Koninklijke Philips Corporation N.v.

Signify Holding B.v.

Philips Lighting Holding B.v.

Johannes Arnoldus Cornelis Bernsen

Walter Dees

Franciscus Antonius Maria Van De Laar

Ronald Felix Albertus Linders

Antonius Adriaan Maria Staring

Maurice Herman Johan Draaijer

Koen Johanna Guillaume Holtman

Wilhelmus Franciscus Johannes Fontijn

Emmanuel David Lucas Michael Frimout

Menno Anne Treffers

Oscar Garcia Morchon

Dennis Van De Meulenhof

Franciscus A Van De Laar

Wilhelmus Fransiscus Johannes Fontijn

Saeed Sedghi

Charles Leonardus Corenlius Maria Knibbeler

A wireless communication system comprises a host device () and mobile devices () arranged for wireless communication and for distance () measurement. The host device has a user interface () comprising a connect button (), and is arranged to execute a connection sequence upon a user activating the connect button. The connection sequence first determines respective distances between the host and respective mobile devices. A first mobile device is identified exhibiting a movement. Then a connection action is executed regarding a connection between the first mobile device and the host device. The mobile device is arranged for executing a ranging protocol and, upon subsequently receiving a connection message, executing a connection action regarding a connection between the first mobile device and the host device. Effectively a connection may be established upon the user of a mobile device pressing a single button on a selected host device and moving the mobile device.

Wireless communication system

The present invention relates to a multiple application QR code capable of storing information of a plurality of applications in such a way that a respective information can be retrieved for each application in a reliable and time-efficient manner. The information is encoded into encoded data including at least a header and a respective data container per application. The header can comprise at least a single identifier indicating a presence of the plurality of applications and a respective application identifier per application. The encoded data are distributedly stored in a plurality of data pixels distributed over an encoding region of the QR code, according to an allocation rule. A QR code reader can retrieve the information stored in the QR code by only accessing and processing the data pixels associated with the respective application of interest and by using an error correction which is specific to this respective application.

Multiple application QR code

A non-SI device is arranged for wireless communication and cooperates with an SI device having access to a subscriber identity. The non-SI device has a transceiver to communicate in a local network and a processor to establish an association with the SI. A non-SI public key is provided to the SI device via a first communication channel. A verification code is shared with the SI device via a second communication channel. The channels are different and include an out-of-band channel. Proof of possession of a non-SI private key is provided to the SI device via the first or the second communication channel. From the SI device, a certificate is received that is related to the SI and comprises a signature computed over at least part of the non-SI public key. The certificate reliably enables the non-SI device to access the core network via the local network and a gateway between the local network and the core network.

Non-3GPP device access to core network

A wireless communication system enables one-sided authentication of a responder device () by an initiator device () and mutual authentication of both devices. Embodiments of the initiator may have a message unit () and a state machine (). The initiator starts by acquiring a responder public key via an out-of-band action and sends an authentication request. The responder sends an authentication response comprising responder authentication data based on a responder private key and a mutual progress status indicative of the mutual authentication being in progress for enabling the responder device to acquire an initiator public key via a responder out-of-band action. The initiator state machine is arranged to provide a mutual authenticating state, engaged upon receiving the mutual progress status, for awaiting mutual authentication. Thereby long time-out periods during wireless communication are avoided, while also enabling the initiator to report communication errors to the user within a short time.

Mutual authentication system

A device is arranged for encrypting input data and protecting integrity of the input data and associated data. An encryption processor has a first hash unit arranged to compute an integrity value based on the input data, a second hash unit arranged to compute an initialization vector based on the integrity value and associated data, producing an initialization vector that is different from the integrity value. At least one of the hash units may be a keyed hash unit. An encryption unit is arranged for encrypting the input data to generate encrypted data using the initialization vector and an encryption key. As the initialization vector depends on both the integrity value and the associated data, any change therein will result in failure of the decryption and decrypted data that are substantially different from the original input data.

Data encryption and integrity verification

A device is arranged for distance measurement according to a ranging protocol using a measurement message from a second device. Based on a first arrival time of the measurement message a first distance () between the first device () and the second device () is determined. A third device () acts as a cooperating device that is located at a trusted distance (). The cooperating device determines a third arrival time of the same measurement message, and transfers support data to the first device, the support data being based on the third arrival time. The first device obtains a third distance () between the third device and the second device using the support data. Then a verification test is performed on the first distance (), the trusted distance () and the third distance (). The first distance is reliable when said distances correspond to a viable spatial constellation () of the devices.

System for trusted distance measurement

A device is arranged for determining a first distance according to a ranging protocol using a measurement message from a second device. A cooperating device () has a directional antenna () and is located at a trusted distance () sharing a connecting direction () with the first device. The cooperating device determines a third direction of the same measurement message, and transfers support data to the first device based on the third direction. The first device first determines a first angle () between the first direction and the connecting direction and obtains a third angle () between the third direction and the connecting direction using the support data. Then a verification test is performed on the first distance (), the trusted distance (), the first and the third angle. The first distance is reliable when said distances and angles correspond to a viable spatial constellation () of the devices.

