Patent Description:
To secure communication between, for example, a car and a smartphone of a user, symmetric session keys and corresponding session identifiers may be used as symmetrical encryption method for lock and unlock procedures. The conventional lock and unlock procedures using symmetric session keys may take several seconds due to the dilatory derivation of the symmetric session keys with conventional methods. A duration of several seconds for locking and unlocking in this application may lead to appreciable delaying for the user, which may be disturbing and may reduce the ease of use especially in situations when the user is in a hurry or carries high weight.

<CIT> describes a method in which a medical device generates a pre-master key and encrypts the pre-master key by a RSA public key that it has received from a remote device. The pre-master key is then sent from medical device to remote device. The remote device decrypts the received encrypted pre-master key using its RSA private key. Then, both the medical device and the remote device use random values exchanged in a key request message and a key response message to derive a new key, namely the master key, from the pre-master key. The generated master key can then be used as symmetric key within a symmetric-key cryptosystem to authenticate and encrypt application data that shall be communicated and exchanged between the medical device and the remote device. The devices preferably may re-use the already computed master key in one or more subsequent sessions, thereby resuming the previous session, without the need to first compute a new asymmetric key pair, exchange a public key and compute and exchange a new pre-master key, i.e., without the need for negotiating new keys.

<CIT> describes a method for pre-computing one or more keys in anticipation of using a subset of such keys for communications over a network. A communication device may establish a base key (e.g., a session key) with a network entity upon the occurrence of a triggering event (e.g., the receipt of a message from the network entity). The communication device may then pre-compute a plurality of possible keys using the base key and a plurality of possible inputs in anticipation of receiving an indicator from a network entity that identifies a selected input to be used in generating a corresponding selected key. The plurality of possible inputs may include algorithms with which to calculate security keys. During the pre-computation of the plurality of possible keys, the selected input is unknown to the communication device.

<CIT> describes car sharing system which includes a car sharing device installed in a vehicle. The car sharing device is configured to perform ID verification via an electronic key system of the vehicle in a state in which key information registered to the mobile terminal has been authenticated to allow an onboard device to be operated by the mobile terminal. The car sharing system includes a key function unit that implements a smart function to perform the ID verification through bidirectional short-range wireless communication with the electronic key system, a determination processing unit that determines whether or not a condition for permitting actuation of the smart function has been satisfied, and an actuation switching unit that validates the smart function if the condition for permitting actuation of the smart function has been satisfied.

There is a need to speed up lock and unlock procedures using symmetric session keys as symmetrical encryption method.

This need is addressed by the subject matter of the independent claims.

According to a first aspect, the present disclosure provides a method for secure communication between a first and a second communication partner. The method comprises establishing a communication link between the first and the second communication partner. The method also comprises determining one or more session identifiers by one of the first and the second communication partner for one or more subsequent secure communication sessions. The method further comprises communicating the one or more session identifiers to the other of the first and the second communication partner. The method further comprises determining, for each of the one or more session identifiers, a respective symmetric session key in each of the first and the second communication partner. The method further comprises storing the one or more session identifiers and the corresponding symmetric session keys in each of the first and the second communication partner for one or more subsequent secure communication sessions.

According to a second aspect, the present disclosure provides an apparatus for secure communication. The apparatus comprises means for establishing a communication link to another communication partner. The apparatus also comprises means for determining one or more session identifiers. The apparatus further comprises means for communicating the one or more session identifiers to the communication partner. The apparatus further comprises means for determining, for each of the one or more session identifiers, a respective symmetric session key. The apparatus further comprises means for storing the one or more session identifiers and the corresponding symmetric session keys for one or more subsequent secure communication sessions.

Embodiments of the present disclosure are based on the finding that the symmetric session keys are determined and stored with the corresponding session identifiers in each of a first and a second communication partner during a previous communication session for one or more subsequent secure communication sessions. This may lead to faster establishing the secure communication between the first and the second communication partner with the stored symmetric session key in the one or more subsequent secure communication sessions.

