KR101031450B1 - Secure association between devices - Google Patents

Abstract

Methods and apparatuses for secure association between devices are described. In one embodiment, devices capable of communicating over a wireless channel may be authenticated through a different channel established by signal generators and / or sensors present in the devices. Other embodiments are also disclosed.

Wireless communication, device pairing, and out-of-band channel

Description

Secure alliances between devices {SECURE ASSOCIATION BETWEEN DEVICES}

The present specification generally relates to the electronic field. More specifically, embodiments of the present invention generally relate to secure associations between devices.

Portable computing devices are quickly gaining popularity, in part due to their ease of movement. Secure alliance between two devices, also known as device pairing, can be an important element of network security for mobile computing devices. A secure partnership generally involves a secure exchange of cryptographic information between the devices so that the two devices can communicate securely over insecure communication channels. For example, some wireless headsets may be securely paired with a telephone to ensure communication between them.

Some current implementations may allow the exchange of an encryption key between two devices over insecure wireless channels such that an eavesdropper cannot decode the encryption information (eg, Diffie-Hellman). protocol). However, the Diffie-Hellman protocol is susceptible to man-in-the-middle attacks, in which case each of the two devices wishing to pay for it cooperates with a third device (ie, the middleman) instead. You may not realize it. One way to prevent this type of attack is to use an out-of-band (OOB) channel to authenticate the exchanges between devices involved in Diffie-Hellman. OOB channels generally represent a mechanism for transmitting and / or receiving information to / from another device without using a radio. Often an OOB channel can be characterized as difficult to interfere with, although not necessarily private. For example, conventional OOB channels may be used in Near Field Communications (NFC), or input of a password on both devices (which are then verified as the same on both sides), or on one device that needs to be input on another device. May include a display of the password.

One basic requirement of these OOB channels may be to associate a human and use that human to complete the authentication process, to verify that the two devices they want to pay are legitimate devices. Thus, for example, in the case of NFC, a person may have to bring the two devices into the NFC communication range (which may be several centimeters in some current implementations), while in the case of a password entry, the person actually Enter the same password on both devices.

One problem with such conventional authentication techniques is that they may require additional hardware, such as NFC readers or tags, or keyboards and / or displays, which adds to system cost. Moreover, for very small devices, it may not be possible to have a keyboard and display present on the device because of size constraints.

In the following description, numerous specific details are set forth in order to provide a thorough understanding of various embodiments. However, various embodiments of the invention may be practiced without the specific details. In other instances, well-known methods, procedures, components, and circuits have not been described in detail in order not to obscure certain embodiments of the present invention. In addition, various aspects of the invention may be practiced using various means, such as integrated semiconductor circuits (“hardware”), computer readable instructions (“software”) comprised of one or more programs, or any combination of hardware and software. Can be. For the purposes of this specification, "logic" means hardware, software, or some combination thereof.

Some of the embodiments described herein can provide techniques for secure association of devices. In one embodiment, devices capable of communicating over a wireless channel detect one or more signal generators (eg, actuators) and / or sensors (eg, movement on one or more axes) present on the devices. Can be authenticated through different channels established by an accelerometer. In one embodiment, the signal generators and / or sensors may be analog.

In one embodiment, a sensor and signal generator pair (which may exist on two mobile communication devices) may be used as an out-of-band (OOB) communication channel. For example, the first device (e.g., mobile phone) may include a vibration feature (e.g., used as a signal generator) that may be combined with an accelerometer (e.g., used as a sensor) on the second device. A secure OOB channel can be formed between the telephone and the second device.

Moreover, the techniques described herein can be used to monitor patients at various locations, including, for example, within and / or remotely through a home environment, such as through a healthcare (eg, cellular network, wireless broadband network, etc.). For secure exchange of patient information for devices), entertainment, education, telecommunications, mobile computing, and the like. Another example is in a personal medical network, in which medical data on which sensors on the body are sensed is collected using a wireless technology, such as an aggregating device (e.g., personal digital assistant (PDA), mobile phone, MID (Mobile). Internet Device), Personal Computer (PC), Ultra Mobile PC (UMPC), or other computing devices such as those described herein).

