Multi-factor authentication for Internet of Things devices

Abstract

A computer-implemented method, system, and computer program product for utilizing multi-factor authentication to authenticate Internet of Things (IoT) devices. Identity credentials of one or more nearby IoT devices are acquired by an IoT device to be authenticated. In response to providing a request to an authentication system to prove its identity, the IoT device provides a first factor credential (e.g., a username and password) that may be embedded within the IoT device to the authentication system. In response to verifying the accuracy of the first factor credential, the authentication system challenges the IoT device to provide a second factor credential. After receiving a challenge from the authentication system to provide the second factor credential, the IoT device returns a second factor credential to the authentication system that is generated based on the acquired identity credentials from one or more nearby IoT devices. In response to determining that the received second factor credentials include identity credentials from a minimum number of required nearby IoT devices, the authentication system approves the authentication.

Description

[Technical Field]

[0001] The present disclosure relates generally to information security, and more particularly to using multi-factor authentication to authenticate Internet of Things (IoT) devices by utilizing identity credentials from one or more nearby IoT devices to generate second factor credentials. [Background technology]

[0002] Information security (sometimes abbreviated as infosec) is the practice of protecting information by mitigating information risk. For example, as part of information risk management, information security seeks to prevent, or at least reduce the probability of, unauthorized / inappropriate access to data or the unlawful use, disclosure, destruction, deletion, damage, alteration, inspection, recording, or devaluation of information. It also includes actions designed to mitigate the adverse consequences of such incidents.

[0003] One technique for providing information security is through multi-factor authentication, which is an electronic authentication method in which, for example, a computer user may be granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism: knowledge (something the user knows and something only the user knows), possession (something the user has and something only the user has), and inherence (what the user is and what only the user is), which protects the user from unknown persons attempting to access the user's data, such as personal identifier details or financial assets.

[0004] Two-factor authentication (also known as 2FA (two-factor authentication)) is a type or subset of multi-factor authentication. It is a method of verifying a user's claimed identity by using a combination of two different factors: 1) something the user knows, 2) something the user has, or 3) something the user is. Third-party authenticator (TPA) applications can enable two-factor authentication, usually by displaying a randomly generated and constantly updated code that the user can use.

[0005] Multi-factor authentication has been used to protect information by attempting to allow only authorized computer users to access websites or applications, but little progress has been made in protecting information stored among Internet of Things (IoT) devices. Summary of the Invention [Means for solving the problem]

[0006] In one embodiment of the present disclosure, a computer-implemented method for authenticating an Internet of Things (IoT) device using multi-factor authentication includes acquiring, by the IoT device, identity credentials from one or more other IoT devices over a period of time to generate a second factor credential. The method further includes providing a request to an authentication system to prove the identity of the IoT device. The method additionally includes providing the first factor credential to the authentication system. Moreover, the method includes receiving a challenge from the authentication system to provide the second factor credential. Additionally, the method includes returning, from the one or more other IoT devices, the second factor credential generated based on the acquired identified credentials. Additionally, the method includes receiving an indication from the authentication system that the IoT device has proven the identity of the IoT device in response to the second factor credential including a minimum number of required identity credentials.

[0007] Other forms of implementation of the computer-implemented methods described above are in systems and in computer program products.

[0008] The foregoing has outlined rather generally the features and technical advantages of one or more embodiments of the present disclosure in order that the detailed description of the disclosure that follows may be better understood. Additional features and advantages of the present disclosure will be described hereinafter which may form the subject of the claims of the present disclosure.

[0009] A better understanding of the present disclosure can be obtained when the following detailed description of the invention is considered in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 illustrates an Internet of Things (IoT) environment for practicing the principles of the present disclosure, according to one embodiment of the present disclosure. [Figure 2]FIG. 2 illustrates one embodiment of the present disclosure of the hardware configuration of the IoT device. [Figure 3] FIG. 3 illustrates one embodiment of a hardware configuration for an authentication system that is representative of a hardware environment for practicing the present disclosure. [Figure 4] FIG. 4 is a flowchart diagram of a method for establishing requirements for generating a second factor credential by an IoT device upon authenticating the IoT device during a setup phase, according to one embodiment of the present disclosure. [Figure 5] FIG. 5 is a flowchart diagram of a method performed by an IoT device providing a second factor credential to an authentication system using the identity credentials of a minimum number of nearby required IoT devices to authenticate the IoT device, according to one embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0011] As discussed in the Background section above, information security (sometimes abbreviated as infosec) is the practice of protecting information by mitigating information risk. For example, as part of information risk management, information security seeks to prevent, or at least reduce the probability of, unauthorized / inappropriate access to data or the unlawful use, disclosure, destruction, deletion, damage, alteration, inspection, recording, or devaluation of information. It also includes activities designed to mitigate the adverse effects of such incidents.

[0012] One technique for providing information security is through multi-factor authentication, which is an electronic authentication method in which a computer user may be granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism: knowledge (something the user knows and something only the user knows), possession (something the user has and something only the user has), and inherence (what the user is and what only the user is), which protects the user from unknown persons attempting to access the user's data, such as personal identifier details or financial assets.

[0013] Two-factor authentication (also known as 2FA) is a type or subset of multi-factor authentication. It is a method of verifying a user's claimed identity by using a combination of two different factors: 1) something the user knows, 2) something the user has, or 3) something the user is. Third-party authentication (TPA) applications can enable two-factor authentication, usually by displaying a randomly generated and constantly updating code that the user can use.

[0014] Multi-factor authentication has been used to protect information by attempting to allow only authorized computer users to access websites or applications, but little progress has been made in protecting information stored among Internet of Things (IoT) devices.

