Secure Pairing for Wired or Wireless Communications Devices

• US 20080320587A1
• Filed: 08/31/2005
• Published: 12/25/2008
• Est. Priority Date: 09/08/2004
• Status: Active Grant

• Current Assignee: Signify Holding B.V. (Signify N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Teuwen, Philippe, Vauclair, Marc, Serret Avila, Javier, Etienne, Lionel Georges
• Granted Patent: US 8,813,188 B2
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/21 for social networking applications

Abstract

Pairing is achieved between a host communications device and a peripheral communications device, in order to establish an ad hoc wireless or wired network. A device identification, relating uniquely to the peripheral device, is displayed on the host device. In order to accept the pairing, the user confirms that th.—device identification displayed on the host device matches that printed on the peripheral diwice, and then completes the pairing procedure by pressing a key on the peripheral device, or, if Near Field Communication (NFC) techniques are implemented in the devices, by placing the peripheral device in contact with, or sufficiently close to, the host device. Thus, secure pairing is achieved, without requiring a complex user interface on the peripheral device.

Claims

1. A method of pairing a trusted device and a second device, the method comprising:

receiving a request to pair the second device with a first device;

mutually authenticating the first device and the second device and obtaining from said first device a device identification relating to said first device;

putting the first device into a trusted mode in which it will not engage in a pairing procedure with any device other than the second device;

obtaining a device identification from the trusted device;

comparing the device identification from the trusted device with the device identification obtained in the authenticating step;

if the device identification relating to the first device matches the device identification obtained from the trusted device, determining that the first device is the trusted device and sending a pairing acceptance to the trusted device; and

pairing the trusted device and the second device in response to the receipt of a second pairing acceptance from a user entered into the trusted device.

2. A method as claimed in claim 1, wherein the step of obtaining a device identification from the trusted device comprises a user reading a device identification printed on the trusted device;

and wherein the step of comparing comprises a user visually comparing the device identification relating to the first device that is displayed on said second device and said device identification printed on the trusted device.

3. A method as claimed in claim 1, wherein the step of obtaining a device identification from the trusted device comprises:

activating a short range radio link between the trusted device and the second device; and

transmitting the device identification of the trusted device to the second device.

4. A method as claimed in claim 3, wherein the step of activating the short range radio link comprises physically touching the second device to the trusted device.

5. A method as claimed in claim 3, wherein the step of activating the short range radio link comprises moving the second device close to the trusted device.

6. A method as claimed in claim 3, wherein the short range radio link uses a Near Field Communication protocol.

7. A method as claimed in claim 3, wherein the device identification of the trusted device is stored in a RFID tag.

8. A method as claimed in claim 1, wherein the first and second devices:

establish a common secret key after or during the mutual authentication;

use the shared common secret key to ensure the authenticity and sequencing of subsequent messages between the first and second devices.

9. A method as claimed in claim 1, wherein the second pairing acceptance comprises a single keypress on the trusted device.

10. A method as claimed in claim 1, further comprising, after putting the first device into the trusted mode, notifying the second device that the first device will pair exclusively with the second device while first device is in the trusted mode.

11. A method as claimed in claim 1, the method comprising:

in response to receiving said request to pair the first and second devices, transmitting a beacon signal from said second device, wherein said beacon signal indicates the identification of said second device; and

in response to receiving said beacon signal from said second device, transmitting a response signal from said first device.

12. A method as claimed in claim 11, wherein the identification of said second device in said beacon signal is unique.

13. A method as claimed in claim 11, comprising generating said identification of said second device by means of a random process.

14. A method as claimed in claim 13, wherein said random process will only generate the same identification of said second device twice with negligible probability.

15. A method as claimed in claim 12, wherein said unique identification of said second device can be directly computed from the said second device authentication.

16. A method as claimed in claim 1, the method comprising after authenticating said first device, indicating on said first device that said first device is in a pairing procedure.

17. A method as claimed in claim 16, comprising indicating on said first device that said first device is in a pairing procedure, by means of a light on said first device.

18. A method as claimed in claim 1, wherein said device identification uniquely identifies said first device.

19. A method as claimed in claim 18, comprising generating said identification of said first device by means of a random process.

20. A method as claimed in claim 19, wherein said random process will only generate the same identification of said first device twice with negligible probability.

21. A method as claimed in claim 18, wherein said device identification can be directly computed from the said first device authentication.

22. A method as claimed in claim 1, further comprising establishing a secure ad hoc wireless communications network between said first and second devices.

23. A method as claimed in claim 22, comprising establishing a wireless USB connection between said first and second devices.

