Method for communication between devices and devices thereof

Disclosed is a method of performing, by a first device, short-range wireless communication with a second device, the method including receiving, from the second device, second authentication information encrypted using first authentication information of the first device, decrypting the encrypted second authentication information by using the first authentication information, determining a secret key based on the decrypted second authentication information, and performing communication between the first device and the second device by using the determined secret key.

TECHNICAL FIELD

The present disclosure relates to communication methods between devices, devices communicating with each other, and recording media having recorded thereon programs for executing the methods.

BACKGROUND ART

The Internet is evolving from a human-centered network, in which humans create and use data, to the Internet of things (IoT), in which data is exchanged and processed among distributed elements such as objects. The Internet of everything (IoE) technology, in which big data processing technology based on connection with a cloud server or the like is combined with the IoT technology, is on the rise. Since technology elements such as sensing technology, wired/wireless communication and network infra, service interface technology, and security technology are required to implement the IoT, research is currently being conducted on sensor network, machine to machine (M2M), and machine type communication (MTC) technologies for connection among objects.

DETAILED DESCRIPTION OF THE INVENTION

Technical Problem

Provided are methods of securely and efficiently sharing information required to establish a communication channel between a device which desires to participate in a short-range wireless communication network and a device which relays the network.

Technical Solution

According to an aspect of an embodiment, a method of performing, by a first device, short-range wireless communication with a second device includes receiving, from the second device, second authentication information encrypted using first authentication information of the first device, decrypting the encrypted second authentication information by using the first authentication information, determining a secret key based on the decrypted second authentication information, and performing communication between the first device and the second device by using the determined secret key.

BEST MODE

According to an aspect of an embodiment, a method of performing, by a first device, short-range wireless communication with a second device includes receiving, from the second device, second authentication information encrypted using first authentication information of the first device, decrypting the encrypted second authentication information by using the first authentication information, determining a secret key based on the decrypted second authentication information, and performing communication between the first device and the second device by using the determined secret key.

The first authentication information and the second authentication information may include a first public key generated by the first device and a second public key generated by the second device, respectively, and the method may further include transmitting the first public key to the second device

The method may further include generating the first public key by using a random number.

The receiving of the second authentication information may include receiving identification information of the second device together with the encrypted second authentication information.

The determining of the secret key may include generating the secret key based on at least one of the first authentication information, the second authentication information, identification information of the first device, and the identification information of the second device, and the performing of communication between the first device and the second device may include decrypting an encrypted network key received from the second device, by using the generated secret key.

The second authentication information may include security information generated by the second device, and the determining of the secret key may include selecting at least one of a plurality of secret keys included in the decrypted security information.

The performing of communication between the first device and the second device may include establishing an encrypted communication channel between the first device and the second device by using the determined secret key.

According to an aspect of another embodiment, a method of performing, by a second device, short-range wireless communication with a first device includes receiving first authentication information from the first device, encrypting second authentication information based on the received first authentication information, transmitting the encrypted second authentication information to the first device, and performing communication between the first device and the second device as the encrypted second authentication information is decrypted by the first device.

The receiving of the first authentication information may include receiving a first public key generated by the first device, and the encrypting of the second authentication information may include encrypting a second public key by using the received first public key.

The receiving of the first authentication information may include receiving identification information of the first device together with the first authentication information.

The method may further include generating a secret key based on at least one of the first authentication information, the second authentication information, the identification information of the first device, and identification information of the second device, encrypting a network key by using the generated secret key, and

transmitting the encrypted network key to the first device.

The second authentication information may include a plurality of secret keys, the performing of communication between the first device and the second device may include receiving at least one secret key selected by the first device, and determining whether the received at least one secret key is included in the plurality of secret keys.

The performing of communication between the first device and the second device may include establishing an encrypted communication channel between the first device and the second device by using the determined secret key.

According to an aspect of another embodiment, a first device for performing short-range wireless communication with a second device includes a communication unit configured to receive, from the second device, second authentication information encrypted using first authentication information, and a processor configured to decrypt the encrypted second authentication information by using the first authentication information, and determine a secret key based on the decrypted second authentication information, wherein the communication unit is further configured to perform communication between the first device and the second device by using the determined secret key.

The first authentication information and the second authentication information may include a first public key generated by the first device and a second public key generated by the second device, respectively, and

the communication unit may be further configured to transmit the first public key to the second device.

The processor may be further configured to generate the first public key by using a random number.

The communication unit may be further configured to receive identification information of the second device together with the encrypted second authentication information.

The processor may be further configured to generate the secret key based on at least one of the first authentication information, the second authentication information, identification information of the first device, and the identification information of the second device, and decrypt an encrypted network key received from the second device, by using the generated secret key.

The second authentication information may include security information generated by the second device, and the processor may be further configured to select at least one of a plurality of secret keys included in the decrypted security information.

The processor may be further configured to establish an encrypted communication channel between the first device and the second device by using the determined secret key.

According to an aspect of another embodiment, a second device for performing short-range wireless communication with a first device includes a communication unit configured to receive first authentication information from the first device, and a processor configured to encrypt second authentication information based on the received first authentication information, wherein the communication unit is configured to transmit the encrypted second authentication information to the first device and perform communication between the first device and the second device as the encrypted second authentication information is decrypted by the first device.

The communication unit may be further configured to receive a first public key generated by the first device, and the processor may be further configured to encrypt a second public key by using the received first public key.

The communication unit may be further configured to receive identification information of the first device together with the first authentication information.

