Processing of communication device signatures for use in securing nomadic electronic transactions

• US 9,037,859 B2
• Filed: 08/02/2013
• Issued: 05/19/2015
• Est. Priority Date: 12/18/2008
• Status: Active Grant

• Current Assignee: BCE Incorporated
• Original Assignee: BCE Incorporated
• Inventors: O'Brien, William G., Murray, Sean MacLean, Yeap, Tet Hin
• Primary Examiner(s): Nalven, Andrew
• Assistant Examiner(s): Waliullah, Mohammed
• Application Number:
  US13/957,903
• Publication Number:
  US 20130318349A1
• Time in Patent Office: 655 Days
• Field of Search: None
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

A method for execution in a communication device, which comprises receiving a first data set and a second data set over a first communication path; receiving a series of requests over local communication path different from the first communication path; responding to a first one of the requests by releasing a first response including the first data set over the local communication path; and responding to a second one of the requests by releasing a second response including the second data set over the second communication path.

Claims

1. A method for execution in a communication device, comprising:

sending a first request to a server;

receiving, in response to the first request, a first plurality of data sets over a first communication path;

sending a second request to the server;

receiving, in response to the second request, a second plurality of data sets over the first communication path;

receiving a series of requests from a point of wireless access over a local communication path different from the first communication path, the series of requests including a third request and a fourth request, wherein the series of requests is received after having received the plurality of data sets, at least the third request being received during a transaction attempt carried out using the communication device;

responding to the third requests by releasing a first response to the point of wireless access over the local communication path including a first data set of the first plurality of data sets;

responding to the fourth requests by releasing a second response to the point of wireless access over the local communication path including a first data set of the second plurality of data sets, wherein the second response does not contain the first data set of the first plurality of data sets.

2. The method defined in claim 1, wherein the first data set comprises a first signature previously generated by encrypting with an encryption key (i) an identifier associated with the communication device;

and (ii) first additional data.

3. The method defined in claim 2, wherein the second data set comprises a second signature previously generated by encrypting the identifier and second additional data with the encryption key.

4. The method defined in claim 3, wherein the second additional data is related to the first data set by a function of time implemented by a control server, the function of time being unknown to the communication device.

5. The method defined in claim 4, wherein the function of time is deterministic.

6. The method defined in claim 4, wherein the function of time is stochastic.

7. The method defined in claim 1, further comprising accessing an identifier stored in a memory and including the identifier in the first and second responses.

8. The method defined in claim 1, wherein at least one of the first data set and the second data set is indicative of a transaction identifier generated by a control server in anticipation of the transaction attempt.

9. The method defined in claim 8, wherein at least one of the first data set and the second data set is indicative of a transaction identifier generated by a control server after being informed of the transaction attempt.

10. The method defined in claim 1, further comprising:

accessing an identifier stored in a memory;

receiving first additional data and second additional data over the first communication path;

generating a first signature from the identifier and the first additional data; and

generating a second signature from the identifier and the second additional data;

wherein the first response further includes the first signature and the identifier and wherein the second response further includes the second signature and the identifier.

11. The method defined in claim 1, wherein upon receipt, the first data set is included within first encrypted data obtained by encrypting the first data set using an encryption key and the second data set is included within second encrypted data obtained by encrypting the second data set using the encryption key, the method further comprising:

decrypting the first data set from the first encrypted data using a decryption key that is complementary to the encryption key, and

decrypting the second data set from the second encrypted data using the decryption key.

12. The method defined in claim 1, wherein the first data set is included within first encrypted data included in the first response and the second data set is included within second encrypted data included in the second response, the method further comprising

obtaining the first encrypted data by encrypting the first data set using an encryption key, wherein the first data set is capable of being decrypted from the first encrypted data by a decryption key that is complementary to the encryption key;

and

obtaining the second encrypted data by encrypting the second data set using the encryption key, wherein the second data set is capable of being decrypted from the second encrypted data by the decryption key.

