Negotiated wireless peripheral security systems

• US 20020052965A1
• Filed: 08/30/2001
• Published: 05/02/2002
• Est. Priority Date: 10/27/2000
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Eric M. Dowling
• Inventors: Dowling, Eric Morgan
• Granted Patent: US 6,901,429 B2
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04M 2250/02 including a Bluetooth interface
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 28/16 : Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
• CPC Class Codes: H04W 28/24 : Negotiating SLA [Service Level Agreement]; Negotiating QoS [Quality of Service]
• CPC Class Codes: H04W 36/1446 : wherein at least one of the networks is unlicensed
• CPC Class Codes: H04W 36/22 : for handling the traffic
• CPC Class Codes: H04W 36/38 : by fixed network equipment
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 8/245 : from a network towards a terminal
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Methods, apparatus, and business techniques are disclosed for use in mobile network communication systems. A mobile unit such as a smart phone is preferably equipped with a wireless local area network connection and a wireless wide area network connection. The local area network connection is used to establish a position-dependent ecommerce network connection with a wireless peripheral supplied by a vendor. The mobile unit is then temporarily augmented with the added peripheral services supplied by the negotiated wireless peripheral. Systems and methods allow the mobile unit to communicate securely with a remote server, even when the negotiated wireless peripheral is not fully trusted. Also mobile units, wireless user peripherals, and negotiated wireless peripherals that project a non-area constrained user interface image on a display surface are taught.

Claims

1. A negotiated wireless peripheral device comprising:

a short-range wireless transceiver operative to support a position-dependent ecommerce session with a mobile unit;

a negotiation module coupled to the short-range wireless transceiver, the negotiation module operative to engage in a handshaking sequence with the mobile unit to establish the position-dependent ecommerce session;

a WAN gateway module operative to couple a traffic stream generated in the mobile unit and received via the short-range wireless transceiver to a wireline WAN connection, so that the mobile unit may maintain an end-to-end secure connection though the negotiated wireless peripheral device with a remote server coupled to the WAN;

a peripheral augmentation system operative to redirect one or more I/O streams to/from the mobile unit to a set of one or more peripheral devices that support a non-area constrained user interface to the user of the mobile; and

one or more protected memory segments that are provided for exclusive use by one or more I/O processes that support the non-area constrained user interface.

2. The negotiated wireless peripheral of claim 1, further comprising:

an object that controls the non-area constrained user interface and maintains a point-to-point secure connection with the application so that all application data stored in the negotiated wireless peripheral is either in encrypted form or is in the protected memory area.

3. The negotiated wireless peripheral of claim 2, wherein the object further comprises:

a program module that prevents other programs from accessing the protected memory segment.

4. The negotiated wireless peripheral of claim 2, wherein the object further comprises:

a program module that monitors access to the memory segment and reports to a unauthorized access to the protected memory segment.

5. For use in a mobile unit that communicates with a negotiated wireless peripheral (NWP) device, a method comprising:

establishing via a wireless local area network air interface a position-dependent ecommerce session with the NWP device and contracting for the use of at least one peripheral that supports enhanced user interface capabilities;

redirecting at least one input-output stream to the at least one peripheral supplied by the NWP device in order to allow an application program to deliver content using a non-area-constrained user interface;

establishing via a wireless wide area network connection an end-to-end secure client-server session between the mobile unit and a remote server that provides an application service; and

supplying a client-side and non-area constrained user interface to the user to allow the user to interact with the remote server using the at least one augmented peripheral.

6. The method of claim 5, wherein the method further comprises:

passing a remote object to the NWP device, whereby the remote object performs cipher processing and memory protection processing in the NWP device; and

invoking an input and/or output method on a stub object that securely communicates commands and/or input/output data to the remote object.

7. For use in a mobile unit that uses a wireless wide area network (wWAN) air interface to communicate via a wide area network (WAN) with one or more remote servers and a wireless local area network (wLAN) air interface to contract with a negotiated wireless peripheral (NWP) device, a method comprising:

establishing via the wLAN air interface a position-dependent ecommerce session with the NWP device;

redirecting at least one input-output stream to at least one peripheral supplied by the NWP device in order to allow an application program to deliver content to a non-area-constrained user interface, whereby the at least one peripheral includes an input device;

establishing or redirecting a client-server packet stream via the wLAN and through the WAN to support an end-to-end secure session between the mobile unit and a selected remote server, whereby the mobile unit performs cipher processing using at least one security parameter from an end-to-end security association between the mobile unit and the selected remote server;

storing in the mobile unit at least one secure information record for secure transmission to with the remote server; and

securely passing the secure information record to the remote server without the need to type in the information stored in the secure information record into the input device supplied by the negotiated wireless peripheral.