Further, in one embodiment, the first device may include a first (eg, analog or digital) sensor that detects an event and logic to generate a first data set corresponding to the event. The second device may include a second (eg, digital or analog) sensor to detect the event and logic to generate a second data set corresponding to the event. Each of the first device and the second device compares the first data set and the second data set to determine whether the first device and the second device will be safely associated.

1 illustrates a block diagram of a secure device association system 100 according to one embodiment. As shown, both devices to be associated with (e.g., devices 102 and 104) are (e.g., a wireless communication channel that may or may not be secured, for example, may be encrypted). Radio 110 (eg, radios 106 and 108, respectively), which may be for primary communication. In addition, in some embodiments a wired channel may be used for the primary communication between devices 102 and 104. The device 102 also generates signals that are detected by the sensor 122 (e.g., an accelerometer that can sense movement (e.g., movement in multiple axes, such as three axes in one embodiment)). Signal generator 120 (eg, a mechanical actuator, a wireless transducer, etc.). In some embodiments two or more signal generators and / or sensors may be used per device.

As shown, signal generator 120 may be coupled to sensor 122 via OOB communication channel 124 (eg, to communicate authenticated or secure affiliate signals). In addition, the OOB communication channel 124 may be a one-way channel in some embodiments, for example, as evidenced by the direction of the corresponding arrow in FIG. 1. In addition, the wireless communication channel 110 may be bidirectional in some embodiments, for example, as evidenced by the direction of the corresponding arrow in FIG. 1. As further shown in FIG. 1, each of the devices 102 and 104 may also perform device association logic (eg, logics) that perform various operations, eg, further described herein with respect to FIG. 2. (130 and 132)).

In one embodiment, signal generator 120 may be a vibrator and sensor 122 may be an accelerometer. Aside from such a combination, signal generators and other possible pairs of sensors may each include (a) blinking LEDs (light emitting diodes) or a display screen and an image capture device (eg a camera); Or (b) one or more of a speaker and a microphone. Such combinations may provide tamper-free communication without adding significant extra cost to the system (eg, such features may already exist in some mobile devices for other applications). For example, most cell phones and PDAs may have a vibrator and a camera. In addition, peripheral devices used for health care applications or entertainment may include accelerometers and / or LEDs.

2 shows a flowchart of a method 200 for safely associating devices, according to one embodiment. Here, for example, with respect to FIG. 1, the various components discussed may be used to perform one or more of the operations of FIG. 2.

1 and 2, in operation 202, two devices to be associated (eg, devices 102 and 104) discover each other and exchange information about their capabilities (eg, The logics 130 and 132 may cause the exchange of information over the wireless communication channel 110) to allow the affiliate process to begin. In operation 204, the shared secret may be securely exchanged with another device (eg, logics 130 and 132 may use a Diffie-Hellman algorithm or similar technique). In one embodiment, the shared secret may be communicated over the wireless communication channel 110.

In operation 206, one device may authenticate another device (eg, device 102 may authenticate device 104 using OOB communication channel 124). In operation 206, the devices (eg, logic 130 and 132) may verify that the information exchanged in operation 204 was from the same device in one embodiment. In operation 208, using the data exchanged in operations 204 and 206, both devices (eg, logics 130 and 132) are thereafter (eg, via wireless communication channel 110). It is possible to generate the same symmetric encryption keys that encrypt any communication between them.

During the authentication process (operations 204 and / or 206), information may be sent from the signal generator 120 to the sensor 122 from one device to another, and the received information may be interfered with by the OOB communication channel 124. It can be used for authentication as it can be resistant to. In the example of a vibrator-accelerometer combination, the user only needs to bring the two devices together during the paying process. The phone can then vibrate with periodic pulses (e.g., a transmission for one period can indicate "1" and a "0" if there is no transmission for a period of time, or vice versa. On the other hand, a peripheral uses its accelerometer to pick up the pulses. By decoding the pulses (eg, in the same way as an acoustic modem in one embodiment), the peripheral receives out-of-band information and uses that information to determine if it is a true communication endpoint. I can prove it. In addition, analog actuators and sensors can provide additional mechanisms for secure device association for smaller devices that do not have a bulky input device, such as a display, keyboard, or touch pad, for example. have.

