Signatures for near field communications

• US 10,237,072 B2
• Filed: 07/01/2013
• Issued: 03/19/2019
• Est. Priority Date: 07/01/2013
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Hoyer, Philip, Robinton, Mark
• Primary Examiner(s): Jamshidi, Ghodrat
• Application Number:
  US14/897,708
• Publication Number:
  US 20160142210A1
• Time in Patent Office: 2,087 Days
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/108 Source integrity
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A data-carrying device and methods of authenticating the same are disclosed. The data-carrying device is described as being capable of communicating via the Near Field Communications (NFC) protocol and may have one or more NFC Data Exchange Format (NDEF) records stored in its memory. The data-carrying device also comprises or has the ability to generate a signature that proves the data-carrying device is the authorized device for storing the one or more NDEF records. A data-carrying device that attempts to transmit an NDEF record without a valid signature may be identified as an unauthorized data-carrying device.

Claims

1. A method, comprising:

receiving a first input at a data-carrying device that is storing one or more Near Field Communications (NFC) Data Exchange Format (NDEF) records;

generating a signature for binding the one or more NDEF records to the data-carrying device, the data-carrying device using the first input to generate the signature; and

providing the signature from the data-carrying device to a reading device so that the reading device can validate the binding between the one or more NDEF records and the data-carrying device thereby determining that the data-carrying device is authorized to store the one or more NDEF records.

2. The method of claim 1, wherein the signature is generated in a Secure Element (SE) of the data-carrying device.

3. The method of claim 2, wherein the data-carrying device comprises an NFC-enabled mobile communication device.

4. The method of claim 1, wherein the first input comprises non-random data that describes at least one of the data-carrying device and a user of the data-carrying device.

5. The method of claim 4, wherein the non-random data comprises a Unique Identifier (UID) assigned to the data-carrying device.

6. The method of claim 1, wherein the first input comprises a nonce value.

7. The method of claim 6, wherein the data-carrying device dynamically generates the signature in response to receiving the nonce value from the reading device and wherein the nonce value is embedded in the one or more NDEF records.

8. The method of claim 1, further comprising:

comparing the signature received from the data-carrying device with a tag revocation list; and

based on the comparison of the signature with the tag revocation list, determining whether or not the signature corresponds to a revoked tag certificate.

9. The method of claim 1, wherein the one or more NDEF records are stored in a Secure Element (SE) of the data-carrying device.

10. The method of claim 9, wherein the signature is also stored in the SE of the data-carrying device.

11. A data-carrying device, comprising:

a Near Field Communications (NFC) interface, which enables the data-carrying device to exchange NFC Data Exchange Format (NDEF) records with other NFC-enabled devices; and

memory in which at least one NDEF record is stored along with a binding signature which provides proof that the data-carrying device is authorized to store the at least one NDEF record.

12. The device of claim 11, wherein the binding signature is generated with non-random data that describes the data-carrying device.

13. The device of claim 12, wherein the non-random data comprises a Unique Identifier (UID) assigned to the data-carrying device.

14. The device of claim 11, wherein the binding signature is generated with a randomly or pseudo-randomly generated number.

15. The device of claim 11, wherein the memory comprises a Secure Element (SE) and wherein the binding signature provides proof that the data-carrying device is the sole device authorized to store the at least one NDEF record.

16. A method, comprising:

receiving a first input at a data-carrying device that is storing one or more Near Field Communications (NFC) Data Exchange Format (NDEF) records;

generating a signature for the one or more NDEF records, the data-carrying device using the first input to generate the signature; and

providing the signature from the data-carrying device to a reading device so that the reading device can validate that the data-carrying device is authorized to store the one or more NDEF records based on the reading device determining that the one or more NDEF records are bound with the data-carrying device via the signature.

17. The method of claim 16, wherein the reading device determines at substantially the same time that:

(i) the one or more NDEF records are valid and (ii) the data-carrying device is the sole device allowed to store the one or more NDEF records based on the reading device determining that the one or more NDEF records are bound with the data-carrying device via the signature.

18. The method of claim 16, wherein the first input comprises non-random data.

19. The method of claim 16, wherein the first input comprises random data.

20. The method of claim 16, wherein the first input comprises non-random data that describes the data-carrying device.