Establishing trust between two devices

• US 10,581,848 B2
• Filed: 06/21/2017
• Issued: 03/03/2020
• Est. Priority Date: 09/17/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Dawoud Shenouda Dawoud, Peter, Saboori, Anoosh, Soni, Himanshu, Ingalls, Dustin Michael, Porter, Nelly L.
• Primary Examiner(s): Perungavoor, Venkat
• Application Number:
  US15/629,468
• Publication Number:
  US 20170302666A1
• Time in Patent Office: 986 Days
• Field of Search: None
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

Techniques described herein leverage a trusted entity within a domain to enable devices to establish trust with one another so they can securely discover each other and connect to one another. In various examples discussed herein, a device is configured to provide trust information to, and/or receive trust information from, the trusted entity. The trust information may include, for example, a public key of an encryption key pair, a certificate signed by the trusted entity proving authenticity, and/or a hash function and a hash seed used to compute a series of results that form a hash chain. The device may use the trust information to discover another device and to connect to the other device securely and automatically (e.g., with no user involvement or limited user involvement). Moreover, the device may use the trust information to dynamically change a MAC address being used to communicate with the other device.

Claims

1. A portable device registered to a user by an entity, the device comprising:

a processing system comprising;

one or more processors; and

memory coupled to the one or more processors, the processing system configured to;

cause the device to join a domain comprising one or more networks, wherein the domain is operated by the entity;

based on the device joining the domain, receive a plurality of certificates from a trusted entity device, an individual certificate in the plurality of certificates indicating;

that another device registered to another user by the entity is trusted by the trusted entity device; and

that the other device is approved for automatic pairing with the device; and

establish, based at least in part on the individual certificate, a connection with the other device via a media access control (MAC) address.

2. The device of claim 1, wherein the device and the other device securely connect via the MAC address without the device having to broadcast the MAC address.

3. The device of claim 1, wherein the device and the other device are associated with a same user account.

4. The device of claim 1, wherein:

the domain comprises an enterprise domain;

the trusted entity device maintains a list of devices that are trusted within the enterprise domain; and

the list of devices includes devices registered to employees of a company that are served by the enterprise domain.

5. The device of claim 1, wherein the connection is established without the individual certificate being communicated from the other device to the device.

6. The device of claim 1, wherein the user and the other user are different users.

7. A method implemented by a device registered to a user by an entity, the method comprising:

joining a domain comprising one or more networks, wherein the domain is operated by the entity;

receiving, based on joining the domain, a plurality of certificates from a trusted entity device, an individual certificate in the plurality of certificates indicating;

that another device registered to another user by the entity is trusted by the trusted entity device; and

that the other device is approved for automatic pairing with the device; and

establishing, based at least in part on the individual certificate, a connection with the other device via a media access control (MAC) address.

8. The method of claim 7, wherein the device and the other device securely connect via the MAC address without the device having to broadcast the MAC address.

9. The method of claim 7, wherein the device and the other device are associated with a same user account.

10. The method of claim 7, wherein:

the domain comprises an enterprise domain;

the trusted entity device maintains a list of devices that are trusted within the enterprise domain; and

the list of devices includes devices registered to employees of a company that are served by the enterprise domain.

11. The method of claim 7, wherein the connection is established without the individual certificate being communicated from the other device to the device.

12. The method of claim 7, wherein the user and the other user are different users.

13. A device registered to a user by an enterprise, the device comprising:

a processing system comprising;

one or more processors; and

memory coupled to the one or more processors, the processing system configured to;

cause the device to automatically join a domain comprising one or more enterprise networks, wherein the domain is operated by the enterprise;

based on the device joining the domain, receive a plurality of certificates from a trusted entity device, an individual certificate in the plurality of certificates indicating;

that another device registered to another user by the entity is trusted by the trusted entity device; and

that the other device is approved for automatic pairing with the device; and

automatically connect, based at least in part on the individual certificate, the device with the other device via a media access control (MAC) address.

14. The device of claim 13, wherein automatically connecting the device with the other device via the MAC address is implemented without requiring input from the user or the other user.