Methods and systems for pairing devices

• US 9,203,819 B2
• Filed: 01/18/2013
• Issued: 12/01/2015
• Est. Priority Date: 01/18/2012
• Status: Active Grant

• Current Assignee: Neustar Incorporated
• Original Assignee: OneID Inc.
• Inventors: Back, Adam, Kirsch, Steven Todd, Fenton, James Lewis
• Primary Examiner(s): Holder, Bradley
• Assistant Examiner(s): MOHAMMADI, FAHIMEH M
• Application Number:
  US13/745,341
• Publication Number:
  US 20130198516A1
• Time in Patent Office: 1,047 Days
• Field of Search: 713168-170, 713/182, 713/375
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method of pairing an unregistered device with a virtual identity may include, at a first repository: receiving a request from the unregistered device, sending a pairing code and an identifier to the unregistered device, receiving the pairing code from a registered device, and sending the identifier to the registered device. The method may also include, at a second repository, receiving the pairing code and secret information from the registered device, receiving the pairing code in a transmission associated with the unregistered device, associating the unregistered device with the virtual identity using the pairing code, and sending the secret information to the unregistered device.

Claims

1. A method of pairing an unregistered device with a virtual identity, the method comprising:

at a pairing repository;

receiving a request from the unregistered device to pair the unregistered device with the virtual identity;

sharing a pairing code between the pairing repository and the unregistered device;

sharing, between the pairing repository and the unregistered device, an identifier to encrypt data;

receiving, from a registered device, the pairing code after the registered device is paired with the virtual identity; and

sending the identifier to the registered device; and

at an identity repository;

receiving the pairing code and secret information from the registered device, where;

the secret information has been encrypted by the registered device using the identifier; and

the identity repository does not have access to the identifier to decrypt the secret information;

receiving the pairing code from the unregistered device;

pairing the unregistered device with the virtual identity using the pairing code; and

sending the secret information to the unregistered device.

2. The method of claim 1 further comprising, at the pairing repository:

receiving an identity repository locator from the registered device; and

providing the identity repository locator to the unregistered device.

3. The method of claim 2 where the identity repository locator comprises a Universal Resource Locator (URL) of the identity repository.

4. The method of claim 1 where the identifier comprises a pseudo-random number.

5. The method of claim 1 where the pairing code is displayed by the unregistered device to a user and provided to the registered device by the user.

6. The method of claim 1 where the pairing repository and the identity repository are geographically remote from the registered device and the unregistered device.

7. The method of claim 1 where the secret information is encrypted using at least the identifier.

8. The method of claim 7 where the secret information is encrypted using an encryption key derived from the pairing code and the identifier.

9. The method of claim 1 where the secret information comprises an encryption key.

10. The method of claim 1, further comprising:

at the pairing repository;

receiving a blind verifier from the unregistered device; and

sending the blind verifier to the registered device; and

at the identity repository;

receiving, from the registered device, a salted blind verifier that is based on the blind verifier;

sending the salted blind verifier to the unregistered device;

receiving, from the unregistered device, a salted verifier that is based on the salted blind verifier; and

verifying that the salted verifier corresponds to a correct passcode.

11. The method of claim 10 where the blind verifier is computed by the unregistered device at least in part by hashing a passcode guess on an elliptic curve and shifting the hash of the passcode guess on the elliptic curve using a value R.

12. The method of claim 10 where the slated blind verifier is computed by the registered device at least in part by shifting the blind verifier on an elliptic curve using a salt value.

13. The method of claim 10 where the salted verifier is computed by the unregistered device at least in part by shifting the salted blind verifier on an elliptic curve using an inverse of a value R.

14. The method of claim 10 where the salted verifier is hashed one or more times before it is received.

15. The method of claim 10 where the salted verifier is verified by comparing the salted verifier to a hash of a salted passcode.

16. The method of claim 10 where the salted verifier is verified by verifying a signature on a nonce that is signed using the salted verifier.

17. A method of pairing an unregistered device with a virtual identity, the method comprising:

at a pairing repository;

receiving a request and a blind verifier from the unregistered device;

receiving a request from the unregistered device to pair the unregistered device with the virtual identity;

sharing a pairing code between the pairing repository and the unregistered device;

sharing, between the pairing repository and the unregistered device, an identifier to encrypt data;

receiving, from a registered device, the pairing code after the registered device is paired with the virtual identity;

receiving a salted blind verifier from a registered device; and

sending the identifier to the registered device; and

at an identity repository;

receiving the pairing code, secret information, and the salted blind verifier from the registered device, where;

the secret information has been encrypted by the registered device using the identifier; and

the identity repository does not have access to the identifier to decrypt the secret information;

receiving the pairing code in a transmission associated with the unregistered device;

pairing the unregistered device with the virtual identity using the pairing code;

sending the salted blind verifier to the unregistered device;

receiving a salted verifier from the unregistered device;

verifying that the salted verifier corresponds to a correct passcode; and

sending the secret information to the unregistered device.

18. The method of claim 17 further comprising, at the pairing repository:

receiving an identity repository locator from the registered device; and

sending the identity repository locator to the unregistered device.

19. The method of claim 17 where the salted verifier is verified by comparing the salted verifier to a hash of a salted passcode.