24. A peripheral communications device, comprising:

means for authenticating the peripheral device to a host device, and transmitting a peripheral device identification to said host device;

means for authenticating the said host device to the peripheral device, and receiving said host device identification;

means for putting the peripheral device into a trusted mode in which it will not engage in a pairing procedure with any device other than said host device;

means for receiving a pairing acceptance input from a user and for confirming pairing with said host device in response to the pairing acceptance input.

25. A peripheral device as claimed in claim 24, wherein the device further comprises a second means for transmitting the peripheral device identification to the host device, the second means using a short range radio link.

26. A peripheral device as claimed in claim 25, wherein the short range radio link uses a Near Field Communication protocol.

27. A peripheral device as claimed in claim 25, wherein the second means comprises a RFID tag.

28. A peripheral device as claimed in claim 24, wherein said peripheral device further comprises:

means for establishing a common secret key with said host device after or during the authentication with the said host device;

means for producing messages with the said secret key whose authenticity, integrity and sequencing can be verified by the said host device;

means for verifying the authenticity, integrity and sequencing of the messages produced by the host device with the said secret key;

29. A peripheral device as claimed in claim 24, wherein said peripheral device identification uniquely identifies said peripheral device.

30. A peripheral device as claimed in claim 24, wherein said peripheral device identification is a result of a random process.

31. A peripheral device as claimed in claim 30, wherein said random process will only generate the same peripheral device identification twice with negligible probability.

32. A peripheral device as claimed in claim 24, the device comprising means for receiving a beacon signal from said host device, and transmitting a response signal.

33. A peripheral device as claimed in claim 24, the device comprising means for indicating that said first device is in a pairing procedure, after completing said authentication.

34. A peripheral device as claimed in claim 33, wherein said means for indicating comprises a light on said peripheral device.

35. A peripheral device as claimed in claim 24, adapted for establishing a wireless USB connection with said host device.

36. A peripheral device as claimed in claim 24, adapted for establishing an Internet Protocol connection with said host device.

37. A peripheral device as claimed in claim 24, wherein the pairing acceptance input from a user comprises a single keypress.

38. A host communications device, comprising:

means for receiving a request to pair said host device with a peripheral device;

means for authenticating the peripheral device and obtaining from said peripheral device a device identification relating to said peripheral device;

means for authenticating to the peripheral device and transmitting a host device identification to said peripheral device;

means for displaying the device identification relating to said peripheral device; and

means for pairing the host and peripheral communications devices in response to the receipt of a pairing confirmation from the peripheral device and a host pairing acceptance from the user entered into the host device.

40. A host device as claimed in claim 38, wherein the means for obtaining comprises a means for establishing a short range radio link with the peripheral device.

41. A host device as claimed in claim 40, wherein the short range radio link uses a Near Field Communication protocol.

42. A host device as claimed in claim 38, wherein said host device further comprises:

means for establishing a common secret key with said peripheral device after or during the authentication with the said peripheral device;

means for producing messages with the said secret key whose authenticity, integrity and sequencing can be verified by the said peripheral device;

means for verifying the authenticity, integrity and sequencing of the messages produces by the peripheral device with the said secret key.

43. A host device as claimed in claim 38, wherein in response to receiving said request to pair the host and peripheral devices, said host device is adapted to transmit a beacon signal, wherein said beacon signal indicates the identification of said host device.

44. A host device as claimed in claim 38, wherein said device identification uniquely identifies said peripheral device.

45. A host device as claimed in claim 38, wherein said peripheral device identification is a result of a random process.

46. A host device as claimed in claim 45, wherein said random process will only generate the same peripheral device identification twice with negligible probability.

47. A host device as claimed in claim 38, wherein said host device identification uniquely identifies said host device.

48. A host device as claimed in claim 38, adapted for establishing a secure wireless USB connection with said peripheral device.

49. A host device as claimed in claim 38, adapted for establishing an Internet Protocol connection with said peripheral device.

50. A host device as claimed in claim 38, wherein the host device comprises a delegator device and a delegatee device, wherein the delegator device is adapted to forward a request to pair said host device with a peripheral device to the delegatee device, and wherein the delegatee device is adapted to perform at least a part of the pairing procedure on behalf of the delegator device.

39. A host communications device, comprising:

means for receiving a request to pair said host device with a peripheral device;

means for authenticating the peripheral device and obtaining from said peripheral device a device identification relating to said peripheral device;

means for authenticating to the peripheral device and transmitting a host device identification to said peripheral device;

means for obtaining a device identification relating to a trusted device; and

means for comparing the device identification relating to the peripheral device and the device identification relating to the trusted device;

means for pairing the host and peripheral devices in the event that the device identification relating to the peripheral device and the device identification relating to the trusted device match, and in response to the receipt of a pairing confirmation from the peripheral device.