Data integrity for proximity-based communication

Patent metadata

Field	Value
Publication number	US-9654981-B2
Application number	US-201114131129-A
Country	US
Kind code	B2
Filing date	Jul 11, 2011
Priority date	Jul 11, 2011
Publication date	May 16, 2017
Grant date	May 16, 2017

Abstract

Methods, systems, and computer programs for trusted communication among mobile devices are described. In some aspects, information is wirelessly transmitted from a first mobile device to a second mobile device. The information permits the second mobile device to detect proximity of the first mobile device. In some implementations, the information can be wirelessly transmitted by a proximity-activated wireless interface, such as, for example, a Near Field Communication (NFC) interface. In response to the information, the first mobile device receives a message and a first authentication value wirelessly transmitted from the second mobile device to the first mobile device. A second authentication value is generated at the first mobile device based on the message and the shared secret value. Integrity of the message is verified based on comparing the first authentication value and the second authentication value.

First claim

What is claimed is:

1. A method for trusted communication among mobile devices, the method comprising:
establishing a shared secret value between a first mobile device and a second mobile device, wherein the first mobile device includes a first wireless communication module and a second wireless communication module, the second wireless communication module is different than the first communication module, and wherein the shared secret value is established based in part on a first set of credentials transmitted from the first mobile device to the second mobile device by the first wireless communication module and a second set of credentials transmitted by the second communication module, the first set of credentials different than the second set of credentials;
wirelessly transmitting information, from the first mobile device to the second mobile device, permitting the second mobile device to detect proximity of the first mobile device;
receiving, at the first mobile device, a message, a first authentication value, and a timestamp value wirelessly transmitted from the second mobile device directly to the first mobile device in response to the information, wherein the first authentication value is generated based on the message and the shared secret value stored at both the first mobile device and the second mobile device, the message includes user data, the first authentication value is appended to the message, and the message and the first authentication value are received at the first mobile device by the second wireless communication module;
accessing the shared secret value stored at the first mobile device and associated with the second mobile device;
generating a second authentication value at the first mobile device based on the message and the shared secret value; and
verifying integrity of the message based on the timestamp value and comparing the first authentication value and the second authentication value.

2. The method of claim 1 , wherein the information is wirelessly transmitted from the first mobile device to the second mobile device by a proximity-activated wireless interface of the first mobile device, and the message and the first authentication value are received at the first mobile device by the proximity-activated wireless interface.

3. The method of claim 2 , wherein the proximity-activated wireless interface comprises a Near Field Communication (NFC) interface.

4. The method of claim 1 , wherein wirelessly transmitting information from the first mobile device to the second mobile device comprises wirelessly transmitting the information from a tablet device to a mobile telecommunication device by a proximity-activated wireless interface.

5. The method of claim 1 , wherein the message comprises a link to content, and the method further comprises automatically displaying the content at the first mobile device in response to verifying the integrity.

6. The method of claim 5 , wherein automatically displaying comprises displaying the content at the first mobile device independent of user confirmation at the first mobile device.

7. The method of claim 1 , wherein the message comprises a phone number, and the method further comprises automatically initiating a call to the phone number at the first mobile device in response to verifying the integrity.

8. The method of claim 1 , wherein verifying the integrity comprises determining whether the first authentication value matches the second authentication value.

9. The method of claim 8 , further comprising accepting the message at the first mobile device based on determining that the first authentication value matches the second authentication value.

10. The method of claim 8 , further comprising rejecting the message at the first mobile device based on determining that the first authentication value does not match the second authentication value.

11. The method of claim 1 , wherein the first mobile device includes a user interface, and establishing the shared secret value between the first mobile device and the second mobile device includes receiving the shared secret value at the first mobile device based on a user interaction with the user interface.

12. The method of claim 1 , wherein the second wireless communication module transmits wireless signals at a frequency of 13.56 MHz, and the first wireless communication module transmits wireless signals at a second frequency in a range of 2400 MHz to 2480 MHz.

13. The method of claim 1 , wherein the second wireless communication module transmits wireless signals at a frequency of 13.56 MHz, and the first wireless communication module transmits wireless signals at a second frequency greater than 1 GHz.

14. The method of claim 1 , wherein establishing the shared secret value between the first mobile device and the second mobile device includes:
accessing, at the first mobile device, a certificate issued by a certificate authority; and
deriving the shared secret value at the first mobile device based on the certificate.

15. The method of claim 1 , wherein the second authentication value is generated by evaluating a keyed hashing algorithm based on the message and the shared secret value.

16. The method of claim 1 , wherein generating the second authentication value comprises generating a Message Authentication Code (MAC) by evaluating a keyed Hash-based Message Authentication Code (HMAC) algorithm based on the message and the shared secret value.

17. A mobile device comprising:
memory operable to store a shared secret value;
a wireless communication interface;
a first wireless communication module;
a second wireless communication module that is different than the first communication module;
data processing apparatus operable to perform operations comprising:
establishing a shared secret value between the mobile device and a second mobile device, wherein the shared secret value is established based in part on a first set of credentials transmitted from the first mobile device to the second mobile device by the first wireless communication module and a second set of credentials transmitted by the second communication module, the first set of credentials different than the second set of credentials;
sending to the second mobile device information permitting the second mobile device to detect proximity of the wireless communication interface;
receiving a message, a first authentication value, and a timestamp value wirelessly transmitted from the second mobile device directly to the wireless communication interface in response to the information, wherein the first authentication value is generated based on the message and the shared secret value stored at both the mobile device and the second mobile device, the message includes user data, the first authentication value is appended to the message, and the message and the first authentication value are received at the mobile device by the second wireless communication module;
generating a second authentication value based on the message and the shared secret value; and
verifying integrity of the message based on the timestamp value and comparing the first authentication value and the second authentication value.

18. The mobile device of claim 17 , wherein the wireless communication interface includes a Near Field Communication (NFC) interface.

19. The mobile device of claim 18 , wherein the message and the first authentication value are received by the NFC interface.

20. The mobile device of claim 17 , wherein the first wireless communication module

Assignees

• Lazaridis Mihal
• Pecen Mark E
• Vanstone Scott Alexander
• Campagna Matthew John
• Rosati Anthony
• Blackberry Ltd
• Certicom Corp

Inventors

• Lazaridis Mihal
• Pecen Mark E
• Vanstone Scott Alexander
• Campagna Matthew John
• Rosati Anthony

Classifications

• H04L63/126

  the source of the received data · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/0492

  by using a location-limited connection, e.g. near-field communication or limited proximity of entities · CPC title

• H04W92/18

  between terminal devices · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title