US 10,219,157 B1Granted

Secure verified attribute exchange between parties in physical proximity

AssigneeSymantec Corporation

InventorsKevin Jiang, Ilya Sokolov

Life of this patent

Estimating the term…

Loading patent…

Abstract

A first mobile device securely transmits selected verified attributes concerning the corresponding user to a second mobile device. The first device broadcasts verified, signed biometric information concerning its user, and the user's public key. The second device confirms the received broadcasted biometric information, based on sensor input. For example, sensors on the second device generate images of the first user, who is physically proximate, and information gleaned from the images is compared to broadcasted biometric information. In response to confirming the broadcasted biometric information, the second device transmits a request to establish a secure channel, and both devices generate a session key. The first device selects specific verified attributes to provide to the second device, based on context, policy and/or user directive. The first device then encrypts the attributes using the session key, and transmits them to the second device. The second device receives and decrypts the attributes.

Claims20

Dependent claims

A computer implemented method for securely transmitting selected verified attributes between a first mobile computing device having a first user and a second mobile computing device having a second user over a secure channel, the method comprising the steps of:

broadcasting, by the first mobile computing device, biometric information concerning the first user, the broadcasted biometric information being independently confirmable by visual and/or aural observation of the first user, the broadcasted biometric information having been verified and signed by a verification service separate from the first mobile computing device and the second mobile computing device;
broadcasting, by the first mobile computing device, a public key of the first user, the public key having been signed by the verification service;
receiving, by the first mobile computing device from the second mobile computing device, a request to establish a secure channel for transmission of verified attributes, in response to the second mobile computing device having confirmed the broadcasted biometric information concerning the first user;
generating a session key based on the broadcasted public key, by the first mobile computing device;
selecting, by the first mobile computing device, specific verified attributes to provide to the second mobile computing device, from a set of available verified attributes concerning the first user, the set of available verified attributes concerning the first user having been verified and signed by the verification service;
encrypting the selected verified attributes using the session key, by the first mobile computing device, the selected verified attributes further comprising verified attributes of at least one type from a group of types consisting of:
verified attributes based on current physical location;
verified attributes based on identity of at least one target recipient;
verified attributes based on policy specifying terms and conditions according to which to exchange information;
verified attributes based on a directive received from the first user;
and
transmitting the encrypted verified attributes to the second mobile computing device, by the first mobile computing device.

9 more elements

receiving, by the second mobile computing device from the first mobile computer device, broadcasted biometric information concerning the first user, the broadcasted biometric information being independently confirmable by visual and/or aural observation of the first user, the broadcasted biometric information having been verified and signed by a verification service separate from the first mobile computing device and the second mobile computing device;
receiving, by the second mobile computing device from the first mobile computer device, a broadcasted public key of the first user, the broadcasted public key having been signed by the verification service;
confirming, by the second mobile computing device based on sensor input, the broadcasted biometric information concerning the first user received from the first mobile computing device;
transmitting, by the second mobile computing device to the first mobile computing device, a request to establish a secure channel for receipt of verified attributes concerning the first user, in response to having confirmed the broadcasted biometric information concerning the first user received from the first mobile computing device;
generating a session key based on the broadcasted public key, by the second mobile computing device;
receiving encrypted verified attributes concerning the first user, by the second mobile computing device from the first mobile computing device, the received verified attributes having been selected by the first mobile computing device to provide to the second mobile computing device, from a set of available verified attributes concerning the first user, the selected verified attributes further comprising verified attributes of at least one type from a group of types consisting of:
verified attributes based on current physical location;
verified attributes based on identity of at least one target recipient;
verified attributes based on policy specifying terms and conditions according to which to exchange information;
verified attributes based on a directive received from the first user;
and
decrypting the received encrypted verified attributes using the session key, by the second mobile computing device.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/286,424Filed 5 Oct 2016
Granted: 26 Feb 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04W 12/06
Security arrangements; Authentication; Protecting privacy or anonymity: authentication
H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…
H04L 63/062
For supporting key management in a packet data network: for key distribution, e.g. centrally by trusted party
H04L 63/0861
For authentication of entities: using biometrical features, e.g. fingerprint, retina-scan