KR20150116749A - Apparatus for sharing a session key between devises and the method thereof - Google Patents

Abstract

Disclosed is a method for sharing a session key between a first device and a second device to pair the first device with the second device. The method includes the steps of: obtaining information for defining the session key in the first device; and outputting, from the first device, the information for defining the session key in a form of at least one from an audio signal and visual signal according to a pairing protocol supported in the second device. The second device can directly detect the audio signal and the visual signal or can receive information in a form of user input.

Description

[0001] APPARATUS FOR SHARING A SESSION KEY BETWEEN DEVICE AND THE METHOD THEREOF [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus and method for sharing session keys between devices, and more particularly, to an apparatus and method for sharing session keys between devices, And a method for sharing session keys between devices sharing the same.

Many modern electronic devices have the ability to communicate with other devices.

For example, in a home network environment, users are often using second screen devices to supplement content displayed on a main screen, such as a digital television. Some applications require a secure connection, in order to prevent eavesdropping and interference of the connection. The process of establishing a secure connection between devices may be referred to as " pairing "of the devices.

There are a number of mechanisms that can support secure connections between devices. One of the most common mechanisms is Hypertext Transfer Protocol Secure (HTTPs), which provides a secure connection between the client and server. HTTPs use valid certificates by known certificate authorities. However, this is a complicated mechanism and is not the most appropriate way to enable security pairing between client and server. In particular, one problem with the HTTPs mechanism is that it requires the use of an external certification authority to prevent man in the middle attacks, which is not always appropriate for lightweight client applications.

However, the certificates embedded on the device are potentially dangerous because the certificates may be at risk. Thus, there is an increased need for an improved pairing mechanism that can support secure connections between devices without the need for an external certification authority.

In order to solve the above problems of the present invention, it is an object of the present invention to provide an apparatus and method for session key sharing between devices sharing information defining the session key in the form of an audio signal and / .

According to another aspect of the present invention, there is provided a method for sharing a session key between a first device and a second device for pairing a first device and a second device according to an embodiment of the present invention, The method comprising the steps of: acquiring information defining the session key; and transmitting, by the first device, information defining the session key according to a pairing protocol supported by the second device, at least one of an audio signal and a visual signal And outputting it in the form of a signal.

In this case, the method of sharing the session key according to an embodiment of the present invention may further include the step of the first device identifying a pairing protocol supported by the second device.

In this case, the step of identifying a pairing protocol supported in the second device may include transmitting information identifying a plurality of pairing protocols supported by the first device to the second device, As a pairing protocol, the method may include receiving information identifying any of the plurality of pairing protocols supported by the first device.

Meanwhile, the 'information defining the session key' may include a shared secret.

In this case, the shared secret may be randomly generated in the first device.

Meanwhile, the session key sharing method according to an exemplary embodiment of the present invention is characterized in that the first device derives the session key from the shared secret using a Password Authenticated Key Exchange (PAKE) algorithm. The method comprising the steps of:

In this case, the method of sharing the session key according to an embodiment of the present invention may further comprise receiving, from the second device, information identifying the PAKE algorithm to be used for deriving the session key.

On the other hand, the shared secret is code, and the code can be displayed on the display part.

In this case, the code may be a Quick Response (QR) code.

Meanwhile, a method for sharing a session key between the first device and the second device for pairing a first device and a second device according to an embodiment of the present invention includes: , The second device obtaining the session key from the received information, and the second device storing the session key.

In this case, the information defining the session key includes a shared secret, and the step of acquiring the session key derives the session key from the shared secret using a password authentication key exchange (PAKE) algorithm Can be obtained.

In this case, the sharing method of the session key according to an embodiment of the present invention may further comprise: before the step of receiving the information defining the session key, the second device identifies the PAKE algorithm to be used for deriving the session key And transmitting the information to the first device.

On the other hand, the information defining the session key may be received by a user input in the second device.

On the other hand, the information defining the session key may be received by the second device detecting at least one of an audio signal and a visual signal.

Meanwhile, a method of sharing the session key according to an embodiment of the present invention may include the steps of: receiving information identifying the plurality of pairing protocols supported by the first device; Selecting a pairing protocol supported by the second device from among the plurality of pairing protocols to be transmitted and the second device transmitting information identifying the selected pairing protocol to the first device .

