Wireless communication

0001Modern electronic devices are often equipped with wireless communication hardware that allows them to communicate with other devices using a variety of communication protocols including Bluetooth®, WiFi, and ZigBee®. Another technology becoming ever more present in such devices is near-field communication (NFC), which allows short range communication between devices when they are brought into close proximity to one another, usually of the order of ten centimetres or less.

0002Wireless communications systems require establishing a connection between two or more compatible devices over a carrier (e.g. Bluetooth®), and may be open (i.e. a device need merely request connection with another device for a connection to be established) but are more often subject to authentication, requiring a password or a key. It is also possible that different levels of access exist such that different features provided by the carrier can be enabled or disabled.

0003<patcit id="pcit0001" dnum="US2014295754A"><text>US 2014/295754</text></patcit> discloses a wireless flash drive which may use a NFC radio link with a second device to establish a second, non-NFC radio link with the second device. The non-NFC link may then be used to transfer data between the second device and memory of the flash drive.

0004<patcit id="pcit0002" dnum="US2014127992A"><text>US 2014/127992</text></patcit> discloses a configuration for determining at a first computing device if a second computing device is within a predetermined distance, then establishing at the first computing device a wireless near field communication (NFC) connection with the second computing device. The information necessary for configuring a wireless tethering connection with the second computing device is then transmitted over the wireless NFC connection.

0005Disclosed herein is a method of transferring data between a first device and a second device comprising: <ul id="ul0001" list-style="none" compact="compact"><li>bringing a first object into an activation zone of a near-field communication module so as thereby to establish a near-field communication link between said module and said first object;</li><li>said near-field communication module sending a control signal to at least one of said first and second device to begin a second communication session through a second, different channel between said first and second devices;</li><li>transferring said data between said first device and said second device in said second communication session; and</li><li>ending said second communication session if said first object is removed from said activation zone.</li></ul>

0006Beginning the second communication session could comprise starting to communicate over the second channel. Equally however, it could comprise replacing or supplementing an existing communication session on the second channel. However the Applicant has also appreciated that an analogous approach could be used to alter an existing communication session. When viewed from a first aspect, the present invention provides a method of transferring data between a first device and a second device comprising: <ul id="ul0002" list-style="none" compact="compact"><li>bringing a first object into an activation zone of a near-field communication module so as thereby to establish a near-field communication link between said module and said first object;</li><li>said near-field communication module sending a control signal to at least one of said first and second device to change a second communication session through a second, different channel between said first and second devices from a first existing state to a second existing state;</li><li>transferring said data between said first device and said second device in said second communication session; and</li><li>changing said second communication session from the second existing state to the first existing state if said first object is removed from said activation zone.</li></ul>

0007The invention is hence defined by the subject matter of the appended independent claims. Preferred embodiments are defined by the subject matter of the dependent claims. In some sets of embodiments of the invention, an output power associated with said second communication session is adjusted according to a sensed proximity between said first object and said near-field communication module. This advantageous arrangement provides a method of increasing or decreasing the output power associated with the second communication session between the first and second devices, depending on the proximity between the first object and the NFC module. This can help ensure optimum power is used and thus save power. Another variable associated with a communication session is data transfer rate. In some sets of embodiments a data transfer rate associated with said second communication session is adjusted according to a sensed proximity between said first object and said near-field communication module. When the first object is brought into close proximity with the NFC module, the rate at which data is sent between the first and second devices via the second communication session can be increased or decreased as required. This advantageous arrangement allows, by way of example only, transfer of data between said first and second devices to be performed at a higher rate if the first object is proximate to the NFC module, which may indicate that the first and second devices are physically arranged in such a way that they can support a faster connection than would otherwise be the norm.

0008Once the first object is within the activation zone of the near-field communication module, it is desirable to poll the first object to verify its presence. In some sets of embodiments a status check signal is sent on said near-field communication link to confirm that said first object is within the activation zone of said near-field communication module. In some sets of embodiments the status check signal is sent periodically. The first object might have been removed since initially entering the activation zone, and thus this particular arrangement provides a method of checking for such events so that the second communication session can be ended or altered as required.

