SYSTEM ACCESS USING A MOBILE DEVICE
FIG1C is a block diagram illustrating exemplary communications to grant authorization to another mobile device to control an control unit, according to some embodiments
FIG1C is a block diagram illustrating exemplary communications to grant authorization to another mobile device 160 to control unit 137. This may allow a user of a paired device to grant access to one or more other devices, e.g., of friends or family members. In the illustrated embodiment, SE 134 sends an authorization grant 165 (which may include a signed certificate, for example) to mobile device 160 that enables system 110 to confirm that mobile device 160 received authorization from mobile device 130, based on authentication communications 170. In the illustrated embodiment, mobile device 160 sends an authorization request 162, which may include a key to be signed by the SE 134.
block diagram
160
device
136
AP
130
device
162
authorization request
134
SE
137
control unit
132
wireless interface
110
system
165
authorization grant
['1. An apparatus, comprising: one or more processing elements configured to: generate a first ephemeral key pair that includes a first public key and a first private key; determine a second public key generated by a system, wherein the second public key is included in a second ephemeral key pair; generate a first shared secret using a key exchange function that uses the first private key and the second public key as inputs; generate a derived shared secret using a key derivation function that uses at least the following inputs: the first shared secret, the first public key, and a public key of the system previously established during a paring session between the apparatus and the system; generate a signature by signing transaction information with a private key of the apparatus established during the pairing session; encrypt the signature and information identifying the apparatus based on the derived shared secret; verify a signed certificate received from the system using the public key of the system, wherein the certificate is signed with a corresponding private key of the system established during the pairing session; and in response to verification of the signed certificate, transmit the encrypted signature and information to the system.', '4. The apparatus of claim 1, wherein, to share access to one or more functions of the system with another device, the apparatus is configured to: receive a certificate signing request from the other device; verify the received certificate using a root certificate of a an authorized entity associated with the other device; authenticate a user of the apparatus; sign the certificate using the private key of the apparatus established during the pairing session with the system; and transmit the signed certificate to the other device.']