Ultra-wideband (UWB) secure wireless device pairing and associated systems
Methods and systems are disclosed for ultra-wideband (UWB) secure wireless device pairing. Secure pairing between devices for secure UWB communications is conducted over in-band UWB communications to provide secure pairing without requiring a visual confirmation through a graphical user interface (GUI), in particular, for wireless personal area network (WPAN) communications. The secure in-band pairing of wireless UWB devices over a UWB radio link provides considerable advantages over prior secure pairing techniques.
TECHNICAL FIELD OF THE INVENTION
This invention relates to techniques for secure device pairing for ultra-wideband (UWB) communication systems and, more particularly, to securing wireless personal area network (WPAN) communications between two or more personal devices.
BACKGROUND
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is an information handling system. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
Certain information handling systems utilize wireless communications to communicate with each other. In addition, certain information handling systems, such as desktop and portable computer systems, utilize wireless personal area network (WPAN) communications to interface with portable devices and peripherals, such as personal digital assistants (PDAs), cellular telephones, printers and other devices. Typically, a WPAN is used for short range wireless communications generally in single digit meters of range and usually intra-room. In contrast, WiFi communications or wireless LAN (local area network) communications are typically used for longer range wireless communications generally in double digit meters of range and often inter-room. Blue Tooth (BT) is an example communication protocol and interface standard that is in use today for short range WPAN device communications. In addition, devices have used direct wired connections, for example, through USB (universal serial buss) connections, to allow for communications between personal electronic devices and desktop/portable computer systems. These wireless and/or wired communications, for example, can allow PDAs to synchronize with software applications running on desktop and/or portable computer systems.
Ultra-wideband (UWB) is currently being considered as an alternative to other short range communication protocols, such as Blue Tooth, and direct cable communications, such as through USB connections. Ultra-wideband (UWB) is typically used to refer to a wireless communications technology that can currently transmit data at speeds between about 40 to 60 megabits per second and possibly up to 1 gigabit per second and beyond. UWB devices are typically configured to transmit ultra-low power radio signals with very short electrical pulses, often in the picosecond ( 1/1000th of a nanosecond) range, across a very wide range of frequencies at once. UWB receivers must translate these short bursts of noise into data by listening for a familiar pulse sequence sent by the transmitter. Because of its low power requirements, UWB is very difficult to detect and therefore difficult to regulate. Because it spans the entire frequency spectrum (licensed and unlicensed), it can be used indoors and underground and is a promising technology for wireless communications. UWB is also advantageous because it offers very low interference with traditional wireless technologies (e.g., WiFi, BT, etc.). A UWB device, as used herein, includes any information handling system that is capable of communicating through UWB communications.
Security is one significant concern with respect to such wireless communications. It is not only desirable for the communications to be secured in some fashion, but it is also desirable for the identity of the devices themselves to be verifiable. In other words, before a secure communication link is established, the communicating devices preferably have a secure mechanism to verify the identity of the device to which it will be communicating. Secure device pairing is one method for making sure device identities are verified in a secure manner prior to opening a communication link.
Secure device paring involves creating a strong shared secret known only to each entity in the pair. The strong shared secret (key) is used to create confidentiality over the pairing channel. Currently, publicly available protocols are available to meet this requirement. For example, known Diffie-Hellman (DH) key exchange protocols and/or modified DH key exchange protocols can be utilized to create a strong shared secret for the pairing. One modified DH key exchange protocol involves key mixing in an effort to mitigate the known man-in-the-middle weakness of stock DH key exchanges. Example DH protocol information can be found in U.S. Pat. No. 4,200,770, which is hereby incorporated by reference in its entirety.
The emergence of high speed, high bandwidth UWB as a WPAN cable replacement technology presents the challenge of allowing for secure peripheral device pairing and authentication without adding undue complexity and cost. As stated above, secured pairing allows one or both of the devices to have one or more pairing secrets that can be used to confirm the identity of the other device. One method currently proposed by the UWB development industry requires initial configuration using a physically connected cable for secure pairing of the two devices. Once the trusted devices have generated pairing secrets through the physical link, the devices transition to operation over a wireless UWB link. Another proposed technique for UWB secure device pairing includes the addition of near-field communication radios (NFCs) within the devices that can be used for the secure pairing before handing off the devices to communicate over a UWB transport link. A further proposed technique for UWB secure device pairing includes the use of graphical depictions of numerical codes on each device that must be verified and confirmed to match by a user through graphical user interfaces (GUIs) of the devices. These approaches (physical link, NFC radio, visual match confirmation) add unnecessary cost and redundant complexity to secure pairing of UWB capable wireless devices.
