SYSTEM AND METHOD FOR EXCHANGING KEY GENERATION PARAMETERS FOR SECURE COMMUNICATIONS

• US 20130007456A1
• Filed: 09/07/2012
• Published: 01/03/2013
• Est. Priority Date: 07/15/2009
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: DEAN, EDWARD, DIAZ, ROBERTO, GODFREY, JAMES
• Granted Patent: US 8,904,179 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys

Abstract

A communication system exchanges key generation parameters for secure communications. An internet service and communications device of a user are in communication with each other. The internet service includes an account authentication mechanism for a user and includes a database having stored cryptographic keys and key generation parameters. A device client operates on the communications device and initiates a request to the internet service that authenticates the user and establishes a secure communications channel between the internet service and communications device and determine key generation parameters based on an authenticated user identifier and transmits the key generation parameters for initiating key generation and securely establishing a cryptographic key between the internet service and communications device.

Claims

1-22. -22. (canceled)

23. A communications system comprising:

an internet service and a mobile wireless communications device cooperating therewith;

the mobile wireless communications device comprising

a wireless transceiver, and

a processor coupled to the wireless transceiver and configured to

wirelessly transmit at least one user credential to the internet service to establish an authenticated communications channel with the internet service, and

wirelessly receive from the internet service a password signed using a private key and used to establish an encryption key with the internet service.

24. The communications system according to claim 23, wherein the mobile wireless communications device comprises a user interface coupled to the processor to accept user entry of the at least one credential comprising a username

25. The communications system according to claim 23, wherein the mobile wireless communications device comprises a user interface coupled to the processor to accept user entry of the at least one credential comprising a password.

26. The communications system according to claim 23, wherein the mobile wireless communications device comprises a browser to accept user entry of the at least one credential comprising a username and password on a web page so that an attachment containing key generation parameters is received and the processor triggers the browser plug-in to execute and initiate a key generation exchange.

27. The communications system according to claim 26, wherein the processor is configured to store a public key for verifying the attachment signed using a private key maintained by the internet service.

28. The communications system according to claim 23, wherein the secure communications channel comprises a Hypertext Transfer Protocol Secure (HTTPS) channel.

29. The communications system according to claim 23, wherein the at least one credential comprises a plurality of credentials corresponding to multiple user accounts.

30. A mobile wireless communications device comprising:

a wireless transceiver; and

a processor coupled to the wireless transceiver and configured to

wirelessly transmit at least one user credential to an internet service to establish an authenticated communications channel with the internet service, and

wirelessly receive from the internet service a password signed using a private key and used to establish an encryption key with the internet service.

31. The mobile wireless communications device according to claim 30, further comprising a user interface coupled to the processor to accept user entry of the at least one credential comprising a username.

32. The mobile wireless communications device according to claim 30, further comprising a user interface coupled to the processor to accept user entry of the at least one credential comprising a password.

33. The mobile wireless communications device according to claim 30, and further comprising a browser to accept user entry of the at least one credential on a web page so that an attachment containing key generation parameters is received and the processor triggers the browser plug-in to execute and initiate a key generation exchange.

34. The mobile wireless communications device according to claim 33, wherein the at least one credential comprises at least one of a username and password.

35. The mobile wireless communications device according to claim 33, wherein the processor is configured to store a public key for verifying the attachment signed using a private key maintained by the internet service.

36. The mobile wireless communications device according to claim 30, wherein the at least one credential comprises a plurality of credentials corresponding to multiple user accounts.

37. A method of operating a mobile wireless communications device comprising:

using a processor coupled to a wireless transceiver to

wirelessly transmit at least one user credential to an internet service to establish an authenticated communications channel with the internet service, and

wirelessly receive from the internet service a password signed using a private key and used to establish an encryption key with the internet service.

38. The method according to claim 37, further comprising accepting user entry of the at least one credential comprising a username.

39. The method according to claim 37, further comprising accepting user entry of the at least one credential comprising a password.

40. The method according to claim 37, and further comprising accepting user entry of the at least one credential comprising a username and password on a web page so that an attachment containing key generation parameters is received and the processor triggers the browser plug-in to execute and initiate a key generation exchange.

41. The method according to claim 40, further comprising using the processor to store a public key for verifying the attachment signed using a private key maintained by the internet service.

42. The method according to claim 37, wherein the at least one credential comprises a plurality of credentials corresponding to multiple user accounts.