Secure authenticated distance measurement

A first communication device configured for determining whether protected content stored on the first communication device is available for access by a second communication device, the first communication device comprising:

• means for performing an authentication of the second communication device, the authentication of the second device comprises:
• receiving a certificate of the second device;
• verifying that that the certificate of said second device identifies the second device as complying with a set of predefined compliance rules;
• means for securely sharing a common secret with the second communication device after the second communication device is authenticated;
• means for performing a round trip time measurement between the first communication device and the second communication device comprising:
• transmitting a first signal to said second device at time t1;
• receiving at time t2 a second signal from said second device, said second signal being generated using said common secret;
• determining said round trip time measurement as a difference between time t1 and time t2;
• means for checking whether the measured round trip time is within a predefined interval,
• means for generating a third signal using said common secret;
• means for checking whether said second signal and said third signal are identical;
• and
• means for allowing access to said protected content when said round trip time measurement is within the predefined interval and the second and third signals are identical.

A system for secure transfer of protected content comprising a first communication device in communication with a second communication device, the first communication device comprising:

• a memory storing a common secret,
• processing means:
• performing an authentication of the second communication device comprising:
• receiving a certificate of said second device;
• checking whether the certificate of said second communication device is compliant with an expected identification of the second communication device;
• securely sharing the common secret with the second communication device after the second communication device is authenticated;
• generating a third signal using the common secret;
• transmitting a first signal to the second communication device;
• receiving a second signal from said second communication device;
• checking whether said second and third signals are identical;
• performing a round trip time measurement between the first communication device and the second communication device using times associated with the first and second signals,
• checking whether the measured round trip time is within a predefined interval;
• and
• transmitting the protected content to the second device depending on when the round trip time measurement is within the predefined interval and the second and third signals are identical.

A first device configured for determining whether protected content stored on a first communication device is available for access by a second communication device, the second device being adapted for receiving a first signal from the first device, generating a second signal according to a common secret, and transmitting the second signal to the first device, the first device comprising:

• a transmitter;
• a receiver;
• a memory storing the common secret;
• a bus connected to the memory;
• a processor connected to the bus and controlling the transmitter and receiver, the processor executing the steps of:
• measuring a round trip time between the first device and the second device, said measured round trip time being determined based on a time difference between signals transmitted between the first and second devices,
• generating a third signal depending on the common secret;
• determining whether the second signal received from the second device during the round trip measurement is identical to the third signal to verify that the second signal was generated using the common secret;
• checking whether said measured round trip time is within a predefined interval,
• authenticating the second device, the authentication of the second device including:
• receiving a certificate of the second device;
• and
• verifying that the certificate of the second device identifies the second device as complying with a set of predefined compliance rules;
• and
• securely transmitting the common secret to the second device after the second device has been authenticated.