In this case, the audio method may be selected in preference to the visual method in response to information for identifying a plurality of pairing mechanisms that indicate whether the audio protocol and visual protocol are supported by the first device.

According to another aspect of the present invention, there is provided a method of sharing a session key, the method comprising the steps of: generating a session identifier; storing, in a database storing a plurality of session keys and a plurality of session identifiers associated with each of the plurality of session keys, Storing the identifier and the session key, the first device sequentially receiving a message including the session identifier and the encrypted data, and receiving the session key associated with the session identifier included in the received message Determining a session key to be used in decrypting the encrypted data among the plurality of session keys by querying the database to acquire the session key.

On the other hand, the step of acquiring the information defining the session key by the first device may further comprise: when the first device is paired with the third device, acquiring the session key being used by the first device and the third device, Information that defines different session keys may be obtained.

On the other hand, the step of acquiring information defining the session key by the first device may be used when the first device and the third device are paired with each other and stored when the first device is paired with the third device And can retrieve the shared secret as information defining the session key.

Meanwhile, a method of sharing the session key according to an embodiment of the present invention may include a method of sharing a session key by a universal plug and play (UPnp) discovery to request a description file for the second device And receiving the description file, wherein the description file may include metadata indicating one or more pairing protocols supported by the second device.

The method may further include storing information defining the session key in the non-volatile memory of the first device, and storing the session identifier in the volatile memory of the first device.

On the other hand, the first device or the second device may be a digital television.

Meanwhile, a recording medium according to an embodiment of the present invention may store a program for performing at least one method of sharing session keys according to various embodiments described above.

Meanwhile, an apparatus for sharing a session key with an external apparatus according to an embodiment of the present invention includes a key information generator for obtaining information defining a session key, and a session key generation unit for defining the session key according to a pairing protocol supported by the external apparatus And an output unit for outputting information to be output to the display unit in the form of at least one of an audio signal and a visual signal.

In this case, the apparatus for sharing a session key with an external apparatus according to an embodiment of the present invention may further include a pairing unit for identifying the pairing protocol supported by the external apparatus.

In this case, the pairing unit transmits information identifying a plurality of pairing protocols supported by the device to the external device, and the pairing protocol supported by the external device is a pairing protocol supported by any one of the plurality of pairing protocols supported by the device Information that identifies one can be received.

Meanwhile, the 'information defining the session key' may include a shared secret.

In this case, the key information generator may randomly generate the shared secret to obtain the shared secret.

Meanwhile, an apparatus for sharing a session key with an external apparatus according to an embodiment of the present invention includes a 'PAKE algorithm unit' for deriving the session key from the shared secret using a PAKE algorithm .

In this case, an apparatus for sharing a session key with an external apparatus according to an embodiment of the present invention may include a network interface unit for receiving information identifying the PAKE algorithm to be used for deriving the session key from the external apparatus .

On the other hand, the shared secret is a code, and the output unit can display the code on the display unit.

In this case, the code may be a QR code.

Meanwhile, an apparatus for sharing a session key with an external apparatus according to an exemplary embodiment of the present invention includes: receiving information defining a session key from an external apparatus; acquiring the session key from the received information; / RTI >

In this case, the information defining the session key includes a shared secret, and the apparatus further comprises a password authentication key exchange < RTI ID = 0.0 > PAKE) algorithm part '.

In this case, the apparatus includes a network interface unit for communicating with the external apparatus, and the apparatus further comprises information identifying the PAKE algorithm to be used for deriving the session key before receiving the information defining the session key To the external device through the network interface unit.

The apparatus may further include a user interface unit for receiving information defining the session key as a user input.

On the other hand, the apparatus can receive information defining the session key by detecting at least one of an audio signal and a time signal output from the external apparatus.

The apparatus may further include a network interface unit for communicating with the external device. The network interface unit receives information for identifying a plurality of pairing protocols supported by the external apparatus, And a pairing unit configured to select a pairing protocol supported by the device from among a plurality of pairing protocols, and to transmit information identifying the selected pairing protocol to the external device through the network interface unit.