The processor may be further configured to generate a secret key based on at least one of the first authentication information, the second authentication information, the identification information of the first device, and identification information of the second device, and encrypt a network key by using the generated secret key, and the communication unit may be further configured to transmit the encrypted network key to the first device.

The second authentication information may include a plurality of secret keys.

The communication unit (or interface) may be further configured to receive at least one secret key selected by the first device, and the processor may be further configured to determine whether the received at least one secret key is included in the plurality of secret keys.

The processor may be further configured to establish an encrypted communication channel between the first device and the second device by using the determined secret key.

MODE OF THE INVENTION

Terminology used in this specification will now be briefly described before describing embodiments.

Although the terms used in the following description are selected, as much as possible, from general terms that are widely used at present while taking into consideration the functions obtained in accordance with the embodiments, these terms may be replaced by other terms based on intentions of one of ordinary skill in the art, customs, emergence of new technologies, or the like. In a particular case, terms that are arbitrarily selected by the applicant may be used. In this case, the meanings of these terms may be described in corresponding parts of the embodiments. Accordingly, it should be noted that the terms used herein should be construed based on practical meanings thereof and the whole content of this specification, rather than being simply construed based on names of the terms.

It will be understood that the terms “comprises”, “comprising”, “includes” and/or “including”, when used herein, specify the presence of stated elements, but do not preclude the presence or addition of one or more other elements. The suffix such as “ . . . er”, “unit”, or “module” is used to denote an entity for performing at least one function or operation, and may be embodied in the form of hardware, software, or a combination thereof.

Reference will now be made in detail to embodiments, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to like elements throughout. In the following description, for clarity, parts or elements that are not related to the embodiments are omitted. In this regard, the present embodiments may have different forms and should not be construed as being limited to the descriptions set forth herein. Accordingly, the embodiments are merely described below, by referring to the figures, to explain aspects.

FIG. 1is a schematic diagram of a communication system100according to an embodiment.

The communication system100according to an embodiment may include at least one first device110(e.g.,112,114, or116) and a second device120.

FIG. 1illustrates only elements of the communication system100related to the current embodiment. Therefore, one of ordinary skill in the art related to the current embodiment will understand that the communication system100may further include other general-use elements in addition to the elements illustrated inFIG. 1. For example, the communication system100illustrated inFIG. 1may further include other devices in addition to the plurality of devices112,114,116, and120.

The first device110may be a device having a communication function capable of participating in a short-range network. For example, referring toFIG. 1, the at least one first device110may be an Internet of things (IoT) device having a communication function, e.g., a washing machine112, a CD player114, or a light bulb116. The above-mentioned devices are merely examples and, in the present disclosure, the first device110may be one of devices having a communication module capable of implementing a communication technology based on a short-range network.

The first device110according to an embodiment may encrypt and decrypt various types of information required to establish a communication channel. For example, in order for the first device110to participate in a short-range network of the second device120, exchange of a network key may be required.

The first device110may receive, from the second device120, a network key encrypted based on first authentication information and second authentication information of the first device110. The first device110may decrypt the encrypted network key by using the first authentication information. Herein, the first authentication information and the second authentication information may be determined based on an encryption protocol performed between the first device110and the second device120. For example, a public key, security card information, and random number information may be included in the authentication information.

However, the network key is merely an example and a parameter or data transmitted/received to establish a communication channel between the first device110and the second device120may be encrypted and decrypted in various manners.

The second device120may be a device for relaying network connection in such a manner that the at least one first device110capable of short-range wireless communication participates in a network. For example, the second device120may include at least one of a hub device, gateway device, and router device. However, the above-mentioned devices are merely examples and the present disclosure is not limited thereto.

The second device120according to an embodiment may encrypt and decrypt various types of information required to establish a communication channel.

For example, the second device120may encrypt at least one of the second authentication information and the network key required to establish a communication channel, by using the first authentication information received from the first device110. In addition, the second device120may decrypt encrypted information received from the first device110.

FIG. 2is a flowchart of a method of communicating with the second device120by the first device110, according to an embodiment.

In operation S210, the first device110receives, from the second device120, second authentication information encrypted using first authentication information of the first device110. Herein, the first authentication information may include at least one of identification information of the first device110, a public key, a random variable generated by the first device110, etc. However, the above-mentioned types of information are merely examples and the present disclosure is not limited thereto.

The first device110according to an embodiment may transmit the first authentication information and a participation request to the second device120in order to participate in a short-range network relayed by the second device120. The first authentication information may be used when the second device120encrypts the second authentication information.

In operation S220, the first device110decrypts the encrypted second authentication information by using the first authentication information.

The first device110according to an embodiment may receive, from the second device120, the second authentication information encrypted using the first authentication information. Herein, the second authentication information may include at least one of identification information of the second device120, a public key, random information generated by the second device120, etc.

Herein, information about a function used to encrypt or decrypt the authentication information between the first device110and the second device120may be equally preset for the first device110and the second device120.

In operation S230, the first device110determines a secret key based on the decrypted second authentication information.

The decrypted second authentication information according to an embodiment may be the public key of the second device120. Alternatively, the decrypted second authentication information may be security information including key values randomly generated by the second device120.

For example, the first device110may generate the secret key by using the first authentication information and the second authentication information. Herein, the secret key may be used to encrypt a network key used to establish a communication channel between the first device110and the second device120.

According to another embodiment, the decrypted second authentication information may be a security key included in a security card generated by the second device120. The first device110may select at least one security key from the security card.

In operation S240, the first device110performs communication between the first device110and the second device120by using the determined secret key.

