Asset authentication in a dynamic, proximity-based network of communication devices

1. A method of authenticating an asset in a dynamic, proximity-based network ( 100 ) of communication devices ( 1 - 6 ), where the communication devices comprise a first communication interface ( 112 , 122 , 232 ) for establishing the dynamic, proximity-based network by short-range wireless beacon broadcast messaging ( 113 , 123 ), and a second communication interface ( 114 , 124 , 234 ) for communicating with a server ( 13 , 16 , 130 ) by broadband communication ( 115 , 125 ), the method involving:

a first communication device ( 110 ) sending ( 210 ) an authentication request (AUTH_REQ 1 ) to a second communication device ( 120 ) via the first communication interface ( 112 , 122 ), said asset ( 126 ) being associated with the second communication device;

the second communication device ( 120 ) receiving ( 220 ) the authentication request (AUTH_REQ 1 ) via the first communication interface ( 112 , 122 ) and in response communicating ( 230 ) with the server ( 130 ) via the second communication interface ( 114 , 124 ) to generate a digital signature (U 2 _Signed) by encrypting data which includes said asset with a private key (U 2 _PrK) for the second communication device;

the second communication device ( 120 ) sending ( 240 ) a signing completed report message (SIGNING_REP 2 ) about the generation of the digital signature (U 2 _Signed) to the first communication device ( 110 ) via the first communication interface ( 112 , 122 ); and

the first communication device ( 110 ) receiving ( 250 ) the signing completed report message (SIGNING_REP 2 ) via the first communication interface ( 112 , 122 ) and in response communicating ( 260 ) with the server ( 130 ) via the second communication interface ( 114 , 124 ) to retrieve an authentication result (AUTH_RESULT);

wherein the method further involves the first communication device ( 110 ) checking ( 510 ) the retrieved authentication result (AUTH_RESULT) and, if the authentication result indicates successful authentication ( 520 ), communicating ( 530 ) with the server ( 130 ) via the second communication interface ( 114 , 124 ) to add a user of the second communication device ( 120 ) to a dynamic, proximity-based group of users of communication devices in the network, the dynamic, proximity-based group supporting interaction between users of the group.

2. The method as defined in claim 1 , wherein the asset ( 126 ) is any of the following:

an identifier (UID 2 ) of the second communication device ( 120 ) or the user ( 120 a ) thereof;

a user profile (U 2 _Profile) of the user ( 120 a ) of the second communication device ( 120 ); and

a valuable digital content which the second communication device ( 120 ) is in control of.

3. The method as defined in claim 1 , the method further involving:

each of said first and second communication devices ( 110 / 120 ) initially sending ( 310 ) a registration request (REG_REQ) to the server ( 130 ) via the second communication interface ( 114 , 124 );

the server ( 130 ) in response:

generating ( 320 ) an identifier (UID 1 /UID 2 ) and a public/private key pair (U 1 _PuK/U 1 _PrK, U 2 _PuK/U 2 _PrK) for the respective communication device ( 110 / 120 ); and

creating and storing ( 330 ) a user profile (U 1 _Profile/U 2 _Profile) for the respective communication device ( 110 / 120 ), the user profile including the generated identifier (UID 1 /UID 2 ) and public/private key pair (U 1 _PuK/U 1 _PrK, U 2 _PuK/U 2 _PrK); and

returning ( 340 ) the generated identifier (UID 1 /UID 2 ) to the respective communication device ( 110 / 120 ); and

the respective communication device ( 110 / 120 ) receiving ( 350 ) the generated identifier (UID 1 /UID 2 ) from the server ( 130 ) via the second communication interface ( 114 , 124 ).

