Automated Secure Pairing for Wireless Devices

• US 20120094635A1
• Filed: 12/22/2011
• Published: 04/19/2012
• Est. Priority Date: 10/31/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ananthanarayanan, Ganesh, Blagsvedt, Sean, Venkatesan, Ramarathnam
• Granted Patent: US 8,989,706 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Systems, methods, and/or techniques (“tools”) are described herein that relate to automated secure pairing for devices, and that relate to parallel downloads of content using devices. The tools for pairing the devices may perform authentication protocols that are based on addresses and on keys. The address-based authentication protocol may operate on address book entries maintained by the devices. The key-based authentication protocol may operate using a key exchange between the devices.

Claims

1. A method for pairing at least two devices, the method comprising:

performing, via a direct connection between the at least two devices, a first authentication protocol including;

receiving a pairing request that includes an identifier; and

comparing the identifier to entries previously stored in an address book;

performing, via an indirect connection between the at least two devices, a second authentication protocol including;

generating a randomly generated nonce using a security key;

encrypting the randomly generated nonce using the security key;

sending a challenge that includes the encrypted randomly generated nonce;

receiving a challenge response that includes the randomly generated nonce that is decrypted; and

comparing the randomly generated nonce that is decrypted and received in the challenge response to the randomly generated nonce that is generated; and

determining to accept the pairing request based in part on whether the identifier coincides with at least one of the entries stored in the address book and the randomly generated nonce that is decrypted matches the randomly generated nonce that is generated based at least in part on the comparing.

2. The method as recited in claim 1, wherein the direct connection includes a direct Bluetooth or WiFi communication link established between the devices.

3. The method as recited in claim 1, wherein the indirect connection uses a third-party communication service.

4. The method as recited in claim 1, wherein the second authentication protocol is performed over an SMS link established between the devices via the indirect connection.

5. The method as recited in claim 1, wherein the identifier is a hashed identifier.

6. The method as recited in claim 5, wherein the previously stored address book entries are hashed.

7. The method as recited in claim 1, wherein the at least one of the at least two devices is a wireless handheld device.

8. The method as recited in claim 1, the first authentication protocol further including:

sending a second challenge via the direct connection in response to the pairing request;

receiving a second challenge response via the direct connection;

determining if the second challenge response is valid; and

determining to accept the pairing request further based in part on whether the second challenge response is valid.

9. The method as recited in claim 1, wherein the challenge is sent in response to the receiving the pairing request.

10. The method as recited in claim 1, the second authentication protocol further including:

receiving an authentication request via the indirect connection; and

receiving, generating or determining the security key based in part on the authentication request.

11. The method as recited in claim 1, the second authentication protocol further including:

receiving a secret number via the indirect connection; and

receiving, generating or determining the security key based in part on the secret number.

12. A computer-readable storage media comprising machine-readable instructions that, when executed by the machine, cause the machine to:

receive a pairing request containing an identifier of an initiating device over the direct communication link between the initiating device and a target device;

perform a first authentication protocol via the direct communication link, the first authentication protocol comprising verifying that the identifier coincides with at least one previously stored entry in an address book of the target device; and

perform a second authentication protocol via an indirect communication link between the initiating device and the target device, the second authentication protocol to;

generate a first nonce and a second nonce;

encrypt the first nonce using an authentication key;

send a challenge to the initiating device, the challenge including the first nonce in an encrypted form and the second nonce in a decrypted form; and

receive a challenge response containing the first nonce in a decrypted form and the second nonce in an encrypted form.

13. The computer-readable storage media of claim 12, wherein the direct communication link includes a direct Bluetooth or WiFi communication link established between the devices.

14. The computer-readable storage media of claim 12, wherein the indirect communication link uses a third-party communication service.

15. The computer-readable storage media of claim 12, wherein the second authentication protocol is performed over an SMS link established between the devices via the indirect communication link.

16. The computer-readable storage media of claim 12, the second authentication protocol further to:

compare the received first nonce in the decrypted form to the first nonce;

determine to accept the pairing request based in part on whether the received first nonce in the decrypted form matches the first nonce.

17. The computer-readable storage media of claim 16, the first authentication protocol further to:

send a second challenge via the direct communication link in response to the pairing request;

receive a second challenge response via the direct communication link; and

determine if the second challenge response is valid.

18. The computer-readable storage media of claim 17, the second authentication protocol further to determine to accept the pairing request further based in part on whether the second challenge response is valid.

19. The computer-readable storage media of claim 12, the identifier is a hashed identifier and the at least one previously stored entry is a hashed entry.

20. A computer-readable storage media comprising machine-readable instructions that, when executed by the machine, cause the machine to:

receive a pairing request that includes an identifier via a direct connection between the at least two devices;

compare the identifier to previously stored entries in an address book; and

generate a randomly generated nonce using a security key;

encrypt the randomly generated nonce using the security key;

send, via an indirect connection between the at least two devices, a challenge that includes the encrypted randomly generated nonce;

receive, via the indirect connection, a challenge response that includes the randomly generated nonce that is decrypted;

compare the randomly generated nonce that is decrypted to the randomly generated nonce that is generated; and

determine to accept the pairing request if the identifier coincides with at least one of the previously stored entries in the address book and the randomly generated nonce that is decrypted matches the randomly generated nonce that is generated.