SUMMARY OF THE INVENTION
The present invention provides ultra-wideband (UWB) secure wireless device pairing and associated systems. According to the present invention, secure pairing between devices for secure UWB communications can be conducted over in-band UWB communications without requiring visual match confirmations through graphical user interfaces (GUIs). The present invention is particularly suited for secure pairing activities in wireless personal area network (WPAN) communications. The secure in-band pairing of wireless UWB devices over a UWB radio link of the present invention provides considerable advantages. While UWB pairing solutions have been proposed that use external means such as cables, access codes or visual numerical match confirmations, the present invention provides automated processes and eliminates the cost of requiring a physical cable and adds useful security mechanisms on top of an in-band pairing scheme.
In one aspect, the present invention can be a method for secure pairing of two or more ultra-wideband (UWB) devices including initiating device discovery with at least a first UWB device, conducting automatically secure pairing between the first UWB device and a second UWB device over in-band UWB communications, and generating automatically one or more pairing secrets for subsequent UWB communications between the first and second UWB devices. The conducting and generating steps are performed without requiring a visual match confirmation through graphical user interfaces (GUIs) of the first and second UWB devices. In addition, the initiating step can be performed manually or automatically, as desired, and a low power mode for UWB communications can be used for secure pairing. Still further, the method can include using pre-existing device or vendor-injected information to generate the pairing secrets, and the method can include using a key exchange protocol to create the pairing secret based at least in part upon a Diffie-Hellman key exchange protocol. As described below, other features and variations can be implemented, if desired, and related systems can be utilized, as well.
In another aspect, the present invention can be a secure pairing system for two or more ultra-wideband (UWB) devices, including a first UWB device having an automated secure pairing module and a UWB communication interface and a second UWB device having an automated secure pairing module and a UWB communication interface. The first UWB device is configured to conduct automatically secure pairing with at least one other UWB device over in-band UWB communications without requiring a visual match confirmation through a graphical user interface (GUI). And the second UWB device is configured to conduct automatically secure pairing with at least one other UWB device over in-band UWB communications without requiring a visual match confirmation through a graphical user interface (GUI). In addition, the first or the second UWB device can be configured to have secure pairing manually initiated through its GUI. Further, the first or the second UWB device can be configured to initiate automatically secure pairing. Still further, the first and second UWB devices can be configured to use pre-existing device or vendor-injected information to generate pairing secrets. A low power mode for UWB communications can also be used for secure pairing. As described below, other features and variations can be implemented, if desired, and related methods can be utilized, as well.
In a further respect, the present invention can be an ultra-wideband (UWB) device having automated in-band secure pairing including a UWB communication interface and an automated secure pairing module configured to conduct automatically secure pairing with at least one other UWB device over in-band UWB communications without requiring a visual match confirmation through a graphical user interface (GUI). The UWB device can also include a graphical user interface (GUI) such that the automated pairing module being configured to provide secure pairing feedback information to a user through the GUI. Still further, the UWB device can be configured to use a low power mode for UWB communications in secure pairing, and the UWB device can be configured to use pre-existing device or vendor-injected information to generate pairing secrets. As described below, other features and variations can be implemented, if desired, and related methods can be utilized, as well.
DETAILED DESCRIPTION OF THE INVENTION
The present invention relates to secure pairing between two or more information handling systems that are configured to communicate using ultra-wideband (UWB) communication links. According to the present invention, secure pairing between devices for secure UWB communications is conducted over in-band UWB communications, in particular, for secure pairing in wireless personal area network (WPAN) communications. The secure in-band pairing of wireless UWB devices over a UWB radio link of the present invention provides considerable advantages. While out-of-band UWB pairing solutions have been proposed that use external means such as cables and access codes, the automated processes of the present invention eliminate the cost of requiring a physical cable and adds useful security mechanisms on top of an in-band pairing scheme.
As described in more detail below, the present invention in part provides a two-phased architecture model to configure the UWB wireless devices intended for pairing. Phase one is a discovery mode in which UWB radio transmit power is set into a very low power state with reduced bandwidth and very short (near-field) range. Although optional, this low power mode allows for increased security and lowers the risk of an undesired device intercepting the secure pairing communications. Phase two is a handshake phase in which transmission of a pairing beacon code is initiated. This beacon code is transmitted over the air preferably in the low power mode and preferably near-physical-locality state. If a device detects more than one beacon code, then the device may elect to pair with the first discovered device or fail due to the conflict. When two devices successfully exchange the handshake beacon code of the other, the two devices can transition to the verification and secure pairing phase.
With respect to secure pairing, existing device pairing techniques can be utilized. As discussed above, Diffie-Hellman (DH) key exchange protocols and modified DH key exchange protocols are examples of existing secure pairing protocols. Key exchange and verification for the present invention can, therefore, utilize DH and modified-DH protocols. Example DH protocol information can be found in U.S. Pat. No. 4,200,770, which is hereby incorporated by reference in its entirety. Other key exchange protocols could also be utilized, if desired, separately or in conjunction in order to help provide secure pairing.