The first device110according to an embodiment may receive, from the second device120, the network key encrypted using the determined secret key. The first device110may decrypt the encrypted network key by using the determined secret key. Since the first device110and the second device120exchange the encrypted network key, unauthorized devices may be prevented from participating in the network relayed by the second device120. In addition, the

The first device110according to another embodiment may transmit the determined secret key to the second device120. When the determined secret key equals a secret key of the second device120, the first device110may participate in the network relayed by the second device120.

FIG. 3is a flowchart of a method of communicating with the first device110by the second device120, according to an embodiment.

In operation S310, the second device120receives first authentication information from the first device110.

The second device120according to an embodiment may receive, from the first device110, the first authentication information and a participation request for participating in a network relayed by the second device120. The participation request of the first device110may include the first authentication information. Alternatively, the second device120may receive the participation request and the first authentication information of the first device110as separate signals.

Herein, as described above in relation toFIG. 2, the first authentication information may include at least one of identification information of the first device110, a public key, a random variable generated by the first device110, etc. However, the above-mentioned types of information are merely examples and the present disclosure is not limited thereto.

In operation S320, the second device120encrypts second authentication information based on the received first authentication information. Herein, an encryption scheme used to encrypt the second authentication information may be pre-shared between the first device110and the second device120.

Herein, the second authentication information may include at least one of identification information of the second device120, a public key, random information generated by the second device120, etc.

When a first public key of the first device110is received as the first authentication information, the second device120according to an embodiment may encrypt the first public key by using a private key of the second device120, e.g., a second private key.

When a random number generated by the first device110is received as the first authentication information, the second device120according to another embodiment may encrypt the received random number by using a key generation function. For example, the second device120may generate security information including a plurality of security keys, by using the key generation function and the received random number.

In operation S330, the second device120transmits the encrypted second authentication information to the first device110.

The second device120according to an embodiment may transmit an encrypted second public key to the first device110. Alternatively, the second device120may transmit encrypted security information to the first device110.

In operation S340, the second device120performs communication between the first device110and the second device120as the encrypted second authentication information is decrypted by the first device110.

The second device120according to an embodiment may generate a secret key by using the first authentication information and the second authentication information. The second device120may encrypt a network key by using a master key. When the first device110is owned by a pre-authorized user, the first device110may decrypt the encrypted network key by using a master key generated based on information exchanged with the second device120. Since the second device120encrypts the network key for communication, unauthorized devices other than the first device110may be prevented from participating in a communication channel.

The first device110according to another embodiment may transmit a determined secret key to the second device120. Herein, the determined secret key may be an arbitrary security key included in a security card of the second device120and determined by the first device110.

FIG. 4is a conceptual diagram for describing a communication method between the first device110and the second device120based on a public key exchange protocol, according to an embodiment.

The first device110may transmit a participation request for participating in a network of the second device120. Herein, the first device110may be one of devices having a communication module capable of participating in the network. For example, the first device110may be a smartphone, laptop computer, tablet PC, electronic book device, digital broadcast receiver, personal digital assistant (PDA), portable multimedia player (PMP), navigation system, smart TV, consumer electronics (CE) device (e.g., a refrigerator or air conditioner having a display panel), or the like, but is not limited thereto.

The second device120may control data transmission/reception of other devices connected to the network. In addition, the second device120may determine whether to permit participation of another device, which desired to participate in the network. For example, the second device120may be a router, gateway, or hub but is not limited thereto. Herein, the network may be a Zigbee network, Bluetooth network, or the like based on short-range wireless communication. The following description will be focused on a communication method between the first device110and the second device120in a Zigbee network for convenience of explanation. However, the embodiments are not limited to the Zigbee network.

The first device110according to an embodiment may generate a secret key by exchanging a public key with the second device120. A network key410encrypted using the secret key may be transmitted/received between the first device110and the second device120. For example, the second device120may encrypt the network key by using the secret key and provide the same to the first device110.

According to an embodiment, since the network key encrypted using the secret key is transmitted/received, other unauthorized external devices may be prevented from participating in the network.

The secret key for encrypting the network key may be determined based on an input parameter and an encryption function type. For example, the input parameter may include at least one of an iteration count, random value, nonce, use of heterogeneous hash functions, and time stamp. The encryption function type may indicate a hash function, message authentication code (MAC), or block cipher. However, the above-mentioned functions are merely examples and the encryption function type is not limited thereto.

FIG. 5is a flowchart of a method of communicating with the second device120by the first device110based on a public key exchange protocol, according to an embodiment.

In operation S510, the first device110may provide a first public key and transmit a network participation request to the second device120.

The first device110according to an embodiment may transmit the network participation request for participating in a Zigbee network relayed by the second device120. Herein, the network participation request may include identification information of the first device110and the first public key of the first device110. However, the network participation request including the first public key is merely an example and the first device110may provide the network participation request and the first public key to the second device120as separate messages.

The first public key may be generated based on a first private key of the first device110. The first device110may generate the first private key by generating an arbitrary random number. For example, the first device110may generate a random number a to generate the first private key. The first device110may generate the first public key by applying a preset function to the first private key. For example, the first device110may generate a first public key aP by multiplying the random number a by a preset value P.

In operation S520, the first device110may receive a second public key of the second device120, which is encrypted using the first public key.

As the first public key is received from the first device110, the second device120according to an embodiment may encrypt the second public key by using the first public key. The second device120may transmit the encrypted second public key to the first device110. Herein, the second device120may encrypt the second public key by using the first public key and a credential pre-shared between the first device110and the second device120. Herein, the credential is cryptographic information capable of indicating an authorized first device, and may be pre-shared between the authorized first device and the second device120.

