Systems and methods for cross-layer secure connection set up

• US 9,628,585 B2
• Filed: 12/27/2011
• Issued: 04/18/2017
• Est. Priority Date: 12/27/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Gong, Michelle X., Boelter, Joshua
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): Ng, Billy H
• Application Number:
  US13/997,318
• Publication Number:
  US 20140244723A1
• Time in Patent Office: 1,939 Days
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/50 Secure pairing of devices

Abstract

Described herein are systems and methods for establishing a secure communications channel between electronic devices. In some embodiments, the secure data channel includes a secure layer 2 and a secure layer 3 connection between a client and a server. The secure layer 2 and secure layer 3 connections may be established using information transferred out of band between the client and server.

Claims

1. An apparatus comprising a processor and a memory, said memory having unified pairing protocol (UPP) instructions stored thereon, wherein said UPP instructions when executed by said processor cause said processor to perform the following operations comprising:

encoding out of band information to provide resulting encoded information, into at least one out of band transfer medium using an encoding format that controls a size of the resulting encoded information, said resulting encoded information including at least server network information and server datalink information wherein said server network information comprises a service set identifier, a network security type, a network password, and combinations thereof; and

wherein said server datalink information comprises an Internet Protocol (IP) address, a host name, a service identification, an operating system (OS) identifier (ID), a port number, and combinations thereof;

transferring said resulting encoded information using at least one out of band transfer medium;

establishing a secure layer 2 connection between said apparatus and at least one second device using at least said server network information contained in said resulting encoded information; and

establishing a secure layer 3 connection between said apparatus and said at least one second device using at least said server datalink information contained in said resulting encoded information, conducting at least one mutual authentication protocol between said apparatus and said at least one second device and conducting at least one man in the middle detection process between said apparatus and said at least one second device.

2. The apparatus of claim 1, wherein said at least one out of band transfer medium comprises at least one of a near field communication signal, a barcode, an audio signal, and combinations thereof, said apparatus further comprising at least one out of band transfer mechanism compatible with one or more of said at least one out of band transfer medium.

3. The apparatus of claim 1, wherein said UPP instructions are provisioned in said memory prior to establishing said secure layer 2 connection;

and

said UPP instructions when executed by said processor cause said processor to generate unique identifying indicia for said apparatus.

4. The apparatus of claim 1, wherein said memory further comprises at least one first application stored thereon, and said UPP instructions when executed by said processor cause said processor to conduct an application pairing process with said at least one second device so as to pair said at least one application with at least one second application executed on said at least one second device.

5. The apparatus of claim 1, wherein said UPP instructions when executed further cause said processor to negotiate at least one mutually supported out of band transfer medium with said at least one second device, said at least one mutually supported out of band transfer medium being supported by said apparatus and said at least one second device.

6. The apparatus of claim 1, wherein establishing said secure layer 3 connection comprises conducting at least one secure layer 3 handshake protocol between said apparatus and said at least one second device.

7. The apparatus of claim 1, wherein said encoding format utilizes at least symbolic identifiers.

8. The apparatus of claim 1 wherein said OS ID connotes an independent application, a part of an application that facilitates communication among multiple devices by leveraging the UPP and a graphical user interface (GUI).

9. A method comprising:

encoding out of band information to provide resulting encoded information, into at least one out of band transfer medium using an encoding format that controls a size of the resulting encoded information, said resulting encoded information including at least server network information and server datalink information wherein said server network information comprises a service set identifier, a network security type, a network password, and combinations thereof; and

wherein said server datalink information comprises an Internet Protocol (IP) address, a host name, a service identification, an operating system (OS) identifier (ID), a port number, and combinations thereof;

transferring said resulting encoded information between at least one client and at least one server using at least one out of band transfer medium;

establishing a secure layer 2 connection between said at least one client and said at least one server using said server network information contained in said resulting encoded information; and

establishing a secure layer 3 connection between said at least one client and said at least one server using said server datalink information contained in said resulting encoded information, conducting at least one mutual authentication protocol between an apparatus and at least one second device and conducting at least one man in the middle detection process between said apparatus and said at least one second device.

10. The method of claim 9, wherein said at least one out of band transfer medium comprises at least one of a near field communication signal, a barcode, an audio signal, and combinations thereof.

11. The method of claim 9, wherein said encoding said out of band information into said at least one out of band transfer medium is performed by said at least one server.

