Method and Apparatus to Create Trust Domains Based on Proximity

• US 20080222711A1
• Filed: 02/21/2008
• Published: 09/11/2008
• Est. Priority Date: 02/23/2007
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Michaelis, Oliver
• Granted Patent: US 8,522,019 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 88/18 Service support devices; Network management devices

Abstract

Devices and methods use close range communication links, e.g., near field communication (NFC) links, to authenticate communication devices to one another to create or join a new device to a trust domain. Once two devices establish a close range communication peer-to-peer link the devices exchange credential information that provide an infrastructure for the trust domain. Medium or long range wireless or wired network communication links can then be used for secure and trusted communications. Proximity limits of the close range communication P2P link enables mutual trust to be presumed among devices, providing added security to the process of extending a trust domain and reducing the need for security and authentication signaling. Embodiments provide a variety of methods for extending credential infrastructure among devices. Embodiments further enable simple to use virtual cables that can provide secure point-to-point communications that are configured merely by touching two communication devices together.

Claims

1. A method for deploying credential infrastructure, comprising:

establishing a close range communications link between a first device and a second device;

sending credential information across the close range communications link; and

using the credential information in communications between the first device and the second device transmitted via another communications link that is different from the close range communications link.

2. The method of claim 1, further comprising notifying a user of the receipt of the credential information.

3. The method of claim 1, further comprising confirming an identity of a user using another separate credential.

4. The method of claim 3, wherein the separate credential is a password.

5. The method of claim 3, wherein the separate credential is biometric data.

6. The method of claim 1, wherein the close range communication link is a near-field communication (NFC) protocol communication link.

7. The method of claim 1, further comprising sending a request to register with a trust domain from the first device to the second device,

wherein:

the second device is already a member of the trust domain; and

the credential information is used to secure communications within the trust domain.

8. The method of claim 7, further comprising:

forwarding the request to register with the trust domain from the second device to a trust domain administrator;

sending the credential information from the trust domain administrator to the second device,

wherein forwarding the credential information sending credential information across the close range communications link comprises the second device forwarding the received credential information to the first device across the close range communications link.

9. The method of claim 8, further comprising:

prompting a user of the second device to provide a separate credential to the trust domain administrator;

transmitting the separate credential to the trust domain administrator; and

verifying the separate credential at the trust domain administrator,

wherein the step of sending the credential information to the second device is accomplished in response to verifying the separate credential at the trust domain administrator.

10. The method of claim 1, further comprising:

sending a device credential from the first device to the second device; and

verifying the device credential,

wherein the step of sending credential information across the close range communications link is accomplished in response to verifying the device credential.

11. The method of claim 1, further comprising:

establishing a close range communications link between the first device and a third device; and

sending the credential information across the close range communications link from the first device to the third device.

12. A mobile device, comprising:

a processor;

a first transceiver coupled to the processor;

a second transceiver coupled to the processor, the second transceiver being a close range communication transceiver; and

a memory coupled to the processor,

wherein the processor is configured with software instructions to perform steps comprising;

establishing a close range communications link between the mobile device and a first communications device via the second transceiver;

receiving credential information from the first communications device over the close range communications link; and

using the credential information in communications between the mobile device and the first communications device using the first transceiver.

13. The mobile device of claim 12, wherein the processor is configured with software instructions to perform steps further comprising:

notifying a user of the mobile device of receipt of the credential information.

14. The mobile device of claim 12, wherein the processor is configured with software instructions to perform steps further comprising:

sending over the close range communication link a separate credential to the first communication device to identify a user of the mobile device.

15. The mobile device of claim 12, wherein the processor is configured with software instructions to perform steps further comprising:

receiving a password from a user of the mobile device; and

sending the password over the close range communication link to the first communication device.

16. The mobile device of claim 12, wherein the processor is configured with software instructions to perform steps further comprising:

receiving biometric data regarding a user of the mobile device; and

sending the biometric data over the close range communication link to the first communication device.