0009In some situations, devices can connect to one another via a communication session so long as they both support the appropriate technology and protocols. In some sets of embodiments, a compatibility check signal is sent on said near-field communication link to confirm that said first and second devices support said second, different channel.

0010In some sets of embodiments an object identity check signal is sent on said near-field communication link to confirm the identity of said first object. By confirming the identity of the first object, an additional level of protection is afforded to the devices. It may also be advantageous to check the identity at later points in time to ensure the object is still what it claims to be and thus in some sets of embodiments an object identity check signal is sent on said near-field communication link to confirm the identity of said first object while the second communication channel is active.

0011Similarly to checking the identity of the object as discussed above, it may also be advantageous for the object to confirm the identity of the NFC module the object is to communicate with. It is also advantageous to check the identity at later points in time to ensure the NFC module is still what it claims to be and thus in some sets of embodiments an NFC identity check signal is sent on said near-field communication link to confirm the identity of said near field communication module while the second communication channel is active.

0012In some sets of embodiments said second communication session has a greater level of security than other communication links on said second channel. By ensuring that the object is proximate to the NFC module, functions available on the second communication session that require an increased level of security can be enabled as it is physically more difficult for a malicious entity to gain access to the second communication session.

0013The connection session on the second, different channel may be open, permitting unrestricted access to third parties. However, in some sets of embodiments said second communication session comprises an encrypted connection between said first and second devices. The separate NFC communication session is advantageously used to securely exchange parameters necessary to establish an encrypted connection between the two devices. In some sets of embodiments, the encrypted connection utilises an Advanced Encryption Standard (AES) cipher. In some further sets of embodiments, the AES cipher comprises a stream cipher. In some embodiments, the AES cipher is operated in a counter mode. In some embodiments, the encrypted connection comprises a cipher block chaining message authentication code (CBC-MAC). Combining the counter mode of operation provided by AES and a CBC-MAC is commonly referred to in the art as a "counter with CBC-MAC" or "CCM" mode. In order to initiate encrypted communications using AES-CCM, the devices must exchange both Session Key Diversifier (SKDm, SKDs) parameters and Initialization Vectors (IVm, IVs).

0014The protocol for achieving the AES-CCM enabled communications involves first initiating a pairing request in both directions over the second, different channel before performing a confirm value exchange via the second, different channel, and finally performing a random value exchange via NFC. The random values are exchanged via NFC because the specific transaction keys (STK) used by the second, different channel typically utilise said random values and thus transmitting them via the channel on which they are to be used is not secure.

0015Establishing an encrypted connection between devices typically involves a challenger device issuing a challenge to a responder device and requiring a predetermined response to be sent back by the responder device before any connection will be permitted. In some sets of embodiments one or more challenge-response parameters are automatically sent over either of said first or second communication channels.

0016The responses sent from the responder device to the challenger device could be sent over the second, different channel. In some sets of embodiments a near-field communication link is utilised to transfer a response to a challenge initiated on said second communication session. By sending the response over the near-field communication link, it is more difficult for third parties to eavesdrop and recover the response which could lead to reduced security.

0017Encrypted communication between devices typically requires said devices to share a secret key in order to prevent third parties from being able to access the content of data transferred via the encrypted connection. In some sets of embodiments of the invention, the method comprises generating a first encryption key. Once this encryption key is generated, it can be used to encrypt and decrypt data transferred over the encrypted connection. A person skilled in the art will appreciate that this encryption key need not be a single key and may comprise private and public key pairs for use in public key encryption schemes known in the art <i>per se.</i>

0018Once the encryption key(s) are generated, they can be used to encrypt and decrypt all communication between the devices from that point onwards. However, in some sets of embodiments the method comprises transferring further encryption keys over said encrypted connection. In some sets of embodiments said further encryption keys are transferred periodically. In some sets of embodiments said further encryption keys are transferred upon request. While further keys might be used for different purposes, changing the active key(s) for a particular encrypted communication link at future intervals improves security by ensuring no particular key is used for extended periods of time.

