SYSTEM ACCESS USING A MOBILE DEVICE
FIG13 is a block diagram illustrating exemplary components of a mobile device and system, according to some embodiments
FIG13 is a block diagram illustrating exemplary short-range wireless (e.g., NFC) connectivity, according to some embodiments. In the illustrated embodiment, mobile device 130 includes application processor 136, which is connected to an NFC controller 1332. The NFC controller, in the illustrated embodiment, connects to the secure element 134 and controls the routing from an NFC antenna to either the secure element or the application processor 136. The application processor 136 does not need to be awake for NFC transactions, in some embodiments. In some embodiments, the system is equipped with at least two NFC readers, e.g., the illustrated door-handle reader 1330 and console reader 1335. In some embodiments, one ECU 137C controls all readers and includes software that executes the communication protocols though NFC, including various cryptographic operations discussed herein. In the illustrated embodiment, another ECU 137B controls screen output and one or more user input devices 1325. Another ECU 137A may also establish a secure channel to the system OEM backend via telematics link 1320. Note that the ECU deployment may be different for different OEMs, in various embodiments.
block diagram
210
SEP
136
AP
130
device
1330
illustrated door-handle reader
1325
user input devices
1335
console reader
134
SE
110
system
1320
backend via telematics link
1332
NFC controller
['1. An apparatus, comprising: one or more processing elements configured to: generate a first ephemeral key pair that includes a first public key and a first private key; determine a second public key generated by a system, wherein the second public key is included in a second ephemeral key pair; generate a first shared secret using a key exchange function that uses the first private key and the second public key as inputs; generate a derived shared secret using a key derivation function that uses at least the following inputs: the first shared secret, the first public key, and a public key of the system previously established during a paring session between the apparatus and the system; generate a signature by signing transaction information with a private key of the apparatus established during the pairing session; encrypt the signature and information identifying the apparatus based on the derived shared secret; verify a signed certificate received from the system using the public key of the system, wherein the certificate is signed with a corresponding private key of the system established during the pairing session; and in response to verification of the signed certificate, transmit the encrypted signature and information to the system.', '4. The apparatus of claim 1, wherein, to share access to one or more functions of the system with another device, the apparatus is configured to: receive a certificate signing request from the other device; verify the received certificate using a root certificate of a an authorized entity associated with the other device; authenticate a user of the apparatus; sign the certificate using the private key of the apparatus established during the pairing session with the system; and transmit the signed certificate to the other device.']