In this case, the pairing unit may select the audio method in preference to the visual method in response to information for identifying a plurality of pairing mechanisms that indicate whether the audio protocol and the visual protocol are supported by the external device .

The apparatus further includes a session manager for generating the session identifier and storing the session identifier and the session key in a database storing a plurality of session keys and a plurality of session identifiers associated with each of the plurality of session keys And the session management unit, when receiving a message including the session identifier and the encrypted data, queries the database to obtain the session key associated with the session identifier included in the received message And determine a session key to be used in decrypting the encrypted data among the plurality of session keys.

Meanwhile, the key information generator may obtain information defining a session key different from the session key used in the device and the third device, when the device is paired with the third device.

On the other hand, if the device is paired with the third device, the device can use the shared secret stored when the device and the third device are paired to retrieve the stored secret as information defining the session key.

The apparatus may further include a universal plug and play (UPnP) discovery unit for performing universal plug and play (UPnP) discovery to request a description file for the external apparatus and receiving the description file , The description file may include metadata indicating one or more pairing protocols supported by the external device.

On the other hand, the apparatus may store information defining the session key in a non-volatile memory of the apparatus, and store the session identifier in a volatile memory of the apparatus.

On the other hand, the device may be a digital television.

1 is a flow chart illustrating a method of sharing a session key between a first and second device in accordance with an embodiment of the present invention;
2 is a flowchart illustrating a method for sharing a session key between a first and second device in accordance with another embodiment of the present invention;
3 is a flowchart illustrating a method of managing a session according to an embodiment of the present invention;
4 depicts an embodiment of the present invention represented as a quick-response code with a shared secret,
Figure 5 illustrates an embodiment of the present invention represented as a numerical code of a shared secret,
6 is a diagram illustrating a system including a digital television and a mobile device in accordance with one embodiment of the present invention.

Hereinafter, the present invention will be described in more detail with reference to the drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 is a diagram illustrating a method of sharing a session key between two devices pairing devices according to an embodiment of the present invention.

In this embodiment, a mobile device such as a smart phone or tablet computer is paired with a digital television (DTV) which is an external device. However, the present invention is not limited to this, and according to another embodiment of the present invention, a different kind of apparatus can be paired.

"Pairing" two devices means exchanging a session key that can be used to encrypt and decrypt the data sent between the two devices. For example, once the devices are paired, each device can encrypt the data using the session key and send the encrypted data to an external device within the payload of the HTTP session, for example. Of the paired devices, the data receiving device can decrypt the encrypted data using the same session key.

In order to share the session key in this embodiment, the DTV starts by identifying a pairing protocol supported by the mobile device, which is an external device, in step S101. The pairing protocol defines a specific technique used when sharing session keys between devices. In this embodiment, the pairing protocol indicates that a shared secret for deriving the session key is represented in the form of a quick-response code.

In this embodiment, both the DTV and the mobile device include a network interface that allows devices to communicate via any appropriate wired or wireless network connection, e.g., WiFi, Bluetooth or ZigBee. Thus, an appropriate pairing protocol compatible with both devices can be negotiated. However, according to another embodiment, the step of identifying the pairing protocol is omitted because both devices can be pre-programmed to simply use the default pairing protocol at all times, in which case both devices will automatically use the same pairing protocol .

After identifying a pairing protocol that is compatible in both the DTV and the mobile device, in step S102 the DTV obtains information defining the session key. In this embodiment, the DTV randomly generates information defining a session key in step S102, but in other embodiments, information defining a session key may be retrieved from the stored list.

As described above, in the present embodiment, the information defining the session key is a shared secret from which the session key can be derived. For example, in step S102, the DTV may first obtain the session key, and then derive the shared secret from the session key. Alternatively, the DTV may generate a directly shared secret.

Although the information defining the session key is obtained after identifying the pairing protocol to be used when sharing the session key in this embodiment, the order of steps S101 and S102 may be changed in another embodiment, May be obtained before the pairing protocol is identified. According to yet another embodiment, steps S101 and S102 can be performed simultaneously by different configurations existing in the DTV.

