Use of short message service (SMS) for secure transactions

• US 20030123669A1
• Filed: 12/28/2001
• Published: 07/03/2003
• Est. Priority Date: 12/28/2001
• Status: Active Grant

• Current Assignee: Nokia Siemens Networks GmbH & Company KG (Nokia Corporation)
• Original Assignee: Siemens Communications Incorporated (Siemens AG)
• Inventors: Stamatelos, George, Koukoulidis, Vassilios, Jezierny, Rick
• Granted Patent: US 7,076,657 B2
• Time in Patent Office: Days
• US Class Current: 380/281
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A system and method is presented for establishing a secure conduit for SMS communication between a center and a wireless terminal. The center encrypts an authorization key in response to a wireless terminal'"'"'s SMS message containing a public key and a request for the authorization key, sends back to the wireless terminal an SMS message containing the encrypted authorization key, decrypts another SMS message received from the wireless terminal which contains an authentication code and a request for a traffic key, authenticates the SMS message, encrypts the traffic key, and sends to the wireless terminal another SMS message containing the traffic key.

Claims

1. A method for establishing a secure conduit for SMS communication with a wireless terminal, comprising:

a) encrypting an authorization key in response to a first SMS message from the wireless terminal comprising a public key and a request for the authorization key;

b) sending to the wireless terminal a second SMS message comprising the encrypted authorization key;

c) decrypting a third SMS message from the wireless terminal comprising an authentication code and a request for a traffic key;

d) authenticating the third SMS message;

e) encrypting the traffic key; and

f) sending to the wireless terminal a fourth SMS message comprising the traffic key.

2. The method of claim 1, further comprising:

generating at least three keys, comprising a key encryption key, an upstream message authentication key, and a downstream authentication key.

3. The method of claim 1, wherein the wireless terminal is a wireless telephone.

4. The method of claim 1, wherein the authentication code is a hash-based message authentication code digest.

5. The method of claim 1, wherein the secure conduit is for conveying credit card transactions.

6. The method of claim 1, wherein the secure conduit is for conveying medical information.

7. An apparatus for establishing a secure conduit for SMS communication with a wireless terminal, comprising:

a) first cryptographic means for encrypting an authorization key in response to a first SMS message from the wireless terminal comprising a public key and a request for the authorization key;

b) communication means for sending to the wireless terminal a second SMS message comprising the encrypted authorization key;

c) second cryptographic means for decrypting a third SMS message from the wireless terminal comprising an authentication code and a request for a traffic key;

d) upstream message authentication key means for authenticating the third SMS message; and

e) third cryptographic means for encrypting the traffic key;

wherein the communication means is also means for sending to the wireless terminal a fourth SMS message comprising the traffic key.

8. The apparatus of claim 7, further comprising:

fourth cryptographic means for generating at least three keys, comprising a key encryption key, an upstream message authentication key, and a downstream authentication key.

9. The apparatus of claim 7, wherein the wireless terminal is a wireless telephone.

10. The apparatus of claim 7, wherein the authentication code is a hash-based message authentication code digest.

11. The apparatus of claim 7, wherein the secure conduit is for conveying credit card transactions.

12. The apparatus of claim 7, wherein the secure conduit is for conveying medical information.

13. A computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to establish a secure conduit for SMS communication with a wireless terminal, by:

a) encrypting an authorization key in response to a first SMS message from the wireless terminal comprising a public key and a request for the authorization key;

b) creating a second message comprising the encrypted authorization key;

c) decrypting a third SMS message from the wireless terminal comprising an authentication code and a request for a traffic key;

d) authenticating the third SMS message;

e) encrypting the traffic key; and

f) creating a fourth message comprising the traffic key.

14. The computer-readable medium of claim 13, wherein the plurality of instructions includes further instructions which, when executed by a processor, cause the processor to perform the additional step of:

generating at least three keys, comprising a key encryption key, an upstream message authentication key, and a downstream authentication key.

15. The computer-readable medium of claim 13, wherein the wireless terminal is a wireless telephone.

16. The computer-readable medium of claim 13, wherein the authentication code is a hash-based message authentication code digest.

17. The computer-readable medium of claim 13, wherein the secure conduit is for conveying credit card transactions.

18. The computer-readable medium of claim 13, wherein the secure conduit is for conveying medical information.