According to the present invention, during the initial secure pairing phase (such as the DH exchange), each UWB device in the pairing negotiation can make use of pre-existing device-specific or device-generated information such as, for example:
-
UWB device ID
-
random number
-
secret nonce in establishing the initial DH secret
-
vendor-supplied information
-
other device-known or device-generated information
Using this existing device information, the present invention provides an automated technique for establishing the initial pairing secret. Alternatively, preset shared secrets can be set up for the UWB devices and then used for automated secure pairing. In addition, as indicated above, a vendor could supply or inject information for the device that would be used for automated pairing. In short, the secure pairing is automated by using unique pre-existing information related to the device rather than hard-wired connections between devices and/or keys or personal identification numbers (PINs) that must be manually entered by a user. It is noted, however, that one of these prior less efficient techniques could be used in conjunction with the automated techniques of the present invention, if desired.
If the DH key exchange fails, the devices can reattempt pairing a specified number of times before a failure is deemed final. Other error and failure handling mechanisms could also be utilized, as desired. After successful secure pairing of the UWB devices, UWB communications can be secured using the pairing secrets established during the secure pairing exchange. Initially, the pairing secrets or keys can be used to verify identity through one-way or two-way challenges (e.g., A challenge B, B challenge A, or both challenge the other). If the key verification fails, a retry limit can be applied such that verification fails if verification cannot be established within a specified number of tries.
The present invention will now be described in further detail with respect to the drawings. FIG. 1 provides an example block diagram for a secure pairing system with two UWB devices. FIG. 2 provides an example flow diagram for automated secure pairing according to the present invention. And FIG. 3 provides an example flow diagram for UWB communications utilizing automated secure pairing according to the present invention.
Looking first to FIG. 1, a block diagram is depicted for a secure pairing system 100 in a wireless personal area network (WPAN) system environment according to the present invention. As depicted, two ultra-wideband (UWB) devices 102 and112 include automated secure pairing modules 104 an 114, respectively, to allow for secure pairing communications across an in-band UWB communication link 120. In particular, the first UWB device (UWB DEVICE A) includes an automated secure pairing module 104, a graphical user interface (GUI) 106 and a UWB communication interface 108. Similarly, the second UWB device (UWB DEVICE B) includes an automated secure pairing module 114, a graphical user interface (GUI)116 and a UWB communication interface 118. Element 120 represents an in-band UWB communication link that exists UWB communication interfaces 108 and 118 when the two UWB devices 102 and 112 when they are communication through UWB protocols and frequencies.
As indicated above, the UWB devices 102 and 112 can be any of a wide variety of devices that have UWB communication capabilities. For example, the UWB devices can be desktop computer systems, portable computer systems, personal digital assistants (PDAs), handheld computers, cellular telephones or any other desired UWB connectable device. In particular, at least one of the UWB devices will typically be a personal computer (e.g., desktop, server, portable), and at least one of the UWB devices will be a peripheral (e.g., PDA, handheld computer, printer, display, cellular telephone, etc.) UWB enabled devices will also typically have some type of display system to provide information to the user. Display systems, for example, can be text based or graphical. Many devices today provide a graphical user interface (GUI) through which users provide inputs to the device and through which information is provided to the user from the device. The GUIs 106 and 116represent the display system through which the user is receiving information from the device.
The present invention is particularly useful for wireless personal area network (WPAN) environments where a user or group of users is using a wireless network to connect personal devices. One example is where a user may have a laptop computer, a PDA and a cellular telephone that are the electronic tools the user utilizes personally to accomplish his work and other personal tasks. It is desirable for the user to be able to share information among these personal devices over secure wireless communications, such as UWB communications, as discussed above. And it is desirable for these devices to automatically connect and communicate with each other when in range. For these UWB communications to be secure, it is desirable for these devices to be securely paired. The automated UWB secure pairing of the present invention is an efficient and advantageous way to provide this secure pairing.
The automated secure pairing modules 104 and 114 represent software modules that are processed by the UWB devices102 and 112. These software modules operate as part of the UWB communications of the device. It is noted that the automated secure pairing modules 104 and 114 could be implemented in a variety ways, as desired, including the use of firmware or software or both. In operation, the automated secure pairing modules 104 and 114 allow for the generation of one or more pairing secrets that can be used by the UWB devices 102 and 112 to provide for identity verification and secure UWB communications.