Next, in step S103, the DTV outputs information defining a session key in the form of an audio signal and / or a visual signal according to the identified pairing protocol. By using an audio signal and / or a visual signal, the information defining the session key can be transmitted only to the external device within the DTV line of sight or the DTV's audible rage of the DTV. Lt; / RTI > Thus, the possibility of a man-in-the-middle attack by a third party in another location, for example in a neighboring building, can be avoided without using an external authentication authority.

As described above, in the present embodiment, the pairing protocol indicates that the shared secret is displayed in the form of a QR code. Therefore, in step S103, the DTV encodes the shared secret into a QR code and displays the QR code on the display screen.

Although the QR code is used in this embodiment, the shared secret may be encrypted differently in other embodiments. Furthermore, embodiments of the present invention are not limited to the use of a shared secret, and in other embodiments, the information defining the session key may accommodate various forms. According to one embodiment, the information defining the session key may be a series of characters, such as a four-digit PIN, in the form of a direct textual representation of the session key.

Next, in step S104, the mobile device receives information defining a session key. Here, various approaches are possible depending on the form in which the DTV outputs the information in step S103. Since the QR code is used in this embodiment, the QR code reader application on the mobile device is used to scan the displayed QR code to obtain the shared secret encrypted with the QR code in step S104. That is, the mobile device directly detects the time signal output by the DTV.

In another embodiment, the shared secret may be encrypted with an audio signal and output via a speaker, in which case the mobile device may directly detect the audio signal using the microphone. In another embodiment, a series of characters representing the shared secret or session key may itself be displayed in step S103, and may be received in step S104 in the following manner. For example, a user may enter the characters directly into a mobile device via a user interface, or by capturing an image of a DTV screen and extracting a series of characters from the image using an optical character recognition (OCR) A series of characters representing the secret or session key shared in S104 may be received by the mobile device.

Next, in step S105, the mobile device transmits an appropriate algorithm, for example, Simple Password Exponential Key Exchange (SPEKE), Password Authenticated Key Exchange by Juggling (J-PAKE) , Or a Password Authenticated Key Exchange (PAKE) algorithm, such as Encrypted Key Exchange (EKE), to derive the session key from the shared secret. As with the pairing protocol, the two devices can negotiate which algorithm to use and can be pre-programmed with the same algorithm as the default.

Then, in step S106, the mobile device stores the session key. At this time, the DTV and the mobile device are now paired and can securely communicate using the shared session key.

Although the DTV is responsible for generating the session key in the method shown in Figure 1, in other embodiments the roles of the devices may be changed so that the mobile device can generate the session key and share the session key with the DTV. have. Further, the present invention is not limited to pairing a DTV and a mobile device, and any devices can be paired with each other.

2 is a diagram for explaining a method of sharing a session key between a first device and a second device according to an embodiment of the present invention.

Referring to Figure 2, Universal Plug and Play (UPnP) discovery is used to identify and select the appropriate pairing protocols supported on both devices.

First, in step S201, the mobile device performs a UPnP discovery to request a description file for the DTV, and a discovery request is received by the DTV in step S202.

In response to the discovery request, the DTV generates a description file containing metadata indicating one or more pairing protocols supported by the DTV, and transmits the description file to the mobile device in step S203. In the present embodiment, an XML (Extensible Markup Language) format is used as a description file and is as follows:

<? xml version = "1.0"?>

<root ...>

<xs: element name = "pakevalues" type = "valuelist">

<xs: element name = "pairingtypes" type = "valuelist">

<device SupportPairing = "true">

<pakevalues> j-pake speke eke </ pakevalues>

<pairingtypes> pin qr </ pairingtypes>

</ device>

</ root ...>

In the present embodiment, the component device (device element) contains properties SupportPairing (attribute SupportPairing). Here, the attribute SupportPairing indicates whether the DTV supports the audio-visual pairing protocol according to the concept of the present invention. The attribute is set to "TRUE" if the audio-visual protocol is supported, or "FALSE" if the audio-visual protocol is not supported. The element pakevalues (element pakevalues ) contains a list of PAKE algorithms supported by the DTV, and the PAKE algorithm list can be used to derive a session key from a shared secret. In this embodiment, DTV supports the use of J-PAKE, SPEKE and EKE algorithms. Pairingtypes element (element pairingtypes) are different types of audio supported by the DTV - includes a list of visual pairing protocol. In this embodiment, QR-based and PIN-based visual pairing protocols are supported.