In some embodiments, the method may further comprise in the one or more subsequent secure communication sessions: selecting one of the stored session identifiers by one of the first and the second communication partner, communicating the selected session identifier to the other of the first and the second communication partner, using the corresponding stored symmetric session key for the one or more subsequent secure communication sessions to secure communication between the first communication partner and the second communication partner. This may enable a faster establishing of the secure communication with the stored symmetric session key and the corresponding session identifier in the one or more subsequent secure communication sessions between the first and the second communication partner.

In some embodiments, the method may further comprise in the one or more subsequent secure communication sessions: setting up a ranging procedure between the first communication partner and the second communication partner in the one or more subsequent secure communication sessions after using the stored symmetric session key to securely communicate between the first communication partner and the second communication partner. This may enable to provide a secure determination of the distance between the first and the second communication partner and to provide a function in dependence of the distance between the first and the second communication partner.

If a distance between the first and the second communication partner falls below a threshold value, an unlocking procedure may be performed by one of the first and the second communication partner. If the distance between the first and the second communication partner exceeds the threshold value, a locking procedure may be performed by one of the first and the second communication partner. In this case a user-friendly locking and unlocking procedure may be provided, which may allow a distance dependent locking and unlocking procedure. This procedure may be fast, convenient to the user and may not need a user action to start the locking and unlocking procedure.

In some embodiments, the ranging procedure may comprise determining a distance between the first and the second communication partner by measuring the time difference between a first time t1 of sending a ranging signal from one of the first and the second communication partner to the other of the first and the second communication partner and a second time t2 of receiving a response signal from the other of the first and the second communication partner. This may enable a Time-of-Flight (ToF) measurement to reliably determine the distance between the first and the second communication partner.

In at least some embodiments a (radio) beacon signal may be used as the ranging signal. The beacon signal as part of a standardized discovery method may enable a reliable wireless signal transmission.

In some embodiments, the selected session identifier may be communicated via Bluetooth Low Energy (BLE) or Ultra Wide-Band (UWB) to the other of the first and the second communication partner. This may enable an accurate, reliable and energy saving way of transmission of the selected session identifier.

In at least some embodiments the stored symmetric session key may be used to secure communication via BLE or UWB between the first communication partner and the second communication partner. This may enable an accurate, reliable and energy saving way to secure communication with the stored symmetric session key.

For example, one of the first and the second communication partner may be a car. The locking and unlocking procedure of cars may be a convenient procedure for the user, which enhance the ease of use especially in situation, when the user is in a hurry or carries high weight.

According to embodiments of the present disclosure one of the first and the second communication partner may be a portable user device. This may provide an easy and convenient way for digital car access for example Smart Access <NUM> to lock and unlock a car with a portable user device such as a smartphone or a smart wristband, for example.

In at least some embodiments, a Diffie-Hellmann based exchange may be used to determine the symmetric session key. A Diffie-Hellman based exchange is a cryptographic method using a public communication link and is used to securely determine symmetric session keys. In this case, a reliable cryptographic key derivation function may be used for the determination of the symmetric session keys. By using a Diffie-Hellmann based exchange, the symmetric session keys may be securely exchanged over a public channel.

In some embodiments, the apparatus may comprise means for selecting one of the stored session identifiers. The apparatus may further comprise means for communicate the selected session identifier to the communication partner. The apparatus may further comprise means for using the corresponding stored symmetric session key for the one or more subsequent secure communication sessions to secure communication with the communication partner. This may enable a faster establishing of the secure communication with the stored symmetric session key and the corresponding session identifier in the one or more subsequent secure communication sessions between the first and the second communication partner.

Some examples of methods and/or apparatuses will be described in the following by way of example only, and with reference to the accompanying figures, in which.

<FIG> shows a flow chart of a conventional method <NUM> for secure communication between a first and a second communication partner. The method <NUM> comprises generating <NUM> a session identifier by one of the first or the second communication partner. The session identifier may be for example a random session identifier. The method <NUM> further comprises establishing a communication link between the first and the second communication partner and communicating <NUM> the session identifiers to the other of the first and the second communication partner. The method <NUM> further comprises determining <NUM>, for the session identifier, a respective symmetric session key by performing a protocol in each of the first and the second communication partner. The method <NUM> further comprises initiating <NUM> a ranging procedure between the first communication partner and the second communication partner using the symmetric session key to securely communicate via Ultra Wide-Band between the first communication partner and the second communication partner.

