Cryptographic protocol for portable devices
Embodiments are directed towards communicating using a mobile device that performs actions including. A mobile device may be provisioned with an access point such that a provisioning key and a provisioning token for each of the provisioned access points may be stored on the mobile device. The mobile device may be determined to be in the presence of a provisioned access point based on the provisioning key and an advertising nonce. The advertising nonce may be encrypted with the provisioning key. A communication channel between the mobile device and the access point may be established based on a session nonce, the advertising nonce, and the provisioning key. A session key may be generated based in part on the advertising nonce and a message counter. And, encrypted message packets that include a message and a message authentication tag may be communicated to the access point.
1. A method for employing a device to communicate data over a network, wherein the device performs actions, comprising:
employing an authentication of a user of the device, by an authorized authentication device (AAD), to perform further actions, including:
providing one or more unique information packets based on one or more provisioning keys; and
communicating the one or more information packets to one or more remote access points, wherein the one or more remote access points employ the one or more provisioning keys to provide one or more local versions of the one or more information packets; and
employing a match of one or more comparisons performed by the one or more remote access points between its one or more local versions of the information packets to the communicated one or more information packets to provide the user with access to one or more remote access points having the one or more matching comparisons.
2. The method of claim 1 , wherein the authentication is based on biometric signals of the user.
3. The method of claim 1 , wherein the one or more provisioning keys are locally stored on the device and locally stored on the one or more remote access points.
4. The method of claim 1 , wherein the providing of the one or more information packets further comprises a synchronized time value.
5. The method of claim 1 , wherein the one or more information packets correspond to one or more of the one or more provisioning keys.
6. The method of claim 1 , wherein providing the one or more information packets, further comprises:
providing a nonce based on a pseudorandom number generator;
encrypting the nonce based on the one or more provisioning keys; and
providing an encrypted hash value, wherein the encrypted hash value includes the encrypted nonce and a synchronized time value.
7. The method of claim 1 , wherein the one or more information packets further comprise, one or more additional values, including at least one of a gesture value, a personal identification number, a password, a touch pattern, or a pass phrase.
8. The method of claim 1 , further comprising, when the user disengages the device, unsetting a synchronized time value and encrypting a cryptographic state of the device.
9. A device for authenticating a user, comprising:
a transceiver that communicates over a network;
a memory that stores at least instructions; and
a processor device that executes instructions that enable actions, including:
employing an authentication of the user of the device, by an authorized authentication device (AAD), to perform further actions, including:
providing one or more unique information packets based on one or more provisioning keys; and
communicating the one or more information packets to one or more remote access points, wherein the one or more remote access points employ the one or more provisioning keys to provide one or more local versions of the one or more information packets; and
employing a match of one or more comparisons performed by the one or more remote access points between its one or more local versions of the information packets to the communicated one or more information packets to provide the user with access to one or more remote access points having the one or more matching comparisons.
10. The device of claim 9 , wherein the authentication is based on biometric signals of the user.
11. The device of claim 9 , wherein the one or more provisioning keys are locally stored on the mobile device and locally stored on the one or more remote access points.
12. The device of claim 9 , wherein the providing of the one or more information packets further comprises a synchronized time value.
13. The device of claim 9 , wherein the one or more information packets corresponds to one or more of the one or more provisioning keys.
14. The device of claim 9 , wherein providing the one or more information packets, further comprises:
providing an nonce based on a pseudorandom number generator;
encrypting the nonce based on the one or more provisioning keys; and
providing an encrypted hash value, wherein the encrypted hash value includes the encrypted nonce and a synchronized time value.
15. The device of claim 9 , wherein the one or more information packets further comprise, one or more additional values, including at least one of a gesture value, a personal identification number, a password, a touch pattern, or a pass phrase.
16. The device of claim 9 , further comprising, when the user disengages the device, unsetting a synchronized time value and encrypting a cryptographic state of the device.
17. A system for employing a device to communicate data, comprising:
an authorized authentication device (AAD), comprising:
a transceiver that communicates over a network;
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including authenticating a user of the device; and
the device comprising:
a transceiver that communicates over a network;
a memory that stores at least instructions; and
one or more processor devices that execute instructions that perform actions, including:
providing one or more unique information packets based on one or more provisioning keys; and
communicating the one or more information packets to one or more remote access points, wherein the one or more remote access points employ the one or more provisioning keys to provide one or more local versions of the one or more information packets; and
employing a match of one or more comparisons performed by the one or more remote access points between its one or more local versions of the information packets to the communicated one or more information packets to provide the user with access to one or more remote access points having the one or more matching comparisons.
18. The system of claim 17 , wherein the authentication is based on biometric signals of the user.
19. The system of claim 17 , wherein the one or more provisioning keys are locally stored on the device and locally stored on the one or more remote access points.
20. The system of claim 17 , wherein the providing of the one or more information packets further comprises a synchronized time value.