17. The mobile device of claim 12, further comprising a fingerprint scanner coupled to the processor,

wherein the processor is configured with software instructions to perform steps further comprising:

receiving fingerprint scan data from the fingerprint scanner; and

sending the fingerprint scan data over the close range communication link to the first communication device.

18. The mobile device of claim 12, wherein the processor is configured with software instructions to perform steps further comprising:

sending a request to register with a trust domain from the first device to the first communication device over the close range communication link.

19. The mobile device of claim 12, wherein the processor is configured with software instructions to perform steps further comprising:

sending a device credential of the mobile device to the first communications device over the close range communications.

20. The mobile device of claim 12, wherein the processor is configured with software instructions to perform steps further comprising:

establishing a close range communications link between the mobile device and a second communication device; and

sending the credential information across the close range communications link from the mobile device to the second communication device.

21. The mobile device of claim 20, wherein the processor is configured with software instructions to perform steps further comprising:

receiving a request to register with a trust domain from the second communication device;

forwarding the request to register to the first communication device;

receiving a request to provide a user credential to the first communication device to; and

sending the user credential to the first communication device.

22. A tangible storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform steps comprising:

establishing a close range communications link between the processor and a first communications device via the second transceiver;

receiving credential information from the first communications device over the close range communications link; and

using the credential information in communications between the processor and the first communications device transmitted via a communication link different from the close range communications link.

23. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

notifying a user of a device including the processor of receipt of the credential information.

24. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

sending over the close range communication link a separate credential to the first communication device to identify a user of a device including the processor.

25. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving a password from a user of a device including the processor; and

sending the password over the close range communication link to the first communication device.

26. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving biometric data regarding a user of a device including the processor; and

sending the biometric data over the close range communication link to the first communication device.

27. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving fingerprint scan data from a fingerprint scanner; and

sending the fingerprint scan data over the close range communication link to the first communication device.

28. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising sending a request to register with a trust domain from the first device to the first communication device over the close range communication link.

29. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising sending a device credential of a device including the processor to the first communications device over the close range communications.

30. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

establishing a close range communications link between the mobile device and a second communication device; and

sending the credential information across the close range communications link from the mobile device to the second communication device.

31. The tangible storage medium of claim 22, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving a request to register with a trust domain from the second communication device;

forwarding the request to register to the first communication device;

receiving a request to provide a user credential to the first communication device to; and

sending the user credential to the first communication device.

32. A mobile device, comprising:

means for establishing a close range communications link between the mobile device and a first communications device;

means for receiving credential information from the first communications device over the close range communications link; and

means for using the credential information in communications between the mobile device and the first communications device transmitted via another communications link that is different from the close range communications link.

33. The mobile device of claim 32, further comprising means for notifying a user of the mobile device of receipt of the credential information.

34. The mobile device of claim 32, further comprising means for sending over the close range communication link a separate credential to the first communication device to identify a user of the mobile device.

35. The mobile device of claim 32, further comprising:

means for receiving a password from a user of the mobile device; and

means for sending the password over the close range communication link to the first communication device.

36. The mobile device of claim 32, further comprising:

means for receiving biometric data regarding a user of the mobile device; and

means for sending the biometric data over the close range communication link to the first communication device.

37. The mobile device of claim 32, further comprising:

means for scanning a finger print of a user to obtain fingerprint scan data; and

means for sending the fingerprint scan data over the close range communication link to the first communication device.

38. The mobile device of claim 32, further comprising means for sending a request to register with a trust domain from the first device to the first communication device over the close range communication link.

39. The mobile device of claim 32, further comprising means for sending a device credential of the mobile device to the first communications device over the close range communications.

40. The mobile device of claim 32, further comprising:

means for establishing a close range communications link between the mobile device and a second communication device; and

means for sending the credential information across the close range communications link from the mobile device to the second communication device.

41. The mobile device of claim 32, further comprising:

means for receiving a request to register with a trust domain from the second communication device;

means for forwarding the request to register to the first communication device;

means for receiving a request to provide a user credential to the first communication device to; and

means for sending the user credential to the first communication device.

