PROVIDING AN ENCRYPTED ACCOUNT CREDENTIAL FROM A FIRST DEVICE TO A SECOND DEVICE

• US 20140208112A1
• Filed: 01/23/2013
• Published: 07/24/2014
• Est. Priority Date: 01/23/2013
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: McDonald, Cameron A., Duggan, Matthew C.
• Granted Patent: US 9,942,750 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/43 using shared identity modules, e.g. SIM sharing
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Disclosed is an apparatus, system, and method to decrypt an encrypted account credential at a second device that is received from a first device. The second device may receive a first share of a master key and the encrypted account credential from the first device. The second device may reconstruct the master key with the first share of the master key and a second share of the master key stored at the second device. The second device may decrypt the encrypted account credential with the reconstructed master key. Based upon the decrypted account credential, the second device may be enabled to access an account based upon the decrypted account credential.

Claims

1. A method comprising:

receiving a first share of a master key and an encrypted account credential from a first device;

reconstructing the master key with the first share of the master key and a second share of the master key at a second device;

decrypting the encrypted account credential with the reconstructed master key; and

enabling access to an account based upon the decrypted account credential at the second device.

2. The method of claim 1, further comprising unlocking the first device.

3. The method claim 2, wherein, unlocking the first device comprises locating the first device within a pre-defined physical proximity range of the second device.

4. The method claim 2, wherein, unlocking the first device comprises a physical action applied to the first device.

5. The method claim 4, wherein, the physical action applied to the first device in combination with the encrypted account credential enables access to the account.

6. The method claim 1, wherein, the encrypted account credential includes a username and a password.

7. The method claim 6, wherein, the encrypted account credential includes a website that includes the account.

8. The method claim 1, wherein, the first device is a mobile device.

9. The method claim 8, wherein, the second device is a non-mobile device.

10. The method claim 1, wherein, the first device is a near field communication (NFC) card.

11. The method claim 1, wherein, the encrypted account credential further comprises randomized data.

12. The method claim 1, further comprising receiving a digital signature with the encrypted account credential.

13. The method of claim 1, wherein, shares are distributed to multiple devices.

14. An apparatus comprising:

an interface; and

a processor to execute operations including;

receiving from the interface a first share of a master key and an encrypted account credential from a first device;

reconstructing the master key with the first share of the master key and a second share of the master key;

decrypting the encrypted account credential with the reconstructed master key; and

enabling access to an account based upon the decrypted account credential.

15. The apparatus of claim 14, wherein, the encrypted account credential includes a username and a password.

16. The apparatus of claim 15, wherein, the encrypted account credential includes a website that includes the account.

17. The apparatus of claim 14, wherein, the first device is a mobile device.

18. The apparatus of claim 14, wherein, the first device is a near field communication (NFC) card.

19. The apparatus of claim 14, wherein, the encrypted account credential further comprises randomized data.

20. An apparatus comprising:

means for receiving a first share of a master key and an encrypted account credential from a first device;

means for reconstructing the master key with the first share of the master key and a second share of the master key;

means for decrypting the encrypted account credential with the reconstructed master key; and

means for enabling access to an account based upon the decrypted account credential.

21. The apparatus of claim 20, wherein, the encrypted account credential includes a username and a password.

22. The apparatus of claim 21, wherein, the encrypted account credential includes a website that includes the account.

23. The apparatus of claim 20, wherein, the first device is a mobile device.

24. The apparatus of claim 20, wherein, the first device is a near field communication (NFC) card.

25. The apparatus of claim 20, wherein, the encrypted account credential further comprises randomized data.

26. A computer program product executed at a second device comprising:

a computer-readable medium comprising code for;

receiving a first share of a master key and an encrypted account credential from a first device;

reconstructing the master key with the first share of the master key and a second share of the master key;

decrypting the encrypted account credential with the reconstructed master key; and

enabling access to an account based upon the decrypted account credential.

27. The computer program product of claim 26, wherein, the encrypted account credential includes a username and a password.

28. The computer program product of claim 27, wherein, the encrypted account credential includes a website that includes the account.

29. The computer program product of claim 26, wherein, the first device is a mobile device.

30. The computer program product of claim 29, wherein, the second device is a non-mobile device.

31. The computer program product of claim 26, wherein, the first device is a near field communication (NFC) card.

32. The computer program product of claim 26, wherein, the encrypted account credential further comprises randomized data.

