Method and apparatus for performing a secure transaction in a trusted network

• US 20060090067A1
• Filed: 10/05/2005
• Published: 04/27/2006
• Est. Priority Date: 10/06/2004
• Status: Abandoned Application

• Current Assignee: Sharp Kabushiki Kaisha (Hon Hai Precision Industry Co., Ltd.)
• Original Assignee: Sharp Kabushiki Kaisha (Hon Hai Precision Industry Co., Ltd.)
• Inventors: Edmonds, Philip G., Wise, Michio, Robinson, David A., Green, Claire
• Application Number:
  US11/244,204
• Publication Number:
  US 20060090067A1
• Time in Patent Office: Days
• US Class Current: 713/159
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1046 Joining mechanisms
• CPC Class Codes: H04L 67/1057 involving pre-assessment of levels of reputation of peers
• CPC Class Codes: H04L 67/1065 Discovery involving distributed pre-established resource-based relationships among peers, e.g. based on distributed hash tables [DHT] pre-configuration of logical or physical connections H04L67/1053

Abstract

A method is provided of enabling respective users (A, B) of first and second devices (12, 2) of a trusted network to perform a secure transaction between them. A communications channel, such as a telephone conversation, is established between the users (A, B). A verification identifier for the transaction is communicated between the users (A, B) using the communications channel (A6). The verification identifier is stored (A3) at the first device (12) as a reference identifier for the transaction. A secure connection is opened between the two devices (12, 2) over the trusted network (A10), the secure connection being different to the communications channel between the users (A, B). The verification identifier is sent (A11) from the second device (2) to the first device (12) over the secure connection. The verification identifier received over the secure connection is compared (A12) with the reference identifier at the first device (12). The secure transaction is performed over the secure connection (A15) in dependence upon the comparison.

Claims

1. A method of enabling respective users of first and second devices of a trusted network to perform a secure transaction between them, comprising:

establishing a communications channel between the users;

communicating a verification identifier for the transaction between the users using the communications channel;

storing the verification identifier at the first device as a reference identifier for the transaction;

opening a secure connection between the two devices over the trusted network, the secure connection being different to the communications channel between the users;

sending the verification identifier from the second device to the first device over the secure connection;

comparing the verification identifier received over the secure connection with the reference identifier at the first device; and

performing the secure transaction over the secure connection in dependence upon the comparison.

2. A method as claimed in claim 1, comprising performing the secure transaction only if the comparison indicates a match between the verification and reference identifiers.

3. A method as claimed in claim 1, comprising closing the secure connection if the comparison does not indicate a match between the verification and reference identifiers.

4. A method as claimed in claim 1, further comprising:

communicating a first device identifier, identifying the first device in the network, from the first user to the second user; and

using the first device identifier at the second device to open the secure connection.

5. A method as claimed in claim 4, wherein the first device identifier is communicated using the communications channel between the users.

6. A method as claimed in claim 1, wherein the verification identifier is communicated from the first user to the second user using the communications channel, and further comprising inputting the verification identifier into the second device for use in the sending step.

7. A method as claimed in claim 6, further comprising generating the verification identifier at the first device.

8. A method as claimed in claim 7, comprising generating a random number for use as the verification identifier.

9. A method as claimed in claim 6, further comprising:

communicating a first device identifier, identifying the first device in the network, from the first user to the second user; and

using the first device identifier at the second device to open the secure connection;

and comprising communicating a single transaction code from the first user to the second user comprising the first device identifier and the verification identifier.

10. A method as claimed in claim 9, wherein the transaction code is formed by appending the first device identifier to the verification identifier.

11. A method as claimed in claim 6, further comprising:

communicating a first device identifier, identifying the first device in the network, from the first user to the second user; and

using the first device identifier at the second device to open the secure connection;

wherein the first device identifier is used as the verification identifier.

12. A method as claimed in claim 1, wherein the verification identifier is communicated from the second user to the first user using the communications channel, and further comprising inputting the verification identifier into the first device for use in the storing step.

13. A method as claimed in claim 12, further comprising generating the verification identifier at the second device.

14. A method as claimed in claim 13, comprising generating a random number for use as the verification identifier.

15. A method as claimed in claim 12, wherein a second device identifier, identifying the second device in the network, is used as the verification identifier.

16. A method as claimed in claim 1, wherein the communications channel is a communications channel that is trusted by the first and second users.

17. A method as claimed in claim 1, wherein the communications channel is one or more of:

a telephone call between the users;

physical contact between the users;

direct voice communication between the users;

transfer of a device-readable storage device between the users;

email; and

Short Message Service.

18. A method as claimed in claim 1, further comprising revoking the reference identifier after a predetermined period of time.

19. A method as claimed in claim 1, further comprising revoking the reference identifier after first use.

20. A method as claimed in claim 1, wherein at least one of the first and second devices is a multi-user device.

21. A method as claimed in claim 1, wherein at least one of the identifiers comprises one or more of:

a number;

a string;

a name;

an IP address; and

a domain name.

22. A method as claimed in claim 1, further comprising indicating the verification identifier for use in the communicating step to one of the users using that user'"'"'s device.

23. A method as claimed in claim 22, comprising displaying the verification identifier on a screen of the user'"'"'s device.