In some embodiments, OOB communication channel 124 may be secure from third party interference. Since a person can typically bring two devices close to each other during the setup process, he can verify that no other device affects the pairing process. In addition, sensors and actuators are often already present in devices (to support existing applications); Thus, additional hardware (or cost) may not need to be added to the system. Moreover, such techniques may be used in wireless devices (e.g., Bluetooth Core Specification version 2.1 (Bluetooth SIG, August 1, 2007) or Wi-Fi Protected Setup (Wi- Fi Alliance (Alliance, Jan. 8, 2007)) can be easily integrated into existing secure alliance methods.

3 illustrates a block diagram of a secure device association system 300, according to one embodiment. As shown, both devices to be associated with (e.g., devices 302 and 304) are (e.g., a wireless communication channel that may or may not be secure, for example, encrypted). Radio 310 (eg, radios 306 and 308, respectively), which may be for primary communication. In some embodiments a wired channel may be used for the primary communication between devices 302 and 304. As shown, each of devices 302 and 304 may also include a sensor (eg, sensors 320 and 322, respectively) that observes event 324.

In one embodiment, sensors 320 and 322 may be accelerometers capable of sensing movement (eg, movement in multiple axes, such as three axes in one embodiment). In some embodiments two or more sensors may be used per device. In addition, event 324 can be any event that can be detected by sensors 320 and 322, such as motion, sound, images, and the like. Thus, sensors 320 and 322 may be accelerometers, microphones, image capture devices (eg cameras), and the like.

Moreover, the sensors 320 and 322 can be the same type (or the same) sensors. As one example, accelerometers can generate a roughly identical string that can be used for sensing and authenticating the same event (eg, event 324). In order to generate the same but arbitrary strings that can be used for authentication, in one embodiment both devices can be brought together in one hand and shaken decisively. Since both devices will sense the same movement, they will have (roughly) identical streams of sensed accelerometer data. Such combinations may provide interference free communication without adding significant extra cost to the system (eg, such features may already exist in some mobile devices for other applications). For example, most cell phones and PDAs may have a vibrator and a camera. In addition, many peripheral devices used for healthcare applications or entertainment may include an accelerometer. Further, although some examples are described herein in connection with an accelerometer, an OOB communication channel formed by a combination of sensors and events may also be formed using other types of sensors.

As shown in FIG. 3, each of devices 302 and 304 may also include device association logic (eg, logics 330 and 332, respectively). The data sensed by the sensors 320 and 322 can then be exchanged between the two devices and the logics 330 and 332 compare the traces respectively so that both devices 302 and 304 can compare. It may be determined whether the same event 324 has been witnessed, thus verifying the other device. In some embodiments, the foregoing comparison does not necessarily mean a perfect match. Comparison functions implemented by logics 330 and 332 that allow for minor differences may be used. Moreover, here, for example, as described further with respect to FIG. 4, the two devices can share their sensor streams in a manner that allows this comparison to occur safely.

More specifically, FIG. 4 shows a flowchart of a method 400 for securely associating devices, according to one embodiment. Here, for example, with respect to FIG. 3, the various components discussed may be used to perform one or more of the operations of FIG. 4.

3 and 4, in operation 402, two devices to be associated (eg, devices 302 and 304) discover each other and exchange information about their capabilities (eg, The logics 330 and 332 may cause the exchange of information via the wireless communication channel 310) to allow the affiliate process to begin. In operation 404, a shared secret can be generated using sensor data from a commonly detected event. For example, logics 330 and 332 can communicate with respect to event 324 to determine whether they detected the same event. In one embodiment, the shared secret may be communicated over the wireless communication channel 310.