In operation S530, the first device110may decrypt the encrypted second public key by using the first public key.

The first device110according to an embodiment may decrypt the encrypted second public key by using pre-stored authentication information and the first public key.

In operation S540, the first device110may generate a secret key by using the second public key and the first private key.

The first device110according to an embodiment may generate the secret key based on at least one of the first private key, the second public key, the identification information of the first device110, and identification information of the second device120.

Herein, the types of information used to generate the secret key may be preset between the first device110and the second device120.

In operation S550, the first device110may receive an encrypted network key from the second device120.

The second device120according to an embodiment may generate a secret key for encrypting the network key required for a communication channel. For example, the second device120may generate the secret key based on at least one of the first public key, a second private key, the identification information of the first device110, and the identification information of the second device120.

The second device120may encrypt the network key by using the generated secret key. In addition, the second device120may transmit the encrypted network key to the first device110.

The first device110according to an embodiment may receive the encrypted network key from the second device120, thereby securely sharing the network key between the first device110and the second device120.

In operation S560, the first device110may decrypt the encrypted network key by using the generated secret key.

The first device110according to an embodiment may participate in the network relayed by the second device120, by using the network key.

FIG. 6is a flowchart of a method of communicating with the first device110by the second device120based on a public key exchange protocol, according to an embodiment.

In operation S610, the second device120may receive a first public key from the first device110.

The second device120according to an embodiment may receive the first public key from the first device110together with a network participation request. However, the receiving of the first public key together with the network participation request is merely an example and the network participation request and the first public key may be received from the first device110as separate messages.

In operation S620, the second device120may encrypt a second public key by using the first public key.

The second device120according to an embodiment may encrypt the second public key by using the first public key and a credential pre-shared with the first device110.

In operation S630, the second device120may transmit the encrypted second public key to the first device110.

In operation S640, the second device120may generate a secret key based on the first public key and a second private key of the second device120.

The second device120according to an embodiment may generate the secret key for encrypting a network key required for a communication channel. For example, the second device120may generate the secret key based on at least one of the first public key, the second private key, identification information of the first device110, and identification information of the second device120.

In operation S650, the second device120may encrypt the network key by using the generated secret key. It may be assumed that the first device110and the second device120according to an embodiment use the same encryption function and the same encryption input parameter.

In operation S660, the second device120may transmit the encrypted network key to the first device110.

The first device110according to an embodiment may decrypt the encrypted network key by using a secret key generated by the first device110. When the first device110is a device permitted to participate in a network, the first device110may decrypt the network key by using the secret key.

An encrypted communication channel may be established between the second and first devices120and110as the first device110decrypts the network key.

FIG. 7is a flowchart of a communication method between the first device110and the second device120based on a public key exchange protocol, according to an embodiment.

In operation S705, the first device110may generate a first public key.

The first device110according to an embodiment may generate a first private key by generating an arbitrary random number. The first device110may generate the first public key by applying a preset function shared with the second device120, to the generated first private key.

In operation S710, the first device110may transmit a network participation request and the first public key to the second device120.

The first device110according to an embodiment may transmit the first public key to the second device120together with the network participation request. However, the transmitting of the first public key together with the network participation request is merely an example and, alternatively, the first device110may transmit the network participation request and the first public key to the second device120as separate messages.

In operation S715, the second device120may generate a second public key.

The second device120according to an embodiment may generate a second private key by generating an arbitrary random number. The second device120may generate the second public key by applying a preset function shared with the first device110, to the generated second private key.

In operation S720, the second device120may encrypt the second public key by using the first public key. The second device120according to an embodiment may encrypt the second public key by using the first public key received from the first device110.

In operation S725, the second device120may transmit the encrypted second public key to the first device110.

In operation S730, the first device110may decrypt the encrypted second public key.

In operation S735, the first device110may generate a secret key by using the first private key and the second public key.

For example, the first device110may generate the secret key based on at least one of the first public key, the second private key, identification information of the first device110, and identification information of the second device120.

In operation S740, the second device120may generate a secret key by using the first public key and the second private key.

For example, the second device120may generate the secret key based on at least one of the first public key, the second private key, the identification information of the first device110, and the identification information of the second device120.

In operation S745, the second device120may encrypt a network key by using the secret key.

In operation S750, the first device110and the second device120may establish an encrypted communication channel therebetween by transmitting/receiving the encrypted network key.

The first device110according to an embodiment may decrypt the encrypted network key received from the second device120, by using the generated secret key.

FIG. 8is a specific flowchart of a communication method between the first device110and the second device120based on a public key exchange protocol, according to an embodiment.

In operation S810, the first device110may generate a first private key by generating a random number a. In addition, the first device110may generate a first public key A by multiplying the first private key a by a preset parameter p. In the current embodiment, the first public key A corresponds to “ap”.

In operation S820, the first device110may transmit the first public key A to the second device120together with identification information z of the first device110.

In operation S830, the second device120may generate a key K by inputting the received first public key A and a credential Z shared with the first device110, to an encryption function E.

Furthermore, the second device120according to an embodiment may generate a second private key by generating a random number b. In addition, the second device120may generate a second public key B by multiplying the second private key b by the preset parameter p. In the current embodiment, the second public key B corresponds to “bp”.

The second device120according to an embodiment may encrypt the second public key by using the generated key K. For example, the second device120may set the generated key K as an input parameter, and encrypt the second public key B by using the encryption function E, thereby generating an encrypted second public key C.