4. The method as defined in claim 1 , the method further involving:

the first communication device ( 110 ) initially sending ( 410 ) an identification request (ID_REQ) to the second communication device ( 120 ) via the first communication interface ( 112 , 122 );

the second communication device ( 120 ) receiving ( 420 ) the identification request (ID_REQ) via the first communication interface ( 112 , 122 ) and in response communicating ( 430 ) with the server ( 130 ) via the second communication interface ( 114 , 124 ) to generate an encrypted identifier (UID 2 encr ) by encrypting an identifier (UID 2 ) of the second communication device ( 120 ) with a public key (U 1 _PuK) for the first communication device ( 110 );

the second communication device ( 120 ) sending ( 440 ) an identification response (ID_RESP) via the first communication interface ( 112 , 122 ) to the first communication device ( 110 ), the identification response (ID_RESP) containing the encrypted identifier (UID 2 encr ); and

the first communication device ( 110 ) receiving ( 450 ) the identification response (ID_RESP) via the first communication interface ( 112 , 122 ) and decrypting ( 460 ) the received identification response (ID_RESP) with a private key (U 1 _PrK) for the first communication device ( 110 ) to derive the identifier (UID 2 ) of the second communication device ( 120 ).

5. The method as defined in claim 1 , wherein interaction between users of the group involves one or more of the following:

content sharing,

social media interaction,

e-commerce transaction,

telephone call,

short text messaging,

multimedia messaging,

email messaging, and

chat conversation.

6. The method as defined in claim 1 , the method further involving:

the server ( 130 ) storing the generated digital signature (U 2 _Signed) in, at or for said server; and

the server ( 130 ) using the generated digital signature (U 2 _Signed) as stored in, at or for said server when retrieving the authentication result.

7. A method of authenticating an asset in a dynamic, proximity-based network ( 100 ) of communication devices ( 1 - 6 ), where the communication devices comprise a first communication interface ( 112 , 122 , 232 ) for establishing the dynamic, proximity-based network by short-range wireless beacon broadcast messaging ( 113 , 123 ), and a second communication interface ( 114 , 124 , 234 ) for communicating with a server ( 13 , 16 , 130 ) by broadband communication ( 115 , 125 ), the method involving:

a first communication device ( 110 ) sending ( 210 ) an authentication request (AUTH_REQ 1 ) to a second communication device ( 120 ) via the first communication interface ( 112 , 122 ), said asset ( 126 ) being associated with the second communication device;

the second communication device ( 120 ) receiving ( 220 ) the authentication request (AUTH_REQ 1 ) via the first communication interface ( 112 , 122 ) and in response communicating ( 230 ) with the server ( 130 ) via the second communication interface ( 114 , 124 ) to generate a digital signature (U 2 _Signed) by encrypting data which includes said asset with a private key (U 2 _PrK) for the second communication device;

the second communication device ( 120 ) sending ( 240 ) a signing completed report message (SIGNING_REP 2 ) about the generation of the digital signature (U 2 _Signed) to the first communication device ( 110 ) via the first communication interface ( 112 , 122 );

the first communication device ( 110 ) receiving ( 250 ) the signing completed report message (SIGNING_REP 2 ) via the first communication interface ( 112 , 122 ) and in response communicating ( 260 ) with the server ( 130 ) via the second communication interface ( 114 , 124 ) to retrieve an authentication result (AUTH_RESULT);

the method further involving:

the server ( 130 ) storing the generated digital signature (U 2 _Signed) in, at or for said server;

the server ( 130 ) using the generated digital signature (U 2 _Signed) as stored in, at or for said server when retrieving the authentication result;

the server ( 130 ) creating a temporary authentication context (TAC) in which the generated digital signature (U 2 _Signed) is stored;

the server ( 130 ) creating an identifier (TAC_ID) of the temporary authentication context (TAC);

the server ( 130 ) sending the identifier (TAC_ID) of the temporary authentication context (TAC) to the second communication device ( 120 ) over the second communication interface ( 114 , 124 );

the second communication device ( 120 ) sending the identifier (TAC_ID) of the temporary authentication context (TAC) to the first communication device ( 110 ) over the first communication interface ( 112 , 122 ); and

the first communication device ( 110 ) sending the identifier (TAC_ID) of the temporary authentication context (TAC) in an authentication request (AUTH_REQ 2 ) to the server ( 130 ) via the second communication interface ( 114 , 124 ) to retrieve the authentication result (AUTH_RESULT).

