Using Secure Elements to Authenticate Devices in Point-to-Point Communication

Patent metadata

Field	Value
Publication number	US-2016234022-A1
Application number	US-201514617996-A
Country	US
Kind code	A1
Filing date	Feb 10, 2015
Priority date	Feb 10, 2015
Publication date	Aug 11, 2016
Grant date	—

Abstract

Methods, devices, systems, and non-transitory process-readable storage media for using secure elements to authenticate a data source device for providing reporting data to a recipient device via local point-to-point communications. An embodiment method includes operations performed by a secure processor of a recipient device that include generating a random token, a data encryption key, and a control register, encrypting the generated data using a shared encryption algorithm and a secret key associated with a unique identifier of the data source device, decrypting data re-encrypted by the data source device and sent within a response message using the shared encryption algorithm and the secret key, determining whether decrypted data matches the random token, and identifying the data source device is authenticated in response to determining that decrypted data matches the random token. The unique identifier and secret key may be pre-loaded on the recipient device.

First claim

What is claimed is:

1 . A method of using secure elements to authenticate a data source device for providing reporting data to a recipient device, comprising:
generating, via a first secure processor of the recipient device, a random token, a data encryption key, and a control register; encrypting, with the first secure processor, the random token, the control register, and the data encryption key using a shared encryption algorithm and a secret key associated with a unique identifier of the data source device; transmitting, via a primary processor of the recipient device, an authentication request message to the data source device that includes the encrypted data for decryption by a second secure processor of the data source device, wherein the authentication request message is transmitted using local point-to-point communications; receiving, via the primary processor, an authentication response message from the data source device that includes data re-encrypted by the second secure processor, wherein the authentication response message is received using the local point-to-point communications; decrypting, via the first secure processor, the re-encrypted data using the shared encryption algorithm and the secret key; determining, via the first secure processor, whether decrypted data matches the random token; and identifying, via the first secure processor, the data source device is authenticated in response to determining that decrypted data matches the random token.

2 . The method of claim 1 , further comprising:
transmitting, via the primary processor, a success message to the data source device in response to determining that decrypted data matches the random token, wherein the success message is transmitted using the local point-to-point communications; and transmitting, via the primary processor, a failure message to the data source device in response to determining that decrypted data does not match the random token, wherein the failure message is transmitted using the local point-to-point communications.

3 . The method of claim 1 , further comprising receiving, via the primary processor, an attach request from the data source device that includes the unique identifier associated with the data source device, wherein the attach request is received via the local point-to-point communications, and
wherein transmitting, via the primary processor, the authentication request message to the data source device that includes the encrypted data comprises transmitting, via the primary processor, the authentication request message to the data source device that includes the encrypted data in response to receiving the attach request.

4 . The method of claim 1 , further comprising:
receiving, via the first secure processor, the unique identifier associated with the data source device and the secret key associated with the unique identifier from a remote server; and storing, via the first secure processor, the unique identifier and the secret key.

5 . The method of claim 1 , further comprising:
receiving, via the primary processor, incoming reporting data from the data source device, wherein the incoming reporting data is received using the local point-to-point communications; and processing, via the primary processor, the received incoming reporting data when the data source device is identified as authenticated.

6 . The method of claim 5 , wherein the control register includes a bit indicating whether future encryption is enabled, the method further comprising:
determining, via the first secure processor, whether incoming reporting data is to be decrypted based on the bit; sharing, via the first secure processor, the data encryption key with the primary processor in response to determining that the incoming reporting data is to be decrypted; and decrypting, via the primary processor, the incoming reporting data using the shared encryption algorithm and the data encryption key.

7 . The method of claim 1 , wherein the first secure processor is a universal integrated circuit card (UICC).

8 . The method of claim 1 , wherein the recipient device is one of a smartphone, a laptop, and a terminal computer.

9 . The method of claim 1 , wherein the local point-to-point communications are short-range wireless signals using a wireless communication protocol or communications via a wired connection.

10 . A method of using secure elements to authenticate a data source device for providing reporting data to a recipient device, comprising:
transmitting, via a primary processor of the data source device, an attach request message to the recipient device that includes a unique identifier associated with the data source device, wherein the attach request message is transmitted using local point-to-point communications; receiving, via the primary processor, an authentication request message from the recipient device that includes data encrypted via a first secure processor of the recipient device, wherein the authentication request message is received using the local point-to-point communications; decrypting, via a second secure processor of the data source device, the encrypted data using a shared encryption algorithm and a secret key associated with the unique identifier to obtain a random token, a control register, and a data encryption key; re-encrypting, via the second secure processor, the random token and the control register using the shared encryption algorithm and the secret key; and transmitting, via the primary processor, an authentication response message to the recipient device that includes the re-encrypted data for decryption by the first secure processor, wherein the authentication response message is transmitted using the local point-to-point communications.

11 . The method of claim 10 , further comprising transmitting, via the second secure processor, the unique identifier and the secret key to a remote server.

12 . The method of claim 10 , further comprising:
determining, via the primary processor, whether a success message is received from the recipient device in response to transmitting the authentication response message; and transmitting, via the primary processor, outgoing reporting data to the recipient device in response to determining that the success message is received, wherein the outgoing reporting data is transmitted using the local point-to-point communications.

13 . The method of claim 12 , wherein the control register includes a bit indicating whether future encryption is enabled, the method further comprising:
determining, via the second secure processor, whether outgoing reporting data is to be encrypted based on the bit; sharing, via the second secure processor, the data encryption key with the primary processor in response to determining that the outgoing reporting data is to be decrypted; and encrypting, via the primary processor, the outgoing reporting data using the shared encryption algorithm and the data encryption key.

14 . The method of claim 10 , wherein the second secure processor of the data source device is a universal integrated circuit card (UICC).

15 . The method of claim 10 , wherein the data source device is one of a smartphone, a robot, a medical equipment device, and a sensor device.

16 . The method of claim 10 , wherein the local point-to-point communications are short-range wireless signals using a wireless communication protocol or communications via a wired connection.

17 . A computing device, comprising:
a primary processor and a first secure processor, wherein the first se

Assignees

• Qualcomm Inc

Inventors

• Motika Goutam
• Sudabattula Samatha

Classifications

• H04L9/3213 Primary

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• H04W12/033

  of the user plane, e.g. user's traffic · CPC title