0019While the first object may be a standalone object such as a token or key fob, in some sets of embodiments said first device comprises said first object.

0020Similarly to the embodiments outlined above, the near-field communication module may be a standalone device that enables communications between the first and second devices. However, in some sets of embodiments said second device comprises said near-field communication module. The first device could, for example, be a tablet, smartphone, or watch having NFC compatibility.

0021In preferred embodiments, said second channel is wireless. In particularly preferred embodiments, said second channel is one selected from the group comprising: Bluetooth®, Bluetooth® Low Energy, wireless local area network and ZigBee®.

0022When viewed from a further aspect, the present invention extends to a system comprising a first device and a second device arranged as recited by claim 14.

0023When viewed from a further aspect, the present invention extends to a near-field communication module arranged as recited by claim 15.

0024Certain embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings in which: <ul id="ul0003" list-style="none" compact="compact"><li><figref idref="f0001">Fig. 1</figref> shows an arrangement described for reference purposes only wherein two devices communicate via NFC to establish a second communication session via a wireless channel;</li><li><figref idref="f0002">Fig. 2</figref> shows an arrangement described for reference purposes only wherein an NFC-enabled first device is brought into close proximity with an NFC unit to establish a wireless communication session with a second device;</li><li><figref idref="f0003">Figs. 3A and 3B</figref> show an arrangement described for reference purposes only wherein two NFC-enabled smartphones are brought within close proximity of one another to establish a Bluetooth® connection;</li><li><figref idref="f0004">Fig. 4</figref> shows transmission power as a function of proximity for an embodiment of the invention;</li><li><figref idref="f0005">Fig. 5</figref> shows transmission data rate as a function of proximity for an embodiment of the invention;</li><li><figref idref="f0006">Figs. 6A and 6B</figref> show an embodiment of the invention where an NFC key fob is used to enable a WLAN connection on a computer; and</li><li><figref idref="f0007">Fig. 7</figref> shows an arrangement described for reference purposes only where an NFC-enabled smartphone is used to enable secure communications with a network storage device.</li></ul>

0025<figref idref="f0001">Fig. 1</figref> shows an arrangement described for reference purposes only wherein two devices 102, 104 communicate via NFC to establish a second communication session via a wireless channel. The first device 102 comprises a first NFC module 106 and a first WLAN module 108. The second device 104 comprises a second NFC module 110 and a second WLAN module 112.

0026The first NFC module 106 and first WLAN module 108 communicate with one another via a series of control signals 114. Similarly, the second NFC module 110 and second WLAN module 112 communicate with one another via a series of control signals 116.

0027When the devices 102, 104 are brought sufficiently close to one another such that they are within the NFC activation zone (not shown), an NFC communication link 118 is established between them. The NFC modules 106, 110 send control signals 114, 116 to their respective WLAN modules 108, 112 in order to instruct them to initiate a WLAN communication session between the two devices 102, 104. Data 120 is then transferred between the devices 102, 104 via this WLAN communication system.

0028If the devices 102, 104 are separated such that they are no longer within range of the NFC activation zone, the NFC 118 and WLAN 120 communication sessions are terminated.

0029<figref idref="f0002">Fig. 2</figref> shows an arrangement described for reference purposes only wherein an NFC-enabled first device 202 is brought into close proximity with an NFC unit 204 to establish a wireless communication session with a second device.

0030In this particular arrangement, the first device 202 again comprises an NFC module 206 and a WLAN module 208. The first NFC module 106 and first WLAN module 108 communicate with one another via a series of control signals 114.

0031The second device 216 comprises a WLAN module 212. A standalone NFC unit 204 comprises an NFC module 210. Note that there are no control signals sent between the second device and the NFC unit as they are separate devices.

0032When the first device 202 and NFC unit 204 are brought into each other's NFC activation zone, an NFC communication link 218 is established between the first device 202 and the NFC unit 204. Once this link 218 is established, the NFC module 206 sends control signals 214 to the first device's WLAN module 208 in order to instruct it to begin establishing a WLAN communication session with the second device 216. Data is then transferred via a WLAN communication session 220 between the first and second devices 202, 216.