In operation 406, two devices (eg, devices 302 and 304) may authenticate each other (eg, receive information received from an established OOB communication channel based on event 324). using). Further, in operation 406, the devices (eg, logics 330 and 332) may verify that the information exchanged in operation 404 was from the same device in one embodiment. In operation 408, using the data exchanged in operations 404 and 406, both devices (eg, logics 330 and 332) are thereafter (eg, via wireless communication channel 310). It is possible to generate the same symmetric encryption keys that encrypt any communication between them.

In operation 406, a protocol is provided that allows each device 302 and 304 to mutually confirm, via their respective sensors 320 and 322, that another device has witnessed the same event. ) Can be used. In one embodiment, the protocol can ensure that neither of the devices exposes its raw sensed stream (or derived string) to another device first. Otherwise, the system can be susceptible to man-in-the-middle attacks. This problem can be avoided using a commitment function, e.g. a one-way function that allows the device to commit knowledge of the particular piece of information before it is exposed. Can be. Such techniques can be equally applied to both passwords and strings derived from analog sensor streams. The result of these protocols is that each device may obtain some information from another device, which information is then compared at each device (eg, by logics 330 and 332) to identify the other device. Can be. On a given device, if the information matches (as determined by logics 330 and 332), the device has detected that two devices have detected the same event (e.g., event 324) and thus is truly user We know that is the two devices we want to pay.

To enable a system based on analog sensor measurements, a comparison may be made between two data streams from analog sensors (eg, sensors 320 and 322). This can be accomplished in a number of ways, including one or more of the following:

(a) Statistical technique: A statistical technique, such as calculating a correlation coefficient between two streams, is one way of checking the "closeness" of the streams;

(b) Frequency technique: Computing the frequency spectrum of time-series data and comparing the resulting spectral data is another way of comparing waveforms;

(c) Coarse data lookup: comparing strings derived from sensor data for accurate or approximate match; or

(d) Any other way of looking at time series data and checking that they are sufficiently similar.

Some techniques for extracting coarse data that can be used for comparison include one or more of the following:

(1) Time between peaks: One approach to calculating the time between peaks for two streams, which may be roughly the same for two streams. Note that the magnitude of the peaks may be slightly different, but the time at which they occur may be about the same. The coarse measure of the stream may be generated as a string of numbers representing the time span between adjacent peaks for each stream; or

(2) Sequence of peaks: A second approach is to list a sequence of peaks between a plurality of portions of a stream. For example, a three dimensional (3D) accelerometer produces x, y and z axes of data. Peaks between these three streams can occur in any chronological order. For the same data, the peaks should appear in the same order across the two devices in some embodiments. In addition, any other method can be used to extract the coarse data from the sensor stream. This coarse data may enable identification of the "approximation" of the two data streams and verification that the two devices were sensing the same event 324. Once it is established that the two devices have sensed the same event, the two devices are authenticated to each other (eg, in operation 406). They can now complete a secure association setup and begin secure communication (eg, at operation 408).

(3) Dominant frequencies: A third approach is to list the dominant frequency components present in each of the plurality of portions of the stream. For example, a three dimensional (3D) accelerometer produces x, y and z axes of data. Accelerometer readings in the time domain for each axis can be projected in the frequency domain. The coarse frequency values of one or more dominant frequency component (s) (those with the largest magnitude peaks in the frequency domain) for one or more of the axes can be assembled together to produce a string of numbers.

In some embodiments, it may be necessary to guarantee synchronization (in time) between two nodes. In order for the algorithms to produce the same or similar results for each of the two nodes, they begin and end sensing substantially simultaneously. One embodiment may look for specific signal characteristics, such as sharp peaks, to identify a starting point. For example, two nodes with three-dimensional (3D) accelerometers each find a sharp negative acceleration on the z axis, indicating that the user has lifted the two devices from the resting position. Since the two devices are brought together, they can both see certain signal characteristics simultaneously. The end of sampling may occur after a period of time after the start, such that the two nodes have substantially the same inputs to the string generation algorithms.