In step S204, the mobile device receives the description file from the DTV. Then, in step S205, the mobile device selects an algorithm and a pairing protocol supported by the mobile device, from the algorithm and the pairing protocols identified in the description file.

In some embodiments, in response to the description file indicating that the audio protocol and visual protocol are supported by the first device, the second device is processed to automatically select an audio pairing protocol prior to the visual pairing protocol . For example, the audio method may override the viewing method since it may be less irritating when the user is watching the current TV program.

Next, in step S206, the mobile device transmits information identifying the selected algorithm and the pairing protocol to the DTV in the form of a pairing request, and the DTV receives the pairing request in step S207. Then, in step S208, the DTV can identify the algorithm that is signaled in the pairing request and the pairing protocol as being supported by the mobile device.

The session key is shared with the mobile device according to the pairing protocol identified in steps S209, S210, S213, S214 and S215 after identifying the appropriate pairing protocol in step S208. Steps S209, S210, S213, S214, and S215 correspond to steps S102 to S106 in Fig. 1, respectively, and therefore detailed description will be omitted in the overlapping range. In step S214, the mobile device derives the session key using the PAKE algorithm signaled to the DTV in the pairing request.

Further, after acquiring the shared secret in step S209, in step S211, the DTV derives the shared secret using the PAKE algorithm signaled in the pairing request. This ensures that both the DTV and the mobile device derive the same session key from the shared secret. In step S212, the DTV stores the derived session key.

In the embodiment shown in FIG. 2, the same device that performs UPnP discovery also selects a pairing protocol to be used when sharing the session key. However, the present invention is not limited to this method. In another embodiment, the device may include information relating to its capabilities in a UPnP discovery request, such as including at least one of the elements pakevalues (elements pakevalues ) and element pairingtypes (elements pairingtypes ) as described above . The device receiving the UPnP discovery request may then use the information to select an algorithm and / or pairing protocol compatible with both devices and to transmit the selected algorithm / protocol to another device in the UPnP description file (signal). In addition, in some embodiments, a combination of these two approaches may be used, e.g., one device selects a PAKE algorithm and the other device selects a pairing protocol.

By using the method shown in FIG. 2 to negotiate an appropriate algorithm and / or pairing protocol between the devices, it is possible through the embodiments of the present invention to allow devices with different capabilities to pair with each other. For example, DTV can be paired with a smartphone device that includes a camera using a QR-based pairing protocol, and the same DTV is paired with a cameraless tablet computer using a user-input PIN-based pairing protocol .

3 is a diagram for explaining a session management method according to an embodiment of the present invention. Referring to FIG. 3, the session management method starts from any one of the devices. For example, in S301, a pairing request is transmitted to the partner device. The pairing request is received by the DTV in step S302. Steps S301 and S302 correspond to S206 and S207, respectively, of Fig. 2, and if necessary, various aspects of the method of Figs. 2 and 3 may be combined in an embodiment of the present invention.

More specifically, in step S301, the mobile device (client) requests initiation of a secure session by connecting to a uniform resource locator (URL) in step S206. In the present embodiment, the URL is defined as follows:

http: // server_ip / ws / pairing

server _ ip is the IP (Internet Protocol) address of the server that the client is trying to connect. In this case, the server is DTV. The mobile device signals which algorithm and pairing protocol will be used as a parameter to the connection URL, such as:

http: // server_ip / ws / pairing? step = 0 & app_id = xyz & device_id = xyz & pakevalues = eke & pairingtype = qr

In this embodiment, the pake value "EKE" is signaled and the pairing type (protocol) "QR" is signaled. Also, as shown in the above example, the pairing request includes an application identifier (app_id) for the application initiating the connection and a device identifier (device_id) for the mobile device. By using application identifiers, multiple connections for different applications can be supported simultaneously between the same two devices.

