Secure data transmission using multi-channel communication

Patent metadata

Field	Value
Publication number	US-9628459-B2
Application number	US-201414218345-A
Country	US
Kind code	B2
Filing date	Mar 18, 2014
Priority date	Mar 18, 2014
Publication date	Apr 18, 2017
Grant date	Apr 18, 2017

Abstract

A method includes receiving a request to initiate secure communications from a first client and authenticating the first client. The authenticating includes communicating with a second client using a second communication channel, and receiving a response from the first client, the response being transmitted over a first communication channel. The method also includes receiving a first set of message data from the first client, the first set of message data being transmitted over the first communication channel, and receiving a second set of message data from the second client, the second set of message data being transmitted over the second communication channel. The method additionally includes constructing the message using the first set of message data and the second set of message data.

First claim

What is claimed is:

1. A method, comprising:
receiving a request to initiate secure communications from a subscriber, the request being transmitted by the subscriber using a first personal device of the subscriber and over a first communication channel, wherein the first personal device comprises a personal computer the secure communications comprise a message stored in a memory of the first personal device;
authenticating the subscriber, the authenticating comprising:
communicating with a second personal device of the subscriber using a second communication channel; and
in response to communicating with the second personal device, receiving a response from the first personal device, the response being transmitted over the first communication channel;

determining whether the first or second communication channel has a higher bandwidth;
transmitting a server's public key over the communication channel with a lower bandwidth;
receiving a first set of message data from the first personal device, the first set of message data being transmitted over the communication channel with the higher bandwidth, wherein the message cannot be determined using the first set of message data alone, and wherein the first set of message data comprises a portion of the message encrypted using the server's public key;
receiving a second set of message data from the second personal device, the second set of message data being transmitted over the communication channel with the lower bandwidth, wherein the message cannot be determined using the second set of message data alone, the second set of message data further comprises a subscriber's public key for encrypting future messages, and wherein a size of the first message data is larger than a size of the second message data;
constructing, using a processor, the message using the first set of message data, the second set of message data, and a private key corresponding to the server's public key.

2. The method of claim 1 , further comprising:
encrypting a second message;
determining a third set of message data and a fourth set of message data using the encrypted second message; and
sending the encrypted second message to the first personal device, the sending comprising:
sending the third set of message data to the first personal device over the communication channel with the higher bandwidth; and
sending the fourth set of message data to the second personal device over the communication channel with the lower bandwidth, wherein the third set of message data and the fourth set of message data are configured to be constructed into the second message at the first personal device.

3. The method of claim 1 , wherein authenticating the first personal device further comprises:
sending a verification code to the second personal device, the verification code being transmitted over the communication channel with the lower bandwidth;
determining whether the first personal device is authenticated based on whether the verification code is received over the communication channel with the higher bandwidth.

4. The method of claim 1 , wherein the first communication channel comprises a transmission line connected to the first personal device, and wherein the second communication channel comprises a cellular data communication service connected to the second personal device.

5. The method of claim 1 , further comprising:
determining a security level of the first communication channel;
determining whether the security level is appropriate for using a single-channel communication protocol to transmit a secure message; and
in response to determining that the security level is appropriate, sending the secure message to the first personal device over the first communication channel.

6. The method of claim 1 , further comprising:
generating a key, wherein the first set of message data comprises a first portion of an encrypted message associated with the message, the second set of message data comprises a second portion of the encrypted message, and constructing the message further comprises decrypting the encrypted message using the key.

7. A computer configured to access a storage device, the computer comprising:
a processor; and
a non-transitory, computer-readable storage medium storing computer-readable instructions that when executed by the processor cause the computer to perform:
receiving a request to initiate secure communications from a subscriber, the request being transmitted by the subscriber using a first personal device of the subscriber and over a first communication channel, wherein the secure communications comprise a message stored in a memory of the first personal device;
authenticating the subscriber, the authenticating comprising:
communicating with a second personal device of the subscriber using a second communication channel; and
in response to communicating with the second personal device, receiving a response from the first personal device, the response being transmitted over the first communication channel;

determining whether the first or second communication channel has a higher bandwidth;
transmitting a server's public key over the communication channel with a lower bandwidth;
receiving a first set of message data from the first personal device, the first set of message data being transmitted over the communication channel with the higher bandwidth, wherein the message cannot be determined using the first set of message data alone;
receiving a second set of message data from the second personal device, the second set of message data being transmitted over the communication channel with the lower bandwidth, wherein the message cannot be determined using the second set of message data alone, and wherein a size of the first message data is larger than a size of the second message data; and
constructing, using a processor, the message using the first set of message data and the second set of message data.

8. The computer of claim 7 , wherein the computer-readable instructions further cause the computer to perform:
encrypting a second message;
determining a third set of message data and a fourth set of message data using the encrypted second message; and
sending the encrypted second message to the first personal device, the sending comprising:
sending the third set of message data to the first personal device over the communication channel with the higher bandwidth; and
sending the fourth set of message data to the second personal device over the communication channel with the lower bandwidth, wherein the third set of message data and the fourth set of message data are configured to be constructed into the second message at the first personal device.

9. The computer of claim 7 , wherein the computer-readable instructions further cause the computer to perform:
generating a first public key and a private key, wherein the first set of message data comprises an encrypted message associated with the message, the second set of message data comprises a second public key for encrypting future messages, and constructing the message further comprises decrypting the encrypted message using the private key.

10. The computer of claim 7 , wherein authenticating the first personal device further comprises:
sending a verification code to the second personal device, the verification code being transmitted over the communication channel with the lower bandwidth;
determining whether the first personal device is authenticated based on whether the verification code is received over the communication channel with the higher bandwidth.

11. The computer of claim 7 , wherein the first communication channel comprises a transmission line co

Assignees

• Greenspan Steven L
• Reno James Donald
• Saborowski Ralf Dieter
• Chell Charley
• Ca Inc

Inventors

• Greenspan Steven L
• Reno James Donald
• Saborowski Ralf Dieter
• Chell Charley

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title