In the conventional method <NUM>, the symmetric session key and the session identifier are determined and used in each secure communication session to secure communication between the first communication partner and the second communication partner. This conventional method <NUM> may take several seconds due to the dilatory derivation of the symmetric session keys during each secure communication session. The symmetric session keys may also called symmetric shared secrets.

<FIG> shows a flow chart of a method <NUM> for secure communication between a first and a second communication partner according to a first embodiment of the present disclosure. The method <NUM> comprises establishing <NUM> a communication link between the first and the second communication partner. The method <NUM> further comprises determining <NUM> one or more session identifiers by one of the first and the second communication partner. The session identifier may, e.g., be determined randomly or by sequential numbering and be used to identify a secure session communication unambiguously. Also a set of session identifiers may be determined for a set of subsequent secure communication sessions. The method <NUM> further comprises communicating <NUM> the one or more session identifiers to the other of the first and the second communication partner. The selected session identifier may, e.g., be communicated via BLE or UWB to the other of the first and the second communication partner. However, also other communication techniques may be used. The method further comprises determining <NUM>, for each of the one or more session identifiers, a respective symmetric session key in each of the first and the second communication partner. The symmetric session key may be a single-use symmetric key used for encryption and decryption. The symmetric key may be determined using a key derivation function. For example, the symmetric session key may be determined with a Diffie-Hellmann based exchange. An authentication protocol may be used, which verifies the first and second communication partner and on success a symmetric session key is derived. The method <NUM> further comprises storing <NUM> the one or more session identifiers and the corresponding symmetric session keys in each of the first and the second communication partner for one or more subsequent (future, new) secure communication sessions. This pre-derivation of symmetric session keys for future sessions differs from the conventional method <NUM>. This step can be done at any point in time during a running session after a connection has been set up. Usually this is done after the performance critical operations have been performed. Thereby, the performance critical steps have been moved from the start of the session to any point in time during an earlier session. This assures minimum latency for the availability of the secure session between a first and a second system application after establishment of the connection between the first and the second communication partner. A secure communication session is a temporary and secured information exchange session by exchanging public/private key pairs between the first and the second communication partner.

The method <NUM> according to the first embodiment of the present disclosure differs from the conventional method <NUM> in that the one or more session identifiers and the corresponding symmetric session keys are determined and stored in each of the first and the second communication partner during a communication session for one or more subsequent secure communication sessions. By using the stored symmetric session key, secure communication between the first and the second communication partner may be established faster in the one or more subsequent secure communication sessions.

<FIG> shows a method <NUM> for secure communication between a first communication partner <NUM> and a second communication partner <NUM> according to a second embodiment of the present disclosure. The method <NUM> according to the second embodiment of the present disclosure comprises the following steps, which are equal to the steps of the method <NUM> according to the first embodiment of the present disclosure. The method <NUM> comprises establishing <NUM> a communication link between the first and the second communication partner. The method <NUM> further comprises determining <NUM> one or more session identifiers by one of the first and the second communication partner. The method further comprises communicating <NUM> the one or more session identifiers to the other of the first and the second communication partner. In the example of <FIG>, the first communication partner <NUM> communicates <NUM> the selected session identifier to the second communication partner <NUM>. The method further comprises redeeming <NUM>, <NUM> the session identifier and a corresponding symmetric session key stored in a previous secure communication session. The method <NUM> further comprises initiating <NUM> UWB distance bounding using the stored one or more symmetric session key, additionally the corresponding session identifier may be used. Distance bonding proves that the first and second communication partner are in proximity. Alternatively, the method <NUM> may further comprise initiating <NUM> via BLE or similar means. The method <NUM> further comprises generating a session identifier by selecting <NUM> one of the stored session identifiers by one of the first and the second communication partner. In the example of <FIG>, the first communication partner <NUM> generates <NUM> one of the session identifiers. The method <NUM> further comprises communicating the selected session identifier to the other of the first <NUM> and the second communication partner <NUM>. The method <NUM> further comprises determining <NUM>, for each of the one or more session identifiers, a respective symmetric session key in each of the first and the second communication partner. The first communication partner <NUM> and the second communication partner <NUM> perform a protocol to derive the stored symmetric session key bound to the session identifier. The method further comprises storing <NUM> the one or more session identifiers and the corresponding symmetric session keys in each of the first and the second communication partner for one or more subsequent secure communication sessions for example by persisting on the session identifier and the corresponding stored symmetric session key. The corresponding stored symmetric session key is used in the first and the second communication partner for the one or more subsequent secure communication sessions to secure communication between the first communication partner and the second communication partner.

