SYSTEMS, DEVICES, AND METHODS FOR SECURELY TRANSMITTING A SECURITY PARAMETER TO A COMPUTING DEVICE

• US 20100262829A1
• Filed: 04/08/2009
• Published: 10/14/2010
• Est. Priority Date: 04/08/2009
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael S., Little, Herbert A.
• Granted Patent: US 8,214,645 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Embodiments of the systems, devices, and methods described herein generally facilitate the secure transmittal of security parameters. In accordance with at least one embodiment, a representation of first data comprising a password is generated at the first computing device as an image or audio signal. The image or audio signal is transmitted from the first computing device to the second computing device. The password is determined from the image or audio signal at the second computing device. A key exchange is performed between the first computing device and the second computing device wherein a key is derived at each of the first and second computing devices. In at least one embodiment, one or more security parameters (e.g. one or more public keys) are exchanged between the first and second computing devices, and techniques for securing the exchange of security parameters or authenticating exchanged security parameters are generally disclosed herein.

Claims

1. A method of transmitting one or more security parameters to a first computing device from a second computing device, the method performed at the second computing device, the method comprising:

receiving an image or audio signal, wherein the image or audio signal is a representation of first data, the first data comprising a password, wherein the password is not derived from a security parameter stored on the first computing device;

determining the password from the image or audio signal; and

performing a key exchange with the first computing device over a communication channel between the first and second computing devices, wherein second data is exchanged between the first and second computing devices in accordance with a key exchange protocol, such that a key is derived at each of the first and second computing devices using the password, and wherein the one or more security parameters is transmitted to the first computing device during the key exchange;

wherein said performing further comprises

computing a confirmation value based on at least the one or more security parameters, and using the key derived at the second computing device, and

transmitting the confirmation value to the first computing device, wherein the one or more security parameters are authenticated when the confirmation value is successfully verified at the first computing device.

2. The method of claim 1, wherein said receiving the image or audio signal is performed when the first and second computing devices are in close proximity.

3. The method of claim 1, wherein the confirmation value comprises a keyed-hash message authentication code.

4. The method of claim 1, wherein the one or more security parameters comprise one or more public keys stored on the second computing device.

5. The method of claim 1, wherein the key exchange protocol comprises a SPEKE protocol.

6. The method of claim 1, wherein the image comprises a barcode.

7. The method of claim 1, wherein at the receiving, the image is received via a camera of the second computing device, wherein the camera is configured to process the image after being displayed on a display of the first computing device.

8. The method of claim 1, wherein the audio signal comprises a plurality of audio tones.

9. The method of claim 1, wherein at the receiving, the audio signal is received via a microphone of the second computing device, wherein the microphone is configured to receive the audio signal after being output on a speaker of the first computing device.

10. The method of claim 1, wherein at the receiving, the audio signal is received via a channel established during a phone call between the first computing device and the second computing device.

11. The method of claim 1, wherein the first data further comprises routing data associated with the first computing device.

12. The method of claim 11, further comprising establishing the communication channel by initiating contact with the first computing device using the routing data.

13. The method of claim 11, wherein the routing data comprises a PIN associated with the first computing device, and wherein the communication channel between the first and second computing devices comprises a PIN-to-PIN channel.

14. The method of claim 1, wherein the password comprises a random number or string.

15. The method of claim 1, further comprising receiving one or more second security parameters from the first computing device, receiving a second confirmation value from the first computing device, and verifying the second confirmation value.

16. The method of claim 1, wherein at least one computing device selected from the following group comprises a mobile device:

the first computing device, and the second computing device.

17. A second computing device comprising a processor and a memory, the processor configured to execute one or more application modules, said one or more application modules comprising:

a module configured to receive an image or audio signal, wherein the image or audio signal is a representation of first data, the first data comprising a password, wherein the password is not derived from a security parameter stored on the first computing device;

a module configured to determine the password from the image or audio signal; and

a module configured to perform a key exchange with the first computing device over a communication channel between the first and second computing devices, wherein second data is exchanged between the first and second computing devices in accordance with a key exchange protocol, such that a key is derived at each of the first and second computing devices using the password, and wherein the one or more security parameters is transmitted to the first computing device during the key exchange;

wherein said module configured to perform a key exchange is further configured to

compute a confirmation value based on at least the one or more security parameters, and using the key derived at the second computing device, and to

transmit the confirmation value to the first computing, wherein the one or more security parameters are authenticated when the confirmation value is successfully verified at the first computing device.

18. The second computing device of claim 17, wherein at least one computing device selected from the following group comprises a mobile device:

the first computing device, and the second computing device

19. A computer readable storage medium comprising instructions that, when executed by a processor of a second computing device, cause the second computing device to perform acts of a method of transmitting one or more security parameters to a first computing device, the method performed at the second computing device, the acts comprising:

receiving an image or audio signal, wherein the image or audio signal is a representation of first data, the first data comprising a password, wherein the password is not derived from a security parameter stored on the first computing device;

determining the password from the image or audio signal; and

performing a key exchange with the first computing device over a communication channel between the first and second computing devices, wherein second data is exchanged between the first and second computing devices in accordance with a key exchange protocol, such that a key is derived at each of the first and second computing devices using the password, and wherein the one or more security parameters is transmitted to the first computing device during the key exchange;

wherein said performing further comprises

computing a confirmation value based on at least the one or more security parameters, and using the key derived at the second computing device, and

transmitting the confirmation value to the first computing device, wherein the one or more security parameters are authenticated when the confirmation value is successfully verified at the first computing device.

20. The medium of claim 19, wherein at least one computing device selected from the following group comprises a mobile device:

the first computing device, and the second computing device.