42. A computer, comprising:

a processor,

a first transceiver coupled to the processor;

a second transceiver coupled to the processor, the second transceiver being a close range communication transceiver;

a memory coupled to the processor; and

a network interface coupled to the processor,

wherein the processor is configured with software instructions to perform steps comprising;

establishing a close range communications link between the computer and a first communications device via the second transceiver;

providing credential information to the first communications device over the close range communications link; and

using the credential information in communications between the mobile device and the first communications device using the first transceiver.

43. The computer of claim 42, wherein the processor is configured with software instructions to perform steps further comprising:

receiving over the close range communication link from the first communication device a separate credential identifying a user of the first communication device; and

verifying the separate credential prior to providing the credential information to the first communication device.

44. The computer of claim 43, wherein:

the separate credential is a password; and

verifying the separate credential comprises comparing the password to a list of passwords of users authorized to register devices with a trust domain.

45. The computer of claim 43, wherein:

the separate credential is biometric data; and

verifying the separate credential comprises comparing the received biometric data to biometric data of users authorized to register devices with a trust domain.

46. The computer of claim 42, wherein the processor is configured with software instructions to perform steps further comprising:

receiving via the first transceiver or the network interface a request to register a second communication device with the trust domain;

sending via the first transceiver or the network interface a request to the first communication device for a separate credential related to the first communication device;

receiving the separate credential via the first transceiver or the network interface;

verifying the separate credential; and

sending the credential information via the first transceiver or the network interface to the first communication device for relay to the second communication device if the separate credential is verified.

47. The computer of claim 42, wherein the computer is a server coupled to a network.

48. The computer of claim 47, wherein the server is configured as a certificate administrator.

49. The computer of claim 42, wherein the computer is a medical device.

50. A tangible storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform steps comprising:

establishing a close range communications link between the processor and a first communications device via the second transceiver;

sending credential information to the first communications device over the close range communications link; and

using the credential information in communications between the processor and the first communications device transmitted via a communication link different from the close range communications link.

51. The tangible storage medium of claim 50, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving over the close range communication link from the first communication device a separate credential identify a user of the first communication device; and

verifying the separate credential prior to providing credential information to the first communication device.

52. The tangible storage medium of claim 50, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving over the close range communication link from the first communication device a password; and

verifying the password by comparing the password to a list of passwords of users authorized to register devices with a trust domain prior to providing credential information to the first communication device.

53. The tangible storage medium of claim 50, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving over the close range communication link from the first communication device biometric data; and

verifying the biometric data by comparing the biometric data to biometric data of users authorized to register devices with a trust domain prior to providing the credential information to the first communication device.

54. The tangible storage medium of claim 50, wherein the tangible storage medium has processor-executable software instructions configured to cause a processor to perform further steps comprising:

receiving a request to register a second communication device with the trust domain;

sending a request to the first communication device for a separate credential related to the first communication device;

receiving the separate credential;

verifying the separate credential; and

sending the credential information to the first communication device for relay to the second communication device if the separate credential is verified.

55. A computer, comprising:

means for establishing a close range communication link between the computer and a first communications device;

means for providing credential information to the first communications device over the close range communications link; and

means for using the credential information in communications between the mobile device and the first communications device transmitted via another communications link that is different from the close range communications link.

56. The computer of claim 55, further comprising:

means for receiving over the close range communication link from the first communication device a separate credential identifying a user of the first communication device; and

means for verifying the separate credential prior to providing the credential information to the first communication device.

57. The computer of claim 55, wherein the separate credential is a password, further comprising means for verifying the separate credential comprises comparing the password to a list of passwords of users authorized to register devices with a trust domain.

58. The computer of claim 55, wherein the separate credential is biometric data, further comprising means for verifying the separate credential comprises comparing the received biometric data to biometric data of users authorized to register devices with a trust domain.