In steps S303 through S306, depending on the algorithm and protocol signaled in the pairing request, the session key may be obtained and shared between the DTV and the mobile device using any of the methods described above. To avoid troubles, duplicate explanation is omitted.

In some embodiments, if the DTV has already been paired with another device, the DTV in step S303 may be processed to obtain a session key that is different from the session key already being used by the DTV and other devices. This maintains the security of the connection between the DTV and the other device by preventing the mobile device from joining a session that is already in progress. Alternatively, the DTV may be processed in step S303 to retrieve a shared secret that has been previously used and stored, if it is paired with another device. This allows the mobile device to join the existing session and communicate with the same session key as the DTV and other devices.

Then, in steps S307 and S308, a session ID is generated by the DTV and transmitted to the mobile device. In another embodiment, steps S307 and S308 may be performed at any other stage, e.g., the session ID may be generated and transmitted prior to outputting the shared secret. In steps S309 and S310, each device stores the pairing information in a non-volatile memory and the session information in a volatile memory.

Once the session information is stored, the devices can communicate securely. For example, in step S311, the mobile device may generate the message by encrypting the data using the current session key, and transmitting the encrypted data in a payload of the message that also includes the session identifier. Upon receiving the message in step S312, the DTV can retrieve the session key corresponding to the session identifier received in step S313 from the volatile memory. Then, in step S314, the DTV can decrypt the data using the retrieved session key.

Any of the methods shown in Figures 1, 2, and 3 may be implemented by software instructions in one or more computer programs. When such a program is executed by one or more processors in a device, the device may perform the appropriate method.

 FIG. 4 illustrates that a secret that is shared according to an embodiment of the present invention is represented by a QR (quick response) code. As shown in FIG. 4, the DTV 410 displays the shared secret in the form of a QR code 411, which can be scanned using the QR reading application on the mobile device 420. In some embodiments, the session key itself may be embedded directly in the QR code without using a shared secret. Because the shared secret is not used in such an embodiment, the PAKE algorithm described above with reference to Figures 2 and 3 is not required.

FIG. 5 illustrates that a shared secret, which is a four-digit pin code, is represented as a numeric code, in accordance with an embodiment of the present invention. 5, the DTV 510 displays a PIN code 511 and the user inputs the displayed code to the mobile device 520 via the user interface screen 521. [

Referring to FIG. 6, a system including a digital television and a mobile device is shown in accordance with an embodiment of the present invention. In FIG. 6, the specific elements may be implemented in software or hardware, or a combination of both.

6, in this embodiment, the DTV 610 includes a pairing unit 611, a key information generator 612, a PAKE algorithm unit 613, a session management unit 614, a network interface unit 615, A display unit 616, a speaker 617, and a UPnP discovery unit 618. The mobile device 620 includes a pairing unit 621, a user interface unit 622, a PAKE algorithm unit 623, a session management unit 624, a network interface unit 625, a camera 626, a microphone 627, And a UPnP discovery unit 628.

The components shown in FIG. 6 provide the DTV 610 and the mobile device 620 with the necessary functionality to perform any of the methods described above with reference to FIGS. 1, 2 and 3. It will be appreciated that certain features may be omitted in certain embodiments when the functionality provided by the components is not required. For example, when the session key is embedded directly into the QR code, the PAKE algorithm is not required and thus the PAKE algorithm part can be omitted.

While specific embodiments of the invention have been described herein with reference to the drawings, it will be understood that many modifications and variations are possible without departing from the scope of the invention as defined in the claims.

A method for session key sharing between devices in accordance with various embodiments described above may be stored in a non-transitory readable medium. Such non-transiently readable media can be used in various devices.

A non-transitory readable medium is a medium that stores data for a short period of time, such as a register, cache, memory, etc., but semi-permanently stores data and is readable by the apparatus. Specifically, it may be a CD, a DVD, a hard disk, a Blu-ray disk, a USB, a memory card, a ROM, or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the present invention.

