BLE Bridge Packet Encryption for Secure Process Data Broadcast
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial communication protocols like HART and BLE are not compatible, limiting interoperability and security in process control environments, where secure and efficient data transmission between field devices and remote devices is crucial.
Innovation Solution
A method and apparatus that use a BLE bridge to transmit process data by determining auxiliary data, generating a nonce value, and encrypting payloads with an encryption key identifier, ensuring secure and compatible communication between field devices and remote devices using BLE technology.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If industrial communication protocols (HART, PROFIBUS, etc.) are used for process control data transmission, then compatibility with field devices is maintained, but interoperability with wireless devices (BLE) is limited
Solution Approach 1:
The patent employs an intermediary device that acts as a protocol translator between industrial communication protocols (HART, PROFIBUS, etc.) and Bluetooth Low Energy (BLE) protocols. This intermediary receives data packets from field devices using industrial protocols, processes and translates them, then transmits via BLE to remote devices, enabling interoperability without requiring field devices to support multiple protocols directly
Solution Approach 2:
The patent creates a copy of the industrial communication data and reformats it into BLE-compatible packets. The intermediary device receives the original industrial protocol data, creates a replicated version in BLE format, and transmits this copy to BLE devices, allowing wireless access to process control data without modifying the original industrial communication infrastructure
2Reliability
If data is transmitted without encryption in BLE networks, then transmission efficiency is maintained, but security and data integrity are compromised
Solution Approach 1:
The patent implements preliminary encryption actions on data packets before they are transmitted over the BLE network. The intermediary device encrypts data using encryption keys and generates authentication codes in advance, ensuring security is built into the transmission process from the outset rather than added as a post-processing step
Solution Approach 2:
The patent segments the data transmission process into distinct components: original data packets, encrypted payloads, authentication data, and auxiliary information. Each segment serves a specific function - the encrypted payload protects data confidentiality while authentication data verifies integrity, allowing efficient processing of each segment independently
3Reliability
If additional security measures (encryption, authentication) are implemented in BLE transmission, then data security is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service security mechanisms where the intermediary device automatically manages encryption keys, generates authentication codes, and handles security protocol operations without requiring manual configuration or intervention. The security measures are integrated into the normal data flow, allowing the system to secure communications autonomously
Solution Approach 2:
The patent merges multiple security functions (encryption, authentication, data integrity verification) into a unified security processing layer within the intermediary device. By combining these security measures into a single integrated process, the patent reduces the overall complexity compared to implementing separate security systems for each function
Data Source
AI summary
An example method includes, in response to receiving a byte array including process data, determining whether auxiliary data is to be transmitted from a field device based on a counter, the auxiliary data including an encryption key identifier and an initialization vector, when auxiliary data is to be transmitted, transmitting a first data packet including the auxiliary data to the remote device, and determining a value for a source bit based on a type of connection between the field device and the remote device, the source bit and the counter included in associated data. The method further includes generating a nonce value based on the source bit and the initialization vector, encrypting a payload including the byte array based on the encryption key identifier and the nonce value, and transmitting a second data packet to the remote device, the second data packet including the associated data and the encrypted payload.