Device to device security using NAF key

Patent metadata

Field	Value
Publication number	US-9781085-B2
Application number	US-201214371683-A
Country	US
Kind code	B2
Filing date	Feb 14, 2012
Priority date	Feb 14, 2012
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

A method, apparatus and computer program product are disclosed for establishing secure off-network communications between first and second Secure Cellular Devices that each have a cellular identity. The second Secure Cellular Device may assume the role of Remote Device for interaction with the NAF keyserver and may obtain a local key. The first Secure Cellular Device may derive the local key and the two devices may conduct secure communications using the shared local key. The two Secure Cellular Devices may alternate the roles of Secure Host and Remote Device, each twice obtaining or deriving a shared local key such that there are two such keys. The devices may employ one key for secure communication in one direction and the other for communication in the other direction. Alternatively, the devices may derive a unique shared key as a function of the two shared keys.

First claim

That which is claimed:

1. A method comprising:
causing a first secure device having a cellular identity to be linked with a communications network application function keyserver;
causing the cellular identity of the first secure device to be authenticated with the communications network application function keyserver;
causing a second secure device to be linked with the communications network application function keyserver;
causing the second secure device to be authenticated with the communications network application function keyserver;
transmitting, from the communication network application function keyserver and to the first secure device, a first local key and a second local key, the first local key provided in a first mode of the first secure device and the second local key provided in a second mode of the first secure device, the second mode different from the first mode;
transmitting, from the communication network application function keyserver and to the second secure device, the first local key and the second local key, the first local key provided in the first mode of the second secure device and the second local key provided in the second mode of the second secure device;
deriving, at the first secure device and at the second secure device, a shared key derived based on the first local key and the second local key; and
using the shared key for conducting secure off-network two-way communications between the first secure device and the second secure device.

2. The method of claim 1 , further comprising:
causing a bootstrap identification and an external key to be provided to the communications network application function keyserver.

3. The method claim 1 , further comprising:
causing a tethering function to be provided, at the first secure device, for linking the second secure device to the communications network application function keyserver.

4. The method of claim 1 , further comprising:
causing the second secure device to assume a function of a remote device for network authentication, including
causing a bootstrap identification and an external key to be provided to the communications network application function keyserver.

5. The method of claim 4 , further comprising:
causing a link to be established at the remote device with the communications network application function keyserver through a secure tunnel.

6. An apparatus comprising at least one processor and at least one memory including computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the apparatus to at least:
cause a first secure device having a cellular identity to be linked with a communications network application function keyserver;
cause the cellular identity of the first secure device to be authenticated with the communications network application function keyserver;
cause a second secure device to be linked with the communications network application function keyserver;
cause the second secure device to be authenticated with the communications network application function keyserver;
transmit, from the communications network application function keyserver and to the first secure device, a first local key and a second local key, the first local key provided in a first mode of the first secure device and the second local key provided in a second mode of the second secure device, the second mode different from the first mode;
transmit, from the communications network application function keyserver and to the second secure device, the first local key and the second local key, the first local key provided in the first mode of the second secure device and the second local key provided in the second mode of the second secure device;
derive, at the first secure device and at the second secure device, a shared key derived based on the first local key and the second local key; and
use the shared key for conducting secure off-network two-way communications between the first secure device and the second secure device.

7. The apparatus of claim 6 , wherein the apparatus is further caused to at least: cause the second secure device to execute a function of a remote device having a cellular identity.

8. The apparatus of claim 7 , wherein the apparatus is further caused to at least: cause a link to be established with the communications network application function keyserver through a transport layer security pre-shared key tunnel.

9. The apparatus of claim 7 , wherein the apparatus is further caused to at least: authenticate a cellular identity for the apparatus with the communications network application function keyserver.

10. The apparatus of claim 6 , wherein the apparatus is further caused to at least: employ the first local key and the second local key in bidirectional secure off-network communication between the first secure device and the second secure device.

11. The apparatus of claim 6 , wherein deriving the shared key includes deriving the shared key as a function of the first local key and the second local key.

12. A computer program product comprising at least one non-transitory computer-readable storage medium having executable computer-readable program code instructions stored therein, the computer-readable program code instructions configured to:
cause a first secure device having cellular identity to be linked with a communications network application function keyserver;
cause the cellular identity to be authenticated with the communications network application function keyserver;
cause a second secure device to be linked with the communications network application function keyserver;
cause the second secure device to be authenticated with the communications network application function keyserver;
transmit, from the communications network application function keyserver and to the first secure device, a first local key and a second local key, the first local key provided in a first mode of the first secure device and the second local key provided in a second mode of the second secure device, the second mode different from the first mode;
transmit, from the communications network application function keyserver and to the second secure device, the first local key and the second local key, the first local key provided in the first mode of the second secure device and the second local key provided in the second mode of the second secure device;
derive, at the first secure device and at the second secure device, a shared key derived based on the first local key and the second local key; and
use the shared key for conducting secure off-network two-way communications between the first secure device and the second secure device.

13. The computer program product of claim 12 , wherein the computer-readable program instructions are further configured to:
cause a tethering function to be provided for linking the second secure device acting as a remote device to the communications network application function keyserver.

14. The computer program product of claim 12 , wherein the computer-readable program instructions are further configured to:
cause the first secure device to assume a function of a remote device for network authentication; and
cause a bootstrap identification and an external key to be provided to the communications network application function keyserver.

Assignees

• Holtmanns Silke
• Asokan Nadarajah
• Nokia Technologies Oy

Inventors

• Holtmanns Silke
• Asokan Nadarajah

Classifications

• H04L63/062 Primary

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04W4/005

  Electricity · mapped topic

• H04W76/023

  Electricity · mapped topic

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title