The method <NUM> according to the second embodiment of the present disclosure further comprises the following steps performed in one or more subsequent secure communication session. The method may further comprise in the one or more subsequent secure communication session selecting one of the stored session identifiers by one of the first <NUM> and the second communication partner <NUM>. The session identifier may be selected randomly for example. The method may further comprise communicating the selected session identifier to the other of the first <NUM> and the second communication partner <NUM>. For example, the first communication partner <NUM> may communicate the selected session identifier to the second communication partner <NUM>. The method may further comprise using the corresponding stored symmetric session key for the one or more sub-sequent secure communication sessions to secure communication between the first communication partner <NUM> and the second communication partner <NUM>. The stored symmetric session key may be used to secure communication via BLE (for example according to the standard IEEE <NUM>. 4z of the Institute of Electrical and Electronics Engineers, IEEE), or UWB between the first communication partner <NUM> and the second communication partner <NUM>. UWB is a radio technology that uses extremely large frequency ranges with a bandwidth of at least <NUM> or of at least <NUM> % of the arithmetic mean of the lower and upper cut-off frequency of the used frequency band.

The method may further comprise setting up a ranging procedure, as shown in <FIG>, for determining a distance between the first communication partner <NUM> and the second communication partner <NUM> in the one or more subsequent secure communication sessions after using the stored symmetric session key to securely communicate between the first communication partner <NUM> and the second communication partner <NUM>. The ranging may be only successful, if the same symmetric session key is used from the first and second communication partner.

The method may be applied to a locking procedure and/or a unlocking procedure by one of the first communication partner <NUM> and the second communication partner <NUM>. The method may further comprise performing the unlocking procedure by one of the first communication partner <NUM> and the second communication partner <NUM>, if a distance between the first communication partner <NUM> and the second communication partner <NUM> falls below a threshold value. The method may further comprise performing the locking procedure by one of the first communication partner <NUM> and the second communication partner <NUM>, if the distance between the first communication partner <NUM> and the second communication partner <NUM> exceeds the threshold value. The threshold value may be in the range of <NUM> and <NUM>, especially <NUM>.

The first communication partner <NUM> may be a vehicle, a movable element for closing an opening, or a locking element. The vehicle may, e.g., be a car, a bicycle, a truck or a motorbike. The vehicle may comprise the movable element for closing the opening and/or the locking element. The movable element for closing the opening may be a door, especially a front door of a housing or a vehicle door. The movable element for closing the opening may comprise the locking element. The locking element may, e.g., be a lock of the vehicle or the movable element for closing the opening. The locking element may be constructed to allow or to deny access to an object (e.g. a vehicle) or a special area.

The second communication partner <NUM> may be a portable user device such as a smartphone, a tablet, a smart wristband or similar means.

<FIG> shows a flow chart of an exemplary method <NUM> for determining a distance between the first communication partner <NUM> and the second communication partner <NUM> in a ranging procedure using a ToF measurement according to the present disclosure. The basic concept of the ToF measurement may be to calculate the distance between the first communication partner <NUM> and the second communication partner <NUM> by determining the ToF of a ranging signal and a response signal travelling between the first communication partner <NUM> and the second communication partner <NUM>. The ranging procedure may comprise two way ranging using the ranging signal <NUM> from one of the first communication partner <NUM> and the second communication partner <NUM> to the other of the first communication partner <NUM> and the second communication partner <NUM> and the response signal <NUM> from the other of the first communication partner <NUM> and the second communication partner <NUM> to the one of the first communication partner <NUM> and the second communication partner <NUM>. The distance D may be determined by measuring the time difference between a first time t1 of sending the ranging signal <NUM> from one of the first communication partner <NUM> and the second communication partner <NUM> to the other of the first communication partner <NUM> and the second communication partner <NUM> and a second time t2 of receiving the response signal <NUM> from the other of the first communication partner <NUM> and the second communication partner <NUM>. Both the first time t1 and the second time t2 are measured with a clock associated to the one of the first communication partner <NUM> and the second communication partner <NUM> sending the ranging signal <NUM>. The TOF may be determined according to the following equation: <MAT> with tresponse denoting the response time for sending the response signal <NUM> from the other of the first communication partner <NUM> and the second communication partner <NUM> after receipt of the ranging signal <NUM>.