[0015] An IoT device is a piece of hardware with sensors that transmits data from one place to another over the Internet. Types of IoT devices include wireless sensors, software, actuators, and computing devices. For example, IoT devices can be used in the following areas: connected applicants, smart home security systems, autonomous agricultural equipment, wearable health monitors, smart factory equipment, wireless inventory trackers, ultra-fast wireless internet, biometric cybersecurity scanners, and shipping container and logistics tracking.

[0016] Typically, to authenticate or prove the identity of an IoT device, the IoT device simply uses a conventional username and password, which is single-factor and does not provide the same level of security as multi-factor authentication.

[0017] However, there are some recent developments that utilize multi-factor authentication to provide a higher level of security for data stored on IoT devices. For example, the IoT device stores a secret key for generating a time-based password. An authenticated identification device may also have the same secret key. The IoT device establishes a secure connection with the identification device over a wireless network. The IoT device then generates a time-based password using the secret key and the current access time, and receives a second time-based password from the identification device over the secure connection. If both time-based passwords match, the identification device is authenticated.

[0018] This approach is similar to that used by RSA key fobs to provide a second factor. Unfortunately, such an approach is susceptible to unauthorized manipulation of the time source within the IoT device.

[0019] There is currently no means to utilize multi-factor authentication to authenticate Internet of Things (IoT) devices in a more secure manner than prior art attempts.

[0020] One embodiment of the present disclosure provides a means for authenticating IoT devices using multi-factor authentication in a more secure manner than prior art attempts.

[0021] In some embodiments of the present disclosure, the present disclosure includes computer-implemented methods, systems, and computer program products for using multi-factor authentication to authenticate Internet of Things (IoT) devices. In one embodiment of the present disclosure, identity credentials of one or more nearby IoT devices are obtained by the IoT device to be authenticated. Such identity credentials can be used to generate second factor credentials during the multi-factor authentication process. In one embodiment, during a trusted state, e.g., when the IoT device and its nearby IoT devices are installed, an authentication system pairs the IoT device with designated nearby IoT devices to ensure that they are in constant communication. The authentication system can require that the second factor credentials generated by the IoT device be based on identity credentials obtained from at least a minimum number of these nearby IoT devices or be obtained from a specified one of these nearby IoT devices. In one embodiment, such identity credentials are acquired by the IoT device during a "neighbor observation period" corresponding to a specified duration, e.g., a specified time interval, which may occur periodically. In response to providing a request to the authentication system to prove its identity, the IoT device provides a first factor credential, e.g., a username and password, which may be embedded within the IoT device, to the authentication system. In response to verifying the accuracy of the first factor credential, e.g., via a lookup table listing usernames and passwords associated with the IoT device, the authentication system challenges the IoT device to provide the second factor credential. After receiving the challenge from the authentication system to provide the second factor credential, the IoT device returns to the authentication system a second factor credential generated based on the acquired identity credentials from one or more nearby IoT devices.In response to determining that the received second factor credentials include identity credentials for a specified nearby IoT device or a specified minimum number of nearby IoT devices, the authentication system approves the authentication. The IoT device then receives an indication from the authentication system that the IoT device has proven its identity. In this manner, the IoT device is authenticated using multi-factor authentication in a more secure manner than prior art attempts.

[0022] In the following description, numerous specific details are set forth to provide a thorough understanding of the present disclosure. However, it will be apparent to those skilled in the art that the present disclosure may be practiced without such specific details. In other instances, well-known circuits are shown in block diagram form so as not to obscure the present disclosure with unnecessary detail. In most cases, details concerning timing and the like have been omitted because such details are not necessary to obtain a complete understanding of the present disclosure and are within the skill of those skilled in the relevant art.

[0023] Referring now in detail to the drawings, Figure 1 illustrates an Internet of Things (IoT) environment 100 for practicing the principles of the present disclosure in accordance with one embodiment of the present disclosure. The IoT environment 100 includes an authentication system 101 connected to IoT devices 102A-102D (identified in Figure 1 as "IoT device A," "IoT device B," "IoT device C," and "IoT device D," respectively) via a network 103. The IoT devices 102 may be referred to collectively or individually as IoT devices 102 or IoT device 102, respectively.

[0024] The authentication system 101 is configured to authenticate or prove the identity of an IoT device 102 without human interaction. In one embodiment, the authentication system 101 requires multi-factor authentication beyond a simple username and password to authenticate or prove the identity of an IoT device 102. Examples of authentication systems that may be modified to authenticate an IoT device 102 without human interaction, as described herein, include HID DigitalPersona® and Duo Security by Cisco®. A description of the hardware configuration of the authentication system 101 is provided further below in connection with FIG. 3.

[0025] In one embodiment, the authentication system 101 is connected to a database 104 for storing identity credentials of registered IoT devices 102, as described further below.

[0026] In one embodiment, an IoT device 102 is a piece of hardware with sensors that transmit data from one place to another over the Internet. Types of IoT devices 102 include wireless sensors, software, actuators, and computing devices. For example, IoT devices 102 may be used in the following areas: connected applicants, smart home security systems, autonomous agricultural equipment, wearable health monitors, smart factory equipment, wireless inventory trackers, ultra-high speed wireless internet, biometric cybersecurity scanners, and shipping container and logistics tracking.

[0027] A description of the hardware configuration of an exemplary IoT device 102 is provided below in connection with FIG.

[0028] FIG. 2 illustrates one embodiment of the present disclosure of a hardware configuration for IoT device 102 (FIG. 1), which is representative of a hardware environment for practicing the present disclosure.

