BLE Mesh Gateway Binding With Multi-Step Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Bluetooth Low Energy Mesh (BLE Mesh) networks, smart home devices may be incorrectly bound to an incorrect gateway during authentication, leading to security risks and privacy issues due to the lack of verification between the device and the gateway.
Innovation Solution
A multi-step authentication process involving a gateway device and an authentication server to verify the device and gateway through multiple rounds of authentication requests and responses, ensuring correct binding and improving network security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If only remote authentication by authentication server is performed, then networking simplicity is maintained, but device-gateway binding security deteriorates due to lack of near-end verification
Solution Approach 1:
The authentication process is segmented into two independent phases: remote authentication (between device and authentication server) and near-end authentication (between device and gateway). Each phase performs verification independently, ensuring that device-gateway binding security is not compromised by relying solely on remote authentication. The gateway generates and verifies authentication information locally, creating a separate security layer.
Solution Approach 2:
The gateway acts as an intermediary that receives authentication information from the device and independently verifies it against generated reference information. This intermediary verification step ensures that even if remote authentication succeeds, the device is correctly bound to the intended gateway, preventing unauthorized binding while maintaining networking simplicity.
2Reliability
If multi-step authentication process is implemented, then device-gateway binding security is improved, but authentication complexity increases
Solution Approach 1:
The near-end authentication process merges multiple verification steps into a unified flow: the gateway generates authentication information, sends it to the device, receives the device's authentication response, and verifies it locally. This combined approach strengthens security without requiring separate complex protocols, as all authentication activities are integrated into a single coordinated process between gateway and device.
Solution Approach 2:
The gateway performs preliminary actions by pre-generating authentication information and reference information before the actual authentication exchange. This preliminary preparation simplifies the subsequent verification step, as the gateway already has the reference data needed to quickly verify the device's authentication response, reducing the perceived complexity during the actual authentication moment.
3Reliability
If gateway generates and verifies authentication information locally, then near-end confirmation is achieved, but communication overhead increases
Solution Approach 1:
The authentication verification function is extracted from the remote authentication server and placed locally in the gateway. This extraction allows the gateway to independently verify device authentication without requiring continuous communication with the authentication server, reducing communication overhead. The gateway generates and verifies authentication information locally, minimizing the quantity of data that needs to be transmitted while achieving near-end confirmation.
Data Source
AI summary
The method includes a gateway device sending a first authentication request and a second authentication request to a first device. The gateway device obtains a third authentication request from the first device, where the third authentication request is used by the gateway device to verify the first device based on the first identification code and third authentication information. The gateway device sends a fourth authentication request to the first authentication server. The gateway device obtains first confirmation information, second confirmation information, third confirmation information, and fourth confirmation information, and establishes a communication connection between the first device and the gateway device based on all the confirmation information.