SHARED SECRET ESTABLISHMENT AND DISTRIBUTION

• US 20120137132A1
• Filed: 09/21/2011
• Published: 05/31/2012
• Est. Priority Date: 09/21/2010
• Status: Abandoned Application

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Le Saint, Eric F.
• Application Number:
  US13/238,668
• Publication Number:
  US 20120137132A1
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G07C 9/00817 where the code of the lock can be programmed
• CPC Class Codes: G07C 9/00857 where the code of the data carrier can be programmed
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Providing secure communication with a security token includes establishing a shared secret between the security token and a first entity, transferring the shared secret between the first entity and a second entity, and the security token and the second entity establishing a secure communication channel using the shared secret. Transferring the shared secret may include selectively transferring the shared secret to a subset of entities according to access considerations for the security token. The security token may be part of a mobile phone having NFC capability, the first entity may be a Web service and the second entity may be a door controller. The Web service may establish a shared secret with the mobile phone. Providing secure communication with a security token may also include distributing the shared secret to all of the hosts corresponding to doors to which the phone can be used to obtain access.

Claims

1. A method of providing secure communication with a security token, comprising:

establishing a shared secret between the security token and a first entity;

transferring the shared secret between the first entity and a second entity; and

the security token and the second entity establishing a secure communication channel using the shared secret.

2. A method, according to claim 1, wherein the first entity is a registrar.

3. A method, according to claim 2, wherein the second entity is a host.

4. A method, according to claim 3, wherein the host is coupled to a door controller and wherein the security token provides access through a corresponding door thereof.

5. A method, according to claim 1, wherein the first entity is a host.

6. A method, according to claim 5, wherein the host is coupled to a door controller and wherein the security token provides access through a corresponding door thereof.

7. A method, according to claim 1, wherein transferring the shared secret includes selectively transferring the shared secret to a subset of entities according to access considerations for the security token.

8. A method, according to claim 1, wherein the security token is part of a mobile phone having NFC capability, the first entity is a Web service and the second entity is a door controller.

9. A method, according to claim 8, wherein the Web service establishes a shared secret with the mobile phone.

10. A method, according to claim 9, further comprising:

distributing the shared secret to all of the hosts corresponding to doors to which the phone can be used to obtain access.

11. Computer software, provided in a computer-readable medium, that provides secure communication with a security token, the software comprising:

executable code that establishes a shared secret between the security token and a first entity;

executable code that transfers the shared secret between the first entity and a second entity; and

executable code that causes the security token and the second entity to establish a secure communication channel using the shared secret.

12. Computer software, according to claim 11, wherein the first entity is a registrar.

13. Computer software, according to claim 12, wherein the second entity is a host.

14. Computer software, according to claim 13, wherein the host is coupled to a door controller and wherein the security token provides access through a corresponding door thereof.

15. Computer software, according to claim 11, wherein the first entity is a host.

16. Computer software, according to claim 15, wherein the host is coupled to a door controller and wherein the security token provides access through a corresponding door thereof.

17. Computer software, according to claim 11, wherein executable code that transfers the shared secret selectively transfers the shared secret to a subset of entities according to access considerations for the security token.

18. Computer software, according to claim 11, wherein the security token is part of a mobile phone having NFC capability, the first entity is a Web service and the second entity is a door controller.

19. Computer software, according to claim 18, wherein the Web service establishes a shared secret with the mobile phone.

20. Computer software, according to claim 19, further comprising:

executable code that distributes the shared secret to all of the hosts corresponding to doors to which the phone can be used to obtain access.