# US 9,438,572 B2 · Establishing a device-to-device communication session > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,572 B2 - Document ID: US9438572B2 - Status: Granted - Kind: B2 - Application number: 14/424,691 - Filed: 2013-08-29 - Published: 2015-08-06 - Granted: 2016-09-06 - Earliest claimed: 2012-09-06 - Assignees: Koninklijke KPN N.V.; Nederlandse Organisatie voor toegepast-natuurwetenschappelijk onderzoek TNO - Applicants: Koninklijke KPN N.V.; Nederlandse Organisatie voor Toegepast-Natuurwetenschappelijk Onderzoek TNO - Inventors: Antonius Norp; Frank Fransen; Sander De Kievit - Web page: https://patentgrep.com/patent/US9438572B2 ## CPC - H04W 76/14: Direct-mode setup - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04W 12/041: Key generation or derivation - H04W 12/0471: Key exchange - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - H04W 12/069: using certificates or pre-shared keys - H04W 72/1215: {for collaboration of different radio technologies} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 92/18: between terminal devices - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method is disclosed for establishing a device-to-device communication session between mobile devices (MD1, MD2) which are mutually connectable via a D2D communication channel (DDC) and individually connectable to a mobile network (MN), comprising: preloading (120) an initiation key on each of the mobile devices (MD1, MD2), the initiation key being associated with a validity period; and on each of the mobile devices (MD1, MD2), verifying (140) a validity of the initiation key based on a current time; if the initiation key is deemed valid, generating (160) a session key using the initiation key by using the initiation key in performing (164, 166) a key agreement procedure between the mobile devices (MD1, MD2) over the D2D communication channel (DDC), the key agreement procedure resulting in the session key if the initiation key used by each of the mobile devices matches; and establishing (180) the D2D communication session over the D2D communication channel (DDC) based on the session key. ## Claims ### Claim 1 Method for establishing a device-to-device (D2D) communication session between mobile devices which are mutually connectable via a D2D communication channel and individually connectable to a mobile network, comprising: preloading an initiation key on each of the mobile devices, the initiation key being associated with a validity period; and on each of the mobile devices: verifying a validity of the initiation key based on a current time; requesting a further initiation key via the mobile network if no initiation key is deemed valid; if the initiation key is deemed valid, generating a session key using the initiation key by using the initiation key in performing a key agreement procedure between the mobile devices over the D2D communication channel, the key agreement procedure resulting in the session key based on a match of the respective initiation keys used by each of the mobile devices; and establishing the D2D communication session over the D2D communication channel based on the session key. ### Claim 2 (depends on 1) Method according to claim 1, wherein the preloading the initiation key comprises providing the initiation key to each of the mobile devices via the mobile network when each respective mobile device is connected to the mobile network. ### Claim 3 (depends on 1) Method according to claim 1, wherein the preloading the initiation key comprises storing the initiation key in a secure storage area of each respective mobile device. ### Claim 4 (depends on 3) Method according to claim 3, wherein the secure storage area is provided by a trusted computing subsystem of each respective mobile device. ### Claim 5 (depends on 4) Method according to claim 4, wherein at least one of the group of: verifying the validity of the initiation key, and using the initiation key in performing the key agreement procedure, is performed by the trusted computing subsystem. ### Claim 6 (depends on 1) Method according to claim 1, further comprising: preloading a set of initiation keys on each of the mobile devices, the set of initiation keys key being associated with a respective set of validity periods; and performing a key synchronization procedure between the mobile devices over the D2D communication channel for selecting a matching one of the set of initiation keys on each of the mobile devices as the initiation key. ### Claim 7 (depends on 6) Method according to claim 6, further comprising: preloading a set of key identifiers on each of the mobile devices, each of the set of key identifiers identifying a respective one of the set of initiation keys; and performing the key synchronization procedure based on an exchange of one or more of the set of key identifiers between the mobile devices. ### Claim 8 (depends on 6) Method according to claim 6, further comprising disabling or removing the initiation key from the set of initiation keys after use in establishing the D2D communication session. ### Claim 9 (depends on 6) Method according to claim 6, wherein the set of validity periods is constituted at least in part by different but overlapping validity periods. ### Claim 10 (depends on 1) Method according to claim 1, wherein the initiation key is associated with a virtual network identity, and wherein the verifying the validity of the initiation key further comprises determining a match of the virtual network identity on each of the mobile devices via the D2D communication channel. ### Claim 11 (depends on 1) Method according to claim 1, wherein the initiation key is associated with a usage count for limiting a number of uses of the initiation key, and wherein the verifying the validity of the initiation key is further based on the usage count. ### Claim 12 (depends on 11) Method according to claim 11, further comprising adjusting the usage count after use of the initiation key in establishing the D2D communication session. ### Claim 13 (depends on 1) Method according to claim 1, further comprising requesting a further initiation key via the mobile network if the key agreement procedure fails in providing the session key. ### Claim 14 (depends on 1) Method according to claim 1, wherein the key agreement procedure comprises: a three-pass authentication procedure; or a use of the initiation key to encrypt a message exchange between the mobile devices for obtaining a shared secret, and a Diffie-Hellman key exchange procedure which is initiated based on the shared secret. ### Claim 15 A non-transitory computer-readable medium configured to store instructions for, upon execution of the instructions on a mobile device, causing the mobile device to establish a device-to-device (D2D) communication session with a further mobile device, the mobile device and the further mobile device being mutually connectable via a D2D communication channel and individually connectable to a mobile network, by: storing an initiation key which is provided during a preloading procedure, the initiation key being associated with a validity period; verifying a validity of the initiation key based on a current time; requesting a further initiation key via the mobile network if no initiation key is deemed valid; if the initiation key is deemed valid, generating a session key using the initiation key by using the initiation key in performing a key agreement procedure with the further mobile device over the D2D communication channel, the key agreement procedure resulting in the session key if the initiation key used by the mobile device matches an initiation key used by the further mobile device; and establishing the D2D communication session over the D2D communication channel based on the session key. ### Claim 16 Mobile device for establishing a device-to-device (D2D) communication session with a further mobile device, the mobile device and the further mobile device being mutually connectable via a D2D communication channel and individually connectable to a mobile network, the mobile device comprising: a storage area for storing an initiation key which is provided during a preloading procedure, the initiation key being associated with a validity period; and a computing subsystem for: verifying a validity of the initiation key based on a current time; requesting a further initiation key via the mobile network if no initiation key is deemed valid; if the initiation key is deemed valid, generating a session key using the initiation key by using the initiation key in performing a key agreement procedure with the further mobile device over the D2D communication channel, the key agreement procedure resulting in the session key if the initiation key used by the mobile device matches an initiation key used by the further mobile device; and a mobile subsystem for establishing the D2D communication session over the D2D communication channel based on the session key. ### Claim 17 Mobile network arranged for preloading an initiation key on a mobile device when the mobile device is connected to the mobile network, the initiation key being associated with a validity period, the mobile device for establishing a device-to-device (D2D) communication session with a further mobile device, the mobile device and the further mobile device being mutually connectable via a D2D communication channel and individually connectable to the mobile network, the mobile device comprising: a computing subsystem for: verifying a validity of the initiation key based on a current time; requesting a further initiation key via the mobile network if no initiation key is deemed valid; if the initiation key is deemed valid, generating a session key using the initiation key by using the initiation key in performing a key agreement procedure with the further mobile device over the D2D communication channel, the key agreement procedure resulting in the session key if the initiation key used by the mobile device matches an initiation key used by the further mobile device; and a mobile subsystem for establishing the D2D communication session over the D2D communication channel based on the session key.