Authenticated Service Discovery Using Secure Ledger
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The multicast Domain Name Service (mDNS) protocol used for service discovery in computer networks is insecure, prone to service spoofing and 'man-in-the-middle' attacks, especially in enterprise IoT deployments, due to its unsecured nature.
Innovation Solution
Implementing a secure digital ledger, such as a blockchain, for authenticating network service devices and their offered services, creating entries based on identifying information and behavioral validation to prevent spoofing and ensure authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mDNS protocol is used for service discovery, then ease of operation is improved, but security is worsened
Solution Approach 1:
A blockchain-based intermediary ledger system is introduced between service providers and service consumers. The blockchain acts as a trusted mediator that records and verifies service advertisements, device identities, and authentication credentials, preventing spoofing while maintaining the simplicity of mDNS-based discovery operations.
Solution Approach 2:
Device identities and service credentials are pre-registered and authenticated on the blockchain before actual service discovery occurs. This preliminary authentication creates immutable records of legitimate devices, allowing subsequent service advertisements to be verified against these pre-established credentials, thus preventing man-in-the-middle attacks.
2Reliability
If secure authentication is implemented, then reliability is improved, but device complexity is worsened
Solution Approach 1:
The blockchain network enables devices to perform self-authentication by verifying service advertisements against the distributed ledger without requiring complex centralized authentication servers. Devices independently query the blockchain for credential verification, reducing the need for additional authentication infrastructure and simplifying device implementation.
Solution Approach 2:
The blockchain platform provides multiple functions including identity management, credential verification, service advertisement authentication, and revocation tracking within a single system. This multi-functional approach consolidates what would otherwise require multiple separate authentication mechanisms, reducing overall system complexity.
Data Source
AI summary
In one embodiment, a service configured to execute on trusted participant devices authenticates network service devices each having identifying information and one or more offered services, and creates an entry into a secure digital ledger for each authenticated network service device and associated offered services, each entry based on the identifying information and the one or more offered services for a corresponding network service device. Upon receiving an advertisement for an advertised service from an advertising device attached to a given trusted participant device, the service then requests and may receive an authentic ledger entry from the secure digital ledger for the advertised service. In response to either validating or failing to validate authenticity of the advertised service based on the authentic ledger entry, registration at the given trusted participant device of the advertised service for the received advertisement from the advertising device may either be permitted or denied, respectively.