Apparatus and methods for sharing cryptography information

• US 20060218397A1
• Filed: 03/22/2005
• Published: 09/28/2006
• Est. Priority Date: 03/22/2005
• Status: Abandoned Application

• Current Assignee: Research In Motion Limited (Blackberry Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Adams, Neil, Brown, Michael S., Little, Herb, Brown, Michael K., Davis, Dinah
• Application Number:
  US11/085,207
• Publication Number:
  US 20060218397A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A system includes a server, a first client device to communicate in an authenticated and secured manner with the server over a first communication link, and a second client device to communicate in an authenticated and secured manner with the first client device over a second communication link. The first client device is to cause the server and the second client device to share cryptography information. The cryptography information may then be used to secure a third communication link between the server and the second client device that does not include the first client device.

Claims

1. A method for a first client device, the method comprising:

causing a server and a second client device to share cryptography information that is to be used to secure a communication link between said server and said second client device that does not include said first client device.

2. The method of claim 1, wherein causing said server and said second client device to share said cryptography information includes at least:

generating a cryptographic key;

sending said cryptographic key to said second client device in a secured and authenticated manner and;

sending said cryptographic key to said server in a secured and authenticated manner.

3. The method of claim 1, wherein causing said server and said second client device to share said cryptography information includes at least:

receiving a symmetric cryptographic key from said server in a secured and authenticated manner; and

sending said symmetric cryptographic key to said second client device in a secured and authenticated manner.

4. The method of claim 1, wherein causing said server and said second client device to share said cryptography information includes at least:

receiving a symmetric cryptographic key from said second client device in a secured and authenticated manner; and

sending said symmetric cryptographic key to said server in a secured and authenticated manner.

5. The method of claim 1, wherein causing said server and said second client device to share said cryptography information includes at least:

receiving a public cryptographic key from said server in an authenticated manner; and

sending said public cryptographic key to said second client device in an authenticated manner.

6. The method of claim 1, wherein causing said server and said second client device to share said cryptography information includes at least:

receiving a public cryptographic key from said second client device in an authenticated manner; and

sending said public cryptographic key to said server in an authenticated manner.

7. The method of claim 1, further comprising:

recognizing that said second client device wants to communicate securely with said server; and

checking that said second client device has permission to communicate securely with said server.

8. The method of claim 7, wherein checking that said second client device has permission to communicate securely with said server includes at least:

asking a user of said first client device for said permission.

9. The method of claim 7, wherein checking that said second client device has permission to communicate securely with said server includes at least:

checking a policy for said permission.

10. The method of claim 1, wherein causing said server and said second client device to share said cryptography information includes at least:

communicating said cryptography information to at least one of said server and said second client device.

11. A first client device comprising:

a first communication interface through which said first client device is able to communicate in an authenticated manner with a server;

a second communication interface through which said first client device is able to communicate in an authenticated manner with a second client device;

a processor; and

a memory to store executable code which, when executed by said processor, causes said server and said second client device to share cryptography information.

12. The first client device of claim 11, wherein said cryptography information is to be used to secure a communication link between said server and said second client device that does not include said first client device.

13. The first client device of claim 12, wherein said cryptography information includes public keys of said server and said second client device.

14. The first client device of claim 12, wherein said first client device is able to communicate through said first communication interface in a secured and authenticated manner with said server, said first client device is able to communicate through said second communication interface in a secured and authenticated manner with said second client device, and said cryptography information includes a symmetric key.

15. The first client device of claim 12, further comprising:

an output device to prompt a user of said first client device for permission for said second client device to share said cryptography information with said server; and

an input device to receive a response from said user.

16. The first client device of claim 12, wherein said executable code, when executed by said processor, also checks a policy for permission for said second client device to share said cryptography information with said server.

17. The first client device of claim 16, wherein said policy is stored in said memory.

18. The first client device of claim 12, wherein said first client device is a mobile device, and said first communication interface includes an antenna and a radio.

19. The first client device of claim 18, wherein said radio is compatible with the Bluetooth®

standard.

20. The first client device of claim 18, wherein said second communication interface includes a connector.

21. A system comprising:

a server;

a first client device to communicate in an authenticated manner with said server over a first communication link; and

a second client device to communicate in an authenticated manner with said first client device over a second communication link,

wherein said first client device is to cause said server and said second client device to share cryptography information that is to be used to secure a third communication link between said server and said second client device that does not include said first client device.

22. The system of claim 21, wherein said first communication link and said third communication link are Bluetooth®

links.