# US 9,436,819 B2 · Securely pairing computing devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,819 B2 - Document ID: US9436819B2 - Status: Granted - Kind: B2 - Application number: 14/493,621 - Filed: 2014-09-23 - Published: 2016-03-24 - Granted: 2016-09-06 - Earliest claimed: 2014-09-23 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Avi Priev; Avishay Sharaga; Hormuzd Khosravi - Web page: https://patentgrep.com/patent/US9436819B2 ## CPC - G06F 21/44: Program or device authentication - G06F 21/31: User authentication - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04W 12/06: Authentication - H04W 12/50: Secure pairing of devices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In an embodiment, an apparatus comprises a secure storage to store an entry having an identifier of a device to be paired with the apparatus and a master key shared between the apparatus and the device, and a connection logic to enable the apparatus to be securely connected to the device according to a connection protocol in which the device is authenticated based on the identifier received from the device and the master key. Other embodiments are described and claimed. ## Claims ### Claim 1 An apparatus comprising: a secure storage to store an entry having an identifier of a device to be paired with the apparatus and a master key shared between the apparatus and the device; and a connection logic to enable the apparatus to be securely connected to the device when the device is physically connected to the apparatus via a wired connection according to a wireless connection protocol in which the device is authenticated based on the identifier received from the device and the master key, the connection logic to generate a set of transport keys based on the master key and attribute information received from the device, wherein after the secure connection a communication between the apparatus and the device is to be protected using the set of transport keys. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein after the secure connection between the device and the apparatus, the connection logic is to enable the device to obtain information stored in a second storage of the apparatus. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the apparatus comprises a base portion of a detachable portable computing device and the device comprises a detachable portion of the detachable portable computing device. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the detachable portion includes a display, a processor, and a storage, wherein the storage includes a secure portion to store an identifier of the apparatus and the master key. ### Claim 5 (depends on 3) The apparatus of claim 3, wherein the apparatus and the device are pre-paired during manufacture of the detachable portable computing device. ### Claim 6 (depends on 3) The apparatus of claim 3, wherein the entry of the secure storage having the device identifier and the master key comprises a default entry stored during the manufacture of the detachable portable computing device, the default entry to remain in the secure storage when the detachable portable computing device is to be restored to a factory default condition. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the apparatus further comprises a wireless interface to communicate wirelessly with the device to perform the connection protocol. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the connection logic is to communicate attribute information of the apparatus to the device according to the connection protocol, the attribute information of the apparatus to enable the device to generate the set of transport keys. ### Claim 9 (depends on 1) The apparatus of claim 1, further comprising a security logic to authenticate a user of the apparatus according to a multi-factor authentication. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the connection logic is to enable the secure connection responsive to a request of the user after the user authentication. ### Claim 11 (depends on 9) The apparatus of claim 9, further comprising a pairing logic, responsive to a request of the user, to pair the apparatus with a second device according to a pairing protocol in which a second master key is generated and stored in a second entry of the secure storage with a second identifier of the second device. ### Claim 12 At least one non-transitory computer readable medium including instructions that when executed enable a system to: connect a first portion and a second portion of a computing device, while the first portion and the second portion are to be physically connected, according to a wireless communication protocol using a shared key, including generation of a set of transport keys in the first portion and generation of the set of transport keys in the second portion; and after the connection of the first portion and the second portion, encrypt data communications between the first portion and the second portion using the set of transport keys. ### Claim 13 (depends on 12) The at least one non-transitory computer readable medium of claim 12, wherein the connection of the first portion and the second portion includes: authentication of the first portion in the second portion, using an identifier for the first portion and the shared key, the identifier received from the first portion. ### Claim 14 (depends on 13) The at least one non-transitory computer readable medium of claim 13, further comprising instructions that when executed, responsive to authentication of the first portion, cause the second portion to transmit an identifier for the second portion and attribute information for the second portion to the first portion. ### Claim 15 (depends on 14) The at least one non-transitory computer readable medium of claim 14, further comprising instructions that when executed enable: receipt, in the second portion, of an acknowledgment message regarding authentication of the second portion in the first portion and including attribute information for the first portion; and generation of the set of transport keys using the shared key and the attribute information for the first portion. ### Claim 16 (depends on 14) The at least one non-transitory computer readable medium of claim 14, wherein the authentication of the first portion comprises: access to an entry in a secure storage of the second portion including the identifier for the first portion and the shared key, using the identifier for the first portion. ### Claim 17 A system comprising: a base portion including one or more user interface devices, a first processor, and a first secure storage including a first entry to store a master key and an identifier for a display portion to couple with the base portion; and the display portion including a display, a second processor, and a second secure storage including a first entry to store the master key and an identifier for the base portion, wherein the base portion and the display portion are configured to securely connect according to a wireless connection protocol via a physical connector that couples the base portion and the display portion. ### Claim 18 (depends on 17) The system of claim 17, wherein after the secure connection, the display portion and the base portion are to communicate in an encrypted manner. ### Claim 19 (depends on 17) The system of claim 17, wherein the system comprises a detachable portable computing system. ### Claim 20 (depends on 19) The system of claim 19, wherein the first entry of the first secure storage and the first entry of the second secure storage comprise a default entry stored during the manufacture of the detachable portable computing system, the default entry to remain in the first secure storage and the second secure storage when the detachable portable computing system is to be restored to a factory default condition. ### Claim 21 (depends on 17) The system of claim 17, wherein the base portion comprises a wireless interface to wirelessly interface with a first access point and to discover the display portion when the display portion is wirelessly coupled to a second access point located remotely to the first access point. ### Claim 22 (depends on 21) The system of claim 21, wherein the first and second processors comprise a connection logic to perform secure connection according to a connection protocol in which a set of transport keys is generated based on the master key and corresponding identifiers and attribute information, wherein after the secure connection is established a communication between the base portion and the display portion is to be protected using the set of transport keys, the secure connection via an Internet protocol connection between the base portion and the display portion. ### Claim 23 (depends on 17) The system of claim 17, wherein the system comprises a convertible portable computing device, and wherein in a first mode communication between the base portion and the display portion is to be encrypted according to transport keys generated during the wireless connection protocol, and in a second mode communication between the base portion and the display portion is to be unencrypted.