[0029] 2, the IoT device 102 includes a processor 201 and a data storage device 202 (e.g., a magnetic storage device, an optical storage device, a flash memory device) that enables the data storage device 202 to host and execute software programs or applications 203, such as lightweight applications, and to communicate with other IoT devices 102 and the authentication system 101 via the network 103 as shown in FIG. 1. As used herein, a "lightweight application" refers to a computer program that is designed to have a small memory footprint and low CPU usage, thereby having an overall low usage of system resources. In one embodiment, the program instructions of the application 203, such as the program instructions of the application 203 described above, including the components described herein, are executed by the processor 201.

[0030] In one embodiment, application 203 may include various components, such as listener 204, broadcaster 205, recorder 206, and sensing / actuation component 207. Generally, listener 204 is responsible for receiving data or other input over network 103 (FIG. 1), while broadcaster 205 is responsible for broadcasting data or other output over network 103. Recorder 206 is responsible for recording data. Sensing / actuation component 207 is responsible for sensing and actuation functionality traditionally associated with IoT devices. Generally, sensing / actuation component 207 may be responsible for sensing or measuring ambient parameters, such as temperature, light, sound, etc., as may be appropriate in the context of the device.

[0031] In one embodiment, the data storage device 202 further includes storage of a username and password 208, which is used as a first factor credential provided to the authentication system 101 in connection with the multi-factor authentication techniques described herein.

[0032] Returning to Figure 1, network 103 may be, for example, a local area network, a wide area network, a wireless wide area network, a circuit-switched telephone network, a Global System for Mobile Communications (GSM) network, a Wireless Application Protocol (WAP) network, a WiFi network, an IEEE 802.11 standard network, various combinations thereof, etc. Other networks, the description of which is omitted herein for the sake of brevity, may also be used in combination with system 100 of Figure 1 without departing from the scope of the present invention.

[0033] The environment 100 is not limited in scope to any one particular network architecture. The environment 100 may include any number of authentication systems 101, IoT devices 102, and networks 103.

[0034] Reference is now made to FIG. 3, which illustrates one embodiment of the present disclosure of a hardware configuration for authentication system 101 (FIG. 1) that is representative of a hardware environment for practicing the present disclosure.

[0035] The authentication system 101 includes a processor 301 connected to various other components by a system bus 302. An operating system 303 executes on the processor 301 and provides control and coordination of the functions of the various components of FIG. 3. An application 304 according to the principles of the present disclosure executes in conjunction with the operating system 303 and provides calls to the operating system 303, which implement various functions or services to be performed by the application 304. The application 304 may include programming for authenticating the IoT device 102 (FIG. 1) using multi-factor authentication, for example, as further described below in connection with FIGS. 4-5.

[0036] Referring again to FIG. 3 , read-only memory (ROM) 305 is connected to system bus 302 and includes a basic input / output system (BIOS) that controls certain basic functions of authentication system 101. Random access memory (RAM) 306 and disk adapter 307 are also connected to system bus 302. It should be noted that software components, including operating system 303 and application 304, may be loaded for execution into RAM 306, which may be the main memory of authentication system 101. Disk adapter 307 may be an integrated drive electronics (IDE) adapter that communicates with disk unit 308, e.g., a disk drive. It should be noted that, as further described below in connection with FIGS. 4-5 , a program for authenticating IoT device 102 using multi-factor authentication may reside in disk unit 308 or in application 304.

[0037] The authentication system 101 may further include a communication adapter 309 connected to the system bus 302. The communication adapter 309 interconnects the system bus 302 with an external network (e.g., network 103 in FIG. 1) for communication with other devices, such as the IoT device 102.

[0038] The present invention may be a system, method, or computer program product, or combination thereof, at any level of technical detail where integration is possible. The computer program product may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0039] The computer-readable storage medium can be a tangible device capable of holding and storing instructions for use by an instruction execution device. The computer-readable storage medium can be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as a punch card or a ridge structure in a groove in which instructions are recorded, or any suitable combination thereof. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0040] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing device / processing device, or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may be comprised of copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing device / processing device receives the computer-readable program instructions from the network and transmits the computer-readable program instructions to the respective computing device / processing device for storage in a computer-readable storage medium.

[0041] The computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, such as object-oriented programming languages, e.g., Smalltalk, C++, etc., or conventional procedural programming languages ​​(e.g., the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, partially on the user's computer as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any kind of network, such as a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., over the Internet using an Internet Service Provider). In some embodiments, electronic circuits, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry to perform aspects of the invention.

[0042] Aspects of the present invention are described herein with reference to flowchart illustrations or block diagrams, or combinations thereof, of methods, apparatus (systems), and computer program products or computer programs according to embodiments of the invention. It will be understood that each block of the flowchart illustrations or block diagrams, or combinations thereof, and combinations of blocks in the flowchart illustrations or block diagrams, or combinations thereof, can be implemented by computer-readable program instructions.

[0043] These computer-readable program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowchart diagrams or block diagrams, or any combination thereof. These computer-readable program instructions can also be stored on a computer-readable storage medium that can direct a computer, programmable data processing apparatus, or other device, or any combination thereof, to function in a particular manner, and the computer-readable storage medium having instructions stored therein comprises an article of manufacture containing instructions that implement one or more specified functional / act aspects of the flowchart diagrams or block diagrams, or any combination thereof.

[0044] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on the computer, other programmable data processing apparatus, or other device, implement the functions / acts identified in one or more blocks of the flowchart diagrams or block diagrams, or a combination thereof, to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to generate a computer-implemented process.

