System and method for using a separate device to facilitate authentication

• US 9,742,771 B2
• Filed: 01/25/2016
• Issued: 08/22/2017
• Est. Priority Date: 11/25/2012
• Status: Active Grant

• Current Assignee: Fred H. Smith
• Original Assignee: ANGEL Secure Networks, Inc.
• Inventors: Smith, Fred Hewitt, Smith, Cynthia
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): BELL, KALISH K
• Application Number:
  US15/005,688
• Publication Number:
  US 20160142416A1
• Time in Patent Office: 575 Days
• Field of Search: 709217, 709225, 709229, 709232, 726 2- 4, 726 16, 726 17, 726 21, 726 26- 29
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A system that incorporates the subject disclosure may perform, for example, operations including receiving a request from a first device to access information content of a second device. The process further includes forwarding a token to the second device by way of a second wireless network, to obtain a second device token, and forwarding the token to the first device by way of the first network to obtain a first device token, wherein the first device forwards the first device token to the second device by way of a third network. A confirmation that the token was received at the first device is based on the result of the comparison indicating a match between the first device token and the second device token. Access to the information content of the second device is authorized in response to the confirmation. Other embodiments are disclosed.

Claims

1. A method comprising:

receiving, by a server comprising a processor, a request from a mobile communication device of a user to allow user access to an application program of a separate device, wherein the request is received by way of a first network;

forwarding, by the server, a token to the separate device by way of a second network, to obtain a separate device token, and forwarding, by the server, the token to the mobile communication device by way of the first network to obtain a mobile communication device token, wherein the mobile communication device forwards the mobile communication device token to the separate device by way of a third network;

determining, by the server, a result of a comparison between the separate device token and the mobile communication device token;

confirming, by the server, that the mobile communication device token was received at the separate device, based on the result of the comparison indicating a match between the mobile communication device token and the separate device token; and

authorizing, by the server, access to the application program of the separate device in response to the confirming that the mobile communication device token was received at the separate device.

2. The method of claim 1, wherein the first network comprises a cellular mobile network and wherein the third network comprises a proximity network comprising one of a near field communications protocol, a mobile personal area network protocol, a Bluetooth personal area network protocol, or a wireless local area network protocol.

3. The method of claim 1, further comprising determining, by the server, a valid encryption key in response to the confirming that the mobile communication device token was received at the separate device,

wherein the authorizing of the access to the application program is in response to the determining of the valid encryption key and the confirming that the mobile communication device token was received at the separate device,

wherein the valid encryption key is unknown by the mobile communication device and the separate device, and wherein the valid encryption key is unknown by the server before the receiving of the request from the mobile communications device, and

wherein the separate devices comprises a vehicle remotely pilotable by way of the mobile communication device.

4. The method of claim 3, further comprising forwarding the valid encryption key to the separate device,

wherein the valid encryption key is used to encrypt one of data related to the application program or communications between the separate device and one of the mobile communication device, the server or both, and

wherein the vehicle comprises a ground vehicle.

5. The method of claim 3, wherein the determining of the valid encryption key is based on an execution of a plurality of agent modules on a plurality of processors to obtain a plurality of cryptographic materials that when combined determine the valid encryption key.

6. The method of claim 5, wherein the executing of the plurality of agent modules comprises determining that one or more of the mobile communication device, the separate device and the server is in a safe state,

wherein the plurality of cryptographic materials that when combined determine the valid encryption key responsive to the determining that the one or more of the mobile communication device, the separate device and the server is in the safe state.

7. The method of claim 6, wherein the determining that the one or more of the mobile communication device, the separate device and the server is in a safe state based on a predetermined state of the one or more of the mobile communication device, the separate device and the server.

8. The method of claim 6, further comprising accessing, by the server, a configuration file that specifies the plurality of agent modules and a plurality of conditions identifying the safe state.

9. The method of claim 8, further comprising:

encrypting, by the server, the token based on the valid encryption key; and

transferring, by the server, the valid encryption key to one or more of the mobile communication device, the separate device or the server,

wherein a successful decryption of the token on the one or more of the mobile communication device, the separate device or the server based on the valid encryption key indicates that a system of one or more of the mobile communication device, the separate device and the server is in a safe state according to a predetermined safe state of a network definition file.

