Management of multiple connections to a security token access device

• US 8,112,794 B2
• Filed: 07/17/2006
• Issued: 02/07/2012
• Est. Priority Date: 07/17/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Little, Herbert A., Adams, Neil P.
• Primary Examiner(s): Pearson, David
• Assistant Examiner(s): VICTORIA, NARCISO F
• Application Number:
  US11/458,032
• Publication Number:
  US 20080016537A1
• Time in Patent Office: 2,031 Days
• Field of Search: 726/9
• US Class Current: 726/9
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/50 Secure pairing of devices

Abstract

A security token access device, a user device such as a computing device or communications device, and a method for managing multiple connections between multiple user devices and the access device. The access device maintains connection information, including security information, for each user device securely paired with the access device. Each time a new user device is paired with the access device, the access device transmits a notification to the user devices already paired to the user device. A user may provide instructions to the access device to terminate a pairing with one of the user devices by overwriting at least a portion of the connection information associated with the designated user device. A user device may further request a listing of all user devices currently paired with the access device.

Claims

1. A user device adapted to communicate with a security token access device over a wireless link, the access device being adapted to communicate over a wireless link with a plurality of user devices and to be paired with at least one of the plurality of user devices, and further being adapted to maintain connection information relating to each of the plurality of user devices paired with the access device, the user device comprising:

a processor configured to place the user device in an inactivated state in response to a detected input at the user device while maintaining a pairing with the access device, and to reactivate the user device after the user device was in the inactivated state;

a receiver for receiving a signal from the access device, the signal comprising a notification that an other user device has been paired with the access device, the other user device being paired with the access device while the user device was in the inactivated state; and

a transmitter for transmitting a signal, after the user device is reactivated, to the access device to instruct the access device to terminate the pairing with the other user device,

wherein the transmitter is further adapted to transmit a signal to the access device comprising a request for a listing of user devices currently paired with the access device, and the receiver is further adapted to receive a signal from the access device comprising the listing of user devices currently paired with the access device.

2. The user device of claim 1, further comprising:

an interface for selecting a user device listed in the listing of user devices;

and wherein the transmitter is further adapted to transmit a signal to the access device to instruct the access device to terminate the pairing with the selected user device, such that the access device terminates said pairing by overwriting at least a portion of the connection information relating to the selected user device.

3. The user device of claim 2, wherein the wireless link over which the user device is adapted to communicate with the access device comprises a wireless link secured with a secure pairing key associated with the user device, and wherein the access device is adapted to be paired with at least one of the plurality of user devices using a secure pairing key associated with the at least one of the plurality of user devices, such that the portion of connection information comprises any secure pairing key associated with at least one of the plurality of user devices.

4. The user device of claim 1, wherein the user device is a mobile communication device.

5. The user device of claim 1, wherein the detected input at the user device comprises one of a lock command or a log-off command.

6. A security token access device adapted to wirelessly communicate with a plurality of user devices, comprising:

a transceiver, a processor and a memory configured to enter into a pairing with each of a plurality of user devices, the processor and memory further being configured to store and maintain connection information relating to each of the plurality of user devices thus paired while said each of the plurality of user devices is in an inactivated state in response to a detected input at said user device;

the transceiver being configured to transmit a notification of a subsequent pairing with a user device to at least one previously paired device of the plurality of user devices, wherein said subsequent pairing occurred while the at least one previously paired device was in the inactivated state, and to receive, from one of the at least one previously paired device, after it is reactivated, an instruction to terminate the subsequent pairing;

wherein the processor and memory are further configured to terminate the subsequent pairing upon receipt of said instruction by overwriting at least a portion of the connection information relating to said subsequently paired device,

wherein the transceiver is further configured to receive a request from a requesting user device for a listing of all user devices currently paired with the access device, and to transmit to the requesting user device in response to the request the listing of all user devices currently paired with the access device.

7. The access device of claim 6, wherein the transceiver is further configured to receive, from one of the at least one previously paired device, said previously paired device having been temporarily inactive when the subsequent pairing was made, a notification that, said previously paired device is ready to receive data, and to transmit the notification of the subsequent pairing to said previously paired device upon receipt of said notification that said previously paired device is ready to receive data.