In some embodiments, an OOB communication channel established by detecting event 324 may be secure from third party interference. Since a person can typically bring the two devices 302 and 304 close to each other during the setup process, he can verify that no other device affects the pairing process. In addition, sensors are often already present in devices (to support existing applications); Thus, additional hardware (or cost) may not need to be added to the system. Moreover, such techniques may be used in wireless devices (e.g., Bluetooth Core Specification version 2.1 (Bluetooth SIG, August 1, 2007) or Wi-Fi Protected Setup (Wi- Fi Alliance (Alliance, Jan. 8, 2007)) can be easily integrated into existing secure alliance methods.

As described in connection with FIGS. 1-4, the signal generators and / or sensors described herein may be used to provide an OOB communication channel to establish a secure association between devices. Such techniques include various computing devices (eg, the devices 102, 104, 302, and / or 304 of FIGS. 1 and 3, respectively) that may include one or more components described with respect to FIGS. 5 and 6. More specifically, Fig. 5 shows a block diagram of a computing system 500 in accordance with one embodiment of the present invention, which includes one or more central processing unit (s) (CPUs). Or processors 502-1 through 502-P (which may be referred to herein as “processor 502” or “processor 502”). (Or bus) 504. Processors 502 may be a general purpose processor, a network processor (which processes data communicated through computer network 503), or another type of processor (RISC). instruction set computer) processor or CISC In addition, the processors 502 may have a single or multiple core design, and the processors 502 having a multi-core design may be identical to each other. It is possible to integrate different types of processor cores on an integrated circuit (IC) die In addition, processors 502 having a multi-core design may be implemented as symmetrical or asymmetrical multiprocessors. Operations described with respect to -4 may be performed by one or more components of system 500. For example, logics 130, 132, 330, and / or 332 may be coupled with processors 502. It may include the same processor.

Chipset 506 may also be in communication with interconnect network 504. Chipset 506 may include a graphical memory control hub (GMCH) 508. GMCH 508 may include a memory controller 510 in communication with memory 512. Memory 512 may store data including instruction sequences executed by processor 502 or any other device included in computing system 500. In one embodiment of the invention, the memory 512 is one or more volatile, such as random access memory (RAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), or other types of storage devices. Storage (or memory) devices. Non-volatile memory such as hard disks may also be used. Additional devices, such as a plurality of CPUs and / or a plurality of system memories, may communicate via the interconnect network 504.

GMCH 508 may also include a graphical interface 514 in communication with graphics accelerator 516. In one embodiment of the present invention, the graphical interface 514 can communicate with the graphics accelerator 516 through an accelerated graphics port (AGP). In one embodiment of the invention, a display (eg, a flat panel display, a cathode ray tube (CRT), a projection screen, etc.) may display a digital representation of an image stored in a storage device such as video memory or system memory. Communication with the graphical interface 514 via, for example, a signal converter, which translates into display signals that are interpreted and displayed by the display. Display signals generated by the display device may pass through various control devices before being interpreted by the display and then displayed on the display.

The hub interface 518 may allow the GMCH 508 and the input / output control hub (ICH) 520 to communicate. ICH 520 may provide an interface for I / O devices in communication with computing system 500. ICH 520 may be connected via a peripheral bridge (or controller) 524, such as a peripheral component interconnect (PCI) bridge, a universal serial bus (USB) controller, or another type of peripheral bridge or controller. Communicate with bus 522. The bridge 524 may provide a data path between the processor 502 and peripheral devices. Other types of topologies may be used. In addition, a plurality of buses may communicate with the ICH 520, for example, via a plurality of bridges or controllers. Moreover, other peripherals in communication with the ICH 520 may, in various embodiments of the invention, be integrated drive electronics (IDE) or small computer system interface (SCSI) hard drive (s), USB port (s), keyboards. , Mouse, parallel port (s), serial port (s), floppy disk drive (s), digital output support (eg, digital video interface (DVI)), or other devices.