33. An apparatus comprising:

an interface; and

a processor to execute operations including;

transmitting from the interface a first share of a master key and an encrypted account credential to a device, wherein the device reconstructs the master key with the first share of the master key and a second share of the master key stored at the device to decrypt the encrypted account credential to enable access to an account based upon the decrypted account credential.

34. The apparatus of claim 33, wherein, the encrypted account credential includes a username and a password.

35. The apparatus of claim 34, wherein, the encrypted account credential includes a website that includes the account.

36. The apparatus of claim 33, further comprising an unlocking sensor to unlock the apparatus to enable transmission of the encrypted account credential and the first share.

37. The apparatus of claim 36, wherein, the unlocking sensor is a proximity range sensor such that when the apparatus is located within a pre-defined physical proximity range of the device the apparatus is unlocked.

38. The apparatus of claim 36, wherein, the unlocking sensor is a physical sensor such that when a physical action is applied to the apparatus that is sensed by the physical sensor the apparatus is unlocked.

39. The apparatus of claim 38, wherein, the physical sensor is a motion sensor.

40. The apparatus of claim 38, wherein, the physical sensor is a microphone.

41. The apparatus of claim 33, wherein, the apparatus is a mobile device.

42. The apparatus of claim 33, wherein, the apparatus is a near field communication (NFC) card.

43. An apparatus comprising:

means for communicating with a device; and

means for transmitting a first share of a master key and an encrypted account credential to the device, wherein the device reconstructs the master key with the first share of the master key and a second share of the master key stored at the device to decrypt the encrypted account credential to enable access to an account based upon the decrypted account credential.

44. The apparatus of claim 43, wherein, the encrypted account credential includes a username and a password.

45. The apparatus of claim 44, wherein, the encrypted account credential includes a website that includes the account.

46. The apparatus of claim 43, further comprising means for unlocking the apparatus to enable transmission of the encrypted account credential and the first share.

47. The apparatus of claim 46, wherein, the means for unlocking the apparatus includes proximity range sensor means such that when the apparatus is located within a pre-defined physical proximity range of the device the apparatus is unlocked.

48. The apparatus of claim 46, wherein, the means for unlocking the apparatus includes physical sensor means such that when a physical action is applied to the apparatus that is sensed by the physical sensor means the apparatus is unlocked.

49. The apparatus of claim 43, wherein, the apparatus is a mobile device.

50. The apparatus of claim 43, wherein, the apparatus is a near field communication (NFC) card.

51. A method implemented at a first device comprising:

transmitting a first share of a master key to a second device; and

transmitting an encrypted account credential to the second device, wherein the second device reconstructs the master key with the first share of the master key and a second share of the master key stored at the second device to decrypt the encrypted account credential to enable access to an account based upon the decrypted account credential.

52. The method of claim 51, wherein, the encrypted account credential includes a username and a password.

53. The method of claim 52, wherein, the encrypted account credential includes a website that includes the account.

54. The method of claim 51, further comprising unlocking the first device to enable transmission of the encrypted account credential and the first share.

55. The method of claim 54, wherein, unlocking the first device includes determining when the first device is located within a pre-defined physical proximity range of the second device.

56. The method of claim 54, wherein, unlocking the first device includes detecting when a physical action is applied to the first device.

57. The method of claim 51, wherein, the first device is a mobile device.

58. The method of claim 51, wherein, the first device is a near field communication (NFC) card.

59. A computer program product executed at a first device comprising:

a computer-readable medium comprising code for;

transmitting a first share of a master key to a second device; and

transmitting an encrypted account credential to the second device, wherein the second device reconstructs the master key with the first share of the master key and a second share of the master key stored at the second device to decrypt the encrypted account credential to enable access to an account based upon the decrypted account credential.

60. The computer program product of claim 59, wherein, the encrypted account credential includes a username and a password.

61. The computer program product of claim 60, wherein, the encrypted account credential includes a website that includes the account.

62. The computer program product of claim 59, further comprising code for unlocking the first device to enable transmission of the encrypted account credential and the first share.

63. The computer program product of claim 62, wherein, unlocking the first device includes code for determining when the first device is located within a pre-defined physical proximity range of the second device.

64. The computer program product of claim 62, wherein, unlocking the first device includes code for detecting when a physical action is applied to the first device.

65. The computer program product of claim 59, wherein, the first device is a mobile device.

66. The computer program product of claim 59, wherein, the first device is a near field communication (NFC) card.