SECURE DATA MANAGEMENT TECHNIQUES

• US 20160197934A1
• Filed: 01/06/2016
• Published: 07/07/2016
• Est. Priority Date: 01/07/2015
• Status: Active Grant

• Current Assignee: Lemon, Inc. (Gen Digital Inc.)
• Original Assignee: Kii, Inc. (Strive Capital)
• Inventors: Muraoka, Taro, Ishizuka, Susumu, Iguchi, Makoto
• Granted Patent: US 9,917,843 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

The present disclosure relates generally to secure data management techniques. Techniques are described for pairing devices and using the pairing information for granting or denying requests (e.g., data exchange requests) from the devices, for example, in a cloud environment, including Internet of Things (IoT) cloud. Devices can be paired with each other according to their identification information. Subsequently, when an original request is received from a first device, and a chasing request received from a second device, the pre-registered pairing information is used to determine whether the first and second devices form a valid pair and the original request is granted or denied based upon that determination. For example, the request may be granted only if it is determined that the first device and the second device have been previously paired. In certain embodiments, in addition to the pairing check, additional checks may be performed to determine whether to grant or deny the original request from the first device.

Claims

1. A method comprising:

receiving, by a server, a request from a first device to register the first device and a second device as paired devices, wherein the first device has a first identifier and the second device has a second identifier;

storing the first identifier and the second identifier as a valid pair;

receiving an original request from the first device, wherein the original request includes the first identifier associated with the first device;

receiving a chasing request from the second device, wherein the chasing request includes the second identifier associated with the second device;

determining whether the first device and the second device are the valid pair based on the first identifier in the original request and the second identifier in the chasing request;

determining whether a portion of information in the original request matches a portion of information in the chasing request; and

in response to determining that the first device and the second device are the valid pair, granting the original request upon determining that the first device and the second device are the valid pair, and upon determining that the portion of the original request matches the portion of the chasing request; and

denying the original request upon determining either that the first device and the second device are not a valid pair, or that the portion of the original request matches the portion of the chasing request.

2. The method according to claim 1, wherein the first identifier comprises unique identification information that identifies the first device and wherein the second identifier comprises unique identification information that identifies the second device.

3. The method according to claim 1, wherein the first identifier comprises a unique identification number of the first device and wherein the second identifier comprises a unique identification number of the second device.

4. The method according to claim 1, wherein the first identifier comprises a unique hash value of the first device and wherein the second identifier comprises a unique hash value of the second device.

5. The method according to claim 1, wherein the responding to the original request comprises granting the first device access to content managed by the server.

6. The method according to claim 1, wherein the first device sends a first message to the second device subsequent to sending the original request to the server and wherein the first message requests the second device to send the chasing request.

7. The method according to claim 1, wherein the server sends a server message to the second device subsequent to receiving the original request from the first device and wherein the server message requests the second device to send the chasing request.

8. The method according to claim 1, wherein the portion of information in the original request and the portion of information in the chasing request match when content of the original request and content of the chasing request are the same.

9. The method according to claim 1, wherein the portion of information in the original request and the portion of information in the chasing request match when a hash value of the original request and a hash value of the chasing request are the same.

10. A system comprising:

a memory; and

one or more processors coupled to the memory and configured to;

receive a request from a first device to register the first device and a second device as paired devices, wherein the first device has a first identifier and first additional information and the second device has a second identifier and second additional information;

store the first identifier and the first additional information of the first device with the second identifier and the second additional information of the second device as a valid set;

receive an original request from the first device, wherein the original request includes the first identifier and the first additional information associated with the first device;

receive a chasing request from the second device, wherein the chasing request includes the second identifier and the second additional information associated with the second device;

determine whether the first device and the second device are the valid set based on the first identifier and first additional information in the original request and the second identifier and second additional information in the chasing request; and

in response to determining that the first device and the second device are the valid set respond to the original request from the first device.

11. The system according to claim 10, wherein the first additional information comprises encryption information of the first device and wherein the second additional information comprises encryption information of the second device.

12. The system according to claim 11, wherein the encryption information of the first device comprises one of a digital signature signed by a private key of the first device and a public key of the first device, and wherein the encryption information of the second device comprises one of a digital signature signed by a private key of the second device and a public key of the second device.

13. The system according to claim 12, wherein the one or more processors configured to determine whether the first device and the second device are the valid set further comprises one or more processors configured to:

determine whether the digital signature signed by the private key of the first device is valid using the public key of the first device; and

determine whether the digital signature signed by the private key of the second device is valid using the public key of the second device.

14. The system according to claim 10, wherein the one or more processors configured to determine whether the first device and the second device are the valid set comprises one or more processors configured to determine whether the first device and the second device are a valid pair based on the first identifier in the original request and the second identifier in the chasing request.

15. The system according to claim 10, wherein the one or more processors configured to determine whether the first device and the second device are the valid set comprises one or more processors configured to determine whether content of the original request and content of the chasing request match.

16. The system according to claim 10, wherein the one or more processors configured to determine whether the first device and the second device are the valid set comprises one or more processors configured to determine whether a hash value of the original request and a hash value of the chasing request match.

17. The system according to claim 10, wherein the first identifier comprises unique identification information that identifies the first device and wherein the second identifier comprises unique identification information that identifies the second device.

18. A method comprising:

receiving, by a server, a request from a first device to register the first device and a second device as paired devices, the first device having a first identifier and the second device having a second identifier;

storing the first identifier and the second identifier as a valid pair;

receiving an original request and a chasing request from the second device, wherein the original request includes the first identifier associated with the first device and wherein the chasing request includes the second identifier associated with the second device;

determining whether the first device and the second device are paired devices based on the first identifier in the original request and the second identifier in the chasing request;

in response to determining that the first identifier in the original request and the second identifier in the chasing request match the stored valid pair, determining that the first device and the second device are paired devices; and

responding to the original request.

19. The method according to claim 18, wherein prior to the receiving the original request and the chasing request from the second device, sending, by the first device, the original request to the second device.

20. The method according to claim 18, wherein the first identifier comprises unique identification information that identifies the first device and wherein the second identifier comprises unique identification information that identifies the second device.