System and method for establishing secondary channels

• US 7,426,271 B2
• Filed: 04/25/2003
• Issued: 09/16/2008
• Est. Priority Date: 04/25/2003
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Conley, Kenneth W., Balfanz, Dirk, Pendleton, Bryan A., Smetters, Diana K., Durfee, Glenn E.
• Primary Examiner(s): Vu, Kimyen
• Assistant Examiner(s): Pich, Ponnoreay
• Application Number:
  US10/424,191
• Publication Number:
  US 20040215974A1
• Time in Patent Office: 1,971 Days
• Field of Search: 709/227, 380/33
• US Class Current: 380/33
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A method for establishing a secondary communication channel between at least two computing devices over a network medium through use of a primary channel connects a first computing device with a first telephonic unit and a second computing device with a second telephonic unit. If the two telephonic units are in communication with each other over a primary channel, and communication channels are established between the computing devices and their respective telephonic units, then the first computing device transmits its location information to the second computing device over the primary channel. A connection is then established between the second computing device and the first computing device over a secondary communication channel.

Claims

1. A method for establishing a secondary communication channel between at least two computing devices over a network medium, comprising:

connecting a first computing device with a first telephonic unit over a primary low-bandwidth channel, wherein said primary low-bandwidth channel is a location-limited channel with the following properties;

human operators can control which devices are communicating with each other,

transmission is physically limited,

pre-authentication information is authentic,

eavesdropping is possible, but information injection can be detected by communicating parties, and

eavesdroppers on the location-limited channel are not able to create connections with the secondary communication channel;

connecting a second computing device with a second telephonic unit;

determining whether said first telephonic unit is in communication over said primary low-bandwidth channel with said second telephonic unit;

transmitting a network address of said first computing device to said second computing device over said primary low-bandwidth channel, wherein the second computing device does not have knowledge of the first computing device'"'"'s network address prior to the transmission; and

creating a one-to-one secondary communication channel between said second computing device and said first computing device through the Internet.

2. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of said computing devices connects to one of said first and second telephonic units utilizing Bluetooth technology.

3. The method for establishing a secondary communication channel between at least two computing devices over a network mediumaccording to claim 1, further comprising establishing a secure connection between said first computing device and said second computing device over said secondary communication channel.

4. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 3, wherein establishing the secure connection comprises:

transmitting a first security token from said first computing device to said second computing device over said primary low-bandwidth channel;

transmitting a second security token from said second computing device to said first computing device over said secondary channel;

verifying that said second security token sent over said secondary channel matches said first security token sent over said primary low-bandwidth channel;

continuing communication if said first security token and said second security token are in agreement; and

terminating communication if said first security token and said second security token are not in agreement.

5. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein said secondary communication channel between said second computing device and said first computing device is created by said second computing device by utilizing the network address sent by said first computing device over said primary low-bandwidth channel.

6. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, further comprising transmitting the network address of said second computing device to said first computing device over said primary low-bandwidth channel.

7. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 6, wherein said secondary communication channel between said second computing device and said first computing device is created by both said first computing device and said second computing device by utilizing the network addresses sent by said first computing device and said second computing device over said primary low-bandwidth channel.

8. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, further comprising:

transmitting a public key commitment from said first computing device over said primary low-bandwidth channel to said second computing device;

transmitting a public key commitment from said second computing device over said primary low-bandwidth channel to said first computing device;

transmitting a public key commitment from said f-r-era-first computing device over said secondary channel to said second computing device;

transmitting a public key commitment from said second computing device over said secondary channel to said first computing device;

determining whether said public key commitments received over said primary low-bandwidth channel match said public key commitments received over said secondary channel;

continuing communication if said public key commitments received over said primary low-bandwidth channel match said public key commitments received over said secondary channel; and

terminating communication if said public key commitments are not in agreement.

9. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein said primary low-bandwidth channel comprises an audio channel.

10. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein said primary low-bandwidth channel comprises a data channel.

11. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of the computing devices comprises a personal digital assistant having cell phone and Internet connectivity.

12. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of the computing devices comprises a table-top computer with wired connection.

13. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of the computing devices comprises a video-conference camera with internet connectivity.

14. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of said computing devices connects to one of said first and second telephonic units utilizing an 802.11 link.

15. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of said computing devices connects to one of said first and second telephonic units utilizing an analog headset connection.

16. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of said computing devices connects to one of said first and second telephonic units utilizing a serial connection.

17. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of said computing devices connects to one of said first and second telephonic units utilizing aerial acoustic technology.

18. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein at least one of said computing devices and at least one of said first and second telephonic units comprise a single, integrated device.

19. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein not less than one of said first and second telephonic units comprises a walkie-talkie.

20. The method for establishing a secondary communication channel between at least two computing devices over a network medium according to claim 1, wherein not less than one of said first and second telephonic units comprises a cellular telephone.

21. An article of manufacture comprising a computer usable medium having computer readable program code embodied in said medium which, when said program code is executed by said computer causes said computer to perform method steps for establishing a secondary communication channel between at least two computing devices over a network medium, said method comprising:

connecting a first computing device with a first telephonic unit over a primary low-bandwidth channel, wherein said primary low-bandwidth channel is a location-limited channel with the following properties;

human operators can control which devices are communicating with each other;

transmission is physically limited,

pre-authentication information is authentic,

eavesdropping is possible, but information injection can be detected by communicating parties, and

eavesdroppers on the location-limited channel are not able to create connections with the secondary communication channel;

connecting a second computing device with a second telephonic unit;

determining whether said first telephonic unit is in communication over a primary low-bandwidth channel with a second telephonic unit;

transmitting the network address of said first computing device to said second computing device over said primary low-bandwidth channel, the second computing device does not have knowledge of the first computing device'"'"'s network address prior to the transmission; and

creating a one-to-one secondary communication channel between said second computing device and said first computing device through the Internet.