Decentralized Blockchain Identity Management for IoT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Identity and Access Management (IAM) solutions for IoT devices are centralized, lacking automation and compliance with GDPR regulations, and require significant computing and storage resources, which are not feasible for all IoT objects.
Innovation Solution
A decentralized communication method using a blockchain database for secure key and identity management, where symmetric keys are generated and shared by manufacturers, and object identities are registered and updated on a blockchain, enabling secure access to digital services and transferring ownership rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized IAM solutions are used for IoT device management, then security and access control are improved, but computing power requirements and storage capacity increase significantly
Solution Approach 1:
The patent segments the centralized IAM system into distributed blockchain nodes, where each node independently validates and stores identity information. This segmentation eliminates the need for a single powerful centralized server, allowing IoT devices to interact with lighter node implementations while maintaining security through distributed consensus mechanisms.
Solution Approach 2:
The blockchain acts as an intermediary layer between IoT devices and service providers, handling the computationally intensive tasks of cryptographic verification and identity management. This mediator approach allows resource-constrained IoT devices to offload security-critical operations to the blockchain network, reducing their local computing requirements while maintaining strong security guarantees.
2Reliability
If centralized IAM solutions are used for IoT device management, then security and access control are improved, but data storage requirements increase
Solution Approach 1:
The patent divides the storage burden across multiple blockchain nodes rather than concentrating all identity data in a single centralized repository. Each node stores a portion of the distributed ledger, spreading the storage requirements thin enough to be manageable by the network as a whole while maintaining the security benefits of centralized verification.
Solution Approach 2:
The blockchain creates replicated copies of identity data across multiple nodes in the network. Instead of requiring one massive centralized storage system, the patent uses numerous smaller copies distributed throughout the network, each sufficient for local verification operations. This copying strategy reduces the storage burden on any single system while maintaining security through redundancy.
3Reliability
If manual enrollment processes are used for IoT devices, then security and authentication are improved, but automation and efficiency deteriorate
Solution Approach 1:
The patent enables IoT devices to perform self-enrollment by automatically generating their own cryptographic key pairs and registering their identities with the blockchain network. This self-service capability eliminates the need for manual enrollment processes while maintaining strong authentication security, as each device independently creates its own security credentials and registers them on the distributed ledger.
Solution Approach 2:
The blockchain infrastructure is pre-configured with the necessary smart contracts and validation rules to automatically process device enrollment requests. This preliminary setup allows devices to self-register without manual intervention, as the system already contains the automated verification and registration logic needed to handle incoming enrollment requests securely and efficiently.
4Ease of operation
If traditional IAM solutions are used, then service provider control is improved, but GDPR compliance and data ownership deteriorate
Solution Approach 1:
The patent inverts the traditional IAM model by placing data ownership and control with the IoT devices and users rather than with service providers. Instead of service providers centrally managing user identities and data, the blockchain gives each device and user direct control over their own identity information, enabling them to grant and revoke access permissions autonomously. This inversion aligns with GDPR principles by empowering individuals with control over their personal data while still allowing service providers to operate efficiently within the decentralized framework.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a communication method for the secure management of keys and identities of an object manufactured by a manufacturer possessing a manufacturer key pair (Ksman, Kpman) and a customer possessing a customer key pair (Ksclient, Kpclient), characterized in that the management is at least partially performed on a decentralized blockchain database, and that the method comprises the following steps: a) Generation by the manufacturer of two diversified symmetric keys from its key pair and diversifiers, then sharing said keys with the object; b) Publication and recording in the blockchain database of the decentralized identifier (DID) of the object and preferably the encryption of the diversifiers and association to form the information DID - Enc(Kpman, DIVc∥DIV_ID). And, when a customer purchases the object from said manufacturer,The process includes the following initialization steps: c) Provision by the Object Manufacturer of the object, the object identifier (DID), and the symmetric keys; d) Update of the blockchain. - And, when the object is powered on for the first time, the object self-enrolls according to the following steps: e) Generation of its new symmetric keys by diversifying its old keys; f) Self-enrollment of the object is performed by a cryptographic challenge; g) Sending by the object to the client the two new diversifiers encrypted with the client's public key; h) Publication and recording of said new diversifiers encrypted with the client's public key in the blockchain.