In operation S840, the second device120may transmit the encrypted second public key C to the first device110. In addition, the second device120may transmit the encrypted second public key C to the first device110together with identification information U of the second device120.

In operation S850, the first device110may generate a key K by using a credential A and the first public key A. The first device110may decrypt the encrypted second public key C received from the second device120, by using the generated key K.

The first device110according to an embodiment may generate a session key S by using the first private key a and the second public key B. In addition, the first device110according to an embodiment may generate a secret key by using the session key S, the identification information V of the first device110, the identification information U of the second device120, the first public key A, and the second public key B.

In operation S860, the second device120may generate a session key S by using the second private key b and the first public key A. In addition, the second device120according to an embodiment may generate a secret key by using the session key S, the identification information V of the first device110, the identification information U of the second device120, the first public key A, and the second public key B.

In operation S870, the first device110and the second device120may establish an encrypted communication channel therebetween by transmitting/receiving a network key encrypted using the secret key.

FIG. 9is a conceptual diagram for describing a communication method between the first device110and the second device120based on a security card exchange protocol, according to an embodiment.

The first device110according to an embodiment may transmit, to the second device120, a network participation request for requesting to participate in a network of the second device120. In addition, the first device110may transmit a random number value generated by the first device110, to the second device120together with the network participation request.

The second device120according to an embodiment may generate a security card910including one or more secret keys, by generating random number values. Referring toFIG. 9, the second device120may generate the security card910including six secret keys.

In addition, the second device120according to an embodiment may encrypt the security card910by using the random number value received from the first device110. For example, the second device120may encrypt the security card910by using the random number value received from the first device110based on an encryption function such as a hash function, message authentication code (MAC), or block cipher.

The second device120may transmit the encrypted security card910to the first device110. The first device110may decrypt the encrypted security card910by using the generated random number value.

The first device110according to an embodiment may select at least one of the six secret keys included in the security card910and transmit the same to the second device120. The second device120may determine whether to permit the first device110to participate in the network, by determining whether the at least one secret key received from the first device110matches that included in the security card910.

The communication method based on the security card exchange protocol, according to an embodiment, since a function for generating a key does not need to be pre-shared between the first device110and the second device120, an encrypted communication channel may be more easily established between the first device110and the second device120.

FIG. 10is a flowchart of a method of communicating with the second device120by the first device110based on a security card exchange protocol, according to an embodiment.

In operation S1010, the first device110may receive, from the second device120, security information encrypted using first authentication information of the first device110. Herein, the security information may be a security card including a plurality of secret keys. The security card is merely an example and the security information is not limited thereto.

The first authentication information according to an embodiment may include a random number value arbitrarily generated by the first device110. For example, when the random number value arbitrarily generated by the first device110is denoted by a, the first authentication information may be a. However, the random number value a is merely an example and the first device110may select one of pre-stored values and use the same as the first authentication information.

The first device110according to an embodiment may transmit the first authentication information to the second device120. Herein, the first device110may transmit a network participation request for requesting to participate in a network of the second device120, together with the first authentication information. However, the transmitting of the network participation request together with the first authentication information is merely an example and the first device110may transmit the first authentication information and the network participation request as separate messages.

The second device120may encrypt the security card by using the first authentication information received from the first device110. Herein, the security card may include one or more secret keys determined based on random number values arbitrarily generated by the second device120. The first device110may receive, from the second device120, the security card encrypted using the first authentication information.

In operation S1020, the first device110may decrypt the encrypted security information by using the first authentication information.

The first device110according to an embodiment may decrypt the encrypted security information by using the first authentication information. Herein, the first device110may have pre-stored therein an encryption function used to encrypt the security information of the second device120. However, the pre-stored encryption function is merely an example and information about the encryption function used to encrypt the security information may not be pre-shared between the first device110and the second device120.

In operation S1030, the first device110may select at least one of the plurality of secret keys included in the decrypted security information.

When the security information is a security card according to an embodiment, the security card may include one or more secret keys. For example the security card may include six secret keys.

The first device110according to an embodiment may select at least one of the one or more secret keys included in the security card. For example, the first device110may select a first key and a third key among the six secret keys.

In operation S1040, the first device110may transmit the selected secret key to the second device120. For example, the first device110may transmit the selected first and third keys to the second device120.

The first device110according to an embodiment may express that the first device110is an authorized device, by transmitting the selected secret key to the second device120.

The second device120according to an embodiment may compare the secret key received from the first device110, to the secret keys included in the security card. For example, the second device120may determine whether each of the first and third keys received from the first device110matches one of the secret keys included in the security card.

When the secret key received from the first device110matches one of the secret keys included in the security card, the second device120may establish an encrypted communication channel for the first device110. Alternatively, when the secret key received from the first device110does not match any of the secret keys included in the security card, the second device120may not establish an encrypted communication channel for the first device110.

FIG. 11is a flowchart of a method of communicating with the first device110by the second device120based on a security card exchange protocol, according to an embodiment.

In operation S1110, the second device120may receive first authentication information from the first device110. Herein, the first authentication information may be, for example, a random number value generated by the first device110. However, the random number value is merely an example and the authentication information is not limited thereto.

In operation S1120, the second device120may encrypt security information generated by the second device120, based on the first authentication information received from the first device110.

The second device120according to an embodiment may generate the security information. For example, the second device120may generate a security card including one or more secret keys. Herein, the one or more secret keys may be generated based on one or more random number values generated by the second device120.