Thus there is provided a method and appropriately arranged devices for configuring for communications in a wireless network comprising performing a configuration protocol, and sending by the enrollee device, during an execution of the configuration protocol, a message containing an indication of a status of a previous configuration attempt. A configuring device receiving the status of the previous configuration attempt is then able to act upon it and inform the user that a previous attempt failed. The information provided to the user would allow the user to understand why the device fails to connect to the desired network and perhaps alert them to the fact that it has not connected.

Previous connection status report

A non-SI device () is arranged for wireless communication () and cooperates with an SI device () having access to a subscriber identity. The non-SI device has a transceiver () to communicate in a local network and a processor () to establish an association with the SI. A non-SI public key is provided to the SI device via a first communication channel. A verification code is shared with the SI device via a second communication channel. The channels are different and include an out-of-band channel (). Proof of possession of a non-SI private key is provided to the SI device via the first or the second communication channel. From the SI device, security data is received that is related to the SI and is computed using the non-SI public key. The security data reliably enables the non-SI device to access the core network via the local network and a gateway between the local network and the core network.

This application relates to devices and methods of authenticating messages exchanged over a network between a transmitter and a receiver. The transmitter generates a truncated MAC code by selecting predetermined bits from a message authentication code (MAC) computed over a concatenation of a part of the message with a part of a previously transmitted message. The transmitter appends the truncated MAC code to the message for transmission. The receiver receives a previously transmitted message, the currently transmitted message, and the truncated MAC code, and generates an expected truncated MAC code by selecting predetermined bits from a message authentication code (MAC) computed over a concatenation of the part of the message with the previously transmitted message. The receiver authenticates the message and the previously transmitted message if the truncated MAC code as received is identical to the expected truncated MAC code.

Methods and devices for providing message authentication code suitable for short messages

A non-SI device () is arranged for wireless communication () and cooperates with an SI device () having access to a subscriber identity. The non-SI device has a transceiver () to communicate in a local network and a processor () to establish an association with the SI. A non-SI public key is provided to the SI device via a first communication channel. A verification code is shared with the SI device via a second communication channel. The channels are different and include an out-of-band channel (). Proof of possession of a non-SI private key is provided to the SI device via the first or the second communication channel. From the SI device, a certificate is received that is related to the SI and comprises a signature computed over at least part of the non-SI public key. The certificate reliably enables the non-SI device to access the core network via the local network and a gateway between the local network and the core network.

In a network system for wireless communication an enrollee accesses the network via a configurator. The enrollee acquires a data pattern that represents a network public key via an out-of-band channel by a sensor. The enrollee derives a first shared key based on the network public key and the first enrollee private key, and encodes a second enrollee public key using the first shared key, and generates a network access request. The configurator also derives the first shared key, and verifies whether the encoded second enrollee public key was encoded by the first shared key, and, if so, generates security data and cryptographically protects data using a second shared key, and generates a network access message. The enrollee processor also derives the second shared key and verifies whether the data was cryptographically protected and, if so, engages the secure communication based on the second enrollee private key and the security data.

Network system for secure communication

This application relates to devices and a method to establish a secure wireless link for communication between a first and a second device over a wireless physical channel, wherein a paring protocol requires sending over the wireless channel identifying information by the first device, identifying information being data suitable for identifying the device sending the identifying information or a user thereof wherein the first device encrypts and transmits the identifying information by using a public key information of the second device and random information, the second device receives the encrypted identifying information and using private key information associated with the public key information it extracts the identifying information. The devices use a secret uniquely related to the identifying information to derive a session key and then use the session key to establish the secure wireless link. For example, the wireless channel is Wi-Fi, the identifying information is an identifier for a password or passphrase and the secret is the password or passphrase and the authentication method is simultaneous authentication of equals (SAE). Alternatively the pairing protocol is DPP and the identifying information is a part of the DPP Connector. The public key information can be transmitted in a Beacon, DMG Beacon, Probe Response, Announce, or Information Response frame or be configured in the first device by a DPP Configurator using the DPP protocol adapted for transferring the public key information as part of the DPP Configuration response message.

Method and device to establish a wireless secure link while maintaining privacy against tracking

A device () arranged for wireless communication () has a processor () to execute a handover sequence to establish a new connection with a further device (). A handover request message has a protocol indication indicating one or more alternative communication protocols that are supported by the requester and a channel indication indicating at least one channel to be used for a new connection. Upon receiving a first handover request message including an initial protocol indication and an initial channel indication, it is determined whether the new connection is to be established based on the initial protocol indication and via a selected channel based on the initial channel indication. If not so, the processor determines a second protocol indication and a second channel indication indicating at least one further channel to be used for the new connection and sends a second handover request message. Effectively the role of handover requester and handover selector are switched.

Growing community of inventors

Eindhoven, Netherlands

Johannes Arnoldus Cornelis Bernsen