Information communication system for establishing pairing in information communication network

• US 10,454,682 B2
• Filed: 02/10/2017
• Issued: 10/22/2019
• Est. Priority Date: 10/21/2016
• Status: Active Grant

• Current Assignee: Platfield Inc.
• Original Assignee: Platfield Inc.
• Inventors: Mizuta, Takeshi
• Primary Examiner(s): Abyaneh, Ali S
• Assistant Examiner(s): Lapian, Alexander R
• Application Number:
  US15/429,351
• Publication Number:
  US 20180115421A1
• Time in Patent Office: 984 Days
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A first apparatus performs a pairing providing process of displaying a provision string on the first apparatus and transmitting the provision string to a server apparatus, the provision string being of a given number of digits that changes every given amount of time in such a manner that, every given amount of time, the provision string is subjected to carrying and a new character is added to the rightmost digit of the provision string. A second apparatus transmits an acceptance string to the server apparatus, the acceptance string being input from the second apparatus based on the provision string displayed on the first apparatus. The server apparatus compares the provision string with the acceptance string, and determines that pairing is established between the first apparatus and the second apparatus when the provision string and the acceptance string match each other.

Claims

1. An information communication system comprising a plurality of apparatuses connected to an information communication network and a server apparatus connected to the information communication network, wherein

a first apparatus of the plurality of apparatuses comprises a first controller and a first display device;

the first controller comprises a pairing provision processing hardware unit configured to perform a pairing providing process of displaying a provision string on the first display device, and transmitting pairing provision information containing the displayed provision string to the server apparatus, the provision string being a character string of a given number of digits that is configured to change every given amount of time in such a manner that, after every given amount of time, the character string is subjected to carrying and at least one new character is added to a rightmost digit of the character string;

a second apparatus of the plurality of apparatuses comprises a second controller, a second display device, and a second input device;

the second controller comprises a pairing acceptance processing hardware unit configured to perform a pairing accepting process of displaying an acceptance string on the second display device, and transmitting pairing acceptance information containing the displayed acceptance string to the server apparatus, the acceptance string being a character string that is input from the second input device based on the provision string displayed on the first display device;

the server apparatus comprises a server side controller comprising a pairing determination processing hardware unit configured to compare the provision string contained in the pairing provision information received from the first apparatus with the acceptance string contained in the pairing acceptance information received from the second apparatus, and determine that pairing is established between the first apparatus and the second apparatus on a condition that the provision string and the acceptance string are determined to match each other;

the pairing acceptance processing hardware unit of the second apparatus comprises a carry processing hardware unit configured to perform, in order to follow changing of the provision string in the first apparatus, carrying on a first acceptance string corresponding to the provision string before the changing and adding at least one character to a rightmost digit of the first acceptance string, the at least one character being input from the second input device and corresponding to the at least one new character added to the rightmost digit of the provision string, so as to generate a second acceptance string corresponding to a provision string generated by the changing,

the carrying on the provision string comprises removing at least one character in the provision string, starting with a leftmost digit of the provision string; and

the carrying on the first acceptance string comprises removing a number of digits in the first acceptance string, starting with a leftmost digit of the first acceptance string, equal to a number of new characters added to the provision string.

2. The information communication system according to claim 1, wherein the carry processing hardware unit of the second apparatus is configured to perform carrying on the first acceptance string in synchronization with carrying of the provision string in the first apparatus.

3. The information communication system according to claim 2, wherein

the pairing acceptance processing hardware unit of the second apparatus comprises a confirmation string display processing hardware unit configured to display a confirmation string on the second display device on a condition that the pairing determination processing hardware unit of the server apparatus determines that the provision string and the acceptance string match each other,

the pairing provision processing hardware unit of the first apparatus comprises a response string acquisition processing hardware unit configured to acquire a response string which is a character string input from a first input device of the first apparatus based on the confirmation string displayed on the second display device, and

the pairing determination processing hardware unit of the server apparatus is configured to determine that pairing is established between the first apparatus and the second apparatus on the condition that the confirmation string displayed on the second display device matches the response string acquired by the first apparatus.

