be executed by the processor, and

wherein, when executed by the processor, the program instructions cause the electronic device to perform at least some of the receiving, the accessing, the generating and the providing.

14. A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions,

wherein, when executed by the electronic device, the program instructions cause the electronic device to provide a message by performing operations comprising:

receiving content associated with a user;

accessing an encryption key associated with the user that is stored in memory;

generating the message based at least in part on the content, wherein generating the message involves encrypting the content based at least in part on the encryption key; and

providing, via an interface circuit in the electronic device, the message for at least a second instance of the electronic device in a group of one or more other instances of the electronic device in a device-to-device network of the user of the electronic device, wherein the second instance of the electronic device is associated with a second user in the device-to-device network;

wherein the second instance of the electronic device is at a location specified by a pre-established and maintained association between the electronic device and the second instance of the electronic device;

wherein the pre-established and maintained association is maintained for longer time than the dynamic connection;

wherein the providing involves at least a dynamic connection that is based at least in part on the pre-established and maintained association and the pre-established and maintained association and the dynamic connection are set up by the electronic device without assistance of a computer in a different network than the device-to-device network;

wherein the pre-established and maintained associations are in response to invitations from the user without advertising in the device-to-device network, the device-to-device network partially overlaps one or more other device-to-device networks of users of the one or more other instances of the electronic device, and a given one of the users provides and accesses messages in one of the one or more other device-to-device networks and controls the one of the one or more other device-to-device networks via a given one of the electronic device or the one or more other instances of the electronic device that corresponds to and is dedicated to at least the given one of the users;

wherein the given one of the electronic device or the one or more other instances of the electronic device hosts up to N users, who are in up to N independent device-to-device networks, in which N is an integer; and

wherein the communication between the electronic device and the second instance of the electronic device via the different network involves at least a non-wireless communication technique.

15. The computer-readable storage medium of claim 14, wherein the operations comprise communicating with a third instance of the electronic device in a second device-to-device network that is outside of the device-to-device network via the second instance of the electronic device in the group;

wherein the second instance of the electronic device is also included in the second device-to-device network; and

wherein the communication with the third instance of the electronic device occurs when the user responds to a second message received from the second user of the second instance of the electronic device in the group that also was sent to a third user of the third instance of the electronic device.

16. The computer-readable storage medium of claim 14, wherein the message is provided for at least the second instance of the electronic device via a queue associated with the second instance of the electronic device;

wherein the electronic device attempts to provide the message for the second instance of the electronic device until a delivery confirmation is received; and

wherein the electronic device deletes the message from the queue when the delivery confirmation is received.

17. The computer-readable storage medium of claim 14, wherein, prior to communicating with the second instance of the electronic device, the electronic device confirms that the second instance of the electronic device is associated with a provider of the electronic device.

18. A method for providing a message, wherein the method comprises:

by an electronic device;

receiving content associated with a user;

accessing an encryption key associated with the user that is stored in memory;

generating the message based at least in part on the content, where generating the message involves encrypting the content based at least in part on the encryption key; and

providing, via an interface circuit in the electronic device, the message for at least a second instance of the electronic device in a group of one or more other instances of the electronic device in a device-to-device network of a user of the electronic device, wherein the second instance of the electronic device is associated with a second user in the device-to-device network;

wherein the second instance of the electronic device is at a location specified by a pre-established and maintained association between the electronic device and the second instance of the electronic device;

wherein the pre-established and maintained association is maintained for longer time than the dynamic connection;

wherein the providing involves at least a dynamic connection that is based at least in part on the pre-established and maintained association and the pre-established and maintained association and the dynamic connection are set up by the electronic device without assistance of a computer in a different network than the device-to-device network;

wherein the pre-established and maintained associations are in response to invitations from the user without advertising in the device-to-device network, the device-to-device network partially overlaps one or more other device-to-device networks of users of the one or more other instances of the electronic device, and a given one of the users provides and accesses messages in one of the one or more other device-to-device networks and controls the one of the one or more other device to-device networks via a given one of the electronic device or the one or more other instances of the electronic device that corresponds to and is dedicated to at least the given one of the users;

wherein the given one of the electronic device or the one or more other instances of the electronic device hosts up to N users, who are in up to N independent device-to-device networks, in which N is an integer; and

wherein the communication between the electronic device and the second instance of the electronic device via the different network involves at least a non-wireless communication technique.

19. The method of claim 18, wherein the method comprises communicating with a third instance of the electronic device in a second device-to-device network that is outside of the device-to-device network via the second instance of the electronic device in the group;

wherein the second instance of the electronic device is also included in the second device-to-device network; and

wherein the communication with the third instance of the electronic device occurs when the user responds to a second message received from the second user of the second instance of the electronic device in the group that also was sent to a third user of the third instance of the electronic device.

20. The method of claim 18, wherein, prior to communicating with the second instance of the electronic device, the method comprises confirming that the second instance of the electronic device is associated with a provider of the electronic device.