Blockchain Certificate Revocation for Secure IoT Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized architectures in IoT networks are vulnerable to attacks, allowing malicious devices to gain access and compromise network security, leading to potential data theft or network disruption.
Innovation Solution
A computer-implemented method using blockchain transactions to revoke access to IoT networks by generating and revoking digital certificates for nodes and devices that fail connection attempts exceeding a threshold, ensuring secure communication and preventing malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized architecture is used to authenticate and authorize nodes in IoT network, then ease of operation is improved, but reliability deteriorates due to vulnerability to attacks and single point of failure
Solution Approach 1:
The patent segments the centralized authentication authority into distributed blockchain nodes. Each node maintains a copy of the certificate ledger and can independently validate certificates, eliminating the single point of failure while maintaining authentication functionality through distributed consensus mechanisms.
Solution Approach 2:
The patent introduces a blockchain-based certificate issuance and revocation mechanism as an intermediary layer between nodes. This mediator uses cryptographic proofs and smart contracts to automate authentication and authorization, replacing manual centralized control with automated decentralized verification.
2Reliability
If digital certificates are stored in blockchain for access control, then reliability is improved through immutable records, but device complexity increases due to blockchain integration requirements
Solution Approach 1:
The patent uses cryptographic hashing to create compact representations of certificate data stored on blockchain. Nodes store and verify only the hash values and essential certificate fields locally, while the complete immutable certificate records reside on the distributed blockchain ledger, reducing local storage requirements and complexity.
Solution Approach 2:
The patent designs the blockchain certificate system to serve multiple functions: authentication, authorization, revocation, and audit logging. A single blockchain infrastructure supports all these security functions, eliminating the need for separate systems and reducing overall device complexity despite the added blockchain layer.
3Reliability
If certificate revocation is implemented through blockchain transactions, then reliability is improved by preventing unauthorized access, but loss of time increases due to transaction propagation and validation
Solution Approach 1:
The patent implements preliminary binding of certificates to blockchain transaction outputs before they are spent. When a certificate is issued, it creates an unspent transaction output (UTXO) that serves as the certificate. Revocation is achieved by spending this UTXO, which immediately invalidates the certificate across all nodes that have validated the transaction, enabling rapid revocation propagation.
Solution Approach 2:
The patent replaces traditional certificate revocation list (CRL) mechanisms with blockchain-based UTXO spending. Instead of periodically distributing revocation lists that require synchronization and validation, the system uses the inherent immutability and propagation of blockchain transactions to instantly revoke certificates, substituting mechanical CRL distribution with cryptographic proof of revocation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for revoking access to a first network, wherein the first network comprises a set of bridging nodes and a set of devices controllable by one or more of the set of bridging nodes, wherein each bridging node is also a respective node of a blockchain network, and wherein each bridging node and device is associated with a respective certificate granting access to the first network; the method being performed by a registration authority and comprising: obtaining an alert transaction, the alert transaction being a blockchain transaction and comprising a first output, the first output comprising an alert message identifying one or more bridging nodes and/or one or more devices; and revoking access to the first network by the identified one or more bridging nodes and/or one or more devices by revoking the respective certificate of the identified one or more bridging nodes and/or one or more devices.