611: Pairing unit 612: Key information generator
613: PAKE algorithm unit 614:
615: Network interface unit 616: Display unit
617: Speaker 618: UPnP Discovery Rib

Claims (45)

A method for sharing a session key between a first device and a second device for pairing a first device and a second device,
The first device obtaining information defining the session key; And
And outputting information defining the session key in the form of at least one of an audio signal and a visual signal according to a pairing protocol supported by the second device by the first device, Way. The method according to claim 1,
Wherein the first device identifies a pairing protocol supported by the second device. &Lt; RTI ID = 0.0 &gt; 31. &lt; / RTI &gt; 3. The method of claim 2,
Wherein identifying a pairing protocol supported by the second device comprises:
Transmitting information identifying a plurality of pairing protocols supported by the first device to the second device; And
And receiving information identifying any of the plurality of pairing protocols supported by the first device as a pairing protocol supported by the second device. 4. The method according to any one of claims 1 to 3,
Wherein the 'information defining the session key' includes a shared secret. 5. The method of claim 4,
Wherein the shared secret is randomly generated in the first device. 5. The method of claim 4,
Further comprising: the first device deriving the session key from the shared secret using a Password Authenticated Key Exchange (PAKE) algorithm. The method according to claim 6,
Further comprising: receiving, from the second device, information identifying the PAKE algorithm to be used in deriving the session key. 5. The method of claim 4,
The shared secret is a code,
Wherein the code is displayed on a display unit. 9. The method of claim 8,
Wherein the code is a Quick Response (QR) code. A method for sharing a session key between a first device and a second device for pairing a first device and a second device,
Receiving information defining the session key by the second device;
The second device obtaining the session key from the received information; And
And storing the session key by the second device. 11. The method of claim 10,
Wherein the information defining the session key includes a shared secret,
Wherein the obtaining the session key comprises:
And deriving the session key from the shared secret using a password authentication key exchange (PAKE) algorithm. 12. The method of claim 11,
Further comprising: before the step of receiving the information defining the session key, the second device transmitting information identifying the PAKE algorithm to be used in deriving the session key to the first device How session keys are shared. 13. The method according to any one of claims 10 to 12,
Wherein the information defining the session key is received by a user input at the second device. 13. The method according to any one of claims 10 to 12,
The information defining the session key includes:
Wherein the second device is received by detecting at least one of an audio signal and a visual signal. 13. The method according to any one of claims 10 to 12,
The second device receiving information identifying a plurality of pairing protocols supported by the first device;
Selecting a pairing protocol supported by the second device from among the plurality of pairing protocols supported by the first device; And
And the second device sending information identifying the selected pairing protocol to the first device. &Lt; Desc / Clms Page number 22 &gt; 16. The method of claim 15,
Wherein the audio method is selected in preference to the visual method in response to information for identifying a plurality of pairing mechanisms indicating whether the audio protocol and the visual protocol are supported by the first device How to share. 4. The method according to any one of claims 1 to 3,
Generating a session identifier;
Storing the session identifier and the session key in a database storing a plurality of session keys and a plurality of session identifiers associated with each of the plurality of session keys;
The first device sequentially receiving a message including the session identifier and the encrypted data; And
Determining a session key to be used in decrypting the encrypted data among the plurality of session keys by querying the database to obtain the session key associated with the session identifier included in the received message The method of claim 1, further comprising: 4. The method according to any one of claims 1 to 3,
Wherein the step of the first device obtaining information defining the session key comprises:
If the first device is in a paired state with the third device, acquiring information defining a session key different from the session key being used by the first device and the third device. 4. The method according to any one of claims 1 to 3,
Wherein the step of the first device obtaining information defining the session key comprises:
When the first device is paired with the third device, searches the shared secret stored and used when the first device and the third device are paired as information defining the session key. How to share. 4. The method according to any one of claims 1 to 3,
Performing a universal plug and play (UPnp) discovery to request the description file for the second device; And
Further comprising: receiving, by the first device, the description file;
Wherein the description file includes metadata indicating one or more pairing protocols supported by the second device. 4. The method according to any one of claims 1 to 3,
Storing information defining the session key in a non-volatile memory of the first device; And
And storing the session identifier in a volatile memory of the first device. 4. The method according to any one of claims 1 to 3,
