IP Library › Granted Patent US 11,140,160

Granted Patent B2

US 11,140,160 · App. 16/050,821 · Granted Oct 5, 2021

Method and system for establishing inter-device communication

Inventors: Dunjun Liu (Hangzhou, CN); Kan Dong (Hangzhou, CN)

Assignee: BANMA ZHIXING NETWORK (HONGKONG) CO., LIMITED

H04L63/0876 G06F21/53 G06F21/72 H04L9/006 H04L9/0825 H04L9/0866 H04L9/0897 H04L63/0428 H04L63/0442 H04L63/061 G06F2221/2107 H04L2463/062

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,140,160
App. No.: 16/050,821
Granted: Oct 5, 2021
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Establishing inter-device communication is disclosed including receiving, using a first device, an encrypted session key sent by a second device, decrypting, based on a private key of the first device, the encrypted session key in a trusted environment to obtain a decrypted session key, and conducting, based on the decrypted session key, data communications with the second device.

Claims (205)

1. A method, comprising:

receiving, using a first device, an encrypted session key sent by a second device, wherein the first device includes a client, a secure service module, and a trusted environment, wherein the client corresponds to an application, and wherein the secure service module corresponds to an operating system;

decrypting, based on a private key of the first device, the encrypted session key in the trusted environment to obtain a decrypted session key, comprising:

sending the encrypted session key to the trusted environment, wherein the trusted environment includes a trusted chip, or a secure environment isolated using a virtualization mechanism, wherein the sending of the encrypted session key to the trusted environment comprises:

sending, using the client, the encrypted session key to the secure service module; and

requesting, using the secure service module, that the trusted environment decrypt the encrypted session key; and

decrypting, in the trusted environment, the encrypted session key to obtain the decrypted session key, comprising:

acquiring, in the trusted environment, the private key; and

decrypting, in the trusted environment, the encrypted session key using the private key to obtain the decrypted session key; and

conducting, based on the decrypted session key, data communication with the second device.

2. The method as described in claim 1 , further comprising:

before the receiving of the encrypted session key:

sending, using the first device, identifying information of the first device to the second device to cause the second device to:

send the identifying information of the first device to an identification service device to retrieve a public key of the first device corresponding to the identifying information of the first device; and

send the encrypted session key to the first device, the encrypted session key being obtained based at least in part on encrypting a session key based on the public key of the first device.

3. The method as described in claim 2 , wherein the identifying information of the first device is stored in the trusted environment;

the identifying information of the first device is assigned in advance by the identification service device;

the public key of the first device corresponding to the identifying information of the first device is pre-generated by the identification service device; and

the private key of the first device is pre-written into the trusted environment of the first device.

4. The method as described in claim 2 , wherein:

the first device corresponds to a client device;

the second device corresponds to a first server device; and

the identification service device corresponds to a second server device.

5. The method as described in claim 1 , further comprising:

before the receiving of the encrypted session key:

sending a public key of the first device to the second device, the second device being configured to:

encrypt a session key based on the public key of the first device to obtain the encrypted session key; and

send the encrypted session key to the second device, wherein:

the public key of the first device and the private key of the first device are generated by an identification service device and provided to the first device; and

the private key of the first device is pre-written into the trusted environment of the first device.

6. The method as described in claim 5 , wherein the first device corresponds to a first client device and the second device corresponds to a second client device.

7. A method, comprising:

acquiring, using a second device, a public key of a first device, wherein the first device includes a client, a secure service module, and a trusted environment, wherein the client corresponds to an application, and wherein the secure service module corresponds to an operating system;

encrypting, using the second device, a session key using the public key of the first device to obtain an encrypted session key;

sending, using the second device, the encrypted session key to the first device to cause the first device to:

receive the encrypted session key sent by the second device;

decrypt, based on a private key of the first device, the encrypted session key in the trusted environment of the first device to obtain a decrypted session key, comprising to:

send the encrypted session key to the trusted environment, wherein the trusted environment includes a trusted chip, or a secure environment isolated using a virtualization mechanism, wherein the sending of the encrypted session key to the trusted environment comprises to:

send, using the client, the encrypted session key to the secure service module; and

request, using the secure service module, that the trusted environment decrypt the encrypted session key; and

decrypt, in the trusted environment, the encrypted session key to obtain a decrypted session key comprising to:

acquire, in the trusted environment, the private key; and

decrypt, in the trusted environment, the encrypted session key using the private key to obtain the decrypted session key; and

conducting, using the encrypted session key, data communications with the first device.