4. The information communication system according to claim 2, wherein

the information communication system is configured to perform an authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and the other one of the first and the second apparatuses serving as the authentication apparatus, the service apparatus being a hardware apparatus configured to provide the specific service, the authentication apparatus being a hardware apparatus configured to perform the authentication at a time of the specific service being used,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering hardware unit configured to generate an authentication side private key which is a private key to be used by the authentication apparatus and an authentication side public key being a public key corresponding to the authentication side private key, store the authentication side private key, and transmit the authentication side public key to the service apparatus,

the service apparatus comprises a service side controller comprising a service side registering hardware unit that is configured to, upon receiving the authentication side public key from the authentication apparatus, generate an internal user ID which is an identification marker for the authentication apparatus in the specific service, store the authentication side public key associating the authentication side public key with the internal user ID, and transmit the internal user ID to the authentication apparatus,

the service side controller comprises a service side encrypting hardware unit that is configured to, upon receiving from the authentication apparatus information to request authentication based on a specified internal user ID specified, transmit service side encrypted data to the authentication apparatus, the service side encrypted data being data obtained by encrypting service side original data which is data prepared in the service apparatus, using the authentication side public key that corresponds to the specified internal user ID and is stored in the service side registering hardware unit,

the authentication side controller comprises an authentication side decrypting hardware unit configured to transmit service side computed data to the service apparatus, the service side computed data being obtained by performing predetermined computation on service side decrypted data, the service side decrypted data being data obtained by decrypting the service side encrypted data received from the service apparatus, using the authentication side private key that is stored in the authentication side registering hardware unit, and

the service side controller comprises an internal user ID genuineness determining hardware unit configured to determine that the specified internal user ID is genuine when the service side computed data received from the authentication apparatus matches data obtained by performing the predetermined computation on the service side original data.

5. The information communication system according to claim 4, wherein

the service side registering hardware unit is further configured to generate a service side private key which is a private key to be used by the service apparatus and a service side public key which is a public key corresponding to the service side private key, store the service side private key, and transmit to the authentication apparatus the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service,

upon receiving the service side public key from the service apparatus, the authentication side registering hardware unit is further configured to store the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting hardware unit that is configured to, upon receiving information to request authentication with the service ID specified, from the service apparatus, transmit authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data which is data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering hardware unit,

the service side controller comprises a service side decrypting hardware unit configured to transmit to the authentication apparatus authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering hardware unit, and

the authentication side controller comprises a service ID genuineness determining hardware unit configured to determine that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

6. The information communication system according to claim 2, wherein

the information communication system is configured to perform an authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and the other one of the first and the second apparatuses serving as the authentication apparatus, the service apparatus being a hardware apparatus configured to provide the specific service, the authentication apparatus being a hardware apparatus configured to perform the authentication at a time of the specific service being used,

the service apparatus comprises a service side controller comprising a service side registering hardware unit configured to generate a service side private key which is a private key to be used by the service apparatus and a service side public key which is a public key corresponding to the service side private key, store the service side private key, and transmit to the authentication apparatus the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering hardware unit that is configured to, upon receiving the service side public key from the service apparatus, store the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting hardware unit that is configured to, upon receiving from the service apparatus information to request authentication with the service ID specified, transmit authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data which is data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering hardware unit,

the service side controller comprises a service side decrypting hardware unit configured to transmit to the authentication apparatus authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering hardware unit, and

the authentication side controller comprises a service ID genuineness determining hardware unit configured to determine that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

7. The information communication system according to claim 1, wherein the pairing determination processing hardware unit of the server apparatus comprises a re-pairing performing instruction processing hardware unit that is configured to, when the first apparatus corresponding to the provision string that matches the acceptance string contained in the pairing acceptance information received from the second apparatus comprises a plurality of first apparatuses, urge the plurality of the first apparatuses to execute the pairing providing process again, and at a same time instruct the second apparatus to perform the pairing accepting process again.

8. The information communication system according to claim 1, wherein

the pairing acceptance processing hardware unit of the second apparatus comprises a confirmation string display processing hardware unit configured to display a confirmation string on the second display device on a condition that the pairing determination processing hardware unit of the server apparatus determines that the provision string and the acceptance string match each other,

the pairing provision processing hardware unit of the first apparatus comprises a response string acquisition processing hardware unit configured to acquire a response string which is a character string input from a first input device of the first apparatus based on the confirmation string displayed on the second display device, and

the pairing determination processing hardware unit of the server apparatus is configured to determine that pairing is established between the first apparatus and the second apparatus on the condition that the confirmation string displayed on the second display device matches the response string acquired by the first apparatus.

9. The information communication system according to claim 1, wherein the second apparatus comprising a plurality of second apparatuses, and the information communication system is configured to establish pairing between the first apparatus and the plurality of second apparatuses.