59. The computer of claim 55, further comprising:

means for receiving a request to register a second communication device with the trust domain;

means for sending a request to the first communication device for a separate credential related to the first communication device;

means for receiving the separate credential;

means for verifying the separate credential; and

means for sending the credential information to the first communication device for relay to the second communication device if the separate credential is verified.

60. The computer of claim 55, further comprising a means for connecting to a network, wherein the computer is configured as a server.

61. A medical monitoring system, comprising:

a computer including

a computer processor;

a memory coupled to the processor;

a first transceiver coupled to the processor; and

a second transceiver coupled to the processor, the second transceiver being a close range communication transceiver,

wherein the computer processor is configured with software instructions to perform steps comprising;

establishing a close range communications link between the computer and a first communications device via the second transceiver,

providing credential information to the first communications device over the close range communications link, and

using the credential information in communications between the mobile device and the first communications device using the first transceiver;

a medical device including

a processor;

a third transceiver coupled to the processor; and

a fourth transceiver coupled to the processor, the fourth transceiver being a close range communication transceiver,

wherein the processor is configured with software instructions to perform steps comprising;

establishing a close range communications link between the medical device and computer via the fourth transceiver;

receiving credential information from the computer over the close range communications link; and

using the credential information in communications between the medical device and the computer using the third transceiver.

62. The medical monitoring system of claim 61, further comprising a hospital server comprising:

a server processor; and

a network connection circuit coupled to a network and configured to send signals to and receive data from the computer,

wherein the server processor is configured with software instructions to perform steps comprising;

providing credential information to the computer via the network; and

using the credential information in communications between the server and the computer via the network.

63. A virtual cable device, comprising:

a cable connector plug configured to establish an electrical connection with a cable socket;

a processor electronically coupled to the cable connector plug;

a wireless network transceiver coupled to the processor; and

a near-field communication wireless transceiver coupled to the processor,

wherein the processor is configured with software instructions to perform steps comprising;

establishing a near-field communication link between the virtual cable device and another communication device via the near-field communication wireless transceiver;

receiving credential information from the other communications device over the near-field communication link; and

using the credential information in communications between the virtual cable device and the other communication device using the wireless network transceiver.

64. The virtual cable device of claim 63, wherein the processor is configured with software instructions to perform steps further comprising:

communicating information received via the wireless network transceiver from the other communication device to a second device into which the cable connector plug is inserted.

65. The virtual cable device of claim 63, wherein the processor is configured with software instructions to perform steps further comprising:

communicating information received via the cable connector plug from a second device into which the cable connector plug is inserted to the other communication device via the wireless network transceiver.

66. The virtual cable device of claim 63, wherein the other communication device is another virtual cable device.

67. A virtual cable device, comprising:

means for wireless communicating data to a wireless network;

means for establishing a near-field communication link between the virtual cable device and another communication device via the near-field communication wireless transceiver;

means for receiving credential information from the other communications device over the near-field communication link; and

means for using the credential information in communications between the virtual cable device and the other communication device using the means for wireless communicating data to a wireless network.

68. The virtual cable device of claim 67, further comprising:

means for communicating information received via the first transceiver from the other communication device to a second device into which the cable connector plug is inserted.

69. The virtual cable device of claim 67, further comprising:

means for communicating information received via the cable connector plug from a second device into which the cable connector plug is inserted to the other communication device via the means for wireless communicating data to a wireless network.

70. A system, comprising:

a network;

a first communication device including a first transceiver and a second transceiver, wherein the first transceiver is configured to communicate via the network, and the second transceiver is a close range communication transceiver; and

a second communication device including a third transceiver and a fourth transceiver, wherein the third transceiver is configured to communicate via the network, and the fourth transceiver is a close range communication transceiver,

wherein the first and second communication devices are configured to

establish a close range communications link between the first and second communication devices via the second and fourth transceivers;

exchange credential information between the first and second communication devices via the close range communications link; and

establish communications between the first and second communication devices via the first and third transceivers based on the exchanged credential information.