Wherein the first device or the second device is a digital television. In the recording medium,
A recording medium storing a program for performing a method of sharing a session key according to claim 1 or 10. 1. An apparatus for sharing a session key with an external device,
A key information generator for obtaining information defining a session key; And
And an output unit for outputting information defining the session key according to a pairing protocol supported by the external device, in at least one of an audio signal and a time signal. 25. The method of claim 24,
And a pairing unit for identifying the pairing protocol supported by the external device. 26. The method of claim 25,
Wherein the pairing unit comprises:
And transmits information identifying a plurality of pairing protocols supported by the device to the external device, the information identifying any of the plurality of pairing protocols supported by the device is received as a pairing protocol supported by the external device Lt; / RTI &gt; 27. The method according to any one of claims 24 to 26,
Wherein the 'information defining the session key' comprises a shared secret. 28. The method of claim 27,
Wherein the key information generator comprises:
And randomly generating the shared secret to obtain the shared secret. 28. The method of claim 27,
(PAKE) algorithm part for deriving the session key from the shared secret using a PAKE algorithm. 30. The method of claim 29,
And a network interface for receiving from the external device information identifying the PAKE algorithm to be used for deriving the session key. 28. The method of claim 27,
The shared secret is a code,
The output unit includes:
And displays the code on the display unit. 32. The method of claim 31,
Wherein the code is a QR code. 1. An apparatus for sharing a session key with an external device,
Receiving information defining a session key from an external device, obtaining the session key from the received information, and storing the session key. 34. The method of claim 33,
Wherein the information defining the session key includes a shared secret,
The apparatus comprises:
And a 'password authentication key exchange (PAKE) algorithm part' for deriving the session key from the shared secret using a password authentication key exchange (PAKE) algorithm. 35. The method of claim 34,
The apparatus includes a network interface unit for communicating with the external apparatus,
Wherein the device transmits information identifying the PAKE algorithm to be used for deriving the session key to the external device via the network interface unit before receiving the information defining the session key. 37. The method according to any one of claims 33 to 35,
The apparatus comprises:
And a user interface unit for receiving information defining the session key as a user input. 37. The method according to any one of claims 33 to 35,
The apparatus comprises:
And receives information defining the session key by detecting at least one of an audio signal and a time signal output from the external apparatus. 37. The method according to any one of claims 33 to 35,
The apparatus comprises:
And a network interface unit for communicating with the external device, wherein the network interface unit receives information identifying a plurality of pairing protocols supported by the external device,
Further comprising a pairing unit configured to select a pairing protocol supported by the device from among the plurality of pairing protocols supported by the external device,
And transmits information identifying the selected pairing protocol to the external device through the network interface unit. 39. The method of claim 38,
Wherein the pairing unit comprises:
Wherein the audio method is selected in preference to the visual method in response to information for identifying a plurality of pairing mechanisms indicating whether the audio protocol and the visual protocol are supported by the external device. 34. The method according to claim 24 or 33,
The apparatus comprises:
And a session manager for storing the session identifier and the session key in a database storing a plurality of session keys and a plurality of session identifiers associated with each of the plurality of session keys,
The session management unit,
Receiving a message including the session identifier and the encrypted data, and querying the database to obtain the session key associated with the session identifier included in the received message, And determines a session key to be used when decrypting the encrypted data. 25. The method of claim 24,
Wherein the key information generator comprises:
And obtains information defining a session key different from the session key used in the device and the third device if the device is in a paired state with the third device. 25. The method of claim 24,
The apparatus comprises:
When the device is paired with the third device, searches the shared secret stored and used when the device and the third device are paired as information defining the session key. 34. The method according to claim 24 or 33,
The apparatus comprises:
Further comprising a Universal Plug and Play (Discovery) unit for performing universal plug-and-play (UPnP) discovery to request a description file for the external device, and receiving the description file,
Wherein the description file includes metadata indicating one or more pairing protocols supported by the external device. 34. The method according to claim 24 or 33,
The apparatus comprises:
Storing information defining the session key in a non-volatile memory of the device, and storing the session identifier in a volatile memory of the device. 34. The method according to claim 24 or 33,
Characterized in that the device is a digital television.

Images