8. The method as described in claim 7 , wherein the acquiring of the public key of the first device comprises:

receiving, using the second device, identifying information of the first device; and

acquiring the public key of the first device corresponding to the identifying information of the first device from an identification service device.

9. The method as described in claim 8 , further comprising:

in response to a determination that the second device receives a response from the identification service device indicating that the identifying information of the first device is not legitimate or a response indicating that the public key of the first device corresponding to the identifying information of the first device does not exist, sending back to the first device a response indicating a failure to establish communication.

10. The method as described in claim 8 , wherein:

the first device corresponds to a client device;

the second device corresponds to a first server device; and

the identification service device corresponds to a second server device.

11. The method as described in claim 7 , wherein the acquiring of the public key of the first device comprises:

receiving, using the second device, the public key of the first device sent by the first device.

12. The method as described in claim 7 , further comprising:

before the sending of the encrypted session key to the first device:

assigning, using the second device, a random session key, wherein the assigning of the random session key and the encrypting of the session key are performed by the second device within the trusted environment.

13. A method, comprising:

receiving, using an identification service device, identifying information of a first device sent by a second device, wherein the first device includes a client, a secure service module, and a trusted environment, wherein the client corresponds to an application, and wherein the secure service module corresponds to an operating system; and

sending back, using the identification service device, a public key of the first device to the second device, the second device being configured to:

encrypt a session key with the public key of the first device to obtain an encrypted session key; and

send the encrypted session key to the first device to cause the first device to:

decrypt, based on a private key of the first device, the encrypted session key in the trusted environment of the first device to obtain a decrypted session key, comprising to:

send, using the client, the encrypted session key to the secure service module; and

request, using the secure service module, that the trusted environment decrypt the encrypted session key; and

decrypt, in the trusted environment, the encrypted session key to obtain a decrypted session key, the decrypted session key being used for data communication between the first device and the second device, wherein the decrypting of the encrypted session key comprises to:

acquire, in the trusted environment, the private key; and

decrypt in the trusted environment the encrypted session key using the private key to obtain the decrypted session key.

14. The method as described in claim 13 , further comprising:

maintaining, using the identification service device, the identifying information of the first device; and

maintaining, using the identification service device, the public key of the first device and a private key of the first device for the first device.

15. The method as described in claim 14 , further comprising:

pre-writing the private key of the first device into the trusted environment of the first device.

16. The method as described in claim 13 , further comprising:

in response to a determination that the identification service device determines that the identifying information of the first device is not legitimate or the public key of the first device corresponding to the identifying information of the first device does not exist, sending back, using the identification service device, to the second device a response indicating that the identifying information of the first device is not legitimate.

17. The method as described in claim 13 , further comprising:

determining, using the identification service device, whether the identifying information of the first device is legitimate and the public key of the first device exists; and

in response to a determination that the identifying information of the first device is legitimate and the public key of the first device exists, locating, using the identification service device, the public key of the first device based on the identifying information of the first device.

18. A first device, comprising:

a client, wherein the client corresponds to an application;

a secure service module, wherein the secure service module corresponds to an operating system;

a trusted environment;

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:

receive an encrypted session key sent by a second device;

decrypt, based on a private key of the first device, the encrypted session key in the trusted environment to obtain a decrypted session key, comprising to:

send, using the client, the encrypted session key to the secure service module; and

request, using the secure service module, that the trusted environment decrypt the encrypted session key; and

decrypt, in the trusted environment, the encrypted session key to obtain the decrypted session key, comprising to:

acquire, in the trusted environment, the private key; and

decrypt, in the trusted environment, the encrypted session key using the private key to obtain the decrypted session key; and

conduct, based on the decrypted session key, data communication with the second device.