The bus 522 may communicate with an audio device 526, one or more disk drive (s) 528, and one or more network interface device (s) 530 (in communication with the computer network 503). Other devices may also communicate over the bus 522. In addition, in some embodiments of the present invention, various components (eg, network interface device 530) may communicate with GMCH 508. In addition, the processor 502 and other components shown in FIG. 5 (including but not limited to one or more components of the GMCH 508, such as the GMCH 508, the memory controller 510, etc.) may form a single chip. Can be combined. Moreover, in some embodiments of the present invention, a graphics accelerator may be included in GMCH 508.

Moreover, computing system 500 may include volatile and / or nonvolatile memory (or storage). For example, non-volatile memory may include one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EPEP), disk drive (eg, For example, 528, a floppy disk, a compact disk ROM (CD-ROM), a digital versatile disk (DVD), a flash memory, a magneto-optical disk, or electronic data (including, for example, instructions) may be stored. Another type of nonvolatile machine readable medium. In one embodiment, the components of system 500 may be arranged in a point-to-point (PtP) configuration. For example, processors, memory, and / or input / output devices may be interconnected by multiple point-to-point interfaces.

6 illustrates a computing system 600 arranged in a point-to-point (PtP) configuration, according to one embodiment of the invention. In particular, FIG. 6 shows a system in which processors, memory, and / or input / output devices are interconnected by multiple point-to-point interfaces. The operations described in connection with FIGS. 1-5 may be performed by one or more components of system 600.

As shown in FIG. 6, system 600 may include several processors, of which only two processors 602 and 604 are shown for clarity. Processors 602 and 604 may include a local memory controller hub (MCH) that enables communication with memories 610 and 612, respectively. The memories 610 and / or 612 may store various data, such as those described with respect to the memory 512 of FIG. 5.

In one embodiment, the processors 602 and 604 may be one of the processors 502 described with respect to FIG. 5. Processors 602 and 604 may exchange data over PtP interface 614 using point-to-point (PtP) interface circuits 616 and 618, respectively. Further, processors 602 and 604 exchange data with chipset 620 via individual PtP interfaces 622 and 624 using point-to-point interface circuits 626, 628, 630, and 632, respectively. can do. The chipset 620 may also exchange data with the graphics circuit 634 via the graphics interface 636, for example using the PtP interface circuit 637.

At least one embodiment of the present invention uses the processors 602 and 604 as one or more of the logics 130, 132, 330, and / or 332 of FIGS. 1 and 3, respectively. However, other embodiments of the present invention may exist in other circuits, logic units, or devices within the system 600 of FIG. 6. Moreover, other embodiments of the present invention may be distributed throughout the several circuits, logic units, or devices shown in FIG. 6.

Chipset 620 may communicate with bus 640 using PtP interface circuit 641. Bus 640 may communicate with one or more devices, such as bridge 642 and I / O devices 643. The bus bridge 642 may communicate via a bus 644 with a keyboard / mouse 645, communication devices 646 (eg, a modem, network interface device, or other computer network 503). Communication device), audio I / O device 647, and / or other devices such as data storage device 648. The data storage device 648 can store code 649 that can be executed by the processors 602 and / or 604.

In various embodiments of the invention, for example, with respect to FIGS. 1-6, the operations described herein may be implemented as hardware (eg, logic circuits), software, firmware, or any combination thereof. It may be stored, for example, machine readable or computer readable, having instructions (or software procedures) used to program a computer (eg, including a processor) to perform the processor described herein. It may be provided as a computer program product, including a possible medium. Machine-readable media can include storage devices such as those described herein.

In addition, such computer readable media may be downloaded as a computer program product, which program may be implemented on a carrier wave or other propagation medium via a communications link (eg, a bus, modem, or network connection). The signals may be sent from a remote computer (eg a server) to the requesting computer (eg a client).

Reference herein to “one embodiment” or “an embodiment” means that a particular feature, structure, and / or characteristic described in connection with the embodiment is included in at least one implementation. The appearances of the phrase “in one embodiment” in various places in the specification may or may not all refer to the same embodiment.