12. The method of claim 9, wherein:

prior to establishing said secure layer 2 connection, said at least one server is connected to at least one network; and

said server network information including information that is sufficient to enable said at least one client to connect to said at least one network.

13. The method of claim 9, wherein client side and server side unified pairing protocols are provisioned on said at least one client and said at least one server, respectively, prior to establishing said secure layer 2 connection.

14. The method of claim 13, further comprising:

generating unique client identifying indicia with client side unified pairing protocol; and

generating unique server identifying indicia with said client side unified pairing protocol.

15. The method of claim 9, wherein said at least one client comprises at least one client side application and said at least one server comprises at least one server side application, the method further comprising conducting an application pairing process to pair said at least one client side application with said at least one server side application.

16. The method of claim 9, further comprising:

negotiating at least one mutually supported out of band transfer medium, said at least one mutually supported out of band transfer medium being supported by said at least one client and said at least one server; and

selecting at least one mutually supported out of band transfer medium with said at least one server.

17. The method of claim 16, further comprising, enabling at least one server side and at least one client side out of band transfer mechanism corresponding to a mutually supported out of band transfer medium selected by said at least one server.

18. The method of claim 9, wherein establishing said secure layer 3 connection comprises conducting at least one secure layer 3 handshake protocol between said at least one client and said at least one server.

19. The method of claim 9 wherein said OS ID connotes an independent application, a part of an application that facilitates communication among multiple devices by leveraging the UPP and a graphical user interface (GUI).

20. At least one non-transitory computer readable medium having unified pairing protocol instructions stored thereon, which when executed by a processor cause the processor to perform the following operations comprising:

receiving out of band information from at least one server using at least one out of band transfer medium, said out of band information including at least server network information and server datalink information encoded using an encoding format that controls a size of the out of band information, wherein said server network information comprises a service set identifier, a network security type, a network password, and combinations thereof; and

wherein said server datalink information comprises an Internet Protocol (IP) address, a host name, a service identification, an operating system (OS) identifier (ID), a port number, and combinations thereof;

establishing a secure layer 2 connection with said at least one server using said server network information; and

establishing a secure layer 3 connection with said at least one server using said server datalink information contained in said encoded out of band information, conducting at least one mutual authentication protocol between an apparatus and at least one second device and conducting at least one man in the middle detection process between said apparatus and said at least one second device.

21. The at least one computer readable medium of claim 20, wherein said unified pairing protocol instructions when executed further cause said processor to perform the following operations comprising:

decoding said out of band information from said at least one out of band transfer medium.

22. The at least one computer readable medium of claim 20, wherein:

prior to establishing said secure layer 2 connection, said at least one server is connected to at least one network; and

said server network information including information that is sufficient to cause said at least one processor to connect to said at least one network, said server network information comprises at least one of a service set identifier, a network security type, a network password, and combinations thereof.

23. The at least one computer readable medium of claim 20, wherein said unified pairing protocol instructions when executed further cause said processor to perform the following operations comprising:

generating unique identifying indicia associated with a device of which the processor is a part; and

storing said unique identifying indicia in a memory of said device.

24. The at least one computer readable medium of claim 20, wherein said unified pairing protocol instructions when executed further cause said processor to perform the following operations comprising:

executing at least one client side application stored in a memory of a client device; and

conducting an application pairing process to pair said at least one client side application with at least one server side application executed on said at least one server.

25. The at least one computer readable medium of claim 20, wherein said unified pairing protocol instructions when executed further cause said processor to perform the following operations comprising:

negotiating at least one mutually supported out of band transfer medium with said at least one server, said at least one mutually supported out of band transfer medium being supported by at least one client and said at least one server;

enabling at least one client side out of band transfer mechanism corresponding to a mutually supported out of band transfer medium selected by said at least one server; and

receiving said out of band information from said at least one server using said at least one client side out of band transfer mechanism.

26. The at least one computer readable medium of claim 20, wherein establishing said secure layer 3 connection comprises conducting at least one secure layer 3 handshake protocol between at least one client and said at least one server, wherein establishing said secure layer 3 connection comprises conducting at least one mutual authentication protocol between said at least one client and said at least one server.

27. The at least one computer readable medium of claim 20 wherein said OS II) connotes an independent application, a part of an application that facilitates communication among multiple devices by leveraging the UPP and a graphical user interface (GUI).