10. The information communication system according to claim 1, wherein

the information communication system is configured to perform an authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and the other one of the first and the second apparatuses serving as the authentication apparatus, the service apparatus being a hardware apparatus configured to perform the specific service, the authentication apparatus being a hardware apparatus configured to perform the authentication at a time of the specific service being used,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering hardware unit configured to generate an authentication side private key which is a private key to be used by the authentication apparatus, and an authentication side public key which is a public key corresponding to the authentication side private key, store the authentication side private key, and transmit the authentication side public key to the service apparatus,

the service apparatus comprises a service side controller comprising a service side registering hardware unit that is configured to, upon receiving the authentication side public key from the authentication apparatus, generate an internal user ID which is an identification marker for the authentication apparatus in the specific service, store the authentication side public key associating the authentication side public key with the internal user ID, and transmit the internal user ID to the authentication apparatus,

the service side controller comprises a service side encrypting hardware unit that is configured to, upon receiving from the authentication apparatus information to request authentication based on a specified internal user ID, transmit service side encrypted data to the authentication apparatus, the service side encrypted data being data obtained by encrypting service side original data which is data prepared in the service apparatus, using the authentication side public key that corresponds to the specified internal user ID and is stored in the service side registering hardware unit,

the authentication side controller comprises an authentication side decrypting hardware unit configured to transmit service side computed data to the service apparatus, the service side computed data being obtained by performing predetermined computation on service side decrypted data, the service side decrypted data being data obtained by decrypting the service side encrypted data received from the service apparatus, using the authentication side private key that is stored in the authentication side registering hardware unit, and

the service side controller comprises an internal user ID genuineness determining hardware unit configured to determine that the specified internal user ID is genuine when the service side computed data received from the authentication apparatus matches data obtained by performing the predetermined computation on the service side original data.

11. The information communication system according to claim 10, wherein

the service side registering hardware unit is further configured to generate a service side private key which is a private key to be used by the service apparatus, and a service side public key which is a public key corresponding to the service side private key, store the service side private key, and transmit to the authentication apparatus the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service,

upon receiving the service side public key from the service apparatus, the authentication side registering hardware unit is further configured to store the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting hardware unit that is configured to, upon receiving information to request authentication with the service ID specified, from the service apparatus, transmit authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data which is data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering hardware unit,

the service side controller comprises a service side decrypting hardware unit configured to transmit to the authentication apparatus authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering hardware unit, and

the authentication side controller comprises a service ID genuineness determining hardware unit configured to determine that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

12. The information communication system according to claim 1, wherein

the information communication system is configured to perform an authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and the other one of the first and the second apparatuses serving as the authentication apparatus, the service apparatus being a hardware apparatus configured to provide the specific service, the authentication apparatus being a hardware apparatus configured to perform the authentication at a time of the specific service being used,

the service apparatus comprises a service side controller comprising a service side registering hardware unit configured to generate a service side private key which is a private key to be used by the service apparatus and a service side public key which is a public key corresponding to the service side private key, store the service side private key, and transmit to the authentication apparatus the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering hardware unit that is configured to, upon receiving the service side public key from the service apparatus, store the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting hardware unit that is configured to, upon receiving from the service apparatus information to request authentication with the service ID specified, transmit authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data which is data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering hardware unit,

the service side controller comprises a service side decrypting hardware unit configured to transmit to the authentication apparatus authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering hardware unit, and

the authentication side controller comprises a service ID genuineness determining hardware unit configured to determine that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

13. A server apparatus for connecting to a plurality of apparatuses in an information communication system via an information communication network, the server apparatus comprising:

a server side controller,

wherein the server side controller comprises a pairing determination processing hardware unit configured to receive pairing provision information from a first apparatus of the plurality of apparatuses, to receive pairing acceptance information from a second apparatus of the plurality of apparatuses, to compare a provision string contained in the pairing provision information with an acceptance string contained in the pairing acceptance information, and to determine that pairing is established between the first apparatus and the second apparatus on a condition that the provision string and the acceptance string are determined to match each other,

the provision string is a character string of a given number of digits that is configured to change after every given amount of time in such a manner that, after every given amount of time, the character string is subjected to carrying,

the acceptance string is a character string that is configured to change after every given amount of time in such a manner that, after every given amount of time, the character string is subjected to carrying in synchronization with the carrying on the provision string,

the carrying on the provision string comprises adding at least one new character to a rightmost digit to the character string of the provision string, and removing at least one character in the provision string, starting with a leftmost digit of the provision string, and

the carrying on the acceptance string comprises adding to a rightmost digit of the acceptance string at least one new character that corresponds to the at least one new character added to the rightmost digit of the provision string, and removing a number of digits in the acceptance string, starting with a leftmost digit of the acceptance string, equal to a number of new characters added to the provision string.