In addition, in the present description and claims, the terms “coupled” and “connected” may be used, along with their derivatives. In some embodiments of the present invention, “connected” may be used to indicate that two or more elements are in direct physical or electrical contact with each other. "Connected" can mean that two or more elements are in direct physical or electrical contact. However, “connected” may also mean that the elements of the two directors are not in direct contact with each other, but may nevertheless cooperate or interact with each other.

As such, although embodiments of the invention have been described in terms specific to structural features and / or methodological acts, it is to be understood that the claimed subject matter may not be limited to the specific features or acts described. Rather, the distinctive features and acts are disclosed as example forms of implementing the claimed subject matter.

A detailed description is provided with reference to the accompanying drawings. In the figures, the left-most digit (s) of a reference number identifies the figure in which the reference number first appears. Using the same reference numerals in different drawings represents the same or similar items.

1 and 3 show block diagrams of secure device federation systems, in accordance with some embodiments.

2 and 4 show flowcharts of methods in accordance with some embodiments.

5 and 6 show block diagrams of embodiments of computing systems, which may be used to implement some embodiments described herein.

<Explanation of symbols for the main parts of the drawings>

102, 104, 302, 304: device

106, 108, 306, 308: Radio

110: wireless channel

120: signal generator

122, 320, 322: sensors

124: OOB channel

130, 132, 330, 332: device association logic

310: wireless channel

324: events

502-1, 502-P, 602, 604: Processor

510: memory controller

512, 610, 612: memory

514: graphical interface

516: graphics accelerator

524: Peripheral Bridge

506, 620: chipset

526: audio device

528: disk drive

530: network interface device (s)

503: network

634 graphics

642: bus bridge

643: I / O devices

647: audio devices

645: keyboard / mouse

646: communication devices

648: Data storage

Claims (51)

