Secure device pairing
View Patent ↗A machine readable quick response (QR) code or, if this fails, a human-readable passcode is presented on a display of a server device for scanning (or reading and human input) into a mobile device. The mobile device computes a response and returns it to the server. If the response is correct, WiFi setup information, which can include PII, is exchanged in an encrypted form between the two devices to support subsequent WiFi communication.
1. A device comprising:
at least one computer memory that is not a transitory signal and that comprises instructions executable by at least one processor to:
responsive to a determination that a hello message from a mobile communication device (MCD) comprises a ciphersuite, establish communication with the MCD);
present on a display a passcode P;
send to the MCD a challenge C;
responsive to determining that a response from the MCD based on P and C and matches a test value, and responsive to a determination that P was displayed less than a threshold period of time prior to receiving the response, return an encryption key to the MCD;
responsive to not receiving a response from the MCD matching the test value, or responsive to a determination that P was displayed greater than the threshold period of time prior to receiving the response, generate a new P and C;
wherein the encryption key is obtained at least in by:
accessing a first key of the device;
using the first key to establish a second key;
using the second key to establish the encryption key, the encryption key being sent to the MCD to enable the MCD to encrypt information with the encryption key.
2. The device of claim 1 , comprising the at least one processor coupled to the at least one computer memory.
3. The device of claim 1 , wherein the instructions are executable to:
access a root key of the device;
use the root key of the computing device to establish a master key;
use the master key to establish the communication key; and
send the communication key to the MCD to enable the MCD to encrypt WiFi information with the communication key.
4. The device of claim 3 , wherein the instructions are executable to:
store the communication key in a secure area of storage encrypted with a random encryption code.
5. The device of claim 4 , wherein the random encryption code includes advanced encryption standard (AES) XEX encryption mode.
6. The device of claim 5 , wherein the AES XEX encryption mode has tweak and ciphertext stealing (XTS) having a first tweak value equal to a key number of the derived key and a second tweak value equal to an AES block number.
7. The device of claim 4 , wherein the random encryption code includes Liskov, Rivest, Wagner (LRW) encryption.
8. The device of claim 4 , wherein the random encryption code includes cipher block chaining-mask-cipher block chaining (CMC) encryption.
9. The device of claim 4 , wherein the random encryption code includes electronic codebook-mask-electronic codebook (EME) encryption.
10. The device of claim 3 , wherein the instructions are executable to:
access the WiFi information received from the MCD;
encrypt the WiFi information using a WiFi key derived from the master key.
11. A device comprising:
at least one computer memory that is not a transitory signal and that comprises instructions executable by at least one processor to:
responsive to a determination that a hello message from a mobile communication device (MCD) comprises a ciphersuite, establish communication with the MCD;
generate a value Q;
embed Q in a machine-readable quick response (QR) code;
present the QR code to the MCD;
send to the MCD a challenge C;
responsive to determining that a response from the MCD is based on a combination of Q and C and matches a test value, return an encryption key to the MCD;
responsive to not receiving a response from the MCD matching the test value, not return an encryption key to the MCD, wherein the encryption key is obtained at least in by:
accessing a first key of the device;
using the first key to establish a second key;
using the second key to establish the encryption key, the encryption key being sent to the MCD to enable the MCD to encrypt information with the encryption key.
12. The device of claim 11 , comprising the at least one processor coupled to the at least one computer memory.
13. The device of claim 11 , wherein the instructions are executable to:
access a root key of the device;
use the root key of the computing device to establish a master key;
use the master key to establish the communication key; and
send the communication key to the MCD to enable the MCD to encrypt WiFi information with the communication key.
14. The device of claim 13 , wherein the instructions are executable to:
access the WiFi information received from the MCD; and
encrypt the WiFi information using a WiFi key derived from the master key.
15. A mobile communication device (MCD) comprising:
at least one computer memory that is not a transitory signal and that comprises instructions executable by at least one processor to:
receive a visible code generated by a server;
combine the code with a challenge received from the server to render a response;
send the response to the server;
responsive to the code being correct as determined by the server, access a communication key received from the server; and
send to the server wireless communication configuration information.
16. The MCD of claim 15 , wherein the code is a machine-readable code received from an imaging device of the MCD.
17. The MCD of claim 15 , wherein the code is a human-readable code received form an input device of the MCD.
18. The MCD of claim 15 , wherein the instructions are executable to encrypt the wireless communication configuration information using the communication key prior to sending the wireless configuration information to the server.
19. The MCD of claim 15 , wherein the instructions are executable to:
present on a display of the MCD a user interface (UI) including at least one selector selectable to enter a mode in which the code is a human-readable passcode.