The second device120according to an embodiment may encrypt the security card by using the random number value received from the first device110. For example, the second device120may encrypt the security card by using an encryption function and the random number value (e.g., a) received from the first device110. Herein, a hash function, message authentication code (MAC), or block cipher may be used as the encryption function. However, the above-mentioned functions are merely examples and the encryption function is not limited thereto.

In operation S1130, the second device120may transmit the encrypted security information to the first device110.

The second device120according to an embodiment may transmit the encrypted security information to the first device110in order to prevent unauthorized external devices from obtaining the security information of the second device120.

In operation S1140, the second device120may receive a secret key selected by the first device110.

According to an embodiment, the first device110may decrypt the encrypted security information received from the second device120, by using the first authentication information. For example, the first device110may decrypt the encrypted security card by using the random number value a.

The first device110may select at least one of the secret keys included in the encrypted security card. The first device110may transmit the selected secret key to the second device120.

In operation S1150, the second device120may determine whether to establish an encrypted communication channel for the first device110, by comparing the received secret key to the secret keys included in the security information.

The second device120according to an embodiment may compare the secret keys included in the security card, to the secret key received from the first device110. For example, when a first key and a third key received from the first device110by the second device120are included in the security card, the second device120may establish an encrypted communication channel for the first device110. Alternatively, when the first and third keys received from the first device110are not included in the security card, the second device120may not establish an encrypted communication channel for the first device110.

FIG. 12is a flowchart of a communication method between the first device110and the second device120based on a security card exchange protocol, according to an embodiment.

In operation S1210, the first device110may generate a first random number. However, the first random number is merely an example of first authentication information and the first device110may have pre-stored therein values usable for the first authentication information.

In operation S1220, the first device110may transmit a network participation request and the first random number to the second device120.

In operation S1230, the second device120may generate security information by using one or more second random numbers. For example, the second device120may generate a security card by using the second random numbers. Herein, the security card may include one or more secret keys. The second device120may use the second random numbers as the secret keys. Alternatively, the second device120may generate may generate the secret keys by substituting the second random numbers in a function.

In operation S1240, the second device120may encrypt the security information by using the first random number. The second device120according to an embodiment may encrypt the security information by using the first random number received from the first device110, in order to prevent unauthorized external devices from obtaining the security information.

In operation S1250, the second device120may transmit the encrypted security information.

In operation S1260, the first device110may decrypt the security information and select a secret key therefrom. The first device110according to an embodiment may decrypt the security card received from the second device120, by using the first random number transmitted to the second device120. In addition, the first device110may select at least one of the one or more secret keys included in the security card.

In operation S1270, the first device110and the second device120may establish a secret-key-based encrypted communication channel therebetween.

The first device110according to an embodiment may transmit the selected secret key to the second device120. When the secret key received from the first device110matches one of the secret keys included in the security card, the second device120may establish an encrypted communication channel for the first device110.

FIG. 13is a flowchart of a method of determining a protocol used to determine whether to permit the first device110to participate in a network, by the second device120, according to an embodiment.

In operation S1310, as a network participation request is received from the first device110, the second device120may determine whether participation of the first device110in a network is possible. For example, when the network of the second device120currently lacks network resources allocable to the first device110, the second device120may determine that participation of the first device110in the network is not possible.

In operation S1320, the second device120may determine whether the first device110supports an encrypted communication channel.

According to an embodiment, the second device120may determine whether the first device110supports a public-key-based protocol or security-card-based protocol for establishing an encrypted communication channel.

In operation S1330, the second device120may select an encrypt key type used to establish an encrypted communication channel for the first device110.

For example, the second device120may select one of the public-key-based protocol and the security-card-based protocol based on a protocol supported by the first device110. When the first device110supports both of the public-key-based protocol and the security-card-based protocol, the second device120may select a protocol based on communication states of the first device110and the second device120. For example, the second device120may select the security-card-based protocol having low complexity.

In operation S1340, the second device120may transmit a second public key encrypted using a first public key received from the first device110, to the first device110.

In operation S1350, the second device120may encrypt a network key by using the second public key and the first public key.

In operation S1360, the second device120may generate security information by using second random numbers.

In operation S1370, the second device120may transmit the security information encrypted using a first random number received from the first device110, to the first device110.

In operation S1380, the second device120may receive encrypted security information from the first device110. For example, the second device120may obtain a security key selected by the first device110, by decrypting the encrypted security information.

In operation S1390, the second device120may establish an encrypted communication channel for the first device110by receiving encrypted information. The second device120according to an embodiment may establish an encrypted communication channel by using an encrypted network key received from the first device110. Alternatively, the second device120may establish an encrypted communication channel by using an encrypted security key received from the first device110.

FIGS. 14 and 15are block diagrams of a first device1400according to an embodiment.

As illustrated inFIG. 14, the first device1400according to an embodiment may include a communication unit1410and a processor1420. However, not all illustrated elements are essential. The first device1400may include a smaller or larger number of elements.

For example, as illustrated inFIG. 15, the first device1400according to an embodiment of the present disclosure may further include a sensing unit1430, a user input unit1440, an output unit1450, an audio/video (A/V) input unit1460, and a memory1470in addition to the communication unit1410and the processor1420.

The first device1400ofFIGS. 14 and 15may correspond to the first device110described above in relation toFIGS. 1 to 13.

The above-mentioned elements will now be described one by one.

The communication unit1410receives, from the second device120, second authentication information encrypted using first authentication information.