[0045] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products or computer programs according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing one or more specified logical functions. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be accomplished as a single step performed simultaneously, substantially simultaneously, partially, or fully in a time-overlapping manner, depending on the functionality involved, or the blocks may be performed in the reverse order. It should be noted that each block of the block diagrams or flowchart diagrams or combinations thereof, and combinations of multiple blocks in the block diagrams or flowchart diagrams or combinations thereof, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations, or may execute a combination of special-purpose hardware and computer instructions.

[0046] As mentioned above, typically, to authenticate or prove the identity of an IoT device, the IoT device simply uses a conventional username and password, which is a single factor and does not provide the same level of security as multi-factor authentication. However, there have been some recent developments that utilize multi-factor authentication to provide a higher level of security for data stored on the IoT device. For example, the IoT device stores a secret key for generating a time-based password. An authenticated identification device may also have the same secret key. The IoT device establishes a secure connection with the identification device over a wireless network. The IoT device then generates a time-based password using the secret key and the current access time and receives a second time-based password from the identification device over the secure connection. If both time-based passwords match, the identification device is authenticated. This approach is similar to the approach used by RSA key fobs to provide a second factor. Unfortunately, such an approach leaves the time source within the IoT device vulnerable to unauthorized manipulation. There is currently no means to utilize multi-factor authentication to authenticate Internet of Things (IoT) devices in a more secure manner than prior art attempts.

[0047] One embodiment of the present disclosure provides a means for authenticating an IoT device 102 (FIGS. 1 and 2) using multi-factor authentication in a more secure manner than prior art attempts that use interactions with nearby IoT devices 102, as described below in connection with FIGs. 4-5. FIG. 4 is a flowchart diagram of the setup phase in establishing the requirements for generating second factor credentials by an IoT device 102 when authenticating the IoT device 102. FIG. 5 is a flowchart diagram of the execution phase in authenticating an IoT device 102 by an IoT device 102 providing a second factor credential using the identity credentials of a nearby IoT device 102.

[0048] FIG. 4 is a flowchart diagram of a method 400 for establishing requirements for generating second factor credentials by an IoT device 102 upon authenticating the IoT device 102 during the setup phase, according to one embodiment of the present disclosure.

[0049] Although the following description describes an authentication system 101 that utilizes two-factor authentication to authenticate an IoT device 102, the authentication system 101 may utilize other authentication factors, such as three-factor authentication, to authenticate an IoT device 102. Those skilled in the art will be able to apply the principles of this disclosure to such implementations. Furthermore, implementations that apply the principles of this disclosure to such implementations will fall within the scope of this disclosure.

[0050] 1-3, the authentication system 101 defines a minimum number of nearby IoT devices 102 required to be used to generate a second factor credential, or defines a minimum number of required collections, and defines a minimum number of IoT devices from the minimum number of required collections to be used to generate a second factor credential. As used herein, "neighbor" or "neighboring" IoT devices 102 (e.g., IoT device 102B, IoT device 102C, IoT device 102D) to an IoT device 102 (e.g., IoT device 102A) refers to those IoT devices 102 (e.g., IoT device 102B) that are paired with the IoT device 102 (e.g., IoT device 102A) during a trust state (described below). Moreover, such "neighboring" IoT devices 102 are located in sufficient proximity to communicate, for example, via a network 103, with the IoT device 102 whose identity is to be authenticated. Such communications include a request by an IoT device 102 (e.g., IoT device 102A) whose identity is to be authenticated to obtain identity credentials from a nearby IoT device 102 (e.g., IoT device 102B, IoT device 102C, IoT device 102D). As used herein, "identity credentials" refers to a security key, a digital signature, or characteristics of an IoT device 102, such as, but not limited to, sensor characteristics (e.g., electrochemical, gyroscope, pressure, optical sensor, Global Positioning System (GPS), pressure, radio-frequency identification (RFID), etc.), signal strength characteristics (e.g., -60 dBm, -75 dBm, etc.), signal modulation characteristics (e.g., 2.4 GHz Wi-Fi, 5 GHz Wi-Fi, Ethernet), and signal coding characteristics (e.g., ASCII, HEX, etc.).

[0051] In one embodiment, nearby IoT devices 102 are required to be registered with the authentication system 101, e.g., during a trusted state, which involves providing such identity credentials to the authentication system 101. In one embodiment, such identity credentials may be provided to the authentication system 101 periodically, e.g., during a neighborhood observation period (described below), when an IoT device 102 obtains the identity credentials of its nearby IoT devices 102.

[0052] In one embodiment, these credentials are stored in a table that may reside in a storage device (e.g., memory 305, disk drive 308). Such credentials may be associated with a particular IoT device 102 in the table, for example, by the IoT device's 102 identifier (e.g., an object identifier, such as a barcode; a communication identifier, such as an Internet Protocol (IP) address; and an application identifier, such as a uniform resource identifier (URI) and uniform resource locator (URL)). In an alternative embodiment, such identity credentials and associated IoT device identifiers may be stored in a database, for example, database 104 connected to authentication system 101.

[0053] As described above, the authentication system 101 may define a minimum number of nearby IoT devices 102 required to be used to generate a second factor credential. For example, the authentication system 101 may require that an IoT device 102 to be authenticated must utilize identity credentials from a minimum of three nearby IoT devices (e.g., IoT device 102B, IoT device 102C, and IoT device 102D) to generate a second factor credential in the two-factor authentication techniques of the present disclosure.