With the assumption that the speed of the ranging signal <NUM> and the response signal <NUM> through air is equal to the speed of light c, the distance D between the first communication partner <NUM> and the second communication partner <NUM> may be calculated according to the following equation: <MAT>.

A beacon signal may be used as the ranging signal <NUM> and/or as the response signal <NUM>. The beacon signal may be a wireless signal and one of a radio, an ultrasonic, an optical, a laser or other type of signal.

<FIG> shows a block diagram of a first apparatus <NUM> of a first communication partner according to a first embodiment of the present disclosure. The first apparatus <NUM> for a secure communication comprises means (circuitry) <NUM> for establishing a communication link to another communication partner. Examples for means <NUM> for establishing a communication link to another communication partner may be an interface such as a BLE interface, an UWB interface or similar means.

The first apparatus <NUM> further comprises means (circuitry) <NUM> for determining one or more session identifiers. Means <NUM> for determining one or more session identifiers may be for example a first system application running on a processing circuit of the first apparatus <NUM>, or similar means. The first system application may be able to store, access data and execute applications. The first system application may comprise an interface, a programming logic and a database. The interface may be configured to exchange data electronically with other applications. The programming logic may comprise one or more computer programs, scripts or other type of computer instructions. The database may be a repository of data that may be used to store data in a structured format.

The first apparatus <NUM> further comprises means (circuitry) <NUM> for communicating the one or more session identifiers to the communication partner. Examples for means <NUM> for communicating the one or more session identifiers to the communication partner may be an interface for BLE, an interface for UWB or an interface for another communication technique.

The first apparatus <NUM> further comprises means (circuitry) <NUM> for determining, for each of the one or more session identifiers, a respective symmetric session key. The means <NUM> for determining, for each of the one or more session identifiers, a respective symmetric session key may be for example a first secure environment application running on the processing circuit or similar means. The first secure environment application may comprise an interface, a programming logic and a database.

The first apparatus <NUM> further comprises means (circuitry) <NUM> for storing the one or more session identifiers and the corresponding symmetric session keys for one or more subsequent secure communication sessions. Examples for means <NUM> for storing the one or more session identifiers and the corresponding symmetric session keys for one or more subsequent secure communication sessions may be a non-volatile storage such as flash memory, hard disk drive, ferroelectric random-access memory or similar means. The one or more session identifiers and the corresponding symmetric session keys for one or more subsequent secure communication sessions may be stored inside the first secure environment application, which may be used to protect data, in the non-volatile storage.

Furthermore, the first apparatus <NUM> may comprise means for selecting one of the stored session identifiers. The first apparatus <NUM> may comprise further means for communicating the selected session identifier to the communication partner. The first apparatus <NUM> may comprise further means for using the corresponding stored symmetric session key for the one or more subsequent secure communication sessions to secure communication with the communication partner.

Further details of the various means of the first apparatus <NUM> are described above with respect to the proposed method for secure communication.

A second apparatus of a second communication partner may be configured and constructed analogously to the first apparatus <NUM>.

<FIG> shows a block diagram of a first apparatus <NUM> of a first communication partner and a second apparatus <NUM> of a second communication partner according to a second embodiment of the present disclosure. The first apparatus <NUM> comprises a first system application <NUM>. The first system application <NUM> may comprise an interface, a programming logic and a database. The first system application <NUM> may be configured to select one of the stored session identifiers and store the session identifiers. The first system application <NUM> may be used to retrieve the corresponding stored symmetric session key for the one or more subsequent secure communication sessions to secure communication with the communication partner using the stored session identifier.