The communication unit1410according to an embodiment may perform communication between the first device1400and the second device120by using a determined secret key. In addition, the communication unit1410may transmit a first public key to the second device120. The communication unit1410may receive identification information of the second device120together with the encrypted second authentication information.

The communication unit1410may include one or more elements for enabling the first device1400to communicate with the second device120. For example, the communication unit1410may include a short-range wireless communication unit1411, a mobile communication unit1412, and a broadcast reception unit1413.

The short-range wireless communication unit1411may include a Bluetooth communication unit, a Bluetooth low energy (BLE) communication unit, a near field communication unit, a wireless local area network (WLAN) (e.g., Wi-Fi) communication unit, a ZigBee communication unit, an infrared data association (IrDA) communication unit, a Wi-Fi direct (WFD) communication unit, an ultra wideband (UWB) communication unit, an Ant+ communication unit, etc., but is not limited thereto.

The mobile communication unit1412transmits/receives radio signals to/from at least one of a base station, an external device, and a server in a mobile communication network. Herein, the radio signals may include various types of data based on transmission/reception of voice call signals, video call signals, and text/multimedia messages.

The broadcast reception unit1413receives broadcast signals and/or broadcast-related information through broadcast channels from an external device. The broadcast channels may include satellite channels and terrestrial channels. According to another embodiment, the first device1400may not include the broadcast reception unit1413.

The processor1420controls overall operations of the first device1400. For example, the processor1420may control all of the communication unit1410, the sensing unit1430, the user input unit1440, the output unit1450, the A/V input unit1460, and the memory1470by executing programs stored in the memory1470.

The processor1420according to an embodiment decrypts the second authentication information encrypted using the first authentication information. In addition, the processor1420may determine the secret key based on the decrypted second authentication information.

Furthermore, the processor1420may generate a random number. The processor1420according to an embodiment may generate the first public key by using the generated random number.

The processor1420according to an embodiment may generate the secret key based on at least one of the first authentication information, the second authentication information, identification information of the first device1400, and the identification information of the second device120. In addition, the processor1420may decrypt an encrypted network key received from the second device120, by using the generated secret key.

The processor1420according to an embodiment may select at least one of a plurality of secret keys included in decrypted security information. In addition, the processor1420may establish an encrypted communication channel between the first device1400and the second device120by using the determined secret key.

The sensing unit1430may include at least one of a magnetic sensor1431, an acceleration sensor1432, a temperature/humidity sensor1433, an infrared sensor1434, a gyroscope sensor1435, a position sensor (e.g., global positioning system (GPS))1436, a barometric pressure sensor1437, a proximity sensor1438, and an RGB sensor (or illuminance sensor)1439, but is not limited thereto. Functions of the sensors may be intuitively inferred from their names by one of ordinary skill in the art, and thus detailed descriptions thereof are not provided herein.

The user input unit1440refers to a means used when a user inputs data to control the first device1400. For example, the user input unit1440may include a keypad, dome switch, touchpad (e.g., capacitive overlay type, resistive overlay type, infrared beam type, surface acoustic wave type, integral strain gauge type, or piezoelectric type), jog wheel, jog switch, etc., but is not limited thereto.

The user input unit1440according to an embodiment may receive user inputs required to perform operations of the first device1400, which are described above in relation toFIGS. 1 to 13.

The output unit1450is used to perform an operation determined by the processor1420, and may include a display unit1451, a sound output unit1452, and a vibration motor1453.

When the display unit1451and a touchpad are layered to configure a touchscreen, the display unit1451may be used as an input device as well as an output device. The display unit1451may include at least one of a liquid crystal display (LCD), thin film transistor-liquid crystal display (TFT-LCD), organic light-emitting diode (OLED), flexible display, a three-dimensional (3D) display, and electrophoretic display. The first device1400may further include one or more display units in addition to the display unit1451based on the configuration of the first device1400.

The sound output unit1452outputs audio data received from the communication unit1410or stored in the memory1470. In addition, the sound output unit1452outputs sound signals related to functions performed by the first device1400(e.g., call signal reception sound, message reception sound, and notification sound). The sound output unit1452may include a speaker, a buzzer, etc.

The vibration motor1453may output vibration signals. For example, the vibration motor1453may output vibration signals corresponding to output of audio data or video data (e.g., call signal reception sound and message reception sound). In addition, the vibration motor1453may output vibration signals when touches are input to the touchscreen.

The A/V input unit1460is used to input audio signals or video signals, and may include a camera1461and a microphone1462. The camera1461may obtain still or moving image frames by using an image sensor in a video call mode or a camera mode. The images captured by the image sensor may be processed by the processor1420or an image processor (not shown).

The image frames processed by the camera261may be stored in the memory1470or may be transmitted through the communication unit1410to an external device. The camera1461may include two or more cameras based on the configuration of the first device1400.

The microphone1462receives an external audio signal and processes the same into electrical voice data. For example, the microphone1462may receive the audio signal from an external first device or a person. The microphone1462may use various noise cancellation algorithms to remove noise generated while the external audio signal is being received.

The memory1470may store programs for processing and control operations of the processor1420, and store input/output data. The memory1470according to an embodiment may store at least one encryption function and at least one input parameter used for encryption. In addition, the memory1470may store credential information shared between the first device1400and the second device120.

The memory1470may include at least one type of storage medium among a flash memory, hard disk, multimedia card micro, card type memory (e.g., secure digital (SD) or extreme digital (XD) memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable ROM (EEPROM), programmable ROM (PROM), magnetic memory, magnetic disc, and optical disc. Alternatively or additionally, the first device1400may use a web storage or cloud server serving as the memory1470on the Internet.