[0054] Additionally, as described above, the authentication system 101 defines a required minimum number of collections to be used to generate a second factor credential. As used herein, a "collection" refers to a set of multiple nearby IoT devices 102. For example, collection ("A") may correspond to a set of {A, B, C, D, and E}, where A, B, C, D, and E are respective nearby IoT devices 102. The authentication system 101 may define a minimum number of such collections to be used in generating a second factor credential by an IoT device 102 whose identity is to be authenticated. Additionally, the authentication system 101 may further define a minimum number of nearby IoT devices from the minimum number of collections to be used in generating a second factor credential. For example, the authentication system 101 may define a minimum number of nearby IoT devices from the minimum number of collections to be used in generating a second factor credential in the two-factor authentication technique of the present disclosure.

[0055] In step 402, the authentication system 101 defines the identities of nearby required IoT devices 102 that correspond to the minimum number of required IoT devices 102 that should be used to generate the second factor credential, or defines the identities of required IoT devices 102 within the required minimum number of collections that should be used to generate the second factor credential.

[0056] For example, the authentication system 101 may require that an IoT device 102 to be authenticated (e.g., IoT device 102A) use the identity credentials of IoT device 102B, IoT device 102C, and IoT device 102D to generate second factor credentials corresponding to the required minimum number of three neighboring IoT devices 102 that need to be used to generate the second factor credential. As used herein, "generating" a second factor credential refers to generating a credential that includes the necessary identity credentials of the neighboring IoT devices 102. "Generating" may be performed by appending identifiers (e.g., object identifiers, e.g., barcodes, communication identifiers, e.g., Internet Protocol (IP) addresses, and application identifiers, e.g., uniform resource identifiers (URIs) and uniform resource locators (URLs)) of the neighboring IoT devices 102 to the identity credentials. As a result, the second factor credential may include a set of identifiers (identifiers of nearby IoT devices 102) appended to its associated identity credential.

[0057] In one embodiment, such requirements are stored in a table (which may be stored in a storage medium (e.g., memory 305, disk drive 308) or in database 104) associated with the IoT device 102 to be authenticated (e.g., IoT device 102A). In this embodiment, the authentication system 101 will be able to determine whether a second factor credential received from the IoT device 102 to be authenticated is correct because the authentication system 101 has access to the identity credentials of each of the nearby IoT devices 102 and can construct the second factor credential using the identity credentials of the necessary nearby IoT devices 102 required to be used to generate the second factor credential. Moreover, as described above, such identity credentials may be constantly updated, for example, during a neighborhood observation period (described further below), so that the identity credentials are current.

[0058] In another example, the authentication system 101 may require that an IoT device 102 (e.g., IoT device 102A) to be authenticated use a required minimum number of collections (e.g., three collections) of the defined nearby IoT devices 102. For example, the authentication system 101 may define collection "R" to include the set of {A, B, C, D, and E}, collection "S" to include the set of {A, B, E, and F}, and collection "T" to include the set of {A, E, I, O, and U}, where each letter corresponds to a particular nearby IoT device 102. An authentication requirement may be that at least three nearby IoT devices 102, e.g., including any nearby IoT devices 102 listed in each of the plurality of collections, need to be used to generate a second factor credential. As a result, IoT devices A and E need to be used and a third IoT device 102 is selected from the set {B, C, D, F, I, O and U}.

[0059] As a result, in step 402, the authentication system 101 informs the to-be-authenticated IoT device 102 of the specific requirements related to the generation of a second factor credential. As a result, the IoT device 102 has knowledge of which nearby IoT devices 102 it should obtain its identity credentials from in order to generate the second factor credential. Such identity credentials from the necessary nearby IoT devices 102 can be obtained during a proximity observation period.

[0060] In step 403, the authentication system 101 defines a "proximity observation period" during which the to-be-authenticated IoT device 102 obtains identity credentials from necessary nearby IoT devices that are used to generate second factor credentials. In one embodiment, the neighborhood observation period includes a time duration. In one embodiment, the neighborhood observation period is defined to occur periodically, for example, at specified time intervals.

[0061] During this period, the IoT device 102 to be authenticated collects the identity credentials of its neighboring IoT devices 102, for example, if required by the authentication system 101.

[0062] Additionally, in one embodiment, during this period, those nearby IoT devices 102 transmit their identity credentials to the authentication system 101 so that the authentication system 101 can determine the second factor credentials to be received from the IoT device 102 to be authenticated. As previously described, such identity credentials may be stored in a table (which may reside in a storage medium (e.g., memory 305, disk drive 308) or in a database 104).

[0063] In step 404, the authentication system 101 establishes a trust state in which the IoT device 102 to be authenticated (e.g., IoT device 102A) is paired with nearby IoT devices, where the identity credentials of at least a subset of these nearby IoT devices are used to generate second factor credentials. In one embodiment, once such IoT devices 102 are paired, they maintain constant communication. In one embodiment, such IoT devices 102 are placed into this trust state.

[0064] In one embodiment, during the trusted state, the username and password 208 that the IoT device 102 uses as a first factor credential may be provided to the authentication system 101 to verify the accuracy of the first factor credential when the IoT device 102 provides the first factor credential to the authentication system 101. In one embodiment, such username and password are stored in a table (which may reside in a storage medium (e.g., memory 305, disk drive 308) or database 104) along with an identifier of the associated IoT device 102 (e.g., an object identifier, e.g., a barcode, a communication identifier, e.g., an Internet Protocol (IP) address, and an application identifier, e.g., a uniform resource identifier (URI) and a uniform resource locator (URL))). By associating the username and password with the corresponding IoT device 102, the authentication system 101 can identify the username and password associated with the IoT device 102 by performing a lookup in the table based on the identifier of the IoT device 102.

[0065] Upon completion of the setup phase, the execution phases when the IoT device 102 authenticates the IoT device 102 (e.g., IoT device 102A) by providing a second factor credential to the authentication system 101 using the necessary identity credentials of a nearby IoT device 102 are described below in connection with FIG. 5.

