Secure exchange of cryptographically signed records

• US 10,491,402 B2
• Filed: 07/27/2017
• Issued: 11/26/2019
• Est. Priority Date: 07/29/2016
• Status: Active Grant

• Current Assignee: Magic Leap, Inc.
• Original Assignee: Magic Leap, Inc.
• Inventors: Kaehler, Adrian
• Primary Examiner(s): Arani, Taghi T
• Assistant Examiner(s): Champakesan, Badri
• Application Number:
  US15/661,990
• Publication Number:
  US 20180034642A1
• Time in Patent Office: 852 Days
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Systems and methods for securely exchanging cryptographically signed records are disclosed. In one aspect, after receiving a content request, a sender device can send a record to a receiver device (e.g., an agent device) making the request. The record can be sent via a short range link in a decentralized (e.g., peer-to-peer) manner while the devices may not be in communication with a centralized processing platform. The record can comprise a sender signature created using the sender device'"'"'s private key. The receiver device can verify the authenticity of the sender signature using the sender device'"'"'s public key. After adding a cryptography-based receiver signature, the receiver device can redeem the record with the platform. Upon successful verification of the record, the platform can perform as instructed by a content of the record (e.g., modifying or updating a user account).

Claims

1. A method for securely exchanging cryptographically signed records, comprising:

under control of a hardware processor;

receiving a receiver individual record from a record receiver device,

wherein the receiver individual record comprises a sender individual record and a receiver signature of the receiver individual record,

wherein the sender individual record is created by a record sender device after receiving a record content request from the record receiver device, and identifying the record receiver device,

wherein the sender individual record comprises a record content, a sender public key of the record sender device, a receiver public key of the record receiver device, and a sender signature of the sender individual record,

wherein the sender signature is created using a sender private key of the record sender device, wherein the sender public key and the sender private key form a sender public-key cryptographic pair,

wherein the receiver individual record is created by the record receiver device after;

receiving the sender individual record from the record sender device; and

verifying, via the record receiver device, the sender individual record based at least in part on the sender public key,

wherein the receiver signature is created using based at least in part on a receiver private key of the record receiver device, and wherein the receiver public key and the receiver private key form a receiver public-key cryptographic pair;

verifying the receiver individual record based at least in part on the receiver public key;

performing for the record receiver device as instructed by the receiver individual record to provide content requested via the record content request;

generating common records from central records comprising;

the sender public key, the receiver public key, a user record status of the record sender device, and a user record status of the record receiver device;

determining that the user record status of the record sender device prohibits a processing platform to perform as instructed by the receiver individual record; and

adding the record sender device to a demerit list.

2. The method of claim 1, wherein identifying the record receiver device comprises performing partner identification, wherein partner identification comprises content authorization, knocking, physical indication, beam forming, prior arrangement, cursory validation, or any combination thereof.

3. The method of claim 1, wherein the sender individual record further comprises a record identifier.

4. The method of claim 1, wherein receiving the sender individual record from the record receiver device comprises receiving the sender individual record from the record sender device via a short range link directly or through an intermediate device.

5. The method of claim 1, wherein the receiver individual record further comprises a for-redemption-only endorsement, a query endorsement, a malicious record endorsement, or any combination thereof.

6. The method of claim 1, wherein the sender individual record is created after receiving authentication information of a record sender by the record sender device, and wherein the receiver individual record is created after receiving authentication information of a record receiver by the record receiver device.

7. The method of claim 1, further comprising providing common records to the record sender device or the record receiver device, wherein the common records comprise the sender public key and the receiver public key.

18. The method of claim 1, wherein the verifying the sender individual record is performed offline.

8. A method for securely exchanging cryptographically signed records, comprising:

under control of a hardware processor;

receiving a content request from a record receiver device;

identifying the record receiver device;

creating a sender individual record,

wherein the sender individual record comprises a record content, a sender public key of a record sender device, a receiver public key of the record receiver device, and a sender signature of the sender individual record,

wherein the sender signature is created using a sender private key of the record sender device, and wherein the sender public key and the sender private key form a sender public-key cryptographic pair;

sending the sender individual record to the record receiver device; and

receiving an indication of the record receiver device;

receiving the sender individual record;

verifying, via the record receiver device, the sender individual record based at least in part on the sender public key;

creating a receiver individual record, wherein the receiver individual record comprises the sender individual record and a receiver signature of the receiver individual record, wherein the receiver signature is created based at least in part on a receiver private key of the record receiver device, and wherein the receiver public key and the receiver private key form a receiver public-key cryptographic pair;

redeeming the receiver individual record with a processing platform;

receiving a performance by the processing platform as instructed by the receiver individual record to provide content requested via the record content request;

generating common records from central records comprising;

the sender public key, the receiver public key, a user record status of the record sender device, and a user record status of the record receiver device;

determining that the user record status of the record sender device prohibits the processing platform to perform as instructed by the receiver individual record; and

adding the record sender device to a demerit list.

9. The method of claim 8, wherein the content request comprises the receiver public key and a requested content, and wherein the record content is related to the requested content.

10. The method of claim 8, wherein the sender signature is created by a Secure Element of the record sender device using the sender private key, and wherein the sender private key is stored in the Secure Element of the record sender device.

19. The method of claim 8, wherein the verifying the sender individual record is performed offline.

11. A method for securely exchanging cryptographically signed records, comprising:

under control of a hardware processor;

sending a content request to a record sender device;

receiving a sender individual record from the record sender device,

wherein the sender individual record is created by the record sender device after receiving the content request from a record receiver device and identifying the record receiver device,

wherein the sender individual record comprises a record content, a sender public key of the record sender device, a receiver public key of the record receiver device, and a sender signature of the sender individual record,

wherein the sender signature is created using a sender private key of the record sender device, and wherein the sender public key and the sender private key form a sender public-key cryptographic pair;

verifying, via the record receiver device, the sender individual record based at least in part on the sender public key;

creating a receiver individual record, wherein the receiver individual record comprises the sender individual record and a receiver signature of the receiver individual record,

wherein the receiver signature is created based at least in part on a receiver private key of the record receiver device, and

wherein the receiver public key and the receiver private key form a receiver public-key cryptographic pair;

redeeming the receiver individual record with the processing platform;

receiving a performance by a processing platform as instructed by the receiver individual record to provide content requested via the record content request;

generating common records from central records comprising;

the sender public key, the receiver public key, a user record status of the record sender device, and a user record status of the record receiver device;

determining that the user record status of the record sender device prohibits the processing platform to perform as instructed by the receiver individual record; and

adding the record sender device to a demerit list.

12. The method of claim 11, wherein the content request comprises the receiver public key and a requested content, and wherein the record content is related to the requested content.

13. The method of claim 11, wherein verifying the sender individual record comprises using the sender public key to determine the sender signature is created using the sender private key.

14. The method of claim 11, wherein the receiver signature is created using a Secure Element of the record receiver device using the receiver private key, and wherein the receiver private key is stored in the Secure Element of the record receiver device.

15. The method of claim 11, further comprising sending common records to the record sender device.

16. The method of claim 11, further comprising receiving common records from the record sender device, wherein the common records comprise the sender public key and the receiver public key.

17. The method of claim 16,

wherein the common records further comprise a third signature of the common records, and wherein the third signature is created using a third private key of the processing platform,

wherein the method further comprises verifying the common records using a third public key of the processing platform,

wherein the third public key and the third private key form a third public-key cryptographic pair, and

wherein verifying the common records comprises using the third public key to determine the third signature is created using the third private key.

20. The method of claim 11, wherein the verifying the sender individual record is performed offline.