The programs stored in the memory1470may be divided into a plurality of modules, e.g., a user interface (UI) module1471, a touchscreen module1472, and a notification module1473, based on functions thereof.

The UI module1471may provide user interfaces (UIs) or graphic user interfaces (GUIs) specialized for each application and operable in the first device1400. The touchscreen module1472may detect a touch gesture of the user on the touchscreen, and transmit information about the touch gesture to the processor1420. The touchscreen module1472according to an embodiment of the present disclosure may recognize and analyze touch code. The touchscreen module1472may be configured as independent hardware including a controller.

Various sensors may be provided in or near the touchscreen to detect touches or proximity touches on the touchscreen. An example of the sensors for detecting touches on the touchscreen is a tactile sensor. The tactile sensor refers to a sensor capable of detecting human-sensible or greater strengths of touches of a certain object. The tactile sensor may detect various types of information, e.g., roughness of a contact surface, hardness of a contact object, and temperature of a contact point.

Another example of the sensors for detecting touches on the touchscreen is a proximity sensor.

The proximity sensor refers to a sensor capable of detecting the presence of an object approaching or in proximity of a certain detection surface by using force of an electromagnetic field or infrared light without a mechanical contact. Examples of the proximity sensor include a transmissive photoelectric sensor, direct-reflective photoelectric sensor, mirror-reflective photoelectric sensor, high-frequency oscillation-type proximity sensor, capacitive proximity sensor, magnetic proximity sensor, and infrared proximity sensor. The touch gesture of the user may include tap, touch and hold, double tap, drag, pan, flick, drag and drop, swipe, etc.

The notification module1473may generate a signal for notifying that an event of the first device1400has occurred. The notification module1473may output the notification signal in the form of a video signal via the display unit1451, in the form of an audio signal via the sound output unit1452, or in the form of a vibration signal via the vibration motor1453.

FIG. 16is a block diagram of a second device1600according to an embodiment.

As illustrated inFIG. 16, the second device1600according to an embodiment may include a communication unit1610, a processor1620, and a memory1630. However, not all illustrated elements are essential. The second device1600may include a smaller or larger number of elements.

The communication unit1610according to an embodiment receives first authentication information from the first device1400. In addition, the communication unit1610may transmit encrypted second authentication information to the first device1400.

The communication unit1610may perform communication between the first device1400and the second device1600as the encrypted second authentication information is decrypted by the first device1400.

In addition, the communication unit1610according to an embodiment may receive a first public key generated by the first device1400. Alternatively, the communication unit1610may receive identification information of the first device1400together with the first authentication information.

The communication unit1610according to an embodiment may transmit an encrypted network key to the first device1400. In addition, the communication unit1610may receive at least one secret key selected by the first device1400.

The processor1620encrypts the second authentication information based on the received first authentication information. In addition, the processor1620according to an embodiment may encrypt a second public key by using the received first public key.

The processor1620according to an embodiment may generate a secret key based on at least one of the first authentication information, the second authentication information, the identification information of the first device1400, and identification information of the second device1600. In addition, the processor1620may encrypt the network key by using the generated secret key.

The processor1620according to an embodiment may determine whether the received at least one secret key is included in a plurality of secret keys. The processor1620may establish an encrypted communication channel between the first device1400and the second device1600by using the determined secret key.

The memory1630may store programs for processing and control operations of the processor1620, and store input/output data. The memory1630according to an embodiment may store at least one encryption function and at least one input parameter used for encryption. In addition, the memory1630may store credential information shared between the first device1400and the second device1600.

The device according to the afore-described embodiments may comprise a processor, a memory for storing program data and executing it, a permanent storage such as a disk drive, a communications port for handling communications with external devices, and user interface devices, including a touch panel, keys, buttons, etc. When software modules or algorithms are involved, these software modules may be stored as program instructions or computer-readable codes executable on the processor on a computer-readable medium. Examples of the computer-readable recording medium include magnetic storage media (e.g., ROM, floppy disks, hard disks, etc.), and optical recording media (e.g., CD-ROMs, or DVDs). The computer-readable recording medium can also be distributed over network coupled computer systems so that the computer-readable code is stored and executed in a distributed fashion. This media can be read by the computer, stored in the memory, and executed by the processor.

For the purposes of promoting an understanding of the principles of the embodiments, reference has been made to the embodiments illustrated in the drawings, and specific terminology has been used to describe these embodiments. However, no limitation of the scope of the embodiments is intended by this specific terminology, and the embodiments should be construed to encompass all elements that would normally occur to one of ordinary skill in the art.

The embodiments may be described in terms of functional blocks and various routines. Such functional blocks may be realized by any number of hardware and/or software elements configured to perform the specified functions. For example, the embodiments may employ various integrated circuit elements, e.g., memory elements, processing elements, logic elements, look-up tables, and the like, which may carry out a variety of functions under the control of one or more microprocessors or other control devices. Similarly, where the elements of the embodiments are implemented using software programming or software elements, the embodiments may be implemented with any programming or scripting language such as C, C++, Java, assembler, or the like, with the various algorithms being implemented with any combination of data structures, objects, processes, routines or other programming elements. Functional aspects may be implemented in algorithms that execute on one or more processors. Furthermore, the embodiments could employ any number of conventional techniques for electronics configuration, signal processing and/or control, data processing and the like. The words “mechanism”, “element”, “means”, and “configuration” are used broadly and are not limited to mechanical or physical elements, but can include software routines in conjunction with processors, etc.