0033If the first device 202 and the NFC unit 204 are separated, the NFC 218 and WLAN 220 communication sessions are terminated, thus severing the connection between the first and second devices 202, 216.

0034<figref idref="f0003">Figs. 3A and 3B</figref> show an arrangement described for reference purposes only wherein two NFC-enabled smartphones are brought within close proximity of one another to establish a Bluetooth® connection.

0035With reference to <figref idref="f0003">Fig. 3A</figref>, two smartphones 402, 404 are both equipped with NFC and Bluetooth® modules (not shown). The smartphones 402, 404 are sufficiently far apart that no interaction with them is currently taking place.

0036With reference to <figref idref="f0003">Fig. 3B</figref>, at some time later the two smartphones 402, 404 are brought sufficiently close to one another that an NFC connection 406 is established between them. The NFC connection 406 is then used to exchange authentication data necessary to establish a Bluetooth® connection between the devices. Such authentication data may include a challenge-response scheme wherein a first of the two devices issues a "challenge" to the other device, the challenge usually comprising a string of randomly generated bits. The second device then passes a plaintext comprising the string of randomly generated bits and its address through a hash function known in the art <i>per se,</i> then returns the resulting hash value to the first device. Since the key used to generate the hash values is shared between trusted devices, and the first device knows the address of the second device, it too generates a hash function in the same way. The first device can then check if its local hash value matches that received from the second device, and if so allow connection. Of course, the second device may also authenticate the first device to achieve mutual authentication as is common practice in cryptography.

0037Once the devices have authenticated with one another, a Bluetooth® connection 408 is established between the first and second devices 402, 404. The NFC connection 406 may then be used for Secure Simple Pairing (SSP), as defined in the Bluetooth® specification, to exchange a new key between the devices to provide an encrypted communication link. Bluetooth® v4.0 supports Advanced Encryption Standard (AES), a symmetric encryption protocol (i.e. the same key is used for both encryption and decryption), typically operated in AES-CCM mode. This Bluetooth® connection 408 then provides encrypted communication between the first and second devices 402, 404. For as long as the Bluetooth® connection 408 remains active, the first and second devices 402, 404 can periodically exchange encryption keys for future use. In order to establish encrypted communication using AES-CCM, the devices exchange: master and slave Session Key Diversifier (SKDm, SKDs) parameters, and master and slave Initialization Vectors (IVm, IVs).

0038This arrangement then allows for refreshing the encrypted session using either the existing key or alternatively using a new key. When using a new key, the authentication or pairing procedure using NFC is repeated.

0039This connection will persist until the NFC connection 406 is terminated by physically separating the devices beyond the NFC activation zone (not shown), or until the Bluetooth® connection 408 is manually terminated by the user.

0040<figref idref="f0004">Fig. 4</figref> shows Bluetooth® transmission power and distance against time for an embodiment of the invention. The distance between two NFC-enabled devices is shown as the solid line 506, a proximity threshold is shown as the dot-dash line 508 and the transmission power is shown as the dashed line 510.

0041At an initial time 512, the devices are sufficiently far apart that the distance 506 between them is greater than the proximity threshold 508. The devices transmit data to one another at an upper transmission power level 514.

0042The two devices are then brought closer to one another until such a time 518 that the distance 506 between the two devices is brought below the proximity threshold 508. At this point 518, the devices are determined to be sufficiently close that less power is required to successfully send data via the Bluetooth® communication link and the transmission power 510 is reduced from the upper transmission power level 514 to a lower transmission power level 516 accordingly. The devices are then kept stationary and within the NFC activation from time 520 onwards.

0043<figref idref="f0005">Fig. 5</figref> shows Bluetooth® data rate and distance against time for an embodiment of the invention. The distance between two NFC-enabled devices is shown as the solid line 606, a proximity threshold is shown as the dot-dash line 608 and the data rate is shown as the dashed line 610.

0044At an initial time 612, the devices are sufficiently far apart that the distance between them is greater than the proximity threshold 608. The devices transmit data to one another at a lower data rate 614.