10. The method of claim 6, further comprising:

identifying, by the server, the plurality of agent modules;

installing, by the server, the plurality of agent modules on one or more of the mobile communication device, the separate device or the server; and

executing, by the server, the plurality of agent modules on the one or more of the mobile communication device, a separate device or the server.

11. The method of claim 10, wherein the identifying of the plurality of agent modules, the installing of the plurality of agent modules, and the executing of the plurality of agent modules are responsive to the receiving of the request.

12. A system comprising:

a server comprising a processing system including a processor; and

a memory that stores executable instructions that when executed by the processing system, facilitate performance of operations comprising;

receiving, by way of a first network, a request from a mobile communication device of a user to provide user access to an application program of a another device;

forwarding a token to the another device by way of a second network, to obtain another device token, and forwarding the token to the mobile communication device by way of the first network to obtain a mobile communication device token, wherein the mobile communication device forwards the mobile communication device token to the another device by way of a third network;

determining, by the server, a result of a comparison between the another device token and the mobile communication device token;

confirming that the token was received at the mobile communication device, based on the result of the comparison indicating a match between the mobile communication device token and the another device token; and

authorizing access to the application program of the another device in response to the confirming that the mobile communication device token was received at the another device.

13. The system of claim 12, wherein the first network comprises a cellular mobile network

wherein the another devices comprises an unpiloted drone, and

wherein the third network comprises a proximity network comprising one of a near field communications protocol, a mobile personal area network protocol or a wireless local area network protocol.

14. The system of claim 13, wherein the unpiloted drone is remotely operated by way of a remote control, the operations further comprising:

identifying a valid encryption key determined in response to the confirming that the mobile communication device token was received at the another device,

wherein the authorizing of the access to the application program is in response to the determining of the valid encryption key and the confirming that the mobile communication device token was received at the another device, and

wherein the valid encryption key is unknown by the mobile communication device and the another device, and wherein the valid encryption key is unknown by the server before the receiving of the request from the mobile communications device.

15. The system of claim 14, wherein the identifying of the valid encryption key comprises determining the valid encryption key based on an execution of a plurality of agent modules on a plurality of processors to obtain a plurality of cryptographic materials that when combined determine the valid encryption key.

16. The system of claim 15, wherein the executing of the plurality of agent modules comprises determining that one or more of the mobile communication device, the another device and the server is in a safe state, and

wherein the plurality of cryptographic materials that when combined determine the valid encryption key responsive to the determining that the one or more of the mobile communication device, the another device and the server is in the safe state.

17. The system of claim 16, wherein the determining that the one or more of the mobile communication device, the another device and the server is in a safe state based on a predetermined state of the one or more of the mobile communication device, the another device and the server, and wherein the another device comprises a ground vehicle.

18. A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:

receiving a request from a first device of a user, by way of a first wireless network, to access information content of a second device;

forwarding a token to the second device by way of a second wireless network, to obtain a second device token, and forwarding the token to the first device by way of the first wireless network to obtain a first device token, wherein the first device forwards the first device token to the second device by way of a third network;

determining a result of a comparison between the second device token and the first device token;

confirming that the token was received at the first device based on the result of the comparison indicating a match between the first device token and the second device token; and

authorizing access to the information content of the second device in response to confirming that the token was received at the first device,

wherein the second device comprises a remotely pilotable vehicle.

19. The non-transitory machine-readable storage medium of claim 18, further comprising identifying a valid encryption key determined in response to the confirming that the first device token was received at the second device,

wherein the authorizing of the access to the information content is in response to the determining of the valid encryption key and the confirming that the first device token was received at the second device, and

wherein the valid encryption key is unknown by the first device and the second device.

20. The non-transitory machine-readable storage medium of claim 19, wherein the identifying of the valid encryption key comprises determining the valid encryption key based on an execution of a plurality of agent modules on a plurality of processors to obtain a plurality of cryptographic materials that when combined determine the valid encryption key.