FIG. 2 is a flow diagram 200 for secure pairing interactions between two UWB devices 102 and 112 having automated secure pairing modules according to the present invention. When a user desires to create a secure pairing between two UWB devices 102 and 112 for use in subsequent identity verification and secure communications over a UWB channel, the user first brings the two UWB devices 102 and 112 in close physical proximity. As shown in the example embodiment of FIG. 2, the first step is for the user to initiate pairing through the GUI of each device as represented by steps 202 and 222, respectively. More particularly, for the example embodiment 200 depicted in FIG. 2, pairing is initiated through the GUI of UWB Device A 102 as represented by step 202, and the UWB Device B 112 responds through its GUI that pairing is taking place as represented by step 222. Next, in steps 204 and 224, each device 102 and 112 provides feedback to the user through its GUI that secure pairing has been initiated. Next, in steps 206 and 226, each device 102 and 112 can enter low power state such that the transmit power of the device is reduced for secure pairing operations. It is noted that low power modes for pairing negotiations is an optional step. By entering low power mode, the radio-frequency energy used for wireless communications has reduced range. Therefore, it is less likely that some other wireless device can spoof or intercept the communications to generate the secure pairing. Although a low power state is not necessary, it does improve security of the subsequent pairing communications between the two devices.
At this point, the devices 102 and 112 begin in-band UWB communications as represented by element 220. In steps 208and 228, each device 102 and 112 transmits a discovery beacon. This discovery phase 240 allows for the devices 102 and112 to determine the existence of the other device. It is noted that only one of the devices could be configured to provide the beacon signal, if desired, such that secure pairing discovery is initiated by one of the devices. For example, USB device A 102 could be configured simply to look for a discovery beacon, and USB device B 112 could be configured to transmit a discovery beacon.
Next, after discovery phase 240, negotiation pairing stage 242 is entered. In this phase 242, the devices 102 and 112communicate with each other through in-band UWB communications to generate secure pairing secrets for use in later UWB communications between the devices. During these operations, in steps 210 and 230, each device 102 and 112 can display feedback to the user through its GUI about the pairing activities that are taking place. It is noted that the secure pairing secrets generated by the devices 102 and 112 can utilize existing information known by the devices 102 and 112 to generate the pairing secrets. For example, information such as processor types, serial numbers, user configurations, etc. could be used to generate the pairing secrets. In this way, the user is not required to enter any keys or other passwords/codes in order to generate the secure pairing secrets that will subsequently be utilized by the devices 102 and112.
The last phase of flow diagram 200 is the successful pairing phase 244. At this point, the devices 102 and 112 have successfully negotiated pairing secrets for use in subsequent secure UWB communications, and this negotiation has proceeded in an automated fashion without requiring user input codes. Once pairing is successful, in steps 212 and 232, each device 102 and 112 can display feedback to the user through its GUI that the pairing has been successful.
It is noted that the discovery and pairing negotiations, according to the present invention, have occurred through automated in-band UWB communications. In short, once pairing is initiated on the devices 102 and 112, the user is not required to intervene. It is again noted that secure pairing could be initiated in a variety of ways, for example, including: user initiated at both devices, automatically initiated at both devices, user initiated at one device, automatically initiated by one device when in proximity to a beacon generated by another device, and/or any other desired technique for initiating the pairing negotiations.
FIG. 3 is a flow diagram 300 for UWB communications between two ultra-wideband (UWB) devices according to the present invention. In step 302, devices are discovered using beacon communications. As noted above, this device discovery can be initiated through a variety of techniques including user initiated techniques and automated beacon techniques. In decision block 304, a determination is made concerning whether or not a pairing secret has been established between the two devices. If the answer is "yes," then flow passes to block 310 where the identity of the devices is verified using one or more pairing secrets that have previously been established between the devices, for example, using the flow diagram of FIG. 2.
If the answer in decision block 304 is "no," then flow passes to block 306. In block 306, secure pairing is negotiated over an in-band UWB communication link. In block 308, one or more pairing secrets are established based at least in part upon the in-band UWB communications. Flow then passes to block 310 where the identity of the devices is verified using the one or more pairing secrets that were established. It is noted that the in-band secure pairing negotiations can be implemented, for example, as described above with respect to FIG. 2. In FIG. 3, this is represented by the dotted line surrounding block 306and 308 and given the element designation 200.
After verification in block 310, flow passes to decision block 312 where a determination is made whether the identity of the devices were verified. If the answer is "no," flow passes to block 314 where the device connection attempt is rejected. If the answer is "yes," flow passes to block 316 where secure UWB communications begin. It is noted that identity verification can be accomplished in a variety of ways. For example, one-way verification can be implemented where a first UWB device can verify the identity of a second UWB device (one-way trust). In addition, a two-way verification could be used where each UWB device verifies the identity of the other (no-way trust).