A communication channel formed between a signal generator of the first device and a sensor of the second device for communicating authentication signals between the first device and the second device, A wireless communication channel communicates wireless signals between the first device and the second device in response to authentication between the first device and the second device over the communication channel, The signal generator comprises an analog signal generator and the sensor comprises an analog sensor, the communication channel communicating analog authentication signals between the first device and the second device. delete 10. The apparatus of claim 1, wherein the wireless communication channel comprises a non-secure wireless communication channel. The apparatus of claim 1, wherein the wireless communication channel communicates one or more of healthcare related data, entertainment related data, education related data, or telecommunication related data. The apparatus of claim 1, wherein the signal generator comprises a wireless transducer. The device of claim 1, wherein at least one of the first device or the second device comprises a device association logic unit that creates a secure association of the first device and the second device. Device. 7. The apparatus of claim 6, wherein the logic unit comprises a processor. 8. The apparatus of claim 7, wherein the processor comprises one or more processor cores. The apparatus of claim 1, wherein the first device comprises a plurality of signal generators. The apparatus of claim 1, wherein the second device comprises a plurality of sensors. The apparatus of claim 1, wherein the signal generator comprises one or more of a mechanical actuator, a light emitting diode (LED), or a speaker. The apparatus of claim 1, wherein the sensor comprises one or more of an accelerometer, an image capture device, or a microphone. Establishing a communication channel between the signal generator of the first device and the sensor of the second device; Communicating authentication signals between the first device and the second device via the communication channel; And Exchanging discovery information between the first device and the second device Including, And a wireless communication channel communicates wireless signals between the first device and the second device in response to authentication between the first device and the second device over the communication channel. delete The method of claim 13 further comprising exchanging a shared secret between the first device and the second device. 14. The method of claim 13, further comprising generating a session key. A computer readable medium comprising one or more instructions, The instructions, when executed on a processor, cause the processor to: Establish a communication channel between the signal generator of the first device and the sensor of the second device; Communicate authentication signals between the first device and the second device via the communication channel, Configure to exchange discovery information between the first device and the second device, And a wireless communication channel communicates wireless signals between the first device and the second device in response to authentication between the first device and the second device over the communication channel. delete 18. The computer readable medium of claim 17, further comprising one or more instructions for configuring the processor to exchange a shared secret between the first device and the second device. 18. The computer readable medium of claim 17, further comprising one or more instructions for configuring the processor to generate a session key. A first device having a first sensor detecting an event and a logic unit generating a first data set corresponding to the event; And A second device having a second sensor for detecting the event and a logic unit for generating a second data set corresponding to the event; Each of the first device and the second device compares the first data set and the second data set to determine whether the first device and the second device will cooperate; And discovery information is exchanged between the first device and the second device. 22. The method of claim 21, wherein between the first device and the second device in response to authentication between the first device and the second device and based on the comparison of the first data set and the second data set. And a wireless communication channel for communicating wireless signals. 23. The apparatus of claim 22, wherein the wireless communication channel comprises an insecure wireless communication channel. The apparatus of claim 22, wherein the wireless communication channel communicates one or more of healthcare related data, entertainment related data, education related data, or telecommunication related data. The apparatus of claim 21, wherein at least one of the first sensor or the second sensor comprises one or more of an analog sensor or a digital sensor. 22. The apparatus of claim 21, further comprising a communication channel for communicating analog authentication signals between the first device and the second device. The apparatus of claim 21, wherein the first sensor and the second sensor comprise sensors of the same type. 22. The apparatus of claim 21, wherein at least one of the logic unit for generating the first data set or the logic unit for generating the second data set comprises a processor. 29. The apparatus of claim 28, wherein the processor comprises one or more processor cores. The apparatus of claim 21, wherein the first device comprises a plurality of sensors. The apparatus of claim 21, wherein the second device comprises a plurality of sensors. The apparatus of claim 21, wherein at least one of the first sensor or the second sensor comprises one or more of an accelerometer, an image capture device, or a microphone. Generating a shared secret at the first device and at the second device based on the event; Communicating authentication signals between the first device and the second device based on the shared secret; And Exchanging discovery information between the first device and the second device. Including, And a wireless communication channel communicates wireless signals between the first device and the second device in response to authentication between the first device and the second device. delete 34. The method of claim 33, further comprising generating a session key. 36. The method of claim 35, further comprising communicating data between the first device and the second device in accordance with the session key. 36. The method of claim 35, wherein generating the session key is performed in response to the authentication. A computer readable medium comprising one or more instructions, The instructions, when executed on one or more processors, cause the one or more processors to: Generate a shared secret at the first device and at the second device based on the event; Communicate authentication signals between the first device and the second device based on the shared secret; Configure to exchange discovery information between the first device and the second device, And a wireless communication channel communicates wireless signals between the first device and the second device in response to authentication between the first device and the second device. delete 39. The computer readable medium of claim 38, further comprising one or more instructions for configuring the one or more processors to generate a session key. A communication channel formed between a signal generator of the first device and a sensor of the second device for communicating authentication signals between the first device and the second device, A wireless communication channel communicates wireless signals between the first device and the second device in response to authentication between the first device and the second device over the communication channel, And discovery information is exchanged between the first device and the second device. 42. The apparatus of claim 41 wherein the wireless communication channel comprises an insecure wireless communication channel. 42. The apparatus of claim 41, wherein the wireless communication channel communicates one or more of healthcare related data, entertainment related data, education related data, or telecommunication related data. 42. The apparatus of claim 41 wherein the signal generator comprises a wireless converter. 42. The apparatus of claim 41, wherein at least one of the first device or the second device comprises a device association logic unit that creates a secure association of the first device and the second device. 46. The apparatus of claim 45, wherein the logic unit comprises a processor. 47. The apparatus of claim 46, wherein the processor comprises one or more processor cores. 42. The apparatus of claim 41 wherein the first device comprises a plurality of signal generators. The apparatus of claim 41, wherein the second device comprises a plurality of sensors. 42. The apparatus of claim 41, wherein the signal generator comprises one or more of a mechanical actuator, LED, or speaker. 42. The apparatus of claim 41, wherein the sensor comprises one or more of an accelerometer, an image capture device, or a microphone.

Images