8. The method of claim 7, wherein the input device is a computer keyboard.

9. The method of claim 7, wherein the method further comprises:

passing an object to the negotiated wireless peripheral device, whereby the object maintains a point-to-point secure connection with the application and controls the storage of input-output data into a protected memory segment in the negotiated wireless peripheral device to inhibit a rouge processes from intercepting information from the non-area constrained user interface.

10. The method of claim 7, wherein the method further comprises:

passing a remote object to the negotiated wireless peripheral, whereby the remote object performs cipher processing and memory protection processing in the negotiated wireless peripheral; and

invoking an input and/or output method on a stub object that securely communicates commands and/or input/output data to the remote object.

11. For use in a mobile unit that uses a wireless wide area network (wWAN) air interface to communicate via a wide area network (WAN) with one or more remote servers and a wireless local area network (wLAN) air interface to contract with a negotiated wireless peripheral (NWP) device, a method comprising:

establishing via the wLAN air interface a position-dependent ecommerce session with the NWP device;

establishing or redirecting a client-server packet stream via the wLAN and through the WAN to support an end-to-end secure session between the mobile unit and a selected remote server, whereby the mobile unit performs cipher processing using at least one security parameter from an end-to-end security association between the mobile unit and the selected remote server; and

projecting a non-area constrained user interface image on a projection-display surface in order to supply a display area in support of a non-area constrained.

12. The method of claim 11, wherein the method further comprises:

storing in the mobile unit at least one secure information record for secure transmission to the remote server; and

securely passing the secure information record to the remote server without the need to enter the information stored in the secure information record into an input peripheral supplied by the NWP device.

13. The method of claim 11, wherein the projecting involves a scanned laser image.

14. The method of claim 11, wherein the projecting involves an LCD-based optical projector.

15. The method of claim 11, wherein the method further comprises:

accepting a power input from the wireless negotiated peripheral device to supply power to the mobile unit.

16. The method of claim 11, wherein the method further comprises:

passing an object to the negotiated wireless peripheral device, whereby the object maintains a point-to-point secure connection with the application and controls the storage of input-output data into a protected memory segment in the negotiated wireless peripheral device to inhibit a rouge processes from intercepting information from the non-area constrained user interface.

17. The method of claim 11, wherein the method further comprises:

passing a remote object to the negotiated wireless peripheral, whereby the remote object performs cipher processing and memory protection processing in the negotiated wireless peripheral; and

invoking an input and/or output method on a stub object that securely communicates commands and/or input/output data to the remote object.

19. The mobile unit of claim 18, further comprising:

a short range wireless transceiver; and

an input configuration module capable of reconfiguring the mobile unit to accept a user interface input from an input device supplied by the short range wireless transceiver and to display this user input onto the projected non-area constrained user interface.

20. The mobile unit of claim 19, further comprising the input device, whereby the input device comprises a lightweight portable keyboard.

21. The mobile unit of claim 20, whereby the display projector is physically built into the lightweight portable keyboard.

22. The mobile unit of claim 21, whereby the lightweight portable keyboard further comprises a frame buffer and a graphics control circuit used to provide a data source to the display projector.

23. The mobile unit of claim 22, whereby display projector comprises a laser projector that draws out a UI image.

24. The mobile unit of claim 22, whereby the laser projector comprises a plurality of lasers of different colors to provide a color UI image.

25. The mobile unit of claim 22, whereby display projector comprises a laser projector that uses raster scanning to project a UI image.

26. The mobile unit of claim 25, whereby the laser projector comprises a plurality of lasers of different colors to provide a color UI image.

18. A mobile unit comprising:

a set of peripherals that in total support an area-constrained user interface and a non-area constrained user interface; and

a display projector that projects a non-area constrained user interface display onto a display surface;

whereby the set of peripherals includes a pointing and selection device capable of controlling a cursor image on the projected non-area constrained user interface and making selections based on interactive portions of the projected non-area constrained user interface.