Trusted device

Patent metadata

Field	Value
Publication number	US-10042996-B2
Application number	US-201514951528-A
Country	US
Kind code	B2
Filing date	Nov 25, 2015
Priority date	Jun 18, 2013
Publication date	Aug 7, 2018
Grant date	Aug 7, 2018

Abstract

A trusted device, such as a wristwatch, is provided with authentication circuitry, used to perform an authentication operation to switch the trusted device into an authenticated state. Retention monitoring circuitry monitors the physical possession of the trusted device by the user following the authentication operation and switches the trusted device out of an authenticated state if the trusted device does not remain in the physical possession of the user. While the trusted device remains in the physical possession of the user, communication triggering circuitry is used to detect a request to establish communication with a target device that is one of a plurality of different target devices and communication circuitry is used to communicate with that target device using an authenticated identity of the user.

First claim

We claim:

1. An apparatus comprising:
circuitry to authenticate with an authentication operation a user having physical possession of said apparatus and thereby switch said apparatus to an authenticated state;
circuitry to continue to monitor physical possession of said apparatus by said user following said authentication operation, to continue said apparatus in the authenticated state if said apparatus is determined to remain in the physical possession of said user, and to switch said apparatus out of said authenticated state if said apparatus is determined to no longer be in physical possession of said user, wherein said circuitry to monitor physical possession of said apparatus includes detection circuitry to recognise one or more biometric characteristics of said user;
circuitry to detect a request to establish communication with a target device; and
circuitry to communicate with said target device when said apparatus is in said authenticated state.

2. The apparatus as claimed in claim 1 , further comprising a button, and wherein said circuitry to detect a request to establish communication with a target device is configured to enable communication responsive to a user pressing said button.

3. The apparatus as claimed in claim 1 , wherein said target device is one of a plurality of different devices.

4. The apparatus as claimed in claim 1 , wherein said communication with said target device includes communicating credentials including one or more of: an application-program-interface key, a digital certificate, a user identity, a password and cryptographically signed data.

5. The apparatus as claimed in claim 1 , wherein communication with said target device includes creation of credentials usable in subsequent authentications.

6. The apparatus as claimed in claim 1 , wherein said communication with said target device includes the transfer of information including at least one of configuration data, personalisation preferences, network settings, contracts, receipts, computer programs, data logs, transaction records and credentials.

7. The apparatus as claimed in claim 4 , wherein said apparatus automatically selects which credentials to use.

8. The apparatus as claimed in claim 6 , wherein said apparatus automatically selects which information to use.

9. The apparatus as claimed in claims 7 , wherein automatic selection criteria used in said automatic selection are subject to user configuration.

10. The apparatus as claimed in claims 7 , wherein said trust device permits a user to manually alter a selection that has been made automatically.

11. The apparatus as claimed in claim 1 , wherein said circuitry to monitor physical possession of said apparatus includes one or more detection circuits comprising at least one of:
a clasp to hold said apparatus attached to said user when said clasp is in a closed state, said circuitry switching said apparatus out of said authenticated state when said clasp changes out of said closed state;
circuitry to detect contact between said apparatus and said user using one of more of: electrical signals detected from said user; temperature of a contact area between said apparatus and said user;
circuitry to detect proximity said apparatus and a proximity device worn by said user;
a photo-detector shielded from light when said apparatus is physical possession of said user;
a chemical detector to detect a chemical characteristic of said user;
circuitry to detect motion of said apparatus as said user moves while said apparatus is in physical possession of said apparatus;
circuitry to detect proximity of an implant within said user; and
circuitry having temperature sensors and configured to detect heat flux through said apparatus.

12. The apparatus as claimed in claim 11 , wherein said circuitry to monitor physical possession of said apparatus comprises a plurality of detection circuits and is configured to combine detection results from said plurality of detection circuits to determine a retention probability that said apparatus is in physical possession of said user and to switch said apparatus out of said authenticated state when said retention probability falls below a threshold probability level.

13. The apparatus as claimed in claim 12 , wherein said circuitry to monitor physical possession of said apparatus is configured to reduce said retention probability as a time since said authentication operation increases.

14. The apparatus as claimed in claim 1 , where said authentication operation comprises receiving and processing a password.

15. The apparatus as claimed in claim 1 , wherein said circuitry to authenticate comprises at least one of:
biometric recognition circuitry to recognise one or more biometric characteristics of said user;
fingerprint recognition circuitry to recognise a fingerprint of said user;
face recognition circuitry to recognise a face of said user;
chemical recognition circuitry to recognise one or more chemical characteristics of said user;
ECG recognition circuitry to recognise ECG signals of said user;
bioimpedance circuitry to recognise one or more bioimpedance characteristics of said user;
gait recognition circuitry to recognise a gait of said user; and
implant recognition circuitry to recognise an implant within said user.

16. The apparatus as claimed in claim 1 , wherein said circuitry to monitor physical possession of said apparatus generates a retention probability to indicate a probability that said apparatus has remained in physical possession of said user since a previous positive authentication operation.

17. The apparatus as claimed in claim 1 , wherein said circuitry to communicate with said target device is configured to trigger communication with said target device in response to at least one of:
detection of a distance of less than a threshold distance between said target device and said apparatus;
detection of said user touching said target device;
detection of a said user pressing a button on said target device;
receipt of a message specifying said target device;
said user selecting said target device from a list of devices.

18. The apparatus as claimed in claim 1 , wherein said circuitry to communicate with said target device is configured to communicate independently of availability of communication between said apparatus and any other device.

19. The apparatus as claimed in claim 1 , further comprising a display configured to display information pertaining to said communication with said target device.

20. The apparatus as claimed in claim 1 , wherein said apparatus is at least one of:
a wearable device; and
a wrist watch.

21. The apparatus as claimed in claim 1 , comprising circuitry configured to store identity data for use in said communication using said authenticated identity, said identity data comprising one of more public identity identifiers each having associated secret data.

22. A method of trusted processing comprising the steps of:
authentication circuitry authenticating with an authentication operation a user having physical possession of an apparatus and thereby switch said apparatus to an authenticated state;
detection circuitry continuing monitoring physical possession of said apparatus by said user following said authentication operation, continuing said apparatus in the authenticated state if said apparatus is determined to remain in the physical possession of said user, and switching said apparatus out of said authenticated state when said appa

Assignees

• Arm Ip Ltd

Inventors

• Flautner Krisztian
• Vincent Hugo John Martin
• Phillips Amyas Edward Wykes
• Taylor Robert George

Classifications

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/34

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title