[0066] FIG. 5 is a flowchart illustrating a method 500 of performing authentication of an IoT device 102 (e.g., IoT device 102A) by an IoT device 102 providing a second factor credential to an authentication system 101 using the identity credentials of a minimum number of nearby required IoT devices, according to one embodiment of the present disclosure.

[0067] Referring to Figure 5, in conjunction with Figures 1-4, in step 501, the IoT device 102 to be authenticated obtains identity credentials from nearby IoT devices 102 during a proximity observation period that is used to generate the second factor credentials, as described above.

[0068] In step 502, the IoT device 102 provides a request to the authentication system 101 to prove the identity of the IoT device 102. In one embodiment, the request is provided to the authentication system 101 periodically. In one embodiment, the request is provided to the authentication system 101 in response to a trigger event (e.g., an event generated by a registry when an item is added, updated, or deleted).

[0069] In step 503, the IoT device 102 provides first factor credentials (e.g., username, password) to the authentication system 101. In one embodiment, the username and password 208 are embedded within the IoT device 102, for example, stored within the data storage device 202.

[0070] In one embodiment, once the authentication system 101 verifies the accuracy of the first factor credential, for example via a lookup in a table listing usernames and passwords associated with the IoT device 102, it challenges the IoT device 102 to provide a second factor credential.

[0071] In step 504, the IoT device 102 receives a challenge from the authentication system 101 to provide a second factor credential.

[0072] In step 505, the IoT device 102 returns second factor credentials generated based on the obtained identity credentials from the necessary nearby IoT devices 102 to the authentication system 101. For example, the authentication system 101 may request that the to-be-authenticated IoT device 102 (e.g., IoT device 102A) use the identity credentials of IoT device 102B, IoT device 102C, and IoT device 102D to generate second factor credentials corresponding to the required minimum number of three nearby IoT devices 102 that need to be used to generate the second factor credential. As a result, the second factor credentials include the identity credentials of IoT device 102B, IoT device 102C, and IoT device 102D, and are provided to the authentication system 101.

[0073] In another example, as described above, the authentication system 101 may require that an IoT device 102 to be authenticated (e.g., IoT device 102A) use a required minimum number of collections (e.g., three collections) of the defined nearby IoT devices 102. For example, the authentication system 101 may define collection "R" to include the set of {A, B, C, D, and E}, collection "S" to include the set of {A, B, E, and F}, and collection "T" to include the set of {A, E, I, O, and U}, where each letter corresponds to a particular IoT device 102. The authentication requirement may be that at least three nearby IoT devices 102, e.g., at least three nearby IoT devices 102 encompassing any nearby IoT devices 102 listed in each of the plurality of collections, need to be used to generate a second factor credential. As a result, IoT devices A and E need to be used, and a third IoT device 102 is selected from the set {B, C, D, F, I, O, and U}. As a result, IoT device 102 acquires the identity credentials of IoT devices A and B, and one selected from IoT devices C, D, E, F, I, O, and U. The second factor credential is then generated using such identity credentials, which is provided to authentication system 101.

[0074] As described above, as used herein, "generating" a second factor credential refers to generating a credential that includes the necessary identity credentials of nearby IoT devices 102. "Generating" may be performed by appending identifiers of nearby IoT devices 102 (e.g., object identifiers, e.g., barcodes, communication identifiers, e.g., Internet Protocol (IP) addresses, and application identifiers, e.g., uniform resource identifiers (URIs) and uniform resource locators (URLs)) to the identity credentials. As a result, the second factor credential may include a set of identifiers (identifiers of nearby IoT devices 102) appended to its associated identity credentials.

[0075] In step 506, the authentication system 101 receives the second factor credential from the IoT device 102.

[0076] In step 507, a determination is made by authentication system 101 as to whether the received second factor credentials include a minimum number of required identity credentials.

[0077] For example, if the authentication system 101 requests that an IoT device 102 to be authenticated (e.g., IoT device 102A) generate the second factor credential using at least the identity credentials of IoT device 102B, IoT device 102C, and IoT device 102D, then the authentication system 101 will approve the authentication as long as those identity credentials are included in the second factor credential. Otherwise, the authentication system 101 will not approve the authentication.

[0078] As described above, the authentication system 101 requires that the IoT device 102 to be authenticated (e.g., IoT device 102A) collects the identity credentials of at least three nearby IoT devices 102 that are members of each of collections R, S, and T (collection "R" includes the set {A, B, C, D, and E}, collection "S" includes the set {A, B, E, and F}, and collection "T" includes the set {A, E, I, O, and U}), e.g., at least three nearby IoT devices 102 that encompass any nearby IoT devices 102 listed in each of the collections. Thus, as long as the second factor credentials include the identity credentials of IoT devices A and E, as well as the identity credentials of an IoT device 102 selected from IoT devices C, D, E, F, I, O, and U, the authentication system 101 will approve the authentication. Otherwise, the authentication system 101 will not approve the authentication.

[0079] If the received second factor credentials include the minimum number of required identity credentials, then in step 508, the authentication system 101 approves the authentication and issues an indication to the IoT device 102 that authentication of the IoT device 102 has been approved. In this manner, the IoT device 102 is authenticated using multi-factor authentication in a more secure manner than prior art attempts. In one embodiment, as a result of being authenticated, the authentication system 101 establishes a secure connection for the IoT device 102 within the IoT environment 100, for example, between itself and another IoT device 102.