8. A first wireless communication device ( 110 ) comprising a first communication interface ( 112 , 232 ) for establishing a dynamic, proximity-based network by short-range wireless beacon broadcast messaging ( 113 , 123 ), and a second communication interface ( 114 , 234 ) for communicating with a server ( 13 , 16 , 130 ) by broadband communication ( 115 ), the first wireless communication device being configured to:

send ( 210 ) an authentication request (AUTH_REQ) to a second communication device ( 120 ) via the first communication interface ( 112 ), the authentication request pertaining to an asset ( 126 ) being associated with the second communication device;

receive ( 250 ) a signing completed report message (SIGNING_REP 2 ) from the second communication device ( 120 ) via the first communication interface ( 112 ); and, in response, communicate ( 260 ) with the server ( 130 ) via the second communication interface ( 114 ) to retrieve an authentication result (AUTH_RESULT); and

check ( 510 ) the retrieved authentication result (AUTH_RESULT) and, if the authentication result indicates successful authentication ( 520 ), communicate ( 530 ) with the server ( 130 ) via the second communication interface ( 114 , 124 ) to add a user of the second communication device ( 120 ) to a dynamic, proximity-based group of users of communication devices in the network, the dynamic, proximity-based group supporting interaction between users of the group.

9. The first wireless communication device ( 110 ) as defined in claim 8 , wherein the asset ( 126 ) is any of the following:

an identifier (UID 2 ) of the second communication device ( 120 ) or the user ( 120 a ) thereof;

a user profile (U 2 _Profile) of the user ( 120 a ) of the second communication device ( 120 ); and

a valuable digital content which the second communication device ( 120 ) is in control of.

10. A server ( 13 , 16 , 130 ) for use with a first wireless communication device ( 110 ) and a second wireless communication device ( 120 ), the second wireless communication device ( 120 ) comprising a first communication interface ( 122 , 232 ) for establishing a dynamic, proximity-based network by short-range wireless beacon broadcast messaging ( 113 , 123 ), and a second communication interface ( 124 , 234 ) for communicating with the server ( 13 , 16 , 130 ) by broadband communication ( 125 ), the second wireless communication device being configured to:

receive ( 220 ) an authentication request (AUTH_REQ) via the first communication interface ( 122 ) from the first communication device ( 110 ), the authentication request pertaining to an asset ( 126 ) being associated with the second communication device;

in response, communicate ( 230 ) with the server ( 130 ) via the second communication interface ( 124 ) to generate a digital signature (U 2 _Signed) by encrypting data which includes said asset with a private key (U 2 _PrK) for the second communication device; and

send ( 240 ) a signing completed report message (SIGNING_REP 2 ) about the generation of the digital signature (U 2 _Signed) to the first communication device ( 110 ) via the first communication interface ( 112 , 122 ), the server being configured to:

communicate ( 230 ) with the second communication device ( 120 ) via the second communication interface ( 114 , 124 ) to generate the digital signature (U 2 _Signed) by encrypting data which includes said asset with the private key (U 2 _PrK) for the second communication device ( 120 );

communicate ( 260 ) with the first communication device ( 110 ) via the second communication interface ( 114 , 124 ) to retrieve the authentication result (AUTH_RESULT); and

if the authentication result indicates successful authentication ( 520 ), receive a communication from the first communication device ( 110 ) via the second communication interface ( 114 , 124 ) to add a user of the second communication device ( 120 ) to a dynamic, proximity-based group of users of communication devices in the network, the dynamic, proximity-based group supporting interaction between users of the group.

11. The server ( 13 , 16 , 130 ) as defined in claim 10 , wherein the asset ( 126 ) is any of the following:

an identifier (UID 2 ) of the second communication device ( 120 ) or the user ( 120 a ) thereof;

a user profile (U 2 _Profile) of the user ( 120 a ) of the second communication device ( 120 ); and

a valuable digital content which the second communication device ( 120 ) is in control of.