Proximity based authentication using bluetooth

#Short range wireless computer networks (or “local wireless networks” herein) such as BLUETOOTH are useful for providing communications between computing devices without being subject to the limitations of larger, “infrastructure-like” computer networks (or “infrastructure networks” herein) such as a local area network (LAN) or a global computer network such as the Internet. More specifically, communication between devices on such local wireless networks may occur without the devices being connected to such infrastructure networks. Additionally, even if connected to such infrastructure networks, the communication between the devices are not subject to the bandwidth and latencies associated with such infrastructure networks when communicating via the local wireless networks.

#Typically, in order to secure communications between two devices communicating via short range wireless computer networks, an operation referred to as “pairing” is performed. Pairing generally involves the exchange of security data that allows for the two communicating devices to encrypt communications transmitted wirelessly if desired and to verify identities. Unfortunately, pairing is not an instantaneous process and generally involves several back-and-forth communications. Additionally, in-band pairing, which is pairing that occurs by way of token exchange within the channel (i.e., via the local wireless network) over which communications will occur, may be subject to security attacks.

#A method for securing communications between a fixed device and a mobile device. The method includes verifying enrollment credentials received from the mobile device. The method also includes obtaining a first security token associated with a BLUETOOTH subsystem of the mobile device. The method further includes obtaining a second security token associated with a BLUETOOTH subsystem of the fixed device. The method also includes performing an out-of-band pairing between the fixed device and the mobile device based on the first security token, and the second security token.

#FIG. 1A is a block diagram of an authentication system for authenticating a mobile device to one or more fixed devices in a secure manner.

#FIG. 1B is a block diagram of a computing device that may implement aspects of one or more of fixed devices, mobile devices, and an MDM server of the authentication system of FIG. 1A, according to an embodiment.

#FIG. 2 is a block diagram illustrating an enrollment sub-configuration of authentication system of FIG. 1, according to an embodiment.

#To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements disclosed in one embodiment may be beneficially utilized on other embodiments without specific recitation.

#An authentication system is described herein that facilitates secure pairing and communications between devices that communicate via a local wireless network such as BLUETOOTH. The authentication system generally allows a user to “enroll” a device with a secure management server over an infrastructure network such as the Internet. This enrollment provides an independent verifier (the secure management server) of user identity, which provides security for pairing operations. More specifically, the secure management server, having verified the identity of a particular user via the enrollment credentials, orchestrates an out-of-band pairing operation between an enrolled device and another device, to pair these two devices, which improves security as compared with in-band pairing. Once enrollment and pairing are completed, communications can proceed between the devices over the local wireless network. For additional security, the enrollment may include biometric data based authentication in addition to other forms of authentication.

#Speed of pairing is also improved by the authentication system. Specifically, because the secure management server verifies the identity of a device when that device becomes enrolled with the secure management server, and because enrollment can generally occur at any time, pairing between the enrolled device and another device can occur prior to communications between the devices across the local wireless network begin. Thus, when the devices first encounter each other, they may already be paired, meaning that the delay that would occur upon those two devices encountering each other is reduced or eliminated. This “pre-pairing” effectively improves the speed with which devices can begin communicating over the local wireless network.