13. The method defined in claim 12, wherein at least one of the first response and the second response includes a key index associated with the encryption key, the key index allowing a recipient of the first response to identify the decryption key from a set of potential decryption keys.

14. The method defined in claim 1, wherein the first one of the requests and the second one of the requests are received via a radio frequency receiver at the communication device.

15. The method defined in claim 14, wherein the radio frequency receiver operates in a frequency range that supports at least one of low-power short-range communication and RFID communication.

16. The method defined in claim 1, wherein the first data set and the second data set are distributed by a control server.

17. A non-transitory computer-readable storage medium comprising a set of instructions for execution by a processing entity of a communication device, wherein execution of the set of instructions by the processing entity causes the processing entity to execute a method that includes:

sending a first request to a server;

receiving, in response to the first request, a first plurality of data sets over a first communication path;

sending a second request to the server over the second communication path;

receiving, in response to the second request, a second plurality of data sets over the first communication path;

receiving a series of requests from a point of wireless access over a local communication path different from the first communication path, the series of requests including a third request and a fourth request, wherein the series of requests is received after having received the plurality of data sets, at least a first one of the requests being received during a transaction attempt carried out using the communication device;

responding to the third requests by releasing a first response to the point of wireless access over the local communication path including a first data set of the first plurality of data sets; and

responding to the fourth requests by releasing a second response to the point of wireless access over the local communication path including a first data set of the second plurality of data sets, wherein the second response does not contain the first data set of the first plurality of data sets.

18. A communication device, comprising:

a memory storing an identifier;

an interface configured to communicate over a first communication path and a local communication path different from the first communication path; and

a processing entity configured to;

send, via the interface, a first request to a server

receive, via the interface, in response to the first request, from the server, and over the first communication path, a first plurality of data sets;

send, via the interface, a second request to the server;

receive, via the interface, in response to the second request, from the server, and over the first communication path, a second plurality of data sets;

receive, via the interface, from a point of wireless access, and over the local communication path, a series of requests subsequent to receipt of the plurality of data sets, the series of requests including a third request and a fourth request, at least the third request being received during a transaction attempt carried out using the communication device;

respond to the third requests by releasing via the interface to the point of wireless access and over the local communication path a first response including a first data set of the first plurality of data sets; and

respond to the fourth request by releasing via the interface to the point of wireless access and over the local communication path a second response including a first data set of the second plurality of data sets, wherein the second response does not contain the first data set of the first plurality of data sets.

19. A mobile communication device comprising:

a memory storing an identifier associated with the mobile communication device;

an interface configured to communicate over a first communication path and over a short range RF communication path different from the first communication path; and

a processing entity configured to;

receive a first request from a point of sale or point of wireless access over the short range RF communication path;

send a second request via the first communication path subsequent to receiving the first request from point of sale or point of wireless access;

receive a data set via the first communication path as a response to the second request;

generate a response to be sent to the point of sale or point of wireless access over the short range RF communication path, the response representing the identifier and the data set received over the first communication path;

send the generated response to the point of sale or point of wireless access over the short range RF communication path;

receive a third request from the point of sale or point of wireless access over the short range RF communication path;

send a fourth request via the first communication path subsequent to receiving the third request from the point of sale or point of wireless access;

receive a second data set via the first communication path as a response to the fourth request;

generate a second response to be sent to the point of sale or point of wireless access over the short range RF communication path, the second response representing the identifier and the second data set received over the first communication path; and

send the second generated response to the point of sale or point of wireless access over the short range RF communication path.

20. The mobile communication device defined in claim 19, wherein the first communication path traverses the Internet, and wherein the short range RF communication path does not traverse the Internet.

21. The mobile communication device defined in claim 19, wherein the first data set is received via the first communication path substantially in real-time.

22. The mobile communication device defined in claim 19, wherein the third request from the point of sale or point of wireless access is received after the first generated response is sent to the point of sale or point of wireless access over the short range RF communication path.

23. The mobile communication device defined in claim 19, wherein the second request from the point of sale or point of wireless access is received at substantially the same time as the first request from the point of sale or point of wireless access.