14. The server apparatus according to claim 13,

wherein the first apparatus is connected to the server apparatus via the information communication network, the first apparatus comprising:

a first controller, and

a first display device,

wherein the first controller comprises a pairing provision processing hardware unit configured to perform a pairing providing process, the pairing providing process comprising displaying the provision string on the first display device, and transmitting the pairing provision information containing the provision string to the server apparatus.

15. The server apparatus according to claim 13,

wherein the second apparatus is connected to the server apparatus via the information communication network, the second apparatus comprising:

a second controller,

a second display device, and

an input device,

wherein the second controller comprises a pairing acceptance processing hardware unit configured to perform a pairing accepting process, the pairing accepting process comprising displaying an acceptance string on the second display device, and transmitting the pairing acceptance information containing the acceptance string to the server apparatus, and

wherein the acceptance string is input from the input device based on the provision string displayed on the first display device.

16. A method of establishing pairing in an information communication system comprising a plurality of apparatuses connected to an information communication network and a server apparatus connected to the information communication network, the method comprising:

receiving pairing provision information from a first apparatus of the plurality of apparatuses,

receiving pairing acceptance information from a second apparatus of the plurality of apparatuses, to compare a provision string contained in the pairing provision information with an acceptance string contained in the pairing acceptance information, each of the provision string and the acceptance string being a character string having a given number of digits,

establishing pairing between the first apparatus and the second apparatus on a condition that the provision string and the acceptance string are determined to match each other,

performing carrying on the provision string after every given amount of time by adding at least one new character to a rightmost digit to the character string of the provision string, and removing at least one character in the provision string, starting with a leftmost digit of the provision string, and

performing carrying on the acceptance string after every given amount of time in synchronization with the performing of carrying on the provision string, by adding to a rightmost digit of the acceptance at least one new character that corresponds to the at least one new character added to the rightmost digit of the provision string, and removing a number of digits in the acceptance string, starting with a leftmost digit of the acceptance string, equal to a number of new characters added to the provision string.

17. A non-transitory computer-readable recording medium storing a computer-executable program causing the computer to perform the method according to claim 16.

18. An information communication method that is performed using an information communication system comprising a plurality of apparatuses connected to an information communication network and a server apparatus connected to the information communication network, the information communication method comprising:

a pairing provision processing step comprising displaying a provision string on a first display device of a first apparatus of the plurality of apparatuses, and transmitting pairing provision information containing the displayed provision string to the server apparatus, the provision string being a character string of a given number of digits that is configured to change every given amount of time in such a manner that, after every given amount of time, the character string is subjected to carrying and a new character is added to a rightmost digit of the character string;

a pairing acceptance processing step comprising displaying an acceptance string on a second display device of a second apparatus of the plurality of apparatuses, and transmitting pairing acceptance information containing the displayed acceptance string to the server apparatus, the acceptance string being a character string that is input from an input device of the second apparatus based on the provision string displayed on the display device of the first apparatus; and

a pairing determination processing step comprising comparing the provision string contained in the pairing provision information received from the first apparatus with the acceptance string contained in the pairing acceptance information received from the second apparatus, pairing being established between the first apparatus and the second apparatus when the provision string and the acceptance string match each other, wherein

the pairing acceptance processing step comprises a carry processing step comprising, in order to follow changing of the provision string in the first apparatus, performing carrying on a first acceptance string corresponding to the provision string before the changing, and adding a character to a rightmost digit of the first acceptance string, the character being input from the input device of the second apparatus and corresponding to the new character added to the rightmost digit of the provision string, so as to generate a second acceptance string corresponding to a provision string generated by the changing,

the carrying on the provision string comprises removing at least one character in the provision string, starting with a leftmost digit of the provision string, and

the carrying on the first acceptance string comprises removing a number of digits in the first acceptance string, starting with a leftmost digit of the first acceptance string, equal to a number of new characters added to the provision string.

19. A non-transitory computer-readable recording medium storing a computer-executable program causing the computer to perform the information communication method according to claim 18.