[0080] In step 509, the IoT device 102 receives an indication from the authentication system 101 that the IoT device 102 has its identity certified. In one embodiment, such an indication may be in the form of an alert or message. As described above, as a result of being authenticated, the IoT device 102 has a secure connection within the IoT environment 100, e.g., between itself and another IoT device 102. As a result, data stored within the IoT device 102 may be permitted to be securely transmitted to another device within the secure system, e.g., another IoT device 102. That is, in response to receiving such an indication, data stored within the IoT device 102 may become accessible to another device within the secure IoT environment 100, e.g., another IoT device 102.

[0081] However, if the received second factor credentials do not include the minimum number of required identity credentials, then in step 510, the authentication system 101 does not approve the authentication and issues an indication to the IoT device 102 that the authentication of the IoT device 102 has not been approved.

[0082] In step 511, the IoT device 102 receives an indication from the authentication system 101 that the IoT device 102 does not have its identity certified. In one embodiment, such an indication may be in the form of an alert or message. In one embodiment, in response to receiving such an indication, data stored within the IoT device 102 may not be allowed to be transmitted to another device, such as another IoT device 102. That is, in response to receiving such an indication, data stored within the IoT device 102 may not be made accessible to another device, such as another IoT device 102.

[0083] As a result of the above, one embodiment of the present disclosure provides a means for improving the art or field of information security by utilizing multi-factor authentication to authenticate IoT devices in a more secure manner than prior art attempts.

[0084] Moreover, the present disclosure improves the technology or technical field involved in information security. As mentioned above, information security (sometimes abbreviated as infosec) is the practice of protecting information by mitigating information risk. For example, information security, which is part of information risk management, seeks to prevent, or at least reduce the probability of, unauthorized / inappropriate access to data or the illegal use, disclosure, destruction, deletion, damage, modification, inspection, recording, or devaluation of information. It also includes activities designed to mitigate the adverse effects of such incidents. One technique for providing information security is through multi-factor authentication, which is an electronic authentication method in which a computer user may be granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism: knowledge (something the user knows and something only the user knows), possession (something the user has and something only the user has), and inherence (something the user is and something only the user is). It protects users from unknown individuals attempting to access their data, such as personal identifier details or financial assets. Multi-factor authentication has been used to protect information by allowing only authenticated computer users to access websites or applications, but little progress has been made in protecting information stored among Internet of Things (IoT) devices. Typically, to authenticate or prove the identity of an IoT device, the IoT device simply uses a conventional username and password, which is a single factor and does not provide the same level of security as multi-factor authentication. However, there are some recent developments that utilize multi-factor authentication to provide a higher level of security for data stored on IoT devices. For example, the IoT device stores a secret key for generating time-based passwords. The authenticated identification device may also have the same secret key.The IoT device establishes a secure connection with the identification device over a wireless network. The IoT device then generates a time-based password using a secret key and the current access time and receives a second time-based password from the identification device over the secure connection. If both time-based passwords match, the identification device is authenticated. This approach is similar to that used by RSA key fobs to provide a second factor. Unfortunately, such an approach is susceptible to unauthorized manipulation of the time source within the IoT device. There is currently no means to utilize multi-factor authentication to authenticate Internet of Things (IoT) devices in a more secure manner than prior art attempts.

[0085] One embodiment of the present disclosure improves upon such techniques by having the IoT device to be authenticated acquire identity credentials for one or more nearby IoT devices. In one embodiment of the present disclosure, identity credentials for one or more nearby IoT devices are acquired by the IoT device to be authenticated. Such identity credentials can be used to generate second factor credentials during a multi-factor authentication process. In one embodiment, during a trusted state, e.g., when an IoT device and its neighboring IoT devices are installed, the authentication system pairs the IoT device with designated neighboring IoT devices to ensure that they are in constant communication. The authentication system may require that the second factor credentials generated by the IoT device be based on identity credentials acquired from at least a minimum number of these neighboring IoT devices or be acquired from a specified one of these neighboring IoT devices. In one embodiment, such identity credentials are acquired by the IoT device during a “neighbor observation period” corresponding to a specified duration, e.g., a specified time interval, which may occur periodically. In response to providing a request to the authentication system to prove its identity, the IoT device provides a first factor credential (e.g., a username and password) that may be embedded within the IoT device to the authentication system. In response to verifying the accuracy of the first factor credential, e.g., via a lookup table listing usernames and passwords associated with the IoT device, the authentication system challenges the IoT device to provide the second factor credential. After receiving the challenge from the authentication system to provide the second factor credential, the IoT device returns to the authentication system a second factor credential generated based on the acquired identity credentials from one or more nearby IoT devices.In response to determining that the received second factor credentials include identity credentials for the specified nearby IoT device or a specified minimum number of nearby IoT devices, the authentication system approves the authentication. The IoT device then receives an indication from the authentication system that the IoT device has proven its identity. In this manner, the IoT device is authenticated more securely through multi-factor authentication than before. Furthermore, in this manner, there is an improvement in the art of information security.

[0086] The technical solutions provided by the present disclosure cannot be implemented in a human mind or by a human using pen and paper, i.e., the technical solutions provided by the present disclosure cannot be achieved in a human mind or by a human using pen and paper, in any reasonable amount of time, with any reasonable expectation of accuracy, without the use of a computer.

[0087] The description of various embodiments of the present invention has been presented for illustrative purposes and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used in this specification have been selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A computer-implemented method for authenticating an Internet of Things (IoT) device using multi-factor authentication, comprising: obtaining, by the IoT device during a period of time, identity credentials from one or more other IoT devices, and generating second factor credentials by the IoT device; providing a request to an authentication system by the IoT device to prove the identity of the IoT device; the IoT device providing a first factor credential to the authentication system; receiving a challenge from the authentication system for the IoT device to provide the second factor credential; In response to receiving the challenge, the IoT device returns to the authentication system the second factor credential generated based on the obtained identified credentials from the one or more other IoT devices; and receiving an indication from the authentication system that the IoT device has attested to the identity of the IoT device in response to the second factor credential including a minimum number of required identity credentials. The method comprising:

2. 10. The method of claim 1, wherein the identity credentials include a security key, a digital signature, or characteristics of the one or more other IoT devices, where the characteristics include one or more of a sensor characteristic, a strength of signal characteristic, a signal modulation characteristic, and a signal coding characteristic.

