SYSTEMS, METHODS, AND DEVICES FOR SECURE DEVICE-TO-DEVICE DISCOVERY AND COMMUNICATION

• US 20160269185A1
• Filed: 09/23/2015
• Published: 09/15/2016
• Est. Priority Date: 03/13/2015
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Intel IP Corporation (Intel Corporation)
• Inventors: Stojanovski, Alexandre S., Adrangi, Farid
• Granted Patent: US 9,893,894 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3252 using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 76/14 Direct-mode setup
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A user equipment (UE) is configured to send a direct communication request to a peer UE, wherein the direct communication request comprises a signature authenticating an identity of the UE. The UE is configured to process a direct communication response from the peer UE to authenticate an identity of the peer UE, wherein the direct communication response comprises a signature authenticating the identity of the peer UE. In response to processing the direct communication response from the peer UE to authenticate the identity of the peer UE, the UE is configured to engage in direct communication with the peer UE.

Claims

1. User equipment (UE) configured to:

send a direct communication request to a peer UE, wherein the direct communication request comprises a first signature authenticating an identity of a user of the UE;

process a direct communication response from the peer UE to authenticate an identity of the peer UE, wherein the direct communication response comprises a second signature authenticating the identity of a user of the peer UE; and

in response to processing the direct communication response from the peer UE to authenticate the identity of the peer UE, engage in direct communication with the peer UE.

2. The UE of claim 1, wherein one or more of the first signature authenticating the identity of the user of the UE and the second signature authenticating the identity of the user of the peer UE comprise a signature based on an Elliptic Curve-based Certificateless Signatures for Identity-based Encryption (ECCSI) signature scheme.

3. The UE of claim 1, wherein one or more of the direct communication request and the direct communication response comprise messages for establishment of a secure layer-2 link between the UE and the peer UE.

4. The UE of claim 1, wherein the UE is further configured to agree on common key material for communication between the UE and the peer UE, wherein the common key material is used for encoding or decoding communications between the UE and the peer UE.

5. The UE in claim 4, wherein the UE is configured to agree on the common key material by transmitting the common key material to the peer UE or receiving the common key material from the peer UE, wherein the common key material is generated and communicated between the UE and the peer UE based on the Sakai-Kasahara Key Encryption (SAKKE) scheme.

6. The UE in claim 5, wherein the common key material is included as part of a SAKKE payload within the direct communication request or the direct communication response.

7. The UE of claim 1, wherein one or more of the first signature authenticating the identity of the user of the UE and the second signature authenticating the identity of the user of the peer UE is computed over one or more other parameters in a corresponding message for message integrity protection.

8. A mobile communication device comprising:

a discovery component configured to receive a device-to-device discovery message comprising a signature authenticating an identity of a source mobile communication device;

an authentication component configured to

verify the identity of the source mobile communication device based on the signature, and

send or receive a message comprising a shared secret value; and

a security component configured to encrypt or decrypt one or more communications between the mobile communication device and the source mobile communication device using the shared secret value.

9. The mobile communication device of claim 8, wherein the device-to-device discovery message comprises one or more of a discovery announcement message, a discovery solicitation message, and a discovery response message.

10. The mobile communication device of claim 8, wherein the signature authenticating the identity of the source mobile communication device comprises a signature based on an Elliptic Curve-based Certificateless Signatures for Identity-based Encryption (ECCSI) signature scheme.

11. The mobile communication device of claim 10, wherein the authentication component is configured to verify the signature based on a public authentication key received from a key management service.

12. The mobile communication device of claim 8, wherein the message comprising the shared secret value comprises a Sakai-Kasahara Key Encryption (SAKKE) payload, wherein the SAKKE payload comprises the shared secret value encoded based on the SAKKE scheme.

13. The mobile communication device of claim 12, wherein the message comprising the shared secret value comprises a direct communication request or a direct communication response for establishment of secure physical-layer link.

14. The mobile communication device of claim 12, wherein the message comprising the shared secret value comprises a discovery message.

15. The mobile communication device of claim 8, wherein the device-to-device discovery message further comprises a user identity corresponding to the source mobile communication device, wherein the authentication component is configured to verify the user identity based on the signature.

16. A baseband processor comprising logic configured to:

discover one or more proximal user equipment (UE);

format a message comprising a payload authenticating an identity of a user corresponding to the baseband processor to send to at least one of the one or more proximal UE;

authenticate an identity of a user of the at least one of the one or more proximal UEs; and

communicate directly with the at least one of the one or more proximal UEs.

17. The baseband processor of claim 16, wherein the message comprising the payload comprises one of a discovery announcement message, a discovery solicitation message, and a discovery response message.

18. The baseband processor of claim 16, wherein the message comprises a message to establish direct communication between a UE corresponding to the baseband processor and the at least one of the one or more proximal UE.

19. The baseband processor of claim 16, wherein the logic is further configured to determine a secret key for communication between the at least one proximal UE and a UE corresponding to the baseband processor, wherein the logic is configured to encode or decode communications between the at least one proximal UE and a UE corresponding to the baseband processor based on the secret key.

20. The baseband processor of claim 16, wherein the payload comprises the identity of the user corresponding to the baseband processor and a signature based on an Elliptic Curve-based Certificateless Signatures for Identity-based Encryption (ECCSI) signature scheme.