19. The first device as described in claim 18 , wherein the processor is further configured to:

before the receiving of the encrypted session key:

send, using the first device, identifying information of the first device to the second device to cause the second device to:

send the encrypted session key to the first device, the encrypted session key being obtained based at least in part on encrypting a session key based on the public key of the first device.

20. The first device as described in claim 19 , wherein the sending of the identifying information of the first device comprises to:

acquire the identifying information of the first device from a secure storage zone; and

send the identifying information of the first device to the second device, wherein:

the identifying information of the first device is assigned in advance by an identification service device;

the public key of the first device corresponding to the identifying information of the first device is pre-generated by the identification service device; and

the private key of the first device is pre-written into the secure storage zone of the first device.

21. The first device as described in claim 19 , wherein:

the first device corresponds to a client device;

the second device corresponds to a first server device; and

the identification service device corresponds to a second server device.

22. The first device as described in claim 18 , wherein the processor is further configured to:

before the receiving of the encrypted session key:

send a public key of the first device to the second device, the second device being configured to:

encrypt a session key based on the public key of the first device to obtain the encrypted session key; and

send the encrypted session key to the second device, wherein:

the public key of the first device and the private key of the first device are generated by an identification service device and provided to the first device; and

the private key of the first device is pre-written into the trusted environment of the first device.

23. The first device as described in claim 22 , wherein the first device corresponds to a first client device and the second device corresponds to a second client device.

24. A second device, comprising:

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:

acquire a public key of a first device, wherein the first device includes a client, a secure service module, and a trusted environment, wherein the client corresponds to an application and wherein the secure service module corresponds to an operating system;

encrypt a session key using the public key of the first device to obtain an encrypted session key;

send the encrypted session key to the first device to cause the first device to:

receive the encrypted session key sent by the second device;

decrypt, based on a private key of the first device, the encrypted session key in the trusted environment of the first device to obtain a decrypted session key, comprising to:

send, using the client, the encrypted session key to the secure service module; and

request, using the secure service module, that the trusted environment decrypt the encrypted session key; and

decrypt, in the trusted environment, the encrypted session key to obtain a decrypted session key, comprising to:

acquire, in the trusted environment, the private key; and

decrypt, in the trusted environment, the encrypted session key using the private key to obtain the decrypted session key; and

conduct, using the encrypted session key, data communications with the first device.

25. The second device as described in claim 24 , wherein the acquiring of the public key of the first device comprises to:

receive identifying information of the first device; and

acquire the public key of the first device corresponding to the identifying information of the first device from an identification service device.

26. The second device as described in claim 25 , wherein the processor is further configured to:

in response to a determination that the second device receives a response from the identification service device indicating that the identifying information of the first device is not legitimate or a response indicating that the public key of the first device corresponding to the identifying information of the first device does not exist, send back to the first device a response indicating a failure to establish communication.

27. The second device as described in claim 25 , wherein:

the first device corresponds to a client device;

the second device corresponds to a first server device; and

the identification service device corresponds to a second server device.

28. The second device as described in claim 24 , wherein:

the acquiring of the public key of the first device comprises to:

receive the public key of the first device sent by the first device.

29. The second device as described in claim 24 , wherein the processor is further configured to:

before the sending of the encrypted session key to the first device:

assign a random session key, wherein the assigning of the random session key and the encrypting of the session key are performed within the trusted environment.