3. 10. The method of claim 1, wherein the request to the authentication system to prove the identity of the IoT device is performed periodically or in response to a trigger event.

4. 10. The method of claim 1, wherein a minimum number of required IoT devices to be used to generate the second factor credential is defined, or a minimum number of required collections to be used to generate the second factor credential is defined, where each of the collections includes a set of identified IoT devices.

5. 5. The method of claim 4, wherein required IoT device identities corresponding to the minimum number of required IoT devices to be used to generate the second factor credential are defined, or required IoT device identities within the required minimum number of collections to be used to generate the second factor credential are defined.

6. 6. The method of claim 5, wherein an observation period is defined during which the IoT device obtains identity credentials from required IoT devices that correspond to the minimum number of required IoT devices to be used to generate the second factor credential, or from required IoT devices within the required minimum number of the collection to be used to generate the second factor credential.

7. The method of claim 1, further comprising establishing a trust state in which the IoT device is paired with the one or more other IoT devices when the one or more other IoT devices are in the vicinity, thereby causing the IoT device to constantly communicate with the one or more other IoT devices.

8. A computer program for authenticating Internet of Things (IoT) devices using multi-factor authentication, acquiring, by the IoT device during a period of time, identity credentials from one or more other IoT devices to generate second factor credentials; providing a request to an authentication system to prove the identity of the IoT device; providing a first factor credential to the authentication system; receiving a challenge from the authentication system to provide the second factor credential; In response to receiving the challenge, returning the second factor credential to the authentication system, the second factor credential being generated based on the obtained identified credentials from the one or more other IoT devices; and receiving an indication from the authentication system that the IoT device has attested to the identity of the IoT device in response to the second factor credential including a minimum number of required identity credentials. The computer program causes one or more processors to execute each step of the method comprising:

9. 9. The computer program product of claim 8, wherein the identity credentials include a security key, a digital signature, or characteristics of the one or more other IoT devices, where the characteristics include one or more of a sensor characteristic, a strength of signal characteristic, a signal modulation characteristic, and a signal coding characteristic.

10. 9. The computer program product of claim 8, wherein the request to the authentication system to prove the identity of the IoT device is performed periodically or in response to a trigger event.

11. 9. The computer program product of claim 8, wherein a minimum number of required IoT devices to be used to generate the second factor credential is defined, or a minimum number of required collections to be used to generate the second factor credential is defined, where each of the collections includes a set of identified IoT devices.

12. 12. The computer program product of claim 11, wherein required IoT device identities corresponding to the minimum number of required IoT devices to be used to generate the second factor credential are defined, or required IoT device identities within the required minimum number of collections to be used to generate the second factor credential are defined.

13. 13. The computer program product of claim 12, wherein an observation period is defined during which the IoT device obtains identity credentials from required IoT devices that correspond to the minimum number of required IoT devices to be used to generate the second factor credential, or from the required IoT devices within the required minimum number of the collection to be used to generate the second factor credential.

14. The computer program of claim 8, wherein when the IoT device is in the vicinity of the one or more other IoT devices, a trust state is established in which the IoT device is paired with the one or more other IoT devices, thereby causing the IoT device to constantly communicate with the one or more other IoT devices.

15. An Internet of Things (IoT) device, the IoT device comprising: a memory for storing a computer program for authenticating the IoT device using multi-factor authentication; and a processor connected to the memory wherein the processor comprises: acquiring, by the IoT device during a period of time, identity credentials from one or more other IoT devices to generate second factor credentials; providing a request to an authentication system to prove the identity of the IoT device; providing a first factor credential to the authentication system; receiving a challenge from the authentication system to provide the second factor credential; In response to receiving the challenge, returning the second factor credential to the authentication system, the second factor credential being generated based on the obtained identified credentials from the one or more other IoT devices; and receiving an indication from the authentication system that the IoT device has attested to the identity of the IoT device in response to the second factor credential including a minimum number of required identity credentials. configured to execute program instructions of the computer program, The IoT device.

16. 16. The IoT device of claim 15, wherein the identity credentials include a security key, a digital signature, or characteristics of the one or more other IoT devices, where the characteristics include one or more of a sensor characteristic, a strength of signal characteristic, a signal modulation characteristic, and a signal coding characteristic.

17. 16. The IoT device of claim 15, wherein the request to the authentication system to prove the identity of the IoT device is performed periodically or in response to a trigger event.

18. 16. The IoT device of claim 15, wherein a minimum number of required IoT devices to be used to generate the second factor credential is defined, or a minimum number of required collections to be used to generate the second factor credential is defined, where each of the collections includes a set of identified IoT devices.

19. 20. The IoT device of claim 18, wherein required IoT device identities corresponding to the minimum number of required IoT devices to be used to generate the second factor credential are defined, or required IoT device identities within the required minimum number of collections to be used to generate the second factor credential are defined.

20. 20. The IoT device of claim 19, wherein an observation period is defined during which the IoT device obtains identity credentials from required IoT devices that correspond to the minimum number of required IoT devices to be used to generate the second factor credential or that are within the required minimum number of IoT devices of the collection to be used to generate the second factor credential.

Images