8. The access device of claim 6, wherein the pairing with each of a plurality of user devices is a secure pairing associated with security information, and the portion of connection information comprises the security information.

9. The access device of claim 8, wherein the security information for each of the plurality of user devices comprises at least a secure pairing key.

10. The access device of claim 9, wherein the security information for each of the plurality of user devices further comprises a master connection key.

11. The access device of claim 8, wherein the connection information further comprises a connection pairing key and an address associated with each of the plurality of user devices thus paired.

12. The access device of claim 11, wherein the processor is further adapted to overwrite the secure pairing key associated with the one of the plurality of user devices.

13. The access device of claim 12, wherein the processor is further adapted to overwrite the connection pairing key associated with the one of the plurality of user devices.

14. A computing device comprising the access device of claim 6.

15. A mobile communication device comprising the access device of claim 6.

16. The access device of claim 6, wherein the detected input at the user device comprises one of a lock command or a log-off command.

17. A method for managing a plurality of user devices adapted to communicate over a wireless link with a security token access device, the method being implemented by the access device and comprising:

receiving a request for a connection from each of a plurality of user devices, each request comprising an identifier corresponding to each of the plurality of user devices;

for each request, generating and transmitting a secure pairing value corresponding to each of the plurality of user devices for establishing a secure pairing with each said user device;

for each of said user device, storing connection information comprising the corresponding identifier and a key derived from the corresponding secure pairing value;

while a first one of the plurality of user devices thus paired is in an inactivated state in response to a detected input at the user device, receiving a request for a connection from a subsequent user device, the request comprising an identifier corresponding to said subsequent user device;

generating and transmitting a subsequent secure pairing value corresponding to the subsequent user device for establishing a secure pairing with the subsequent user device;

storing connection information comprising the identifier corresponding to the subsequent user device and a key derived from the subsequent secure pairing value;

transmitting a notification to the first one of the plurality of user devices thus paired that the subsequent user device has been paired with the access device;

receiving an instruction from said first one of the plurality of user devices thus paired, after said user device is reactivated, to terminate the pairing between the access device and the subsequent user device;

in response to said instruction, overwriting the key derived from the subsequent secure pairing value;

receiving a request from a requesting user device for a listing of all user devices currently paired with the access device; and

transmitting to the requesting user device in response to the request the listing of all user devices currently paired with the access device.

18. The method of claim 17, wherein the connection information further comprises an associated connection pairing value and an associated user device address.

19. The method of claim 18, further comprising, in response to said instruction, overwriting the connection pairing value associated with the subsequent user device.

20. The method of claim 17, further comprising:

after generating and transmitting the secure pairing value corresponding to each of the plurality of user devices, for each of said plurality of user devices,

establishing at the access device corresponding master connection key data for generating a corresponding master connection key for said user device;

generating said corresponding master connection key from the corresponding master connection key data,

wherein the each of said plurality of user devices is configured to generate said corresponding master connection key from the corresponding master connection key data, the corresponding master connection key being used to secure data transmitted between the access device and said user device, and wherein data transmitted to said user device by the access device comprises the corresponding identifier;

after generating and transmitting the subsequent secure pairing value,

establishing at the access device subsequent master connection key data for generating a subsequent master connection key for said subsequent user device;

generating said subsequent master connection key from the subsequent master connection key data,

wherein the subsequent user device is configured to generate the subsequent master connection key from the subsequent master connection key data, the subsequent master connection key being used to secure data transmitted between the access device and the subsequent user device, and wherein data transmitted to the subsequent user device by the access device comprises the subsequent identifier;

and wherein the connection information for each user device securely paired with the access device further comprises the master connection key associated with said user device,

and further wherein overwriting the key further comprises overwriting the subsequent master connection key.

21. A computer program product comprising a non-transitory computer-readable medium comprising code executable by a computing device for carrying out the method of claim 17.

22. A smart card reader adapted to communicate with a plurality of user devices and to be securely paired with at least one of the plurality of user devices for implementing the method recited in claim 17.

23. The method of claim 17, wherein the detected input at the user device comprises one of a lock command or a log-off command.