The first apparatus <NUM> comprises further a first secure element <NUM> for example a processing circuit. The first secure element <NUM> comprises a first secure environment application <NUM>. The first secure element <NUM> may be able to securely store, access data and execute applications. The first secure element <NUM> may be for example a secure environment. The first secure environment application <NUM> may comprise an interface, a programming logic and a database. The first secure environment application <NUM> may be used to establish a communication link to the second communication partner. Furthermore, the first secure environment application <NUM> may be used to derive the corresponding stored symmetric session key using a key derivation function. The symmetric session keys are derived using a symmetric information from the initialization of the trust relationship and a random, session specific information, bound to the corresponding session identifiers, which is shared via a first public communication link <NUM> as a secure communications link. The first secure environment application <NUM> may store the session identifier and the corresponding stored symmetric session key for the one or more subsequent secure communication sessions to secure communication with the communication partner. These symmetric session keys are also called pre-derived session keys. The pre-derived session keys may be derived from static and random information shared between the first and a second secure environment application on demand. The pre-derived session keys may be used to secure communication between system level applications between the first and the second communication partner.

The first apparatus <NUM> comprises further a first private communication link <NUM>, which connects the first system application <NUM> and the first secure environment application <NUM>. The first private communication link <NUM> may be a wireless communication link. The first private communication link <NUM> may be used to retrieve the symmetric session key using the stored session identifier by the first system application <NUM> from the first secure environment application <NUM>.

The second apparatus <NUM> for a secure communication may be constructed just like the first apparatus <NUM>, described above. The second apparatus <NUM> comprises a second system application <NUM> and a second secure element <NUM>. The second secure element <NUM> comprises the second secure environment application <NUM>. The second apparatus <NUM> further comprises a second private communication link <NUM>, which connects the second system application <NUM> and the second secure environment application <NUM>.

Hereby, the second system application <NUM> may be configured just like the first system application <NUM>. Further the second secure element <NUM> may be constructed just like the first secure element <NUM>. The second secure environment application <NUM> may be configured just like the first secure environment application <NUM>. The second private communication link <NUM> may be constructed just like the first private communication link <NUM>.

The selected session identifier may be communicated to the communication partner via the first public communication link <NUM> between the first apparatus <NUM> and the second apparatus <NUM>.

Furthermore, the corresponding stored symmetric session key for the one or more subsequent secure communication sessions may be used to secure communication between the first apparatus <NUM> and the second apparatus <NUM> via the first public communication link <NUM>. The first system application <NUM> and the second system application <NUM> may be used to secure communication via the first public communication link <NUM>.

Alternatively, the corresponding stored symmetric session key may be used to secure communication via a second public communication link <NUM> between the first apparatus <NUM> and the second apparatus <NUM>. The first system application <NUM> and the second system application <NUM> may be used to secure communication via the second public communication link <NUM>. The second public communication link <NUM> may be a different wireless communication link than the first public communication link <NUM>. The first public communication link <NUM> and the second public communication link <NUM> may use different technologies such as UWB and BLE. Alternatively, the same technology may be used for the first public communication link <NUM> and the second public communication link <NUM>, but the first <NUM> and the second public communication link <NUM> may differ in at least one other quantity (for example, a used frequency band).

Furthermore, in further examples, a single step, function, process or operation may include and/or be broken up into several sub-steps, - functions, -processes or -operations.

Claim 1:
A method for secure communication between a first (<NUM>) and a second communication partner (<NUM>), comprising
establishing (<NUM>, <NUM>) a communication link between the first (<NUM>) and the second communication partner (<NUM>);
determining (<NUM>, <NUM>) one or more session identifiers by one of the first (<NUM>) and the second communication partner (<NUM>) for one or more subsequent new secure communication sessions;
communicating (<NUM>, <NUM>) the one or more session identifiers to the other of the first (<NUM>) and the second communication partner (<NUM>);
determining (<NUM>, <NUM>), for each of the one or more session identifiers, a respective session-specific symmetric session key bound to the corresponding session identifiers in each of the first (<NUM>) and the second communication partner (<NUM>); and
storing (<NUM>, <NUM>) the one or more session identifiers and the corresponding session-specific symmetric session keys in each of the first (<NUM>) and the second communication partner (<NUM>) for one or more subsequent new secure communication sessions.