24. A method as claimed in claim 1, further comprising inputting the verification identifier received by one of the users in the communicating step into that user'"'"'s device.

25. A method as claimed in claim 24, comprising inputting the verification identifier using a keypad of the user'"'"'s device.

26. A method as claimed in claim 1, wherein the verification identifier uniquely identifies the transaction.

27. A method as claimed in claim 1, wherein the network is a peer-to-peer network of devices.

28. A method as claimed in claim 1, further comprising:

communicating a further verification identifier for the transaction between the users using the same or a different such communications channel;

storing the further verification identifier at the second device as a further reference identifier for the transaction;

sending the further verification identifier from the first device to the second device over the secure connection;

comparing the further verification identifier received over the secure connection with the further reference identifier at the second device; and

performing the secure transaction over the secure connection in dependence upon the comparison.

29. A method of maintaining a group, comprising a plurality of members, using a method as claimed in claim 1, wherein the step of performing a secure transaction relates to the addition or removal of one of the first and second users as a member of the group, the other of the first and second users being a designated coordinator for the group.

30. A method of configuring a trusted network, comprising a method as claimed in claim 1.

31. A method for use by a first device of a trusted network for enabling a user of the first device to perform a secure transaction with a user of a second device of the trusted network, comprising:

indicating a verification identifier for the transaction to the user of the first device for communication to the user of the second device using a communications channel established between the users, or inputting a verification identifier for the transaction communicated to the user of the first device from the user of the second device using a communications channel established between the users;

storing the verification identifier as a reference identifier for the transaction;

opening a secure connection between the two devices over the trusted network, the secure connection being different to the communications channel between the users;

receiving the verification identifier from the second device over the secure connection;

comparing the verification identifier received over the secure connection with the reference identifier; and

performing the secure transaction over the secure connection in dependence upon the comparison.

40. An operating program which, when run on a device, causes the device to carry out a method as claimed in claim 31.

41. An operating program as claimed in claim 40, carried on a carrier medium such as a transmission medium or a storage medium.

32. A method for use by a second device of a trusted network for enabling a user of the second device to perform a secure transaction with a user of a first device of the trusted network, comprising:

indicating a verification identifier for the transaction to the user of the second device for communication to the user of the first device using a communications channel established between the users, or inputting a verification identifier for the transaction communicated to the user of the second device from the user of the first device using a communications channel established between the users, the verification identifier being stored at the first device as a reference identifier for the transaction;

opening a secure connection between the two devices over the trusted network, the secure connection being different to the communications channel between the users;

sending the verification identifier to the first device over the secure connection for use by the first device in comparing with the reference identifier; and

performing the secure transaction over the secure connection in dependence upon the comparison.

42. An operating program which, when run on a device, causes the device to carry out a method as claimed in claim 32.

43. An operating program as claimed in claim 42, carried on a carrier medium such as a transmission medium or a storage medium.

33. A system for enabling respective users of first and second devices of a trusted network to perform a secure transaction between them, comprising:

means for establishing a communications channel between the users;

means for communicating a verification identifier for the transaction between the users using the communications channel;

means for storing the verification identifier at the first device as a reference identifier for the transaction;

means for opening a secure connection between the two devices over the trusted network, the secure connection being different to the communications channel between the users;

means for sending the verification identifier from the second device to the first device over the secure connection;

means for comparing the verification identifier received over the secure connection with the reference identifier at the first device; and

means for performing the secure transaction over the secure connection in dependence upon the comparison.

34. A device for use in a trusted network for enabling a user of the device to perform a secure transaction with a user of another device of the trusted network, comprising:

means for indicating a verification identifier for the transaction to the user of the device for communication to the user of the other device using a communications channel established between the users, or inputting a verification identifier for the transaction communicated to the user of the device from the user of the other device using a communications channel established between the users;

means for storing the verification identifier as a reference identifier for the transaction;

means for opening a secure connection between the two devices over the trusted network, the secure connection being different to the communications channel between the users;

means for receiving the verification identifier from the other device over the secure connection;

means for comparing the verification identifier received over the secure connection with the reference identifier; and

means for performing the secure transaction over the secure connection in dependence upon the comparison.

36. An operating program which, when loaded into a device, causes the device to become a device as claimed in claim 34.

37. An operating program as claimed in claim 36, carried on a carrier medium such as a transmission medium or a storage medium.

35. A device for use in a trusted network for enabling a user of the device to perform a secure transaction with a user of another device of the trusted network, comprising:

means for indicating a verification identifier for the transaction to the user of the device for communication to the user of the other device using a communications channel established between the users, or inputting a verification identifier for the transaction communicated to the user of the device from the user of the other device using a communications channel established between the users, the verification identifier being stored at the other device as a reference identifier for the transaction;

means for opening a secure connection between the two devices over the trusted network, the secure connection being different to the communications channel between the users;

means for sending the verification identifier to the other device over the secure connection for use by the other device in comparing with the reference identifier; and

means for performing the secure transaction over the secure connection in dependence upon the comparison.

38. An operating program which, when loaded into a device, causes the device to become a device as claimed in claim 35.

39. An operating program as claimed in claim 38, carried on a carrier medium such as a transmission medium or a storage medium.