30. An identification service device, comprising:

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:

receive identifying information of a first device sent by a second device, wherein the first device includes a client, a secure service module, and a trusted environment, wherein the client corresponds to an application, and wherein the secure service module corresponds to an operating system; and

send back a public key of the first device corresponding to the identifying information of the first device to the second device, the second device being configured to:

encrypt a session key with the public key of the first device to obtain an encrypted session key; and

send the encrypted session key to the first device to cause the first device to:

decrypt, based on a private key of the first device, the encrypted session key in the trusted environment of the first device to obtain a decrypted session key, comprising to:

send, using the client, the encrypted session key to the secure service module; and

request, using the secure service module, that the trusted environment decrypt the encrypted session key; and

acquire, in the trusted environment, the private key; and

decrypt in the trusted environment the encrypted session key using the private key to obtain the decrypted session key.

31. The identification service device as described in claim 30 , wherein the processor is further configured to:

maintain the identifying information of the first device; and

maintain the public key of the first device and a private key of the first device for the first device.

32. The identification service device as described in claim 30 , wherein the processor is further configured to:

in response to a determination that the identification service device determines that the identifying information of the first device is not legitimate or the public key of the first device corresponding to the identifying information of the first device does not exist, send back to the second device a response indicating that the identifying information of the first device is not legitimate.

33. The identification service device as described in claim 30 , wherein the processor is further configured to:

determine whether the identifying information of the first device is legitimate and the public key of the first device exists; and

in response to a determination that the identifying information of the first device is legitimate and a public key of the first device exists, locate the public key of the first device based on the identifying information of the first device.

34. A computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

decrypting, based on a private key of the first device, the encrypted session key in the trusted environment to obtain a decrypted session key, comprising:

sending, using the client, the encrypted session key to the secure service module; and

requesting, using the secure service module, that the trusted environment decrypt the encrypted session key; and

decrypting, in the trusted environment, the encrypted session key to obtain the decrypted session key, comprising:

acquiring, in the trusted environment, the private key; and

decrypting, in the trusted environment, the encrypted session key using the private key to obtain the decrypted session key; and

conducting, based on the decrypted session key, data communication with the second device.

35. A computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

acquiring, using a second device, a public key of a first device, wherein the first device includes a client a secure service module and a trusted environment wherein the client corresponds to an application, and wherein the secure service module corresponds to an operating system;

encrypting, using the second device, a session key using the public key of the first device to obtain an encrypted session key;

sending, using the second device, the encrypted session key to the first device to cause the first device to:

receive the encrypted session key sent by the second device;

decrypt, based on a private key of the first device, the encrypted session key in the trusted environment of the first device to obtain a decrypted session key, comprising to:

send, using the client, the encrypted session key to the secure service module; and

request, using the secure service module, that the trusted environment decrypt the encrypted session key; and

decrypt, in the trusted environment, the encrypted session key to obtain a decrypted session key, comprising to:

acquire, in the trusted environment, the private key; and

decrypt in the trusted environment the encrypted session key using the private key to obtain the decrypted session key; and

conducting, using the encrypted session key, data communications with the first device.

36. A computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

sending back a public key of the first device to the second device, the second device being configured to:

encrypt a session key with the public key of the first device to obtain an encrypted session key; and

send the encrypted session key to the first device to cause the first device to:

decrypt, based on a private key of the first device, the encrypted session key in the trusted environment of the first device to obtain a decrypted session key, comprising to:

send, using the client, the encrypted session key to the secure service module; and

request, using the secure service module, that the trusted environment decrypt the encrypted session key; and

acquire in the trusted environment the private key; and

decrypt, in the trusted environment, the encrypted session key using the private key to obtain the decrypted session key.

Assignments (2)

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 11, 2020

From: ALIBABA GROUP HOLDING LIMITED

To: BANMA ZHIXING NETWORK (HONGKONG) CO., LIMITED

Reel/Frame 054384/0014 →

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 2, 2018

From: LIU, DUNJUN; DONG, KAN

To: ALIBABA GROUP HOLDING LIMITED

Reel/Frame 047916/0291 →

Priority Claims (1)

CN 201610072683.0 · Feb 2, 2016 · national

Continuity (2)

Continuation In Part PCTCN2017071832 · Jan 20, 2017

Related Publication 20190052635A1 · Feb 14, 2019

Cited By (1)

US 12,585,791