0045The two devices are then brought closer to one another until such a time 618 that the distance between the two devices is brought below the proximity threshold 608. At this point, the devices are determined to be sufficiently close that data can be sent via the Bluetooth® communication link at a higher rate without unacceptable errors and the data rate 610 is increased from the lower data rate 614 to a higher data rate 616 accordingly. The devices are then kept stationary and within the NFC activation from time 620 onwards.

0046<figref idref="f0006">Fig. 6A</figref> shows an embodiment of the invention where an NFC key fob is used to enable a WLAN connection on a computer. A desktop computer 702 is connected to an NFC unit 704 which is used to selectively enable and disable the WLAN capabilities of the computer 702.

0047This system is particularly advantageous to provide parental controls to prevent children accessing the internet without supervision. In order to access the internet via the WLAN network, an NFC token possessed only by a responsible adult is required. In <figref idref="f0006">Fig. 6A</figref>, the token is not present and so the NFC unit 704 prevents the computer 702 from utilising WLAN, illustrated by the disconnected symbol 706A shown onscreen.

0048With reference to <figref idref="f0006">Fig. 6B</figref>, a person possessing the NFC token 708 has decided to enable the internet capabilities of the computer 702. The NFC token 708 is placed on the NFC unit 704 within its activation zone, thus enabling an NFC communication link 710. Once the NFC unit 704 has authenticated the NFC token 708, a control signal is sent to the computer 702 to enable the WLAN capabilities and thus grant users access to the internet, illustrated by the connected symbol 706B shown onscreen. Once the NFC token 708 is removed from the activation zone of the NFC unit 704, the WLAN capabilities are disabled once more, reverting the state of the computer to that as described above with reference to <figref idref="f0006">Fig. 6A</figref>.

0049<figref idref="f0007">Fig. 7</figref> shows an arrangement described for reference purposes only where an NFC-enabled smartphone is used to enable secure communications with a network storage device. A desktop computer 802 is configured to transfer data to and from a network storage device 804 via WLAN 810. In order to prevent unauthorised access to sensitive data stored on the network storage device 804, an authorised user's NFC-enabled smartphone 806 must be brought within the activation zone of an NFC module within the computer 802.

0050Once the smartphone 806 is within the activation zone of the computer 802, an authentication procedure is carried out via the NFC connection 808 in order to establish a secure communication link 810 with the network storage device 804. All data transferred via the secure communication link 810 is encrypted to ensure that the content is unusable to unauthorised third parties. The secure communication link 810 exists only as long as the NFC connection 808 remains active, and so removing the smartphone 806 from the NFC activation zone causes the secure communication link 810 to be terminated immediately.

0051Thus it will be seen that a wireless communication system has been described in which NFC can be used to modify the nature of the wireless communication. Although particular embodiments have been described in detail, it will be appreciated by those skilled in the art that many variations and modifications are possible using the principles of the invention set out herein.

0052<figref idref="f0007">Fig. 7</figref> shows an embodiment of the invention where an NFC-enabled smartphone is used to enable secure communications with a network storage device. A desktop computer 802 is configured to transfer data to and from a network storage device 804 via WLAN 810. In order to prevent unauthorised access to sensitive data stored on the network storage device 804, an authorised user's NFC-enabled smartphone 806 must be brought within the activation zone of an NFC module within the computer 802.

0053Once the smartphone 806 is within the activation zone of the computer 802, an authentication procedure is carried out via the NFC connection 808 in order to establish a secure communication link 810 with the network storage device 804. All data transferred via the secure communication link 810 is encrypted to ensure that the content is unusable to unauthorised third parties. The secure communication link 810 exists only as long as the NFC connection 808 remains active, and so removing the smartphone 806 from the NFC activation zone causes the secure communication link 810 to be terminated immediately.

0054Thus it will be seen that a wireless communication system has been described in which NFC can be used to enable or modify the nature of the wireless communication. Although particular embodiments have been described in detail, it will be appreciated by those skilled in the art that many variations and modifications are possible using the principles of the invention set out herein.